| OLD | NEW |
|---|
| (Empty) | |
| 1 /* apps/s_client.c */ |
| 2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
| 3 * All rights reserved. |
| 4 * |
| 5 * This package is an SSL implementation written |
| 6 * by Eric Young (eay@cryptsoft.com). |
| 7 * The implementation was written so as to conform with Netscapes SSL. |
| 8 * |
| 9 * This library is free for commercial and non-commercial use as long as |
| 10 * the following conditions are aheared to. The following conditions |
| 11 * apply to all code found in this distribution, be it the RC4, RSA, |
| 12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation |
| 13 * included with this distribution is covered by the same copyright terms |
| 14 * except that the holder is Tim Hudson (tjh@cryptsoft.com). |
| 15 * |
| 16 * Copyright remains Eric Young's, and as such any Copyright notices in |
| 17 * the code are not to be removed. |
| 18 * If this package is used in a product, Eric Young should be given attribution |
| 19 * as the author of the parts of the library used. |
| 20 * This can be in the form of a textual message at program startup or |
| 21 * in documentation (online or textual) provided with the package. |
| 22 * |
| 23 * Redistribution and use in source and binary forms, with or without |
| 24 * modification, are permitted provided that the following conditions |
| 25 * are met: |
| 26 * 1. Redistributions of source code must retain the copyright |
| 27 * notice, this list of conditions and the following disclaimer. |
| 28 * 2. Redistributions in binary form must reproduce the above copyright |
| 29 * notice, this list of conditions and the following disclaimer in the |
| 30 * documentation and/or other materials provided with the distribution. |
| 31 * 3. All advertising materials mentioning features or use of this software |
| 32 * must display the following acknowledgement: |
| 33 * "This product includes cryptographic software written by |
| 34 * Eric Young (eay@cryptsoft.com)" |
| 35 * The word 'cryptographic' can be left out if the rouines from the library |
| 36 * being used are not cryptographic related :-). |
| 37 * 4. If you include any Windows specific code (or a derivative thereof) from |
| 38 * the apps directory (application code) you must include an acknowledgement: |
| 39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" |
| 40 * |
| 41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND |
| 42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| 43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| 44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE |
| 45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
| 46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
| 47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
| 49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
| 50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
| 51 * SUCH DAMAGE. |
| 52 * |
| 53 * The licence and distribution terms for any publically available version or |
| 54 * derivative of this code cannot be changed. i.e. this code cannot simply be |
| 55 * copied and put under another distribution licence |
| 56 * [including the GNU Public Licence.] |
| 57 */ |
| 58 /* ==================================================================== |
| 59 * Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved. |
| 60 * |
| 61 * Redistribution and use in source and binary forms, with or without |
| 62 * modification, are permitted provided that the following conditions |
| 63 * are met: |
| 64 * |
| 65 * 1. Redistributions of source code must retain the above copyright |
| 66 * notice, this list of conditions and the following disclaimer. |
| 67 * |
| 68 * 2. Redistributions in binary form must reproduce the above copyright |
| 69 * notice, this list of conditions and the following disclaimer in |
| 70 * the documentation and/or other materials provided with the |
| 71 * distribution. |
| 72 * |
| 73 * 3. All advertising materials mentioning features or use of this |
| 74 * software must display the following acknowledgment: |
| 75 * "This product includes software developed by the OpenSSL Project |
| 76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" |
| 77 * |
| 78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to |
| 79 * endorse or promote products derived from this software without |
| 80 * prior written permission. For written permission, please contact |
| 81 * openssl-core@openssl.org. |
| 82 * |
| 83 * 5. Products derived from this software may not be called "OpenSSL" |
| 84 * nor may "OpenSSL" appear in their names without prior written |
| 85 * permission of the OpenSSL Project. |
| 86 * |
| 87 * 6. Redistributions of any form whatsoever must retain the following |
| 88 * acknowledgment: |
| 89 * "This product includes software developed by the OpenSSL Project |
| 90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)" |
| 91 * |
| 92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY |
| 93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| 94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR |
| 95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR |
| 96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
| 97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
| 98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
| 99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| 100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, |
| 101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) |
| 102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED |
| 103 * OF THE POSSIBILITY OF SUCH DAMAGE. |
| 104 * ==================================================================== |
| 105 * |
| 106 * This product includes cryptographic software written by Eric Young |
| 107 * (eay@cryptsoft.com). This product includes software written by Tim |
| 108 * Hudson (tjh@cryptsoft.com). |
| 109 * |
| 110 */ |
| 111 /* ==================================================================== |
| 112 * Copyright 2005 Nokia. All rights reserved. |
| 113 * |
| 114 * The portions of the attached software ("Contribution") is developed by |
| 115 * Nokia Corporation and is licensed pursuant to the OpenSSL open source |
| 116 * license. |
| 117 * |
| 118 * The Contribution, originally written by Mika Kousa and Pasi Eronen of |
| 119 * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites |
| 120 * support (see RFC 4279) to OpenSSL. |
| 121 * |
| 122 * No patent licenses or other rights except those expressly stated in |
| 123 * the OpenSSL open source license shall be deemed granted or received |
| 124 * expressly, by implication, estoppel, or otherwise. |
| 125 * |
| 126 * No assurances are provided by Nokia that the Contribution does not |
| 127 * infringe the patent or other intellectual property rights of any third |
| 128 * party or that the license provides you with all the necessary rights |
| 129 * to make use of the Contribution. |
| 130 * |
| 131 * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN |
| 132 * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA |
| 133 * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY |
| 134 * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR |
| 135 * OTHERWISE. |
| 136 */ |
| 137 |
| 138 #include <assert.h> |
| 139 #include <ctype.h> |
| 140 #include <stdio.h> |
| 141 #include <stdlib.h> |
| 142 #include <string.h> |
| 143 #include <openssl/e_os2.h> |
| 144 #ifdef OPENSSL_NO_STDIO |
| 145 #define APPS_WIN16 |
| 146 #endif |
| 147 |
| 148 /* With IPv6, it looks like Digital has mixed up the proper order of |
| 149 recursive header file inclusion, resulting in the compiler complaining |
| 150 that u_int isn't defined, but only if _POSIX_C_SOURCE is defined, which |
| 151 is needed to have fileno() declared correctly... So let's define u_int */ |
| 152 #if defined(OPENSSL_SYS_VMS_DECC) && !defined(__U_INT) |
| 153 #define __U_INT |
| 154 typedef unsigned int u_int; |
| 155 #endif |
| 156 |
| 157 #define USE_SOCKETS |
| 158 #include "apps.h" |
| 159 #include <openssl/x509.h> |
| 160 #include <openssl/ssl.h> |
| 161 #include <openssl/err.h> |
| 162 #include <openssl/pem.h> |
| 163 #include <openssl/rand.h> |
| 164 #include <openssl/ocsp.h> |
| 165 #include <openssl/bn.h> |
| 166 #include "s_apps.h" |
| 167 #include "timeouts.h" |
| 168 |
| 169 #if (defined(OPENSSL_SYS_VMS) && __VMS_VER < 70000000) |
| 170 /* FIONBIO used as a switch to enable ioctl, and that isn't in VMS < 7.0 */ |
| 171 #undef FIONBIO |
| 172 #endif |
| 173 |
| 174 #if defined(OPENSSL_SYS_BEOS_R5) |
| 175 #include <fcntl.h> |
| 176 #endif |
| 177 |
| 178 #undef PROG |
| 179 #define PROG s_client_main |
| 180 |
| 181 /*#define SSL_HOST_NAME "www.netscape.com" */ |
| 182 /*#define SSL_HOST_NAME "193.118.187.102" */ |
| 183 #define SSL_HOST_NAME "localhost" |
| 184 |
| 185 /*#define TEST_CERT "client.pem" */ /* no default cert. */ |
| 186 |
| 187 #undef BUFSIZZ |
| 188 #define BUFSIZZ 1024*8 |
| 189 |
| 190 extern int verify_depth; |
| 191 extern int verify_error; |
| 192 extern int verify_return_error; |
| 193 |
| 194 #ifdef FIONBIO |
| 195 static int c_nbio=0; |
| 196 #endif |
| 197 static int c_Pause=0; |
| 198 static int c_debug=0; |
| 199 #ifndef OPENSSL_NO_TLSEXT |
| 200 static int c_tlsextdebug=0; |
| 201 static int c_status_req=0; |
| 202 #endif |
| 203 static int c_msg=0; |
| 204 static int c_showcerts=0; |
| 205 |
| 206 static void sc_usage(void); |
| 207 static void print_stuff(BIO *berr,SSL *con,int full); |
| 208 #ifndef OPENSSL_NO_TLSEXT |
| 209 static int ocsp_resp_cb(SSL *s, void *arg); |
| 210 #endif |
| 211 static BIO *bio_c_out=NULL; |
| 212 static int c_quiet=0; |
| 213 static int c_ign_eof=0; |
| 214 |
| 215 #ifndef OPENSSL_NO_PSK |
| 216 /* Default PSK identity and key */ |
| 217 static char *psk_identity="Client_identity"; |
| 218 /*char *psk_key=NULL; by default PSK is not used */ |
| 219 |
| 220 static unsigned int psk_client_cb(SSL *ssl, const char *hint, char *identity, |
| 221 unsigned int max_identity_len, unsigned char *psk, |
| 222 unsigned int max_psk_len) |
| 223 { |
| 224 unsigned int psk_len = 0; |
| 225 int ret; |
| 226 BIGNUM *bn=NULL; |
| 227 |
| 228 if (c_debug) |
| 229 BIO_printf(bio_c_out, "psk_client_cb\n"); |
| 230 if (!hint) |
| 231 { |
| 232 /* no ServerKeyExchange message*/ |
| 233 if (c_debug) |
| 234 BIO_printf(bio_c_out,"NULL received PSK identity hint, c
ontinuing anyway\n"); |
| 235 } |
| 236 else if (c_debug) |
| 237 BIO_printf(bio_c_out, "Received PSK identity hint '%s'\n", hint)
; |
| 238 |
| 239 /* lookup PSK identity and PSK key based on the given identity hint here
*/ |
| 240 ret = BIO_snprintf(identity, max_identity_len, "%s", psk_identity); |
| 241 if (ret < 0 || (unsigned int)ret > max_identity_len) |
| 242 goto out_err; |
| 243 if (c_debug) |
| 244 BIO_printf(bio_c_out, "created identity '%s' len=%d\n", identity
, ret); |
| 245 ret=BN_hex2bn(&bn, psk_key); |
| 246 if (!ret) |
| 247 { |
| 248 BIO_printf(bio_err,"Could not convert PSK key '%s' to BIGNUM\n",
psk_key); |
| 249 if (bn) |
| 250 BN_free(bn); |
| 251 return 0; |
| 252 } |
| 253 |
| 254 if ((unsigned int)BN_num_bytes(bn) > max_psk_len) |
| 255 { |
| 256 BIO_printf(bio_err,"psk buffer of callback is too small (%d) for
key (%d)\n", |
| 257 max_psk_len, BN_num_bytes(bn)); |
| 258 BN_free(bn); |
| 259 return 0; |
| 260 } |
| 261 |
| 262 psk_len=BN_bn2bin(bn, psk); |
| 263 BN_free(bn); |
| 264 if (psk_len == 0) |
| 265 goto out_err; |
| 266 |
| 267 if (c_debug) |
| 268 BIO_printf(bio_c_out, "created PSK len=%d\n", psk_len); |
| 269 |
| 270 return psk_len; |
| 271 out_err: |
| 272 if (c_debug) |
| 273 BIO_printf(bio_err, "Error in PSK client callback\n"); |
| 274 return 0; |
| 275 } |
| 276 #endif |
| 277 |
| 278 static void sc_usage(void) |
| 279 { |
| 280 BIO_printf(bio_err,"usage: s_client args\n"); |
| 281 BIO_printf(bio_err,"\n"); |
| 282 BIO_printf(bio_err," -host host - use -connect instead\n"); |
| 283 BIO_printf(bio_err," -port port - use -connect instead\n"); |
| 284 BIO_printf(bio_err," -connect host:port - who to connect to (default is
%s:%s)\n",SSL_HOST_NAME,PORT_STR); |
| 285 |
| 286 BIO_printf(bio_err," -verify arg - turn on peer certificate verificati
on\n"); |
| 287 BIO_printf(bio_err," -cert arg - certificate file to use, PEM format
assumed\n"); |
| 288 BIO_printf(bio_err," -certform arg - certificate format (PEM or DER) PEM
default\n"); |
| 289 BIO_printf(bio_err," -key arg - Private key file to use, in cert fi
le if\n"); |
| 290 BIO_printf(bio_err," not specified but cert file is.\n")
; |
| 291 BIO_printf(bio_err," -keyform arg - key format (PEM or DER) PEM default
\n"); |
| 292 BIO_printf(bio_err," -pass arg - private key file pass phrase source
\n"); |
| 293 BIO_printf(bio_err," -CApath arg - PEM format directory of CA's\n"); |
| 294 BIO_printf(bio_err," -CAfile arg - PEM format file of CA's\n"); |
| 295 BIO_printf(bio_err," -reconnect - Drop and re-make the connection wit
h the same Session-ID\n"); |
| 296 BIO_printf(bio_err," -pause - sleep(1) after each read(2) and wri
te(2) system call\n"); |
| 297 BIO_printf(bio_err," -showcerts - show all certificates in the chain\
n"); |
| 298 BIO_printf(bio_err," -debug - extra output\n"); |
| 299 #ifdef WATT32 |
| 300 BIO_printf(bio_err," -wdebug - WATT-32 tcp debugging\n"); |
| 301 #endif |
| 302 BIO_printf(bio_err," -msg - Show protocol messages\n"); |
| 303 BIO_printf(bio_err," -nbio_test - more ssl protocol testing\n"); |
| 304 BIO_printf(bio_err," -state - print the 'ssl' states\n"); |
| 305 #ifdef FIONBIO |
| 306 BIO_printf(bio_err," -nbio - Run with non-blocking IO\n"); |
| 307 #endif |
| 308 BIO_printf(bio_err," -crlf - convert LF from terminal into CRLF\
n"); |
| 309 BIO_printf(bio_err," -quiet - no s_client output\n"); |
| 310 BIO_printf(bio_err," -ign_eof - ignore input eof (default when -qui
et)\n"); |
| 311 BIO_printf(bio_err," -no_ign_eof - don't ignore input eof\n"); |
| 312 #ifndef OPENSSL_NO_PSK |
| 313 BIO_printf(bio_err," -psk_identity arg - PSK identity\n"); |
| 314 BIO_printf(bio_err," -psk arg - PSK in hex (without 0x)\n"); |
| 315 # ifndef OPENSSL_NO_JPAKE |
| 316 BIO_printf(bio_err," -jpake arg - JPAKE secret to use\n"); |
| 317 # endif |
| 318 #endif |
| 319 BIO_printf(bio_err," -ssl2 - just use SSLv2\n"); |
| 320 BIO_printf(bio_err," -ssl3 - just use SSLv3\n"); |
| 321 BIO_printf(bio_err," -tls1 - just use TLSv1\n"); |
| 322 BIO_printf(bio_err," -dtls1 - just use DTLSv1\n"); |
| 323 BIO_printf(bio_err," -mtu - set the link layer MTU\n"); |
| 324 BIO_printf(bio_err," -no_tls1/-no_ssl3/-no_ssl2 - turn off that protocol
\n"); |
| 325 BIO_printf(bio_err," -bugs - Switch on all SSL implementation bu
g workarounds\n"); |
| 326 BIO_printf(bio_err," -serverpref - Use server's cipher preferences (on
ly SSLv2)\n"); |
| 327 BIO_printf(bio_err," -cipher - preferred cipher to use, use the 'o
penssl ciphers'\n"); |
| 328 BIO_printf(bio_err," command to see what is available\n"
); |
| 329 BIO_printf(bio_err," -starttls prot - use the STARTTLS command before st
arting TLS\n"); |
| 330 BIO_printf(bio_err," for those protocols that support it
, where\n"); |
| 331 BIO_printf(bio_err," 'prot' defines which one to assume.
Currently,\n"); |
| 332 BIO_printf(bio_err," only \"smtp\", \"pop3\", \"imap\",
\"ftp\" and \"xmpp\"\n"); |
| 333 BIO_printf(bio_err," are supported.\n"); |
| 334 #ifndef OPENSSL_NO_ENGINE |
| 335 BIO_printf(bio_err," -engine id - Initialise and use the specified en
gine\n"); |
| 336 #endif |
| 337 BIO_printf(bio_err," -rand file%cfile%c...\n", LIST_SEPARATOR_CHAR, LIST
_SEPARATOR_CHAR); |
| 338 BIO_printf(bio_err," -sess_out arg - file to write SSL session to\n"); |
| 339 BIO_printf(bio_err," -sess_in arg - file to read SSL session from\n"); |
| 340 #ifndef OPENSSL_NO_TLSEXT |
| 341 BIO_printf(bio_err," -servername host - Set TLS extension servername in
ClientHello\n"); |
| 342 BIO_printf(bio_err," -tlsextdebug - hex dump of all TLS extensions
received\n"); |
| 343 BIO_printf(bio_err," -status - request certificate status from
server\n"); |
| 344 BIO_printf(bio_err," -no_ticket - disable use of RFC4507bis sessi
on tickets\n"); |
| 345 #endif |
| 346 BIO_printf(bio_err," -legacy_renegotiation - enable use of legacy renego
tiation (dangerous)\n"); |
| 347 } |
| 348 |
| 349 #ifndef OPENSSL_NO_TLSEXT |
| 350 |
| 351 /* This is a context that we pass to callbacks */ |
| 352 typedef struct tlsextctx_st { |
| 353 BIO * biodebug; |
| 354 int ack; |
| 355 } tlsextctx; |
| 356 |
| 357 |
| 358 static int MS_CALLBACK ssl_servername_cb(SSL *s, int *ad, void *arg) |
| 359 { |
| 360 tlsextctx * p = (tlsextctx *) arg; |
| 361 const char * hn= SSL_get_servername(s, TLSEXT_NAMETYPE_host_name); |
| 362 if (SSL_get_servername_type(s) != -1) |
| 363 p->ack = !SSL_session_reused(s) && hn != NULL; |
| 364 else |
| 365 BIO_printf(bio_err,"Can't use SSL_get_servername\n"); |
| 366 |
| 367 return SSL_TLSEXT_ERR_OK; |
| 368 } |
| 369 #endif |
| 370 |
| 371 enum |
| 372 { |
| 373 PROTO_OFF = 0, |
| 374 PROTO_SMTP, |
| 375 PROTO_POP3, |
| 376 PROTO_IMAP, |
| 377 PROTO_FTP, |
| 378 PROTO_XMPP |
| 379 }; |
| 380 |
| 381 int MAIN(int, char **); |
| 382 |
| 383 int MAIN(int argc, char **argv) |
| 384 { |
| 385 unsigned int off=0, clr=0; |
| 386 SSL *con=NULL; |
| 387 int s,k,width,state=0; |
| 388 char *cbuf=NULL,*sbuf=NULL,*mbuf=NULL; |
| 389 int cbuf_len,cbuf_off; |
| 390 int sbuf_len,sbuf_off; |
| 391 fd_set readfds,writefds; |
| 392 short port=PORT; |
| 393 int full_log=1; |
| 394 char *host=SSL_HOST_NAME; |
| 395 char *cert_file=NULL,*key_file=NULL; |
| 396 int cert_format = FORMAT_PEM, key_format = FORMAT_PEM; |
| 397 char *passarg = NULL, *pass = NULL; |
| 398 X509 *cert = NULL; |
| 399 EVP_PKEY *key = NULL; |
| 400 char *CApath=NULL,*CAfile=NULL,*cipher=NULL; |
| 401 int reconnect=0,badop=0,verify=SSL_VERIFY_NONE,bugs=0; |
| 402 int crlf=0; |
| 403 int write_tty,read_tty,write_ssl,read_ssl,tty_on,ssl_pending; |
| 404 SSL_CTX *ctx=NULL; |
| 405 int ret=1,in_init=1,i,nbio_test=0; |
| 406 int starttls_proto = PROTO_OFF; |
| 407 int prexit = 0; |
| 408 X509_VERIFY_PARAM *vpm = NULL; |
| 409 int badarg = 0; |
| 410 const SSL_METHOD *meth=NULL; |
| 411 int socket_type=SOCK_STREAM; |
| 412 BIO *sbio; |
| 413 char *inrand=NULL; |
| 414 int mbuf_len=0; |
| 415 struct timeval timeout, *timeoutp; |
| 416 #ifndef OPENSSL_NO_ENGINE |
| 417 char *engine_id=NULL; |
| 418 char *ssl_client_engine_id=NULL; |
| 419 ENGINE *ssl_client_engine=NULL; |
| 420 #endif |
| 421 ENGINE *e=NULL; |
| 422 #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSS
L_SYS_NETWARE) || defined(OPENSSL_SYS_BEOS_R5) |
| 423 struct timeval tv; |
| 424 #if defined(OPENSSL_SYS_BEOS_R5) |
| 425 int stdin_set = 0; |
| 426 #endif |
| 427 #endif |
| 428 #ifndef OPENSSL_NO_TLSEXT |
| 429 char *servername = NULL; |
| 430 tlsextctx tlsextcbp = |
| 431 {NULL,0}; |
| 432 #endif |
| 433 char *sess_in = NULL; |
| 434 char *sess_out = NULL; |
| 435 struct sockaddr peer; |
| 436 int peerlen = sizeof(peer); |
| 437 int enable_timeouts = 0 ; |
| 438 long socket_mtu = 0; |
| 439 #ifndef OPENSSL_NO_JPAKE |
| 440 char *jpake_secret = NULL; |
| 441 #endif |
| 442 |
| 443 #if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3) |
| 444 meth=SSLv23_client_method(); |
| 445 #elif !defined(OPENSSL_NO_SSL3) |
| 446 meth=SSLv3_client_method(); |
| 447 #elif !defined(OPENSSL_NO_SSL2) |
| 448 meth=SSLv2_client_method(); |
| 449 #endif |
| 450 |
| 451 apps_startup(); |
| 452 c_Pause=0; |
| 453 c_quiet=0; |
| 454 c_ign_eof=0; |
| 455 c_debug=0; |
| 456 c_msg=0; |
| 457 c_showcerts=0; |
| 458 |
| 459 if (bio_err == NULL) |
| 460 bio_err=BIO_new_fp(stderr,BIO_NOCLOSE); |
| 461 |
| 462 if (!load_config(bio_err, NULL)) |
| 463 goto end; |
| 464 |
| 465 if ( ((cbuf=OPENSSL_malloc(BUFSIZZ)) == NULL) || |
| 466 ((sbuf=OPENSSL_malloc(BUFSIZZ)) == NULL) || |
| 467 ((mbuf=OPENSSL_malloc(BUFSIZZ)) == NULL)) |
| 468 { |
| 469 BIO_printf(bio_err,"out of memory\n"); |
| 470 goto end; |
| 471 } |
| 472 |
| 473 verify_depth=0; |
| 474 verify_error=X509_V_OK; |
| 475 #ifdef FIONBIO |
| 476 c_nbio=0; |
| 477 #endif |
| 478 |
| 479 argc--; |
| 480 argv++; |
| 481 while (argc >= 1) |
| 482 { |
| 483 if (strcmp(*argv,"-host") == 0) |
| 484 { |
| 485 if (--argc < 1) goto bad; |
| 486 host= *(++argv); |
| 487 } |
| 488 else if (strcmp(*argv,"-port") == 0) |
| 489 { |
| 490 if (--argc < 1) goto bad; |
| 491 port=atoi(*(++argv)); |
| 492 if (port == 0) goto bad; |
| 493 } |
| 494 else if (strcmp(*argv,"-connect") == 0) |
| 495 { |
| 496 if (--argc < 1) goto bad; |
| 497 if (!extract_host_port(*(++argv),&host,NULL,&port)) |
| 498 goto bad; |
| 499 } |
| 500 else if (strcmp(*argv,"-verify") == 0) |
| 501 { |
| 502 verify=SSL_VERIFY_PEER; |
| 503 if (--argc < 1) goto bad; |
| 504 verify_depth=atoi(*(++argv)); |
| 505 BIO_printf(bio_err,"verify depth is %d\n",verify_depth); |
| 506 } |
| 507 else if (strcmp(*argv,"-cert") == 0) |
| 508 { |
| 509 if (--argc < 1) goto bad; |
| 510 cert_file= *(++argv); |
| 511 } |
| 512 else if (strcmp(*argv,"-sess_out") == 0) |
| 513 { |
| 514 if (--argc < 1) goto bad; |
| 515 sess_out = *(++argv); |
| 516 } |
| 517 else if (strcmp(*argv,"-sess_in") == 0) |
| 518 { |
| 519 if (--argc < 1) goto bad; |
| 520 sess_in = *(++argv); |
| 521 } |
| 522 else if (strcmp(*argv,"-certform") == 0) |
| 523 { |
| 524 if (--argc < 1) goto bad; |
| 525 cert_format = str2fmt(*(++argv)); |
| 526 } |
| 527 else if (args_verify(&argv, &argc, &badarg, bio_err, &vpm)) |
| 528 { |
| 529 if (badarg) |
| 530 goto bad; |
| 531 continue; |
| 532 } |
| 533 else if (strcmp(*argv,"-verify_return_error") == 0) |
| 534 verify_return_error = 1; |
| 535 else if (strcmp(*argv,"-prexit") == 0) |
| 536 prexit=1; |
| 537 else if (strcmp(*argv,"-crlf") == 0) |
| 538 crlf=1; |
| 539 else if (strcmp(*argv,"-quiet") == 0) |
| 540 { |
| 541 c_quiet=1; |
| 542 c_ign_eof=1; |
| 543 } |
| 544 else if (strcmp(*argv,"-ign_eof") == 0) |
| 545 c_ign_eof=1; |
| 546 else if (strcmp(*argv,"-no_ign_eof") == 0) |
| 547 c_ign_eof=0; |
| 548 else if (strcmp(*argv,"-pause") == 0) |
| 549 c_Pause=1; |
| 550 else if (strcmp(*argv,"-debug") == 0) |
| 551 c_debug=1; |
| 552 #ifndef OPENSSL_NO_TLSEXT |
| 553 else if (strcmp(*argv,"-tlsextdebug") == 0) |
| 554 c_tlsextdebug=1; |
| 555 else if (strcmp(*argv,"-status") == 0) |
| 556 c_status_req=1; |
| 557 #endif |
| 558 #ifdef WATT32 |
| 559 else if (strcmp(*argv,"-wdebug") == 0) |
| 560 dbug_init(); |
| 561 #endif |
| 562 else if (strcmp(*argv,"-msg") == 0) |
| 563 c_msg=1; |
| 564 else if (strcmp(*argv,"-showcerts") == 0) |
| 565 c_showcerts=1; |
| 566 else if (strcmp(*argv,"-nbio_test") == 0) |
| 567 nbio_test=1; |
| 568 else if (strcmp(*argv,"-state") == 0) |
| 569 state=1; |
| 570 #ifndef OPENSSL_NO_PSK |
| 571 else if (strcmp(*argv,"-psk_identity") == 0) |
| 572 { |
| 573 if (--argc < 1) goto bad; |
| 574 psk_identity=*(++argv); |
| 575 } |
| 576 else if (strcmp(*argv,"-psk") == 0) |
| 577 { |
| 578 size_t j; |
| 579 |
| 580 if (--argc < 1) goto bad; |
| 581 psk_key=*(++argv); |
| 582 for (j = 0; j < strlen(psk_key); j++) |
| 583 { |
| 584 if (isxdigit((int)psk_key[j])) |
| 585 continue; |
| 586 BIO_printf(bio_err,"Not a hex number '%s'\n",*ar
gv); |
| 587 goto bad; |
| 588 } |
| 589 } |
| 590 #endif |
| 591 #ifndef OPENSSL_NO_SSL2 |
| 592 else if (strcmp(*argv,"-ssl2") == 0) |
| 593 meth=SSLv2_client_method(); |
| 594 #endif |
| 595 #ifndef OPENSSL_NO_SSL3 |
| 596 else if (strcmp(*argv,"-ssl3") == 0) |
| 597 meth=SSLv3_client_method(); |
| 598 #endif |
| 599 #ifndef OPENSSL_NO_TLS1 |
| 600 else if (strcmp(*argv,"-tls1") == 0) |
| 601 meth=TLSv1_client_method(); |
| 602 #endif |
| 603 #ifndef OPENSSL_NO_DTLS1 |
| 604 else if (strcmp(*argv,"-dtls1") == 0) |
| 605 { |
| 606 meth=DTLSv1_client_method(); |
| 607 socket_type=SOCK_DGRAM; |
| 608 } |
| 609 else if (strcmp(*argv,"-timeout") == 0) |
| 610 enable_timeouts=1; |
| 611 else if (strcmp(*argv,"-mtu") == 0) |
| 612 { |
| 613 if (--argc < 1) goto bad; |
| 614 socket_mtu = atol(*(++argv)); |
| 615 } |
| 616 #endif |
| 617 else if (strcmp(*argv,"-bugs") == 0) |
| 618 bugs=1; |
| 619 else if (strcmp(*argv,"-keyform") == 0) |
| 620 { |
| 621 if (--argc < 1) goto bad; |
| 622 key_format = str2fmt(*(++argv)); |
| 623 } |
| 624 else if (strcmp(*argv,"-pass") == 0) |
| 625 { |
| 626 if (--argc < 1) goto bad; |
| 627 passarg = *(++argv); |
| 628 } |
| 629 else if (strcmp(*argv,"-key") == 0) |
| 630 { |
| 631 if (--argc < 1) goto bad; |
| 632 key_file= *(++argv); |
| 633 } |
| 634 else if (strcmp(*argv,"-reconnect") == 0) |
| 635 { |
| 636 reconnect=5; |
| 637 } |
| 638 else if (strcmp(*argv,"-CApath") == 0) |
| 639 { |
| 640 if (--argc < 1) goto bad; |
| 641 CApath= *(++argv); |
| 642 } |
| 643 else if (strcmp(*argv,"-CAfile") == 0) |
| 644 { |
| 645 if (--argc < 1) goto bad; |
| 646 CAfile= *(++argv); |
| 647 } |
| 648 else if (strcmp(*argv,"-no_tls1") == 0) |
| 649 off|=SSL_OP_NO_TLSv1; |
| 650 else if (strcmp(*argv,"-no_ssl3") == 0) |
| 651 off|=SSL_OP_NO_SSLv3; |
| 652 else if (strcmp(*argv,"-no_ssl2") == 0) |
| 653 off|=SSL_OP_NO_SSLv2; |
| 654 else if (strcmp(*argv,"-no_comp") == 0) |
| 655 { off|=SSL_OP_NO_COMPRESSION; } |
| 656 #ifndef OPENSSL_NO_TLSEXT |
| 657 else if (strcmp(*argv,"-no_ticket") == 0) |
| 658 { off|=SSL_OP_NO_TICKET; } |
| 659 #endif |
| 660 else if (strcmp(*argv,"-serverpref") == 0) |
| 661 off|=SSL_OP_CIPHER_SERVER_PREFERENCE; |
| 662 else if (strcmp(*argv,"-legacy_renegotiation") == 0) |
| 663 off|=SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION; |
| 664 else if (strcmp(*argv,"-legacy_server_connect") == 0) |
| 665 { off|=SSL_OP_LEGACY_SERVER_CONNECT; } |
| 666 else if (strcmp(*argv,"-no_legacy_server_connect") == 0) |
| 667 { clr|=SSL_OP_LEGACY_SERVER_CONNECT; } |
| 668 else if (strcmp(*argv,"-cipher") == 0) |
| 669 { |
| 670 if (--argc < 1) goto bad; |
| 671 cipher= *(++argv); |
| 672 } |
| 673 #ifdef FIONBIO |
| 674 else if (strcmp(*argv,"-nbio") == 0) |
| 675 { c_nbio=1; } |
| 676 #endif |
| 677 else if (strcmp(*argv,"-starttls") == 0) |
| 678 { |
| 679 if (--argc < 1) goto bad; |
| 680 ++argv; |
| 681 if (strcmp(*argv,"smtp") == 0) |
| 682 starttls_proto = PROTO_SMTP; |
| 683 else if (strcmp(*argv,"pop3") == 0) |
| 684 starttls_proto = PROTO_POP3; |
| 685 else if (strcmp(*argv,"imap") == 0) |
| 686 starttls_proto = PROTO_IMAP; |
| 687 else if (strcmp(*argv,"ftp") == 0) |
| 688 starttls_proto = PROTO_FTP; |
| 689 else if (strcmp(*argv, "xmpp") == 0) |
| 690 starttls_proto = PROTO_XMPP; |
| 691 else |
| 692 goto bad; |
| 693 } |
| 694 #ifndef OPENSSL_NO_ENGINE |
| 695 else if (strcmp(*argv,"-engine") == 0) |
| 696 { |
| 697 if (--argc < 1) goto bad; |
| 698 engine_id = *(++argv); |
| 699 } |
| 700 else if (strcmp(*argv,"-ssl_client_engine") == 0) |
| 701 { |
| 702 if (--argc < 1) goto bad; |
| 703 ssl_client_engine_id = *(++argv); |
| 704 } |
| 705 #endif |
| 706 else if (strcmp(*argv,"-rand") == 0) |
| 707 { |
| 708 if (--argc < 1) goto bad; |
| 709 inrand= *(++argv); |
| 710 } |
| 711 #ifndef OPENSSL_NO_TLSEXT |
| 712 else if (strcmp(*argv,"-servername") == 0) |
| 713 { |
| 714 if (--argc < 1) goto bad; |
| 715 servername= *(++argv); |
| 716 /* meth=TLSv1_client_method(); */ |
| 717 } |
| 718 #endif |
| 719 #ifndef OPENSSL_NO_JPAKE |
| 720 else if (strcmp(*argv,"-jpake") == 0) |
| 721 { |
| 722 if (--argc < 1) goto bad; |
| 723 jpake_secret = *++argv; |
| 724 } |
| 725 #endif |
| 726 else |
| 727 { |
| 728 BIO_printf(bio_err,"unknown option %s\n",*argv); |
| 729 badop=1; |
| 730 break; |
| 731 } |
| 732 argc--; |
| 733 argv++; |
| 734 } |
| 735 if (badop) |
| 736 { |
| 737 bad: |
| 738 sc_usage(); |
| 739 goto end; |
| 740 } |
| 741 |
| 742 #if !defined(OPENSSL_NO_JPAKE) && !defined(OPENSSL_NO_PSK) |
| 743 if (jpake_secret) |
| 744 { |
| 745 if (psk_key) |
| 746 { |
| 747 BIO_printf(bio_err, |
| 748 "Can't use JPAKE and PSK together\n"); |
| 749 goto end; |
| 750 } |
| 751 psk_identity = "JPAKE"; |
| 752 } |
| 753 |
| 754 if (cipher) |
| 755 { |
| 756 BIO_printf(bio_err, "JPAKE sets cipher to PSK\n"); |
| 757 goto end; |
| 758 } |
| 759 cipher = "PSK"; |
| 760 #endif |
| 761 |
| 762 OpenSSL_add_ssl_algorithms(); |
| 763 SSL_load_error_strings(); |
| 764 |
| 765 #ifndef OPENSSL_NO_ENGINE |
| 766 e = setup_engine(bio_err, engine_id, 1); |
| 767 if (ssl_client_engine_id) |
| 768 { |
| 769 ssl_client_engine = ENGINE_by_id(ssl_client_engine_id); |
| 770 if (!ssl_client_engine) |
| 771 { |
| 772 BIO_printf(bio_err, |
| 773 "Error getting client auth engine\n"); |
| 774 goto end; |
| 775 } |
| 776 } |
| 777 |
| 778 #endif |
| 779 if (!app_passwd(bio_err, passarg, NULL, &pass, NULL)) |
| 780 { |
| 781 BIO_printf(bio_err, "Error getting password\n"); |
| 782 goto end; |
| 783 } |
| 784 |
| 785 if (key_file == NULL) |
| 786 key_file = cert_file; |
| 787 |
| 788 |
| 789 if (key_file) |
| 790 |
| 791 { |
| 792 |
| 793 key = load_key(bio_err, key_file, key_format, 0, pass, e, |
| 794 "client certificate private key file"); |
| 795 if (!key) |
| 796 { |
| 797 ERR_print_errors(bio_err); |
| 798 goto end; |
| 799 } |
| 800 |
| 801 } |
| 802 |
| 803 if (cert_file) |
| 804 |
| 805 { |
| 806 cert = load_cert(bio_err,cert_file,cert_format, |
| 807 NULL, e, "client certificate file"); |
| 808 |
| 809 if (!cert) |
| 810 { |
| 811 ERR_print_errors(bio_err); |
| 812 goto end; |
| 813 } |
| 814 } |
| 815 |
| 816 if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL |
| 817 && !RAND_status()) |
| 818 { |
| 819 BIO_printf(bio_err,"warning, not much extra random data, conside
r using the -rand option\n"); |
| 820 } |
| 821 if (inrand != NULL) |
| 822 BIO_printf(bio_err,"%ld semi-random bytes loaded\n", |
| 823 app_RAND_load_files(inrand)); |
| 824 |
| 825 if (bio_c_out == NULL) |
| 826 { |
| 827 if (c_quiet && !c_debug && !c_msg) |
| 828 { |
| 829 bio_c_out=BIO_new(BIO_s_null()); |
| 830 } |
| 831 else |
| 832 { |
| 833 if (bio_c_out == NULL) |
| 834 bio_c_out=BIO_new_fp(stdout,BIO_NOCLOSE); |
| 835 } |
| 836 } |
| 837 |
| 838 ctx=SSL_CTX_new(meth); |
| 839 if (ctx == NULL) |
| 840 { |
| 841 ERR_print_errors(bio_err); |
| 842 goto end; |
| 843 } |
| 844 |
| 845 if (vpm) |
| 846 SSL_CTX_set1_param(ctx, vpm); |
| 847 |
| 848 #ifndef OPENSSL_NO_ENGINE |
| 849 if (ssl_client_engine) |
| 850 { |
| 851 if (!SSL_CTX_set_client_cert_engine(ctx, ssl_client_engine)) |
| 852 { |
| 853 BIO_puts(bio_err, "Error setting client auth engine\n"); |
| 854 ERR_print_errors(bio_err); |
| 855 ENGINE_free(ssl_client_engine); |
| 856 goto end; |
| 857 } |
| 858 ENGINE_free(ssl_client_engine); |
| 859 } |
| 860 #endif |
| 861 |
| 862 #ifndef OPENSSL_NO_PSK |
| 863 #ifdef OPENSSL_NO_JPAKE |
| 864 if (psk_key != NULL) |
| 865 #else |
| 866 if (psk_key != NULL || jpake_secret) |
| 867 #endif |
| 868 { |
| 869 if (c_debug) |
| 870 BIO_printf(bio_c_out, "PSK key given or JPAKE in use, se
tting client callback\n"); |
| 871 SSL_CTX_set_psk_client_callback(ctx, psk_client_cb); |
| 872 } |
| 873 #endif |
| 874 if (bugs) |
| 875 SSL_CTX_set_options(ctx,SSL_OP_ALL|off); |
| 876 else |
| 877 SSL_CTX_set_options(ctx,off); |
| 878 |
| 879 if (clr) |
| 880 SSL_CTX_clear_options(ctx, clr); |
| 881 /* DTLS: partial reads end up discarding unread UDP bytes :-( |
| 882 * Setting read ahead solves this problem. |
| 883 */ |
| 884 if (socket_type == SOCK_DGRAM) SSL_CTX_set_read_ahead(ctx, 1); |
| 885 |
| 886 if (state) SSL_CTX_set_info_callback(ctx,apps_ssl_info_callback); |
| 887 if (cipher != NULL) |
| 888 if(!SSL_CTX_set_cipher_list(ctx,cipher)) { |
| 889 BIO_printf(bio_err,"error setting cipher list\n"); |
| 890 ERR_print_errors(bio_err); |
| 891 goto end; |
| 892 } |
| 893 #if 0 |
| 894 else |
| 895 SSL_CTX_set_cipher_list(ctx,getenv("SSL_CIPHER")); |
| 896 #endif |
| 897 |
| 898 SSL_CTX_set_verify(ctx,verify,verify_callback); |
| 899 if (!set_cert_key_stuff(ctx,cert,key)) |
| 900 goto end; |
| 901 |
| 902 if ((!SSL_CTX_load_verify_locations(ctx,CAfile,CApath)) || |
| 903 (!SSL_CTX_set_default_verify_paths(ctx))) |
| 904 { |
| 905 /* BIO_printf(bio_err,"error setting default verify locations\n"
); */ |
| 906 ERR_print_errors(bio_err); |
| 907 /* goto end; */ |
| 908 } |
| 909 |
| 910 #ifndef OPENSSL_NO_TLSEXT |
| 911 if (servername != NULL) |
| 912 { |
| 913 tlsextcbp.biodebug = bio_err; |
| 914 SSL_CTX_set_tlsext_servername_callback(ctx, ssl_servername_cb); |
| 915 SSL_CTX_set_tlsext_servername_arg(ctx, &tlsextcbp); |
| 916 } |
| 917 #endif |
| 918 |
| 919 con=SSL_new(ctx); |
| 920 if (sess_in) |
| 921 { |
| 922 SSL_SESSION *sess; |
| 923 BIO *stmp = BIO_new_file(sess_in, "r"); |
| 924 if (!stmp) |
| 925 { |
| 926 BIO_printf(bio_err, "Can't open session file %s\n", |
| 927 sess_in); |
| 928 ERR_print_errors(bio_err); |
| 929 goto end; |
| 930 } |
| 931 sess = PEM_read_bio_SSL_SESSION(stmp, NULL, 0, NULL); |
| 932 BIO_free(stmp); |
| 933 if (!sess) |
| 934 { |
| 935 BIO_printf(bio_err, "Can't open session file %s\n", |
| 936 sess_in); |
| 937 ERR_print_errors(bio_err); |
| 938 goto end; |
| 939 } |
| 940 SSL_set_session(con, sess); |
| 941 SSL_SESSION_free(sess); |
| 942 } |
| 943 #ifndef OPENSSL_NO_TLSEXT |
| 944 if (servername != NULL) |
| 945 { |
| 946 if (!SSL_set_tlsext_host_name(con,servername)) |
| 947 { |
| 948 BIO_printf(bio_err,"Unable to set TLS servername extensi
on.\n"); |
| 949 ERR_print_errors(bio_err); |
| 950 goto end; |
| 951 } |
| 952 } |
| 953 #endif |
| 954 #ifndef OPENSSL_NO_KRB5 |
| 955 if (con && (con->kssl_ctx = kssl_ctx_new()) != NULL) |
| 956 { |
| 957 kssl_ctx_setstring(con->kssl_ctx, KSSL_SERVER, host); |
| 958 } |
| 959 #endif /* OPENSSL_NO_KRB5 */ |
| 960 /* SSL_set_cipher_list(con,"RC4-MD5"); */ |
| 961 #if 0 |
| 962 #ifdef TLSEXT_TYPE_opaque_prf_input |
| 963 SSL_set_tlsext_opaque_prf_input(con, "Test client", 11); |
| 964 #endif |
| 965 #endif |
| 966 |
| 967 re_start: |
| 968 |
| 969 if (init_client(&s,host,port,socket_type) == 0) |
| 970 { |
| 971 BIO_printf(bio_err,"connect:errno=%d\n",get_last_socket_error())
; |
| 972 SHUTDOWN(s); |
| 973 goto end; |
| 974 } |
| 975 BIO_printf(bio_c_out,"CONNECTED(%08X)\n",s); |
| 976 |
| 977 #ifdef FIONBIO |
| 978 if (c_nbio) |
| 979 { |
| 980 unsigned long l=1; |
| 981 BIO_printf(bio_c_out,"turning on non blocking io\n"); |
| 982 if (BIO_socket_ioctl(s,FIONBIO,&l) < 0) |
| 983 { |
| 984 ERR_print_errors(bio_err); |
| 985 goto end; |
| 986 } |
| 987 } |
| 988 #endif |
| 989 if (c_Pause & 0x01) con->debug=1; |
| 990 |
| 991 if ( SSL_version(con) == DTLS1_VERSION) |
| 992 { |
| 993 |
| 994 sbio=BIO_new_dgram(s,BIO_NOCLOSE); |
| 995 if (getsockname(s, &peer, (void *)&peerlen) < 0) |
| 996 { |
| 997 BIO_printf(bio_err, "getsockname:errno=%d\n", |
| 998 get_last_socket_error()); |
| 999 SHUTDOWN(s); |
| 1000 goto end; |
| 1001 } |
| 1002 |
| 1003 (void)BIO_ctrl_set_connected(sbio, 1, &peer); |
| 1004 |
| 1005 if (enable_timeouts) |
| 1006 { |
| 1007 timeout.tv_sec = 0; |
| 1008 timeout.tv_usec = DGRAM_RCV_TIMEOUT; |
| 1009 BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_RECV_TIMEOUT, 0, &time
out); |
| 1010 |
| 1011 timeout.tv_sec = 0; |
| 1012 timeout.tv_usec = DGRAM_SND_TIMEOUT; |
| 1013 BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_SEND_TIMEOUT, 0, &time
out); |
| 1014 } |
| 1015 |
| 1016 if (socket_mtu > 28) |
| 1017 { |
| 1018 SSL_set_options(con, SSL_OP_NO_QUERY_MTU); |
| 1019 SSL_set_mtu(con, socket_mtu - 28); |
| 1020 } |
| 1021 else |
| 1022 /* want to do MTU discovery */ |
| 1023 BIO_ctrl(sbio, BIO_CTRL_DGRAM_MTU_DISCOVER, 0, NULL); |
| 1024 } |
| 1025 else |
| 1026 sbio=BIO_new_socket(s,BIO_NOCLOSE); |
| 1027 |
| 1028 if (nbio_test) |
| 1029 { |
| 1030 BIO *test; |
| 1031 |
| 1032 test=BIO_new(BIO_f_nbio_test()); |
| 1033 sbio=BIO_push(test,sbio); |
| 1034 } |
| 1035 |
| 1036 if (c_debug) |
| 1037 { |
| 1038 con->debug=1; |
| 1039 BIO_set_callback(sbio,bio_dump_callback); |
| 1040 BIO_set_callback_arg(sbio,(char *)bio_c_out); |
| 1041 } |
| 1042 if (c_msg) |
| 1043 { |
| 1044 SSL_set_msg_callback(con, msg_cb); |
| 1045 SSL_set_msg_callback_arg(con, bio_c_out); |
| 1046 } |
| 1047 #ifndef OPENSSL_NO_TLSEXT |
| 1048 if (c_tlsextdebug) |
| 1049 { |
| 1050 SSL_set_tlsext_debug_callback(con, tlsext_cb); |
| 1051 SSL_set_tlsext_debug_arg(con, bio_c_out); |
| 1052 } |
| 1053 if (c_status_req) |
| 1054 { |
| 1055 SSL_set_tlsext_status_type(con, TLSEXT_STATUSTYPE_ocsp); |
| 1056 SSL_CTX_set_tlsext_status_cb(ctx, ocsp_resp_cb); |
| 1057 SSL_CTX_set_tlsext_status_arg(ctx, bio_c_out); |
| 1058 #if 0 |
| 1059 { |
| 1060 STACK_OF(OCSP_RESPID) *ids = sk_OCSP_RESPID_new_null(); |
| 1061 OCSP_RESPID *id = OCSP_RESPID_new(); |
| 1062 id->value.byKey = ASN1_OCTET_STRING_new(); |
| 1063 id->type = V_OCSP_RESPID_KEY; |
| 1064 ASN1_STRING_set(id->value.byKey, "Hello World", -1); |
| 1065 sk_OCSP_RESPID_push(ids, id); |
| 1066 SSL_set_tlsext_status_ids(con, ids); |
| 1067 } |
| 1068 #endif |
| 1069 } |
| 1070 #endif |
| 1071 #ifndef OPENSSL_NO_JPAKE |
| 1072 if (jpake_secret) |
| 1073 jpake_client_auth(bio_c_out, sbio, jpake_secret); |
| 1074 #endif |
| 1075 |
| 1076 SSL_set_bio(con,sbio,sbio); |
| 1077 SSL_set_connect_state(con); |
| 1078 |
| 1079 /* ok, lets connect */ |
| 1080 width=SSL_get_fd(con)+1; |
| 1081 |
| 1082 read_tty=1; |
| 1083 write_tty=0; |
| 1084 tty_on=0; |
| 1085 read_ssl=1; |
| 1086 write_ssl=1; |
| 1087 |
| 1088 cbuf_len=0; |
| 1089 cbuf_off=0; |
| 1090 sbuf_len=0; |
| 1091 sbuf_off=0; |
| 1092 |
| 1093 /* This is an ugly hack that does a lot of assumptions */ |
| 1094 /* We do have to handle multi-line responses which may come |
| 1095 in a single packet or not. We therefore have to use |
| 1096 BIO_gets() which does need a buffering BIO. So during |
| 1097 the initial chitchat we do push a buffering BIO into the |
| 1098 chain that is removed again later on to not disturb the |
| 1099 rest of the s_client operation. */ |
| 1100 if (starttls_proto == PROTO_SMTP) |
| 1101 { |
| 1102 int foundit=0; |
| 1103 BIO *fbio = BIO_new(BIO_f_buffer()); |
| 1104 BIO_push(fbio, sbio); |
| 1105 /* wait for multi-line response to end from SMTP */ |
| 1106 do |
| 1107 { |
| 1108 mbuf_len = BIO_gets(fbio,mbuf,BUFSIZZ); |
| 1109 } |
| 1110 while (mbuf_len>3 && mbuf[3]=='-'); |
| 1111 /* STARTTLS command requires EHLO... */ |
| 1112 BIO_printf(fbio,"EHLO openssl.client.net\r\n"); |
| 1113 (void)BIO_flush(fbio); |
| 1114 /* wait for multi-line response to end EHLO SMTP response */ |
| 1115 do |
| 1116 { |
| 1117 mbuf_len = BIO_gets(fbio,mbuf,BUFSIZZ); |
| 1118 if (strstr(mbuf,"STARTTLS")) |
| 1119 foundit=1; |
| 1120 } |
| 1121 while (mbuf_len>3 && mbuf[3]=='-'); |
| 1122 (void)BIO_flush(fbio); |
| 1123 BIO_pop(fbio); |
| 1124 BIO_free(fbio); |
| 1125 if (!foundit) |
| 1126 BIO_printf(bio_err, |
| 1127 "didn't found starttls in server response," |
| 1128 " try anyway...\n"); |
| 1129 BIO_printf(sbio,"STARTTLS\r\n"); |
| 1130 BIO_read(sbio,sbuf,BUFSIZZ); |
| 1131 } |
| 1132 else if (starttls_proto == PROTO_POP3) |
| 1133 { |
| 1134 BIO_read(sbio,mbuf,BUFSIZZ); |
| 1135 BIO_printf(sbio,"STLS\r\n"); |
| 1136 BIO_read(sbio,sbuf,BUFSIZZ); |
| 1137 } |
| 1138 else if (starttls_proto == PROTO_IMAP) |
| 1139 { |
| 1140 int foundit=0; |
| 1141 BIO *fbio = BIO_new(BIO_f_buffer()); |
| 1142 BIO_push(fbio, sbio); |
| 1143 BIO_gets(fbio,mbuf,BUFSIZZ); |
| 1144 /* STARTTLS command requires CAPABILITY... */ |
| 1145 BIO_printf(fbio,". CAPABILITY\r\n"); |
| 1146 (void)BIO_flush(fbio); |
| 1147 /* wait for multi-line CAPABILITY response */ |
| 1148 do |
| 1149 { |
| 1150 mbuf_len = BIO_gets(fbio,mbuf,BUFSIZZ); |
| 1151 if (strstr(mbuf,"STARTTLS")) |
| 1152 foundit=1; |
| 1153 } |
| 1154 while (mbuf_len>3 && mbuf[0]!='.'); |
| 1155 (void)BIO_flush(fbio); |
| 1156 BIO_pop(fbio); |
| 1157 BIO_free(fbio); |
| 1158 if (!foundit) |
| 1159 BIO_printf(bio_err, |
| 1160 "didn't found STARTTLS in server response," |
| 1161 " try anyway...\n"); |
| 1162 BIO_printf(sbio,". STARTTLS\r\n"); |
| 1163 BIO_read(sbio,sbuf,BUFSIZZ); |
| 1164 } |
| 1165 else if (starttls_proto == PROTO_FTP) |
| 1166 { |
| 1167 BIO *fbio = BIO_new(BIO_f_buffer()); |
| 1168 BIO_push(fbio, sbio); |
| 1169 /* wait for multi-line response to end from FTP */ |
| 1170 do |
| 1171 { |
| 1172 mbuf_len = BIO_gets(fbio,mbuf,BUFSIZZ); |
| 1173 } |
| 1174 while (mbuf_len>3 && mbuf[3]=='-'); |
| 1175 (void)BIO_flush(fbio); |
| 1176 BIO_pop(fbio); |
| 1177 BIO_free(fbio); |
| 1178 BIO_printf(sbio,"AUTH TLS\r\n"); |
| 1179 BIO_read(sbio,sbuf,BUFSIZZ); |
| 1180 } |
| 1181 if (starttls_proto == PROTO_XMPP) |
| 1182 { |
| 1183 int seen = 0; |
| 1184 BIO_printf(sbio,"<stream:stream " |
| 1185 "xmlns:stream='http://etherx.jabber.org/streams' " |
| 1186 "xmlns='jabber:client' to='%s' version='1.0'>", host); |
| 1187 seen = BIO_read(sbio,mbuf,BUFSIZZ); |
| 1188 mbuf[seen] = 0; |
| 1189 while (!strstr(mbuf, "<starttls xmlns='urn:ietf:params:xml:ns:xm
pp-tls'")) |
| 1190 { |
| 1191 if (strstr(mbuf, "/stream:features>")) |
| 1192 goto shut; |
| 1193 seen = BIO_read(sbio,mbuf,BUFSIZZ); |
| 1194 mbuf[seen] = 0; |
| 1195 } |
| 1196 BIO_printf(sbio, "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-t
ls'/>"); |
| 1197 seen = BIO_read(sbio,sbuf,BUFSIZZ); |
| 1198 sbuf[seen] = 0; |
| 1199 if (!strstr(sbuf, "<proceed")) |
| 1200 goto shut; |
| 1201 mbuf[0] = 0; |
| 1202 } |
| 1203 |
| 1204 for (;;) |
| 1205 { |
| 1206 FD_ZERO(&readfds); |
| 1207 FD_ZERO(&writefds); |
| 1208 |
| 1209 if ((SSL_version(con) == DTLS1_VERSION) && |
| 1210 DTLSv1_get_timeout(con, &timeout)) |
| 1211 timeoutp = &timeout; |
| 1212 else |
| 1213 timeoutp = NULL; |
| 1214 |
| 1215 if (SSL_in_init(con) && !SSL_total_renegotiations(con)) |
| 1216 { |
| 1217 in_init=1; |
| 1218 tty_on=0; |
| 1219 } |
| 1220 else |
| 1221 { |
| 1222 tty_on=1; |
| 1223 if (in_init) |
| 1224 { |
| 1225 in_init=0; |
| 1226 #if 0 /* This test doesn't really work as intended (needs to be fixed) */ |
| 1227 #ifndef OPENSSL_NO_TLSEXT |
| 1228 if (servername != NULL && !SSL_session_reused(co
n)) |
| 1229 { |
| 1230 BIO_printf(bio_c_out,"Server did %sackno
wledge servername extension.\n",tlsextcbp.ack?"":"not "); |
| 1231 } |
| 1232 #endif |
| 1233 #endif |
| 1234 if (sess_out) |
| 1235 { |
| 1236 BIO *stmp = BIO_new_file(sess_out, "w"); |
| 1237 if (stmp) |
| 1238 { |
| 1239 PEM_write_bio_SSL_SESSION(stmp,
SSL_get_session(con)); |
| 1240 BIO_free(stmp); |
| 1241 } |
| 1242 else |
| 1243 BIO_printf(bio_err, "Error writi
ng session file %s\n", sess_out); |
| 1244 } |
| 1245 print_stuff(bio_c_out,con,full_log); |
| 1246 if (full_log > 0) full_log--; |
| 1247 |
| 1248 if (starttls_proto) |
| 1249 { |
| 1250 BIO_printf(bio_err,"%s",mbuf); |
| 1251 /* We don't need to know any more */ |
| 1252 starttls_proto = PROTO_OFF; |
| 1253 } |
| 1254 |
| 1255 if (reconnect) |
| 1256 { |
| 1257 reconnect--; |
| 1258 BIO_printf(bio_c_out,"drop connection an
d then reconnect\n"); |
| 1259 SSL_shutdown(con); |
| 1260 SSL_set_connect_state(con); |
| 1261 SHUTDOWN(SSL_get_fd(con)); |
| 1262 goto re_start; |
| 1263 } |
| 1264 } |
| 1265 } |
| 1266 |
| 1267 ssl_pending = read_ssl && SSL_pending(con); |
| 1268 |
| 1269 if (!ssl_pending) |
| 1270 { |
| 1271 #if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_MSDOS) && !defined(OPE
NSSL_SYS_NETWARE) && !defined (OPENSSL_SYS_BEOS_R5) |
| 1272 if (tty_on) |
| 1273 { |
| 1274 if (read_tty) openssl_fdset(fileno(stdin),&read
fds); |
| 1275 if (write_tty) openssl_fdset(fileno(stdout),&wri
tefds); |
| 1276 } |
| 1277 if (read_ssl) |
| 1278 openssl_fdset(SSL_get_fd(con),&readfds); |
| 1279 if (write_ssl) |
| 1280 openssl_fdset(SSL_get_fd(con),&writefds); |
| 1281 #else |
| 1282 if(!tty_on || !write_tty) { |
| 1283 if (read_ssl) |
| 1284 openssl_fdset(SSL_get_fd(con),&readfds); |
| 1285 if (write_ssl) |
| 1286 openssl_fdset(SSL_get_fd(con),&writefds)
; |
| 1287 } |
| 1288 #endif |
| 1289 /* printf("mode tty(%d %d%d) ssl(%d%d)\n", |
| 1290 tty_on,read_tty,write_tty,read_ssl,write_ssl);*/ |
| 1291 |
| 1292 /* Note: under VMS with SOCKETSHR the second parameter |
| 1293 * is currently of type (int *) whereas under other |
| 1294 * systems it is (void *) if you don't have a cast it |
| 1295 * will choke the compiler: if you do have a cast then |
| 1296 * you can either go for (int *) or (void *). |
| 1297 */ |
| 1298 #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) |
| 1299 /* Under Windows/DOS we make the assumption that we can |
| 1300 * always write to the tty: therefore if we need to |
| 1301 * write to the tty we just fall through. Otherwise |
| 1302 * we timeout the select every second and see if there |
| 1303 * are any keypresses. Note: this is a hack, in a proper |
| 1304 * Windows application we wouldn't do this. |
| 1305 */ |
| 1306 i=0; |
| 1307 if(!write_tty) { |
| 1308 if(read_tty) { |
| 1309 tv.tv_sec = 1; |
| 1310 tv.tv_usec = 0; |
| 1311 i=select(width,(void *)&readfds,(void *)
&writefds, |
| 1312 NULL,&tv); |
| 1313 #if defined(OPENSSL_SYS_WINCE) || defined(OPENSSL_SYS_MSDOS) |
| 1314 if(!i && (!_kbhit() || !read_tty) ) cont
inue; |
| 1315 #else |
| 1316 if(!i && (!((_kbhit()) || (WAIT_OBJECT_0
== WaitForSingleObject(GetStdHandle(STD_INPUT_HANDLE), 0))) || !read_tty) ) con
tinue; |
| 1317 #endif |
| 1318 } else i=select(width,(void *)&readfds,(void *)
&writefds, |
| 1319 NULL,timeoutp); |
| 1320 } |
| 1321 #elif defined(OPENSSL_SYS_NETWARE) |
| 1322 if(!write_tty) { |
| 1323 if(read_tty) { |
| 1324 tv.tv_sec = 1; |
| 1325 tv.tv_usec = 0; |
| 1326 i=select(width,(void *)&readfds,(void *)
&writefds, |
| 1327 NULL,&tv); |
| 1328 } else i=select(width,(void *)&readfds,(void *)
&writefds, |
| 1329 NULL,timeoutp); |
| 1330 } |
| 1331 #elif defined(OPENSSL_SYS_BEOS_R5) |
| 1332 /* Under BeOS-R5 the situation is similar to DOS */ |
| 1333 i=0; |
| 1334 stdin_set = 0; |
| 1335 (void)fcntl(fileno(stdin), F_SETFL, O_NONBLOCK); |
| 1336 if(!write_tty) { |
| 1337 if(read_tty) { |
| 1338 tv.tv_sec = 1; |
| 1339 tv.tv_usec = 0; |
| 1340 i=select(width,(void *)&readfds,(void *)
&writefds, |
| 1341 NULL,&tv); |
| 1342 if (read(fileno(stdin), sbuf, 0) >= 0) |
| 1343 stdin_set = 1; |
| 1344 if (!i && (stdin_set != 1 || !read_tty)) |
| 1345 continue; |
| 1346 } else i=select(width,(void *)&readfds,(void *)
&writefds, |
| 1347 NULL,timeoutp); |
| 1348 } |
| 1349 (void)fcntl(fileno(stdin), F_SETFL, 0); |
| 1350 #else |
| 1351 i=select(width,(void *)&readfds,(void *)&writefds, |
| 1352 NULL,timeoutp); |
| 1353 #endif |
| 1354 if ( i < 0) |
| 1355 { |
| 1356 BIO_printf(bio_err,"bad select %d\n", |
| 1357 get_last_socket_error()); |
| 1358 goto shut; |
| 1359 /* goto end; */ |
| 1360 } |
| 1361 } |
| 1362 |
| 1363 if ((SSL_version(con) == DTLS1_VERSION) && DTLSv1_handle_timeout
(con) > 0) |
| 1364 { |
| 1365 BIO_printf(bio_err,"TIMEOUT occured\n"); |
| 1366 } |
| 1367 |
| 1368 if (!ssl_pending && FD_ISSET(SSL_get_fd(con),&writefds)) |
| 1369 { |
| 1370 k=SSL_write(con,&(cbuf[cbuf_off]), |
| 1371 (unsigned int)cbuf_len); |
| 1372 switch (SSL_get_error(con,k)) |
| 1373 { |
| 1374 case SSL_ERROR_NONE: |
| 1375 cbuf_off+=k; |
| 1376 cbuf_len-=k; |
| 1377 if (k <= 0) goto end; |
| 1378 /* we have done a write(con,NULL,0); */ |
| 1379 if (cbuf_len <= 0) |
| 1380 { |
| 1381 read_tty=1; |
| 1382 write_ssl=0; |
| 1383 } |
| 1384 else /* if (cbuf_len > 0) */ |
| 1385 { |
| 1386 read_tty=0; |
| 1387 write_ssl=1; |
| 1388 } |
| 1389 break; |
| 1390 case SSL_ERROR_WANT_WRITE: |
| 1391 BIO_printf(bio_c_out,"write W BLOCK\n"); |
| 1392 write_ssl=1; |
| 1393 read_tty=0; |
| 1394 break; |
| 1395 case SSL_ERROR_WANT_READ: |
| 1396 BIO_printf(bio_c_out,"write R BLOCK\n"); |
| 1397 write_tty=0; |
| 1398 read_ssl=1; |
| 1399 write_ssl=0; |
| 1400 break; |
| 1401 case SSL_ERROR_WANT_X509_LOOKUP: |
| 1402 BIO_printf(bio_c_out,"write X BLOCK\n"); |
| 1403 break; |
| 1404 case SSL_ERROR_ZERO_RETURN: |
| 1405 if (cbuf_len != 0) |
| 1406 { |
| 1407 BIO_printf(bio_c_out,"shutdown\n"); |
| 1408 ret = 0; |
| 1409 goto shut; |
| 1410 } |
| 1411 else |
| 1412 { |
| 1413 read_tty=1; |
| 1414 write_ssl=0; |
| 1415 break; |
| 1416 } |
| 1417 |
| 1418 case SSL_ERROR_SYSCALL: |
| 1419 if ((k != 0) || (cbuf_len != 0)) |
| 1420 { |
| 1421 BIO_printf(bio_err,"write:errno=%d\n", |
| 1422 get_last_socket_error()); |
| 1423 goto shut; |
| 1424 } |
| 1425 else |
| 1426 { |
| 1427 read_tty=1; |
| 1428 write_ssl=0; |
| 1429 } |
| 1430 break; |
| 1431 case SSL_ERROR_SSL: |
| 1432 ERR_print_errors(bio_err); |
| 1433 goto shut; |
| 1434 } |
| 1435 } |
| 1436 #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSS
L_SYS_NETWARE) || defined(OPENSSL_SYS_BEOS_R5) |
| 1437 /* Assume Windows/DOS/BeOS can always write */ |
| 1438 else if (!ssl_pending && write_tty) |
| 1439 #else |
| 1440 else if (!ssl_pending && FD_ISSET(fileno(stdout),&writefds)) |
| 1441 #endif |
| 1442 { |
| 1443 #ifdef CHARSET_EBCDIC |
| 1444 ascii2ebcdic(&(sbuf[sbuf_off]),&(sbuf[sbuf_off]),sbuf_le
n); |
| 1445 #endif |
| 1446 i=raw_write_stdout(&(sbuf[sbuf_off]),sbuf_len); |
| 1447 |
| 1448 if (i <= 0) |
| 1449 { |
| 1450 BIO_printf(bio_c_out,"DONE\n"); |
| 1451 ret = 0; |
| 1452 goto shut; |
| 1453 /* goto end; */ |
| 1454 } |
| 1455 |
| 1456 sbuf_len-=i;; |
| 1457 sbuf_off+=i; |
| 1458 if (sbuf_len <= 0) |
| 1459 { |
| 1460 read_ssl=1; |
| 1461 write_tty=0; |
| 1462 } |
| 1463 } |
| 1464 else if (ssl_pending || FD_ISSET(SSL_get_fd(con),&readfds)) |
| 1465 { |
| 1466 #ifdef RENEG |
| 1467 { static int iiii; if (++iiii == 52) { SSL_renegotiate(con); iiii=0; } } |
| 1468 #endif |
| 1469 #if 1 |
| 1470 k=SSL_read(con,sbuf,1024 /* BUFSIZZ */ ); |
| 1471 #else |
| 1472 /* Demo for pending and peek :-) */ |
| 1473 k=SSL_read(con,sbuf,16); |
| 1474 { char zbuf[10240]; |
| 1475 printf("read=%d pending=%d peek=%d\n",k,SSL_pending(con),SSL_peek(con,zbuf,10240
)); |
| 1476 } |
| 1477 #endif |
| 1478 |
| 1479 switch (SSL_get_error(con,k)) |
| 1480 { |
| 1481 case SSL_ERROR_NONE: |
| 1482 if (k <= 0) |
| 1483 goto end; |
| 1484 sbuf_off=0; |
| 1485 sbuf_len=k; |
| 1486 |
| 1487 read_ssl=0; |
| 1488 write_tty=1; |
| 1489 break; |
| 1490 case SSL_ERROR_WANT_WRITE: |
| 1491 BIO_printf(bio_c_out,"read W BLOCK\n"); |
| 1492 write_ssl=1; |
| 1493 read_tty=0; |
| 1494 break; |
| 1495 case SSL_ERROR_WANT_READ: |
| 1496 BIO_printf(bio_c_out,"read R BLOCK\n"); |
| 1497 write_tty=0; |
| 1498 read_ssl=1; |
| 1499 if ((read_tty == 0) && (write_ssl == 0)) |
| 1500 write_ssl=1; |
| 1501 break; |
| 1502 case SSL_ERROR_WANT_X509_LOOKUP: |
| 1503 BIO_printf(bio_c_out,"read X BLOCK\n"); |
| 1504 break; |
| 1505 case SSL_ERROR_SYSCALL: |
| 1506 ret=get_last_socket_error(); |
| 1507 BIO_printf(bio_err,"read:errno=%d\n",ret); |
| 1508 goto shut; |
| 1509 case SSL_ERROR_ZERO_RETURN: |
| 1510 BIO_printf(bio_c_out,"closed\n"); |
| 1511 ret=0; |
| 1512 goto shut; |
| 1513 case SSL_ERROR_SSL: |
| 1514 ERR_print_errors(bio_err); |
| 1515 goto shut; |
| 1516 /* break; */ |
| 1517 } |
| 1518 } |
| 1519 |
| 1520 #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) |
| 1521 #if defined(OPENSSL_SYS_WINCE) || defined(OPENSSL_SYS_MSDOS) |
| 1522 else if (_kbhit()) |
| 1523 #else |
| 1524 else if ((_kbhit()) || (WAIT_OBJECT_0 == WaitForSingleObject(Get
StdHandle(STD_INPUT_HANDLE), 0))) |
| 1525 #endif |
| 1526 #elif defined (OPENSSL_SYS_NETWARE) |
| 1527 else if (_kbhit()) |
| 1528 #elif defined(OPENSSL_SYS_BEOS_R5) |
| 1529 else if (stdin_set) |
| 1530 #else |
| 1531 else if (FD_ISSET(fileno(stdin),&readfds)) |
| 1532 #endif |
| 1533 { |
| 1534 if (crlf) |
| 1535 { |
| 1536 int j, lf_num; |
| 1537 |
| 1538 i=raw_read_stdin(cbuf,BUFSIZZ/2); |
| 1539 lf_num = 0; |
| 1540 /* both loops are skipped when i <= 0 */ |
| 1541 for (j = 0; j < i; j++) |
| 1542 if (cbuf[j] == '\n') |
| 1543 lf_num++; |
| 1544 for (j = i-1; j >= 0; j--) |
| 1545 { |
| 1546 cbuf[j+lf_num] = cbuf[j]; |
| 1547 if (cbuf[j] == '\n') |
| 1548 { |
| 1549 lf_num--; |
| 1550 i++; |
| 1551 cbuf[j+lf_num] = '\r'; |
| 1552 } |
| 1553 } |
| 1554 assert(lf_num == 0); |
| 1555 } |
| 1556 else |
| 1557 i=raw_read_stdin(cbuf,BUFSIZZ); |
| 1558 |
| 1559 if ((!c_ign_eof) && ((i <= 0) || (cbuf[0] == 'Q'))) |
| 1560 { |
| 1561 BIO_printf(bio_err,"DONE\n"); |
| 1562 ret=0; |
| 1563 goto shut; |
| 1564 } |
| 1565 |
| 1566 if ((!c_ign_eof) && (cbuf[0] == 'R')) |
| 1567 { |
| 1568 BIO_printf(bio_err,"RENEGOTIATING\n"); |
| 1569 SSL_renegotiate(con); |
| 1570 cbuf_len=0; |
| 1571 } |
| 1572 else |
| 1573 { |
| 1574 cbuf_len=i; |
| 1575 cbuf_off=0; |
| 1576 #ifdef CHARSET_EBCDIC |
| 1577 ebcdic2ascii(cbuf, cbuf, i); |
| 1578 #endif |
| 1579 } |
| 1580 |
| 1581 write_ssl=1; |
| 1582 read_tty=0; |
| 1583 } |
| 1584 } |
| 1585 |
| 1586 ret=0; |
| 1587 shut: |
| 1588 if (in_init) |
| 1589 print_stuff(bio_c_out,con,full_log); |
| 1590 SSL_shutdown(con); |
| 1591 SHUTDOWN(SSL_get_fd(con)); |
| 1592 end: |
| 1593 if (con != NULL) |
| 1594 { |
| 1595 if (prexit != 0) |
| 1596 print_stuff(bio_c_out,con,1); |
| 1597 SSL_free(con); |
| 1598 } |
| 1599 if (ctx != NULL) SSL_CTX_free(ctx); |
| 1600 if (cert) |
| 1601 X509_free(cert); |
| 1602 if (key) |
| 1603 EVP_PKEY_free(key); |
| 1604 if (pass) |
| 1605 OPENSSL_free(pass); |
| 1606 if (cbuf != NULL) { OPENSSL_cleanse(cbuf,BUFSIZZ); OPENSSL_free(cbuf); } |
| 1607 if (sbuf != NULL) { OPENSSL_cleanse(sbuf,BUFSIZZ); OPENSSL_free(sbuf); } |
| 1608 if (mbuf != NULL) { OPENSSL_cleanse(mbuf,BUFSIZZ); OPENSSL_free(mbuf); } |
| 1609 if (bio_c_out != NULL) |
| 1610 { |
| 1611 BIO_free(bio_c_out); |
| 1612 bio_c_out=NULL; |
| 1613 } |
| 1614 apps_shutdown(); |
| 1615 OPENSSL_EXIT(ret); |
| 1616 } |
| 1617 |
| 1618 |
| 1619 static void print_stuff(BIO *bio, SSL *s, int full) |
| 1620 { |
| 1621 X509 *peer=NULL; |
| 1622 char *p; |
| 1623 static const char *space=" "; |
| 1624 char buf[BUFSIZ]; |
| 1625 STACK_OF(X509) *sk; |
| 1626 STACK_OF(X509_NAME) *sk2; |
| 1627 const SSL_CIPHER *c; |
| 1628 X509_NAME *xn; |
| 1629 int j,i; |
| 1630 #ifndef OPENSSL_NO_COMP |
| 1631 const COMP_METHOD *comp, *expansion; |
| 1632 #endif |
| 1633 |
| 1634 if (full) |
| 1635 { |
| 1636 int got_a_chain = 0; |
| 1637 |
| 1638 sk=SSL_get_peer_cert_chain(s); |
| 1639 if (sk != NULL) |
| 1640 { |
| 1641 got_a_chain = 1; /* we don't have it for SSL2 (yet) */ |
| 1642 |
| 1643 BIO_printf(bio,"---\nCertificate chain\n"); |
| 1644 for (i=0; i<sk_X509_num(sk); i++) |
| 1645 { |
| 1646 X509_NAME_oneline(X509_get_subject_name( |
| 1647 sk_X509_value(sk,i)),buf,sizeof buf); |
| 1648 BIO_printf(bio,"%2d s:%s\n",i,buf); |
| 1649 X509_NAME_oneline(X509_get_issuer_name( |
| 1650 sk_X509_value(sk,i)),buf,sizeof buf); |
| 1651 BIO_printf(bio," i:%s\n",buf); |
| 1652 if (c_showcerts) |
| 1653 PEM_write_bio_X509(bio,sk_X509_value(sk,
i)); |
| 1654 } |
| 1655 } |
| 1656 |
| 1657 BIO_printf(bio,"---\n"); |
| 1658 peer=SSL_get_peer_certificate(s); |
| 1659 if (peer != NULL) |
| 1660 { |
| 1661 BIO_printf(bio,"Server certificate\n"); |
| 1662 if (!(c_showcerts && got_a_chain)) /* Redundant if we sh
owed the whole chain */ |
| 1663 PEM_write_bio_X509(bio,peer); |
| 1664 X509_NAME_oneline(X509_get_subject_name(peer), |
| 1665 buf,sizeof buf); |
| 1666 BIO_printf(bio,"subject=%s\n",buf); |
| 1667 X509_NAME_oneline(X509_get_issuer_name(peer), |
| 1668 buf,sizeof buf); |
| 1669 BIO_printf(bio,"issuer=%s\n",buf); |
| 1670 } |
| 1671 else |
| 1672 BIO_printf(bio,"no peer certificate available\n"); |
| 1673 |
| 1674 sk2=SSL_get_client_CA_list(s); |
| 1675 if ((sk2 != NULL) && (sk_X509_NAME_num(sk2) > 0)) |
| 1676 { |
| 1677 BIO_printf(bio,"---\nAcceptable client certificate CA na
mes\n"); |
| 1678 for (i=0; i<sk_X509_NAME_num(sk2); i++) |
| 1679 { |
| 1680 xn=sk_X509_NAME_value(sk2,i); |
| 1681 X509_NAME_oneline(xn,buf,sizeof(buf)); |
| 1682 BIO_write(bio,buf,strlen(buf)); |
| 1683 BIO_write(bio,"\n",1); |
| 1684 } |
| 1685 } |
| 1686 else |
| 1687 { |
| 1688 BIO_printf(bio,"---\nNo client certificate CA names sent
\n"); |
| 1689 } |
| 1690 p=SSL_get_shared_ciphers(s,buf,sizeof buf); |
| 1691 if (p != NULL) |
| 1692 { |
| 1693 /* This works only for SSL 2. In later protocol |
| 1694 * versions, the client does not know what other |
| 1695 * ciphers (in addition to the one to be used |
| 1696 * in the current connection) the server supports. */ |
| 1697 |
| 1698 BIO_printf(bio,"---\nCiphers common between both SSL end
points:\n"); |
| 1699 j=i=0; |
| 1700 while (*p) |
| 1701 { |
| 1702 if (*p == ':') |
| 1703 { |
| 1704 BIO_write(bio,space,15-j%25); |
| 1705 i++; |
| 1706 j=0; |
| 1707 BIO_write(bio,((i%3)?" ":"\n"),1); |
| 1708 } |
| 1709 else |
| 1710 { |
| 1711 BIO_write(bio,p,1); |
| 1712 j++; |
| 1713 } |
| 1714 p++; |
| 1715 } |
| 1716 BIO_write(bio,"\n",1); |
| 1717 } |
| 1718 |
| 1719 BIO_printf(bio,"---\nSSL handshake has read %ld bytes and writte
n %ld bytes\n", |
| 1720 BIO_number_read(SSL_get_rbio(s)), |
| 1721 BIO_number_written(SSL_get_wbio(s))); |
| 1722 } |
| 1723 BIO_printf(bio,((s->hit)?"---\nReused, ":"---\nNew, ")); |
| 1724 c=SSL_get_current_cipher(s); |
| 1725 BIO_printf(bio,"%s, Cipher is %s\n", |
| 1726 SSL_CIPHER_get_version(c), |
| 1727 SSL_CIPHER_get_name(c)); |
| 1728 if (peer != NULL) { |
| 1729 EVP_PKEY *pktmp; |
| 1730 pktmp = X509_get_pubkey(peer); |
| 1731 BIO_printf(bio,"Server public key is %d bit\n", |
| 1732 EVP_PKEY_bits(pktmp)); |
| 1733 EVP_PKEY_free(pktmp); |
| 1734 } |
| 1735 BIO_printf(bio, "Secure Renegotiation IS%s supported\n", |
| 1736 SSL_get_secure_renegotiation_support(s) ? "" : " NOT"); |
| 1737 #ifndef OPENSSL_NO_COMP |
| 1738 comp=SSL_get_current_compression(s); |
| 1739 expansion=SSL_get_current_expansion(s); |
| 1740 BIO_printf(bio,"Compression: %s\n", |
| 1741 comp ? SSL_COMP_get_name(comp) : "NONE"); |
| 1742 BIO_printf(bio,"Expansion: %s\n", |
| 1743 expansion ? SSL_COMP_get_name(expansion) : "NONE"); |
| 1744 #endif |
| 1745 SSL_SESSION_print(bio,SSL_get_session(s)); |
| 1746 BIO_printf(bio,"---\n"); |
| 1747 if (peer != NULL) |
| 1748 X509_free(peer); |
| 1749 /* flush, or debugging output gets mixed with http response */ |
| 1750 (void)BIO_flush(bio); |
| 1751 } |
| 1752 |
| 1753 #ifndef OPENSSL_NO_TLSEXT |
| 1754 |
| 1755 static int ocsp_resp_cb(SSL *s, void *arg) |
| 1756 { |
| 1757 const unsigned char *p; |
| 1758 int len; |
| 1759 OCSP_RESPONSE *rsp; |
| 1760 len = SSL_get_tlsext_status_ocsp_resp(s, &p); |
| 1761 BIO_puts(arg, "OCSP response: "); |
| 1762 if (!p) |
| 1763 { |
| 1764 BIO_puts(arg, "no response sent\n"); |
| 1765 return 1; |
| 1766 } |
| 1767 rsp = d2i_OCSP_RESPONSE(NULL, &p, len); |
| 1768 if (!rsp) |
| 1769 { |
| 1770 BIO_puts(arg, "response parse error\n"); |
| 1771 BIO_dump_indent(arg, (char *)p, len, 4); |
| 1772 return 0; |
| 1773 } |
| 1774 BIO_puts(arg, "\n======================================\n"); |
| 1775 OCSP_RESPONSE_print(arg, rsp, 0); |
| 1776 BIO_puts(arg, "======================================\n"); |
| 1777 OCSP_RESPONSE_free(rsp); |
| 1778 return 1; |
| 1779 } |
| 1780 |
| 1781 #endif |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 9254031:
Upgrade chrome's OpenSSL to same version Android ships with. (Closed)
Base URL: http://src.chromium.org/svn/trunk/deps/third_party/openssl/