void dh_info(FILE * infile, FILE * outfile, common_info_st * ci) { gnutls_datum_t params; size_t size; int ret, ret2; gnutls_dh_params_t dh_params; gnutls_datum_t p, g; unsigned int q_bits = 0; fix_lbuffer(0); if (gnutls_dh_params_init(&dh_params) < 0) { fprintf(stderr, "Error in dh parameter initialization\n"); exit(1); } params.data = (void *) fread_file(infile, &size); params.size = size; ret = gnutls_dh_params_import_pkcs3(dh_params, ¶ms, ci->incert_format); if (ret < 0) { /* Try DSA */ ret2 = import_dsa_dh(dh_params, ¶ms, ci->incert_format); if (ret2 < 0) { fprintf(stderr, "Error parsing dh params: %s\n", gnutls_strerror(ret)); exit(1); } } ret = gnutls_dh_params_export_raw(dh_params, &p, &g, &q_bits); if (ret < 0) { fprintf(stderr, "Error exporting parameters: %s\n", gnutls_strerror(ret)); exit(1); } if (ci->outcert_format == GNUTLS_X509_FMT_PEM) print_dh_info(outfile, &p, &g, q_bits, ci->cprint); if (!ci->cprint) { /* generate a PKCS#3 structure */ size_t len = lbuffer_size; ret = gnutls_dh_params_export_pkcs3(dh_params, ci->outcert_format, lbuffer, &len); if (ret == 0) { if (ci->outcert_format == GNUTLS_X509_FMT_PEM) { fprintf(outfile, "\n%s", lbuffer); } else { fwrite(lbuffer, 1, len, outfile); } } else { fprintf(stderr, "Error: %s\n", gnutls_strerror(ret)); } } gnutls_free(p.data); gnutls_free(g.data); gnutls_dh_params_deinit(dh_params); }
int print_info (gnutls_session_t session, const char *hostname, int insecure) { const char *tmp; gnutls_credentials_type_t cred; gnutls_kx_algorithm_t kx; /* print the key exchange's algorithm name */ kx = gnutls_kx_get (session); cred = gnutls_auth_get_type (session); switch (cred) { #ifdef ENABLE_ANON case GNUTLS_CRD_ANON: print_dh_info (session, "Anonymous "); break; #endif #ifdef ENABLE_SRP case GNUTLS_CRD_SRP: /* This should be only called in server * side. */ if (gnutls_srp_server_get_username (session) != NULL) printf ("- SRP authentication. Connected as '%s'\n", gnutls_srp_server_get_username (session)); break; #endif #ifdef ENABLE_PSK case GNUTLS_CRD_PSK: /* This returns NULL in server side. */ if (gnutls_psk_client_get_hint (session) != NULL) printf ("- PSK authentication. PSK hint '%s'\n", gnutls_psk_client_get_hint (session)); /* This returns NULL in client side. */ if (gnutls_psk_server_get_username (session) != NULL) printf ("- PSK authentication. Connected as '%s'\n", gnutls_psk_server_get_username (session)); if (kx == GNUTLS_KX_DHE_PSK) print_dh_info (session, "Ephemeral "); break; #endif case GNUTLS_CRD_IA: printf ("- TLS/IA authentication\n"); break; case GNUTLS_CRD_CERTIFICATE: { char dns[256]; size_t dns_size = sizeof (dns); unsigned int type; /* This fails in client side */ if (gnutls_server_name_get (session, dns, &dns_size, &type, 0) == 0) { printf ("- Given server name[%d]: %s\n", type, dns); } } if (kx == GNUTLS_KX_DHE_RSA || kx == GNUTLS_KX_DHE_DSS) print_dh_info (session, "Ephemeral "); print_cert_info (session, hostname, insecure); print_cert_vrfy (session); } tmp = SU (gnutls_protocol_get_name (gnutls_protocol_get_version (session))); printf ("- Version: %s\n", tmp); tmp = SU (gnutls_kx_get_name (kx)); printf ("- Key Exchange: %s\n", tmp); tmp = SU (gnutls_cipher_get_name (gnutls_cipher_get (session))); printf ("- Cipher: %s\n", tmp); tmp = SU (gnutls_mac_get_name (gnutls_mac_get (session))); printf ("- MAC: %s\n", tmp); tmp = SU (gnutls_compression_get_name (gnutls_compression_get (session))); printf ("- Compression: %s\n", tmp); if (verbose) { char id[32]; size_t id_size = sizeof (id); gnutls_session_get_id (session, id, &id_size); printf ("- Session ID: %s\n", raw_to_string (id, id_size)); } fflush (stdout); return 0; }
/* If how is zero then the included parameters are used. */ int generate_prime(FILE * outfile, int how, common_info_st * info) { int ret; gnutls_dh_params_t dh_params; gnutls_datum_t p, g; int bits = get_bits(GNUTLS_PK_DH, info->bits, info->sec_param, 1); unsigned int q_bits = 0, key_bits = 0; fix_lbuffer(0); gnutls_dh_params_init(&dh_params); if (how != 0) { fprintf(stderr, "Generating DH parameters (%d bits)...\n", bits); fprintf(stderr, "(might take long time)\n"); } else fprintf(stderr, "Retrieving DH parameters...\n"); if (how != 0) { if (info->provable != 0) { gnutls_x509_privkey_t pkey; unsigned save; ret = gnutls_x509_privkey_init(&pkey); if (ret < 0) { fprintf(stderr, "Error initializing key: %s\n", gnutls_strerror(ret)); exit(1); } if (info->seed_size > 0) { gnutls_keygen_data_st data; if (info->seed_size < 32) { fprintf(stderr, "For DH parameter generation a 32-byte seed value or larger is expected (have: %d); use -d 2 for more information.\n", (int)info->seed_size); exit(1); } data.type = GNUTLS_KEYGEN_SEED; data.data = (void*)info->seed; data.size = info->seed_size; ret = gnutls_x509_privkey_generate2(pkey, GNUTLS_PK_DSA, bits, GNUTLS_PRIVKEY_FLAG_PROVABLE, &data, 1); } else { ret = gnutls_x509_privkey_generate(pkey, GNUTLS_PK_DSA, bits, GNUTLS_PRIVKEY_FLAG_PROVABLE); } if (ret < 0) { fprintf(stderr, "Error generating DSA parameters: %s\n", gnutls_strerror(ret)); exit(1); } if (info->outcert_format == GNUTLS_X509_FMT_PEM) { save = info->no_compat; info->no_compat = 1; print_private_key(outfile, info, pkey); info->no_compat = save; } ret = gnutls_dh_params_import_dsa(dh_params, pkey); if (ret < 0) { fprintf(stderr, "Error importing DSA parameters: %s\n", gnutls_strerror(ret)); exit(1); } gnutls_x509_privkey_deinit(pkey); } else { ret = gnutls_dh_params_generate2(dh_params, bits); if (ret < 0) { fprintf(stderr, "Error generating parameters: %s\n", gnutls_strerror(ret)); exit(1); } } ret = gnutls_dh_params_export_raw(dh_params, &p, &g, &q_bits); if (ret < 0) { fprintf(stderr, "Error exporting parameters: %s\n", gnutls_strerror(ret)); exit(1); } } else { if (info->provable != 0) { fprintf(stderr, "The DH parameters obtained via this option are not provable\n"); exit(1); } #if defined(ENABLE_DHE) || defined(ENABLE_ANON) if (bits <= 2048) { p = gnutls_ffdhe_2048_group_prime; g = gnutls_ffdhe_2048_group_generator; key_bits = gnutls_ffdhe_2048_key_bits; bits = 2048; } else if (bits <= 3072) { p = gnutls_ffdhe_3072_group_prime; g = gnutls_ffdhe_3072_group_generator; key_bits = gnutls_ffdhe_3072_key_bits; bits = 3072; } else if (bits <= 4096) { p = gnutls_ffdhe_4096_group_prime; g = gnutls_ffdhe_4096_group_generator; key_bits = gnutls_ffdhe_4096_key_bits; bits = 4096; } else { p = gnutls_ffdhe_8192_group_prime; g = gnutls_ffdhe_8192_group_generator; key_bits = gnutls_ffdhe_8192_key_bits; bits = 8192; } ret = gnutls_dh_params_import_raw2(dh_params, &p, &g, key_bits); if (ret < 0) { fprintf(stderr, "Error exporting parameters: %s\n", gnutls_strerror(ret)); exit(1); } #elif defined(ENABLE_SRP) if (bits <= 1024) { p = gnutls_srp_1024_group_prime; g = gnutls_srp_1024_group_generator; bits = 1024; } else if (bits <= 1536) { p = gnutls_srp_1536_group_prime; g = gnutls_srp_1536_group_generator; bits = 1536; } else if (bits <= 2048) { p = gnutls_srp_2048_group_prime; g = gnutls_srp_2048_group_generator; bits = 2048; } else if (bits <= 3072) { p = gnutls_srp_3072_group_prime; g = gnutls_srp_3072_group_generator; bits = 3072; } else { p = gnutls_srp_4096_group_prime; g = gnutls_srp_4096_group_generator; bits = 4096; } ret = gnutls_dh_params_import_raw(dh_params, &p, &g); if (ret < 0) { fprintf(stderr, "Error exporting parameters: %s\n", gnutls_strerror(ret)); exit(1); } #else fprintf(stderr, "Parameters unavailable as SRP is disabled.\n"); exit(1); #endif } if (info->outcert_format == GNUTLS_X509_FMT_PEM) print_dh_info(outfile, &p, &g, q_bits, info->cprint); if (!info->cprint) { /* generate a PKCS#3 structure */ size_t len = lbuffer_size; ret = gnutls_dh_params_export_pkcs3(dh_params, info->outcert_format, lbuffer, &len); if (ret == 0) { if (info->outcert_format == GNUTLS_X509_FMT_PEM) fprintf(outfile, "\n%s", lbuffer); else fwrite(lbuffer, 1, len, outfile); } else { fprintf(stderr, "Error: %s\n", gnutls_strerror(ret)); } } if (how != 0) { gnutls_free(p.data); gnutls_free(g.data); } gnutls_dh_params_deinit(dh_params); return 0; }
int print_info (gnutls_session_t session, const char *hostname, int insecure) { const char *tmp; gnutls_credentials_type_t cred; gnutls_kx_algorithm_t kx; /* print the key exchange's algorithm name */ kx = gnutls_kx_get (session); cred = gnutls_auth_get_type (session); switch (cred) { #ifdef ENABLE_ANON case GNUTLS_CRD_ANON: print_dh_info (session, "Anonymous "); break; #endif #ifdef ENABLE_SRP case GNUTLS_CRD_SRP: /* This should be only called in server * side. */ if (gnutls_srp_server_get_username (session) != NULL) printf ("- SRP authentication. Connected as '%s'\n", gnutls_srp_server_get_username (session)); break; #endif #ifdef ENABLE_PSK case GNUTLS_CRD_PSK: /* This returns NULL in server side. */ if (gnutls_psk_client_get_hint (session) != NULL) printf ("- PSK authentication. PSK hint '%s'\n", gnutls_psk_client_get_hint (session)); /* This returns NULL in client side. */ if (gnutls_psk_server_get_username (session) != NULL) printf ("- PSK authentication. Connected as '%s'\n", gnutls_psk_server_get_username (session)); if (kx == GNUTLS_KX_DHE_PSK) print_dh_info (session, "Ephemeral "); break; #endif case GNUTLS_CRD_IA: printf ("- TLS/IA authentication\n"); break; case GNUTLS_CRD_CERTIFICATE: { char dns[256]; size_t dns_size = sizeof (dns); unsigned int type; /* This fails in client side */ if (gnutls_server_name_get (session, dns, &dns_size, &type, 0) == 0) { printf ("- Given server name[%d]: %s\n", type, dns); } } if (kx == GNUTLS_KX_DHE_RSA || kx == GNUTLS_KX_DHE_DSS) print_dh_info (session, "Ephemeral "); print_cert_info (session, hostname, insecure); print_cert_vrfy (session); } tmp = SU (gnutls_protocol_get_name (gnutls_protocol_get_version (session))); printf ("- Version: %s\n", tmp); tmp = SU (gnutls_kx_get_name (kx)); printf ("- Key Exchange: %s\n", tmp); tmp = SU (gnutls_cipher_get_name (gnutls_cipher_get (session))); printf ("- Cipher: %s\n", tmp); tmp = SU (gnutls_mac_get_name (gnutls_mac_get (session))); printf ("- MAC: %s\n", tmp); tmp = SU (gnutls_compression_get_name (gnutls_compression_get (session))); printf ("- Compression: %s\n", tmp); if (verbose) { char id[32]; size_t id_size = sizeof (id); gnutls_session_get_id (session, id, &id_size); printf ("- Session ID: %s\n", raw_to_string (id, id_size)); } if (verbose) { gnutls_datum cb; int rc; rc = gnutls_session_channel_binding (session, GNUTLS_CB_TLS_UNIQUE, &cb); if (rc) fprintf (stderr, "Channel binding error: %s\n", gnutls_strerror (rc)); else { size_t i; printf ("- Channel binding 'tls-unique': "); for (i = 0; i < cb.size; i++) printf ("%02x", cb.data[i]); printf ("\n"); } } /* Warning: Do not print anything more here. The 'Compression:' output MUST be the last non-verbose output. This is used by Emacs starttls.el code. */ fflush (stdout); return 0; }