[Help-gnutls] Equivalent to fdopen?

[Brian Lavender]

I am trying to take a simple socket program and convert it to use
gnutls. Is there an equivalent to fdopen so I can stream my secured
socket as an fstream?

int sock_fd;
FILE *sock_fpi;

sock_fd = accept( sock_id, (struct sockaddr *) &sa_cli, &client_len );

sock_fpi = fdopen( sock_fd, "r" ))

But when I attempt to convert it to use gnutls, I run into the
following.

sock_fd = accept( sock_id, (struct sockaddr *) &sa_cli, &client_len );

session = initialize_tls_session ();

gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sock_fd );

ret = gnutls_handshake (session);

And, it appears that I can only read using the following command.

ret = gnutls_record_recv (session, buffer, MAX_BUF);

Any sugguestions? Is there an fdopen equivalent, so I can still use the
fgets and friends? Or, do I have to write my own buffering routine?

brian


#include <stdio.h>
#include <stdlib.h>

#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <time.h>
#include <string.h>
#include <gnutls/gnutls.h>
#include <gcrypt.h> /* for gcry_control */

#define PORTNUM 15000
#define HOSTLEN 256
#define DH_BITS 2048
#define oops(msg) { perror(msg); exit(1); }

#define KEYFILE "key.pem"
#define CERTFILE "cert.pem"
#define CAFILE "ca.pem"
#define CRLFILE "crl.pem"

/* These are global */
gnutls_certificate_credentials_t x509_cred;
gnutls_priority_t priority_cache;

gnutls_session_t
initialize_tls_session (void)
{
  gnutls_session_t session;

  gnutls_init (&session, GNUTLS_SERVER);

  gnutls_priority_set (session, priority_cache);

  gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, x509_cred);

  /* request client certificate if any.
   */
  gnutls_certificate_server_set_request (session, GNUTLS_CERT_REQUEST);
  
  /* Set maximum compatibility mode. This is only suggested on public webservers
   * that need to trade security for compatibility
   */
  gnutls_session_enable_compatibility_mode( session);

  return session;
}

static gnutls_dh_params_t dh_params;

static int
generate_dh_params (void)
{

  /* Generate Diffie Hellman parameters - for use with DHE
   * kx algorithms. When short bit length is used, it might
   * be wise to regenerate parameters.
   *
   * Check the ex-serv-export.c example for using static
   * parameters.
   */
  gnutls_dh_params_init (&dh_params);
  gnutls_dh_params_generate2 (dh_params, DH_BITS);

  return 0;
}


int main(int ac, char *av[] )
{
  int ret; // return value
        struct sockaddr_in saddr;
        struct sockaddr_in sa_cli;
        int client_len;
        struct hostent *hp;
        char hostname[HOSTLEN];
        int sock_id, sock_fd;
        FILE *sock_fpi, *sock_fpo;
        FILE *pipe_fp;
        char topbuf[512];
        char dirname[BUFSIZ];
        char command[BUFSIZ];
        int dirlen, c;
        gnutls_session_t session;


        /* to disallow usage of the blocking /dev/random 
         */
        /*      gcry_control (GCRYCTL_ENABLE_QUICK_RANDOM, 0);*/
        
        /* this must be called once in the program
         */
        gnutls_global_init ();

        gnutls_certificate_allocate_credentials (&x509_cred);
        gnutls_certificate_set_x509_trust_file (x509_cred, CAFILE,
                                                GNUTLS_X509_FMT_PEM);

        gnutls_certificate_set_x509_crl_file (x509_cred, CRLFILE,
                                              GNUTLS_X509_FMT_PEM);

        gnutls_certificate_set_x509_key_file (x509_cred, CERTFILE, KEYFILE,
                                              GNUTLS_X509_FMT_PEM);

        generate_dh_params ();

        gnutls_priority_init( &priority_cache, "NORMAL", NULL);


        gnutls_certificate_set_dh_params (x509_cred, dh_params);



        
        /* step 1 */
        
        sock_id = socket( PF_INET, SOCK_STREAM, 0 );
        if ( sock_id == -1 )
                oops("socket");

        /* step 2 */

        bzero( (void *)&saddr, sizeof(saddr) );
        gethostname( hostname, HOSTLEN );
        hp = gethostbyname( hostname );

//      bcopy( (void *)hp->h_addr, (void *)&saddr.sin_addr, hp->h_length);

        saddr.sin_addr.s_addr = INADDR_ANY;
        
        saddr.sin_port = htons(PORTNUM);
        saddr.sin_family = AF_INET;
        
        if( bind(sock_id, (struct sockaddr *)&saddr, sizeof(saddr)) != 0 )
                oops( "bind" );



        /* step 3 */

        if ( listen(sock_id, 1) != 0 )
                oops("listen");

        printf ("Server ready. Listening to port '%d'.\n\n", PORTNUM);

        /* main loop: accept, write, close */

        client_len = sizeof (sa_cli);

        while(1) 
        {
                session = initialize_tls_session ();

                sock_fd = accept( sock_id, (struct sockaddr *) &sa_cli, 
&client_len );
                if ( sock_fd == -1 )
                        oops("accept");

                printf ("- connection from %s, port %d\n",
                        inet_ntop (AF_INET, &sa_cli.sin_addr, topbuf,
                                   sizeof (topbuf)), ntohs (sa_cli.sin_port));

                gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) 
sock_fd );

                ret = gnutls_handshake (session);
                if (ret < 0)
                  {
                    close (sock_fd);
                    gnutls_deinit (session);
                    fprintf (stderr, "*** Handshake has failed (%s)\n\n",
                             gnutls_strerror (ret));
                    continue;
                  }
                printf ("- Handshake was completed\n");

                /* STOP here. PARE aca. :) Now we have a tls_session that 
                   we read from. It's not
                   a file descriptor anymore. Can't use fdopen on session :( */
                

                /* open reading direction as buffered stream */
                if ( ( sock_fpi = fdopen( sock_fd, "r" )) == NULL )
                        oops("fdopen reading ");

                if ( fgets( dirname, BUFSIZ - 5, sock_fpi) == NULL )
                        oops("reading dirname");
                sanitize(dirname);

                /* open writing direction as buffered stream */
                if ( (sock_fpo = fdopen(sock_fd,"w")) == NULL )
                        oops("fdopen writing");

                sprintf( command, "ls %s", dirname);

                if ( (pipe_fp = popen(command, "r")) == NULL)
                        oops("popen");

                /* transfer data from ls to socket */

                while ( ( c = getc(pipe_fp)) != EOF )
                        putc( c , sock_fpo );

                pclose(pipe_fp);
                fclose(sock_fpo);
                fclose(sock_fpi);

        }

        return 0;
}

sanitize( char *str )
{
        char *src, *dest;
        
        for( src = dest = str; *src; src++ )
                if ( *src == '/' || isalnum(*src) )
                        *dest++ = *src;

        *dest = '\0';
}
                
-- 
Brian Lavender
http://www.brie.com/brian/