#ifndef OPENSSL_NO_SRP
# include <openssl/srp.h>
#endif
+#ifndef OPENSSL_NO_CT
+# include <openssl/ct.h>
+#endif
#include "s_apps.h"
#include "timeouts.h"
-#if (defined(OPENSSL_SYS_VMS) && __VMS_VER < 70000000)
-/* FIONBIO used as a switch to enable ioctl, and that isn't in VMS < 7.0 */
-# undef FIONBIO
+#if defined(__has_feature)
+# if __has_feature(memory_sanitizer)
+# include <sanitizer/msan_interface.h>
+# endif
#endif
#undef BUFSIZZ
static char *prog;
static int async = 0;
+static unsigned int split_send_fragment = 0;
+static unsigned int max_pipelines = 0;
static int c_nbio = 0;
static int c_tlsextdebug = 0;
static int c_status_req = 0;
/* This the context that we pass to next_proto_cb */
typedef struct tlsextnextprotoctx_st {
unsigned char *data;
- unsigned short len;
+ size_t len;
int status;
} tlsextnextprotoctx;
OPT_CHAINCAFILE, OPT_VERIFYCAFILE, OPT_NEXTPROTONEG, OPT_ALPN,
OPT_SERVERINFO, OPT_STARTTLS, OPT_SERVERNAME,
OPT_USE_SRTP, OPT_KEYMATEXPORT, OPT_KEYMATEXPORTLEN, OPT_SMTPHOST,
- OPT_ASYNC,
+ OPT_ASYNC, OPT_SPLIT_SEND_FRAG, OPT_MAX_PIPELINES, OPT_READ_BUF,
OPT_V_ENUM,
OPT_X_ENUM,
OPT_S_ENUM,
OPT_FALLBACKSCSV, OPT_NOCMDS, OPT_PROXY, OPT_DANE_TLSA_DOMAIN,
+#ifndef OPENSSL_NO_CT
+ OPT_NOCT, OPT_REQUESTCT, OPT_REQUIRECT, OPT_CTLOG_FILE,
+#endif
OPT_DANE_TLSA_RRDATA
} OPTION_CHOICE;
"Enable ALPN extension, considering named protocols supported (comma-separated list)"},
{"async", OPT_ASYNC, '-', "Support asynchronous operation"},
{"ssl_config", OPT_SSL_CONFIG, 's', "Use specified configuration file"},
+ {"split_send_frag", OPT_SPLIT_SEND_FRAG, 'n',
+ "Size used to split data for encrypt pipelines"},
+ {"max_pipelines", OPT_MAX_PIPELINES, 'n',
+ "Maximum number of encrypt/decrypt pipelines to be used"},
+ {"read_buf", OPT_READ_BUF, 'n',
+ "Default read buffer size to be used for connections"},
OPT_S_OPTIONS,
OPT_V_OPTIONS,
OPT_X_OPTIONS,
#ifdef WATT32
{"wdebug", OPT_WDEBUG, '-', "WATT-32 tcp debugging"},
#endif
-#ifdef FIONBIO
{"nbio", OPT_NBIO, '-', "Use non-blocking IO"},
-#endif
#ifndef OPENSSL_NO_PSK
{"psk_identity", OPT_PSK_IDENTITY, 's', "PSK identity"},
{"psk", OPT_PSK, 's', "PSK in hex (without 0x)"},
{"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
{"ssl_client_engine", OPT_SSL_CLIENT_ENGINE, 's',
"Specify engine to be used for client certificate operations"},
+#endif
+#ifndef OPENSSL_NO_CT
+ {"noct", OPT_NOCT, '-', "Do not request or parse SCTs (default)"},
+ {"requestct", OPT_REQUESTCT, '-', "Request SCTs (enables OCSP stapling)"},
+ {"requirect", OPT_REQUIRECT, '-', "Require at least 1 SCT (enables OCSP stapling)"},
+ {"ctlogfile", OPT_CTLOG_FILE, '<', "CT log list CONF file"},
#endif
{NULL}
};
int socket_family = AF_UNSPEC, socket_type = SOCK_STREAM;
int starttls_proto = PROTO_OFF, crl_format = FORMAT_PEM, crl_download = 0;
int write_tty, read_tty, write_ssl, read_ssl, tty_on, ssl_pending;
+ int read_buf_len = 0;
int fallback_scsv = 0;
long socket_mtu = 0, randamt = 0;
OPTION_CHOICE o;
char *srppass = NULL;
int srp_lateuser = 0;
SRP_ARG srp_arg = { NULL, NULL, 0, 0, 0, 1024 };
+#endif
+#ifndef OPENSSL_NO_CT
+ char *ctlog_file = NULL;
+ ct_validation_cb ct_validation = NULL;
+#endif
+
+ FD_ZERO(&readfds);
+ FD_ZERO(&writefds);
+/* Known false-positive of MemorySanitizer. */
+#if defined(__has_feature)
+# if __has_feature(memory_sanitizer)
+ __msan_unpoison(&readfds, sizeof(readfds));
+ __msan_unpoison(&writefds, sizeof(writefds));
+# endif
#endif
prog = opt_progname(argv[0]);
case OPT_NOCAFILE:
noCAfile = 1;
break;
+#ifndef OPENSSL_NO_CT
+ case OPT_NOCT:
+ ct_validation = NULL;
+ break;
+ case OPT_REQUESTCT:
+ ct_validation = CT_verify_no_bad_scts;
+ break;
+ case OPT_REQUIRECT:
+ ct_validation = CT_verify_at_least_one_good_sct;
+ break;
+ case OPT_CTLOG_FILE:
+ ctlog_file = opt_arg();
+ break;
+#endif
case OPT_CHAINCAFILE:
chCAfile = opt_arg();
break;
case OPT_ASYNC:
async = 1;
break;
+ case OPT_SPLIT_SEND_FRAG:
+ split_send_fragment = atoi(opt_arg());
+ if (split_send_fragment == 0) {
+ /*
+ * Not allowed - set to a deliberately bad value so we get an
+ * error message below
+ */
+ split_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH + 1;
+ }
+ break;
+ case OPT_MAX_PIPELINES:
+ max_pipelines = atoi(opt_arg());
+ break;
+ case OPT_READ_BUF:
+ read_buf_len = atoi(opt_arg());
+ break;
}
}
argc = opt_num_rest();
- argv = opt_rest();
+ if (argc != 0)
+ goto opthelp;
if (proxystr) {
int res;
goto end;
}
+ if (split_send_fragment > SSL3_RT_MAX_PLAIN_LENGTH) {
+ BIO_printf(bio_err, "Bad split send fragment size\n");
+ goto end;
+ }
+
+ if (max_pipelines > SSL_MAX_PIPELINES) {
+ BIO_printf(bio_err, "Bad max pipelines value\n");
+ goto end;
+ }
+
#if !defined(OPENSSL_NO_NEXTPROTONEG)
next_proto.status = -1;
if (next_proto_neg_in) {
}
if (cert_file) {
- cert = load_cert(cert_file, cert_format,
- NULL, e, "client certificate file");
+ cert = load_cert(cert_file, cert_format, "client certificate file");
if (cert == NULL) {
ERR_print_errors(bio_err);
goto end;
}
if (chain_file) {
- if (!load_certs(chain_file, &chain, FORMAT_PEM, NULL, e,
+ if (!load_certs(chain_file, &chain, FORMAT_PEM, NULL,
"client certificate chain"))
goto end;
}
if (async) {
SSL_CTX_set_mode(ctx, SSL_MODE_ASYNC);
}
+ if (split_send_fragment > 0) {
+ SSL_CTX_set_split_send_fragment(ctx, split_send_fragment);
+ }
+ if (max_pipelines > 0) {
+ SSL_CTX_set_max_pipelines(ctx, max_pipelines);
+ }
+
+ if (read_buf_len > 0) {
+ SSL_CTX_set_default_read_buffer_len(ctx, read_buf_len);
+ }
if (!config_ctx(cctx, ssl_args, ctx))
goto end;
SSL_CTX_set_next_proto_select_cb(ctx, next_proto_cb, &next_proto);
#endif
if (alpn_in) {
- unsigned short alpn_len;
+ size_t alpn_len;
unsigned char *alpn = next_protos_parse(&alpn_len, alpn_in);
if (alpn == NULL) {
if (state)
SSL_CTX_set_info_callback(ctx, apps_ssl_info_callback);
+#ifndef OPENSSL_NO_CT
+ if (!SSL_CTX_set_ct_validation_callback(ctx, ct_validation, NULL)) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+
+ if (!ctx_set_ctlog_list_file(ctx, ctlog_file)) {
+ if (ct_validation != NULL) {
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+
+ /*
+ * If CT validation is not enabled, the log list isn't needed so don't
+ * show errors or abort. We try to load it regardless because then we
+ * can show the names of the logs any SCTs came from (SCTs may be seen
+ * even with validation disabled).
+ */
+ ERR_clear_error();
+ }
+#endif
+
SSL_CTX_set_verify(ctx, verify, verify_callback);
if (!ctx_set_verify_locations(ctx, CAfile, CApath, noCAfile, noCApath)) {
if (init_client(&s, host, port, socket_family, socket_type) == 0)
{
BIO_printf(bio_err, "connect:errno=%d\n", get_last_socket_error());
- SHUTDOWN(s);
+ BIO_closesocket(s);
goto end;
}
BIO_printf(bio_c_out, "CONNECTED(%08X)\n", s);
-#ifdef FIONBIO
if (c_nbio) {
- unsigned long l = 1;
- BIO_printf(bio_c_out, "turning on non blocking io\n");
- if (BIO_socket_ioctl(s, FIONBIO, &l) < 0) {
+ if (!BIO_socket_nbio(s, 1)) {
ERR_print_errors(bio_err);
goto end;
}
+ BIO_printf(bio_c_out, "Turned on non blocking io\n");
}
-#endif
if (socket_type == SOCK_DGRAM) {
sbio = BIO_new_dgram(s, BIO_NOCLOSE);
if (getsockname(s, &peer, (void *)&peerlen) < 0) {
BIO_printf(bio_err, "getsockname:errno=%d\n",
get_last_socket_error());
- SHUTDOWN(s);
+ BIO_closesocket(s);
goto end;
}
"drop connection and then reconnect\n");
do_ssl_shutdown(con);
SSL_set_connect_state(con);
- SHUTDOWN(SSL_get_fd(con));
+ BIO_closesocket(SSL_get_fd(con));
goto re_start;
}
}
}
- ssl_pending = read_ssl && SSL_pending(con);
+ ssl_pending = read_ssl && SSL_has_pending(con);
if (!ssl_pending) {
#if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_NETWARE)
if (in_init)
print_stuff(bio_c_out, con, full_log);
do_ssl_shutdown(con);
- SHUTDOWN(SSL_get_fd(con));
+ BIO_closesocket(SSL_get_fd(con));
end:
if (con != NULL) {
if (prexit != 0)
const COMP_METHOD *comp, *expansion;
#endif
unsigned char *exportedkeymat;
+#ifndef OPENSSL_NO_CT
+ const STACK_OF(SCT) *scts;
+#endif
if (full) {
int got_a_chain = 0;
ssl_print_sigalgs(bio, s);
ssl_print_tmp_key(bio, s);
+#ifndef OPENSSL_NO_CT
+ scts = SSL_get0_peer_scts(s);
+ BIO_printf(bio, "---\nSCTs present (%i)\n",
+ scts != NULL ? sk_SCT_num(scts) : 0);
+
+ if (SSL_get_ct_validation_callback(s) == NULL) {
+ BIO_printf(bio, "Warning: CT validation is disabled, so not all "
+ "SCTs may be displayed. Re-run with \"-requestct\".\n");
+ }
+
+ if (scts != NULL && sk_SCT_num(scts) > 0) {
+ BIO_printf(bio, "---\n");
+ SCT_LIST_print(scts, bio, 0, "\n---\n");
+ BIO_printf(bio, "\n");
+ }
+#endif
+
BIO_printf(bio,
"---\nSSL handshake has read %"PRIu64" bytes and written %"PRIu64" bytes\n",
BIO_number_read(SSL_get_rbio(s)),
projects / openssl.git / blobdiff