gloox  1.1-svn
tlsgnutlsserver.cpp
1 /*
2  Copyright (c) 2005-2009 by Jakob Schroeter <js@camaya.net>
3  This file is part of the gloox library. http://camaya.net/gloox
4 
5  This software is distributed under a license. The full license
6  agreement can be found in the file LICENSE in this distribution.
7  This software may not be copied, modified, sold or distributed
8  other than expressed in the named license agreement.
9 
10  This software is distributed without any warranty.
11 */
12 
13 
14 
15 #include "tlsgnutlsserver.h"
16 
17 #ifdef HAVE_GNUTLS
18 
19 #include <errno.h>
20 
21 namespace gloox
22 {
23 
25  : GnuTLSBase( th ), m_dhBits( 1024 )
26  {
27  }
28 
30  {
31  gnutls_certificate_free_credentials( m_x509cred );
32  gnutls_dh_params_deinit( m_dhParams );
33  }
34 
36  {
38  init();
39  }
40 
41  bool GnuTLSServer::init( const std::string& clientKey,
42  const std::string& clientCerts,
43  const StringList& cacerts )
44  {
45  const int protocolPriority[] = {
46 #ifdef GNUTLS_TLS1_2
47  GNUTLS_TLS1_2,
48 #endif
49  GNUTLS_TLS1_1, GNUTLS_TLS1, 0 };
50  const int kxPriority[] = { GNUTLS_KX_RSA, GNUTLS_KX_DHE_RSA, GNUTLS_KX_DHE_DSS, 0 };
51  const int cipherPriority[] = { GNUTLS_CIPHER_AES_256_CBC, GNUTLS_CIPHER_AES_128_CBC,
52  GNUTLS_CIPHER_3DES_CBC, GNUTLS_CIPHER_ARCFOUR, 0 };
53  const int compPriority[] = { GNUTLS_COMP_ZLIB, GNUTLS_COMP_NULL, 0 };
54  const int macPriority[] = { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, 0 };
55 
56  if( m_initLib && gnutls_global_init() != 0 )
57  return false;
58 
59  if( gnutls_certificate_allocate_credentials( &m_x509cred ) < 0 )
60  return false;
61 
62  setClientCert( clientKey, clientCerts );
63  setCACerts( cacerts );
64 
65  generateDH();
66  gnutls_certificate_set_dh_params( m_x509cred, m_dhParams );
67  gnutls_certificate_set_rsa_export_params( m_x509cred, m_rsaParams);
68 // gnutls_priority_init( &m_priorityCache, "NORMAL", 0 );
69 
70  if( gnutls_init( m_session, GNUTLS_SERVER ) != 0 )
71  return false;
72 
73 // gnutls_priority_set( m_session, m_priorityCache );
74  gnutls_protocol_set_priority( *m_session, protocolPriority );
75  gnutls_cipher_set_priority( *m_session, cipherPriority );
76  gnutls_compression_set_priority( *m_session, compPriority );
77  gnutls_kx_set_priority( *m_session, kxPriority );
78  gnutls_mac_set_priority( *m_session, macPriority );
79  gnutls_credentials_set( *m_session, GNUTLS_CRD_CERTIFICATE, m_x509cred );
80 
81  gnutls_certificate_server_set_request( *m_session, GNUTLS_CERT_REQUEST );
82 
83  gnutls_dh_set_prime_bits( *m_session, m_dhBits );
84 
85  gnutls_transport_set_ptr( *m_session, (gnutls_transport_ptr_t)this );
86  gnutls_transport_set_push_function( *m_session, pushFunc );
87  gnutls_transport_set_pull_function( *m_session, pullFunc );
88 
89  m_valid = true;
90  return true;
91  }
92 
93  void GnuTLSServer::setCACerts( const StringList& cacerts )
94  {
95  m_cacerts = cacerts;
96 
97  StringList::const_iterator it = m_cacerts.begin();
98  for( ; it != m_cacerts.end(); ++it )
99  gnutls_certificate_set_x509_trust_file( m_x509cred, (*it).c_str(), GNUTLS_X509_FMT_PEM );
100  }
101 
102  void GnuTLSServer::setClientCert( const std::string& clientKey, const std::string& clientCerts )
103  {
104  m_clientKey = clientKey;
105  m_clientCerts = clientCerts;
106 
107  if( !m_clientKey.empty() && !m_clientCerts.empty() )
108  {
109  gnutls_certificate_set_x509_key_file( m_x509cred,
110  m_clientCerts.c_str(),
111  m_clientKey.c_str(),
112  GNUTLS_X509_FMT_PEM );
113  }
114  }
115 
116 
117  void GnuTLSServer::generateDH()
118  {
119  gnutls_dh_params_init( &m_dhParams );
120  gnutls_dh_params_generate2( m_dhParams, m_dhBits );
121  gnutls_rsa_params_init( &m_rsaParams );
122  gnutls_rsa_params_generate2( m_rsaParams, 512 );
123  }
124 
125  void GnuTLSServer::getCertInfo()
126  {
127  m_certInfo.status = CertOk;
128 
129  const char* info;
130  info = gnutls_compression_get_name( gnutls_compression_get( *m_session ) );
131  if( info )
132  m_certInfo.compression = info;
133 
134  info = gnutls_mac_get_name( gnutls_mac_get( *m_session ) );
135  if( info )
136  m_certInfo.mac = info;
137 
138  info = gnutls_cipher_get_name( gnutls_cipher_get( *m_session ) );
139  if( info )
140  m_certInfo.cipher = info;
141 
142  info = gnutls_protocol_get_name( gnutls_protocol_get_version( *m_session ) );
143  if( info )
144  m_certInfo.protocol = info;
145 
146  m_valid = true;
147  }
148 
149 }
150 
151 #endif // HAVE_GNUTLS