#ifndef OPENSSL_NO_TLSEXT
static int c_tlsextdebug=0;
static int c_status_req=0;
-static int c_proof_debug=0;
#endif
static int c_msg=0;
static int c_showcerts=0;
static void print_stuff(BIO *berr,SSL *con,int full);
#ifndef OPENSSL_NO_TLSEXT
static int ocsp_resp_cb(SSL *s, void *arg);
-static int audit_proof_cb(SSL *s, void *arg);
+static int c_auth = 0;
+static int c_auth_require_reneg = 0;
#endif
static BIO *bio_c_out=NULL;
static BIO *bio_c_msg=NULL;
static int c_ign_eof=0;
static int c_brief=0;
+#ifndef OPENSSL_NO_TLSEXT
+
+static unsigned char *generated_supp_data = NULL;
+
+static const unsigned char *most_recent_supplemental_data = NULL;
+static size_t most_recent_supplemental_data_length = 0;
+
+static int server_provided_server_authz = 0;
+static int server_provided_client_authz = 0;
+
+static const unsigned char auth_ext_data[]={TLSEXT_AUTHZDATAFORMAT_dtcp};
+
+static int suppdata_cb(SSL *s, unsigned short supp_data_type,
+ const unsigned char *in,
+ unsigned short inlen, int *al,
+ void *arg);
+
+static int auth_suppdata_generate_cb(SSL *s, unsigned short supp_data_type,
+ const unsigned char **out,
+ unsigned short *outlen, int *al, void *arg);
+
+static int authz_tlsext_generate_cb(SSL *s, unsigned short ext_type,
+ const unsigned char **out, unsigned short *outlen,
+ int *al, void *arg);
+
+static int authz_tlsext_cb(SSL *s, unsigned short ext_type,
+ const unsigned char *in,
+ unsigned short inlen, int *al,
+ void *arg);
+#endif
+
#ifndef OPENSSL_NO_PSK
/* Default PSK identity and key */
static char *psk_identity="Client_identity";
BIO_printf(bio_err," -host host - use -connect instead\n");
BIO_printf(bio_err," -port port - use -connect instead\n");
BIO_printf(bio_err," -connect host:port - who to connect to (default is %s:%s)\n",SSL_HOST_NAME,PORT_STR);
-
BIO_printf(bio_err," -verify arg - turn on peer certificate verification\n");
BIO_printf(bio_err," -cert arg - certificate file to use, PEM format assumed\n");
BIO_printf(bio_err," -certform arg - certificate format (PEM or DER) PEM default\n");
BIO_printf(bio_err," 'prot' defines which one to assume. Currently,\n");
BIO_printf(bio_err," only \"smtp\", \"pop3\", \"imap\", \"ftp\" and \"xmpp\"\n");
BIO_printf(bio_err," are supported.\n");
+ BIO_printf(bio_err," -xmpphost host - When used with \"-starttls xmpp\" specifies the virtual host.\n");
#ifndef OPENSSL_NO_ENGINE
BIO_printf(bio_err," -engine id - Initialise and use the specified engine\n");
#endif
BIO_printf(bio_err," -tlsextdebug - hex dump of all TLS extensions received\n");
BIO_printf(bio_err," -status - request certificate status from server\n");
BIO_printf(bio_err," -no_ticket - disable use of RFC4507bis session tickets\n");
- BIO_printf(bio_err," -proof_debug - request an audit proof and print its hex dump\n");
+ BIO_printf(bio_err," -serverinfo types - send empty ClientHello extensions (comma-separated numbers)\n");
+ BIO_printf(bio_err," -auth - send and receive RFC 5878 TLS auth extensions and supplemental data\n");
+ BIO_printf(bio_err," -auth_require_reneg - Do not send TLS auth extensions until renegotiation\n");
# ifndef OPENSSL_NO_NEXTPROTONEG
BIO_printf(bio_err," -nextprotoneg arg - enable NPN extension, considering named protocols supported (comma-separated list)\n");
# endif
+ BIO_printf(bio_err," -alpn arg - enable ALPN extension, considering named protocols supported (comma-separated list)\n");
#endif
BIO_printf(bio_err," -legacy_renegotiation - enable use of legacy renegotiation (dangerous)\n");
BIO_printf(bio_err," -use_srtp profiles - Offer SRTP key management with a colon-separated profile list\n");
return SSL_TLSEXT_ERR_OK;
}
# endif /* ndef OPENSSL_NO_NEXTPROTONEG */
+
+static int serverinfo_cli_cb(SSL* s, unsigned short ext_type,
+ const unsigned char* in, unsigned short inlen,
+ int* al, void* arg)
+ {
+ char pem_name[100];
+ unsigned char ext_buf[4 + 65536];
+
+ /* Reconstruct the type/len fields prior to extension data */
+ ext_buf[0] = ext_type >> 8;
+ ext_buf[1] = ext_type & 0xFF;
+ ext_buf[2] = inlen >> 8;
+ ext_buf[3] = inlen & 0xFF;
+ memcpy(ext_buf+4, in, inlen);
+
+ BIO_snprintf(pem_name, sizeof(pem_name), "SERVERINFO FOR EXTENSION %d",
+ ext_type);
+ PEM_write_bio(bio_c_out, pem_name, "", ext_buf, 4 + inlen);
+ return 1;
+ }
+
#endif
enum
int MAIN(int argc, char **argv)
{
- unsigned int off=0, clr=0;
- unsigned int cert_flags=0;
int build_chain = 0;
SSL *con=NULL;
#ifndef OPENSSL_NO_KRB5
short port=PORT;
int full_log=1;
char *host=SSL_HOST_NAME;
- char *cert_file=NULL,*key_file=NULL;
+ char *xmpphost = NULL;
+ char *cert_file=NULL,*key_file=NULL,*chain_file=NULL;
int cert_format = FORMAT_PEM, key_format = FORMAT_PEM;
char *passarg = NULL, *pass = NULL;
X509 *cert = NULL;
EVP_PKEY *key = NULL;
- char *CApath=NULL,*CAfile=NULL,*cipher=NULL;
- int reconnect=0,badop=0,verify=SSL_VERIFY_NONE,bugs=0;
+ STACK_OF(X509) *chain = NULL;
+ char *CApath=NULL,*CAfile=NULL;
+ char *chCApath=NULL,*chCAfile=NULL;
+ char *vfyCApath=NULL,*vfyCAfile=NULL;
+ int reconnect=0,badop=0,verify=SSL_VERIFY_NONE;
int crlf=0;
int write_tty,read_tty,write_ssl,read_ssl,tty_on,ssl_pending;
SSL_CTX *ctx=NULL;
#endif
#ifndef OPENSSL_NO_TLSEXT
char *servername = NULL;
- char *curves=NULL;
- char *sigalgs=NULL;
- char *client_sigalgs=NULL;
tlsextctx tlsextcbp =
{NULL,0};
# ifndef OPENSSL_NO_NEXTPROTONEG
const char *next_proto_neg_in = NULL;
# endif
+ const char *alpn_in = NULL;
+# define MAX_SI_TYPES 100
+ unsigned short serverinfo_types[MAX_SI_TYPES];
+ int serverinfo_types_count = 0;
#endif
char *sess_in = NULL;
char *sess_out = NULL;
int enable_timeouts = 0 ;
long socket_mtu = 0;
#ifndef OPENSSL_NO_JPAKE
- char *jpake_secret = NULL;
+static char *jpake_secret = NULL;
+#define no_jpake !jpake_secret
+#else
+#define no_jpake 1
#endif
#ifndef OPENSSL_NO_SRP
char * srppass = NULL;
#endif
SSL_EXCERT *exc = NULL;
+ SSL_CONF_CTX *cctx = NULL;
+ STACK_OF(OPENSSL_STRING) *ssl_args = NULL;
+
+ char *crl_file = NULL;
+ int crl_format = FORMAT_PEM;
+ int crl_download = 0;
+ STACK_OF(X509_CRL) *crls = NULL;
+
meth=SSLv23_client_method();
apps_startup();
if (!load_config(bio_err, NULL))
goto end;
+ cctx = SSL_CONF_CTX_new();
+ if (!cctx)
+ goto end;
+ SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_CLIENT);
+ SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_CMDLINE);
if ( ((cbuf=OPENSSL_malloc(BUFSIZZ)) == NULL) ||
((sbuf=OPENSSL_malloc(BUFSIZZ)) == NULL) ||
if (!extract_host_port(*(++argv),&host,NULL,&port))
goto bad;
}
+ else if (strcmp(*argv,"-xmpphost") == 0)
+ {
+ if (--argc < 1) goto bad;
+ xmpphost= *(++argv);
+ }
else if (strcmp(*argv,"-verify") == 0)
{
verify=SSL_VERIFY_PEER;
if (--argc < 1) goto bad;
cert_file= *(++argv);
}
+ else if (strcmp(*argv,"-CRL") == 0)
+ {
+ if (--argc < 1) goto bad;
+ crl_file= *(++argv);
+ }
+ else if (strcmp(*argv,"-crl_download") == 0)
+ crl_download = 1;
else if (strcmp(*argv,"-sess_out") == 0)
{
if (--argc < 1) goto bad;
if (--argc < 1) goto bad;
cert_format = str2fmt(*(++argv));
}
+ else if (strcmp(*argv,"-CRLform") == 0)
+ {
+ if (--argc < 1) goto bad;
+ crl_format = str2fmt(*(++argv));
+ }
else if (args_verify(&argv, &argc, &badarg, bio_err, &vpm))
{
if (badarg)
goto bad;
continue;
}
+ else if (args_ssl(&argv, &argc, cctx, &badarg, bio_err, &ssl_args))
+ {
+ if (badarg)
+ goto bad;
+ continue;
+ }
else if (strcmp(*argv,"-prexit") == 0)
prexit=1;
else if (strcmp(*argv,"-crlf") == 0)
c_tlsextdebug=1;
else if (strcmp(*argv,"-status") == 0)
c_status_req=1;
- else if (strcmp(*argv,"-proof_debug") == 0)
- c_proof_debug=1;
+ else if (strcmp(*argv,"-auth") == 0)
+ c_auth = 1;
+ else if (strcmp(*argv,"-auth_require_reneg") == 0)
+ c_auth_require_reneg = 1;
#endif
#ifdef WATT32
else if (strcmp(*argv,"-wdebug") == 0)
meth=TLSv1_client_method();
#endif
#ifndef OPENSSL_NO_DTLS1
+ else if (strcmp(*argv,"-dtls") == 0)
+ {
+ meth=DTLS_client_method();
+ socket_type=SOCK_DGRAM;
+ }
else if (strcmp(*argv,"-dtls1") == 0)
{
meth=DTLSv1_client_method();
socket_type=SOCK_DGRAM;
}
+ else if (strcmp(*argv,"-dtls1_2") == 0)
+ {
+ meth=DTLSv1_2_client_method();
+ socket_type=SOCK_DGRAM;
+ }
else if (strcmp(*argv,"-timeout") == 0)
enable_timeouts=1;
else if (strcmp(*argv,"-mtu") == 0)
socket_mtu = atol(*(++argv));
}
#endif
- else if (strcmp(*argv,"-bugs") == 0)
- bugs=1;
else if (strcmp(*argv,"-keyform") == 0)
{
if (--argc < 1) goto bad;
if (--argc < 1) goto bad;
passarg = *(++argv);
}
+ else if (strcmp(*argv,"-cert_chain") == 0)
+ {
+ if (--argc < 1) goto bad;
+ chain_file= *(++argv);
+ }
else if (strcmp(*argv,"-key") == 0)
{
if (--argc < 1) goto bad;
if (--argc < 1) goto bad;
CApath= *(++argv);
}
+ else if (strcmp(*argv,"-chainCApath") == 0)
+ {
+ if (--argc < 1) goto bad;
+ chCApath= *(++argv);
+ }
+ else if (strcmp(*argv,"-verifyCApath") == 0)
+ {
+ if (--argc < 1) goto bad;
+ vfyCApath= *(++argv);
+ }
else if (strcmp(*argv,"-build_chain") == 0)
build_chain = 1;
else if (strcmp(*argv,"-CAfile") == 0)
if (--argc < 1) goto bad;
CAfile= *(++argv);
}
- else if (strcmp(*argv,"-no_tls1_2") == 0)
- off|=SSL_OP_NO_TLSv1_2;
- else if (strcmp(*argv,"-no_tls1_1") == 0)
- off|=SSL_OP_NO_TLSv1_1;
- else if (strcmp(*argv,"-no_tls1") == 0)
- off|=SSL_OP_NO_TLSv1;
- else if (strcmp(*argv,"-no_ssl3") == 0)
- off|=SSL_OP_NO_SSLv3;
- else if (strcmp(*argv,"-no_ssl2") == 0)
- off|=SSL_OP_NO_SSLv2;
- else if (strcmp(*argv,"-no_comp") == 0)
- { off|=SSL_OP_NO_COMPRESSION; }
+ else if (strcmp(*argv,"-chainCAfile") == 0)
+ {
+ if (--argc < 1) goto bad;
+ chCAfile= *(++argv);
+ }
+ else if (strcmp(*argv,"-verifyCAfile") == 0)
+ {
+ if (--argc < 1) goto bad;
+ vfyCAfile= *(++argv);
+ }
#ifndef OPENSSL_NO_TLSEXT
- else if (strcmp(*argv,"-no_ticket") == 0)
- { off|=SSL_OP_NO_TICKET; }
# ifndef OPENSSL_NO_NEXTPROTONEG
else if (strcmp(*argv,"-nextprotoneg") == 0)
{
next_proto_neg_in = *(++argv);
}
# endif
-#endif
- else if (strcmp(*argv,"-serverpref") == 0)
- off|=SSL_OP_CIPHER_SERVER_PREFERENCE;
- else if (strcmp(*argv,"-legacy_renegotiation") == 0)
- off|=SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;
- else if (strcmp(*argv,"-legacy_server_connect") == 0)
- { off|=SSL_OP_LEGACY_SERVER_CONNECT; }
- else if (strcmp(*argv,"-no_legacy_server_connect") == 0)
- { clr|=SSL_OP_LEGACY_SERVER_CONNECT; }
- else if (strcmp(*argv,"-cipher") == 0)
+ else if (strcmp(*argv,"-alpn") == 0)
{
if (--argc < 1) goto bad;
- cipher= *(++argv);
+ alpn_in = *(++argv);
}
+ else if (strcmp(*argv,"-serverinfo") == 0)
+ {
+ char *c;
+ int start = 0;
+ int len;
+
+ if (--argc < 1) goto bad;
+ c = *(++argv);
+ serverinfo_types_count = 0;
+ len = strlen(c);
+ for (i = 0; i <= len; ++i)
+ {
+ if (i == len || c[i] == ',')
+ {
+ serverinfo_types[serverinfo_types_count]
+ = atoi(c+start);
+ serverinfo_types_count++;
+ start = i+1;
+ }
+ if (serverinfo_types_count == MAX_SI_TYPES)
+ break;
+ }
+ }
+#endif
#ifdef FIONBIO
else if (strcmp(*argv,"-nbio") == 0)
{ c_nbio=1; }
servername= *(++argv);
/* meth=TLSv1_client_method(); */
}
- else if (strcmp(*argv,"-curves") == 0)
- {
- if (--argc < 1) goto bad;
- curves= *(++argv);
- }
- else if (strcmp(*argv,"-sigalgs") == 0)
- {
- if (--argc < 1) goto bad;
- sigalgs= *(++argv);
- }
- else if (strcmp(*argv,"-client_sigalgs") == 0)
- {
- if (--argc < 1) goto bad;
- client_sigalgs= *(++argv);
- }
#endif
#ifndef OPENSSL_NO_JPAKE
else if (strcmp(*argv,"-jpake") == 0)
keymatexportlen=atoi(*(++argv));
if (keymatexportlen == 0) goto bad;
}
- else if (strcmp(*argv, "-cert_strict") == 0)
- cert_flags |= SSL_CERT_FLAG_TLS_STRICT;
-#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
- else if (strcmp(*argv, "-debug_broken_protocol") == 0)
- cert_flags |= SSL_CERT_FLAG_BROKEN_PROTCOL;
-#endif
else
{
BIO_printf(bio_err,"unknown option %s\n",*argv);
}
psk_identity = "JPAKE";
}
-
- if (cipher)
- {
- BIO_printf(bio_err, "JPAKE sets cipher to PSK\n");
- goto end;
- }
- cipher = "PSK";
#endif
OpenSSL_add_ssl_algorithms();
}
}
+ if (chain_file)
+ {
+ chain = load_certs(bio_err, chain_file,FORMAT_PEM,
+ NULL, e, "client certificate chain");
+ if (!chain)
+ goto end;
+ }
+
+ if (crl_file)
+ {
+ X509_CRL *crl;
+ crl = load_crl(crl_file, crl_format);
+ if (!crl)
+ {
+ BIO_puts(bio_err, "Error loading CRL\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ crls = sk_X509_CRL_new_null();
+ if (!crls || !sk_X509_CRL_push(crls, crl))
+ {
+ BIO_puts(bio_err, "Error adding CRL\n");
+ ERR_print_errors(bio_err);
+ X509_CRL_free(crl);
+ goto end;
+ }
+ }
+
if (!load_excert(&exc, bio_err))
goto end;
if (bio_c_out == NULL)
{
- if (c_quiet && !c_debug && !c_msg)
+ if (c_quiet && !c_debug)
{
bio_c_out=BIO_new(BIO_s_null());
+ if (c_msg && !bio_c_msg)
+ bio_c_msg=BIO_new_fp(stdout,BIO_NOCLOSE);
}
else
{
if (vpm)
SSL_CTX_set1_param(ctx, vpm);
+ if (!args_ssl_call(ctx, bio_err, cctx, ssl_args, 1, no_jpake))
+ {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+
+ if (!ssl_load_stores(ctx, vfyCApath, vfyCAfile, chCApath, chCAfile,
+ crls, crl_download))
+ {
+ BIO_printf(bio_err, "Error loading store locations\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+
#ifndef OPENSSL_NO_ENGINE
if (ssl_client_engine)
{
if (srtp_profiles != NULL)
SSL_CTX_set_tlsext_use_srtp(ctx, srtp_profiles);
#endif
- if (bugs)
- SSL_CTX_set_options(ctx,SSL_OP_ALL|off);
- else
- SSL_CTX_set_options(ctx,off);
-
- if (clr)
- SSL_CTX_clear_options(ctx, clr);
- if (cert_flags) SSL_CTX_set_cert_flags(ctx, cert_flags);
if (exc) ssl_ctx_set_excert(ctx, exc);
/* DTLS: partial reads end up discarding unread UDP bytes :-(
* Setting read ahead solves this problem.
*/
if (socket_type == SOCK_DGRAM) SSL_CTX_set_read_ahead(ctx, 1);
-#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
+#if !defined(OPENSSL_NO_TLSEXT)
+# if !defined(OPENSSL_NO_NEXTPROTONEG)
if (next_proto.data)
SSL_CTX_set_next_proto_select_cb(ctx, next_proto_cb, &next_proto);
+# endif
+ if (alpn_in)
+ {
+ unsigned short alpn_len;
+ unsigned char *alpn = next_protos_parse(&alpn_len, alpn_in);
+
+ if (alpn == NULL)
+ {
+ BIO_printf(bio_err, "Error parsing -alpn argument\n");
+ goto end;
+ }
+ SSL_CTX_set_alpn_protos(ctx, alpn, alpn_len);
+ OPENSSL_free(alpn);
+ }
+#endif
+#ifndef OPENSSL_NO_TLSEXT
+ if (serverinfo_types_count)
+ {
+ for (i = 0; i < serverinfo_types_count; i++)
+ {
+ SSL_CTX_set_custom_cli_ext(ctx,
+ serverinfo_types[i],
+ NULL,
+ serverinfo_cli_cb,
+ NULL);
+ }
+ }
#endif
if (state) SSL_CTX_set_info_callback(ctx,apps_ssl_info_callback);
- if (cipher != NULL)
- if(!SSL_CTX_set_cipher_list(ctx,cipher)) {
- BIO_printf(bio_err,"error setting cipher list\n");
- ERR_print_errors(bio_err);
- goto end;
- }
#if 0
else
SSL_CTX_set_cipher_list(ctx,getenv("SSL_CIPHER"));
/* goto end; */
}
- if (!set_cert_key_stuff(ctx,cert,key, NULL, build_chain))
+ ssl_ctx_add_crls(ctx, crls, crl_download);
+
+ if (!set_cert_key_stuff(ctx,cert,key,chain,build_chain))
goto end;
#ifndef OPENSSL_NO_TLSEXT
- if (curves != NULL)
- if(!SSL_CTX_set1_curves_list(ctx,curves)) {
- BIO_printf(bio_err,"error setting curve list\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- if (sigalgs != NULL)
- if(!SSL_CTX_set1_sigalgs_list(ctx,sigalgs)) {
- BIO_printf(bio_err,"error setting signature algorithms list\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- if (client_sigalgs != NULL)
- if(!SSL_CTX_set1_client_sigalgs_list(ctx,client_sigalgs)) {
- BIO_printf(bio_err,"error setting client signature algorithms list\n");
- ERR_print_errors(bio_err);
- goto end;
- }
if (servername != NULL)
{
tlsextcbp.biodebug = bio_err;
}
#endif
- if (c_proof_debug)
- SSL_CTX_set_tlsext_authz_server_audit_proof_cb(ctx,
- audit_proof_cb);
+ if (c_auth)
+ {
+ SSL_CTX_set_custom_cli_ext(ctx, TLSEXT_TYPE_client_authz, authz_tlsext_generate_cb, authz_tlsext_cb, bio_err);
+ SSL_CTX_set_custom_cli_ext(ctx, TLSEXT_TYPE_server_authz, authz_tlsext_generate_cb, authz_tlsext_cb, bio_err);
+ SSL_CTX_set_cli_supp_data(ctx, TLSEXT_SUPPLEMENTALDATATYPE_authz_data, suppdata_cb, auth_suppdata_generate_cb, bio_err);
+ }
#endif
con=SSL_new(ctx);
#endif
if (c_Pause & 0x01) SSL_set_debug(con, 1);
- if ( SSL_version(con) == DTLS1_VERSION)
+ if (socket_type == SOCK_DGRAM)
{
sbio=BIO_new_dgram(s,BIO_NOCLOSE);
int seen = 0;
BIO_printf(sbio,"<stream:stream "
"xmlns:stream='http://etherx.jabber.org/streams' "
- "xmlns='jabber:client' to='%s' version='1.0'>", host);
+ "xmlns='jabber:client' to='%s' version='1.0'>", xmpphost ?
+ xmpphost : host);
seen = BIO_read(sbio,mbuf,BUFSIZZ);
mbuf[seen] = 0;
- while (!strstr(mbuf, "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'"))
+ while (!strstr(mbuf, "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'") &&
+ !strstr(mbuf, "<starttls xmlns=\"urn:ietf:params:xml:ns:xmpp-tls\""))
{
- if (strstr(mbuf, "/stream:features>"))
- goto shut;
seen = BIO_read(sbio,mbuf,BUFSIZZ);
+
+ if (seen <= 0)
+ goto shut;
+
mbuf[seen] = 0;
}
BIO_printf(sbio, "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>");
"CONNECTION ESTABLISHED\n");
print_ssl_summary(bio_err, con);
}
+ /*handshake is complete - free the generated supp data allocated in the callback */
+ if (generated_supp_data)
+ {
+ OPENSSL_free(generated_supp_data);
+ generated_supp_data = NULL;
+ }
+
print_stuff(bio_c_out,con,full_log);
if (full_log > 0) full_log--;
if ((SSL_version(con) == DTLS1_VERSION) && DTLSv1_handle_timeout(con) > 0)
{
- BIO_printf(bio_err,"TIMEOUT occured\n");
+ BIO_printf(bio_err,"TIMEOUT occurred\n");
}
if (!ssl_pending && FD_ISSET(SSL_get_fd(con),&writefds))
break;
case SSL_ERROR_SYSCALL:
ret=get_last_socket_error();
- BIO_printf(bio_err,"read:errno=%d\n",ret);
+ if (c_brief)
+ BIO_puts(bio_err, "CONNECTION CLOSED BY SERVER\n");
+ else
+ BIO_printf(bio_err,"read:errno=%d\n",ret);
goto shut;
case SSL_ERROR_ZERO_RETURN:
BIO_printf(bio_c_out,"closed\n");
if (ctx != NULL) SSL_CTX_free(ctx);
if (cert)
X509_free(cert);
+ if (crls)
+ sk_X509_CRL_pop_free(crls, X509_CRL_free);
if (key)
EVP_PKEY_free(key);
+ if (chain)
+ sk_X509_pop_free(chain, X509_free);
if (pass)
OPENSSL_free(pass);
+ if (vpm)
+ X509_VERIFY_PARAM_free(vpm);
ssl_excert_free(exc);
+ if (ssl_args)
+ sk_OPENSSL_STRING_free(ssl_args);
+ if (cctx)
+ SSL_CONF_CTX_free(cctx);
+#ifndef OPENSSL_NO_JPAKE
+ if (jpake_secret && psk_key)
+ OPENSSL_free(psk_key);
+#endif
if (cbuf != NULL) { OPENSSL_cleanse(cbuf,BUFSIZZ); OPENSSL_free(cbuf); }
if (sbuf != NULL) { OPENSSL_cleanse(sbuf,BUFSIZZ); OPENSSL_free(sbuf); }
if (mbuf != NULL) { OPENSSL_cleanse(mbuf,BUFSIZZ); OPENSSL_free(mbuf); }
}
#endif
-#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
+#if !defined(OPENSSL_NO_TLSEXT)
+# if !defined(OPENSSL_NO_NEXTPROTONEG)
if (next_proto.status != -1) {
const unsigned char *proto;
unsigned int proto_len;
BIO_write(bio, proto, proto_len);
BIO_write(bio, "\n", 1);
}
+# endif
+ {
+ const unsigned char *proto;
+ unsigned int proto_len;
+ SSL_get0_alpn_selected(s, &proto, &proto_len);
+ if (proto_len > 0)
+ {
+ BIO_printf(bio, "ALPN protocol: ");
+ BIO_write(bio, proto, proto_len);
+ BIO_write(bio, "\n", 1);
+ }
+ else
+ BIO_printf(bio, "No ALPN negotiated\n");
+ }
#endif
{
return 1;
}
-static int audit_proof_cb(SSL *s, void *arg)
+static int authz_tlsext_cb(SSL *s, unsigned short ext_type,
+ const unsigned char *in,
+ unsigned short inlen, int *al,
+ void *arg)
{
- const unsigned char *proof;
- size_t proof_len;
- size_t i;
- SSL_SESSION *sess = SSL_get_session(s);
-
- proof = SSL_SESSION_get_tlsext_authz_server_audit_proof(sess,
- &proof_len);
- if (proof != NULL)
+ if (TLSEXT_TYPE_server_authz == ext_type)
+ server_provided_server_authz
+ = (memchr(in, TLSEXT_AUTHZDATAFORMAT_dtcp, inlen) != NULL);
+
+ if (TLSEXT_TYPE_client_authz == ext_type)
+ server_provided_client_authz
+ = (memchr(in, TLSEXT_AUTHZDATAFORMAT_dtcp, inlen) != NULL);
+
+ return 1;
+ }
+
+static int authz_tlsext_generate_cb(SSL *s, unsigned short ext_type,
+ const unsigned char **out, unsigned short *outlen,
+ int *al, void *arg)
+ {
+ if (c_auth)
{
- BIO_printf(bio_c_out, "Audit proof: ");
- for (i = 0; i < proof_len; ++i)
- BIO_printf(bio_c_out, "%02X", proof[i]);
- BIO_printf(bio_c_out, "\n");
+ /*if auth_require_reneg flag is set, only send extensions if
+ renegotiation has occurred */
+ if (!c_auth_require_reneg || (c_auth_require_reneg && SSL_num_renegotiations(s)))
+ {
+ *out = auth_ext_data;
+ *outlen = 1;
+ return 1;
+ }
}
- else
+ /* no auth extension to send */
+ return -1;
+ }
+
+static int suppdata_cb(SSL *s, unsigned short supp_data_type,
+ const unsigned char *in,
+ unsigned short inlen, int *al,
+ void *arg)
+ {
+ if (supp_data_type == TLSEXT_SUPPLEMENTALDATATYPE_authz_data)
{
- BIO_printf(bio_c_out, "No audit proof found.\n");
+ most_recent_supplemental_data = in;
+ most_recent_supplemental_data_length = inlen;
}
return 1;
}
+
+static int auth_suppdata_generate_cb(SSL *s, unsigned short supp_data_type,
+ const unsigned char **out,
+ unsigned short *outlen, int *al, void *arg)
+ {
+ if (c_auth && server_provided_client_authz && server_provided_server_authz)
+ {
+ /*if auth_require_reneg flag is set, only send supplemental data if
+ renegotiation has occurred */
+ if (!c_auth_require_reneg
+ || (c_auth_require_reneg && SSL_num_renegotiations(s)))
+ {
+ generated_supp_data = OPENSSL_malloc(10);
+ memcpy(generated_supp_data, "5432154321", 10);
+ *out = generated_supp_data;
+ *outlen = 10;
+ return 1;
+ }
+ }
+ /* no supplemental data to send */
+ return -1;
+ }
+
#endif
projects / openssl.git / blobdiff