added :

* configure.ac support for --with-gnutls=PFX
* TLS connection handler in daemon.c
* simple TLS echo client server example

3 files changed, 364 insertions, 3 deletions

diff --git a/src/examples/Makefile.am b/src/examples/Makefile.am
index 3d693b23..340f7824 100644
--- a/src/examples/Makefile.am
+++ b/src/examples/Makefile.am
@@ -1,10 +1,16 @@
 SUBDIRS  = .
 
-INCLUDES = -I$(top_srcdir)/src/include
+AM_CPPFLAGS = -I$(top_srcdir)/src/include 
 
 # example programs
 
-noinst_PROGRAMS = minimal_example querystring_example fileserver_example fileserver_example_external_select
+noinst_PROGRAMS = \
+https_server_example \
+https_echo_client_example \
+minimal_example \
+querystring_example \
+fileserver_example \
+fileserver_example_external_select
 
 minimal_example_SOURCES = \
  minimal_example.c 
@@ -21,9 +27,29 @@ fileserver_example_SOURCES = \
 fileserver_example_LDADD = \
  $(top_builddir)/src/daemon/libmicrohttpd.la 
 
-
 fileserver_example_external_select_SOURCES = \
  fileserver_example_external_select.c 
 fileserver_example_external_select_LDADD = \
  $(top_builddir)/src/daemon/libmicrohttpd.la 
 
+https_server_example_CPPFLAGS = \
+ $(GNUTLS_CPPFLAGS) \
+ -I$(top_srcdir)/src/daemon
+https_server_example_SOURCES = \
+ https_server_example.c
+https_server_example_LDADD = \
+ $(top_builddir)/src/daemon/libmicrohttpd.la
+https_server_example_LDFLAGS = \
+ -L$(GNUTLS_LIB_PATH) \
+ -lgnutls
+ 
+https_echo_client_example_CPPFLAGS = \
+ $(GNUTLS_CPPFLAGS) \
+ -I$(top_srcdir)/src/daemon
+https_echo_client_example_SOURCES = \
+ https_echo_client_example.c
+https_echo_client_example_LDADD = \
+ $(top_builddir)/src/daemon/libmicrohttpd.la
+https_echo_client_example_LDFLAGS = \
+ -L$(GNUTLS_LIB_PATH) \
+ -lgnutls
diff --git a/src/examples/https_echo_client_example.c b/src/examples/https_echo_client_example.c
new file mode 100644
index 00000000..04e26c74
--- /dev/null
+++ b/src/examples/https_echo_client_example.c
@@ -0,0 +1,153 @@
+/*
+ This file is part of libmicrohttpd
+ (C) 2007 Christian Grothoff
+
+ libmicrohttpd is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published
+ by the Free Software Foundation; either version 2, or (at your
+ option) any later version.
+
+ libmicrohttpd is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with libmicrohttpd; see the file COPYING.  If not, write to the
+ Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ Boston, MA 02111-1307, USA.
+ */
+
+/**
+ * @file https_echo_client.c
+ * @brief a simple echo client to use in conjuction with the echo TLS server. 
+ * @author LV-426
+ */
+
+#if HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <arpa/inet.h>
+#include <unistd.h>
+#include <gnutls/gnutls.h>
+
+#define MAX_BUF 1024
+#define SA struct sockaddr
+#define MSG "GET / HTTP/1.0\r\n\r\n"
+
+extern int tcp_connect (void);
+extern void tcp_close (int sd);
+
+int
+main (int argc, char **argv)
+{
+  int ret, sd, ii, err;
+  gnutls_session_t session;
+  char buffer[MAX_BUF + 1];
+  gnutls_anon_client_credentials_t anoncred;
+
+  struct sockaddr_in servaddr4;
+  const struct sockaddr *servaddr;
+  struct sockaddr_in sa;
+  socklen_t addrlen;
+
+  if (argc < 2)
+    {
+      printf ("Usage : %s SERVER-PORT\n", argv[0]);
+      return 1;
+    }
+
+  gnutls_global_init ();
+
+  gnutls_anon_allocate_client_credentials (&anoncred);
+
+  /* Initialize TLS session */
+  gnutls_init (&session, GNUTLS_CLIENT);
+
+  /* Use default priorities */
+  gnutls_priority_set_direct (session, "PERFORMANCE:+ANON-DH:!ARCFOUR-128",
+                              NULL);
+
+  /* put the anonymous credentials to the current session */
+  gnutls_credentials_set (session, GNUTLS_CRD_ANON, anoncred);
+
+  sd = socket (AF_INET, SOCK_STREAM, 0);
+  memset (&sa, '\0', sizeof (sa));
+  sa.sin_family = AF_INET;
+  sa.sin_port = htons (atoi (argv[1]));
+  inet_pton (AF_INET, "127.0.0.1", &sa.sin_addr);
+
+  /* connect to the peer */
+  err = connect (sd, (struct sockaddr *) &sa, sizeof (sa));
+  if (err < 0)
+    {
+      fprintf (stderr, "Connect error\n");
+      exit (1);
+    }
+
+  gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
+
+  /* Perform the TLS handshake */
+  ret = gnutls_handshake (session);
+
+  if (ret < 0)
+    {
+      fprintf (stderr, "*** Handshake failed\n");
+      gnutls_perror (ret);
+      goto end;
+    }
+  else
+    {
+      printf ("- Handshake was completed\n");
+    }
+
+  for (;;)
+    {
+       /**/ scanf ("%s", buffer);
+
+      if (strcmp (buffer, "exit") == 0)
+        {
+          gnutls_record_send (session, buffer, strlen (MSG));
+          break;
+        }
+      gnutls_record_send (session, buffer, strlen (MSG));
+
+      ret = gnutls_record_recv (session, buffer, MAX_BUF);
+      if (ret == 0)
+        {
+          printf ("- Peer has closed the TLS connection\n");
+          goto end;
+        }
+      else if (ret < 0)
+        {
+          fprintf (stderr, "*** Error: %s\n", gnutls_strerror (ret));
+          break;
+        }
+
+      printf ("- Received %d bytes: ", ret);
+      for (ii = 0; ii < ret; ii++)
+        {
+          fputc (buffer[ii], stdout);
+        }
+      fputs ("\n", stdout);
+    }
+
+end:
+
+  shutdown (sd, SHUT_RDWR);
+  close (sd);
+
+  gnutls_deinit (session);
+
+  gnutls_anon_free_client_credentials (anoncred);
+
+  gnutls_global_deinit ();
+
+  return 0;
+}
diff --git a/src/examples/https_server_example.c b/src/examples/https_server_example.c
new file mode 100644
index 00000000..709f8502
--- /dev/null
+++ b/src/examples/https_server_example.c
@@ -0,0 +1,182 @@
+/*
+ This file is part of libmicrohttpd
+ (C) 2007 Christian Grothoff
+
+ libmicrohttpd is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published
+ by the Free Software Foundation; either version 2, or (at your
+ option) any later version.
+
+ libmicrohttpd is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with libmicrohttpd; see the file COPYING.  If not, write to the
+ Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ Boston, MA 02111-1307, USA.
+ */
+
+/**
+ * @file https_server_example.c
+ * @brief a simple echo server using TLS. echo input from client until 'exit' message is received. 
+ * @author LV-426
+ */
+
+#include "config.h"
+#include <microhttpd.h>
+#include "internal.h"
+
+#include <stdlib.h>
+#ifndef MINGW
+#include <unistd.h>
+#endif
+#include <string.h>
+#include <stdio.h>
+#include <gnutls/gnutls.h>
+
+#define DH_BITS 1024
+#define MAX_BUF 1024
+/* server credintials */
+gnutls_anon_server_credentials_t anoncred;
+
+/* server Diffie-Hellman parameters */
+static gnutls_dh_params_t dh_params;
+
+
+/* Generate Diffie Hellman parameters - for use with DHE kx algorithms. */
+static int
+generate_dh_params (void)
+{
+
+  gnutls_dh_params_init (&dh_params);
+  gnutls_dh_params_generate2 (dh_params, DH_BITS);
+  return 0;
+}
+
+gnutls_session_t
+initialize_tls_session (void)
+{
+  gnutls_session_t session;
+
+  gnutls_init (&session, GNUTLS_SERVER);
+
+  gnutls_priority_set_direct (session, "NORMAL:+ANON-DH", NULL);
+
+  gnutls_credentials_set (session, GNUTLS_CRD_ANON, anoncred);
+
+  gnutls_dh_set_prime_bits (session, DH_BITS);
+
+  return session;
+}
+
+/* Accept Policy Callback */
+static int
+TLS_echo (void *cls,
+          struct MHD_Connection *connection,
+          const char *url,
+          const char *method,
+          const char *upload_data,
+          const char *version, unsigned int *upload_data_size, void **ptr)
+{
+  gnutls_session_t session;
+  static int aptr;
+  struct MHD_Response *response;
+  char buffer[MAX_BUF + 1];
+  int ret;
+
+  printf ("accepted connection from %d\n", connection->addr->sin_addr);
+
+  session = initialize_tls_session ();
+
+  gnutls_transport_set_ptr (session, connection->socket_fd);
+
+  ret = gnutls_handshake (session);
+  if (ret < 0)
+    {
+      /* set connection as closed */
+      connection->socket_fd = 1;
+      gnutls_deinit (session);
+      fprintf (stderr, "*** Handshake has failed (%s)\n\n",
+               gnutls_strerror (ret));
+      return MHD_NO;
+    }
+
+  printf ("TLS Handshake completed\n");
+  connection->state = MHDS_HANDSHAKE_COMPLETE;
+
+  /* simple echo loop. message encryption/decryption is acheived through 'gnutls_record_send'
+   *  & gnutls_record_recv calls. */
+  for (;;)
+    {
+      memset (buffer, 0, MAX_BUF + 1);
+      ret = gnutls_record_recv (session, buffer, MAX_BUF);
+
+      if (ret < 0)
+        {
+          fprintf (stderr, "\n*** Received corrupted "
+                   "data(%d). Closing the connection.\n\n", ret);
+          break;
+        }
+      else if (ret >= 0)
+        {
+          if (strcmp (buffer, "exit") == 0)
+            {
+              printf ("\n- Peer has closed the GNUTLS connection\n");
+              break;
+            }
+          else
+            {
+              /* echo data back to the client */
+              gnutls_record_send (session, buffer, strlen (buffer));
+            }
+        }
+    }
+  printf ("\n");
+
+  /* mark connection as closed */
+  connection->socket_fd = -1;
+
+  gnutls_deinit (session);
+
+  return ret;
+}
+
+int
+main (int argc, char *const *argv)
+{
+  struct MHD_Daemon *daemon;
+  struct MHD_Daemon *TLS_daemon;
+
+  /* look for HTTPS port argument */
+  if (argc < 4)
+    {
+      printf ("Usage : %s HTTP-PORT SECONDS-TO-RUN HTTPS-PORT\n", argv[0]);
+      return 1;
+    }
+
+  gnutls_global_init ();
+
+  gnutls_anon_allocate_server_credentials (&anoncred);
+
+  generate_dh_params ();
+
+  gnutls_anon_set_server_dh_params (anoncred, dh_params);
+
+  TLS_daemon = MHD_start_daemon (MHD_USE_THREAD_PER_CONNECTION
+                                  | MHD_USE_DEBUG | MHD_USE_SSL,
+                                  atoi (argv[3]), NULL, NULL, &TLS_echo, NULL,
+                                  MHD_OPTION_END);
+
+  if (TLS_daemon == NULL)
+    return 1;
+  sleep (atoi (argv[2]));
+
+  MHD_stop_daemon (daemon);
+
+  gnutls_anon_free_server_credentials (anoncred);
+
+  gnutls_global_deinit ();
+  return 0;
+}