2
#include <sys/types.h> //socket, setsockopt, bind, listen, accept,
4
#include <sys/socket.h> //socket, setsockopt, bind, listen, accept,
6
#include <sys/ioctl.h> //ioctl, sockaddr_ll, ifreq
7
#include <unistd.h> //write, close
8
#include <netinet/ip.h> // sockaddr_in
9
#include <gnutls/gnutls.h>
10
#include <gnutls/x509.h> // gnutls_x509_crt_init, gnutls_x509_crt_import, gnutls_x509_crt_get_dn
11
#include <arpa/inet.h> // inet_ntop, htons
12
#include <net/if.h> //ifreq
18
#include <algorithm> // std::max
19
#include <cstdlib> // exit()
20
#include <fstream> // std::ifstream
21
#include <string> // std::string
22
#include <map> // std::map
23
#include <iostream> // cout
24
#include <ostream> // <<
26
#define SOCKET_ERR(err,s) if(err<0) {perror(s);exit(1);}
29
#define KEYFILE "key.pem"
30
#define CERTFILE "cert.pem"
31
#define CAFILE "ca.pem"
32
#define CRLFILE "crl.pem"
40
/* These are global */
41
gnutls_certificate_credentials_t x509_cred;
42
map<string,string> table;
44
static gnutls_dh_params_t dh_params;
50
/* Generate Diffie Hellman parameters - for use with DHE
51
* kx algorithms. These should be discarded and regenerated
52
* once a day, once a week or once a month. Depending on the
53
* security requirements.
55
gnutls_dh_params_init (&dh_params);
56
gnutls_dh_params_generate2 (dh_params, DH_BITS);
62
initialize_tls_session ()
64
gnutls_session_t session;
66
gnutls_global_init ();
68
gnutls_certificate_allocate_credentials (&x509_cred);
69
gnutls_certificate_set_x509_trust_file (x509_cred, CAFILE,
71
gnutls_certificate_set_x509_crl_file (x509_cred, CRLFILE,
73
gnutls_certificate_set_x509_key_file (x509_cred, CERTFILE, KEYFILE,
76
generate_dh_params ();
77
gnutls_certificate_set_dh_params (x509_cred, dh_params);
79
gnutls_init (&session, GNUTLS_SERVER);
80
gnutls_set_default_priority (session);
81
gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, x509_cred);
83
// request client certificate if any.
85
gnutls_certificate_server_set_request (session, GNUTLS_CERT_REQUEST);
86
gnutls_dh_set_prime_bits (session, DH_BITS);
92
void udpreply(int &sd){
93
struct sockaddr_in6 sa_cli;
98
socklen_t sa_cli_len = sizeof(sa_cli);
99
ret = recvfrom(sd, buffer, 512,0,
100
reinterpret_cast<sockaddr *>(& sa_cli), & sa_cli_len);
101
SOCKET_ERR (ret, "recvfrom");
104
if (strncmp(buffer,"Marco", 5) == 0){
105
ret = sendto(sd, "Polo", 4, 0, reinterpret_cast<sockaddr *>(& sa_cli),
107
SOCKET_ERR (ret, "sendto");
112
void tcpreply(int sd, struct sockaddr_in6 *sa_cli, gnutls_session_t session){
120
#define DIE(s){ exit_status = s; goto tcpreply_die; }
122
printf ("- TCP connection from %s, port %d\n",
123
inet_ntop (AF_INET6, &(sa_cli->sin6_addr), buffer,
124
sizeof (buffer)), ntohs (sa_cli->sin6_port));
127
gnutls_transport_set_ptr (session, reinterpret_cast<gnutls_transport_ptr_t> (sd));
130
ret = gnutls_handshake (session);
134
gnutls_deinit (session);
135
fprintf (stderr, "*** Handshake has failed (%s)\n\n",
136
gnutls_strerror (ret));
139
printf ("- Handshake was completed\n");
143
if (gnutls_certificate_type_get (session) != GNUTLS_CRT_X509){
144
printf("Recived certificate not X.509\n");
148
const gnutls_datum_t *cert_list;
149
unsigned int cert_list_size = 0;
150
gnutls_x509_crt_t cert;
153
cert_list = gnutls_certificate_get_peers (session, &cert_list_size);
155
printf ("Peer provided %d certificates.\n", cert_list_size);
157
if (cert_list_size == 0){
158
printf("No certificates recived\n");
162
gnutls_x509_crt_init (&cert);
164
// XXX -Checking only first cert, might want to check them all
165
gnutls_x509_crt_import (cert, &cert_list[0], GNUTLS_X509_FMT_DER);
168
gnutls_x509_crt_get_dn (cert, dn, &size);
170
printf ("DN: %s\n", dn);
173
ret = gnutls_certificate_verify_peers2 (session, &status);
176
printf ("Verify failed\n");
180
if (status & (GNUTLS_CERT_INVALID | GNUTLS_CERT_SIGNER_NOT_FOUND | GNUTLS_CERT_REVOKED)) {
181
if (status & GNUTLS_CERT_INVALID) {
182
printf ("The certificate is not trusted.\n");
185
if (status & GNUTLS_CERT_SIGNER_NOT_FOUND){
186
printf ("The certificate hasn't got a known issuer.\n");
189
if (status & GNUTLS_CERT_REVOKED){
190
printf ("The certificate has been revoked.\n");
195
if (table.find(dn) != table.end()){
196
gnutls_record_send (session, table[dn].c_str(), table[dn].size());
197
printf("Password sent to client\n");
200
printf("dn not in list of allowed clients\n");
205
gnutls_bye (session, GNUTLS_SHUT_WR);
207
gnutls_deinit (session);
208
gnutls_certificate_free_credentials (x509_cred);
209
gnutls_global_deinit ();
214
void badconfigparser(string file){
219
ifstream infile (file.c_str());
222
getline(infile, dn, '\n');
226
getline(infile, pw, '\n');
230
getline(infile, pwfile, '\n');
235
ifstream pwf(pwfile.c_str());
243
pw = pw + tmp + '\n';
255
int ret, err, udp_listen_sd, tcp_listen_sd;
256
struct sockaddr_in6 sa_serv;
257
struct sockaddr_in6 sa_cli;
260
socklen_t client_len;
262
gnutls_session_t session;
266
badconfigparser(string("clients.conf"));
268
session = initialize_tls_session ();
270
//UDP IPv6 socket creation
271
udp_listen_sd = socket (PF_INET6, SOCK_DGRAM, 0);
272
SOCKET_ERR (udp_listen_sd, "socket");
274
memset (&sa_serv, '\0', sizeof (sa_serv));
275
sa_serv.sin6_family = AF_INET6;
276
sa_serv.sin6_addr = in6addr_any; //XXX only listen to link local?
277
sa_serv.sin6_port = htons (PORT); /* Server Port number */
279
ret = setsockopt (udp_listen_sd, SOL_SOCKET, SO_REUSEADDR, &optval, sizeof (optval));
280
SOCKET_ERR(ret,"setsockopt reuseaddr");
282
ret = setsockopt(udp_listen_sd, SOL_SOCKET, SO_BINDTODEVICE, "eth0", 5);
283
SOCKET_ERR(ret,"setsockopt bindtodevice");
287
ret = setsockopt(udp_listen_sd, SOL_SOCKET, SO_BROADCAST, & flag, sizeof(flag));
288
SOCKET_ERR(ret,"setsockopt broadcast");
291
err = bind (udp_listen_sd, reinterpret_cast<const sockaddr *> (& sa_serv),
293
SOCKET_ERR (err, "bind");
295
//UDP socket creation done
298
//TCP IPv6 socket creation
300
tcp_listen_sd = socket(PF_INET6, SOCK_STREAM, 0);
301
SOCKET_ERR(tcp_listen_sd,"socket");
303
setsockopt(tcp_listen_sd, SOL_SOCKET, SO_BINDTODEVICE, "eth0", 5);
304
SOCKET_ERR(ret,"setsockopt bindtodevice");
306
ret = setsockopt (tcp_listen_sd, SOL_SOCKET, SO_REUSEADDR, &optval, sizeof (optval));
307
SOCKET_ERR(ret,"setsockopt reuseaddr");
309
err = bind (tcp_listen_sd, reinterpret_cast<const sockaddr *> (& sa_serv),
311
SOCKET_ERR (err, "bind");
313
err = listen (tcp_listen_sd, 1024);
314
SOCKET_ERR (err, "listen");
316
//TCP IPv6 sockets creation done
319
FD_SET(udp_listen_sd, &rfds_orig);
320
FD_SET(tcp_listen_sd, &rfds_orig);
322
printf ("Server ready. Listening to port '%d' on UDP and TCP.\n\n", PORT);
325
fd_set rfds = rfds_orig;
327
ret = select(std::max(udp_listen_sd, tcp_listen_sd)+1, &rfds, 0, 0, 0);
328
SOCKET_ERR(ret,"select");
330
if (FD_ISSET(udp_listen_sd, &rfds)){
331
udpreply(udp_listen_sd);
334
if (FD_ISSET(tcp_listen_sd, &rfds)){
335
client_len = sizeof(sa_cli);
336
int sd = accept (tcp_listen_sd,
337
reinterpret_cast<struct sockaddr *> (& sa_cli),
339
SOCKET_ERR(sd,"accept"); //xxx not dieing when just connection abort
342
tcpreply(sd, &sa_cli, session);
347
close(tcp_listen_sd);
348
close(udp_listen_sd);
357
close(tcp_listen_sd);
358
close(udp_listen_sd);
added
removed
server.cpp
