#define COOKIE_SECRET_LENGTH 16
int verify_depth=0;
+int verify_quiet=0;
int verify_error=X509_V_OK;
int verify_return_error=0;
unsigned char cookie_secret[COOKIE_SECRET_LENGTH];
err= X509_STORE_CTX_get_error(ctx);
depth= X509_STORE_CTX_get_error_depth(ctx);
- BIO_printf(bio_err,"depth=%d ",depth);
- if (err_cert)
+ if (!verify_quiet || !ok)
{
- X509_NAME_print_ex(bio_err, X509_get_subject_name(err_cert),
+ BIO_printf(bio_err,"depth=%d ",depth);
+ if (err_cert)
+ {
+ X509_NAME_print_ex(bio_err,
+ X509_get_subject_name(err_cert),
0, XN_FLAG_ONELINE);
- BIO_puts(bio_err, "\n");
+ BIO_puts(bio_err, "\n");
+ }
+ else
+ BIO_puts(bio_err, "<no cert>\n");
}
- else
- BIO_puts(bio_err, "<no cert>\n");
if (!ok)
{
BIO_printf(bio_err,"verify error:num=%d:%s\n",err,
policies_print(bio_err, ctx);
break;
}
- if (err == X509_V_OK && ok == 2)
+ if (err == X509_V_OK && ok == 2 && !verify_quiet)
policies_print(bio_err, ctx);
-
- BIO_printf(bio_err,"verify return:%d\n",ok);
+ if (ok && !verify_quiet)
+ BIO_printf(bio_err,"verify return:%d\n",ok);
return(ok);
}
}
int set_cert_key_stuff(SSL_CTX *ctx, X509 *cert, EVP_PKEY *key,
- STACK_OF(X509) *chain)
+ STACK_OF(X509) *chain, int build_chain)
{
if (cert == NULL)
return 1;
ERR_print_errors(bio_err);
return 0;
}
+ if (!chain && build_chain && !SSL_CTX_build_cert_chain(ctx, 0))
+ {
+ BIO_printf(bio_err,"error building certificate chain\n");
+ ERR_print_errors(bio_err);
+ return 0;
+ }
+
return 1;
}
int ssl_print_sigalgs(BIO *out, SSL *s)
{
+ int mdnid;
if (!SSL_is_server(s))
ssl_print_client_cert_types(out, s);
do_print_sigalgs(out, s, 0);
do_print_sigalgs(out, s, 1);
+ if (SSL_get_peer_signature_nid(s, &mdnid))
+ BIO_printf(out, "Peer signing digest: %s\n", OBJ_nid2sn(mdnid));
return 1;
}
-int ssl_print_curves(BIO *out, SSL *s)
+int ssl_print_curves(BIO *out, SSL *s, int noshared)
{
int i, ncurves, *curves, nid;
const char *cname;
BIO_printf(out, "%s", cname);
}
}
+ if (ncurves == 0)
+ BIO_puts(out, "NONE");
+ if (noshared)
+ {
+ BIO_puts(out, "\n");
+ return 1;
+ }
BIO_puts(out, "\nShared Elliptic curves: ");
OPENSSL_free(curves);
ncurves = SSL_get_shared_curve(s, -1);
return 1;
}
+int ssl_print_tmp_key(BIO *out, SSL *s)
+ {
+ EVP_PKEY *key;
+ if (!SSL_get_server_tmp_key(s, &key))
+ return 1;
+ BIO_puts(out, "Server Temp Key: ");
+ switch (EVP_PKEY_id(key))
+ {
+ case EVP_PKEY_RSA:
+ BIO_printf(out, "RSA, %d bits\n", EVP_PKEY_bits(key));
+ break;
+
+ case EVP_PKEY_DH:
+ BIO_printf(out, "DH, %d bits\n", EVP_PKEY_bits(key));
+ break;
+
+ case EVP_PKEY_EC:
+ {
+ EC_KEY *ec = EVP_PKEY_get1_EC_KEY(key);
+ int nid;
+ const char *cname;
+ nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
+ EC_KEY_free(ec);
+ cname = EC_curve_nid2nist(nid);
+ if (!cname)
+ cname = OBJ_nid2sn(nid);
+ BIO_printf(out, "ECDH, %s, %d bits\n",
+ cname, EVP_PKEY_bits(key));
+ }
+ }
+ EVP_PKEY_free(key);
+ return 1;
+ }
+
long MS_CALLBACK bio_dump_callback(BIO *bio, int cmd, const char *argp,
int argi, long argl, long ret)
if (version == SSL3_VERSION ||
version == TLS1_VERSION ||
+ version == TLS1_1_VERSION ||
+ version == TLS1_2_VERSION ||
version == DTLS1_VERSION ||
version == DTLS1_BAD_VER)
{
X509 *cert;
EVP_PKEY *key;
STACK_OF(X509) *chain;
+ int build_chain;
struct ssl_excert_st *next, *prev;
};
+struct chain_flags
+ {
+ int flag;
+ const char *name;
+ };
+
+struct chain_flags chain_flags_list[] =
+ {
+ {CERT_PKEY_VALID, "Overall Validity"},
+ {CERT_PKEY_SIGN, "Sign with EE key"},
+ {CERT_PKEY_EE_SIGNATURE, "EE signature"},
+ {CERT_PKEY_CA_SIGNATURE, "CA signature"},
+ {CERT_PKEY_EE_PARAM, "EE key parameters"},
+ {CERT_PKEY_CA_PARAM, "CA key parameters"},
+ {CERT_PKEY_EXPLICIT_SIGN, "Explicity sign with EE key"},
+ {CERT_PKEY_ISSUER_NAME, "Issuer Name"},
+ {CERT_PKEY_CERT_TYPE, "Certificate Type"},
+ {0, NULL}
+ };
+
+
+static void print_chain_flags(BIO *out, int flags)
+ {
+ struct chain_flags *ctmp = chain_flags_list;
+ while(ctmp->name)
+ {
+ BIO_printf(out, "\t%s: %s\n", ctmp->name,
+ flags & ctmp->flag ? "OK" : "NOT OK");
+ ctmp++;
+ }
+ }
+
/* Very basic selection callback: just use any certificate chain
* reported as valid. More sophisticated could prioritise according
* to local policy.
*/
static int set_cert_cb(SSL *ssl, void *arg)
{
+ int i, rv;
SSL_EXCERT *exc = arg;
SSL_certs_clear(ssl);
*/
while (exc->next)
exc = exc->next;
-
+
+ i = 0;
+
while(exc)
{
- if (SSL_check_chain(ssl, exc->cert, exc->key, exc->chain))
+ i++;
+ rv = SSL_check_chain(ssl, exc->cert, exc->key, exc->chain);
+ BIO_printf(bio_err, "Checking cert chain %d:\nSubject: ", i);
+ X509_NAME_print_ex(bio_err, X509_get_subject_name(exc->cert), 0,
+ XN_FLAG_ONELINE);
+ BIO_puts(bio_err, "\n");
+
+ print_chain_flags(bio_err, rv);
+ if (rv & CERT_PKEY_VALID)
{
SSL_use_certificate(ssl, exc->cert);
SSL_use_PrivateKey(ssl, exc->key);
- if (exc->chain)
+ /* NB: we wouldn't normally do this as it is
+ * not efficient building chains on each connection
+ * better to cache the chain in advance.
+ */
+ if (exc->build_chain)
+ {
+ if (!SSL_build_cert_chain(ssl, 0))
+ return 0;
+ }
+ else if (exc->chain)
SSL_set1_chain(ssl, exc->chain);
}
exc = exc->prev;
exc->key = NULL;
exc->chain = NULL;
exc->prev = NULL;
+ exc->build_chain = 0;
exc->next = *pexc;
*pexc = exc;
{
char *arg = **pargs, *argn = (*pargs)[1];
SSL_EXCERT *exc = *pexc;
+ int narg = 2;
if (!exc)
{
if (ssl_excert_prepend(&exc))
}
exc->chainfile = argn;
}
+ else if (strcmp(arg,"-xchain_build") == 0)
+ {
+ narg = 1;
+ exc->build_chain = 1;
+ }
else if (strcmp(arg,"-xcertform") == 0)
{
if (!argn)
else
return 0;
- (*pargs) += 2;
+ (*pargs) += narg;
if (pargc)
- *pargc -= 2;
+ *pargc -= narg;
*pexc = exc;
return 1;
}
+static void print_raw_cipherlist(BIO *bio, SSL *s)
+ {
+ const unsigned char *rlist;
+ static const unsigned char scsv_id[] = {0, 0, 0xFF};
+ size_t i, rlistlen, num;
+ if (!SSL_is_server(s))
+ return;
+ num = SSL_get0_raw_cipherlist(s, NULL);
+ rlistlen = SSL_get0_raw_cipherlist(s, &rlist);
+ BIO_puts(bio, "Client cipher list: ");
+ for (i = 0; i < rlistlen; i += num, rlist += num)
+ {
+ const SSL_CIPHER *c = SSL_CIPHER_find(s, rlist);
+ if (i)
+ BIO_puts(bio, ":");
+ if (c)
+ BIO_puts(bio, SSL_CIPHER_get_name(c));
+ else if (!memcmp(rlist, scsv_id - num + 3, num))
+ BIO_puts(bio, "SCSV");
+ else
+ {
+ size_t j;
+ BIO_puts(bio, "0x");
+ for (j = 0; j < num; j++)
+ BIO_printf(bio, "%02X", rlist[j]);
+ }
+ }
+ BIO_puts(bio, "\n");
+ }
+
+
+void print_ssl_summary(BIO *bio, SSL *s)
+ {
+ const SSL_CIPHER *c;
+ X509 *peer;
+ /*const char *pnam = SSL_is_server(s) ? "client" : "server";*/
+ BIO_printf(bio, "Protocol version: %s\n", SSL_get_version(s));
+ print_raw_cipherlist(bio, s);
+ c = SSL_get_current_cipher(s);
+ BIO_printf(bio,"Ciphersuite: %s\n", SSL_CIPHER_get_name(c));
+ do_print_sigalgs(bio, s, 0);
+ peer = SSL_get_peer_certificate(s);
+ if (peer)
+ {
+ int nid;
+ BIO_puts(bio, "Peer certificate: ");
+ X509_NAME_print_ex(bio, X509_get_subject_name(peer),
+ 0, XN_FLAG_ONELINE);
+ BIO_puts(bio, "\n");
+ if (SSL_get_peer_signature_nid(s, &nid))
+ BIO_printf(bio, "Hash used: %s\n", OBJ_nid2sn(nid));
+ }
+ else
+ BIO_puts(bio, "No peer certificate\n");
+ if (peer)
+ X509_free(peer);
+ if (SSL_is_server(s))
+ ssl_print_curves(bio, s, 1);
+ else
+ ssl_print_tmp_key(bio, s);
+ }
+
projects / openssl.git / blobdiff