/*

 * Copyright (C) 2000-2016 Free Software Foundation, Inc.

 * Copyright (C) 2013-2016 Nikos Mavrogiannopoulos

 * Copyright (C) 2015-2017 Red Hat, Inc.

 *

 * This file is part of GnuTLS.

 *

 * GnuTLS is free software: you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation, either version 3 of the License, or

 * (at your option) any later version.

 *

 * GnuTLS is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>.

 */

#include <config.h>

#include <stdio.h>

#include <errno.h>

#include <stdlib.h>

#include <sys/types.h>

#include <string.h>

#include <sys/time.h>

#include <sys/stat.h>

#if HAVE_SYS_SOCKET_H

#include <sys/socket.h>

#elif HAVE_WS2TCPIP_H

#include <ws2tcpip.h>

#endif

#include <sys/select.h>

#include <unistd.h>

#include <stdint.h>

#include <stdbool.h>

#include <fcntl.h>

#include <netdb.h>

#include <ctype.h>

#include <assert.h>

/* Get TCP_FASTOPEN */

#ifdef HAVE_NETINET_TCP_H

#include <netinet/tcp.h>

#endif

#include <gnutls/gnutls.h>

#include <gnutls/abstract.h>

#include <gnutls/dtls.h>

#include <gnutls/x509.h>

#include <gnutls/pkcs11.h>

#include <gnutls/crypto.h>

#include <gnutls/socket.h>

/* Gnulib portability files. */

#include <read-file.h>

#include <getpass.h>

#include <minmax.h>

#include "sockets.h"

#include "benchmark.h"

#include "inline_cmds.h"

#ifdef HAVE_DANE

#include <gnutls/dane.h>

#endif

#include <common.h>

#include <socket.h>

#include <cli-args.h>

#include <ocsptool-common.h>

#define MAX_BUF 4096

/* global stuff here */

int resume, starttls, insecure, ranges, rehandshake, udp, mtu,

    inline_commands, waitresumption;

unsigned int global_vflags = 0;

char *hostname = NULL;

char service[32]="";

int record_max_size;

int crlf;

int fastopen;

unsigned int verbose = 0;

int print_cert;

const char *srp_passwd = NULL;

const char *srp_username = NULL;

const char *x509_keyfile = NULL;

const char *x509_certfile = NULL;

const char *x509_cafile = NULL;

const char *x509_crlfile = NULL;

static int x509ctype;

const char *rawpk_keyfile = NULL;

const char *rawpk_file = NULL;

static int disable_extensions;

static int disable_sni;

static unsigned int init_flags = GNUTLS_CLIENT | GNUTLS_ENABLE_RAWPK;

static const char *priorities = NULL;

static const char *inline_commands_prefix;

const char *psk_username = NULL;

gnutls_datum_t psk_key = { NULL, 0 };

static gnutls_srp_client_credentials_t srp_cred;

static gnutls_psk_client_credentials_t psk_cred;

static gnutls_anon_client_credentials_t anon_cred;

static gnutls_certificate_credentials_t xcred;

/* end of global stuff */

/* prototypes */

static void check_server_cmd(socket_st * socket, int ret);

static void init_global_tls_stuff(void);

static int cert_verify_ocsp(gnutls_session_t session);

#define MAX_CRT 6

static unsigned int x509_crt_size;

static gnutls_pcert_st x509_crt[MAX_CRT];

static gnutls_privkey_t x509_key = NULL;

static gnutls_pcert_st rawpk;

static gnutls_privkey_t rawpk_key = NULL;

/* Load a PKCS #8, PKCS #12 private key or PKCS #11 URL

 */

static void load_priv_key(gnutls_privkey_t* privkey, const char* key_source)

{

	int ret;

	gnutls_datum_t data = { NULL, 0 };

	ret = gnutls_privkey_init(privkey);

	if (ret < 0) {

		fprintf(stderr, "*** Error initializing key: %s\n",

			gnutls_strerror(ret));

		exit(1);

	}

	gnutls_privkey_set_pin_function(*privkey, pin_callback,

					NULL);

	if (gnutls_url_is_supported(key_source) != 0) {

		ret = gnutls_privkey_import_url(*privkey, key_source, 0);

		if (ret < 0) {

			fprintf(stderr,

				"*** Error loading url: %s\n",

				gnutls_strerror(ret));

			exit(1);

		}

	} else {

		ret = gnutls_load_file(key_source, &data);

		if (ret < 0) {

			fprintf(stderr,

				"*** Error loading key file.\n");

			exit(1);

		}

		ret = gnutls_privkey_import_x509_raw(*privkey, &data,

		                                     x509ctype, NULL, 0);

		if (ret < 0) {

			fprintf(stderr,

				"*** Error importing key: %s\n",

				gnutls_strerror(ret));

			exit(1);

		}

		gnutls_free(data.data);

	}

}

/* Load the X509 certificate and the private key.

 */

static void load_x509_keys(void)

{

	unsigned int crt_num;

	int ret;

	unsigned int i;

	gnutls_datum_t data = { NULL, 0 };

	gnutls_x509_crt_t crt_list[MAX_CRT];

	if (x509_certfile != NULL && x509_keyfile != NULL) {

#ifdef ENABLE_PKCS11

		if (strncmp(x509_certfile, "pkcs11:", 7) == 0) {

			crt_num = 1;

			ret = gnutls_x509_crt_init(&crt_list[0]);

			if (ret < 0) {

				fprintf(stderr, "Memory error\n");

				exit(1);

			}

			gnutls_x509_crt_set_pin_function(crt_list[0],

							 pin_callback,

							 NULL);

			ret =

			    gnutls_x509_crt_import_pkcs11_url(crt_list[0],

							      x509_certfile,

							      0);

			if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)

				ret =

				    gnutls_x509_crt_import_pkcs11_url

				    (crt_list[0], x509_certfile,

				     GNUTLS_PKCS11_OBJ_FLAG_LOGIN);

			if (ret < 0) {

				fprintf(stderr,

					"*** Error loading cert file.\n");

				exit(1);

			}

			x509_crt_size = 1;

		} else

#endif				/* ENABLE_PKCS11 */

		{

			ret = gnutls_load_file(x509_certfile, &data);

			if (ret < 0) {

				fprintf(stderr,

					"*** Error loading cert file.\n");

				exit(1);

			}

			crt_num = MAX_CRT;

			ret =

			    gnutls_x509_crt_list_import(crt_list, &crt_num,

							&data, x509ctype,

							GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED);

			if (ret < 0) {

				if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) {

					fprintf(stderr,

						"*** Error loading cert file: Too many certs %d\n",

						crt_num);

				} else {

					fprintf(stderr,

						"*** Error loading cert file: %s\n",

						gnutls_strerror(ret));

				}

				exit(1);

			}

			x509_crt_size = ret;

		}

		for (i = 0; i < x509_crt_size; i++) {

			ret =

			    gnutls_pcert_import_x509(&x509_crt[i],

						     crt_list[i], 0);

			if (ret < 0) {

				fprintf(stderr,

					"*** Error importing crt to pcert: %s\n",

					gnutls_strerror(ret));

				exit(1);

			}

			gnutls_x509_crt_deinit(crt_list[i]);

		}

		gnutls_free(data.data);

		load_priv_key(&x509_key, x509_keyfile);

		log_msg(stdout,

			"Processed %d client X.509 certificates...\n",

			x509_crt_size);

	}

}

/* Load the raw public key and corresponding private key.

 */

static void load_rawpk_keys(void)

{

	int ret;

	gnutls_datum_t data = { NULL, 0 };

	if (rawpk_file != NULL && rawpk_keyfile != NULL) {

		// First we load the raw public key

		ret = gnutls_load_file(rawpk_file, &data);

		if (ret < 0) {

			fprintf(stderr,

				"*** Error loading cert file.\n");

			exit(1);

		}

		ret = gnutls_pcert_import_rawpk_raw(&rawpk, &data, x509ctype, 0, 0);

		if (ret < 0) {

			fprintf(stderr,

			        "*** Error importing rawpk to pcert: %s\n",

			        gnutls_strerror(ret));

			exit(1);

		}

		gnutls_free(data.data);

		// Secondly, we load the private key corresponding to the raw pk

		load_priv_key(&rawpk_key, rawpk_keyfile);

		log_msg(stdout,

			"Processed %d client raw public key pair...\n",	1);

	}

}

#define IS_NEWLINE(x) ((x[0] == '\n') || (x[0] == '\r'))

static int read_yesno(const char *input_str)

{

	char input[128];

	fputs(input_str, stderr);

	if (fgets(input, sizeof(input), stdin) == NULL)

		return 0;

	if (IS_NEWLINE(input))

		return 0;

	if (input[0] == 'y' || input[0] == 'Y')

		return 1;

	return 0;

}

static void try_save_cert(gnutls_session_t session)

{

	const gnutls_datum_t *cert_list;

	unsigned int cert_list_size = 0;

	int ret;

	unsigned i;

	gnutls_datum_t t;

	FILE *fp;

	cert_list = gnutls_certificate_get_peers(session, &cert_list_size);

	if (cert_list_size == 0) {

		fprintf(stderr, "no certificates sent by server!\n");

		exit(1);

	}

	fp = fopen(OPT_ARG(SAVE_CERT), "w");

	if (fp == NULL) {

		fprintf(stderr, "could not open %s\n", OPT_ARG(SAVE_CERT));

		exit(1);

	}

	for (i=0;i

		ret = gnutls_pem_base64_encode_alloc("CERTIFICATE", &cert_list[i], &t);

		if (ret < 0) {

			fprintf(stderr, "error[%d]: %s\n", __LINE__,

				gnutls_strerror(ret));

			exit(1);

		}

		fwrite(t.data, t.size, 1, fp);

		gnutls_free(t.data);

	}

	fclose(fp);

	return;

}

static void try_save_ocsp_status(gnutls_session_t session)

{

	unsigned int cert_num = 0;

	gnutls_certificate_get_peers(session, &cert_num);

	if (cert_num == 0) {

		fprintf(stderr, "no certificates sent by server, so can't get OCSP status!\n");

		return;

	}

	const char *path;

	gnutls_x509_crt_fmt_t type;

	unsigned int max_out;

	/* This function is called if exactly one of SAVE_OCSP and

	 * SAVE_OCSP_MULTI is set. */

	if (HAVE_OPT(SAVE_OCSP))

	{

		path = OPT_ARG(SAVE_OCSP);

		type = GNUTLS_X509_FMT_DER;

		max_out = 1;

	} else {

		path = OPT_ARG(SAVE_OCSP_MULTI);

		type = GNUTLS_X509_FMT_PEM;

		max_out = cert_num;

	}

	FILE *fp = fopen(path, "w");

	if (fp == NULL) {

		fprintf(stderr, "could not open %s for writing\n", path);

		exit(1);

	}

	for (unsigned int i = 0; i < max_out; i++) {

		gnutls_datum_t oresp;

		int ret = gnutls_ocsp_status_request_get2(session, i, &oresp);

		if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {

			fprintf(stderr, "no OCSP response for certificate %u\n", i);

			continue;

		} else if (ret < 0) {

			fprintf(stderr, "error getting OCSP response %u: %s\n",

			        i, gnutls_strerror(ret));

			exit(1);

		}

		if (type == GNUTLS_X509_FMT_DER) {

			/* on success the return value is equal to the

			 * number of items (third parameter) */

			if (fwrite(oresp.data, oresp.size, 1, fp) != 1) {

				fprintf(stderr, "writing to %s failed\n", path);

				exit(1);

			}

			continue;

		}

		gnutls_datum_t t;

		ret = gnutls_pem_base64_encode_alloc("OCSP RESPONSE",

		                                     &oresp, &t);

		if (ret < 0) {

			fprintf(stderr, "error allocating PEM OCSP response: %s\n",

			        gnutls_strerror(ret));

			exit(1);

		}

		/* on success the return value is equal to the number

		 * of items (third parameter) */

		if (fwrite(t.data, t.size, 1, fp) != 1) {

			fprintf(stderr, "writing to %s failed\n", path);

			exit(1);

		}

		gnutls_free(t.data);

	}

	if (fclose(fp) != 0) {

		perror("failed to close OCSP save file");

	}

	return;

}

static int cert_verify_callback(gnutls_session_t session)

{

	int rc;

	unsigned int status = 0;

	int ssh = ENABLED_OPT(TOFU);

	int strictssh = ENABLED_OPT(STRICT_TOFU);

	int dane = ENABLED_OPT(DANE);

	int ca_verify = ENABLED_OPT(CA_VERIFICATION);

	const char *txt_service;

	const char *host;

	/* On an session with TOFU the PKI/DANE verification

	 * become advisory.

	 */

	if (strictssh) {

		ssh = strictssh;

	}

	if (HAVE_OPT(VERIFY_HOSTNAME)) {

		host = OPT_ARG(VERIFY_HOSTNAME);

		canonicalize_host((char *) host, NULL, 0);

	} else

		host = hostname;

	/* Save certificate and OCSP response */

	if (HAVE_OPT(SAVE_CERT)) {

		try_save_cert(session);

	}

#ifndef ENABLE_OCSP

	if (HAVE_OPT(SAVE_OCSP_MULTI) || HAVE_OPT(SAVE_OCSP) || HAVE_OPT(OCSP)) {

		fprintf(stderr, "OCSP is not supported!\n");

	}

#else

	if (HAVE_OPT(SAVE_OCSP_MULTI) || HAVE_OPT(SAVE_OCSP)) {

		try_save_ocsp_status(session);

	}

#endif

	print_cert_info(session, verbose, print_cert);

	if (ca_verify) {

		rc = cert_verify(session, host, GNUTLS_KP_TLS_WWW_SERVER);

		if (rc == 0) {

			log_msg

			    (stdout, "*** PKI verification of server certificate failed...\n");

			if (!insecure && !ssh)

				return -1;

		}

#ifdef ENABLE_OCSP

		else if (ENABLED_OPT(OCSP) && gnutls_ocsp_status_request_is_checked(session, 0) == 0) {	/* off-line verification succeeded. Try OCSP */

			rc = cert_verify_ocsp(session);

			if (rc == -1) {

				log_msg

				    (stdout, "*** Verifying (with OCSP) server certificate chain failed...\n");

				if (!insecure && !ssh)

					return -1;

			} else if (rc == 0)

				log_msg(stdout, "*** OCSP: nothing to check.\n");

			else

				log_msg(stdout, "*** OCSP: verified %d certificate(s).\n", rc);

		}

#endif

	}

	if (dane) {		/* try DANE auth */

#ifdef HAVE_DANE

		int port;

		unsigned vflags = 0;

		unsigned int sflags =

		    ENABLED_OPT(LOCAL_DNS) ? 0 :

		    DANE_F_IGNORE_LOCAL_RESOLVER;

		/* if we didn't verify the chain it only makes sense

		 * to check the end certificate using dane. */

		if (ca_verify == 0)

			vflags |= DANE_VFLAG_ONLY_CHECK_EE_USAGE;

		port = service_to_port(service, udp?"udp":"tcp");

		rc = dane_verify_session_crt(NULL, session, host,

					     udp ? "udp" : "tcp", port,

					     sflags, vflags, &status);

		if (rc < 0) {

			fprintf(stderr,

				"*** DANE verification error: %s\n",

				dane_strerror(rc));

			if (!insecure && !ssh)

				return -1;

		} else {

			gnutls_datum_t out;

			rc = dane_verification_status_print(status, &out,

							    0);

			if (rc < 0) {

				fprintf(stderr, "*** DANE error: %s\n",

					dane_strerror(rc));

			} else {

				fprintf(stderr, "- DANE: %s\n", out.data);

				gnutls_free(out.data);

			}

			if (status != 0 && !insecure && !ssh)

				return -1;

		}

#else

		fprintf(stderr, "*** DANE error: GnuTLS is not compiled with DANE support.\n");

		if (!insecure && !ssh)

			return -1;

#endif

	}

	if (ssh) {		/* try ssh auth */

		unsigned int list_size;

		const gnutls_datum_t *cert;

		cert = gnutls_certificate_get_peers(session, &list_size);

		if (cert == NULL) {

			fprintf(stderr,

				"Cannot obtain peer's certificate!\n");

			return -1;

		}

		txt_service = port_to_service(service, udp?"udp":"tcp");

		rc = gnutls_verify_stored_pubkey(NULL, NULL, host,

						 txt_service,

						 GNUTLS_CRT_X509, cert, 0);

		if (rc == GNUTLS_E_NO_CERTIFICATE_FOUND) {

			fprintf(stderr,

				"Host %s (%s) has never been contacted before.\n",

				host, txt_service);

			if (status == 0)

				fprintf(stderr,

					"Its certificate is valid for %s.\n",

					host);

			if (strictssh)

				return -1;

			rc = read_yesno

			    ("Are you sure you want to trust it? (y/N): ");

			if (rc == 0)

				return -1;

		} else if (rc == GNUTLS_E_CERTIFICATE_KEY_MISMATCH) {

			fprintf(stderr,

				"Warning: host %s is known and it is associated with a different key.\n",

				host);

			fprintf(stderr,

				"It might be that the server has multiple keys, or an attacker replaced the key to eavesdrop this connection .\n");

			if (status == 0)

				fprintf(stderr,

					"Its certificate is valid for %s.\n",

					host);

			if (strictssh)

				return -1;

			rc = read_yesno

				("Do you trust the received key? (y/N): ");

			if (rc == 0)

				return -1;

		} else if (rc < 0) {

			fprintf(stderr,

				"gnutls_verify_stored_pubkey: %s\n",

				gnutls_strerror(rc));

			return -1;

		}

		if (rc != 0) {

			rc = gnutls_store_pubkey(NULL, NULL, host,

						 txt_service,

						 GNUTLS_CRT_X509, cert, 0,

						 0);

			if (rc < 0)

				fprintf(stderr,

					"Could not store key: %s\n",

					gnutls_strerror(rc));

		}

	}

	return 0;

}

/* This callback should be associated with a session by calling

 * gnutls_certificate_client_set_retrieve_function( session, cert_callback),

 * before a handshake.

 */

static int

cert_callback(gnutls_session_t session,

	      const gnutls_datum_t * req_ca_rdn, int nreqs,

	      const gnutls_pk_algorithm_t * sign_algos,

	      int sign_algos_length, gnutls_pcert_st ** pcert,

	      unsigned int *pcert_length, gnutls_privkey_t * pkey)

{

	char issuer_dn[256];

	int i, ret, cert_type;

	size_t len;

	if (verbose) {

		/* Print the server's trusted CAs

		 */

		if (nreqs > 0)

			log_msg(stdout, "- Server's trusted authorities:\n");

		else

			log_msg

			    (stdout, "- Server did not send us any trusted authorities names.\n");

		/* print the names (if any) */

		for (i = 0; i < nreqs; i++) {

			len = sizeof(issuer_dn);

			ret =

			    gnutls_x509_rdn_get(&req_ca_rdn[i], issuer_dn,

						&len;;

			if (ret >= 0) {

				log_msg(stdout, "   [%d]: ", i);

				log_msg(stdout, "%s\n", issuer_dn);

			}

		}

	}

	/* Select a certificate and return it.

	 * The certificate must be of any of the "sign algorithms"

	 * supported by the server.

	 */

	cert_type = gnutls_certificate_type_get2(session, GNUTLS_CTYPE_CLIENT);

	*pcert_length = 0;

	switch (cert_type) {

		case GNUTLS_CRT_X509:

			if (x509_crt_size > 0) {

				if (x509_key != NULL) {

					*pkey = x509_key;

				} else {

					log_msg

					      (stdout, "- Could not find a suitable key to send to server\n");

					return -1;

				}

				*pcert_length = x509_crt_size;

				*pcert = x509_crt;

			}

			break;

		case GNUTLS_CRT_RAWPK:

			if (rawpk_key == NULL || rawpk.type != GNUTLS_CRT_RAWPK) {

				log_msg

				      (stdout, "- Could not find a suitable key to send to server\n");

				return -1;

			}

			*pkey = rawpk_key;

			*pcert = &rawpk;

			*pcert_length = 1;

			break;

		default:

			log_msg(stdout, "- Could not retrieve unsupported certificate type %s.\n",

	       gnutls_certificate_type_get_name(cert_type));

	    return -1;

	}

	log_msg(stdout, "- Successfully sent %u certificate(s) to server.\n",

	       *pcert_length);

	return 0;

}

/* initializes a gnutls_session_t with some defaults.

 */

gnutls_session_t init_tls_session(const char *host)

{

	const char *err;

	int ret;

	unsigned i;

	gnutls_session_t session;

	if (udp) {

		gnutls_init(&session, GNUTLS_DATAGRAM | init_flags);

		if (mtu)

			gnutls_dtls_set_mtu(session, mtu);

	} else

		gnutls_init(&session, init_flags);

	if (priorities == NULL) {

		ret = gnutls_set_default_priority(session);

		if (ret < 0) {

			fprintf(stderr, "Error in setting priorities: %s\n",

					gnutls_strerror(ret));

			exit(1);

		}

	} else {

		ret = gnutls_priority_set_direct(session, priorities, &err;;

		if (ret < 0) {

			if (ret == GNUTLS_E_INVALID_REQUEST)

				fprintf(stderr, "Syntax error at: %s\n", err);

			else

				fprintf(stderr, "Error in priorities: %s\n",

					gnutls_strerror(ret));

			exit(1);

		}

	}

	/* allow the use of private ciphersuites.

	 */

	if (disable_extensions == 0 && disable_sni == 0) {

		if (HAVE_OPT(SNI_HOSTNAME)) {

			const char *sni_host = OPT_ARG(SNI_HOSTNAME);

			canonicalize_host((char *) sni_host, NULL, 0);

			gnutls_server_name_set(session, GNUTLS_NAME_DNS, sni_host, strlen(sni_host));

		} else if (host != NULL && is_ip(host) == 0)

			gnutls_server_name_set(session, GNUTLS_NAME_DNS,

					       host, strlen(host));

	}

	if (HAVE_OPT(DH_BITS)) {

#if defined(ENABLE_DHE) || defined(ENABLE_ANON)

		gnutls_dh_set_prime_bits(session, OPT_VALUE_DH_BITS);

#else

		fprintf(stderr, "Setting DH parameters is not supported\n");

		exit(1);

#endif

	}

	if (HAVE_OPT(ALPN)) {

#ifndef ENABLE_ALPN

		fprintf(stderr, "ALPN is not supported\n");

		exit(1);

#else

		unsigned proto_n = STACKCT_OPT(ALPN);

		char **protos = (void *) STACKLST_OPT(ALPN);

		if (proto_n > 1024) {

			fprintf(stderr, "Number of ALPN protocols too large (%d)\n",

					proto_n);

			exit(1);

		}

		gnutls_datum_t p[1024];

		for (i = 0; i < proto_n; i++) {

			p[i].data = (void *) protos[i];

			p[i].size = strlen(protos[i]);

		}

		gnutls_alpn_set_protocols(session, p, proto_n, 0);

#endif

	}

	gnutls_credentials_set(session, GNUTLS_CRD_ANON, anon_cred);

	if (srp_cred)

		gnutls_credentials_set(session, GNUTLS_CRD_SRP, srp_cred);

	if (psk_cred)

		gnutls_credentials_set(session, GNUTLS_CRD_PSK, psk_cred);

	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);

	gnutls_certificate_set_retrieve_function2(xcred, cert_callback);

	gnutls_certificate_set_verify_function(xcred,

					       cert_verify_callback);

	/* use the max record size extension */

	if (record_max_size > 0 && disable_extensions == 0) {

		if (gnutls_record_set_max_size(session, record_max_size) <

		    0) {

			fprintf(stderr,

				"Cannot set the maximum record size to %d.\n",

				record_max_size);

			fprintf(stderr,

				"Possible values: 512, 1024, 2048, 4096.\n");

			exit(1);

		}

	}

	if (HAVE_OPT(HEARTBEAT))

		gnutls_heartbeat_enable(session,

					GNUTLS_HB_PEER_ALLOWED_TO_SEND);

#ifdef ENABLE_DTLS_SRTP

	if (HAVE_OPT(SRTP_PROFILES)) {

		ret =

		    gnutls_srtp_set_profile_direct(session,

						   OPT_ARG(SRTP_PROFILES),

						   &err;;

		if (ret == GNUTLS_E_INVALID_REQUEST)

			fprintf(stderr, "Syntax error at: %s\n", err);

		else if (ret != 0)

			fprintf(stderr, "Error in profiles: %s\n",

				gnutls_strerror(ret));

		else fprintf(stderr,"DTLS profile set to %s\n",

			     OPT_ARG(SRTP_PROFILES));

		if (ret != 0) exit(1);

	}

#endif

	return session;

}

static void cmd_parser(int argc, char **argv);

/* Returns zero if the error code was successfully handled.

 */

static int handle_error(socket_st * hd, int err)

{

	int alert, ret;

	const char *err_type, *str;

	if (err >= 0 || err == GNUTLS_E_AGAIN

	    || err == GNUTLS_E_INTERRUPTED)

		return 0;

	if (gnutls_error_is_fatal(err) == 0) {

		ret = 0;

		err_type = "Non fatal";

	} else {

		ret = err;

		err_type = "Fatal";

	}

	str = gnutls_strerror(err);

	if (str == NULL)

		str = str_unknown;

	fprintf(stderr, "*** %s error: %s\n", err_type, str);

	if (err == GNUTLS_E_WARNING_ALERT_RECEIVED

	    || err == GNUTLS_E_FATAL_ALERT_RECEIVED) {

		alert = gnutls_alert_get(hd->session);

		str = gnutls_alert_get_name(alert);

		if (str == NULL)

			str = str_unknown;

		log_msg(stdout, "*** Received alert [%d]: %s\n", alert, str);

	}

	check_server_cmd(hd, err);

	return ret;

}

int starttls_alarmed = 0;

#ifndef _WIN32