1ebfedea0SLionel Sambuc /* apps/s_client.c */
2ebfedea0SLionel Sambuc /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3ebfedea0SLionel Sambuc * All rights reserved.
4ebfedea0SLionel Sambuc *
5ebfedea0SLionel Sambuc * This package is an SSL implementation written
6ebfedea0SLionel Sambuc * by Eric Young (eay@cryptsoft.com).
7ebfedea0SLionel Sambuc * The implementation was written so as to conform with Netscapes SSL.
8ebfedea0SLionel Sambuc *
9ebfedea0SLionel Sambuc * This library is free for commercial and non-commercial use as long as
10ebfedea0SLionel Sambuc * the following conditions are aheared to. The following conditions
11ebfedea0SLionel Sambuc * apply to all code found in this distribution, be it the RC4, RSA,
12ebfedea0SLionel Sambuc * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13ebfedea0SLionel Sambuc * included with this distribution is covered by the same copyright terms
14ebfedea0SLionel Sambuc * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15ebfedea0SLionel Sambuc *
16ebfedea0SLionel Sambuc * Copyright remains Eric Young's, and as such any Copyright notices in
17ebfedea0SLionel Sambuc * the code are not to be removed.
18ebfedea0SLionel Sambuc * If this package is used in a product, Eric Young should be given attribution
19ebfedea0SLionel Sambuc * as the author of the parts of the library used.
20ebfedea0SLionel Sambuc * This can be in the form of a textual message at program startup or
21ebfedea0SLionel Sambuc * in documentation (online or textual) provided with the package.
22ebfedea0SLionel Sambuc *
23ebfedea0SLionel Sambuc * Redistribution and use in source and binary forms, with or without
24ebfedea0SLionel Sambuc * modification, are permitted provided that the following conditions
25ebfedea0SLionel Sambuc * are met:
26ebfedea0SLionel Sambuc * 1. Redistributions of source code must retain the copyright
27ebfedea0SLionel Sambuc * notice, this list of conditions and the following disclaimer.
28ebfedea0SLionel Sambuc * 2. Redistributions in binary form must reproduce the above copyright
29ebfedea0SLionel Sambuc * notice, this list of conditions and the following disclaimer in the
30ebfedea0SLionel Sambuc * documentation and/or other materials provided with the distribution.
31ebfedea0SLionel Sambuc * 3. All advertising materials mentioning features or use of this software
32ebfedea0SLionel Sambuc * must display the following acknowledgement:
33ebfedea0SLionel Sambuc * "This product includes cryptographic software written by
34ebfedea0SLionel Sambuc * Eric Young (eay@cryptsoft.com)"
35ebfedea0SLionel Sambuc * The word 'cryptographic' can be left out if the rouines from the library
36ebfedea0SLionel Sambuc * being used are not cryptographic related :-).
37ebfedea0SLionel Sambuc * 4. If you include any Windows specific code (or a derivative thereof) from
38ebfedea0SLionel Sambuc * the apps directory (application code) you must include an acknowledgement:
39ebfedea0SLionel Sambuc * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40ebfedea0SLionel Sambuc *
41ebfedea0SLionel Sambuc * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42ebfedea0SLionel Sambuc * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43ebfedea0SLionel Sambuc * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44ebfedea0SLionel Sambuc * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45ebfedea0SLionel Sambuc * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46ebfedea0SLionel Sambuc * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47ebfedea0SLionel Sambuc * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48ebfedea0SLionel Sambuc * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49ebfedea0SLionel Sambuc * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50ebfedea0SLionel Sambuc * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51ebfedea0SLionel Sambuc * SUCH DAMAGE.
52ebfedea0SLionel Sambuc *
53ebfedea0SLionel Sambuc * The licence and distribution terms for any publically available version or
54ebfedea0SLionel Sambuc * derivative of this code cannot be changed. i.e. this code cannot simply be
55ebfedea0SLionel Sambuc * copied and put under another distribution licence
56ebfedea0SLionel Sambuc * [including the GNU Public Licence.]
57ebfedea0SLionel Sambuc */
58ebfedea0SLionel Sambuc /* ====================================================================
59ebfedea0SLionel Sambuc * Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved.
60ebfedea0SLionel Sambuc *
61ebfedea0SLionel Sambuc * Redistribution and use in source and binary forms, with or without
62ebfedea0SLionel Sambuc * modification, are permitted provided that the following conditions
63ebfedea0SLionel Sambuc * are met:
64ebfedea0SLionel Sambuc *
65ebfedea0SLionel Sambuc * 1. Redistributions of source code must retain the above copyright
66ebfedea0SLionel Sambuc * notice, this list of conditions and the following disclaimer.
67ebfedea0SLionel Sambuc *
68ebfedea0SLionel Sambuc * 2. Redistributions in binary form must reproduce the above copyright
69ebfedea0SLionel Sambuc * notice, this list of conditions and the following disclaimer in
70ebfedea0SLionel Sambuc * the documentation and/or other materials provided with the
71ebfedea0SLionel Sambuc * distribution.
72ebfedea0SLionel Sambuc *
73ebfedea0SLionel Sambuc * 3. All advertising materials mentioning features or use of this
74ebfedea0SLionel Sambuc * software must display the following acknowledgment:
75ebfedea0SLionel Sambuc * "This product includes software developed by the OpenSSL Project
76ebfedea0SLionel Sambuc * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77ebfedea0SLionel Sambuc *
78ebfedea0SLionel Sambuc * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79ebfedea0SLionel Sambuc * endorse or promote products derived from this software without
80ebfedea0SLionel Sambuc * prior written permission. For written permission, please contact
81ebfedea0SLionel Sambuc * openssl-core@openssl.org.
82ebfedea0SLionel Sambuc *
83ebfedea0SLionel Sambuc * 5. Products derived from this software may not be called "OpenSSL"
84ebfedea0SLionel Sambuc * nor may "OpenSSL" appear in their names without prior written
85ebfedea0SLionel Sambuc * permission of the OpenSSL Project.
86ebfedea0SLionel Sambuc *
87ebfedea0SLionel Sambuc * 6. Redistributions of any form whatsoever must retain the following
88ebfedea0SLionel Sambuc * acknowledgment:
89ebfedea0SLionel Sambuc * "This product includes software developed by the OpenSSL Project
90ebfedea0SLionel Sambuc * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91ebfedea0SLionel Sambuc *
92ebfedea0SLionel Sambuc * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93ebfedea0SLionel Sambuc * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94ebfedea0SLionel Sambuc * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95ebfedea0SLionel Sambuc * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96ebfedea0SLionel Sambuc * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97ebfedea0SLionel Sambuc * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98ebfedea0SLionel Sambuc * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99ebfedea0SLionel Sambuc * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100ebfedea0SLionel Sambuc * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101ebfedea0SLionel Sambuc * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102ebfedea0SLionel Sambuc * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103ebfedea0SLionel Sambuc * OF THE POSSIBILITY OF SUCH DAMAGE.
104ebfedea0SLionel Sambuc * ====================================================================
105ebfedea0SLionel Sambuc *
106ebfedea0SLionel Sambuc * This product includes cryptographic software written by Eric Young
107ebfedea0SLionel Sambuc * (eay@cryptsoft.com). This product includes software written by Tim
108ebfedea0SLionel Sambuc * Hudson (tjh@cryptsoft.com).
109ebfedea0SLionel Sambuc *
110ebfedea0SLionel Sambuc */
111ebfedea0SLionel Sambuc /* ====================================================================
112ebfedea0SLionel Sambuc * Copyright 2005 Nokia. All rights reserved.
113ebfedea0SLionel Sambuc *
114ebfedea0SLionel Sambuc * The portions of the attached software ("Contribution") is developed by
115ebfedea0SLionel Sambuc * Nokia Corporation and is licensed pursuant to the OpenSSL open source
116ebfedea0SLionel Sambuc * license.
117ebfedea0SLionel Sambuc *
118ebfedea0SLionel Sambuc * The Contribution, originally written by Mika Kousa and Pasi Eronen of
119ebfedea0SLionel Sambuc * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
120ebfedea0SLionel Sambuc * support (see RFC 4279) to OpenSSL.
121ebfedea0SLionel Sambuc *
122ebfedea0SLionel Sambuc * No patent licenses or other rights except those expressly stated in
123ebfedea0SLionel Sambuc * the OpenSSL open source license shall be deemed granted or received
124ebfedea0SLionel Sambuc * expressly, by implication, estoppel, or otherwise.
125ebfedea0SLionel Sambuc *
126ebfedea0SLionel Sambuc * No assurances are provided by Nokia that the Contribution does not
127ebfedea0SLionel Sambuc * infringe the patent or other intellectual property rights of any third
128ebfedea0SLionel Sambuc * party or that the license provides you with all the necessary rights
129ebfedea0SLionel Sambuc * to make use of the Contribution.
130ebfedea0SLionel Sambuc *
131ebfedea0SLionel Sambuc * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
132ebfedea0SLionel Sambuc * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
133ebfedea0SLionel Sambuc * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
134ebfedea0SLionel Sambuc * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
135ebfedea0SLionel Sambuc * OTHERWISE.
136ebfedea0SLionel Sambuc */
137ebfedea0SLionel Sambuc
138ebfedea0SLionel Sambuc #include <assert.h>
139ebfedea0SLionel Sambuc #include <ctype.h>
140ebfedea0SLionel Sambuc #include <stdio.h>
141ebfedea0SLionel Sambuc #include <stdlib.h>
142ebfedea0SLionel Sambuc #include <string.h>
143ebfedea0SLionel Sambuc #include <openssl/e_os2.h>
144ebfedea0SLionel Sambuc #ifdef OPENSSL_NO_STDIO
145ebfedea0SLionel Sambuc # define APPS_WIN16
146ebfedea0SLionel Sambuc #endif
147ebfedea0SLionel Sambuc
148*0a6a1f1dSLionel Sambuc /*
149*0a6a1f1dSLionel Sambuc * With IPv6, it looks like Digital has mixed up the proper order of
150*0a6a1f1dSLionel Sambuc * recursive header file inclusion, resulting in the compiler complaining
151*0a6a1f1dSLionel Sambuc * that u_int isn't defined, but only if _POSIX_C_SOURCE is defined, which is
152*0a6a1f1dSLionel Sambuc * needed to have fileno() declared correctly... So let's define u_int
153*0a6a1f1dSLionel Sambuc */
154ebfedea0SLionel Sambuc #if defined(OPENSSL_SYS_VMS_DECC) && !defined(__U_INT)
155ebfedea0SLionel Sambuc # define __U_INT
156ebfedea0SLionel Sambuc typedef unsigned int u_int;
157ebfedea0SLionel Sambuc #endif
158ebfedea0SLionel Sambuc
159ebfedea0SLionel Sambuc #define USE_SOCKETS
160ebfedea0SLionel Sambuc #include "apps.h"
161ebfedea0SLionel Sambuc #include <openssl/x509.h>
162ebfedea0SLionel Sambuc #include <openssl/ssl.h>
163ebfedea0SLionel Sambuc #include <openssl/err.h>
164ebfedea0SLionel Sambuc #include <openssl/pem.h>
165ebfedea0SLionel Sambuc #include <openssl/rand.h>
166ebfedea0SLionel Sambuc #include <openssl/ocsp.h>
167ebfedea0SLionel Sambuc #include <openssl/bn.h>
168ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_SRP
169ebfedea0SLionel Sambuc # include <openssl/srp.h>
170ebfedea0SLionel Sambuc #endif
171ebfedea0SLionel Sambuc #include "s_apps.h"
172ebfedea0SLionel Sambuc #include "timeouts.h"
173ebfedea0SLionel Sambuc
174ebfedea0SLionel Sambuc #if (defined(OPENSSL_SYS_VMS) && __VMS_VER < 70000000)
175ebfedea0SLionel Sambuc /* FIONBIO used as a switch to enable ioctl, and that isn't in VMS < 7.0 */
176ebfedea0SLionel Sambuc # undef FIONBIO
177ebfedea0SLionel Sambuc #endif
178ebfedea0SLionel Sambuc
179ebfedea0SLionel Sambuc #if defined(OPENSSL_SYS_BEOS_R5)
180ebfedea0SLionel Sambuc # include <fcntl.h>
181ebfedea0SLionel Sambuc #endif
182ebfedea0SLionel Sambuc
183ebfedea0SLionel Sambuc #undef PROG
184ebfedea0SLionel Sambuc #define PROG s_client_main
185ebfedea0SLionel Sambuc
186*0a6a1f1dSLionel Sambuc /*
187*0a6a1f1dSLionel Sambuc * #define SSL_HOST_NAME "www.netscape.com"
188*0a6a1f1dSLionel Sambuc */
189*0a6a1f1dSLionel Sambuc /*
190*0a6a1f1dSLionel Sambuc * #define SSL_HOST_NAME "193.118.187.102"
191*0a6a1f1dSLionel Sambuc */
192ebfedea0SLionel Sambuc #define SSL_HOST_NAME "localhost"
193ebfedea0SLionel Sambuc
194*0a6a1f1dSLionel Sambuc /* no default cert. */
195*0a6a1f1dSLionel Sambuc /*
196*0a6a1f1dSLionel Sambuc * #define TEST_CERT "client.pem"
197*0a6a1f1dSLionel Sambuc */
198ebfedea0SLionel Sambuc
199ebfedea0SLionel Sambuc #undef BUFSIZZ
200ebfedea0SLionel Sambuc #define BUFSIZZ 1024*8
201ebfedea0SLionel Sambuc
202ebfedea0SLionel Sambuc extern int verify_depth;
203ebfedea0SLionel Sambuc extern int verify_error;
204ebfedea0SLionel Sambuc extern int verify_return_error;
205ebfedea0SLionel Sambuc
206ebfedea0SLionel Sambuc #ifdef FIONBIO
207ebfedea0SLionel Sambuc static int c_nbio = 0;
208ebfedea0SLionel Sambuc #endif
209ebfedea0SLionel Sambuc static int c_Pause = 0;
210ebfedea0SLionel Sambuc static int c_debug = 0;
211ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_TLSEXT
212ebfedea0SLionel Sambuc static int c_tlsextdebug = 0;
213ebfedea0SLionel Sambuc static int c_status_req = 0;
214ebfedea0SLionel Sambuc #endif
215ebfedea0SLionel Sambuc static int c_msg = 0;
216ebfedea0SLionel Sambuc static int c_showcerts = 0;
217ebfedea0SLionel Sambuc
218ebfedea0SLionel Sambuc static char *keymatexportlabel = NULL;
219ebfedea0SLionel Sambuc static int keymatexportlen = 20;
220ebfedea0SLionel Sambuc
221ebfedea0SLionel Sambuc static void sc_usage(void);
222ebfedea0SLionel Sambuc static void print_stuff(BIO *berr, SSL *con, int full);
223ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_TLSEXT
224ebfedea0SLionel Sambuc static int ocsp_resp_cb(SSL *s, void *arg);
225ebfedea0SLionel Sambuc #endif
226ebfedea0SLionel Sambuc static BIO *bio_c_out = NULL;
227ebfedea0SLionel Sambuc static int c_quiet = 0;
228ebfedea0SLionel Sambuc static int c_ign_eof = 0;
229ebfedea0SLionel Sambuc
230ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_PSK
231ebfedea0SLionel Sambuc /* Default PSK identity and key */
232ebfedea0SLionel Sambuc static char *psk_identity = "Client_identity";
233*0a6a1f1dSLionel Sambuc /*
234*0a6a1f1dSLionel Sambuc * char *psk_key=NULL; by default PSK is not used
235*0a6a1f1dSLionel Sambuc */
236ebfedea0SLionel Sambuc
psk_client_cb(SSL * ssl,const char * hint,char * identity,unsigned int max_identity_len,unsigned char * psk,unsigned int max_psk_len)237ebfedea0SLionel Sambuc static unsigned int psk_client_cb(SSL *ssl, const char *hint, char *identity,
238*0a6a1f1dSLionel Sambuc unsigned int max_identity_len,
239*0a6a1f1dSLionel Sambuc unsigned char *psk,
240ebfedea0SLionel Sambuc unsigned int max_psk_len)
241ebfedea0SLionel Sambuc {
242ebfedea0SLionel Sambuc unsigned int psk_len = 0;
243ebfedea0SLionel Sambuc int ret;
244ebfedea0SLionel Sambuc BIGNUM *bn = NULL;
245ebfedea0SLionel Sambuc
246ebfedea0SLionel Sambuc if (c_debug)
247ebfedea0SLionel Sambuc BIO_printf(bio_c_out, "psk_client_cb\n");
248*0a6a1f1dSLionel Sambuc if (!hint) {
249ebfedea0SLionel Sambuc /* no ServerKeyExchange message */
250ebfedea0SLionel Sambuc if (c_debug)
251*0a6a1f1dSLionel Sambuc BIO_printf(bio_c_out,
252*0a6a1f1dSLionel Sambuc "NULL received PSK identity hint, continuing anyway\n");
253*0a6a1f1dSLionel Sambuc } else if (c_debug)
254ebfedea0SLionel Sambuc BIO_printf(bio_c_out, "Received PSK identity hint '%s'\n", hint);
255ebfedea0SLionel Sambuc
256*0a6a1f1dSLionel Sambuc /*
257*0a6a1f1dSLionel Sambuc * lookup PSK identity and PSK key based on the given identity hint here
258*0a6a1f1dSLionel Sambuc */
259ebfedea0SLionel Sambuc ret = BIO_snprintf(identity, max_identity_len, "%s", psk_identity);
260ebfedea0SLionel Sambuc if (ret < 0 || (unsigned int)ret > max_identity_len)
261ebfedea0SLionel Sambuc goto out_err;
262ebfedea0SLionel Sambuc if (c_debug)
263*0a6a1f1dSLionel Sambuc BIO_printf(bio_c_out, "created identity '%s' len=%d\n", identity,
264*0a6a1f1dSLionel Sambuc ret);
265ebfedea0SLionel Sambuc ret = BN_hex2bn(&bn, psk_key);
266*0a6a1f1dSLionel Sambuc if (!ret) {
267*0a6a1f1dSLionel Sambuc BIO_printf(bio_err, "Could not convert PSK key '%s' to BIGNUM\n",
268*0a6a1f1dSLionel Sambuc psk_key);
269ebfedea0SLionel Sambuc if (bn)
270ebfedea0SLionel Sambuc BN_free(bn);
271ebfedea0SLionel Sambuc return 0;
272ebfedea0SLionel Sambuc }
273ebfedea0SLionel Sambuc
274*0a6a1f1dSLionel Sambuc if ((unsigned int)BN_num_bytes(bn) > max_psk_len) {
275*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
276*0a6a1f1dSLionel Sambuc "psk buffer of callback is too small (%d) for key (%d)\n",
277ebfedea0SLionel Sambuc max_psk_len, BN_num_bytes(bn));
278ebfedea0SLionel Sambuc BN_free(bn);
279ebfedea0SLionel Sambuc return 0;
280ebfedea0SLionel Sambuc }
281ebfedea0SLionel Sambuc
282ebfedea0SLionel Sambuc psk_len = BN_bn2bin(bn, psk);
283ebfedea0SLionel Sambuc BN_free(bn);
284ebfedea0SLionel Sambuc if (psk_len == 0)
285ebfedea0SLionel Sambuc goto out_err;
286ebfedea0SLionel Sambuc
287ebfedea0SLionel Sambuc if (c_debug)
288ebfedea0SLionel Sambuc BIO_printf(bio_c_out, "created PSK len=%d\n", psk_len);
289ebfedea0SLionel Sambuc
290ebfedea0SLionel Sambuc return psk_len;
291ebfedea0SLionel Sambuc out_err:
292ebfedea0SLionel Sambuc if (c_debug)
293ebfedea0SLionel Sambuc BIO_printf(bio_err, "Error in PSK client callback\n");
294ebfedea0SLionel Sambuc return 0;
295ebfedea0SLionel Sambuc }
296ebfedea0SLionel Sambuc #endif
297ebfedea0SLionel Sambuc
sc_usage(void)298ebfedea0SLionel Sambuc static void sc_usage(void)
299ebfedea0SLionel Sambuc {
300ebfedea0SLionel Sambuc BIO_printf(bio_err, "usage: s_client args\n");
301ebfedea0SLionel Sambuc BIO_printf(bio_err, "\n");
302ebfedea0SLionel Sambuc BIO_printf(bio_err, " -host host - use -connect instead\n");
303ebfedea0SLionel Sambuc BIO_printf(bio_err, " -port port - use -connect instead\n");
304*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
305*0a6a1f1dSLionel Sambuc " -connect host:port - who to connect to (default is %s:%s)\n",
306*0a6a1f1dSLionel Sambuc SSL_HOST_NAME, PORT_STR);
307ebfedea0SLionel Sambuc
308*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
309*0a6a1f1dSLionel Sambuc " -verify arg - turn on peer certificate verification\n");
310*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
311*0a6a1f1dSLionel Sambuc " -verify_return_error - return verification errors\n");
312*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
313*0a6a1f1dSLionel Sambuc " -cert arg - certificate file to use, PEM format assumed\n");
314*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
315*0a6a1f1dSLionel Sambuc " -certform arg - certificate format (PEM or DER) PEM default\n");
316*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
317*0a6a1f1dSLionel Sambuc " -key arg - Private key file to use, in cert file if\n");
318ebfedea0SLionel Sambuc BIO_printf(bio_err, " not specified but cert file is.\n");
319*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
320*0a6a1f1dSLionel Sambuc " -keyform arg - key format (PEM or DER) PEM default\n");
321*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
322*0a6a1f1dSLionel Sambuc " -pass arg - private key file pass phrase source\n");
323ebfedea0SLionel Sambuc BIO_printf(bio_err, " -CApath arg - PEM format directory of CA's\n");
324ebfedea0SLionel Sambuc BIO_printf(bio_err, " -CAfile arg - PEM format file of CA's\n");
325*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
326*0a6a1f1dSLionel Sambuc " -no_alt_chains - only ever use the first certificate chain found\n");
327*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
328*0a6a1f1dSLionel Sambuc " -reconnect - Drop and re-make the connection with the same Session-ID\n");
329*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
330*0a6a1f1dSLionel Sambuc " -pause - sleep(1) after each read(2) and write(2) system call\n");
331*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
332*0a6a1f1dSLionel Sambuc " -prexit - print session information even on connection failure\n");
333*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
334*0a6a1f1dSLionel Sambuc " -showcerts - show all certificates in the chain\n");
335ebfedea0SLionel Sambuc BIO_printf(bio_err, " -debug - extra output\n");
336ebfedea0SLionel Sambuc #ifdef WATT32
337ebfedea0SLionel Sambuc BIO_printf(bio_err, " -wdebug - WATT-32 tcp debugging\n");
338ebfedea0SLionel Sambuc #endif
339ebfedea0SLionel Sambuc BIO_printf(bio_err, " -msg - Show protocol messages\n");
340ebfedea0SLionel Sambuc BIO_printf(bio_err, " -nbio_test - more ssl protocol testing\n");
341ebfedea0SLionel Sambuc BIO_printf(bio_err, " -state - print the 'ssl' states\n");
342ebfedea0SLionel Sambuc #ifdef FIONBIO
343ebfedea0SLionel Sambuc BIO_printf(bio_err, " -nbio - Run with non-blocking IO\n");
344ebfedea0SLionel Sambuc #endif
345*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
346*0a6a1f1dSLionel Sambuc " -crlf - convert LF from terminal into CRLF\n");
347ebfedea0SLionel Sambuc BIO_printf(bio_err, " -quiet - no s_client output\n");
348*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
349*0a6a1f1dSLionel Sambuc " -ign_eof - ignore input eof (default when -quiet)\n");
350ebfedea0SLionel Sambuc BIO_printf(bio_err, " -no_ign_eof - don't ignore input eof\n");
351ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_PSK
352ebfedea0SLionel Sambuc BIO_printf(bio_err, " -psk_identity arg - PSK identity\n");
353ebfedea0SLionel Sambuc BIO_printf(bio_err, " -psk arg - PSK in hex (without 0x)\n");
354ebfedea0SLionel Sambuc # ifndef OPENSSL_NO_JPAKE
355ebfedea0SLionel Sambuc BIO_printf(bio_err, " -jpake arg - JPAKE secret to use\n");
356ebfedea0SLionel Sambuc # endif
357ebfedea0SLionel Sambuc #endif
358ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_SRP
359*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
360*0a6a1f1dSLionel Sambuc " -srpuser user - SRP authentification for 'user'\n");
361ebfedea0SLionel Sambuc BIO_printf(bio_err, " -srppass arg - password for 'user'\n");
362*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
363*0a6a1f1dSLionel Sambuc " -srp_lateuser - SRP username into second ClientHello message\n");
364*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
365*0a6a1f1dSLionel Sambuc " -srp_moregroups - Tolerate other than the known g N values.\n");
366*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
367*0a6a1f1dSLionel Sambuc " -srp_strength int - minimal length in bits for N (default %d).\n",
368*0a6a1f1dSLionel Sambuc SRP_MINIMAL_N);
369ebfedea0SLionel Sambuc #endif
370ebfedea0SLionel Sambuc BIO_printf(bio_err, " -ssl2 - just use SSLv2\n");
371*0a6a1f1dSLionel Sambuc #ifndef OPENSSL_NO_SSL3_METHOD
372ebfedea0SLionel Sambuc BIO_printf(bio_err, " -ssl3 - just use SSLv3\n");
373*0a6a1f1dSLionel Sambuc #endif
374ebfedea0SLionel Sambuc BIO_printf(bio_err, " -tls1_2 - just use TLSv1.2\n");
375ebfedea0SLionel Sambuc BIO_printf(bio_err, " -tls1_1 - just use TLSv1.1\n");
376ebfedea0SLionel Sambuc BIO_printf(bio_err, " -tls1 - just use TLSv1\n");
377ebfedea0SLionel Sambuc BIO_printf(bio_err, " -dtls1 - just use DTLSv1\n");
378*0a6a1f1dSLionel Sambuc BIO_printf(bio_err, " -fallback_scsv - send TLS_FALLBACK_SCSV\n");
379ebfedea0SLionel Sambuc BIO_printf(bio_err, " -mtu - set the link layer MTU\n");
380*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
381*0a6a1f1dSLionel Sambuc " -no_tls1_2/-no_tls1_1/-no_tls1/-no_ssl3/-no_ssl2 - turn off that protocol\n");
382*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
383*0a6a1f1dSLionel Sambuc " -bugs - Switch on all SSL implementation bug workarounds\n");
384*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
385*0a6a1f1dSLionel Sambuc " -serverpref - Use server's cipher preferences (only SSLv2)\n");
386*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
387*0a6a1f1dSLionel Sambuc " -cipher - preferred cipher to use, use the 'openssl ciphers'\n");
388*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
389*0a6a1f1dSLionel Sambuc " command to see what is available\n");
390*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
391*0a6a1f1dSLionel Sambuc " -starttls prot - use the STARTTLS command before starting TLS\n");
392*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
393*0a6a1f1dSLionel Sambuc " for those protocols that support it, where\n");
394*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
395*0a6a1f1dSLionel Sambuc " 'prot' defines which one to assume. Currently,\n");
396*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
397*0a6a1f1dSLionel Sambuc " only \"smtp\", \"pop3\", \"imap\", \"ftp\" and \"xmpp\"\n");
398ebfedea0SLionel Sambuc BIO_printf(bio_err, " are supported.\n");
399ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_ENGINE
400*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
401*0a6a1f1dSLionel Sambuc " -engine id - Initialise and use the specified engine\n");
402ebfedea0SLionel Sambuc #endif
403*0a6a1f1dSLionel Sambuc BIO_printf(bio_err, " -rand file%cfile%c...\n", LIST_SEPARATOR_CHAR,
404*0a6a1f1dSLionel Sambuc LIST_SEPARATOR_CHAR);
405ebfedea0SLionel Sambuc BIO_printf(bio_err, " -sess_out arg - file to write SSL session to\n");
406ebfedea0SLionel Sambuc BIO_printf(bio_err, " -sess_in arg - file to read SSL session from\n");
407ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_TLSEXT
408*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
409*0a6a1f1dSLionel Sambuc " -servername host - Set TLS extension servername in ClientHello\n");
410*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
411*0a6a1f1dSLionel Sambuc " -tlsextdebug - hex dump of all TLS extensions received\n");
412*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
413*0a6a1f1dSLionel Sambuc " -status - request certificate status from server\n");
414*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
415*0a6a1f1dSLionel Sambuc " -no_ticket - disable use of RFC4507bis session tickets\n");
416ebfedea0SLionel Sambuc # ifndef OPENSSL_NO_NEXTPROTONEG
417*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
418*0a6a1f1dSLionel Sambuc " -nextprotoneg arg - enable NPN extension, considering named protocols supported (comma-separated list)\n");
419ebfedea0SLionel Sambuc # endif
420ebfedea0SLionel Sambuc #endif
421*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
422*0a6a1f1dSLionel Sambuc " -legacy_renegotiation - enable use of legacy renegotiation (dangerous)\n");
423ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_SRTP
424*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
425*0a6a1f1dSLionel Sambuc " -use_srtp profiles - Offer SRTP key management with a colon-separated profile list\n");
426ebfedea0SLionel Sambuc #endif
427*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
428*0a6a1f1dSLionel Sambuc " -keymatexport label - Export keying material using label\n");
429*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
430*0a6a1f1dSLionel Sambuc " -keymatexportlen len - Export len bytes of keying material (default 20)\n");
431ebfedea0SLionel Sambuc }
432ebfedea0SLionel Sambuc
433ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_TLSEXT
434ebfedea0SLionel Sambuc
435ebfedea0SLionel Sambuc /* This is a context that we pass to callbacks */
436ebfedea0SLionel Sambuc typedef struct tlsextctx_st {
437ebfedea0SLionel Sambuc BIO *biodebug;
438ebfedea0SLionel Sambuc int ack;
439ebfedea0SLionel Sambuc } tlsextctx;
440ebfedea0SLionel Sambuc
ssl_servername_cb(SSL * s,int * ad,void * arg)441ebfedea0SLionel Sambuc static int MS_CALLBACK ssl_servername_cb(SSL *s, int *ad, void *arg)
442ebfedea0SLionel Sambuc {
443ebfedea0SLionel Sambuc tlsextctx *p = (tlsextctx *) arg;
444ebfedea0SLionel Sambuc const char *hn = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
445ebfedea0SLionel Sambuc if (SSL_get_servername_type(s) != -1)
446ebfedea0SLionel Sambuc p->ack = !SSL_session_reused(s) && hn != NULL;
447ebfedea0SLionel Sambuc else
448ebfedea0SLionel Sambuc BIO_printf(bio_err, "Can't use SSL_get_servername\n");
449ebfedea0SLionel Sambuc
450ebfedea0SLionel Sambuc return SSL_TLSEXT_ERR_OK;
451ebfedea0SLionel Sambuc }
452ebfedea0SLionel Sambuc
453ebfedea0SLionel Sambuc # ifndef OPENSSL_NO_SRP
454ebfedea0SLionel Sambuc
455ebfedea0SLionel Sambuc /* This is a context that we pass to all callbacks */
456*0a6a1f1dSLionel Sambuc typedef struct srp_arg_st {
457ebfedea0SLionel Sambuc char *srppassin;
458ebfedea0SLionel Sambuc char *srplogin;
459ebfedea0SLionel Sambuc int msg; /* copy from c_msg */
460ebfedea0SLionel Sambuc int debug; /* copy from c_debug */
461ebfedea0SLionel Sambuc int amp; /* allow more groups */
462ebfedea0SLionel Sambuc int strength /* minimal size for N */ ;
463ebfedea0SLionel Sambuc } SRP_ARG;
464ebfedea0SLionel Sambuc
465ebfedea0SLionel Sambuc # define SRP_NUMBER_ITERATIONS_FOR_PRIME 64
466ebfedea0SLionel Sambuc
srp_Verify_N_and_g(BIGNUM * N,BIGNUM * g)467ebfedea0SLionel Sambuc static int srp_Verify_N_and_g(BIGNUM *N, BIGNUM *g)
468ebfedea0SLionel Sambuc {
469ebfedea0SLionel Sambuc BN_CTX *bn_ctx = BN_CTX_new();
470ebfedea0SLionel Sambuc BIGNUM *p = BN_new();
471ebfedea0SLionel Sambuc BIGNUM *r = BN_new();
472ebfedea0SLionel Sambuc int ret =
473ebfedea0SLionel Sambuc g != NULL && N != NULL && bn_ctx != NULL && BN_is_odd(N) &&
474ebfedea0SLionel Sambuc BN_is_prime_ex(N, SRP_NUMBER_ITERATIONS_FOR_PRIME, bn_ctx, NULL) &&
475ebfedea0SLionel Sambuc p != NULL && BN_rshift1(p, N) &&
476ebfedea0SLionel Sambuc /* p = (N-1)/2 */
477ebfedea0SLionel Sambuc BN_is_prime_ex(p, SRP_NUMBER_ITERATIONS_FOR_PRIME, bn_ctx, NULL) &&
478ebfedea0SLionel Sambuc r != NULL &&
479ebfedea0SLionel Sambuc /* verify g^((N-1)/2) == -1 (mod N) */
480ebfedea0SLionel Sambuc BN_mod_exp(r, g, p, N, bn_ctx) &&
481*0a6a1f1dSLionel Sambuc BN_add_word(r, 1) && BN_cmp(r, N) == 0;
482ebfedea0SLionel Sambuc
483ebfedea0SLionel Sambuc if (r)
484ebfedea0SLionel Sambuc BN_free(r);
485ebfedea0SLionel Sambuc if (p)
486ebfedea0SLionel Sambuc BN_free(p);
487ebfedea0SLionel Sambuc if (bn_ctx)
488ebfedea0SLionel Sambuc BN_CTX_free(bn_ctx);
489ebfedea0SLionel Sambuc return ret;
490ebfedea0SLionel Sambuc }
491ebfedea0SLionel Sambuc
492*0a6a1f1dSLionel Sambuc /*-
493*0a6a1f1dSLionel Sambuc * This callback is used here for two purposes:
494*0a6a1f1dSLionel Sambuc * - extended debugging
495*0a6a1f1dSLionel Sambuc * - making some primality tests for unknown groups
496*0a6a1f1dSLionel Sambuc * The callback is only called for a non default group.
497*0a6a1f1dSLionel Sambuc *
498*0a6a1f1dSLionel Sambuc * An application does not need the call back at all if
499*0a6a1f1dSLionel Sambuc * only the stanard groups are used. In real life situations,
500*0a6a1f1dSLionel Sambuc * client and server already share well known groups,
501*0a6a1f1dSLionel Sambuc * thus there is no need to verify them.
502*0a6a1f1dSLionel Sambuc * Furthermore, in case that a server actually proposes a group that
503*0a6a1f1dSLionel Sambuc * is not one of those defined in RFC 5054, it is more appropriate
504*0a6a1f1dSLionel Sambuc * to add the group to a static list and then compare since
505*0a6a1f1dSLionel Sambuc * primality tests are rather cpu consuming.
506ebfedea0SLionel Sambuc */
507ebfedea0SLionel Sambuc
ssl_srp_verify_param_cb(SSL * s,void * arg)508ebfedea0SLionel Sambuc static int MS_CALLBACK ssl_srp_verify_param_cb(SSL *s, void *arg)
509ebfedea0SLionel Sambuc {
510ebfedea0SLionel Sambuc SRP_ARG *srp_arg = (SRP_ARG *)arg;
511ebfedea0SLionel Sambuc BIGNUM *N = NULL, *g = NULL;
512ebfedea0SLionel Sambuc if (!(N = SSL_get_srp_N(s)) || !(g = SSL_get_srp_g(s)))
513ebfedea0SLionel Sambuc return 0;
514*0a6a1f1dSLionel Sambuc if (srp_arg->debug || srp_arg->msg || srp_arg->amp == 1) {
515ebfedea0SLionel Sambuc BIO_printf(bio_err, "SRP parameters:\n");
516*0a6a1f1dSLionel Sambuc BIO_printf(bio_err, "\tN=");
517*0a6a1f1dSLionel Sambuc BN_print(bio_err, N);
518*0a6a1f1dSLionel Sambuc BIO_printf(bio_err, "\n\tg=");
519*0a6a1f1dSLionel Sambuc BN_print(bio_err, g);
520ebfedea0SLionel Sambuc BIO_printf(bio_err, "\n");
521ebfedea0SLionel Sambuc }
522ebfedea0SLionel Sambuc
523ebfedea0SLionel Sambuc if (SRP_check_known_gN_param(g, N))
524ebfedea0SLionel Sambuc return 1;
525ebfedea0SLionel Sambuc
526*0a6a1f1dSLionel Sambuc if (srp_arg->amp == 1) {
527ebfedea0SLionel Sambuc if (srp_arg->debug)
528*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
529*0a6a1f1dSLionel Sambuc "SRP param N and g are not known params, going to check deeper.\n");
530ebfedea0SLionel Sambuc
531*0a6a1f1dSLionel Sambuc /*
532*0a6a1f1dSLionel Sambuc * The srp_moregroups is a real debugging feature. Implementors
533*0a6a1f1dSLionel Sambuc * should rather add the value to the known ones. The minimal size
534*0a6a1f1dSLionel Sambuc * has already been tested.
535ebfedea0SLionel Sambuc */
536ebfedea0SLionel Sambuc if (BN_num_bits(g) <= BN_BITS && srp_Verify_N_and_g(N, g))
537ebfedea0SLionel Sambuc return 1;
538ebfedea0SLionel Sambuc }
539ebfedea0SLionel Sambuc BIO_printf(bio_err, "SRP param N and g rejected.\n");
540ebfedea0SLionel Sambuc return 0;
541ebfedea0SLionel Sambuc }
542ebfedea0SLionel Sambuc
543ebfedea0SLionel Sambuc # define PWD_STRLEN 1024
544ebfedea0SLionel Sambuc
ssl_give_srp_client_pwd_cb(SSL * s,void * arg)545ebfedea0SLionel Sambuc static char *MS_CALLBACK ssl_give_srp_client_pwd_cb(SSL *s, void *arg)
546ebfedea0SLionel Sambuc {
547ebfedea0SLionel Sambuc SRP_ARG *srp_arg = (SRP_ARG *)arg;
548ebfedea0SLionel Sambuc char *pass = (char *)OPENSSL_malloc(PWD_STRLEN + 1);
549ebfedea0SLionel Sambuc PW_CB_DATA cb_tmp;
550ebfedea0SLionel Sambuc int l;
551ebfedea0SLionel Sambuc
552*0a6a1f1dSLionel Sambuc if (!pass) {
553*0a6a1f1dSLionel Sambuc BIO_printf(bio_err, "Malloc failure\n");
554*0a6a1f1dSLionel Sambuc return NULL;
555*0a6a1f1dSLionel Sambuc }
556*0a6a1f1dSLionel Sambuc
557ebfedea0SLionel Sambuc cb_tmp.password = (char *)srp_arg->srppassin;
558ebfedea0SLionel Sambuc cb_tmp.prompt_info = "SRP user";
559*0a6a1f1dSLionel Sambuc if ((l = password_callback(pass, PWD_STRLEN, 0, &cb_tmp)) < 0) {
560ebfedea0SLionel Sambuc BIO_printf(bio_err, "Can't read Password\n");
561ebfedea0SLionel Sambuc OPENSSL_free(pass);
562ebfedea0SLionel Sambuc return NULL;
563ebfedea0SLionel Sambuc }
564ebfedea0SLionel Sambuc *(pass + l) = '\0';
565ebfedea0SLionel Sambuc
566ebfedea0SLionel Sambuc return pass;
567ebfedea0SLionel Sambuc }
568ebfedea0SLionel Sambuc
569ebfedea0SLionel Sambuc # endif
570ebfedea0SLionel Sambuc # ifndef OPENSSL_NO_SRTP
571ebfedea0SLionel Sambuc char *srtp_profiles = NULL;
572ebfedea0SLionel Sambuc # endif
573ebfedea0SLionel Sambuc
574ebfedea0SLionel Sambuc # ifndef OPENSSL_NO_NEXTPROTONEG
575ebfedea0SLionel Sambuc /* This the context that we pass to next_proto_cb */
576ebfedea0SLionel Sambuc typedef struct tlsextnextprotoctx_st {
577ebfedea0SLionel Sambuc unsigned char *data;
578ebfedea0SLionel Sambuc unsigned short len;
579ebfedea0SLionel Sambuc int status;
580ebfedea0SLionel Sambuc } tlsextnextprotoctx;
581ebfedea0SLionel Sambuc
582ebfedea0SLionel Sambuc static tlsextnextprotoctx next_proto;
583ebfedea0SLionel Sambuc
next_proto_cb(SSL * s,unsigned char ** out,unsigned char * outlen,const unsigned char * in,unsigned int inlen,void * arg)584*0a6a1f1dSLionel Sambuc static int next_proto_cb(SSL *s, unsigned char **out, unsigned char *outlen,
585*0a6a1f1dSLionel Sambuc const unsigned char *in, unsigned int inlen,
586*0a6a1f1dSLionel Sambuc void *arg)
587ebfedea0SLionel Sambuc {
588ebfedea0SLionel Sambuc tlsextnextprotoctx *ctx = arg;
589ebfedea0SLionel Sambuc
590*0a6a1f1dSLionel Sambuc if (!c_quiet) {
591ebfedea0SLionel Sambuc /* We can assume that |in| is syntactically valid. */
592ebfedea0SLionel Sambuc unsigned i;
593ebfedea0SLionel Sambuc BIO_printf(bio_c_out, "Protocols advertised by server: ");
594*0a6a1f1dSLionel Sambuc for (i = 0; i < inlen;) {
595ebfedea0SLionel Sambuc if (i)
596ebfedea0SLionel Sambuc BIO_write(bio_c_out, ", ", 2);
597ebfedea0SLionel Sambuc BIO_write(bio_c_out, &in[i + 1], in[i]);
598ebfedea0SLionel Sambuc i += in[i] + 1;
599ebfedea0SLionel Sambuc }
600ebfedea0SLionel Sambuc BIO_write(bio_c_out, "\n", 1);
601ebfedea0SLionel Sambuc }
602ebfedea0SLionel Sambuc
603*0a6a1f1dSLionel Sambuc ctx->status =
604*0a6a1f1dSLionel Sambuc SSL_select_next_proto(out, outlen, in, inlen, ctx->data, ctx->len);
605ebfedea0SLionel Sambuc return SSL_TLSEXT_ERR_OK;
606ebfedea0SLionel Sambuc }
607ebfedea0SLionel Sambuc # endif /* ndef OPENSSL_NO_NEXTPROTONEG */
608ebfedea0SLionel Sambuc #endif
609ebfedea0SLionel Sambuc
610*0a6a1f1dSLionel Sambuc enum {
611ebfedea0SLionel Sambuc PROTO_OFF = 0,
612ebfedea0SLionel Sambuc PROTO_SMTP,
613ebfedea0SLionel Sambuc PROTO_POP3,
614ebfedea0SLionel Sambuc PROTO_IMAP,
615ebfedea0SLionel Sambuc PROTO_FTP,
616ebfedea0SLionel Sambuc PROTO_XMPP
617ebfedea0SLionel Sambuc };
618ebfedea0SLionel Sambuc
619ebfedea0SLionel Sambuc int MAIN(int, char **);
620ebfedea0SLionel Sambuc
MAIN(int argc,char ** argv)621ebfedea0SLionel Sambuc int MAIN(int argc, char **argv)
622ebfedea0SLionel Sambuc {
623ebfedea0SLionel Sambuc unsigned int off = 0, clr = 0;
624ebfedea0SLionel Sambuc SSL *con = NULL;
625ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_KRB5
626ebfedea0SLionel Sambuc KSSL_CTX *kctx;
627ebfedea0SLionel Sambuc #endif
628ebfedea0SLionel Sambuc int s, k, width, state = 0;
629ebfedea0SLionel Sambuc char *cbuf = NULL, *sbuf = NULL, *mbuf = NULL;
630ebfedea0SLionel Sambuc int cbuf_len, cbuf_off;
631ebfedea0SLionel Sambuc int sbuf_len, sbuf_off;
632ebfedea0SLionel Sambuc fd_set readfds, writefds;
633ebfedea0SLionel Sambuc int fdin, fdout;
634ebfedea0SLionel Sambuc short port = PORT;
635ebfedea0SLionel Sambuc int full_log = 1;
636ebfedea0SLionel Sambuc char *host = SSL_HOST_NAME;
637ebfedea0SLionel Sambuc char *cert_file = NULL, *key_file = NULL;
638ebfedea0SLionel Sambuc int cert_format = FORMAT_PEM, key_format = FORMAT_PEM;
639ebfedea0SLionel Sambuc char *passarg = NULL, *pass = NULL;
640ebfedea0SLionel Sambuc X509 *cert = NULL;
641ebfedea0SLionel Sambuc EVP_PKEY *key = NULL;
642ebfedea0SLionel Sambuc char *CApath = NULL, *CAfile = NULL, *cipher = NULL;
643ebfedea0SLionel Sambuc int reconnect = 0, badop = 0, verify = SSL_VERIFY_NONE, bugs = 0;
644ebfedea0SLionel Sambuc int crlf = 0;
645ebfedea0SLionel Sambuc int write_tty, read_tty, write_ssl, read_ssl, tty_on, ssl_pending;
646ebfedea0SLionel Sambuc SSL_CTX *ctx = NULL;
647ebfedea0SLionel Sambuc int ret = 1, in_init = 1, i, nbio_test = 0;
648ebfedea0SLionel Sambuc int starttls_proto = PROTO_OFF;
649ebfedea0SLionel Sambuc int prexit = 0;
650ebfedea0SLionel Sambuc X509_VERIFY_PARAM *vpm = NULL;
651ebfedea0SLionel Sambuc int badarg = 0;
652ebfedea0SLionel Sambuc const SSL_METHOD *meth = NULL;
653ebfedea0SLionel Sambuc int socket_type = SOCK_STREAM;
654ebfedea0SLionel Sambuc BIO *sbio;
655ebfedea0SLionel Sambuc char *inrand = NULL;
656ebfedea0SLionel Sambuc int mbuf_len = 0;
657ebfedea0SLionel Sambuc struct timeval timeout, *timeoutp;
658ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_ENGINE
659ebfedea0SLionel Sambuc char *engine_id = NULL;
660ebfedea0SLionel Sambuc char *ssl_client_engine_id = NULL;
661ebfedea0SLionel Sambuc ENGINE *ssl_client_engine = NULL;
662ebfedea0SLionel Sambuc #endif
663ebfedea0SLionel Sambuc ENGINE *e = NULL;
664ebfedea0SLionel Sambuc #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE) || defined(OPENSSL_SYS_BEOS_R5)
665ebfedea0SLionel Sambuc struct timeval tv;
666ebfedea0SLionel Sambuc # if defined(OPENSSL_SYS_BEOS_R5)
667ebfedea0SLionel Sambuc int stdin_set = 0;
668ebfedea0SLionel Sambuc # endif
669ebfedea0SLionel Sambuc #endif
670ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_TLSEXT
671ebfedea0SLionel Sambuc char *servername = NULL;
672*0a6a1f1dSLionel Sambuc tlsextctx tlsextcbp = { NULL, 0 };
673ebfedea0SLionel Sambuc # ifndef OPENSSL_NO_NEXTPROTONEG
674ebfedea0SLionel Sambuc const char *next_proto_neg_in = NULL;
675ebfedea0SLionel Sambuc # endif
676ebfedea0SLionel Sambuc #endif
677ebfedea0SLionel Sambuc char *sess_in = NULL;
678ebfedea0SLionel Sambuc char *sess_out = NULL;
679ebfedea0SLionel Sambuc struct sockaddr peer;
680ebfedea0SLionel Sambuc int peerlen = sizeof(peer);
681*0a6a1f1dSLionel Sambuc int fallback_scsv = 0;
682ebfedea0SLionel Sambuc int enable_timeouts = 0;
683ebfedea0SLionel Sambuc long socket_mtu = 0;
684ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_JPAKE
685ebfedea0SLionel Sambuc char *jpake_secret = NULL;
686ebfedea0SLionel Sambuc #endif
687ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_SRP
688ebfedea0SLionel Sambuc char *srppass = NULL;
689ebfedea0SLionel Sambuc int srp_lateuser = 0;
690ebfedea0SLionel Sambuc SRP_ARG srp_arg = { NULL, NULL, 0, 0, 0, 1024 };
691ebfedea0SLionel Sambuc #endif
692ebfedea0SLionel Sambuc
693ebfedea0SLionel Sambuc meth = SSLv23_client_method();
694ebfedea0SLionel Sambuc
695ebfedea0SLionel Sambuc apps_startup();
696ebfedea0SLionel Sambuc c_Pause = 0;
697ebfedea0SLionel Sambuc c_quiet = 0;
698ebfedea0SLionel Sambuc c_ign_eof = 0;
699ebfedea0SLionel Sambuc c_debug = 0;
700ebfedea0SLionel Sambuc c_msg = 0;
701ebfedea0SLionel Sambuc c_showcerts = 0;
702ebfedea0SLionel Sambuc
703ebfedea0SLionel Sambuc if (bio_err == NULL)
704ebfedea0SLionel Sambuc bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
705ebfedea0SLionel Sambuc
706ebfedea0SLionel Sambuc if (!load_config(bio_err, NULL))
707ebfedea0SLionel Sambuc goto end;
708ebfedea0SLionel Sambuc
709ebfedea0SLionel Sambuc if (((cbuf = OPENSSL_malloc(BUFSIZZ)) == NULL) ||
710ebfedea0SLionel Sambuc ((sbuf = OPENSSL_malloc(BUFSIZZ)) == NULL) ||
711*0a6a1f1dSLionel Sambuc ((mbuf = OPENSSL_malloc(BUFSIZZ)) == NULL)) {
712ebfedea0SLionel Sambuc BIO_printf(bio_err, "out of memory\n");
713ebfedea0SLionel Sambuc goto end;
714ebfedea0SLionel Sambuc }
715ebfedea0SLionel Sambuc
716ebfedea0SLionel Sambuc verify_depth = 0;
717ebfedea0SLionel Sambuc verify_error = X509_V_OK;
718ebfedea0SLionel Sambuc #ifdef FIONBIO
719ebfedea0SLionel Sambuc c_nbio = 0;
720ebfedea0SLionel Sambuc #endif
721ebfedea0SLionel Sambuc
722ebfedea0SLionel Sambuc argc--;
723ebfedea0SLionel Sambuc argv++;
724*0a6a1f1dSLionel Sambuc while (argc >= 1) {
725*0a6a1f1dSLionel Sambuc if (strcmp(*argv, "-host") == 0) {
726*0a6a1f1dSLionel Sambuc if (--argc < 1)
727*0a6a1f1dSLionel Sambuc goto bad;
728ebfedea0SLionel Sambuc host = *(++argv);
729*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-port") == 0) {
730*0a6a1f1dSLionel Sambuc if (--argc < 1)
731*0a6a1f1dSLionel Sambuc goto bad;
732ebfedea0SLionel Sambuc port = atoi(*(++argv));
733*0a6a1f1dSLionel Sambuc if (port == 0)
734*0a6a1f1dSLionel Sambuc goto bad;
735*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-connect") == 0) {
736*0a6a1f1dSLionel Sambuc if (--argc < 1)
737*0a6a1f1dSLionel Sambuc goto bad;
738ebfedea0SLionel Sambuc if (!extract_host_port(*(++argv), &host, NULL, &port))
739ebfedea0SLionel Sambuc goto bad;
740*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-verify") == 0) {
741ebfedea0SLionel Sambuc verify = SSL_VERIFY_PEER;
742*0a6a1f1dSLionel Sambuc if (--argc < 1)
743*0a6a1f1dSLionel Sambuc goto bad;
744ebfedea0SLionel Sambuc verify_depth = atoi(*(++argv));
745ebfedea0SLionel Sambuc BIO_printf(bio_err, "verify depth is %d\n", verify_depth);
746*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-cert") == 0) {
747*0a6a1f1dSLionel Sambuc if (--argc < 1)
748*0a6a1f1dSLionel Sambuc goto bad;
749ebfedea0SLionel Sambuc cert_file = *(++argv);
750*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-sess_out") == 0) {
751*0a6a1f1dSLionel Sambuc if (--argc < 1)
752*0a6a1f1dSLionel Sambuc goto bad;
753ebfedea0SLionel Sambuc sess_out = *(++argv);
754*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-sess_in") == 0) {
755*0a6a1f1dSLionel Sambuc if (--argc < 1)
756*0a6a1f1dSLionel Sambuc goto bad;
757ebfedea0SLionel Sambuc sess_in = *(++argv);
758*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-certform") == 0) {
759*0a6a1f1dSLionel Sambuc if (--argc < 1)
760*0a6a1f1dSLionel Sambuc goto bad;
761ebfedea0SLionel Sambuc cert_format = str2fmt(*(++argv));
762*0a6a1f1dSLionel Sambuc } else if (args_verify(&argv, &argc, &badarg, bio_err, &vpm)) {
763ebfedea0SLionel Sambuc if (badarg)
764ebfedea0SLionel Sambuc goto bad;
765ebfedea0SLionel Sambuc continue;
766*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-verify_return_error") == 0)
767ebfedea0SLionel Sambuc verify_return_error = 1;
768ebfedea0SLionel Sambuc else if (strcmp(*argv, "-prexit") == 0)
769ebfedea0SLionel Sambuc prexit = 1;
770ebfedea0SLionel Sambuc else if (strcmp(*argv, "-crlf") == 0)
771ebfedea0SLionel Sambuc crlf = 1;
772*0a6a1f1dSLionel Sambuc else if (strcmp(*argv, "-quiet") == 0) {
773ebfedea0SLionel Sambuc c_quiet = 1;
774ebfedea0SLionel Sambuc c_ign_eof = 1;
775*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-ign_eof") == 0)
776ebfedea0SLionel Sambuc c_ign_eof = 1;
777ebfedea0SLionel Sambuc else if (strcmp(*argv, "-no_ign_eof") == 0)
778ebfedea0SLionel Sambuc c_ign_eof = 0;
779ebfedea0SLionel Sambuc else if (strcmp(*argv, "-pause") == 0)
780ebfedea0SLionel Sambuc c_Pause = 1;
781ebfedea0SLionel Sambuc else if (strcmp(*argv, "-debug") == 0)
782ebfedea0SLionel Sambuc c_debug = 1;
783ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_TLSEXT
784ebfedea0SLionel Sambuc else if (strcmp(*argv, "-tlsextdebug") == 0)
785ebfedea0SLionel Sambuc c_tlsextdebug = 1;
786ebfedea0SLionel Sambuc else if (strcmp(*argv, "-status") == 0)
787ebfedea0SLionel Sambuc c_status_req = 1;
788ebfedea0SLionel Sambuc #endif
789ebfedea0SLionel Sambuc #ifdef WATT32
790ebfedea0SLionel Sambuc else if (strcmp(*argv, "-wdebug") == 0)
791ebfedea0SLionel Sambuc dbug_init();
792ebfedea0SLionel Sambuc #endif
793ebfedea0SLionel Sambuc else if (strcmp(*argv, "-msg") == 0)
794ebfedea0SLionel Sambuc c_msg = 1;
795ebfedea0SLionel Sambuc else if (strcmp(*argv, "-showcerts") == 0)
796ebfedea0SLionel Sambuc c_showcerts = 1;
797ebfedea0SLionel Sambuc else if (strcmp(*argv, "-nbio_test") == 0)
798ebfedea0SLionel Sambuc nbio_test = 1;
799ebfedea0SLionel Sambuc else if (strcmp(*argv, "-state") == 0)
800ebfedea0SLionel Sambuc state = 1;
801ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_PSK
802*0a6a1f1dSLionel Sambuc else if (strcmp(*argv, "-psk_identity") == 0) {
803*0a6a1f1dSLionel Sambuc if (--argc < 1)
804*0a6a1f1dSLionel Sambuc goto bad;
805ebfedea0SLionel Sambuc psk_identity = *(++argv);
806*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-psk") == 0) {
807ebfedea0SLionel Sambuc size_t j;
808ebfedea0SLionel Sambuc
809*0a6a1f1dSLionel Sambuc if (--argc < 1)
810*0a6a1f1dSLionel Sambuc goto bad;
811ebfedea0SLionel Sambuc psk_key = *(++argv);
812*0a6a1f1dSLionel Sambuc for (j = 0; j < strlen(psk_key); j++) {
813ebfedea0SLionel Sambuc if (isxdigit((unsigned char)psk_key[j]))
814ebfedea0SLionel Sambuc continue;
815ebfedea0SLionel Sambuc BIO_printf(bio_err, "Not a hex number '%s'\n", *argv);
816ebfedea0SLionel Sambuc goto bad;
817ebfedea0SLionel Sambuc }
818ebfedea0SLionel Sambuc }
819ebfedea0SLionel Sambuc #endif
820ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_SRP
821*0a6a1f1dSLionel Sambuc else if (strcmp(*argv, "-srpuser") == 0) {
822*0a6a1f1dSLionel Sambuc if (--argc < 1)
823*0a6a1f1dSLionel Sambuc goto bad;
824ebfedea0SLionel Sambuc srp_arg.srplogin = *(++argv);
825ebfedea0SLionel Sambuc meth = TLSv1_client_method();
826*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-srppass") == 0) {
827*0a6a1f1dSLionel Sambuc if (--argc < 1)
828*0a6a1f1dSLionel Sambuc goto bad;
829ebfedea0SLionel Sambuc srppass = *(++argv);
830ebfedea0SLionel Sambuc meth = TLSv1_client_method();
831*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-srp_strength") == 0) {
832*0a6a1f1dSLionel Sambuc if (--argc < 1)
833*0a6a1f1dSLionel Sambuc goto bad;
834ebfedea0SLionel Sambuc srp_arg.strength = atoi(*(++argv));
835*0a6a1f1dSLionel Sambuc BIO_printf(bio_err, "SRP minimal length for N is %d\n",
836*0a6a1f1dSLionel Sambuc srp_arg.strength);
837ebfedea0SLionel Sambuc meth = TLSv1_client_method();
838*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-srp_lateuser") == 0) {
839ebfedea0SLionel Sambuc srp_lateuser = 1;
840ebfedea0SLionel Sambuc meth = TLSv1_client_method();
841*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-srp_moregroups") == 0) {
842ebfedea0SLionel Sambuc srp_arg.amp = 1;
843ebfedea0SLionel Sambuc meth = TLSv1_client_method();
844ebfedea0SLionel Sambuc }
845ebfedea0SLionel Sambuc #endif
846ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_SSL2
847ebfedea0SLionel Sambuc else if (strcmp(*argv, "-ssl2") == 0)
848ebfedea0SLionel Sambuc meth = SSLv2_client_method();
849ebfedea0SLionel Sambuc #endif
850*0a6a1f1dSLionel Sambuc #ifndef OPENSSL_NO_SSL3_METHOD
851ebfedea0SLionel Sambuc else if (strcmp(*argv, "-ssl3") == 0)
852ebfedea0SLionel Sambuc meth = SSLv3_client_method();
853ebfedea0SLionel Sambuc #endif
854ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_TLS1
855ebfedea0SLionel Sambuc else if (strcmp(*argv, "-tls1_2") == 0)
856ebfedea0SLionel Sambuc meth = TLSv1_2_client_method();
857ebfedea0SLionel Sambuc else if (strcmp(*argv, "-tls1_1") == 0)
858ebfedea0SLionel Sambuc meth = TLSv1_1_client_method();
859ebfedea0SLionel Sambuc else if (strcmp(*argv, "-tls1") == 0)
860ebfedea0SLionel Sambuc meth = TLSv1_client_method();
861ebfedea0SLionel Sambuc #endif
862ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_DTLS1
863*0a6a1f1dSLionel Sambuc else if (strcmp(*argv, "-dtls1") == 0) {
864ebfedea0SLionel Sambuc meth = DTLSv1_client_method();
865ebfedea0SLionel Sambuc socket_type = SOCK_DGRAM;
866*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-fallback_scsv") == 0) {
867*0a6a1f1dSLionel Sambuc fallback_scsv = 1;
868*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-timeout") == 0)
869ebfedea0SLionel Sambuc enable_timeouts = 1;
870*0a6a1f1dSLionel Sambuc else if (strcmp(*argv, "-mtu") == 0) {
871*0a6a1f1dSLionel Sambuc if (--argc < 1)
872*0a6a1f1dSLionel Sambuc goto bad;
873ebfedea0SLionel Sambuc socket_mtu = atol(*(++argv));
874ebfedea0SLionel Sambuc }
875ebfedea0SLionel Sambuc #endif
876ebfedea0SLionel Sambuc else if (strcmp(*argv, "-bugs") == 0)
877ebfedea0SLionel Sambuc bugs = 1;
878*0a6a1f1dSLionel Sambuc else if (strcmp(*argv, "-keyform") == 0) {
879*0a6a1f1dSLionel Sambuc if (--argc < 1)
880*0a6a1f1dSLionel Sambuc goto bad;
881ebfedea0SLionel Sambuc key_format = str2fmt(*(++argv));
882*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-pass") == 0) {
883*0a6a1f1dSLionel Sambuc if (--argc < 1)
884*0a6a1f1dSLionel Sambuc goto bad;
885ebfedea0SLionel Sambuc passarg = *(++argv);
886*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-key") == 0) {
887*0a6a1f1dSLionel Sambuc if (--argc < 1)
888*0a6a1f1dSLionel Sambuc goto bad;
889ebfedea0SLionel Sambuc key_file = *(++argv);
890*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-reconnect") == 0) {
891ebfedea0SLionel Sambuc reconnect = 5;
892*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-CApath") == 0) {
893*0a6a1f1dSLionel Sambuc if (--argc < 1)
894*0a6a1f1dSLionel Sambuc goto bad;
895ebfedea0SLionel Sambuc CApath = *(++argv);
896*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-CAfile") == 0) {
897*0a6a1f1dSLionel Sambuc if (--argc < 1)
898*0a6a1f1dSLionel Sambuc goto bad;
899ebfedea0SLionel Sambuc CAfile = *(++argv);
900*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-no_tls1_2") == 0)
901ebfedea0SLionel Sambuc off |= SSL_OP_NO_TLSv1_2;
902ebfedea0SLionel Sambuc else if (strcmp(*argv, "-no_tls1_1") == 0)
903ebfedea0SLionel Sambuc off |= SSL_OP_NO_TLSv1_1;
904ebfedea0SLionel Sambuc else if (strcmp(*argv, "-no_tls1") == 0)
905ebfedea0SLionel Sambuc off |= SSL_OP_NO_TLSv1;
906ebfedea0SLionel Sambuc else if (strcmp(*argv, "-no_ssl3") == 0)
907ebfedea0SLionel Sambuc off |= SSL_OP_NO_SSLv3;
908ebfedea0SLionel Sambuc else if (strcmp(*argv, "-no_ssl2") == 0)
909ebfedea0SLionel Sambuc off |= SSL_OP_NO_SSLv2;
910*0a6a1f1dSLionel Sambuc else if (strcmp(*argv, "-no_comp") == 0) {
911*0a6a1f1dSLionel Sambuc off |= SSL_OP_NO_COMPRESSION;
912*0a6a1f1dSLionel Sambuc }
913ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_TLSEXT
914*0a6a1f1dSLionel Sambuc else if (strcmp(*argv, "-no_ticket") == 0) {
915*0a6a1f1dSLionel Sambuc off |= SSL_OP_NO_TICKET;
916*0a6a1f1dSLionel Sambuc }
917ebfedea0SLionel Sambuc # ifndef OPENSSL_NO_NEXTPROTONEG
918*0a6a1f1dSLionel Sambuc else if (strcmp(*argv, "-nextprotoneg") == 0) {
919*0a6a1f1dSLionel Sambuc if (--argc < 1)
920*0a6a1f1dSLionel Sambuc goto bad;
921ebfedea0SLionel Sambuc next_proto_neg_in = *(++argv);
922ebfedea0SLionel Sambuc }
923ebfedea0SLionel Sambuc # endif
924ebfedea0SLionel Sambuc #endif
925ebfedea0SLionel Sambuc else if (strcmp(*argv, "-serverpref") == 0)
926ebfedea0SLionel Sambuc off |= SSL_OP_CIPHER_SERVER_PREFERENCE;
927ebfedea0SLionel Sambuc else if (strcmp(*argv, "-legacy_renegotiation") == 0)
928ebfedea0SLionel Sambuc off |= SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;
929*0a6a1f1dSLionel Sambuc else if (strcmp(*argv, "-legacy_server_connect") == 0) {
930*0a6a1f1dSLionel Sambuc off |= SSL_OP_LEGACY_SERVER_CONNECT;
931*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-no_legacy_server_connect") == 0) {
932*0a6a1f1dSLionel Sambuc clr |= SSL_OP_LEGACY_SERVER_CONNECT;
933*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-cipher") == 0) {
934*0a6a1f1dSLionel Sambuc if (--argc < 1)
935*0a6a1f1dSLionel Sambuc goto bad;
936ebfedea0SLionel Sambuc cipher = *(++argv);
937ebfedea0SLionel Sambuc }
938ebfedea0SLionel Sambuc #ifdef FIONBIO
939*0a6a1f1dSLionel Sambuc else if (strcmp(*argv, "-nbio") == 0) {
940*0a6a1f1dSLionel Sambuc c_nbio = 1;
941*0a6a1f1dSLionel Sambuc }
942ebfedea0SLionel Sambuc #endif
943*0a6a1f1dSLionel Sambuc else if (strcmp(*argv, "-starttls") == 0) {
944*0a6a1f1dSLionel Sambuc if (--argc < 1)
945*0a6a1f1dSLionel Sambuc goto bad;
946ebfedea0SLionel Sambuc ++argv;
947ebfedea0SLionel Sambuc if (strcmp(*argv, "smtp") == 0)
948ebfedea0SLionel Sambuc starttls_proto = PROTO_SMTP;
949ebfedea0SLionel Sambuc else if (strcmp(*argv, "pop3") == 0)
950ebfedea0SLionel Sambuc starttls_proto = PROTO_POP3;
951ebfedea0SLionel Sambuc else if (strcmp(*argv, "imap") == 0)
952ebfedea0SLionel Sambuc starttls_proto = PROTO_IMAP;
953ebfedea0SLionel Sambuc else if (strcmp(*argv, "ftp") == 0)
954ebfedea0SLionel Sambuc starttls_proto = PROTO_FTP;
955ebfedea0SLionel Sambuc else if (strcmp(*argv, "xmpp") == 0)
956ebfedea0SLionel Sambuc starttls_proto = PROTO_XMPP;
957ebfedea0SLionel Sambuc else
958ebfedea0SLionel Sambuc goto bad;
959ebfedea0SLionel Sambuc }
960ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_ENGINE
961*0a6a1f1dSLionel Sambuc else if (strcmp(*argv, "-engine") == 0) {
962*0a6a1f1dSLionel Sambuc if (--argc < 1)
963*0a6a1f1dSLionel Sambuc goto bad;
964ebfedea0SLionel Sambuc engine_id = *(++argv);
965*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-ssl_client_engine") == 0) {
966*0a6a1f1dSLionel Sambuc if (--argc < 1)
967*0a6a1f1dSLionel Sambuc goto bad;
968ebfedea0SLionel Sambuc ssl_client_engine_id = *(++argv);
969ebfedea0SLionel Sambuc }
970ebfedea0SLionel Sambuc #endif
971*0a6a1f1dSLionel Sambuc else if (strcmp(*argv, "-rand") == 0) {
972*0a6a1f1dSLionel Sambuc if (--argc < 1)
973*0a6a1f1dSLionel Sambuc goto bad;
974ebfedea0SLionel Sambuc inrand = *(++argv);
975ebfedea0SLionel Sambuc }
976ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_TLSEXT
977*0a6a1f1dSLionel Sambuc else if (strcmp(*argv, "-servername") == 0) {
978*0a6a1f1dSLionel Sambuc if (--argc < 1)
979*0a6a1f1dSLionel Sambuc goto bad;
980ebfedea0SLionel Sambuc servername = *(++argv);
981ebfedea0SLionel Sambuc /* meth=TLSv1_client_method(); */
982ebfedea0SLionel Sambuc }
983ebfedea0SLionel Sambuc #endif
984ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_JPAKE
985*0a6a1f1dSLionel Sambuc else if (strcmp(*argv, "-jpake") == 0) {
986*0a6a1f1dSLionel Sambuc if (--argc < 1)
987*0a6a1f1dSLionel Sambuc goto bad;
988ebfedea0SLionel Sambuc jpake_secret = *++argv;
989ebfedea0SLionel Sambuc }
990ebfedea0SLionel Sambuc #endif
991ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_SRTP
992*0a6a1f1dSLionel Sambuc else if (strcmp(*argv, "-use_srtp") == 0) {
993*0a6a1f1dSLionel Sambuc if (--argc < 1)
994*0a6a1f1dSLionel Sambuc goto bad;
995ebfedea0SLionel Sambuc srtp_profiles = *(++argv);
996ebfedea0SLionel Sambuc }
997ebfedea0SLionel Sambuc #endif
998*0a6a1f1dSLionel Sambuc else if (strcmp(*argv, "-keymatexport") == 0) {
999*0a6a1f1dSLionel Sambuc if (--argc < 1)
1000*0a6a1f1dSLionel Sambuc goto bad;
1001ebfedea0SLionel Sambuc keymatexportlabel = *(++argv);
1002*0a6a1f1dSLionel Sambuc } else if (strcmp(*argv, "-keymatexportlen") == 0) {
1003*0a6a1f1dSLionel Sambuc if (--argc < 1)
1004*0a6a1f1dSLionel Sambuc goto bad;
1005ebfedea0SLionel Sambuc keymatexportlen = atoi(*(++argv));
1006*0a6a1f1dSLionel Sambuc if (keymatexportlen == 0)
1007*0a6a1f1dSLionel Sambuc goto bad;
1008*0a6a1f1dSLionel Sambuc } else {
1009ebfedea0SLionel Sambuc BIO_printf(bio_err, "unknown option %s\n", *argv);
1010ebfedea0SLionel Sambuc badop = 1;
1011ebfedea0SLionel Sambuc break;
1012ebfedea0SLionel Sambuc }
1013ebfedea0SLionel Sambuc argc--;
1014ebfedea0SLionel Sambuc argv++;
1015ebfedea0SLionel Sambuc }
1016*0a6a1f1dSLionel Sambuc if (badop) {
1017ebfedea0SLionel Sambuc bad:
1018ebfedea0SLionel Sambuc sc_usage();
1019ebfedea0SLionel Sambuc goto end;
1020ebfedea0SLionel Sambuc }
1021ebfedea0SLionel Sambuc #if !defined(OPENSSL_NO_JPAKE) && !defined(OPENSSL_NO_PSK)
1022*0a6a1f1dSLionel Sambuc if (jpake_secret) {
1023*0a6a1f1dSLionel Sambuc if (psk_key) {
1024*0a6a1f1dSLionel Sambuc BIO_printf(bio_err, "Can't use JPAKE and PSK together\n");
1025ebfedea0SLionel Sambuc goto end;
1026ebfedea0SLionel Sambuc }
1027ebfedea0SLionel Sambuc psk_identity = "JPAKE";
1028*0a6a1f1dSLionel Sambuc if (cipher) {
1029ebfedea0SLionel Sambuc BIO_printf(bio_err, "JPAKE sets cipher to PSK\n");
1030ebfedea0SLionel Sambuc goto end;
1031ebfedea0SLionel Sambuc }
1032ebfedea0SLionel Sambuc cipher = "PSK";
1033ebfedea0SLionel Sambuc }
1034ebfedea0SLionel Sambuc #endif
1035ebfedea0SLionel Sambuc
1036ebfedea0SLionel Sambuc OpenSSL_add_ssl_algorithms();
1037ebfedea0SLionel Sambuc SSL_load_error_strings();
1038ebfedea0SLionel Sambuc
1039ebfedea0SLionel Sambuc #if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
1040ebfedea0SLionel Sambuc next_proto.status = -1;
1041*0a6a1f1dSLionel Sambuc if (next_proto_neg_in) {
1042*0a6a1f1dSLionel Sambuc next_proto.data =
1043*0a6a1f1dSLionel Sambuc next_protos_parse(&next_proto.len, next_proto_neg_in);
1044*0a6a1f1dSLionel Sambuc if (next_proto.data == NULL) {
1045ebfedea0SLionel Sambuc BIO_printf(bio_err, "Error parsing -nextprotoneg argument\n");
1046ebfedea0SLionel Sambuc goto end;
1047ebfedea0SLionel Sambuc }
1048*0a6a1f1dSLionel Sambuc } else
1049ebfedea0SLionel Sambuc next_proto.data = NULL;
1050ebfedea0SLionel Sambuc #endif
1051ebfedea0SLionel Sambuc
1052ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_ENGINE
1053ebfedea0SLionel Sambuc e = setup_engine(bio_err, engine_id, 1);
1054*0a6a1f1dSLionel Sambuc if (ssl_client_engine_id) {
1055ebfedea0SLionel Sambuc ssl_client_engine = ENGINE_by_id(ssl_client_engine_id);
1056*0a6a1f1dSLionel Sambuc if (!ssl_client_engine) {
1057*0a6a1f1dSLionel Sambuc BIO_printf(bio_err, "Error getting client auth engine\n");
1058ebfedea0SLionel Sambuc goto end;
1059ebfedea0SLionel Sambuc }
1060ebfedea0SLionel Sambuc }
1061ebfedea0SLionel Sambuc #endif
1062*0a6a1f1dSLionel Sambuc if (!app_passwd(bio_err, passarg, NULL, &pass, NULL)) {
1063ebfedea0SLionel Sambuc BIO_printf(bio_err, "Error getting password\n");
1064ebfedea0SLionel Sambuc goto end;
1065ebfedea0SLionel Sambuc }
1066ebfedea0SLionel Sambuc
1067ebfedea0SLionel Sambuc if (key_file == NULL)
1068ebfedea0SLionel Sambuc key_file = cert_file;
1069ebfedea0SLionel Sambuc
1070*0a6a1f1dSLionel Sambuc if (key_file) {
1071ebfedea0SLionel Sambuc
1072ebfedea0SLionel Sambuc key = load_key(bio_err, key_file, key_format, 0, pass, e,
1073ebfedea0SLionel Sambuc "client certificate private key file");
1074*0a6a1f1dSLionel Sambuc if (!key) {
1075ebfedea0SLionel Sambuc ERR_print_errors(bio_err);
1076ebfedea0SLionel Sambuc goto end;
1077ebfedea0SLionel Sambuc }
1078ebfedea0SLionel Sambuc
1079ebfedea0SLionel Sambuc }
1080ebfedea0SLionel Sambuc
1081*0a6a1f1dSLionel Sambuc if (cert_file) {
1082ebfedea0SLionel Sambuc cert = load_cert(bio_err, cert_file, cert_format,
1083ebfedea0SLionel Sambuc NULL, e, "client certificate file");
1084ebfedea0SLionel Sambuc
1085*0a6a1f1dSLionel Sambuc if (!cert) {
1086ebfedea0SLionel Sambuc ERR_print_errors(bio_err);
1087ebfedea0SLionel Sambuc goto end;
1088ebfedea0SLionel Sambuc }
1089ebfedea0SLionel Sambuc }
1090ebfedea0SLionel Sambuc
1091ebfedea0SLionel Sambuc if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL
1092*0a6a1f1dSLionel Sambuc && !RAND_status()) {
1093*0a6a1f1dSLionel Sambuc BIO_printf(bio_err,
1094*0a6a1f1dSLionel Sambuc "warning, not much extra random data, consider using the -rand option\n");
1095ebfedea0SLionel Sambuc }
1096ebfedea0SLionel Sambuc if (inrand != NULL)
1097ebfedea0SLionel Sambuc BIO_printf(bio_err, "%ld semi-random bytes loaded\n",
1098ebfedea0SLionel Sambuc app_RAND_load_files(inrand));
1099ebfedea0SLionel Sambuc
1100*0a6a1f1dSLionel Sambuc if (bio_c_out == NULL) {
1101*0a6a1f1dSLionel Sambuc if (c_quiet && !c_debug && !c_msg) {
1102ebfedea0SLionel Sambuc bio_c_out = BIO_new(BIO_s_null());
1103*0a6a1f1dSLionel Sambuc } else {
1104ebfedea0SLionel Sambuc if (bio_c_out == NULL)
1105ebfedea0SLionel Sambuc bio_c_out = BIO_new_fp(stdout, BIO_NOCLOSE);
1106ebfedea0SLionel Sambuc }
1107ebfedea0SLionel Sambuc }
1108ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_SRP
1109*0a6a1f1dSLionel Sambuc if (!app_passwd(bio_err, srppass, NULL, &srp_arg.srppassin, NULL)) {
1110ebfedea0SLionel Sambuc BIO_printf(bio_err, "Error getting password\n");
1111ebfedea0SLionel Sambuc goto end;
1112ebfedea0SLionel Sambuc }
1113ebfedea0SLionel Sambuc #endif
1114ebfedea0SLionel Sambuc
1115ebfedea0SLionel Sambuc ctx = SSL_CTX_new(meth);
1116*0a6a1f1dSLionel Sambuc if (ctx == NULL) {
1117ebfedea0SLionel Sambuc ERR_print_errors(bio_err);
1118ebfedea0SLionel Sambuc goto end;
1119ebfedea0SLionel Sambuc }
1120ebfedea0SLionel Sambuc
1121ebfedea0SLionel Sambuc if (vpm)
1122ebfedea0SLionel Sambuc SSL_CTX_set1_param(ctx, vpm);
1123ebfedea0SLionel Sambuc
1124ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_ENGINE
1125*0a6a1f1dSLionel Sambuc if (ssl_client_engine) {
1126*0a6a1f1dSLionel Sambuc if (!SSL_CTX_set_client_cert_engine(ctx, ssl_client_engine)) {
1127ebfedea0SLionel Sambuc BIO_puts(bio_err, "Error setting client auth engine\n");
1128ebfedea0SLionel Sambuc ERR_print_errors(bio_err);
1129ebfedea0SLionel Sambuc ENGINE_free(ssl_client_engine);
1130ebfedea0SLionel Sambuc goto end;
1131ebfedea0SLionel Sambuc }
1132ebfedea0SLionel Sambuc ENGINE_free(ssl_client_engine);
1133ebfedea0SLionel Sambuc }
1134ebfedea0SLionel Sambuc #endif
1135ebfedea0SLionel Sambuc
1136ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_PSK
1137ebfedea0SLionel Sambuc # ifdef OPENSSL_NO_JPAKE
1138ebfedea0SLionel Sambuc if (psk_key != NULL)
1139ebfedea0SLionel Sambuc # else
1140ebfedea0SLionel Sambuc if (psk_key != NULL || jpake_secret)
1141ebfedea0SLionel Sambuc # endif
1142ebfedea0SLionel Sambuc {
1143ebfedea0SLionel Sambuc if (c_debug)
1144*0a6a1f1dSLionel Sambuc BIO_printf(bio_c_out,
1145*0a6a1f1dSLionel Sambuc "PSK key given or JPAKE in use, setting client callback\n");
1146ebfedea0SLionel Sambuc SSL_CTX_set_psk_client_callback(ctx, psk_client_cb);
1147ebfedea0SLionel Sambuc }
1148ebfedea0SLionel Sambuc #endif
1149ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_SRTP
1150ebfedea0SLionel Sambuc if (srtp_profiles != NULL)
1151ebfedea0SLionel Sambuc SSL_CTX_set_tlsext_use_srtp(ctx, srtp_profiles);
1152ebfedea0SLionel Sambuc #endif
1153ebfedea0SLionel Sambuc if (bugs)
1154ebfedea0SLionel Sambuc SSL_CTX_set_options(ctx, SSL_OP_ALL | off);
1155ebfedea0SLionel Sambuc else
1156ebfedea0SLionel Sambuc SSL_CTX_set_options(ctx, off);
1157ebfedea0SLionel Sambuc
1158ebfedea0SLionel Sambuc if (clr)
1159ebfedea0SLionel Sambuc SSL_CTX_clear_options(ctx, clr);
1160ebfedea0SLionel Sambuc
1161ebfedea0SLionel Sambuc #if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
1162ebfedea0SLionel Sambuc if (next_proto.data)
1163ebfedea0SLionel Sambuc SSL_CTX_set_next_proto_select_cb(ctx, next_proto_cb, &next_proto);
1164ebfedea0SLionel Sambuc #endif
1165ebfedea0SLionel Sambuc
1166*0a6a1f1dSLionel Sambuc if (state)
1167*0a6a1f1dSLionel Sambuc SSL_CTX_set_info_callback(ctx, apps_ssl_info_callback);
1168ebfedea0SLionel Sambuc if (cipher != NULL)
1169ebfedea0SLionel Sambuc if (!SSL_CTX_set_cipher_list(ctx, cipher)) {
1170ebfedea0SLionel Sambuc BIO_printf(bio_err, "error setting cipher list\n");
1171ebfedea0SLionel Sambuc ERR_print_errors(bio_err);
1172ebfedea0SLionel Sambuc goto end;
1173ebfedea0SLionel Sambuc }
1174ebfedea0SLionel Sambuc #if 0
1175ebfedea0SLionel Sambuc else
1176ebfedea0SLionel Sambuc SSL_CTX_set_cipher_list(ctx, getenv("SSL_CIPHER"));
1177ebfedea0SLionel Sambuc #endif
1178ebfedea0SLionel Sambuc
1179ebfedea0SLionel Sambuc SSL_CTX_set_verify(ctx, verify, verify_callback);
1180ebfedea0SLionel Sambuc if (!set_cert_key_stuff(ctx, cert, key))
1181ebfedea0SLionel Sambuc goto end;
1182ebfedea0SLionel Sambuc
1183*0a6a1f1dSLionel Sambuc if ((CAfile || CApath)
1184*0a6a1f1dSLionel Sambuc && !SSL_CTX_load_verify_locations(ctx, CAfile, CApath)) {
1185ebfedea0SLionel Sambuc ERR_print_errors(bio_err);
1186ebfedea0SLionel Sambuc }
1187*0a6a1f1dSLionel Sambuc if (!SSL_CTX_set_default_verify_paths(ctx)) {
1188*0a6a1f1dSLionel Sambuc ERR_print_errors(bio_err);
1189*0a6a1f1dSLionel Sambuc }
1190ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_TLSEXT
1191*0a6a1f1dSLionel Sambuc if (servername != NULL) {
1192ebfedea0SLionel Sambuc tlsextcbp.biodebug = bio_err;
1193ebfedea0SLionel Sambuc SSL_CTX_set_tlsext_servername_callback(ctx, ssl_servername_cb);
1194ebfedea0SLionel Sambuc SSL_CTX_set_tlsext_servername_arg(ctx, &tlsextcbp);
1195ebfedea0SLionel Sambuc }
1196ebfedea0SLionel Sambuc # ifndef OPENSSL_NO_SRP
1197*0a6a1f1dSLionel Sambuc if (srp_arg.srplogin) {
1198*0a6a1f1dSLionel Sambuc if (!srp_lateuser && !SSL_CTX_set_srp_username(ctx, srp_arg.srplogin)) {
1199ebfedea0SLionel Sambuc BIO_printf(bio_err, "Unable to set SRP username\n");
1200ebfedea0SLionel Sambuc goto end;
1201ebfedea0SLionel Sambuc }
1202ebfedea0SLionel Sambuc srp_arg.msg = c_msg;
1203ebfedea0SLionel Sambuc srp_arg.debug = c_debug;
1204ebfedea0SLionel Sambuc SSL_CTX_set_srp_cb_arg(ctx, &srp_arg);
1205ebfedea0SLionel Sambuc SSL_CTX_set_srp_client_pwd_callback(ctx, ssl_give_srp_client_pwd_cb);
1206ebfedea0SLionel Sambuc SSL_CTX_set_srp_strength(ctx, srp_arg.strength);
1207ebfedea0SLionel Sambuc if (c_msg || c_debug || srp_arg.amp == 0)
1208*0a6a1f1dSLionel Sambuc SSL_CTX_set_srp_verify_param_callback(ctx,
1209*0a6a1f1dSLionel Sambuc ssl_srp_verify_param_cb);
1210ebfedea0SLionel Sambuc }
1211ebfedea0SLionel Sambuc # endif
1212ebfedea0SLionel Sambuc #endif
1213ebfedea0SLionel Sambuc
1214ebfedea0SLionel Sambuc con = SSL_new(ctx);
1215*0a6a1f1dSLionel Sambuc if (sess_in) {
1216ebfedea0SLionel Sambuc SSL_SESSION *sess;
1217ebfedea0SLionel Sambuc BIO *stmp = BIO_new_file(sess_in, "r");
1218*0a6a1f1dSLionel Sambuc if (!stmp) {
1219*0a6a1f1dSLionel Sambuc BIO_printf(bio_err, "Can't open session file %s\n", sess_in);
1220ebfedea0SLionel Sambuc ERR_print_errors(bio_err);
1221ebfedea0SLionel Sambuc goto end;
1222ebfedea0SLionel Sambuc }
1223ebfedea0SLionel Sambuc sess = PEM_read_bio_SSL_SESSION(stmp, NULL, 0, NULL);
1224ebfedea0SLionel Sambuc BIO_free(stmp);
1225*0a6a1f1dSLionel Sambuc if (!sess) {
1226*0a6a1f1dSLionel Sambuc BIO_printf(bio_err, "Can't open session file %s\n", sess_in);
1227ebfedea0SLionel Sambuc ERR_print_errors(bio_err);
1228ebfedea0SLionel Sambuc goto end;
1229ebfedea0SLionel Sambuc }
1230ebfedea0SLionel Sambuc SSL_set_session(con, sess);
1231ebfedea0SLionel Sambuc SSL_SESSION_free(sess);
1232ebfedea0SLionel Sambuc }
1233*0a6a1f1dSLionel Sambuc
1234*0a6a1f1dSLionel Sambuc if (fallback_scsv)
1235*0a6a1f1dSLionel Sambuc SSL_set_mode(con, SSL_MODE_SEND_FALLBACK_SCSV);
1236*0a6a1f1dSLionel Sambuc
1237ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_TLSEXT
1238*0a6a1f1dSLionel Sambuc if (servername != NULL) {
1239*0a6a1f1dSLionel Sambuc if (!SSL_set_tlsext_host_name(con, servername)) {
1240ebfedea0SLionel Sambuc BIO_printf(bio_err, "Unable to set TLS servername extension.\n");
1241ebfedea0SLionel Sambuc ERR_print_errors(bio_err);
1242ebfedea0SLionel Sambuc goto end;
1243ebfedea0SLionel Sambuc }
1244ebfedea0SLionel Sambuc }
1245ebfedea0SLionel Sambuc #endif
1246ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_KRB5
1247*0a6a1f1dSLionel Sambuc if (con && (kctx = kssl_ctx_new()) != NULL) {
1248ebfedea0SLionel Sambuc SSL_set0_kssl_ctx(con, kctx);
1249ebfedea0SLionel Sambuc kssl_ctx_setstring(kctx, KSSL_SERVER, host);
1250ebfedea0SLionel Sambuc }
1251ebfedea0SLionel Sambuc #endif /* OPENSSL_NO_KRB5 */
1252ebfedea0SLionel Sambuc /* SSL_set_cipher_list(con,"RC4-MD5"); */
1253ebfedea0SLionel Sambuc #if 0
1254ebfedea0SLionel Sambuc # ifdef TLSEXT_TYPE_opaque_prf_input
1255ebfedea0SLionel Sambuc SSL_set_tlsext_opaque_prf_input(con, "Test client", 11);
1256ebfedea0SLionel Sambuc # endif
1257ebfedea0SLionel Sambuc #endif
1258ebfedea0SLionel Sambuc
1259ebfedea0SLionel Sambuc re_start:
1260ebfedea0SLionel Sambuc
1261*0a6a1f1dSLionel Sambuc if (init_client(&s, host, port, socket_type) == 0) {
1262ebfedea0SLionel Sambuc BIO_printf(bio_err, "connect:errno=%d\n", get_last_socket_error());
1263ebfedea0SLionel Sambuc SHUTDOWN(s);
1264ebfedea0SLionel Sambuc goto end;
1265ebfedea0SLionel Sambuc }
1266ebfedea0SLionel Sambuc BIO_printf(bio_c_out, "CONNECTED(%08X)\n", s);
1267ebfedea0SLionel Sambuc
1268ebfedea0SLionel Sambuc #ifdef FIONBIO
1269*0a6a1f1dSLionel Sambuc if (c_nbio) {
1270ebfedea0SLionel Sambuc unsigned long l = 1;
1271ebfedea0SLionel Sambuc BIO_printf(bio_c_out, "turning on non blocking io\n");
1272*0a6a1f1dSLionel Sambuc if (BIO_socket_ioctl(s, FIONBIO, &l) < 0) {
1273ebfedea0SLionel Sambuc ERR_print_errors(bio_err);
1274ebfedea0SLionel Sambuc goto end;
1275ebfedea0SLionel Sambuc }
1276ebfedea0SLionel Sambuc }
1277ebfedea0SLionel Sambuc #endif
1278*0a6a1f1dSLionel Sambuc if (c_Pause & 0x01)
1279*0a6a1f1dSLionel Sambuc SSL_set_debug(con, 1);
1280ebfedea0SLionel Sambuc
1281*0a6a1f1dSLionel Sambuc if (SSL_version(con) == DTLS1_VERSION) {
1282ebfedea0SLionel Sambuc
1283ebfedea0SLionel Sambuc sbio = BIO_new_dgram(s, BIO_NOCLOSE);
1284*0a6a1f1dSLionel Sambuc if (getsockname(s, &peer, (void *)&peerlen) < 0) {
1285ebfedea0SLionel Sambuc BIO_printf(bio_err, "getsockname:errno=%d\n",
1286ebfedea0SLionel Sambuc get_last_socket_error());
1287ebfedea0SLionel Sambuc SHUTDOWN(s);
1288ebfedea0SLionel Sambuc goto end;
1289ebfedea0SLionel Sambuc }
1290ebfedea0SLionel Sambuc
1291ebfedea0SLionel Sambuc (void)BIO_ctrl_set_connected(sbio, 1, &peer);
1292ebfedea0SLionel Sambuc
1293*0a6a1f1dSLionel Sambuc if (enable_timeouts) {
1294ebfedea0SLionel Sambuc timeout.tv_sec = 0;
1295ebfedea0SLionel Sambuc timeout.tv_usec = DGRAM_RCV_TIMEOUT;
1296ebfedea0SLionel Sambuc BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_RECV_TIMEOUT, 0, &timeout);
1297ebfedea0SLionel Sambuc
1298ebfedea0SLionel Sambuc timeout.tv_sec = 0;
1299ebfedea0SLionel Sambuc timeout.tv_usec = DGRAM_SND_TIMEOUT;
1300ebfedea0SLionel Sambuc BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_SEND_TIMEOUT, 0, &timeout);
1301ebfedea0SLionel Sambuc }
1302ebfedea0SLionel Sambuc
1303*0a6a1f1dSLionel Sambuc if (socket_mtu) {
1304*0a6a1f1dSLionel Sambuc if (socket_mtu < DTLS_get_link_min_mtu(con)) {
1305*0a6a1f1dSLionel Sambuc BIO_printf(bio_err, "MTU too small. Must be at least %ld\n",
1306*0a6a1f1dSLionel Sambuc DTLS_get_link_min_mtu(con));
1307*0a6a1f1dSLionel Sambuc BIO_free(sbio);
1308*0a6a1f1dSLionel Sambuc goto shut;
1309ebfedea0SLionel Sambuc }
1310*0a6a1f1dSLionel Sambuc SSL_set_options(con, SSL_OP_NO_QUERY_MTU);
1311*0a6a1f1dSLionel Sambuc if (!DTLS_set_link_mtu(con, socket_mtu)) {
1312*0a6a1f1dSLionel Sambuc BIO_printf(bio_err, "Failed to set MTU\n");
1313*0a6a1f1dSLionel Sambuc BIO_free(sbio);
1314*0a6a1f1dSLionel Sambuc goto shut;
1315*0a6a1f1dSLionel Sambuc }
1316*0a6a1f1dSLionel Sambuc } else
1317ebfedea0SLionel Sambuc /* want to do MTU discovery */
1318ebfedea0SLionel Sambuc BIO_ctrl(sbio, BIO_CTRL_DGRAM_MTU_DISCOVER, 0, NULL);
1319*0a6a1f1dSLionel Sambuc } else
1320ebfedea0SLionel Sambuc sbio = BIO_new_socket(s, BIO_NOCLOSE);
1321ebfedea0SLionel Sambuc
1322*0a6a1f1dSLionel Sambuc if (nbio_test) {
1323ebfedea0SLionel Sambuc BIO *test;
1324ebfedea0SLionel Sambuc
1325ebfedea0SLionel Sambuc test = BIO_new(BIO_f_nbio_test());
1326ebfedea0SLionel Sambuc sbio = BIO_push(test, sbio);
1327ebfedea0SLionel Sambuc }
1328ebfedea0SLionel Sambuc
1329*0a6a1f1dSLionel Sambuc if (c_debug) {
1330ebfedea0SLionel Sambuc SSL_set_debug(con, 1);
1331ebfedea0SLionel Sambuc BIO_set_callback(sbio, bio_dump_callback);
1332ebfedea0SLionel Sambuc BIO_set_callback_arg(sbio, (char *)bio_c_out);
1333ebfedea0SLionel Sambuc }
1334*0a6a1f1dSLionel Sambuc if (c_msg) {
1335ebfedea0SLionel Sambuc SSL_set_msg_callback(con, msg_cb);
1336ebfedea0SLionel Sambuc SSL_set_msg_callback_arg(con, bio_c_out);
1337ebfedea0SLionel Sambuc }
1338ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_TLSEXT
1339*0a6a1f1dSLionel Sambuc if (c_tlsextdebug) {
1340ebfedea0SLionel Sambuc SSL_set_tlsext_debug_callback(con, tlsext_cb);
1341ebfedea0SLionel Sambuc SSL_set_tlsext_debug_arg(con, bio_c_out);
1342ebfedea0SLionel Sambuc }
1343*0a6a1f1dSLionel Sambuc if (c_status_req) {
1344ebfedea0SLionel Sambuc SSL_set_tlsext_status_type(con, TLSEXT_STATUSTYPE_ocsp);
1345ebfedea0SLionel Sambuc SSL_CTX_set_tlsext_status_cb(ctx, ocsp_resp_cb);
1346ebfedea0SLionel Sambuc SSL_CTX_set_tlsext_status_arg(ctx, bio_c_out);
1347ebfedea0SLionel Sambuc # if 0
1348ebfedea0SLionel Sambuc {
1349ebfedea0SLionel Sambuc STACK_OF(OCSP_RESPID) *ids = sk_OCSP_RESPID_new_null();
1350ebfedea0SLionel Sambuc OCSP_RESPID *id = OCSP_RESPID_new();
1351ebfedea0SLionel Sambuc id->value.byKey = ASN1_OCTET_STRING_new();
1352ebfedea0SLionel Sambuc id->type = V_OCSP_RESPID_KEY;
1353ebfedea0SLionel Sambuc ASN1_STRING_set(id->value.byKey, "Hello World", -1);
1354ebfedea0SLionel Sambuc sk_OCSP_RESPID_push(ids, id);
1355ebfedea0SLionel Sambuc SSL_set_tlsext_status_ids(con, ids);
1356ebfedea0SLionel Sambuc }
1357ebfedea0SLionel Sambuc # endif
1358ebfedea0SLionel Sambuc }
1359ebfedea0SLionel Sambuc #endif
1360ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_JPAKE
1361ebfedea0SLionel Sambuc if (jpake_secret)
1362ebfedea0SLionel Sambuc jpake_client_auth(bio_c_out, sbio, jpake_secret);
1363ebfedea0SLionel Sambuc #endif
1364ebfedea0SLionel Sambuc
1365ebfedea0SLionel Sambuc SSL_set_bio(con, sbio, sbio);
1366ebfedea0SLionel Sambuc SSL_set_connect_state(con);
1367ebfedea0SLionel Sambuc
1368ebfedea0SLionel Sambuc /* ok, lets connect */
1369ebfedea0SLionel Sambuc width = SSL_get_fd(con) + 1;
1370ebfedea0SLionel Sambuc
1371ebfedea0SLionel Sambuc read_tty = 1;
1372ebfedea0SLionel Sambuc write_tty = 0;
1373ebfedea0SLionel Sambuc tty_on = 0;
1374ebfedea0SLionel Sambuc read_ssl = 1;
1375ebfedea0SLionel Sambuc write_ssl = 1;
1376ebfedea0SLionel Sambuc
1377ebfedea0SLionel Sambuc cbuf_len = 0;
1378ebfedea0SLionel Sambuc cbuf_off = 0;
1379ebfedea0SLionel Sambuc sbuf_len = 0;
1380ebfedea0SLionel Sambuc sbuf_off = 0;
1381ebfedea0SLionel Sambuc
1382ebfedea0SLionel Sambuc /* This is an ugly hack that does a lot of assumptions */
1383*0a6a1f1dSLionel Sambuc /*
1384*0a6a1f1dSLionel Sambuc * We do have to handle multi-line responses which may come in a single
1385*0a6a1f1dSLionel Sambuc * packet or not. We therefore have to use BIO_gets() which does need a
1386*0a6a1f1dSLionel Sambuc * buffering BIO. So during the initial chitchat we do push a buffering
1387*0a6a1f1dSLionel Sambuc * BIO into the chain that is removed again later on to not disturb the
1388*0a6a1f1dSLionel Sambuc * rest of the s_client operation.
1389*0a6a1f1dSLionel Sambuc */
1390*0a6a1f1dSLionel Sambuc if (starttls_proto == PROTO_SMTP) {
1391ebfedea0SLionel Sambuc int foundit = 0;
1392ebfedea0SLionel Sambuc BIO *fbio = BIO_new(BIO_f_buffer());
1393ebfedea0SLionel Sambuc BIO_push(fbio, sbio);
1394ebfedea0SLionel Sambuc /* wait for multi-line response to end from SMTP */
1395*0a6a1f1dSLionel Sambuc do {
1396ebfedea0SLionel Sambuc mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
1397ebfedea0SLionel Sambuc }
1398ebfedea0SLionel Sambuc while (mbuf_len > 3 && mbuf[3] == '-');
1399ebfedea0SLionel Sambuc /* STARTTLS command requires EHLO... */
1400ebfedea0SLionel Sambuc BIO_printf(fbio, "EHLO openssl.client.net\r\n");
1401ebfedea0SLionel Sambuc (void)BIO_flush(fbio);
1402ebfedea0SLionel Sambuc /* wait for multi-line response to end EHLO SMTP response */
1403*0a6a1f1dSLionel Sambuc do {
1404ebfedea0SLionel Sambuc mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
1405ebfedea0SLionel Sambuc if (strstr(mbuf, "STARTTLS"))
1406ebfedea0SLionel Sambuc foundit = 1;
1407ebfedea0SLionel Sambuc }
1408ebfedea0SLionel Sambuc while (mbuf_len > 3 && mbuf[3] == '-');
1409ebfedea0SLionel Sambuc (void)BIO_flush(fbio);
1410ebfedea0SLionel Sambuc BIO_pop(fbio);
1411ebfedea0SLionel Sambuc BIO_free(fbio);
1412ebfedea0SLionel Sambuc if (!foundit)
1413ebfedea0SLionel Sambuc BIO_printf(bio_err,
1414ebfedea0SLionel Sambuc "didn't found starttls in server response,"
1415ebfedea0SLionel Sambuc " try anyway...\n");
1416ebfedea0SLionel Sambuc BIO_printf(sbio, "STARTTLS\r\n");
1417ebfedea0SLionel Sambuc BIO_read(sbio, sbuf, BUFSIZZ);
1418*0a6a1f1dSLionel Sambuc } else if (starttls_proto == PROTO_POP3) {
1419ebfedea0SLionel Sambuc BIO_read(sbio, mbuf, BUFSIZZ);
1420ebfedea0SLionel Sambuc BIO_printf(sbio, "STLS\r\n");
1421ebfedea0SLionel Sambuc BIO_read(sbio, sbuf, BUFSIZZ);
1422*0a6a1f1dSLionel Sambuc } else if (starttls_proto == PROTO_IMAP) {
1423ebfedea0SLionel Sambuc int foundit = 0;
1424ebfedea0SLionel Sambuc BIO *fbio = BIO_new(BIO_f_buffer());
1425ebfedea0SLionel Sambuc BIO_push(fbio, sbio);
1426ebfedea0SLionel Sambuc BIO_gets(fbio, mbuf, BUFSIZZ);
1427ebfedea0SLionel Sambuc /* STARTTLS command requires CAPABILITY... */
1428ebfedea0SLionel Sambuc BIO_printf(fbio, ". CAPABILITY\r\n");
1429ebfedea0SLionel Sambuc (void)BIO_flush(fbio);
1430ebfedea0SLionel Sambuc /* wait for multi-line CAPABILITY response */
1431*0a6a1f1dSLionel Sambuc do {
1432ebfedea0SLionel Sambuc mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
1433ebfedea0SLionel Sambuc if (strstr(mbuf, "STARTTLS"))
1434ebfedea0SLionel Sambuc foundit = 1;
1435ebfedea0SLionel Sambuc }
1436ebfedea0SLionel Sambuc while (mbuf_len > 3 && mbuf[0] != '.');
1437ebfedea0SLionel Sambuc (void)BIO_flush(fbio);
1438ebfedea0SLionel Sambuc BIO_pop(fbio);
1439ebfedea0SLionel Sambuc BIO_free(fbio);
1440ebfedea0SLionel Sambuc if (!foundit)
1441ebfedea0SLionel Sambuc BIO_printf(bio_err,
1442ebfedea0SLionel Sambuc "didn't found STARTTLS in server response,"
1443ebfedea0SLionel Sambuc " try anyway...\n");
1444ebfedea0SLionel Sambuc BIO_printf(sbio, ". STARTTLS\r\n");
1445ebfedea0SLionel Sambuc BIO_read(sbio, sbuf, BUFSIZZ);
1446*0a6a1f1dSLionel Sambuc } else if (starttls_proto == PROTO_FTP) {
1447ebfedea0SLionel Sambuc BIO *fbio = BIO_new(BIO_f_buffer());
1448ebfedea0SLionel Sambuc BIO_push(fbio, sbio);
1449ebfedea0SLionel Sambuc /* wait for multi-line response to end from FTP */
1450*0a6a1f1dSLionel Sambuc do {
1451ebfedea0SLionel Sambuc mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
1452ebfedea0SLionel Sambuc }
1453ebfedea0SLionel Sambuc while (mbuf_len > 3 && mbuf[3] == '-');
1454ebfedea0SLionel Sambuc (void)BIO_flush(fbio);
1455ebfedea0SLionel Sambuc BIO_pop(fbio);
1456ebfedea0SLionel Sambuc BIO_free(fbio);
1457ebfedea0SLionel Sambuc BIO_printf(sbio, "AUTH TLS\r\n");
1458ebfedea0SLionel Sambuc BIO_read(sbio, sbuf, BUFSIZZ);
1459ebfedea0SLionel Sambuc }
1460*0a6a1f1dSLionel Sambuc if (starttls_proto == PROTO_XMPP) {
1461ebfedea0SLionel Sambuc int seen = 0;
1462ebfedea0SLionel Sambuc BIO_printf(sbio, "<stream:stream "
1463ebfedea0SLionel Sambuc "xmlns:stream='http://etherx.jabber.org/streams' "
1464ebfedea0SLionel Sambuc "xmlns='jabber:client' to='%s' version='1.0'>", host);
1465ebfedea0SLionel Sambuc seen = BIO_read(sbio, mbuf, BUFSIZZ);
1466ebfedea0SLionel Sambuc mbuf[seen] = 0;
1467*0a6a1f1dSLionel Sambuc while (!strstr
1468*0a6a1f1dSLionel Sambuc (mbuf, "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'")) {
1469ebfedea0SLionel Sambuc if (strstr(mbuf, "/stream:features>"))
1470ebfedea0SLionel Sambuc goto shut;
1471ebfedea0SLionel Sambuc seen = BIO_read(sbio, mbuf, BUFSIZZ);
1472ebfedea0SLionel Sambuc mbuf[seen] = 0;
1473ebfedea0SLionel Sambuc }
1474*0a6a1f1dSLionel Sambuc BIO_printf(sbio,
1475*0a6a1f1dSLionel Sambuc "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>");
1476ebfedea0SLionel Sambuc seen = BIO_read(sbio, sbuf, BUFSIZZ);
1477ebfedea0SLionel Sambuc sbuf[seen] = 0;
1478ebfedea0SLionel Sambuc if (!strstr(sbuf, "<proceed"))
1479ebfedea0SLionel Sambuc goto shut;
1480ebfedea0SLionel Sambuc mbuf[0] = 0;
1481ebfedea0SLionel Sambuc }
1482ebfedea0SLionel Sambuc
1483*0a6a1f1dSLionel Sambuc for (;;) {
1484ebfedea0SLionel Sambuc FD_ZERO(&readfds);
1485ebfedea0SLionel Sambuc FD_ZERO(&writefds);
1486ebfedea0SLionel Sambuc fdin = fileno(stdin);
1487*0a6a1f1dSLionel Sambuc if (fdin < 0) {
1488ebfedea0SLionel Sambuc BIO_printf(bio_err,"bad fileno for stdin\n");
1489ebfedea0SLionel Sambuc goto shut;
1490ebfedea0SLionel Sambuc }
1491ebfedea0SLionel Sambuc fdout = fileno(stdout);
1492*0a6a1f1dSLionel Sambuc if (fdout < 0) {
1493ebfedea0SLionel Sambuc BIO_printf(bio_err,"bad fileno for stdout\n");
1494ebfedea0SLionel Sambuc goto shut;
1495ebfedea0SLionel Sambuc }
1496ebfedea0SLionel Sambuc
1497ebfedea0SLionel Sambuc if ((SSL_version(con) == DTLS1_VERSION) &&
1498ebfedea0SLionel Sambuc DTLSv1_get_timeout(con, &timeout))
1499ebfedea0SLionel Sambuc timeoutp = &timeout;
1500ebfedea0SLionel Sambuc else
1501ebfedea0SLionel Sambuc timeoutp = NULL;
1502ebfedea0SLionel Sambuc
1503*0a6a1f1dSLionel Sambuc if (SSL_in_init(con) && !SSL_total_renegotiations(con)) {
1504ebfedea0SLionel Sambuc in_init = 1;
1505ebfedea0SLionel Sambuc tty_on = 0;
1506*0a6a1f1dSLionel Sambuc } else {
1507ebfedea0SLionel Sambuc tty_on = 1;
1508*0a6a1f1dSLionel Sambuc if (in_init) {
1509ebfedea0SLionel Sambuc in_init = 0;
1510*0a6a1f1dSLionel Sambuc #if 0 /* This test doesn't really work as intended
1511*0a6a1f1dSLionel Sambuc * (needs to be fixed) */
1512ebfedea0SLionel Sambuc # ifndef OPENSSL_NO_TLSEXT
1513*0a6a1f1dSLionel Sambuc if (servername != NULL && !SSL_session_reused(con)) {
1514*0a6a1f1dSLionel Sambuc BIO_printf(bio_c_out,
1515*0a6a1f1dSLionel Sambuc "Server did %sacknowledge servername extension.\n",
1516*0a6a1f1dSLionel Sambuc tlsextcbp.ack ? "" : "not ");
1517ebfedea0SLionel Sambuc }
1518ebfedea0SLionel Sambuc # endif
1519ebfedea0SLionel Sambuc #endif
1520*0a6a1f1dSLionel Sambuc if (sess_out) {
1521ebfedea0SLionel Sambuc BIO *stmp = BIO_new_file(sess_out, "w");
1522*0a6a1f1dSLionel Sambuc if (stmp) {
1523ebfedea0SLionel Sambuc PEM_write_bio_SSL_SESSION(stmp, SSL_get_session(con));
1524ebfedea0SLionel Sambuc BIO_free(stmp);
1525*0a6a1f1dSLionel Sambuc } else
1526*0a6a1f1dSLionel Sambuc BIO_printf(bio_err, "Error writing session file %s\n",
1527*0a6a1f1dSLionel Sambuc sess_out);
1528ebfedea0SLionel Sambuc }
1529ebfedea0SLionel Sambuc print_stuff(bio_c_out, con, full_log);
1530*0a6a1f1dSLionel Sambuc if (full_log > 0)
1531*0a6a1f1dSLionel Sambuc full_log--;
1532ebfedea0SLionel Sambuc
1533*0a6a1f1dSLionel Sambuc if (starttls_proto) {
1534ebfedea0SLionel Sambuc BIO_printf(bio_err, "%s", mbuf);
1535ebfedea0SLionel Sambuc /* We don't need to know any more */
1536ebfedea0SLionel Sambuc starttls_proto = PROTO_OFF;
1537ebfedea0SLionel Sambuc }
1538ebfedea0SLionel Sambuc
1539*0a6a1f1dSLionel Sambuc if (reconnect) {
1540ebfedea0SLionel Sambuc reconnect--;
1541*0a6a1f1dSLionel Sambuc BIO_printf(bio_c_out,
1542*0a6a1f1dSLionel Sambuc "drop connection and then reconnect\n");
1543ebfedea0SLionel Sambuc SSL_shutdown(con);
1544ebfedea0SLionel Sambuc SSL_set_connect_state(con);
1545ebfedea0SLionel Sambuc SHUTDOWN(SSL_get_fd(con));
1546ebfedea0SLionel Sambuc goto re_start;
1547ebfedea0SLionel Sambuc }
1548ebfedea0SLionel Sambuc }
1549ebfedea0SLionel Sambuc }
1550ebfedea0SLionel Sambuc
1551ebfedea0SLionel Sambuc ssl_pending = read_ssl && SSL_pending(con);
1552ebfedea0SLionel Sambuc
1553*0a6a1f1dSLionel Sambuc if (!ssl_pending) {
1554ebfedea0SLionel Sambuc #if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_NETWARE) && !defined (OPENSSL_SYS_BEOS_R5)
1555*0a6a1f1dSLionel Sambuc if (tty_on) {
1556*0a6a1f1dSLionel Sambuc if (read_tty)
1557*0a6a1f1dSLionel Sambuc openssl_fdset(fdin, &readfds);
1558*0a6a1f1dSLionel Sambuc if (write_tty)
1559*0a6a1f1dSLionel Sambuc openssl_fdset(fdout, &writefds);
1560ebfedea0SLionel Sambuc }
1561ebfedea0SLionel Sambuc if (read_ssl)
1562ebfedea0SLionel Sambuc openssl_fdset(SSL_get_fd(con), &readfds);
1563ebfedea0SLionel Sambuc if (write_ssl)
1564ebfedea0SLionel Sambuc openssl_fdset(SSL_get_fd(con), &writefds);
1565ebfedea0SLionel Sambuc #else
1566ebfedea0SLionel Sambuc if (!tty_on || !write_tty) {
1567ebfedea0SLionel Sambuc if (read_ssl)
1568ebfedea0SLionel Sambuc openssl_fdset(SSL_get_fd(con), &readfds);
1569ebfedea0SLionel Sambuc if (write_ssl)
1570ebfedea0SLionel Sambuc openssl_fdset(SSL_get_fd(con), &writefds);
1571ebfedea0SLionel Sambuc }
1572ebfedea0SLionel Sambuc #endif
1573*0a6a1f1dSLionel Sambuc /*- printf("mode tty(%d %d%d) ssl(%d%d)\n",
1574ebfedea0SLionel Sambuc tty_on,read_tty,write_tty,read_ssl,write_ssl);*/
1575ebfedea0SLionel Sambuc
1576*0a6a1f1dSLionel Sambuc /*
1577*0a6a1f1dSLionel Sambuc * Note: under VMS with SOCKETSHR the second parameter is
1578*0a6a1f1dSLionel Sambuc * currently of type (int *) whereas under other systems it is
1579*0a6a1f1dSLionel Sambuc * (void *) if you don't have a cast it will choke the compiler:
1580*0a6a1f1dSLionel Sambuc * if you do have a cast then you can either go for (int *) or
1581*0a6a1f1dSLionel Sambuc * (void *).
1582ebfedea0SLionel Sambuc */
1583ebfedea0SLionel Sambuc #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)
1584*0a6a1f1dSLionel Sambuc /*
1585*0a6a1f1dSLionel Sambuc * Under Windows/DOS we make the assumption that we can always
1586*0a6a1f1dSLionel Sambuc * write to the tty: therefore if we need to write to the tty we
1587*0a6a1f1dSLionel Sambuc * just fall through. Otherwise we timeout the select every
1588*0a6a1f1dSLionel Sambuc * second and see if there are any keypresses. Note: this is a
1589*0a6a1f1dSLionel Sambuc * hack, in a proper Windows application we wouldn't do this.
1590ebfedea0SLionel Sambuc */
1591ebfedea0SLionel Sambuc i = 0;
1592ebfedea0SLionel Sambuc if (!write_tty) {
1593ebfedea0SLionel Sambuc if (read_tty) {
1594ebfedea0SLionel Sambuc tv.tv_sec = 1;
1595ebfedea0SLionel Sambuc tv.tv_usec = 0;
1596ebfedea0SLionel Sambuc i = select(width, (void *)&readfds, (void *)&writefds,
1597ebfedea0SLionel Sambuc NULL, &tv);
1598ebfedea0SLionel Sambuc # if defined(OPENSSL_SYS_WINCE) || defined(OPENSSL_SYS_MSDOS)
1599*0a6a1f1dSLionel Sambuc if (!i && (!_kbhit() || !read_tty))
1600*0a6a1f1dSLionel Sambuc continue;
1601ebfedea0SLionel Sambuc # else
1602*0a6a1f1dSLionel Sambuc if (!i && (!((_kbhit())
1603*0a6a1f1dSLionel Sambuc || (WAIT_OBJECT_0 ==
1604*0a6a1f1dSLionel Sambuc WaitForSingleObject(GetStdHandle
1605*0a6a1f1dSLionel Sambuc (STD_INPUT_HANDLE),
1606*0a6a1f1dSLionel Sambuc 0)))
1607*0a6a1f1dSLionel Sambuc || !read_tty))
1608*0a6a1f1dSLionel Sambuc continue;
1609ebfedea0SLionel Sambuc # endif
1610*0a6a1f1dSLionel Sambuc } else
1611*0a6a1f1dSLionel Sambuc i = select(width, (void *)&readfds, (void *)&writefds,
1612ebfedea0SLionel Sambuc NULL, timeoutp);
1613ebfedea0SLionel Sambuc }
1614ebfedea0SLionel Sambuc #elif defined(OPENSSL_SYS_NETWARE)
1615ebfedea0SLionel Sambuc if (!write_tty) {
1616ebfedea0SLionel Sambuc if (read_tty) {
1617ebfedea0SLionel Sambuc tv.tv_sec = 1;
1618ebfedea0SLionel Sambuc tv.tv_usec = 0;
1619ebfedea0SLionel Sambuc i = select(width, (void *)&readfds, (void *)&writefds,
1620ebfedea0SLionel Sambuc NULL, &tv);
1621*0a6a1f1dSLionel Sambuc } else
1622*0a6a1f1dSLionel Sambuc i = select(width, (void *)&readfds, (void *)&writefds,
1623ebfedea0SLionel Sambuc NULL, timeoutp);
1624ebfedea0SLionel Sambuc }
1625ebfedea0SLionel Sambuc #elif defined(OPENSSL_SYS_BEOS_R5)
1626ebfedea0SLionel Sambuc /* Under BeOS-R5 the situation is similar to DOS */
1627ebfedea0SLionel Sambuc i = 0;
1628ebfedea0SLionel Sambuc stdin_set = 0;
1629ebfedea0SLionel Sambuc (void)fcntl(fdin, F_SETFL, O_NONBLOCK);
1630ebfedea0SLionel Sambuc if (!write_tty) {
1631ebfedea0SLionel Sambuc if (read_tty) {
1632ebfedea0SLionel Sambuc tv.tv_sec = 1;
1633ebfedea0SLionel Sambuc tv.tv_usec = 0;
1634ebfedea0SLionel Sambuc i = select(width, (void *)&readfds, (void *)&writefds,
1635ebfedea0SLionel Sambuc NULL, &tv);
1636ebfedea0SLionel Sambuc if (read(fdin, sbuf, 0) >= 0)
1637ebfedea0SLionel Sambuc stdin_set = 1;
1638ebfedea0SLionel Sambuc if (!i && (stdin_set != 1 || !read_tty))
1639ebfedea0SLionel Sambuc continue;
1640*0a6a1f1dSLionel Sambuc } else
1641*0a6a1f1dSLionel Sambuc i = select(width, (void *)&readfds, (void *)&writefds,
1642ebfedea0SLionel Sambuc NULL, timeoutp);
1643ebfedea0SLionel Sambuc }
1644ebfedea0SLionel Sambuc (void)fcntl(fdin, F_SETFL, 0);
1645ebfedea0SLionel Sambuc #else
1646ebfedea0SLionel Sambuc i = select(width, (void *)&readfds, (void *)&writefds,
1647ebfedea0SLionel Sambuc NULL, timeoutp);
1648ebfedea0SLionel Sambuc #endif
1649*0a6a1f1dSLionel Sambuc if (i < 0) {
1650ebfedea0SLionel Sambuc BIO_printf(bio_err, "bad select %d\n",
1651ebfedea0SLionel Sambuc get_last_socket_error());
1652ebfedea0SLionel Sambuc goto shut;
1653ebfedea0SLionel Sambuc /* goto end; */
1654ebfedea0SLionel Sambuc }
1655ebfedea0SLionel Sambuc }
1656ebfedea0SLionel Sambuc
1657*0a6a1f1dSLionel Sambuc if ((SSL_version(con) == DTLS1_VERSION)
1658*0a6a1f1dSLionel Sambuc && DTLSv1_handle_timeout(con) > 0) {
1659ebfedea0SLionel Sambuc BIO_printf(bio_err, "TIMEOUT occured\n");
1660ebfedea0SLionel Sambuc }
1661ebfedea0SLionel Sambuc
1662*0a6a1f1dSLionel Sambuc if (!ssl_pending && FD_ISSET(SSL_get_fd(con), &writefds)) {
1663*0a6a1f1dSLionel Sambuc k = SSL_write(con, &(cbuf[cbuf_off]), (unsigned int)cbuf_len);
1664*0a6a1f1dSLionel Sambuc switch (SSL_get_error(con, k)) {
1665ebfedea0SLionel Sambuc case SSL_ERROR_NONE:
1666ebfedea0SLionel Sambuc cbuf_off += k;
1667ebfedea0SLionel Sambuc cbuf_len -= k;
1668*0a6a1f1dSLionel Sambuc if (k <= 0)
1669*0a6a1f1dSLionel Sambuc goto end;
1670ebfedea0SLionel Sambuc /* we have done a write(con,NULL,0); */
1671*0a6a1f1dSLionel Sambuc if (cbuf_len <= 0) {
1672ebfedea0SLionel Sambuc read_tty = 1;
1673ebfedea0SLionel Sambuc write_ssl = 0;
1674*0a6a1f1dSLionel Sambuc } else { /* if (cbuf_len > 0) */
1675*0a6a1f1dSLionel Sambuc
1676ebfedea0SLionel Sambuc read_tty = 0;
1677ebfedea0SLionel Sambuc write_ssl = 1;
1678ebfedea0SLionel Sambuc }
1679ebfedea0SLionel Sambuc break;
1680ebfedea0SLionel Sambuc case SSL_ERROR_WANT_WRITE:
1681ebfedea0SLionel Sambuc BIO_printf(bio_c_out, "write W BLOCK\n");
1682ebfedea0SLionel Sambuc write_ssl = 1;
1683ebfedea0SLionel Sambuc read_tty = 0;
1684ebfedea0SLionel Sambuc break;
1685ebfedea0SLionel Sambuc case SSL_ERROR_WANT_READ:
1686ebfedea0SLionel Sambuc BIO_printf(bio_c_out, "write R BLOCK\n");
1687ebfedea0SLionel Sambuc write_tty = 0;
1688ebfedea0SLionel Sambuc read_ssl = 1;
1689ebfedea0SLionel Sambuc write_ssl = 0;
1690ebfedea0SLionel Sambuc break;
1691ebfedea0SLionel Sambuc case SSL_ERROR_WANT_X509_LOOKUP:
1692ebfedea0SLionel Sambuc BIO_printf(bio_c_out, "write X BLOCK\n");
1693ebfedea0SLionel Sambuc break;
1694ebfedea0SLionel Sambuc case SSL_ERROR_ZERO_RETURN:
1695*0a6a1f1dSLionel Sambuc if (cbuf_len != 0) {
1696ebfedea0SLionel Sambuc BIO_printf(bio_c_out, "shutdown\n");
1697ebfedea0SLionel Sambuc ret = 0;
1698ebfedea0SLionel Sambuc goto shut;
1699*0a6a1f1dSLionel Sambuc } else {
1700ebfedea0SLionel Sambuc read_tty = 1;
1701ebfedea0SLionel Sambuc write_ssl = 0;
1702ebfedea0SLionel Sambuc break;
1703ebfedea0SLionel Sambuc }
1704ebfedea0SLionel Sambuc
1705ebfedea0SLionel Sambuc case SSL_ERROR_SYSCALL:
1706*0a6a1f1dSLionel Sambuc if ((k != 0) || (cbuf_len != 0)) {
1707ebfedea0SLionel Sambuc BIO_printf(bio_err, "write:errno=%d\n",
1708ebfedea0SLionel Sambuc get_last_socket_error());
1709ebfedea0SLionel Sambuc goto shut;
1710*0a6a1f1dSLionel Sambuc } else {
1711ebfedea0SLionel Sambuc read_tty = 1;
1712ebfedea0SLionel Sambuc write_ssl = 0;
1713ebfedea0SLionel Sambuc }
1714ebfedea0SLionel Sambuc break;
1715ebfedea0SLionel Sambuc case SSL_ERROR_SSL:
1716ebfedea0SLionel Sambuc ERR_print_errors(bio_err);
1717ebfedea0SLionel Sambuc goto shut;
1718ebfedea0SLionel Sambuc }
1719ebfedea0SLionel Sambuc }
1720ebfedea0SLionel Sambuc #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE) || defined(OPENSSL_SYS_BEOS_R5)
1721ebfedea0SLionel Sambuc /* Assume Windows/DOS/BeOS can always write */
1722ebfedea0SLionel Sambuc else if (!ssl_pending && write_tty)
1723ebfedea0SLionel Sambuc #else
1724ebfedea0SLionel Sambuc else if (!ssl_pending && FD_ISSET(fdout, &writefds))
1725ebfedea0SLionel Sambuc #endif
1726ebfedea0SLionel Sambuc {
1727ebfedea0SLionel Sambuc #ifdef CHARSET_EBCDIC
1728ebfedea0SLionel Sambuc ascii2ebcdic(&(sbuf[sbuf_off]), &(sbuf[sbuf_off]), sbuf_len);
1729ebfedea0SLionel Sambuc #endif
1730ebfedea0SLionel Sambuc i = raw_write_stdout(&(sbuf[sbuf_off]), sbuf_len);
1731ebfedea0SLionel Sambuc
1732*0a6a1f1dSLionel Sambuc if (i <= 0) {
1733ebfedea0SLionel Sambuc BIO_printf(bio_c_out, "DONE\n");
1734ebfedea0SLionel Sambuc ret = 0;
1735ebfedea0SLionel Sambuc goto shut;
1736ebfedea0SLionel Sambuc /* goto end; */
1737ebfedea0SLionel Sambuc }
1738ebfedea0SLionel Sambuc
1739ebfedea0SLionel Sambuc sbuf_len -= i;;
1740ebfedea0SLionel Sambuc sbuf_off += i;
1741*0a6a1f1dSLionel Sambuc if (sbuf_len <= 0) {
1742ebfedea0SLionel Sambuc read_ssl = 1;
1743ebfedea0SLionel Sambuc write_tty = 0;
1744ebfedea0SLionel Sambuc }
1745*0a6a1f1dSLionel Sambuc } else if (ssl_pending || FD_ISSET(SSL_get_fd(con), &readfds)) {
1746ebfedea0SLionel Sambuc #ifdef RENEG
1747*0a6a1f1dSLionel Sambuc {
1748*0a6a1f1dSLionel Sambuc static int iiii;
1749*0a6a1f1dSLionel Sambuc if (++iiii == 52) {
1750*0a6a1f1dSLionel Sambuc SSL_renegotiate(con);
1751*0a6a1f1dSLionel Sambuc iiii = 0;
1752*0a6a1f1dSLionel Sambuc }
1753*0a6a1f1dSLionel Sambuc }
1754ebfedea0SLionel Sambuc #endif
1755ebfedea0SLionel Sambuc #if 1
1756ebfedea0SLionel Sambuc k = SSL_read(con, sbuf, 1024 /* BUFSIZZ */ );
1757ebfedea0SLionel Sambuc #else
1758ebfedea0SLionel Sambuc /* Demo for pending and peek :-) */
1759ebfedea0SLionel Sambuc k = SSL_read(con, sbuf, 16);
1760*0a6a1f1dSLionel Sambuc {
1761*0a6a1f1dSLionel Sambuc char zbuf[10240];
1762*0a6a1f1dSLionel Sambuc printf("read=%d pending=%d peek=%d\n", k, SSL_pending(con),
1763*0a6a1f1dSLionel Sambuc SSL_peek(con, zbuf, 10240));
1764ebfedea0SLionel Sambuc }
1765ebfedea0SLionel Sambuc #endif
1766ebfedea0SLionel Sambuc
1767*0a6a1f1dSLionel Sambuc switch (SSL_get_error(con, k)) {
1768ebfedea0SLionel Sambuc case SSL_ERROR_NONE:
1769ebfedea0SLionel Sambuc if (k <= 0)
1770ebfedea0SLionel Sambuc goto end;
1771ebfedea0SLionel Sambuc sbuf_off = 0;
1772ebfedea0SLionel Sambuc sbuf_len = k;
1773ebfedea0SLionel Sambuc
1774ebfedea0SLionel Sambuc read_ssl = 0;
1775ebfedea0SLionel Sambuc write_tty = 1;
1776ebfedea0SLionel Sambuc break;
1777ebfedea0SLionel Sambuc case SSL_ERROR_WANT_WRITE:
1778ebfedea0SLionel Sambuc BIO_printf(bio_c_out, "read W BLOCK\n");
1779ebfedea0SLionel Sambuc write_ssl = 1;
1780ebfedea0SLionel Sambuc read_tty = 0;
1781ebfedea0SLionel Sambuc break;
1782ebfedea0SLionel Sambuc case SSL_ERROR_WANT_READ:
1783ebfedea0SLionel Sambuc BIO_printf(bio_c_out, "read R BLOCK\n");
1784ebfedea0SLionel Sambuc write_tty = 0;
1785ebfedea0SLionel Sambuc read_ssl = 1;
1786ebfedea0SLionel Sambuc if ((read_tty == 0) && (write_ssl == 0))
1787ebfedea0SLionel Sambuc write_ssl = 1;
1788ebfedea0SLionel Sambuc break;
1789ebfedea0SLionel Sambuc case SSL_ERROR_WANT_X509_LOOKUP:
1790ebfedea0SLionel Sambuc BIO_printf(bio_c_out, "read X BLOCK\n");
1791ebfedea0SLionel Sambuc break;
1792ebfedea0SLionel Sambuc case SSL_ERROR_SYSCALL:
1793ebfedea0SLionel Sambuc ret = get_last_socket_error();
1794ebfedea0SLionel Sambuc BIO_printf(bio_err, "read:errno=%d\n", ret);
1795ebfedea0SLionel Sambuc goto shut;
1796ebfedea0SLionel Sambuc case SSL_ERROR_ZERO_RETURN:
1797ebfedea0SLionel Sambuc BIO_printf(bio_c_out, "closed\n");
1798ebfedea0SLionel Sambuc ret = 0;
1799ebfedea0SLionel Sambuc goto shut;
1800ebfedea0SLionel Sambuc case SSL_ERROR_SSL:
1801ebfedea0SLionel Sambuc ERR_print_errors(bio_err);
1802ebfedea0SLionel Sambuc goto shut;
1803ebfedea0SLionel Sambuc /* break; */
1804ebfedea0SLionel Sambuc }
1805ebfedea0SLionel Sambuc }
1806ebfedea0SLionel Sambuc #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)
1807ebfedea0SLionel Sambuc # if defined(OPENSSL_SYS_WINCE) || defined(OPENSSL_SYS_MSDOS)
1808ebfedea0SLionel Sambuc else if (_kbhit())
1809ebfedea0SLionel Sambuc # else
1810*0a6a1f1dSLionel Sambuc else if ((_kbhit())
1811*0a6a1f1dSLionel Sambuc || (WAIT_OBJECT_0 ==
1812*0a6a1f1dSLionel Sambuc WaitForSingleObject(GetStdHandle(STD_INPUT_HANDLE), 0)))
1813ebfedea0SLionel Sambuc # endif
1814ebfedea0SLionel Sambuc #elif defined (OPENSSL_SYS_NETWARE)
1815ebfedea0SLionel Sambuc else if (_kbhit())
1816ebfedea0SLionel Sambuc #elif defined(OPENSSL_SYS_BEOS_R5)
1817ebfedea0SLionel Sambuc else if (stdin_set)
1818ebfedea0SLionel Sambuc #else
1819ebfedea0SLionel Sambuc else if (FD_ISSET(fdin, &readfds))
1820ebfedea0SLionel Sambuc #endif
1821ebfedea0SLionel Sambuc {
1822*0a6a1f1dSLionel Sambuc if (crlf) {
1823ebfedea0SLionel Sambuc int j, lf_num;
1824ebfedea0SLionel Sambuc
1825ebfedea0SLionel Sambuc i = raw_read_stdin(cbuf, BUFSIZZ / 2);
1826ebfedea0SLionel Sambuc lf_num = 0;
1827ebfedea0SLionel Sambuc /* both loops are skipped when i <= 0 */
1828ebfedea0SLionel Sambuc for (j = 0; j < i; j++)
1829ebfedea0SLionel Sambuc if (cbuf[j] == '\n')
1830ebfedea0SLionel Sambuc lf_num++;
1831*0a6a1f1dSLionel Sambuc for (j = i - 1; j >= 0; j--) {
1832ebfedea0SLionel Sambuc cbuf[j + lf_num] = cbuf[j];
1833*0a6a1f1dSLionel Sambuc if (cbuf[j] == '\n') {
1834ebfedea0SLionel Sambuc lf_num--;
1835ebfedea0SLionel Sambuc i++;
1836ebfedea0SLionel Sambuc cbuf[j + lf_num] = '\r';
1837ebfedea0SLionel Sambuc }
1838ebfedea0SLionel Sambuc }
1839ebfedea0SLionel Sambuc assert(lf_num == 0);
1840*0a6a1f1dSLionel Sambuc } else
1841ebfedea0SLionel Sambuc i = raw_read_stdin(cbuf, BUFSIZZ);
1842ebfedea0SLionel Sambuc
1843*0a6a1f1dSLionel Sambuc if ((!c_ign_eof) && ((i <= 0) || (cbuf[0] == 'Q'))) {
1844ebfedea0SLionel Sambuc BIO_printf(bio_err, "DONE\n");
1845ebfedea0SLionel Sambuc ret = 0;
1846ebfedea0SLionel Sambuc goto shut;
1847ebfedea0SLionel Sambuc }
1848ebfedea0SLionel Sambuc
1849*0a6a1f1dSLionel Sambuc if ((!c_ign_eof) && (cbuf[0] == 'R')) {
1850ebfedea0SLionel Sambuc BIO_printf(bio_err, "RENEGOTIATING\n");
1851ebfedea0SLionel Sambuc SSL_renegotiate(con);
1852ebfedea0SLionel Sambuc cbuf_len = 0;
1853ebfedea0SLionel Sambuc }
1854ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_HEARTBEATS
1855*0a6a1f1dSLionel Sambuc else if ((!c_ign_eof) && (cbuf[0] == 'B')) {
1856ebfedea0SLionel Sambuc BIO_printf(bio_err, "HEARTBEATING\n");
1857ebfedea0SLionel Sambuc SSL_heartbeat(con);
1858ebfedea0SLionel Sambuc cbuf_len = 0;
1859ebfedea0SLionel Sambuc }
1860ebfedea0SLionel Sambuc #endif
1861*0a6a1f1dSLionel Sambuc else {
1862ebfedea0SLionel Sambuc cbuf_len = i;
1863ebfedea0SLionel Sambuc cbuf_off = 0;
1864ebfedea0SLionel Sambuc #ifdef CHARSET_EBCDIC
1865ebfedea0SLionel Sambuc ebcdic2ascii(cbuf, cbuf, i);
1866ebfedea0SLionel Sambuc #endif
1867ebfedea0SLionel Sambuc }
1868ebfedea0SLionel Sambuc
1869ebfedea0SLionel Sambuc write_ssl = 1;
1870ebfedea0SLionel Sambuc read_tty = 0;
1871ebfedea0SLionel Sambuc }
1872ebfedea0SLionel Sambuc }
1873ebfedea0SLionel Sambuc
1874ebfedea0SLionel Sambuc ret = 0;
1875ebfedea0SLionel Sambuc shut:
1876ebfedea0SLionel Sambuc if (in_init)
1877ebfedea0SLionel Sambuc print_stuff(bio_c_out, con, full_log);
1878ebfedea0SLionel Sambuc SSL_shutdown(con);
1879ebfedea0SLionel Sambuc SHUTDOWN(SSL_get_fd(con));
1880ebfedea0SLionel Sambuc end:
1881*0a6a1f1dSLionel Sambuc if (con != NULL) {
1882ebfedea0SLionel Sambuc if (prexit != 0)
1883ebfedea0SLionel Sambuc print_stuff(bio_c_out, con, 1);
1884ebfedea0SLionel Sambuc SSL_free(con);
1885ebfedea0SLionel Sambuc }
1886ebfedea0SLionel Sambuc #if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
1887ebfedea0SLionel Sambuc if (next_proto.data)
1888ebfedea0SLionel Sambuc OPENSSL_free(next_proto.data);
1889ebfedea0SLionel Sambuc #endif
1890*0a6a1f1dSLionel Sambuc if (ctx != NULL)
1891*0a6a1f1dSLionel Sambuc SSL_CTX_free(ctx);
1892ebfedea0SLionel Sambuc if (cert)
1893ebfedea0SLionel Sambuc X509_free(cert);
1894ebfedea0SLionel Sambuc if (key)
1895ebfedea0SLionel Sambuc EVP_PKEY_free(key);
1896ebfedea0SLionel Sambuc if (pass)
1897ebfedea0SLionel Sambuc OPENSSL_free(pass);
1898ebfedea0SLionel Sambuc if (vpm)
1899ebfedea0SLionel Sambuc X509_VERIFY_PARAM_free(vpm);
1900*0a6a1f1dSLionel Sambuc if (cbuf != NULL) {
1901*0a6a1f1dSLionel Sambuc OPENSSL_cleanse(cbuf, BUFSIZZ);
1902*0a6a1f1dSLionel Sambuc OPENSSL_free(cbuf);
1903*0a6a1f1dSLionel Sambuc }
1904*0a6a1f1dSLionel Sambuc if (sbuf != NULL) {
1905*0a6a1f1dSLionel Sambuc OPENSSL_cleanse(sbuf, BUFSIZZ);
1906*0a6a1f1dSLionel Sambuc OPENSSL_free(sbuf);
1907*0a6a1f1dSLionel Sambuc }
1908*0a6a1f1dSLionel Sambuc if (mbuf != NULL) {
1909*0a6a1f1dSLionel Sambuc OPENSSL_cleanse(mbuf, BUFSIZZ);
1910*0a6a1f1dSLionel Sambuc OPENSSL_free(mbuf);
1911*0a6a1f1dSLionel Sambuc }
1912*0a6a1f1dSLionel Sambuc if (bio_c_out != NULL) {
1913ebfedea0SLionel Sambuc BIO_free(bio_c_out);
1914ebfedea0SLionel Sambuc bio_c_out = NULL;
1915ebfedea0SLionel Sambuc }
1916ebfedea0SLionel Sambuc apps_shutdown();
1917ebfedea0SLionel Sambuc OPENSSL_EXIT(ret);
1918ebfedea0SLionel Sambuc }
1919ebfedea0SLionel Sambuc
print_stuff(BIO * bio,SSL * s,int full)1920ebfedea0SLionel Sambuc static void print_stuff(BIO *bio, SSL *s, int full)
1921ebfedea0SLionel Sambuc {
1922ebfedea0SLionel Sambuc X509 *peer = NULL;
1923ebfedea0SLionel Sambuc char *p;
1924ebfedea0SLionel Sambuc static const char *space = " ";
1925ebfedea0SLionel Sambuc char buf[BUFSIZ];
1926ebfedea0SLionel Sambuc STACK_OF(X509) *sk;
1927ebfedea0SLionel Sambuc STACK_OF(X509_NAME) *sk2;
1928ebfedea0SLionel Sambuc const SSL_CIPHER *c;
1929ebfedea0SLionel Sambuc X509_NAME *xn;
1930ebfedea0SLionel Sambuc int j, i;
1931ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_COMP
1932ebfedea0SLionel Sambuc const COMP_METHOD *comp, *expansion;
1933ebfedea0SLionel Sambuc #endif
1934ebfedea0SLionel Sambuc unsigned char *exportedkeymat;
1935ebfedea0SLionel Sambuc
1936*0a6a1f1dSLionel Sambuc if (full) {
1937ebfedea0SLionel Sambuc int got_a_chain = 0;
1938ebfedea0SLionel Sambuc
1939ebfedea0SLionel Sambuc sk = SSL_get_peer_cert_chain(s);
1940*0a6a1f1dSLionel Sambuc if (sk != NULL) {
1941ebfedea0SLionel Sambuc got_a_chain = 1; /* we don't have it for SSL2 (yet) */
1942ebfedea0SLionel Sambuc
1943ebfedea0SLionel Sambuc BIO_printf(bio, "---\nCertificate chain\n");
1944*0a6a1f1dSLionel Sambuc for (i = 0; i < sk_X509_num(sk); i++) {
1945*0a6a1f1dSLionel Sambuc X509_NAME_oneline(X509_get_subject_name(sk_X509_value(sk, i)),
1946*0a6a1f1dSLionel Sambuc buf, sizeof buf);
1947ebfedea0SLionel Sambuc BIO_printf(bio, "%2d s:%s\n", i, buf);
1948*0a6a1f1dSLionel Sambuc X509_NAME_oneline(X509_get_issuer_name(sk_X509_value(sk, i)),
1949*0a6a1f1dSLionel Sambuc buf, sizeof buf);
1950ebfedea0SLionel Sambuc BIO_printf(bio, " i:%s\n", buf);
1951ebfedea0SLionel Sambuc if (c_showcerts)
1952ebfedea0SLionel Sambuc PEM_write_bio_X509(bio, sk_X509_value(sk, i));
1953ebfedea0SLionel Sambuc }
1954ebfedea0SLionel Sambuc }
1955ebfedea0SLionel Sambuc
1956ebfedea0SLionel Sambuc BIO_printf(bio, "---\n");
1957ebfedea0SLionel Sambuc peer = SSL_get_peer_certificate(s);
1958*0a6a1f1dSLionel Sambuc if (peer != NULL) {
1959ebfedea0SLionel Sambuc BIO_printf(bio, "Server certificate\n");
1960*0a6a1f1dSLionel Sambuc
1961*0a6a1f1dSLionel Sambuc /* Redundant if we showed the whole chain */
1962*0a6a1f1dSLionel Sambuc if (!(c_showcerts && got_a_chain))
1963ebfedea0SLionel Sambuc PEM_write_bio_X509(bio, peer);
1964*0a6a1f1dSLionel Sambuc X509_NAME_oneline(X509_get_subject_name(peer), buf, sizeof buf);
1965ebfedea0SLionel Sambuc BIO_printf(bio, "subject=%s\n", buf);
1966*0a6a1f1dSLionel Sambuc X509_NAME_oneline(X509_get_issuer_name(peer), buf, sizeof buf);
1967ebfedea0SLionel Sambuc BIO_printf(bio, "issuer=%s\n", buf);
1968*0a6a1f1dSLionel Sambuc } else
1969ebfedea0SLionel Sambuc BIO_printf(bio, "no peer certificate available\n");
1970ebfedea0SLionel Sambuc
1971ebfedea0SLionel Sambuc sk2 = SSL_get_client_CA_list(s);
1972*0a6a1f1dSLionel Sambuc if ((sk2 != NULL) && (sk_X509_NAME_num(sk2) > 0)) {
1973ebfedea0SLionel Sambuc BIO_printf(bio, "---\nAcceptable client certificate CA names\n");
1974*0a6a1f1dSLionel Sambuc for (i = 0; i < sk_X509_NAME_num(sk2); i++) {
1975ebfedea0SLionel Sambuc xn = sk_X509_NAME_value(sk2, i);
1976ebfedea0SLionel Sambuc X509_NAME_oneline(xn, buf, sizeof(buf));
1977ebfedea0SLionel Sambuc BIO_write(bio, buf, strlen(buf));
1978ebfedea0SLionel Sambuc BIO_write(bio, "\n", 1);
1979ebfedea0SLionel Sambuc }
1980*0a6a1f1dSLionel Sambuc } else {
1981ebfedea0SLionel Sambuc BIO_printf(bio, "---\nNo client certificate CA names sent\n");
1982ebfedea0SLionel Sambuc }
1983ebfedea0SLionel Sambuc p = SSL_get_shared_ciphers(s, buf, sizeof buf);
1984*0a6a1f1dSLionel Sambuc if (p != NULL) {
1985*0a6a1f1dSLionel Sambuc /*
1986*0a6a1f1dSLionel Sambuc * This works only for SSL 2. In later protocol versions, the
1987*0a6a1f1dSLionel Sambuc * client does not know what other ciphers (in addition to the
1988*0a6a1f1dSLionel Sambuc * one to be used in the current connection) the server supports.
1989*0a6a1f1dSLionel Sambuc */
1990ebfedea0SLionel Sambuc
1991*0a6a1f1dSLionel Sambuc BIO_printf(bio,
1992*0a6a1f1dSLionel Sambuc "---\nCiphers common between both SSL endpoints:\n");
1993ebfedea0SLionel Sambuc j = i = 0;
1994*0a6a1f1dSLionel Sambuc while (*p) {
1995*0a6a1f1dSLionel Sambuc if (*p == ':') {
1996ebfedea0SLionel Sambuc BIO_write(bio, space, 15 - j % 25);
1997ebfedea0SLionel Sambuc i++;
1998ebfedea0SLionel Sambuc j = 0;
1999ebfedea0SLionel Sambuc BIO_write(bio, ((i % 3) ? " " : "\n"), 1);
2000*0a6a1f1dSLionel Sambuc } else {
2001ebfedea0SLionel Sambuc BIO_write(bio, p, 1);
2002ebfedea0SLionel Sambuc j++;
2003ebfedea0SLionel Sambuc }
2004ebfedea0SLionel Sambuc p++;
2005ebfedea0SLionel Sambuc }
2006ebfedea0SLionel Sambuc BIO_write(bio, "\n", 1);
2007ebfedea0SLionel Sambuc }
2008ebfedea0SLionel Sambuc
2009*0a6a1f1dSLionel Sambuc BIO_printf(bio,
2010*0a6a1f1dSLionel Sambuc "---\nSSL handshake has read %ld bytes and written %ld bytes\n",
2011ebfedea0SLionel Sambuc BIO_number_read(SSL_get_rbio(s)),
2012ebfedea0SLionel Sambuc BIO_number_written(SSL_get_wbio(s)));
2013ebfedea0SLionel Sambuc }
2014ebfedea0SLionel Sambuc BIO_printf(bio, (SSL_cache_hit(s) ? "---\nReused, " : "---\nNew, "));
2015ebfedea0SLionel Sambuc c = SSL_get_current_cipher(s);
2016ebfedea0SLionel Sambuc BIO_printf(bio, "%s, Cipher is %s\n",
2017*0a6a1f1dSLionel Sambuc SSL_CIPHER_get_version(c), SSL_CIPHER_get_name(c));
2018ebfedea0SLionel Sambuc if (peer != NULL) {
2019ebfedea0SLionel Sambuc EVP_PKEY *pktmp;
2020ebfedea0SLionel Sambuc pktmp = X509_get_pubkey(peer);
2021ebfedea0SLionel Sambuc BIO_printf(bio, "Server public key is %d bit\n",
2022ebfedea0SLionel Sambuc EVP_PKEY_bits(pktmp));
2023ebfedea0SLionel Sambuc EVP_PKEY_free(pktmp);
2024ebfedea0SLionel Sambuc }
2025ebfedea0SLionel Sambuc BIO_printf(bio, "Secure Renegotiation IS%s supported\n",
2026ebfedea0SLionel Sambuc SSL_get_secure_renegotiation_support(s) ? "" : " NOT");
2027ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_COMP
2028ebfedea0SLionel Sambuc comp = SSL_get_current_compression(s);
2029ebfedea0SLionel Sambuc expansion = SSL_get_current_expansion(s);
2030ebfedea0SLionel Sambuc BIO_printf(bio, "Compression: %s\n",
2031ebfedea0SLionel Sambuc comp ? SSL_COMP_get_name(comp) : "NONE");
2032ebfedea0SLionel Sambuc BIO_printf(bio, "Expansion: %s\n",
2033ebfedea0SLionel Sambuc expansion ? SSL_COMP_get_name(expansion) : "NONE");
2034ebfedea0SLionel Sambuc #endif
2035ebfedea0SLionel Sambuc
2036ebfedea0SLionel Sambuc #ifdef SSL_DEBUG
2037ebfedea0SLionel Sambuc {
2038ebfedea0SLionel Sambuc /* Print out local port of connection: useful for debugging */
2039ebfedea0SLionel Sambuc int sock;
2040ebfedea0SLionel Sambuc struct sockaddr_in ladd;
2041ebfedea0SLionel Sambuc socklen_t ladd_size = sizeof(ladd);
2042ebfedea0SLionel Sambuc sock = SSL_get_fd(s);
2043ebfedea0SLionel Sambuc getsockname(sock, (struct sockaddr *)&ladd, &ladd_size);
2044ebfedea0SLionel Sambuc BIO_printf(bio_c_out, "LOCAL PORT is %u\n", ntohs(ladd.sin_port));
2045ebfedea0SLionel Sambuc }
2046ebfedea0SLionel Sambuc #endif
2047ebfedea0SLionel Sambuc
2048ebfedea0SLionel Sambuc #if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
2049ebfedea0SLionel Sambuc if (next_proto.status != -1) {
2050ebfedea0SLionel Sambuc const unsigned char *proto;
2051ebfedea0SLionel Sambuc unsigned int proto_len;
2052ebfedea0SLionel Sambuc SSL_get0_next_proto_negotiated(s, &proto, &proto_len);
2053ebfedea0SLionel Sambuc BIO_printf(bio, "Next protocol: (%d) ", next_proto.status);
2054ebfedea0SLionel Sambuc BIO_write(bio, proto, proto_len);
2055ebfedea0SLionel Sambuc BIO_write(bio, "\n", 1);
2056ebfedea0SLionel Sambuc }
2057ebfedea0SLionel Sambuc #endif
2058ebfedea0SLionel Sambuc
2059ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_SRTP
2060ebfedea0SLionel Sambuc {
2061*0a6a1f1dSLionel Sambuc SRTP_PROTECTION_PROFILE *srtp_profile =
2062*0a6a1f1dSLionel Sambuc SSL_get_selected_srtp_profile(s);
2063ebfedea0SLionel Sambuc
2064ebfedea0SLionel Sambuc if (srtp_profile)
2065ebfedea0SLionel Sambuc BIO_printf(bio, "SRTP Extension negotiated, profile=%s\n",
2066ebfedea0SLionel Sambuc srtp_profile->name);
2067ebfedea0SLionel Sambuc }
2068ebfedea0SLionel Sambuc #endif
2069ebfedea0SLionel Sambuc
2070ebfedea0SLionel Sambuc SSL_SESSION_print(bio, SSL_get_session(s));
2071*0a6a1f1dSLionel Sambuc if (keymatexportlabel != NULL) {
2072ebfedea0SLionel Sambuc BIO_printf(bio, "Keying material exporter:\n");
2073ebfedea0SLionel Sambuc BIO_printf(bio, " Label: '%s'\n", keymatexportlabel);
2074ebfedea0SLionel Sambuc BIO_printf(bio, " Length: %i bytes\n", keymatexportlen);
2075ebfedea0SLionel Sambuc exportedkeymat = OPENSSL_malloc(keymatexportlen);
2076*0a6a1f1dSLionel Sambuc if (exportedkeymat != NULL) {
2077ebfedea0SLionel Sambuc if (!SSL_export_keying_material(s, exportedkeymat,
2078ebfedea0SLionel Sambuc keymatexportlen,
2079ebfedea0SLionel Sambuc keymatexportlabel,
2080ebfedea0SLionel Sambuc strlen(keymatexportlabel),
2081*0a6a1f1dSLionel Sambuc NULL, 0, 0)) {
2082ebfedea0SLionel Sambuc BIO_printf(bio, " Error\n");
2083*0a6a1f1dSLionel Sambuc } else {
2084ebfedea0SLionel Sambuc BIO_printf(bio, " Keying material: ");
2085ebfedea0SLionel Sambuc for (i = 0; i < keymatexportlen; i++)
2086*0a6a1f1dSLionel Sambuc BIO_printf(bio, "%02X", exportedkeymat[i]);
2087ebfedea0SLionel Sambuc BIO_printf(bio, "\n");
2088ebfedea0SLionel Sambuc }
2089ebfedea0SLionel Sambuc OPENSSL_free(exportedkeymat);
2090ebfedea0SLionel Sambuc }
2091ebfedea0SLionel Sambuc }
2092ebfedea0SLionel Sambuc BIO_printf(bio, "---\n");
2093ebfedea0SLionel Sambuc if (peer != NULL)
2094ebfedea0SLionel Sambuc X509_free(peer);
2095ebfedea0SLionel Sambuc /* flush, or debugging output gets mixed with http response */
2096ebfedea0SLionel Sambuc (void)BIO_flush(bio);
2097ebfedea0SLionel Sambuc }
2098ebfedea0SLionel Sambuc
2099ebfedea0SLionel Sambuc #ifndef OPENSSL_NO_TLSEXT
2100ebfedea0SLionel Sambuc
ocsp_resp_cb(SSL * s,void * arg)2101ebfedea0SLionel Sambuc static int ocsp_resp_cb(SSL *s, void *arg)
2102ebfedea0SLionel Sambuc {
2103ebfedea0SLionel Sambuc const unsigned char *p;
2104ebfedea0SLionel Sambuc int len;
2105ebfedea0SLionel Sambuc OCSP_RESPONSE *rsp;
2106ebfedea0SLionel Sambuc len = SSL_get_tlsext_status_ocsp_resp(s, &p);
2107ebfedea0SLionel Sambuc BIO_puts(arg, "OCSP response: ");
2108*0a6a1f1dSLionel Sambuc if (!p) {
2109ebfedea0SLionel Sambuc BIO_puts(arg, "no response sent\n");
2110ebfedea0SLionel Sambuc return 1;
2111ebfedea0SLionel Sambuc }
2112ebfedea0SLionel Sambuc rsp = d2i_OCSP_RESPONSE(NULL, &p, len);
2113*0a6a1f1dSLionel Sambuc if (!rsp) {
2114ebfedea0SLionel Sambuc BIO_puts(arg, "response parse error\n");
2115ebfedea0SLionel Sambuc BIO_dump_indent(arg, (char *)p, len, 4);
2116ebfedea0SLionel Sambuc return 0;
2117ebfedea0SLionel Sambuc }
2118ebfedea0SLionel Sambuc BIO_puts(arg, "\n======================================\n");
2119ebfedea0SLionel Sambuc OCSP_RESPONSE_print(arg, rsp, 0);
2120ebfedea0SLionel Sambuc BIO_puts(arg, "======================================\n");
2121ebfedea0SLionel Sambuc OCSP_RESPONSE_free(rsp);
2122ebfedea0SLionel Sambuc return 1;
2123ebfedea0SLionel Sambuc }
2124ebfedea0SLionel Sambuc
2125ebfedea0SLionel Sambuc #endif
2126