1 /* apps/s_client.c */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58 /* ====================================================================
59 * Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved.
60 *
61 * Redistribution and use in source and binary forms, with or without
62 * modification, are permitted provided that the following conditions
63 * are met:
64 *
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
67 *
68 * 2. Redistributions in binary form must reproduce the above copyright
69 * notice, this list of conditions and the following disclaimer in
70 * the documentation and/or other materials provided with the
71 * distribution.
72 *
73 * 3. All advertising materials mentioning features or use of this
74 * software must display the following acknowledgment:
75 * "This product includes software developed by the OpenSSL Project
76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77 *
78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79 * endorse or promote products derived from this software without
80 * prior written permission. For written permission, please contact
81 * openssl-core@openssl.org.
82 *
83 * 5. Products derived from this software may not be called "OpenSSL"
84 * nor may "OpenSSL" appear in their names without prior written
85 * permission of the OpenSSL Project.
86 *
87 * 6. Redistributions of any form whatsoever must retain the following
88 * acknowledgment:
89 * "This product includes software developed by the OpenSSL Project
90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91 *
92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103 * OF THE POSSIBILITY OF SUCH DAMAGE.
104 * ====================================================================
105 *
106 * This product includes cryptographic software written by Eric Young
107 * (eay@cryptsoft.com). This product includes software written by Tim
108 * Hudson (tjh@cryptsoft.com).
109 *
110 */
111 /* ====================================================================
112 * Copyright 2005 Nokia. All rights reserved.
113 *
114 * The portions of the attached software ("Contribution") is developed by
115 * Nokia Corporation and is licensed pursuant to the OpenSSL open source
116 * license.
117 *
118 * The Contribution, originally written by Mika Kousa and Pasi Eronen of
119 * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
120 * support (see RFC 4279) to OpenSSL.
121 *
122 * No patent licenses or other rights except those expressly stated in
123 * the OpenSSL open source license shall be deemed granted or received
124 * expressly, by implication, estoppel, or otherwise.
125 *
126 * No assurances are provided by Nokia that the Contribution does not
127 * infringe the patent or other intellectual property rights of any third
128 * party or that the license provides you with all the necessary rights
129 * to make use of the Contribution.
130 *
131 * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
132 * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
133 * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
134 * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
135 * OTHERWISE.
136 */
137
138 #include <assert.h>
139 #include <ctype.h>
140 #include <stdio.h>
141 #include <stdlib.h>
142 #include <string.h>
143 #include <openssl/e_os2.h>
144 #ifdef OPENSSL_NO_STDIO
145 # define APPS_WIN16
146 #endif
147
148 /*
149 * With IPv6, it looks like Digital has mixed up the proper order of
150 * recursive header file inclusion, resulting in the compiler complaining
151 * that u_int isn't defined, but only if _POSIX_C_SOURCE is defined, which is
152 * needed to have fileno() declared correctly... So let's define u_int
153 */
154 #if defined(OPENSSL_SYS_VMS_DECC) && !defined(__U_INT)
155 # define __U_INT
156 typedef unsigned int u_int;
157 #endif
158
159 #define USE_SOCKETS
160 #include "apps.h"
161 #include <openssl/x509.h>
162 #include <openssl/ssl.h>
163 #include <openssl/err.h>
164 #include <openssl/pem.h>
165 #include <openssl/rand.h>
166 #include <openssl/ocsp.h>
167 #include <openssl/bn.h>
168 #ifndef OPENSSL_NO_SRP
169 # include <openssl/srp.h>
170 #endif
171 #include "s_apps.h"
172 #include "timeouts.h"
173
174 #if (defined(OPENSSL_SYS_VMS) && __VMS_VER < 70000000)
175 /* FIONBIO used as a switch to enable ioctl, and that isn't in VMS < 7.0 */
176 # undef FIONBIO
177 #endif
178
179 #if defined(OPENSSL_SYS_BEOS_R5)
180 # include <fcntl.h>
181 #endif
182
183 #undef PROG
184 #define PROG s_client_main
185
186 /*
187 * #define SSL_HOST_NAME "www.netscape.com"
188 */
189 /*
190 * #define SSL_HOST_NAME "193.118.187.102"
191 */
192 #define SSL_HOST_NAME "localhost"
193
194 /* no default cert. */
195 /*
196 * #define TEST_CERT "client.pem"
197 */
198
199 #undef BUFSIZZ
200 #define BUFSIZZ 1024*8
201
202 extern int verify_depth;
203 extern int verify_error;
204 extern int verify_return_error;
205
206 #ifdef FIONBIO
207 static int c_nbio = 0;
208 #endif
209 static int c_Pause = 0;
210 static int c_debug = 0;
211 #ifndef OPENSSL_NO_TLSEXT
212 static int c_tlsextdebug = 0;
213 static int c_status_req = 0;
214 #endif
215 static int c_msg = 0;
216 static int c_showcerts = 0;
217
218 static char *keymatexportlabel = NULL;
219 static int keymatexportlen = 20;
220
221 static void sc_usage(void);
222 static void print_stuff(BIO *berr, SSL *con, int full);
223 #ifndef OPENSSL_NO_TLSEXT
224 static int ocsp_resp_cb(SSL *s, void *arg);
225 #endif
226 static BIO *bio_c_out = NULL;
227 static int c_quiet = 0;
228 static int c_ign_eof = 0;
229
230 #ifndef OPENSSL_NO_PSK
231 /* Default PSK identity and key */
232 static char *psk_identity = "Client_identity";
233 /*
234 * char *psk_key=NULL; by default PSK is not used
235 */
236
psk_client_cb(SSL * ssl,const char * hint,char * identity,unsigned int max_identity_len,unsigned char * psk,unsigned int max_psk_len)237 static unsigned int psk_client_cb(SSL *ssl, const char *hint, char *identity,
238 unsigned int max_identity_len,
239 unsigned char *psk,
240 unsigned int max_psk_len)
241 {
242 unsigned int psk_len = 0;
243 int ret;
244 BIGNUM *bn = NULL;
245
246 if (c_debug)
247 BIO_printf(bio_c_out, "psk_client_cb\n");
248 if (!hint) {
249 /* no ServerKeyExchange message */
250 if (c_debug)
251 BIO_printf(bio_c_out,
252 "NULL received PSK identity hint, continuing anyway\n");
253 } else if (c_debug)
254 BIO_printf(bio_c_out, "Received PSK identity hint '%s'\n", hint);
255
256 /*
257 * lookup PSK identity and PSK key based on the given identity hint here
258 */
259 ret = BIO_snprintf(identity, max_identity_len, "%s", psk_identity);
260 if (ret < 0 || (unsigned int)ret > max_identity_len)
261 goto out_err;
262 if (c_debug)
263 BIO_printf(bio_c_out, "created identity '%s' len=%d\n", identity,
264 ret);
265 ret = BN_hex2bn(&bn, psk_key);
266 if (!ret) {
267 BIO_printf(bio_err, "Could not convert PSK key '%s' to BIGNUM\n",
268 psk_key);
269 if (bn)
270 BN_free(bn);
271 return 0;
272 }
273
274 if ((unsigned int)BN_num_bytes(bn) > max_psk_len) {
275 BIO_printf(bio_err,
276 "psk buffer of callback is too small (%d) for key (%d)\n",
277 max_psk_len, BN_num_bytes(bn));
278 BN_free(bn);
279 return 0;
280 }
281
282 psk_len = BN_bn2bin(bn, psk);
283 BN_free(bn);
284 if (psk_len == 0)
285 goto out_err;
286
287 if (c_debug)
288 BIO_printf(bio_c_out, "created PSK len=%d\n", psk_len);
289
290 return psk_len;
291 out_err:
292 if (c_debug)
293 BIO_printf(bio_err, "Error in PSK client callback\n");
294 return 0;
295 }
296 #endif
297
sc_usage(void)298 static void sc_usage(void)
299 {
300 BIO_printf(bio_err, "usage: s_client args\n");
301 BIO_printf(bio_err, "\n");
302 BIO_printf(bio_err, " -host host - use -connect instead\n");
303 BIO_printf(bio_err, " -port port - use -connect instead\n");
304 BIO_printf(bio_err,
305 " -connect host:port - who to connect to (default is %s:%s)\n",
306 SSL_HOST_NAME, PORT_STR);
307
308 BIO_printf(bio_err,
309 " -verify arg - turn on peer certificate verification\n");
310 BIO_printf(bio_err,
311 " -verify_return_error - return verification errors\n");
312 BIO_printf(bio_err,
313 " -cert arg - certificate file to use, PEM format assumed\n");
314 BIO_printf(bio_err,
315 " -certform arg - certificate format (PEM or DER) PEM default\n");
316 BIO_printf(bio_err,
317 " -key arg - Private key file to use, in cert file if\n");
318 BIO_printf(bio_err, " not specified but cert file is.\n");
319 BIO_printf(bio_err,
320 " -keyform arg - key format (PEM or DER) PEM default\n");
321 BIO_printf(bio_err,
322 " -pass arg - private key file pass phrase source\n");
323 BIO_printf(bio_err, " -CApath arg - PEM format directory of CA's\n");
324 BIO_printf(bio_err, " -CAfile arg - PEM format file of CA's\n");
325 BIO_printf(bio_err,
326 " -no_alt_chains - only ever use the first certificate chain found\n");
327 BIO_printf(bio_err,
328 " -reconnect - Drop and re-make the connection with the same Session-ID\n");
329 BIO_printf(bio_err,
330 " -pause - sleep(1) after each read(2) and write(2) system call\n");
331 BIO_printf(bio_err,
332 " -prexit - print session information even on connection failure\n");
333 BIO_printf(bio_err,
334 " -showcerts - show all certificates in the chain\n");
335 BIO_printf(bio_err, " -debug - extra output\n");
336 #ifdef WATT32
337 BIO_printf(bio_err, " -wdebug - WATT-32 tcp debugging\n");
338 #endif
339 BIO_printf(bio_err, " -msg - Show protocol messages\n");
340 BIO_printf(bio_err, " -nbio_test - more ssl protocol testing\n");
341 BIO_printf(bio_err, " -state - print the 'ssl' states\n");
342 #ifdef FIONBIO
343 BIO_printf(bio_err, " -nbio - Run with non-blocking IO\n");
344 #endif
345 BIO_printf(bio_err,
346 " -crlf - convert LF from terminal into CRLF\n");
347 BIO_printf(bio_err, " -quiet - no s_client output\n");
348 BIO_printf(bio_err,
349 " -ign_eof - ignore input eof (default when -quiet)\n");
350 BIO_printf(bio_err, " -no_ign_eof - don't ignore input eof\n");
351 #ifndef OPENSSL_NO_PSK
352 BIO_printf(bio_err, " -psk_identity arg - PSK identity\n");
353 BIO_printf(bio_err, " -psk arg - PSK in hex (without 0x)\n");
354 # ifndef OPENSSL_NO_JPAKE
355 BIO_printf(bio_err, " -jpake arg - JPAKE secret to use\n");
356 # endif
357 #endif
358 #ifndef OPENSSL_NO_SRP
359 BIO_printf(bio_err,
360 " -srpuser user - SRP authentification for 'user'\n");
361 BIO_printf(bio_err, " -srppass arg - password for 'user'\n");
362 BIO_printf(bio_err,
363 " -srp_lateuser - SRP username into second ClientHello message\n");
364 BIO_printf(bio_err,
365 " -srp_moregroups - Tolerate other than the known g N values.\n");
366 BIO_printf(bio_err,
367 " -srp_strength int - minimal length in bits for N (default %d).\n",
368 SRP_MINIMAL_N);
369 #endif
370 BIO_printf(bio_err, " -ssl2 - just use SSLv2\n");
371 #ifndef OPENSSL_NO_SSL3_METHOD
372 BIO_printf(bio_err, " -ssl3 - just use SSLv3\n");
373 #endif
374 BIO_printf(bio_err, " -tls1_2 - just use TLSv1.2\n");
375 BIO_printf(bio_err, " -tls1_1 - just use TLSv1.1\n");
376 BIO_printf(bio_err, " -tls1 - just use TLSv1\n");
377 BIO_printf(bio_err, " -dtls1 - just use DTLSv1\n");
378 BIO_printf(bio_err, " -fallback_scsv - send TLS_FALLBACK_SCSV\n");
379 BIO_printf(bio_err, " -mtu - set the link layer MTU\n");
380 BIO_printf(bio_err,
381 " -no_tls1_2/-no_tls1_1/-no_tls1/-no_ssl3/-no_ssl2 - turn off that protocol\n");
382 BIO_printf(bio_err,
383 " -bugs - Switch on all SSL implementation bug workarounds\n");
384 BIO_printf(bio_err,
385 " -serverpref - Use server's cipher preferences (only SSLv2)\n");
386 BIO_printf(bio_err,
387 " -cipher - preferred cipher to use, use the 'openssl ciphers'\n");
388 BIO_printf(bio_err,
389 " command to see what is available\n");
390 BIO_printf(bio_err,
391 " -starttls prot - use the STARTTLS command before starting TLS\n");
392 BIO_printf(bio_err,
393 " for those protocols that support it, where\n");
394 BIO_printf(bio_err,
395 " 'prot' defines which one to assume. Currently,\n");
396 BIO_printf(bio_err,
397 " only \"smtp\", \"pop3\", \"imap\", \"ftp\" and \"xmpp\"\n");
398 BIO_printf(bio_err, " are supported.\n");
399 #ifndef OPENSSL_NO_ENGINE
400 BIO_printf(bio_err,
401 " -engine id - Initialise and use the specified engine\n");
402 #endif
403 BIO_printf(bio_err, " -rand file%cfile%c...\n", LIST_SEPARATOR_CHAR,
404 LIST_SEPARATOR_CHAR);
405 BIO_printf(bio_err, " -sess_out arg - file to write SSL session to\n");
406 BIO_printf(bio_err, " -sess_in arg - file to read SSL session from\n");
407 #ifndef OPENSSL_NO_TLSEXT
408 BIO_printf(bio_err,
409 " -servername host - Set TLS extension servername in ClientHello\n");
410 BIO_printf(bio_err,
411 " -tlsextdebug - hex dump of all TLS extensions received\n");
412 BIO_printf(bio_err,
413 " -status - request certificate status from server\n");
414 BIO_printf(bio_err,
415 " -no_ticket - disable use of RFC4507bis session tickets\n");
416 # ifndef OPENSSL_NO_NEXTPROTONEG
417 BIO_printf(bio_err,
418 " -nextprotoneg arg - enable NPN extension, considering named protocols supported (comma-separated list)\n");
419 # endif
420 #endif
421 BIO_printf(bio_err,
422 " -legacy_renegotiation - enable use of legacy renegotiation (dangerous)\n");
423 #ifndef OPENSSL_NO_SRTP
424 BIO_printf(bio_err,
425 " -use_srtp profiles - Offer SRTP key management with a colon-separated profile list\n");
426 #endif
427 BIO_printf(bio_err,
428 " -keymatexport label - Export keying material using label\n");
429 BIO_printf(bio_err,
430 " -keymatexportlen len - Export len bytes of keying material (default 20)\n");
431 }
432
433 #ifndef OPENSSL_NO_TLSEXT
434
435 /* This is a context that we pass to callbacks */
436 typedef struct tlsextctx_st {
437 BIO *biodebug;
438 int ack;
439 } tlsextctx;
440
ssl_servername_cb(SSL * s,int * ad,void * arg)441 static int MS_CALLBACK ssl_servername_cb(SSL *s, int *ad, void *arg)
442 {
443 tlsextctx *p = (tlsextctx *) arg;
444 const char *hn = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
445 if (SSL_get_servername_type(s) != -1)
446 p->ack = !SSL_session_reused(s) && hn != NULL;
447 else
448 BIO_printf(bio_err, "Can't use SSL_get_servername\n");
449
450 return SSL_TLSEXT_ERR_OK;
451 }
452
453 # ifndef OPENSSL_NO_SRP
454
455 /* This is a context that we pass to all callbacks */
456 typedef struct srp_arg_st {
457 char *srppassin;
458 char *srplogin;
459 int msg; /* copy from c_msg */
460 int debug; /* copy from c_debug */
461 int amp; /* allow more groups */
462 int strength /* minimal size for N */ ;
463 } SRP_ARG;
464
465 # define SRP_NUMBER_ITERATIONS_FOR_PRIME 64
466
srp_Verify_N_and_g(BIGNUM * N,BIGNUM * g)467 static int srp_Verify_N_and_g(BIGNUM *N, BIGNUM *g)
468 {
469 BN_CTX *bn_ctx = BN_CTX_new();
470 BIGNUM *p = BN_new();
471 BIGNUM *r = BN_new();
472 int ret =
473 g != NULL && N != NULL && bn_ctx != NULL && BN_is_odd(N) &&
474 BN_is_prime_ex(N, SRP_NUMBER_ITERATIONS_FOR_PRIME, bn_ctx, NULL) &&
475 p != NULL && BN_rshift1(p, N) &&
476 /* p = (N-1)/2 */
477 BN_is_prime_ex(p, SRP_NUMBER_ITERATIONS_FOR_PRIME, bn_ctx, NULL) &&
478 r != NULL &&
479 /* verify g^((N-1)/2) == -1 (mod N) */
480 BN_mod_exp(r, g, p, N, bn_ctx) &&
481 BN_add_word(r, 1) && BN_cmp(r, N) == 0;
482
483 if (r)
484 BN_free(r);
485 if (p)
486 BN_free(p);
487 if (bn_ctx)
488 BN_CTX_free(bn_ctx);
489 return ret;
490 }
491
492 /*-
493 * This callback is used here for two purposes:
494 * - extended debugging
495 * - making some primality tests for unknown groups
496 * The callback is only called for a non default group.
497 *
498 * An application does not need the call back at all if
499 * only the stanard groups are used. In real life situations,
500 * client and server already share well known groups,
501 * thus there is no need to verify them.
502 * Furthermore, in case that a server actually proposes a group that
503 * is not one of those defined in RFC 5054, it is more appropriate
504 * to add the group to a static list and then compare since
505 * primality tests are rather cpu consuming.
506 */
507
ssl_srp_verify_param_cb(SSL * s,void * arg)508 static int MS_CALLBACK ssl_srp_verify_param_cb(SSL *s, void *arg)
509 {
510 SRP_ARG *srp_arg = (SRP_ARG *)arg;
511 BIGNUM *N = NULL, *g = NULL;
512 if (!(N = SSL_get_srp_N(s)) || !(g = SSL_get_srp_g(s)))
513 return 0;
514 if (srp_arg->debug || srp_arg->msg || srp_arg->amp == 1) {
515 BIO_printf(bio_err, "SRP parameters:\n");
516 BIO_printf(bio_err, "\tN=");
517 BN_print(bio_err, N);
518 BIO_printf(bio_err, "\n\tg=");
519 BN_print(bio_err, g);
520 BIO_printf(bio_err, "\n");
521 }
522
523 if (SRP_check_known_gN_param(g, N))
524 return 1;
525
526 if (srp_arg->amp == 1) {
527 if (srp_arg->debug)
528 BIO_printf(bio_err,
529 "SRP param N and g are not known params, going to check deeper.\n");
530
531 /*
532 * The srp_moregroups is a real debugging feature. Implementors
533 * should rather add the value to the known ones. The minimal size
534 * has already been tested.
535 */
536 if (BN_num_bits(g) <= BN_BITS && srp_Verify_N_and_g(N, g))
537 return 1;
538 }
539 BIO_printf(bio_err, "SRP param N and g rejected.\n");
540 return 0;
541 }
542
543 # define PWD_STRLEN 1024
544
ssl_give_srp_client_pwd_cb(SSL * s,void * arg)545 static char *MS_CALLBACK ssl_give_srp_client_pwd_cb(SSL *s, void *arg)
546 {
547 SRP_ARG *srp_arg = (SRP_ARG *)arg;
548 char *pass = (char *)OPENSSL_malloc(PWD_STRLEN + 1);
549 PW_CB_DATA cb_tmp;
550 int l;
551
552 if (!pass) {
553 BIO_printf(bio_err, "Malloc failure\n");
554 return NULL;
555 }
556
557 cb_tmp.password = (char *)srp_arg->srppassin;
558 cb_tmp.prompt_info = "SRP user";
559 if ((l = password_callback(pass, PWD_STRLEN, 0, &cb_tmp)) < 0) {
560 BIO_printf(bio_err, "Can't read Password\n");
561 OPENSSL_free(pass);
562 return NULL;
563 }
564 *(pass + l) = '\0';
565
566 return pass;
567 }
568
569 # endif
570 # ifndef OPENSSL_NO_SRTP
571 char *srtp_profiles = NULL;
572 # endif
573
574 # ifndef OPENSSL_NO_NEXTPROTONEG
575 /* This the context that we pass to next_proto_cb */
576 typedef struct tlsextnextprotoctx_st {
577 unsigned char *data;
578 unsigned short len;
579 int status;
580 } tlsextnextprotoctx;
581
582 static tlsextnextprotoctx next_proto;
583
next_proto_cb(SSL * s,unsigned char ** out,unsigned char * outlen,const unsigned char * in,unsigned int inlen,void * arg)584 static int next_proto_cb(SSL *s, unsigned char **out, unsigned char *outlen,
585 const unsigned char *in, unsigned int inlen,
586 void *arg)
587 {
588 tlsextnextprotoctx *ctx = arg;
589
590 if (!c_quiet) {
591 /* We can assume that |in| is syntactically valid. */
592 unsigned i;
593 BIO_printf(bio_c_out, "Protocols advertised by server: ");
594 for (i = 0; i < inlen;) {
595 if (i)
596 BIO_write(bio_c_out, ", ", 2);
597 BIO_write(bio_c_out, &in[i + 1], in[i]);
598 i += in[i] + 1;
599 }
600 BIO_write(bio_c_out, "\n", 1);
601 }
602
603 ctx->status =
604 SSL_select_next_proto(out, outlen, in, inlen, ctx->data, ctx->len);
605 return SSL_TLSEXT_ERR_OK;
606 }
607 # endif /* ndef OPENSSL_NO_NEXTPROTONEG */
608 #endif
609
610 enum {
611 PROTO_OFF = 0,
612 PROTO_SMTP,
613 PROTO_POP3,
614 PROTO_IMAP,
615 PROTO_FTP,
616 PROTO_XMPP
617 };
618
619 int MAIN(int, char **);
620
MAIN(int argc,char ** argv)621 int MAIN(int argc, char **argv)
622 {
623 unsigned int off = 0, clr = 0;
624 SSL *con = NULL;
625 #ifndef OPENSSL_NO_KRB5
626 KSSL_CTX *kctx;
627 #endif
628 int s, k, width, state = 0;
629 char *cbuf = NULL, *sbuf = NULL, *mbuf = NULL;
630 int cbuf_len, cbuf_off;
631 int sbuf_len, sbuf_off;
632 fd_set readfds, writefds;
633 int fdin, fdout;
634 short port = PORT;
635 int full_log = 1;
636 char *host = SSL_HOST_NAME;
637 char *cert_file = NULL, *key_file = NULL;
638 int cert_format = FORMAT_PEM, key_format = FORMAT_PEM;
639 char *passarg = NULL, *pass = NULL;
640 X509 *cert = NULL;
641 EVP_PKEY *key = NULL;
642 char *CApath = NULL, *CAfile = NULL, *cipher = NULL;
643 int reconnect = 0, badop = 0, verify = SSL_VERIFY_NONE, bugs = 0;
644 int crlf = 0;
645 int write_tty, read_tty, write_ssl, read_ssl, tty_on, ssl_pending;
646 SSL_CTX *ctx = NULL;
647 int ret = 1, in_init = 1, i, nbio_test = 0;
648 int starttls_proto = PROTO_OFF;
649 int prexit = 0;
650 X509_VERIFY_PARAM *vpm = NULL;
651 int badarg = 0;
652 const SSL_METHOD *meth = NULL;
653 int socket_type = SOCK_STREAM;
654 BIO *sbio;
655 char *inrand = NULL;
656 int mbuf_len = 0;
657 struct timeval timeout, *timeoutp;
658 #ifndef OPENSSL_NO_ENGINE
659 char *engine_id = NULL;
660 char *ssl_client_engine_id = NULL;
661 ENGINE *ssl_client_engine = NULL;
662 #endif
663 ENGINE *e = NULL;
664 #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE) || defined(OPENSSL_SYS_BEOS_R5)
665 struct timeval tv;
666 # if defined(OPENSSL_SYS_BEOS_R5)
667 int stdin_set = 0;
668 # endif
669 #endif
670 #ifndef OPENSSL_NO_TLSEXT
671 char *servername = NULL;
672 tlsextctx tlsextcbp = { NULL, 0 };
673 # ifndef OPENSSL_NO_NEXTPROTONEG
674 const char *next_proto_neg_in = NULL;
675 # endif
676 #endif
677 char *sess_in = NULL;
678 char *sess_out = NULL;
679 struct sockaddr peer;
680 int peerlen = sizeof(peer);
681 int fallback_scsv = 0;
682 int enable_timeouts = 0;
683 long socket_mtu = 0;
684 #ifndef OPENSSL_NO_JPAKE
685 char *jpake_secret = NULL;
686 #endif
687 #ifndef OPENSSL_NO_SRP
688 char *srppass = NULL;
689 int srp_lateuser = 0;
690 SRP_ARG srp_arg = { NULL, NULL, 0, 0, 0, 1024 };
691 #endif
692
693 meth = SSLv23_client_method();
694
695 apps_startup();
696 c_Pause = 0;
697 c_quiet = 0;
698 c_ign_eof = 0;
699 c_debug = 0;
700 c_msg = 0;
701 c_showcerts = 0;
702
703 if (bio_err == NULL)
704 bio_err = BIO_new_fp(stderr, BIO_NOCLOSE);
705
706 if (!load_config(bio_err, NULL))
707 goto end;
708
709 if (((cbuf = OPENSSL_malloc(BUFSIZZ)) == NULL) ||
710 ((sbuf = OPENSSL_malloc(BUFSIZZ)) == NULL) ||
711 ((mbuf = OPENSSL_malloc(BUFSIZZ)) == NULL)) {
712 BIO_printf(bio_err, "out of memory\n");
713 goto end;
714 }
715
716 verify_depth = 0;
717 verify_error = X509_V_OK;
718 #ifdef FIONBIO
719 c_nbio = 0;
720 #endif
721
722 argc--;
723 argv++;
724 while (argc >= 1) {
725 if (strcmp(*argv, "-host") == 0) {
726 if (--argc < 1)
727 goto bad;
728 host = *(++argv);
729 } else if (strcmp(*argv, "-port") == 0) {
730 if (--argc < 1)
731 goto bad;
732 port = atoi(*(++argv));
733 if (port == 0)
734 goto bad;
735 } else if (strcmp(*argv, "-connect") == 0) {
736 if (--argc < 1)
737 goto bad;
738 if (!extract_host_port(*(++argv), &host, NULL, &port))
739 goto bad;
740 } else if (strcmp(*argv, "-verify") == 0) {
741 verify = SSL_VERIFY_PEER;
742 if (--argc < 1)
743 goto bad;
744 verify_depth = atoi(*(++argv));
745 BIO_printf(bio_err, "verify depth is %d\n", verify_depth);
746 } else if (strcmp(*argv, "-cert") == 0) {
747 if (--argc < 1)
748 goto bad;
749 cert_file = *(++argv);
750 } else if (strcmp(*argv, "-sess_out") == 0) {
751 if (--argc < 1)
752 goto bad;
753 sess_out = *(++argv);
754 } else if (strcmp(*argv, "-sess_in") == 0) {
755 if (--argc < 1)
756 goto bad;
757 sess_in = *(++argv);
758 } else if (strcmp(*argv, "-certform") == 0) {
759 if (--argc < 1)
760 goto bad;
761 cert_format = str2fmt(*(++argv));
762 } else if (args_verify(&argv, &argc, &badarg, bio_err, &vpm)) {
763 if (badarg)
764 goto bad;
765 continue;
766 } else if (strcmp(*argv, "-verify_return_error") == 0)
767 verify_return_error = 1;
768 else if (strcmp(*argv, "-prexit") == 0)
769 prexit = 1;
770 else if (strcmp(*argv, "-crlf") == 0)
771 crlf = 1;
772 else if (strcmp(*argv, "-quiet") == 0) {
773 c_quiet = 1;
774 c_ign_eof = 1;
775 } else if (strcmp(*argv, "-ign_eof") == 0)
776 c_ign_eof = 1;
777 else if (strcmp(*argv, "-no_ign_eof") == 0)
778 c_ign_eof = 0;
779 else if (strcmp(*argv, "-pause") == 0)
780 c_Pause = 1;
781 else if (strcmp(*argv, "-debug") == 0)
782 c_debug = 1;
783 #ifndef OPENSSL_NO_TLSEXT
784 else if (strcmp(*argv, "-tlsextdebug") == 0)
785 c_tlsextdebug = 1;
786 else if (strcmp(*argv, "-status") == 0)
787 c_status_req = 1;
788 #endif
789 #ifdef WATT32
790 else if (strcmp(*argv, "-wdebug") == 0)
791 dbug_init();
792 #endif
793 else if (strcmp(*argv, "-msg") == 0)
794 c_msg = 1;
795 else if (strcmp(*argv, "-showcerts") == 0)
796 c_showcerts = 1;
797 else if (strcmp(*argv, "-nbio_test") == 0)
798 nbio_test = 1;
799 else if (strcmp(*argv, "-state") == 0)
800 state = 1;
801 #ifndef OPENSSL_NO_PSK
802 else if (strcmp(*argv, "-psk_identity") == 0) {
803 if (--argc < 1)
804 goto bad;
805 psk_identity = *(++argv);
806 } else if (strcmp(*argv, "-psk") == 0) {
807 size_t j;
808
809 if (--argc < 1)
810 goto bad;
811 psk_key = *(++argv);
812 for (j = 0; j < strlen(psk_key); j++) {
813 if (isxdigit((unsigned char)psk_key[j]))
814 continue;
815 BIO_printf(bio_err, "Not a hex number '%s'\n", *argv);
816 goto bad;
817 }
818 }
819 #endif
820 #ifndef OPENSSL_NO_SRP
821 else if (strcmp(*argv, "-srpuser") == 0) {
822 if (--argc < 1)
823 goto bad;
824 srp_arg.srplogin = *(++argv);
825 meth = TLSv1_client_method();
826 } else if (strcmp(*argv, "-srppass") == 0) {
827 if (--argc < 1)
828 goto bad;
829 srppass = *(++argv);
830 meth = TLSv1_client_method();
831 } else if (strcmp(*argv, "-srp_strength") == 0) {
832 if (--argc < 1)
833 goto bad;
834 srp_arg.strength = atoi(*(++argv));
835 BIO_printf(bio_err, "SRP minimal length for N is %d\n",
836 srp_arg.strength);
837 meth = TLSv1_client_method();
838 } else if (strcmp(*argv, "-srp_lateuser") == 0) {
839 srp_lateuser = 1;
840 meth = TLSv1_client_method();
841 } else if (strcmp(*argv, "-srp_moregroups") == 0) {
842 srp_arg.amp = 1;
843 meth = TLSv1_client_method();
844 }
845 #endif
846 #ifndef OPENSSL_NO_SSL2
847 else if (strcmp(*argv, "-ssl2") == 0)
848 meth = SSLv2_client_method();
849 #endif
850 #ifndef OPENSSL_NO_SSL3_METHOD
851 else if (strcmp(*argv, "-ssl3") == 0)
852 meth = SSLv3_client_method();
853 #endif
854 #ifndef OPENSSL_NO_TLS1
855 else if (strcmp(*argv, "-tls1_2") == 0)
856 meth = TLSv1_2_client_method();
857 else if (strcmp(*argv, "-tls1_1") == 0)
858 meth = TLSv1_1_client_method();
859 else if (strcmp(*argv, "-tls1") == 0)
860 meth = TLSv1_client_method();
861 #endif
862 #ifndef OPENSSL_NO_DTLS1
863 else if (strcmp(*argv, "-dtls1") == 0) {
864 meth = DTLSv1_client_method();
865 socket_type = SOCK_DGRAM;
866 } else if (strcmp(*argv, "-fallback_scsv") == 0) {
867 fallback_scsv = 1;
868 } else if (strcmp(*argv, "-timeout") == 0)
869 enable_timeouts = 1;
870 else if (strcmp(*argv, "-mtu") == 0) {
871 if (--argc < 1)
872 goto bad;
873 socket_mtu = atol(*(++argv));
874 }
875 #endif
876 else if (strcmp(*argv, "-bugs") == 0)
877 bugs = 1;
878 else if (strcmp(*argv, "-keyform") == 0) {
879 if (--argc < 1)
880 goto bad;
881 key_format = str2fmt(*(++argv));
882 } else if (strcmp(*argv, "-pass") == 0) {
883 if (--argc < 1)
884 goto bad;
885 passarg = *(++argv);
886 } else if (strcmp(*argv, "-key") == 0) {
887 if (--argc < 1)
888 goto bad;
889 key_file = *(++argv);
890 } else if (strcmp(*argv, "-reconnect") == 0) {
891 reconnect = 5;
892 } else if (strcmp(*argv, "-CApath") == 0) {
893 if (--argc < 1)
894 goto bad;
895 CApath = *(++argv);
896 } else if (strcmp(*argv, "-CAfile") == 0) {
897 if (--argc < 1)
898 goto bad;
899 CAfile = *(++argv);
900 } else if (strcmp(*argv, "-no_tls1_2") == 0)
901 off |= SSL_OP_NO_TLSv1_2;
902 else if (strcmp(*argv, "-no_tls1_1") == 0)
903 off |= SSL_OP_NO_TLSv1_1;
904 else if (strcmp(*argv, "-no_tls1") == 0)
905 off |= SSL_OP_NO_TLSv1;
906 else if (strcmp(*argv, "-no_ssl3") == 0)
907 off |= SSL_OP_NO_SSLv3;
908 else if (strcmp(*argv, "-no_ssl2") == 0)
909 off |= SSL_OP_NO_SSLv2;
910 else if (strcmp(*argv, "-no_comp") == 0) {
911 off |= SSL_OP_NO_COMPRESSION;
912 }
913 #ifndef OPENSSL_NO_TLSEXT
914 else if (strcmp(*argv, "-no_ticket") == 0) {
915 off |= SSL_OP_NO_TICKET;
916 }
917 # ifndef OPENSSL_NO_NEXTPROTONEG
918 else if (strcmp(*argv, "-nextprotoneg") == 0) {
919 if (--argc < 1)
920 goto bad;
921 next_proto_neg_in = *(++argv);
922 }
923 # endif
924 #endif
925 else if (strcmp(*argv, "-serverpref") == 0)
926 off |= SSL_OP_CIPHER_SERVER_PREFERENCE;
927 else if (strcmp(*argv, "-legacy_renegotiation") == 0)
928 off |= SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;
929 else if (strcmp(*argv, "-legacy_server_connect") == 0) {
930 off |= SSL_OP_LEGACY_SERVER_CONNECT;
931 } else if (strcmp(*argv, "-no_legacy_server_connect") == 0) {
932 clr |= SSL_OP_LEGACY_SERVER_CONNECT;
933 } else if (strcmp(*argv, "-cipher") == 0) {
934 if (--argc < 1)
935 goto bad;
936 cipher = *(++argv);
937 }
938 #ifdef FIONBIO
939 else if (strcmp(*argv, "-nbio") == 0) {
940 c_nbio = 1;
941 }
942 #endif
943 else if (strcmp(*argv, "-starttls") == 0) {
944 if (--argc < 1)
945 goto bad;
946 ++argv;
947 if (strcmp(*argv, "smtp") == 0)
948 starttls_proto = PROTO_SMTP;
949 else if (strcmp(*argv, "pop3") == 0)
950 starttls_proto = PROTO_POP3;
951 else if (strcmp(*argv, "imap") == 0)
952 starttls_proto = PROTO_IMAP;
953 else if (strcmp(*argv, "ftp") == 0)
954 starttls_proto = PROTO_FTP;
955 else if (strcmp(*argv, "xmpp") == 0)
956 starttls_proto = PROTO_XMPP;
957 else
958 goto bad;
959 }
960 #ifndef OPENSSL_NO_ENGINE
961 else if (strcmp(*argv, "-engine") == 0) {
962 if (--argc < 1)
963 goto bad;
964 engine_id = *(++argv);
965 } else if (strcmp(*argv, "-ssl_client_engine") == 0) {
966 if (--argc < 1)
967 goto bad;
968 ssl_client_engine_id = *(++argv);
969 }
970 #endif
971 else if (strcmp(*argv, "-rand") == 0) {
972 if (--argc < 1)
973 goto bad;
974 inrand = *(++argv);
975 }
976 #ifndef OPENSSL_NO_TLSEXT
977 else if (strcmp(*argv, "-servername") == 0) {
978 if (--argc < 1)
979 goto bad;
980 servername = *(++argv);
981 /* meth=TLSv1_client_method(); */
982 }
983 #endif
984 #ifndef OPENSSL_NO_JPAKE
985 else if (strcmp(*argv, "-jpake") == 0) {
986 if (--argc < 1)
987 goto bad;
988 jpake_secret = *++argv;
989 }
990 #endif
991 #ifndef OPENSSL_NO_SRTP
992 else if (strcmp(*argv, "-use_srtp") == 0) {
993 if (--argc < 1)
994 goto bad;
995 srtp_profiles = *(++argv);
996 }
997 #endif
998 else if (strcmp(*argv, "-keymatexport") == 0) {
999 if (--argc < 1)
1000 goto bad;
1001 keymatexportlabel = *(++argv);
1002 } else if (strcmp(*argv, "-keymatexportlen") == 0) {
1003 if (--argc < 1)
1004 goto bad;
1005 keymatexportlen = atoi(*(++argv));
1006 if (keymatexportlen == 0)
1007 goto bad;
1008 } else {
1009 BIO_printf(bio_err, "unknown option %s\n", *argv);
1010 badop = 1;
1011 break;
1012 }
1013 argc--;
1014 argv++;
1015 }
1016 if (badop) {
1017 bad:
1018 sc_usage();
1019 goto end;
1020 }
1021 #if !defined(OPENSSL_NO_JPAKE) && !defined(OPENSSL_NO_PSK)
1022 if (jpake_secret) {
1023 if (psk_key) {
1024 BIO_printf(bio_err, "Can't use JPAKE and PSK together\n");
1025 goto end;
1026 }
1027 psk_identity = "JPAKE";
1028 if (cipher) {
1029 BIO_printf(bio_err, "JPAKE sets cipher to PSK\n");
1030 goto end;
1031 }
1032 cipher = "PSK";
1033 }
1034 #endif
1035
1036 OpenSSL_add_ssl_algorithms();
1037 SSL_load_error_strings();
1038
1039 #if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
1040 next_proto.status = -1;
1041 if (next_proto_neg_in) {
1042 next_proto.data =
1043 next_protos_parse(&next_proto.len, next_proto_neg_in);
1044 if (next_proto.data == NULL) {
1045 BIO_printf(bio_err, "Error parsing -nextprotoneg argument\n");
1046 goto end;
1047 }
1048 } else
1049 next_proto.data = NULL;
1050 #endif
1051
1052 #ifndef OPENSSL_NO_ENGINE
1053 e = setup_engine(bio_err, engine_id, 1);
1054 if (ssl_client_engine_id) {
1055 ssl_client_engine = ENGINE_by_id(ssl_client_engine_id);
1056 if (!ssl_client_engine) {
1057 BIO_printf(bio_err, "Error getting client auth engine\n");
1058 goto end;
1059 }
1060 }
1061 #endif
1062 if (!app_passwd(bio_err, passarg, NULL, &pass, NULL)) {
1063 BIO_printf(bio_err, "Error getting password\n");
1064 goto end;
1065 }
1066
1067 if (key_file == NULL)
1068 key_file = cert_file;
1069
1070 if (key_file) {
1071
1072 key = load_key(bio_err, key_file, key_format, 0, pass, e,
1073 "client certificate private key file");
1074 if (!key) {
1075 ERR_print_errors(bio_err);
1076 goto end;
1077 }
1078
1079 }
1080
1081 if (cert_file) {
1082 cert = load_cert(bio_err, cert_file, cert_format,
1083 NULL, e, "client certificate file");
1084
1085 if (!cert) {
1086 ERR_print_errors(bio_err);
1087 goto end;
1088 }
1089 }
1090
1091 if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL
1092 && !RAND_status()) {
1093 BIO_printf(bio_err,
1094 "warning, not much extra random data, consider using the -rand option\n");
1095 }
1096 if (inrand != NULL)
1097 BIO_printf(bio_err, "%ld semi-random bytes loaded\n",
1098 app_RAND_load_files(inrand));
1099
1100 if (bio_c_out == NULL) {
1101 if (c_quiet && !c_debug && !c_msg) {
1102 bio_c_out = BIO_new(BIO_s_null());
1103 } else {
1104 if (bio_c_out == NULL)
1105 bio_c_out = BIO_new_fp(stdout, BIO_NOCLOSE);
1106 }
1107 }
1108 #ifndef OPENSSL_NO_SRP
1109 if (!app_passwd(bio_err, srppass, NULL, &srp_arg.srppassin, NULL)) {
1110 BIO_printf(bio_err, "Error getting password\n");
1111 goto end;
1112 }
1113 #endif
1114
1115 ctx = SSL_CTX_new(meth);
1116 if (ctx == NULL) {
1117 ERR_print_errors(bio_err);
1118 goto end;
1119 }
1120
1121 if (vpm)
1122 SSL_CTX_set1_param(ctx, vpm);
1123
1124 #ifndef OPENSSL_NO_ENGINE
1125 if (ssl_client_engine) {
1126 if (!SSL_CTX_set_client_cert_engine(ctx, ssl_client_engine)) {
1127 BIO_puts(bio_err, "Error setting client auth engine\n");
1128 ERR_print_errors(bio_err);
1129 ENGINE_free(ssl_client_engine);
1130 goto end;
1131 }
1132 ENGINE_free(ssl_client_engine);
1133 }
1134 #endif
1135
1136 #ifndef OPENSSL_NO_PSK
1137 # ifdef OPENSSL_NO_JPAKE
1138 if (psk_key != NULL)
1139 # else
1140 if (psk_key != NULL || jpake_secret)
1141 # endif
1142 {
1143 if (c_debug)
1144 BIO_printf(bio_c_out,
1145 "PSK key given or JPAKE in use, setting client callback\n");
1146 SSL_CTX_set_psk_client_callback(ctx, psk_client_cb);
1147 }
1148 #endif
1149 #ifndef OPENSSL_NO_SRTP
1150 if (srtp_profiles != NULL)
1151 SSL_CTX_set_tlsext_use_srtp(ctx, srtp_profiles);
1152 #endif
1153 if (bugs)
1154 SSL_CTX_set_options(ctx, SSL_OP_ALL | off);
1155 else
1156 SSL_CTX_set_options(ctx, off);
1157
1158 if (clr)
1159 SSL_CTX_clear_options(ctx, clr);
1160
1161 #if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
1162 if (next_proto.data)
1163 SSL_CTX_set_next_proto_select_cb(ctx, next_proto_cb, &next_proto);
1164 #endif
1165
1166 if (state)
1167 SSL_CTX_set_info_callback(ctx, apps_ssl_info_callback);
1168 if (cipher != NULL)
1169 if (!SSL_CTX_set_cipher_list(ctx, cipher)) {
1170 BIO_printf(bio_err, "error setting cipher list\n");
1171 ERR_print_errors(bio_err);
1172 goto end;
1173 }
1174 #if 0
1175 else
1176 SSL_CTX_set_cipher_list(ctx, getenv("SSL_CIPHER"));
1177 #endif
1178
1179 SSL_CTX_set_verify(ctx, verify, verify_callback);
1180 if (!set_cert_key_stuff(ctx, cert, key))
1181 goto end;
1182
1183 if ((CAfile || CApath)
1184 && !SSL_CTX_load_verify_locations(ctx, CAfile, CApath)) {
1185 ERR_print_errors(bio_err);
1186 }
1187 if (!SSL_CTX_set_default_verify_paths(ctx)) {
1188 ERR_print_errors(bio_err);
1189 }
1190 #ifndef OPENSSL_NO_TLSEXT
1191 if (servername != NULL) {
1192 tlsextcbp.biodebug = bio_err;
1193 SSL_CTX_set_tlsext_servername_callback(ctx, ssl_servername_cb);
1194 SSL_CTX_set_tlsext_servername_arg(ctx, &tlsextcbp);
1195 }
1196 # ifndef OPENSSL_NO_SRP
1197 if (srp_arg.srplogin) {
1198 if (!srp_lateuser && !SSL_CTX_set_srp_username(ctx, srp_arg.srplogin)) {
1199 BIO_printf(bio_err, "Unable to set SRP username\n");
1200 goto end;
1201 }
1202 srp_arg.msg = c_msg;
1203 srp_arg.debug = c_debug;
1204 SSL_CTX_set_srp_cb_arg(ctx, &srp_arg);
1205 SSL_CTX_set_srp_client_pwd_callback(ctx, ssl_give_srp_client_pwd_cb);
1206 SSL_CTX_set_srp_strength(ctx, srp_arg.strength);
1207 if (c_msg || c_debug || srp_arg.amp == 0)
1208 SSL_CTX_set_srp_verify_param_callback(ctx,
1209 ssl_srp_verify_param_cb);
1210 }
1211 # endif
1212 #endif
1213
1214 con = SSL_new(ctx);
1215 if (sess_in) {
1216 SSL_SESSION *sess;
1217 BIO *stmp = BIO_new_file(sess_in, "r");
1218 if (!stmp) {
1219 BIO_printf(bio_err, "Can't open session file %s\n", sess_in);
1220 ERR_print_errors(bio_err);
1221 goto end;
1222 }
1223 sess = PEM_read_bio_SSL_SESSION(stmp, NULL, 0, NULL);
1224 BIO_free(stmp);
1225 if (!sess) {
1226 BIO_printf(bio_err, "Can't open session file %s\n", sess_in);
1227 ERR_print_errors(bio_err);
1228 goto end;
1229 }
1230 SSL_set_session(con, sess);
1231 SSL_SESSION_free(sess);
1232 }
1233
1234 if (fallback_scsv)
1235 SSL_set_mode(con, SSL_MODE_SEND_FALLBACK_SCSV);
1236
1237 #ifndef OPENSSL_NO_TLSEXT
1238 if (servername != NULL) {
1239 if (!SSL_set_tlsext_host_name(con, servername)) {
1240 BIO_printf(bio_err, "Unable to set TLS servername extension.\n");
1241 ERR_print_errors(bio_err);
1242 goto end;
1243 }
1244 }
1245 #endif
1246 #ifndef OPENSSL_NO_KRB5
1247 if (con && (kctx = kssl_ctx_new()) != NULL) {
1248 SSL_set0_kssl_ctx(con, kctx);
1249 kssl_ctx_setstring(kctx, KSSL_SERVER, host);
1250 }
1251 #endif /* OPENSSL_NO_KRB5 */
1252 /* SSL_set_cipher_list(con,"RC4-MD5"); */
1253 #if 0
1254 # ifdef TLSEXT_TYPE_opaque_prf_input
1255 SSL_set_tlsext_opaque_prf_input(con, "Test client", 11);
1256 # endif
1257 #endif
1258
1259 re_start:
1260
1261 if (init_client(&s, host, port, socket_type) == 0) {
1262 BIO_printf(bio_err, "connect:errno=%d\n", get_last_socket_error());
1263 SHUTDOWN(s);
1264 goto end;
1265 }
1266 BIO_printf(bio_c_out, "CONNECTED(%08X)\n", s);
1267
1268 #ifdef FIONBIO
1269 if (c_nbio) {
1270 unsigned long l = 1;
1271 BIO_printf(bio_c_out, "turning on non blocking io\n");
1272 if (BIO_socket_ioctl(s, FIONBIO, &l) < 0) {
1273 ERR_print_errors(bio_err);
1274 goto end;
1275 }
1276 }
1277 #endif
1278 if (c_Pause & 0x01)
1279 SSL_set_debug(con, 1);
1280
1281 if (SSL_version(con) == DTLS1_VERSION) {
1282
1283 sbio = BIO_new_dgram(s, BIO_NOCLOSE);
1284 if (getsockname(s, &peer, (void *)&peerlen) < 0) {
1285 BIO_printf(bio_err, "getsockname:errno=%d\n",
1286 get_last_socket_error());
1287 SHUTDOWN(s);
1288 goto end;
1289 }
1290
1291 (void)BIO_ctrl_set_connected(sbio, 1, &peer);
1292
1293 if (enable_timeouts) {
1294 timeout.tv_sec = 0;
1295 timeout.tv_usec = DGRAM_RCV_TIMEOUT;
1296 BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_RECV_TIMEOUT, 0, &timeout);
1297
1298 timeout.tv_sec = 0;
1299 timeout.tv_usec = DGRAM_SND_TIMEOUT;
1300 BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_SEND_TIMEOUT, 0, &timeout);
1301 }
1302
1303 if (socket_mtu) {
1304 if (socket_mtu < DTLS_get_link_min_mtu(con)) {
1305 BIO_printf(bio_err, "MTU too small. Must be at least %ld\n",
1306 DTLS_get_link_min_mtu(con));
1307 BIO_free(sbio);
1308 goto shut;
1309 }
1310 SSL_set_options(con, SSL_OP_NO_QUERY_MTU);
1311 if (!DTLS_set_link_mtu(con, socket_mtu)) {
1312 BIO_printf(bio_err, "Failed to set MTU\n");
1313 BIO_free(sbio);
1314 goto shut;
1315 }
1316 } else
1317 /* want to do MTU discovery */
1318 BIO_ctrl(sbio, BIO_CTRL_DGRAM_MTU_DISCOVER, 0, NULL);
1319 } else
1320 sbio = BIO_new_socket(s, BIO_NOCLOSE);
1321
1322 if (nbio_test) {
1323 BIO *test;
1324
1325 test = BIO_new(BIO_f_nbio_test());
1326 sbio = BIO_push(test, sbio);
1327 }
1328
1329 if (c_debug) {
1330 SSL_set_debug(con, 1);
1331 BIO_set_callback(sbio, bio_dump_callback);
1332 BIO_set_callback_arg(sbio, (char *)bio_c_out);
1333 }
1334 if (c_msg) {
1335 SSL_set_msg_callback(con, msg_cb);
1336 SSL_set_msg_callback_arg(con, bio_c_out);
1337 }
1338 #ifndef OPENSSL_NO_TLSEXT
1339 if (c_tlsextdebug) {
1340 SSL_set_tlsext_debug_callback(con, tlsext_cb);
1341 SSL_set_tlsext_debug_arg(con, bio_c_out);
1342 }
1343 if (c_status_req) {
1344 SSL_set_tlsext_status_type(con, TLSEXT_STATUSTYPE_ocsp);
1345 SSL_CTX_set_tlsext_status_cb(ctx, ocsp_resp_cb);
1346 SSL_CTX_set_tlsext_status_arg(ctx, bio_c_out);
1347 # if 0
1348 {
1349 STACK_OF(OCSP_RESPID) *ids = sk_OCSP_RESPID_new_null();
1350 OCSP_RESPID *id = OCSP_RESPID_new();
1351 id->value.byKey = ASN1_OCTET_STRING_new();
1352 id->type = V_OCSP_RESPID_KEY;
1353 ASN1_STRING_set(id->value.byKey, "Hello World", -1);
1354 sk_OCSP_RESPID_push(ids, id);
1355 SSL_set_tlsext_status_ids(con, ids);
1356 }
1357 # endif
1358 }
1359 #endif
1360 #ifndef OPENSSL_NO_JPAKE
1361 if (jpake_secret)
1362 jpake_client_auth(bio_c_out, sbio, jpake_secret);
1363 #endif
1364
1365 SSL_set_bio(con, sbio, sbio);
1366 SSL_set_connect_state(con);
1367
1368 /* ok, lets connect */
1369 width = SSL_get_fd(con) + 1;
1370
1371 read_tty = 1;
1372 write_tty = 0;
1373 tty_on = 0;
1374 read_ssl = 1;
1375 write_ssl = 1;
1376
1377 cbuf_len = 0;
1378 cbuf_off = 0;
1379 sbuf_len = 0;
1380 sbuf_off = 0;
1381
1382 /* This is an ugly hack that does a lot of assumptions */
1383 /*
1384 * We do have to handle multi-line responses which may come in a single
1385 * packet or not. We therefore have to use BIO_gets() which does need a
1386 * buffering BIO. So during the initial chitchat we do push a buffering
1387 * BIO into the chain that is removed again later on to not disturb the
1388 * rest of the s_client operation.
1389 */
1390 if (starttls_proto == PROTO_SMTP) {
1391 int foundit = 0;
1392 BIO *fbio = BIO_new(BIO_f_buffer());
1393 BIO_push(fbio, sbio);
1394 /* wait for multi-line response to end from SMTP */
1395 do {
1396 mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
1397 }
1398 while (mbuf_len > 3 && mbuf[3] == '-');
1399 /* STARTTLS command requires EHLO... */
1400 BIO_printf(fbio, "EHLO openssl.client.net\r\n");
1401 (void)BIO_flush(fbio);
1402 /* wait for multi-line response to end EHLO SMTP response */
1403 do {
1404 mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
1405 if (strstr(mbuf, "STARTTLS"))
1406 foundit = 1;
1407 }
1408 while (mbuf_len > 3 && mbuf[3] == '-');
1409 (void)BIO_flush(fbio);
1410 BIO_pop(fbio);
1411 BIO_free(fbio);
1412 if (!foundit)
1413 BIO_printf(bio_err,
1414 "didn't found starttls in server response,"
1415 " try anyway...\n");
1416 BIO_printf(sbio, "STARTTLS\r\n");
1417 BIO_read(sbio, sbuf, BUFSIZZ);
1418 } else if (starttls_proto == PROTO_POP3) {
1419 BIO_read(sbio, mbuf, BUFSIZZ);
1420 BIO_printf(sbio, "STLS\r\n");
1421 BIO_read(sbio, sbuf, BUFSIZZ);
1422 } else if (starttls_proto == PROTO_IMAP) {
1423 int foundit = 0;
1424 BIO *fbio = BIO_new(BIO_f_buffer());
1425 BIO_push(fbio, sbio);
1426 BIO_gets(fbio, mbuf, BUFSIZZ);
1427 /* STARTTLS command requires CAPABILITY... */
1428 BIO_printf(fbio, ". CAPABILITY\r\n");
1429 (void)BIO_flush(fbio);
1430 /* wait for multi-line CAPABILITY response */
1431 do {
1432 mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
1433 if (strstr(mbuf, "STARTTLS"))
1434 foundit = 1;
1435 }
1436 while (mbuf_len > 3 && mbuf[0] != '.');
1437 (void)BIO_flush(fbio);
1438 BIO_pop(fbio);
1439 BIO_free(fbio);
1440 if (!foundit)
1441 BIO_printf(bio_err,
1442 "didn't found STARTTLS in server response,"
1443 " try anyway...\n");
1444 BIO_printf(sbio, ". STARTTLS\r\n");
1445 BIO_read(sbio, sbuf, BUFSIZZ);
1446 } else if (starttls_proto == PROTO_FTP) {
1447 BIO *fbio = BIO_new(BIO_f_buffer());
1448 BIO_push(fbio, sbio);
1449 /* wait for multi-line response to end from FTP */
1450 do {
1451 mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);
1452 }
1453 while (mbuf_len > 3 && mbuf[3] == '-');
1454 (void)BIO_flush(fbio);
1455 BIO_pop(fbio);
1456 BIO_free(fbio);
1457 BIO_printf(sbio, "AUTH TLS\r\n");
1458 BIO_read(sbio, sbuf, BUFSIZZ);
1459 }
1460 if (starttls_proto == PROTO_XMPP) {
1461 int seen = 0;
1462 BIO_printf(sbio, "<stream:stream "
1463 "xmlns:stream='http://etherx.jabber.org/streams' "
1464 "xmlns='jabber:client' to='%s' version='1.0'>", host);
1465 seen = BIO_read(sbio, mbuf, BUFSIZZ);
1466 mbuf[seen] = 0;
1467 while (!strstr
1468 (mbuf, "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'")) {
1469 if (strstr(mbuf, "/stream:features>"))
1470 goto shut;
1471 seen = BIO_read(sbio, mbuf, BUFSIZZ);
1472 mbuf[seen] = 0;
1473 }
1474 BIO_printf(sbio,
1475 "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>");
1476 seen = BIO_read(sbio, sbuf, BUFSIZZ);
1477 sbuf[seen] = 0;
1478 if (!strstr(sbuf, "<proceed"))
1479 goto shut;
1480 mbuf[0] = 0;
1481 }
1482
1483 for (;;) {
1484 FD_ZERO(&readfds);
1485 FD_ZERO(&writefds);
1486 fdin = fileno(stdin);
1487 if (fdin < 0) {
1488 BIO_printf(bio_err,"bad fileno for stdin\n");
1489 goto shut;
1490 }
1491 fdout = fileno(stdout);
1492 if (fdout < 0) {
1493 BIO_printf(bio_err,"bad fileno for stdout\n");
1494 goto shut;
1495 }
1496
1497 if ((SSL_version(con) == DTLS1_VERSION) &&
1498 DTLSv1_get_timeout(con, &timeout))
1499 timeoutp = &timeout;
1500 else
1501 timeoutp = NULL;
1502
1503 if (SSL_in_init(con) && !SSL_total_renegotiations(con)) {
1504 in_init = 1;
1505 tty_on = 0;
1506 } else {
1507 tty_on = 1;
1508 if (in_init) {
1509 in_init = 0;
1510 #if 0 /* This test doesn't really work as intended
1511 * (needs to be fixed) */
1512 # ifndef OPENSSL_NO_TLSEXT
1513 if (servername != NULL && !SSL_session_reused(con)) {
1514 BIO_printf(bio_c_out,
1515 "Server did %sacknowledge servername extension.\n",
1516 tlsextcbp.ack ? "" : "not ");
1517 }
1518 # endif
1519 #endif
1520 if (sess_out) {
1521 BIO *stmp = BIO_new_file(sess_out, "w");
1522 if (stmp) {
1523 PEM_write_bio_SSL_SESSION(stmp, SSL_get_session(con));
1524 BIO_free(stmp);
1525 } else
1526 BIO_printf(bio_err, "Error writing session file %s\n",
1527 sess_out);
1528 }
1529 print_stuff(bio_c_out, con, full_log);
1530 if (full_log > 0)
1531 full_log--;
1532
1533 if (starttls_proto) {
1534 BIO_printf(bio_err, "%s", mbuf);
1535 /* We don't need to know any more */
1536 starttls_proto = PROTO_OFF;
1537 }
1538
1539 if (reconnect) {
1540 reconnect--;
1541 BIO_printf(bio_c_out,
1542 "drop connection and then reconnect\n");
1543 SSL_shutdown(con);
1544 SSL_set_connect_state(con);
1545 SHUTDOWN(SSL_get_fd(con));
1546 goto re_start;
1547 }
1548 }
1549 }
1550
1551 ssl_pending = read_ssl && SSL_pending(con);
1552
1553 if (!ssl_pending) {
1554 #if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_NETWARE) && !defined (OPENSSL_SYS_BEOS_R5)
1555 if (tty_on) {
1556 if (read_tty)
1557 openssl_fdset(fdin, &readfds);
1558 if (write_tty)
1559 openssl_fdset(fdout, &writefds);
1560 }
1561 if (read_ssl)
1562 openssl_fdset(SSL_get_fd(con), &readfds);
1563 if (write_ssl)
1564 openssl_fdset(SSL_get_fd(con), &writefds);
1565 #else
1566 if (!tty_on || !write_tty) {
1567 if (read_ssl)
1568 openssl_fdset(SSL_get_fd(con), &readfds);
1569 if (write_ssl)
1570 openssl_fdset(SSL_get_fd(con), &writefds);
1571 }
1572 #endif
1573 /*- printf("mode tty(%d %d%d) ssl(%d%d)\n",
1574 tty_on,read_tty,write_tty,read_ssl,write_ssl);*/
1575
1576 /*
1577 * Note: under VMS with SOCKETSHR the second parameter is
1578 * currently of type (int *) whereas under other systems it is
1579 * (void *) if you don't have a cast it will choke the compiler:
1580 * if you do have a cast then you can either go for (int *) or
1581 * (void *).
1582 */
1583 #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)
1584 /*
1585 * Under Windows/DOS we make the assumption that we can always
1586 * write to the tty: therefore if we need to write to the tty we
1587 * just fall through. Otherwise we timeout the select every
1588 * second and see if there are any keypresses. Note: this is a
1589 * hack, in a proper Windows application we wouldn't do this.
1590 */
1591 i = 0;
1592 if (!write_tty) {
1593 if (read_tty) {
1594 tv.tv_sec = 1;
1595 tv.tv_usec = 0;
1596 i = select(width, (void *)&readfds, (void *)&writefds,
1597 NULL, &tv);
1598 # if defined(OPENSSL_SYS_WINCE) || defined(OPENSSL_SYS_MSDOS)
1599 if (!i && (!_kbhit() || !read_tty))
1600 continue;
1601 # else
1602 if (!i && (!((_kbhit())
1603 || (WAIT_OBJECT_0 ==
1604 WaitForSingleObject(GetStdHandle
1605 (STD_INPUT_HANDLE),
1606 0)))
1607 || !read_tty))
1608 continue;
1609 # endif
1610 } else
1611 i = select(width, (void *)&readfds, (void *)&writefds,
1612 NULL, timeoutp);
1613 }
1614 #elif defined(OPENSSL_SYS_NETWARE)
1615 if (!write_tty) {
1616 if (read_tty) {
1617 tv.tv_sec = 1;
1618 tv.tv_usec = 0;
1619 i = select(width, (void *)&readfds, (void *)&writefds,
1620 NULL, &tv);
1621 } else
1622 i = select(width, (void *)&readfds, (void *)&writefds,
1623 NULL, timeoutp);
1624 }
1625 #elif defined(OPENSSL_SYS_BEOS_R5)
1626 /* Under BeOS-R5 the situation is similar to DOS */
1627 i = 0;
1628 stdin_set = 0;
1629 (void)fcntl(fdin, F_SETFL, O_NONBLOCK);
1630 if (!write_tty) {
1631 if (read_tty) {
1632 tv.tv_sec = 1;
1633 tv.tv_usec = 0;
1634 i = select(width, (void *)&readfds, (void *)&writefds,
1635 NULL, &tv);
1636 if (read(fdin, sbuf, 0) >= 0)
1637 stdin_set = 1;
1638 if (!i && (stdin_set != 1 || !read_tty))
1639 continue;
1640 } else
1641 i = select(width, (void *)&readfds, (void *)&writefds,
1642 NULL, timeoutp);
1643 }
1644 (void)fcntl(fdin, F_SETFL, 0);
1645 #else
1646 i = select(width, (void *)&readfds, (void *)&writefds,
1647 NULL, timeoutp);
1648 #endif
1649 if (i < 0) {
1650 BIO_printf(bio_err, "bad select %d\n",
1651 get_last_socket_error());
1652 goto shut;
1653 /* goto end; */
1654 }
1655 }
1656
1657 if ((SSL_version(con) == DTLS1_VERSION)
1658 && DTLSv1_handle_timeout(con) > 0) {
1659 BIO_printf(bio_err, "TIMEOUT occured\n");
1660 }
1661
1662 if (!ssl_pending && FD_ISSET(SSL_get_fd(con), &writefds)) {
1663 k = SSL_write(con, &(cbuf[cbuf_off]), (unsigned int)cbuf_len);
1664 switch (SSL_get_error(con, k)) {
1665 case SSL_ERROR_NONE:
1666 cbuf_off += k;
1667 cbuf_len -= k;
1668 if (k <= 0)
1669 goto end;
1670 /* we have done a write(con,NULL,0); */
1671 if (cbuf_len <= 0) {
1672 read_tty = 1;
1673 write_ssl = 0;
1674 } else { /* if (cbuf_len > 0) */
1675
1676 read_tty = 0;
1677 write_ssl = 1;
1678 }
1679 break;
1680 case SSL_ERROR_WANT_WRITE:
1681 BIO_printf(bio_c_out, "write W BLOCK\n");
1682 write_ssl = 1;
1683 read_tty = 0;
1684 break;
1685 case SSL_ERROR_WANT_READ:
1686 BIO_printf(bio_c_out, "write R BLOCK\n");
1687 write_tty = 0;
1688 read_ssl = 1;
1689 write_ssl = 0;
1690 break;
1691 case SSL_ERROR_WANT_X509_LOOKUP:
1692 BIO_printf(bio_c_out, "write X BLOCK\n");
1693 break;
1694 case SSL_ERROR_ZERO_RETURN:
1695 if (cbuf_len != 0) {
1696 BIO_printf(bio_c_out, "shutdown\n");
1697 ret = 0;
1698 goto shut;
1699 } else {
1700 read_tty = 1;
1701 write_ssl = 0;
1702 break;
1703 }
1704
1705 case SSL_ERROR_SYSCALL:
1706 if ((k != 0) || (cbuf_len != 0)) {
1707 BIO_printf(bio_err, "write:errno=%d\n",
1708 get_last_socket_error());
1709 goto shut;
1710 } else {
1711 read_tty = 1;
1712 write_ssl = 0;
1713 }
1714 break;
1715 case SSL_ERROR_SSL:
1716 ERR_print_errors(bio_err);
1717 goto shut;
1718 }
1719 }
1720 #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE) || defined(OPENSSL_SYS_BEOS_R5)
1721 /* Assume Windows/DOS/BeOS can always write */
1722 else if (!ssl_pending && write_tty)
1723 #else
1724 else if (!ssl_pending && FD_ISSET(fdout, &writefds))
1725 #endif
1726 {
1727 #ifdef CHARSET_EBCDIC
1728 ascii2ebcdic(&(sbuf[sbuf_off]), &(sbuf[sbuf_off]), sbuf_len);
1729 #endif
1730 i = raw_write_stdout(&(sbuf[sbuf_off]), sbuf_len);
1731
1732 if (i <= 0) {
1733 BIO_printf(bio_c_out, "DONE\n");
1734 ret = 0;
1735 goto shut;
1736 /* goto end; */
1737 }
1738
1739 sbuf_len -= i;;
1740 sbuf_off += i;
1741 if (sbuf_len <= 0) {
1742 read_ssl = 1;
1743 write_tty = 0;
1744 }
1745 } else if (ssl_pending || FD_ISSET(SSL_get_fd(con), &readfds)) {
1746 #ifdef RENEG
1747 {
1748 static int iiii;
1749 if (++iiii == 52) {
1750 SSL_renegotiate(con);
1751 iiii = 0;
1752 }
1753 }
1754 #endif
1755 #if 1
1756 k = SSL_read(con, sbuf, 1024 /* BUFSIZZ */ );
1757 #else
1758 /* Demo for pending and peek :-) */
1759 k = SSL_read(con, sbuf, 16);
1760 {
1761 char zbuf[10240];
1762 printf("read=%d pending=%d peek=%d\n", k, SSL_pending(con),
1763 SSL_peek(con, zbuf, 10240));
1764 }
1765 #endif
1766
1767 switch (SSL_get_error(con, k)) {
1768 case SSL_ERROR_NONE:
1769 if (k <= 0)
1770 goto end;
1771 sbuf_off = 0;
1772 sbuf_len = k;
1773
1774 read_ssl = 0;
1775 write_tty = 1;
1776 break;
1777 case SSL_ERROR_WANT_WRITE:
1778 BIO_printf(bio_c_out, "read W BLOCK\n");
1779 write_ssl = 1;
1780 read_tty = 0;
1781 break;
1782 case SSL_ERROR_WANT_READ:
1783 BIO_printf(bio_c_out, "read R BLOCK\n");
1784 write_tty = 0;
1785 read_ssl = 1;
1786 if ((read_tty == 0) && (write_ssl == 0))
1787 write_ssl = 1;
1788 break;
1789 case SSL_ERROR_WANT_X509_LOOKUP:
1790 BIO_printf(bio_c_out, "read X BLOCK\n");
1791 break;
1792 case SSL_ERROR_SYSCALL:
1793 ret = get_last_socket_error();
1794 BIO_printf(bio_err, "read:errno=%d\n", ret);
1795 goto shut;
1796 case SSL_ERROR_ZERO_RETURN:
1797 BIO_printf(bio_c_out, "closed\n");
1798 ret = 0;
1799 goto shut;
1800 case SSL_ERROR_SSL:
1801 ERR_print_errors(bio_err);
1802 goto shut;
1803 /* break; */
1804 }
1805 }
1806 #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)
1807 # if defined(OPENSSL_SYS_WINCE) || defined(OPENSSL_SYS_MSDOS)
1808 else if (_kbhit())
1809 # else
1810 else if ((_kbhit())
1811 || (WAIT_OBJECT_0 ==
1812 WaitForSingleObject(GetStdHandle(STD_INPUT_HANDLE), 0)))
1813 # endif
1814 #elif defined (OPENSSL_SYS_NETWARE)
1815 else if (_kbhit())
1816 #elif defined(OPENSSL_SYS_BEOS_R5)
1817 else if (stdin_set)
1818 #else
1819 else if (FD_ISSET(fdin, &readfds))
1820 #endif
1821 {
1822 if (crlf) {
1823 int j, lf_num;
1824
1825 i = raw_read_stdin(cbuf, BUFSIZZ / 2);
1826 lf_num = 0;
1827 /* both loops are skipped when i <= 0 */
1828 for (j = 0; j < i; j++)
1829 if (cbuf[j] == '\n')
1830 lf_num++;
1831 for (j = i - 1; j >= 0; j--) {
1832 cbuf[j + lf_num] = cbuf[j];
1833 if (cbuf[j] == '\n') {
1834 lf_num--;
1835 i++;
1836 cbuf[j + lf_num] = '\r';
1837 }
1838 }
1839 assert(lf_num == 0);
1840 } else
1841 i = raw_read_stdin(cbuf, BUFSIZZ);
1842
1843 if ((!c_ign_eof) && ((i <= 0) || (cbuf[0] == 'Q'))) {
1844 BIO_printf(bio_err, "DONE\n");
1845 ret = 0;
1846 goto shut;
1847 }
1848
1849 if ((!c_ign_eof) && (cbuf[0] == 'R')) {
1850 BIO_printf(bio_err, "RENEGOTIATING\n");
1851 SSL_renegotiate(con);
1852 cbuf_len = 0;
1853 }
1854 #ifndef OPENSSL_NO_HEARTBEATS
1855 else if ((!c_ign_eof) && (cbuf[0] == 'B')) {
1856 BIO_printf(bio_err, "HEARTBEATING\n");
1857 SSL_heartbeat(con);
1858 cbuf_len = 0;
1859 }
1860 #endif
1861 else {
1862 cbuf_len = i;
1863 cbuf_off = 0;
1864 #ifdef CHARSET_EBCDIC
1865 ebcdic2ascii(cbuf, cbuf, i);
1866 #endif
1867 }
1868
1869 write_ssl = 1;
1870 read_tty = 0;
1871 }
1872 }
1873
1874 ret = 0;
1875 shut:
1876 if (in_init)
1877 print_stuff(bio_c_out, con, full_log);
1878 SSL_shutdown(con);
1879 SHUTDOWN(SSL_get_fd(con));
1880 end:
1881 if (con != NULL) {
1882 if (prexit != 0)
1883 print_stuff(bio_c_out, con, 1);
1884 SSL_free(con);
1885 }
1886 #if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
1887 if (next_proto.data)
1888 OPENSSL_free(next_proto.data);
1889 #endif
1890 if (ctx != NULL)
1891 SSL_CTX_free(ctx);
1892 if (cert)
1893 X509_free(cert);
1894 if (key)
1895 EVP_PKEY_free(key);
1896 if (pass)
1897 OPENSSL_free(pass);
1898 if (vpm)
1899 X509_VERIFY_PARAM_free(vpm);
1900 if (cbuf != NULL) {
1901 OPENSSL_cleanse(cbuf, BUFSIZZ);
1902 OPENSSL_free(cbuf);
1903 }
1904 if (sbuf != NULL) {
1905 OPENSSL_cleanse(sbuf, BUFSIZZ);
1906 OPENSSL_free(sbuf);
1907 }
1908 if (mbuf != NULL) {
1909 OPENSSL_cleanse(mbuf, BUFSIZZ);
1910 OPENSSL_free(mbuf);
1911 }
1912 if (bio_c_out != NULL) {
1913 BIO_free(bio_c_out);
1914 bio_c_out = NULL;
1915 }
1916 apps_shutdown();
1917 OPENSSL_EXIT(ret);
1918 }
1919
print_stuff(BIO * bio,SSL * s,int full)1920 static void print_stuff(BIO *bio, SSL *s, int full)
1921 {
1922 X509 *peer = NULL;
1923 char *p;
1924 static const char *space = " ";
1925 char buf[BUFSIZ];
1926 STACK_OF(X509) *sk;
1927 STACK_OF(X509_NAME) *sk2;
1928 const SSL_CIPHER *c;
1929 X509_NAME *xn;
1930 int j, i;
1931 #ifndef OPENSSL_NO_COMP
1932 const COMP_METHOD *comp, *expansion;
1933 #endif
1934 unsigned char *exportedkeymat;
1935
1936 if (full) {
1937 int got_a_chain = 0;
1938
1939 sk = SSL_get_peer_cert_chain(s);
1940 if (sk != NULL) {
1941 got_a_chain = 1; /* we don't have it for SSL2 (yet) */
1942
1943 BIO_printf(bio, "---\nCertificate chain\n");
1944 for (i = 0; i < sk_X509_num(sk); i++) {
1945 X509_NAME_oneline(X509_get_subject_name(sk_X509_value(sk, i)),
1946 buf, sizeof buf);
1947 BIO_printf(bio, "%2d s:%s\n", i, buf);
1948 X509_NAME_oneline(X509_get_issuer_name(sk_X509_value(sk, i)),
1949 buf, sizeof buf);
1950 BIO_printf(bio, " i:%s\n", buf);
1951 if (c_showcerts)
1952 PEM_write_bio_X509(bio, sk_X509_value(sk, i));
1953 }
1954 }
1955
1956 BIO_printf(bio, "---\n");
1957 peer = SSL_get_peer_certificate(s);
1958 if (peer != NULL) {
1959 BIO_printf(bio, "Server certificate\n");
1960
1961 /* Redundant if we showed the whole chain */
1962 if (!(c_showcerts && got_a_chain))
1963 PEM_write_bio_X509(bio, peer);
1964 X509_NAME_oneline(X509_get_subject_name(peer), buf, sizeof buf);
1965 BIO_printf(bio, "subject=%s\n", buf);
1966 X509_NAME_oneline(X509_get_issuer_name(peer), buf, sizeof buf);
1967 BIO_printf(bio, "issuer=%s\n", buf);
1968 } else
1969 BIO_printf(bio, "no peer certificate available\n");
1970
1971 sk2 = SSL_get_client_CA_list(s);
1972 if ((sk2 != NULL) && (sk_X509_NAME_num(sk2) > 0)) {
1973 BIO_printf(bio, "---\nAcceptable client certificate CA names\n");
1974 for (i = 0; i < sk_X509_NAME_num(sk2); i++) {
1975 xn = sk_X509_NAME_value(sk2, i);
1976 X509_NAME_oneline(xn, buf, sizeof(buf));
1977 BIO_write(bio, buf, strlen(buf));
1978 BIO_write(bio, "\n", 1);
1979 }
1980 } else {
1981 BIO_printf(bio, "---\nNo client certificate CA names sent\n");
1982 }
1983 p = SSL_get_shared_ciphers(s, buf, sizeof buf);
1984 if (p != NULL) {
1985 /*
1986 * This works only for SSL 2. In later protocol versions, the
1987 * client does not know what other ciphers (in addition to the
1988 * one to be used in the current connection) the server supports.
1989 */
1990
1991 BIO_printf(bio,
1992 "---\nCiphers common between both SSL endpoints:\n");
1993 j = i = 0;
1994 while (*p) {
1995 if (*p == ':') {
1996 BIO_write(bio, space, 15 - j % 25);
1997 i++;
1998 j = 0;
1999 BIO_write(bio, ((i % 3) ? " " : "\n"), 1);
2000 } else {
2001 BIO_write(bio, p, 1);
2002 j++;
2003 }
2004 p++;
2005 }
2006 BIO_write(bio, "\n", 1);
2007 }
2008
2009 BIO_printf(bio,
2010 "---\nSSL handshake has read %ld bytes and written %ld bytes\n",
2011 BIO_number_read(SSL_get_rbio(s)),
2012 BIO_number_written(SSL_get_wbio(s)));
2013 }
2014 BIO_printf(bio, (SSL_cache_hit(s) ? "---\nReused, " : "---\nNew, "));
2015 c = SSL_get_current_cipher(s);
2016 BIO_printf(bio, "%s, Cipher is %s\n",
2017 SSL_CIPHER_get_version(c), SSL_CIPHER_get_name(c));
2018 if (peer != NULL) {
2019 EVP_PKEY *pktmp;
2020 pktmp = X509_get_pubkey(peer);
2021 BIO_printf(bio, "Server public key is %d bit\n",
2022 EVP_PKEY_bits(pktmp));
2023 EVP_PKEY_free(pktmp);
2024 }
2025 BIO_printf(bio, "Secure Renegotiation IS%s supported\n",
2026 SSL_get_secure_renegotiation_support(s) ? "" : " NOT");
2027 #ifndef OPENSSL_NO_COMP
2028 comp = SSL_get_current_compression(s);
2029 expansion = SSL_get_current_expansion(s);
2030 BIO_printf(bio, "Compression: %s\n",
2031 comp ? SSL_COMP_get_name(comp) : "NONE");
2032 BIO_printf(bio, "Expansion: %s\n",
2033 expansion ? SSL_COMP_get_name(expansion) : "NONE");
2034 #endif
2035
2036 #ifdef SSL_DEBUG
2037 {
2038 /* Print out local port of connection: useful for debugging */
2039 int sock;
2040 struct sockaddr_in ladd;
2041 socklen_t ladd_size = sizeof(ladd);
2042 sock = SSL_get_fd(s);
2043 getsockname(sock, (struct sockaddr *)&ladd, &ladd_size);
2044 BIO_printf(bio_c_out, "LOCAL PORT is %u\n", ntohs(ladd.sin_port));
2045 }
2046 #endif
2047
2048 #if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
2049 if (next_proto.status != -1) {
2050 const unsigned char *proto;
2051 unsigned int proto_len;
2052 SSL_get0_next_proto_negotiated(s, &proto, &proto_len);
2053 BIO_printf(bio, "Next protocol: (%d) ", next_proto.status);
2054 BIO_write(bio, proto, proto_len);
2055 BIO_write(bio, "\n", 1);
2056 }
2057 #endif
2058
2059 #ifndef OPENSSL_NO_SRTP
2060 {
2061 SRTP_PROTECTION_PROFILE *srtp_profile =
2062 SSL_get_selected_srtp_profile(s);
2063
2064 if (srtp_profile)
2065 BIO_printf(bio, "SRTP Extension negotiated, profile=%s\n",
2066 srtp_profile->name);
2067 }
2068 #endif
2069
2070 SSL_SESSION_print(bio, SSL_get_session(s));
2071 if (keymatexportlabel != NULL) {
2072 BIO_printf(bio, "Keying material exporter:\n");
2073 BIO_printf(bio, " Label: '%s'\n", keymatexportlabel);
2074 BIO_printf(bio, " Length: %i bytes\n", keymatexportlen);
2075 exportedkeymat = OPENSSL_malloc(keymatexportlen);
2076 if (exportedkeymat != NULL) {
2077 if (!SSL_export_keying_material(s, exportedkeymat,
2078 keymatexportlen,
2079 keymatexportlabel,
2080 strlen(keymatexportlabel),
2081 NULL, 0, 0)) {
2082 BIO_printf(bio, " Error\n");
2083 } else {
2084 BIO_printf(bio, " Keying material: ");
2085 for (i = 0; i < keymatexportlen; i++)
2086 BIO_printf(bio, "%02X", exportedkeymat[i]);
2087 BIO_printf(bio, "\n");
2088 }
2089 OPENSSL_free(exportedkeymat);
2090 }
2091 }
2092 BIO_printf(bio, "---\n");
2093 if (peer != NULL)
2094 X509_free(peer);
2095 /* flush, or debugging output gets mixed with http response */
2096 (void)BIO_flush(bio);
2097 }
2098
2099 #ifndef OPENSSL_NO_TLSEXT
2100
ocsp_resp_cb(SSL * s,void * arg)2101 static int ocsp_resp_cb(SSL *s, void *arg)
2102 {
2103 const unsigned char *p;
2104 int len;
2105 OCSP_RESPONSE *rsp;
2106 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
2107 BIO_puts(arg, "OCSP response: ");
2108 if (!p) {
2109 BIO_puts(arg, "no response sent\n");
2110 return 1;
2111 }
2112 rsp = d2i_OCSP_RESPONSE(NULL, &p, len);
2113 if (!rsp) {
2114 BIO_puts(arg, "response parse error\n");
2115 BIO_dump_indent(arg, (char *)p, len, 4);
2116 return 0;
2117 }
2118 BIO_puts(arg, "\n======================================\n");
2119 OCSP_RESPONSE_print(arg, rsp, 0);
2120 BIO_puts(arg, "======================================\n");
2121 OCSP_RESPONSE_free(rsp);
2122 return 1;
2123 }
2124
2125 #endif
2126