@node GnuTLS application examples
@chapter GnuTLS application examples
@anchor{examples}
@cindex example programs
@cindex examples
In this chapter several examples of real-world use cases are listed.
The examples are simplified to promote readability and contain little or
no error checking.
@menu
* Client examples::
* Server examples::
* More advanced client and servers::
* OCSP example::
* Miscellaneous examples::
@end menu
@node Client examples
@section Client examples
This section contains examples of @acronym{TLS} and @acronym{SSL}
clients, using @acronym{GnuTLS}. Note that some of the examples require functions
implemented by another example.
@menu
* Client example with X.509 certificate support::
* Datagram TLS client example::
* Client using a smart card with TLS::
* Client with Resume capability example::
* Client example with SSH-style certificate verification::
@end menu
@node Client example with X.509 certificate support
@subsection Client example with @acronym{X.509} certificate support
@anchor{ex-verify}
Let's assume now that we want to create a TCP client which
communicates with servers that use @acronym{X.509} certificate authentication.
The following client is a very simple @acronym{TLS} client, which uses
the high level verification functions for certificates, but does not support session
resumption.
Note that this client utilizes functionality present in the latest GnuTLS
version. For a reasonably portable version see @ref{Legacy client example with X.509 certificate support}.
@verbatiminclude examples/ex-client-x509.c
@node Datagram TLS client example
@subsection Datagram @acronym{TLS} client example
This is a client that uses @acronym{UDP} to connect to a
server. This is the @acronym{DTLS} equivalent to the TLS example
with X.509 certificates.
@verbatiminclude examples/ex-client-dtls.c
@node Client using a smart card with TLS
@subsection Using a smart card with TLS
@anchor{ex-pkcs11-client}
@cindex Smart card example
This example will demonstrate how to load keys and certificates
from a smart-card or any other @acronym{PKCS} #11 token, and
use it in a TLS connection. The difference between this and the
@ref{Client example with X.509 certificate support} is that the
client keys are provided as PKCS #11 URIs instead of files.
@verbatiminclude examples/ex-cert-select-pkcs11.c
@node Client with Resume capability example
@subsection Client with resume capability example
@anchor{ex-resume-client}
This is a modification of the simple client example. Here we
demonstrate the use of session resumption. The client tries to connect
once using @acronym{TLS}, close the connection and then try to
establish a new connection using the previously negotiated data.
@verbatiminclude examples/ex-client-resume.c
@node Client example with SSH-style certificate verification
@subsection Client example with SSH-style certificate verification
This is an alternative verification function that will use the
X.509 certificate authorities for verification, but also assume an
trust on first use (SSH-like) authentication system. That is the user is
prompted on unknown public keys and known public keys are considered
trusted.
@verbatiminclude examples/ex-verify-ssh.c
@node Server examples
@section Server examples
This section contains examples of @acronym{TLS} and @acronym{SSL}
servers, using @acronym{GnuTLS}.
@menu
* Echo server with X.509 authentication::
* DTLS echo server with X.509 authentication::
@end menu
@node Echo server with X.509 authentication
@subsection Echo server with @acronym{X.509} authentication
This example is a very simple echo server which supports
@acronym{X.509} authentication.
@verbatiminclude examples/ex-serv-x509.c
@node DTLS echo server with X.509 authentication
@subsection DTLS echo server with @acronym{X.509} authentication
This example is a very simple echo server using Datagram TLS and
@acronym{X.509} authentication.
@verbatiminclude examples/ex-serv-dtls.c
@node More advanced client and servers
@section More advanced client and servers
This section has various, more advanced topics in client and servers.
@menu
* Client example with anonymous authentication::
* Using a callback to select the certificate to use::
* Obtaining session information::
* Advanced certificate verification example::
* Client example with PSK authentication::
* Client example with SRP authentication::
* Legacy client example with X.509 certificate support::
* Client example in C++::
* Echo server with PSK authentication::
* Echo server with SRP authentication::
* Echo server with anonymous authentication::
* Helper functions for TCP connections::
* Helper functions for UDP connections::
@end menu
@node Client example with anonymous authentication
@subsection Client example with anonymous authentication
The simplest client using TLS is the one that doesn't do any
authentication. This means no external certificates or passwords are
needed to set up the connection. As could be expected, the connection
is vulnerable to man-in-the-middle (active or redirection) attacks.
However, the data are integrity protected and encrypted from
passive eavesdroppers.
Note that due to the vulnerable nature of this method very few public
servers support it.
@verbatiminclude examples/ex-client-anon.c
@node Using a callback to select the certificate to use
@subsection Using a callback to select the certificate to use
There are cases where a client holds several certificate and key
pairs, and may not want to load all of them in the credentials
structure. The following example demonstrates the use of the
certificate selection callback.
@verbatiminclude examples/ex-cert-select.c
@node Obtaining session information
@subsection Obtaining session information
Most of the times it is desirable to know the security properties of
the current established session. This includes the underlying ciphers
and the protocols involved. That is the purpose of the following
function. Note that this function will print meaningful values only
if called after a successful @funcref{gnutls_handshake}.
@verbatiminclude examples/ex-session-info.c
@node Advanced certificate verification example
@subsection Advanced certificate verification
@anchor{ex-verify2}
An example is listed below which uses the high level verification
functions to verify a given certificate chain against a set of CAs
and CRLs.
@verbatiminclude examples/ex-verify.c
@node Client example with PSK authentication
@subsection Client example with @acronym{PSK} authentication
The following client is a very simple @acronym{PSK} @acronym{TLS}
client which connects to a server and authenticates using a
@emph{username} and a @emph{key}.
@verbatiminclude examples/ex-client-psk.c
@node Client example with SRP authentication
@subsection Client example with @acronym{SRP} authentication
The following client is a very simple @acronym{SRP} @acronym{TLS}
client which connects to a server and authenticates using a
@emph{username} and a @emph{password}. The server may authenticate
itself using a certificate, and in that case it has to be verified.
@verbatiminclude examples/ex-client-srp.c
@node Legacy client example with X.509 certificate support
@subsection Legacy client example with @acronym{X.509} certificate support
@anchor{ex-verify-legacy}
For applications that need to maintain compatibility with the GnuTLS 3.1.x
library, this client example is identical to @ref{Client example with X.509 certificate support}
but utilizes APIs that were available in GnuTLS 3.1.4.
@verbatiminclude examples/ex-client-x509-3.1.c
@node Client example in C++
@subsection Client example using the C++ API
The following client is a simple example of a client client utilizing
the GnuTLS C++ API.
@verbatiminclude examples/ex-cxx.cpp
@node Echo server with PSK authentication
@subsection Echo server with @acronym{PSK} authentication
This is a server which supports @acronym{PSK} authentication.
@verbatiminclude examples/ex-serv-psk.c
@node Echo server with SRP authentication
@subsection Echo server with @acronym{SRP} authentication
This is a server which supports @acronym{SRP} authentication. It is
also possible to combine this functionality with a certificate
server. Here it is separate for simplicity.
@verbatiminclude examples/ex-serv-srp.c
@node Echo server with anonymous authentication
@subsection Echo server with anonymous authentication
This example server supports anonymous authentication, and could be
used to serve the example client for anonymous authentication.
@verbatiminclude examples/ex-serv-anon.c
@node Helper functions for TCP connections
@subsection Helper functions for TCP connections
Those helper function abstract away TCP connection handling from the
other examples. It is required to build some examples.
@verbatiminclude examples/tcp.c
@node Helper functions for UDP connections
@subsection Helper functions for UDP connections
The UDP helper functions abstract away UDP connection handling from the
other examples. It is required to build the examples using UDP.
@verbatiminclude examples/udp.c
@node OCSP example
@section OCSP example
@anchor{Generate OCSP request}
@subheading Generate @acronym{OCSP} request
A small tool to generate OCSP requests.
@verbatiminclude examples/ex-ocsp-client.c
@node Miscellaneous examples
@section Miscellaneous examples
@menu
* Checking for an alert::
* X.509 certificate parsing example::
* Listing the ciphersuites in a priority string::
* PKCS12 structure generation example::
@end menu
@node Checking for an alert
@subsection Checking for an alert
This is a function that checks if an alert has been received in the
current session.
@verbatiminclude examples/ex-alert.c
@node X.509 certificate parsing example
@subsection @acronym{X.509} certificate parsing example
@anchor{ex-x509-info}
To demonstrate the @acronym{X.509} parsing capabilities an example program is
listed below. That program reads the peer's certificate, and prints
information about it.
@verbatiminclude examples/ex-x509-info.c
@node Listing the ciphersuites in a priority string
@subsection Listing the ciphersuites in a priority string
This is a small program to list the enabled ciphersuites by a
priority string.
@verbatiminclude examples/print-ciphersuites.c
@node PKCS12 structure generation example
@subsection PKCS #12 structure generation example
This small program demonstrates the usage of the PKCS #12 API, by generating
such a structure.
@verbatiminclude examples/ex-pkcs12.c