s_client.c revision 296465
1/* apps/s_client.c */ 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3 * All rights reserved. 4 * 5 * This package is an SSL implementation written 6 * by Eric Young (eay@cryptsoft.com). 7 * The implementation was written so as to conform with Netscapes SSL. 8 * 9 * This library is free for commercial and non-commercial use as long as 10 * the following conditions are aheared to. The following conditions 11 * apply to all code found in this distribution, be it the RC4, RSA, 12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13 * included with this distribution is covered by the same copyright terms 14 * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15 * 16 * Copyright remains Eric Young's, and as such any Copyright notices in 17 * the code are not to be removed. 18 * If this package is used in a product, Eric Young should be given attribution 19 * as the author of the parts of the library used. 20 * This can be in the form of a textual message at program startup or 21 * in documentation (online or textual) provided with the package. 22 * 23 * Redistribution and use in source and binary forms, with or without 24 * modification, are permitted provided that the following conditions 25 * are met: 26 * 1. Redistributions of source code must retain the copyright 27 * notice, this list of conditions and the following disclaimer. 28 * 2. Redistributions in binary form must reproduce the above copyright 29 * notice, this list of conditions and the following disclaimer in the 30 * documentation and/or other materials provided with the distribution. 31 * 3. All advertising materials mentioning features or use of this software 32 * must display the following acknowledgement: 33 * "This product includes cryptographic software written by 34 * Eric Young (eay@cryptsoft.com)" 35 * The word 'cryptographic' can be left out if the rouines from the library 36 * being used are not cryptographic related :-). 37 * 4. If you include any Windows specific code (or a derivative thereof) from 38 * the apps directory (application code) you must include an acknowledgement: 39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40 * 41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51 * SUCH DAMAGE. 52 * 53 * The licence and distribution terms for any publically available version or 54 * derivative of this code cannot be changed. i.e. this code cannot simply be 55 * copied and put under another distribution licence 56 * [including the GNU Public Licence.] 57 */ 58/* ==================================================================== 59 * Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved. 60 * 61 * Redistribution and use in source and binary forms, with or without 62 * modification, are permitted provided that the following conditions 63 * are met: 64 * 65 * 1. Redistributions of source code must retain the above copyright 66 * notice, this list of conditions and the following disclaimer. 67 * 68 * 2. Redistributions in binary form must reproduce the above copyright 69 * notice, this list of conditions and the following disclaimer in 70 * the documentation and/or other materials provided with the 71 * distribution. 72 * 73 * 3. All advertising materials mentioning features or use of this 74 * software must display the following acknowledgment: 75 * "This product includes software developed by the OpenSSL Project 76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 77 * 78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 79 * endorse or promote products derived from this software without 80 * prior written permission. For written permission, please contact 81 * openssl-core@openssl.org. 82 * 83 * 5. Products derived from this software may not be called "OpenSSL" 84 * nor may "OpenSSL" appear in their names without prior written 85 * permission of the OpenSSL Project. 86 * 87 * 6. Redistributions of any form whatsoever must retain the following 88 * acknowledgment: 89 * "This product includes software developed by the OpenSSL Project 90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 91 * 92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 103 * OF THE POSSIBILITY OF SUCH DAMAGE. 104 * ==================================================================== 105 * 106 * This product includes cryptographic software written by Eric Young 107 * (eay@cryptsoft.com). This product includes software written by Tim 108 * Hudson (tjh@cryptsoft.com). 109 * 110 */ 111 112#include <assert.h> 113#include <stdio.h> 114#include <stdlib.h> 115#include <string.h> 116#include <openssl/e_os2.h> 117#ifdef OPENSSL_NO_STDIO 118# define APPS_WIN16 119#endif 120 121/* 122 * With IPv6, it looks like Digital has mixed up the proper order of 123 * recursive header file inclusion, resulting in the compiler complaining 124 * that u_int isn't defined, but only if _POSIX_C_SOURCE is defined, which is 125 * needed to have fileno() declared correctly... So let's define u_int 126 */ 127#if defined(OPENSSL_SYS_VMS_DECC) && !defined(__U_INT) 128# define __U_INT 129typedef unsigned int u_int; 130#endif 131 132#define USE_SOCKETS 133#include "apps.h" 134#include <openssl/x509.h> 135#include <openssl/ssl.h> 136#include <openssl/err.h> 137#include <openssl/pem.h> 138#include <openssl/rand.h> 139#include <openssl/ocsp.h> 140#include "s_apps.h" 141#include "timeouts.h" 142 143#ifdef OPENSSL_SYS_WINCE 144/* 145 * Windows CE incorrectly defines fileno as returning void*, so to avoid 146 * problems below... 147 */ 148# ifdef fileno 149# undef fileno 150# endif 151# define fileno(a) (int)_fileno(a) 152#endif 153 154#if (defined(OPENSSL_SYS_VMS) && __VMS_VER < 70000000) 155/* FIONBIO used as a switch to enable ioctl, and that isn't in VMS < 7.0 */ 156# undef FIONBIO 157#endif 158 159#undef PROG 160#define PROG s_client_main 161 162/* 163 * #define SSL_HOST_NAME "www.netscape.com" 164 */ 165/* 166 * #define SSL_HOST_NAME "193.118.187.102" 167 */ 168#define SSL_HOST_NAME "localhost" 169 170/* no default cert. */ 171/* 172 * #define TEST_CERT "client.pem" 173 */ 174 175#undef BUFSIZZ 176#define BUFSIZZ 1024*8 177 178extern int verify_depth; 179extern int verify_error; 180 181#ifdef FIONBIO 182static int c_nbio = 0; 183#endif 184static int c_Pause = 0; 185static int c_debug = 0; 186#ifndef OPENSSL_NO_TLSEXT 187static int c_tlsextdebug = 0; 188static int c_status_req = 0; 189#endif 190static int c_msg = 0; 191static int c_showcerts = 0; 192 193static void sc_usage(void); 194static void print_stuff(BIO *berr, SSL *con, int full); 195#ifndef OPENSSL_NO_TLSEXT 196static int ocsp_resp_cb(SSL *s, void *arg); 197#endif 198static BIO *bio_c_out = NULL; 199static int c_quiet = 0; 200static int c_ign_eof = 0; 201 202static void sc_usage(void) 203{ 204 BIO_printf(bio_err, "usage: s_client args\n"); 205 BIO_printf(bio_err, "\n"); 206 BIO_printf(bio_err, " -host host - use -connect instead\n"); 207 BIO_printf(bio_err, " -port port - use -connect instead\n"); 208 BIO_printf(bio_err, 209 " -connect host:port - who to connect to (default is %s:%s)\n", 210 SSL_HOST_NAME, PORT_STR); 211 212 BIO_printf(bio_err, 213 " -verify depth - turn on peer certificate verification\n"); 214 BIO_printf(bio_err, 215 " -cert arg - certificate file to use, PEM format assumed\n"); 216 BIO_printf(bio_err, 217 " -certform arg - certificate format (PEM or DER) PEM default\n"); 218 BIO_printf(bio_err, 219 " -key arg - Private key file to use, in cert file if\n"); 220 BIO_printf(bio_err, " not specified but cert file is.\n"); 221 BIO_printf(bio_err, 222 " -keyform arg - key format (PEM or DER) PEM default\n"); 223 BIO_printf(bio_err, 224 " -pass arg - private key file pass phrase source\n"); 225 BIO_printf(bio_err, " -CApath arg - PEM format directory of CA's\n"); 226 BIO_printf(bio_err, " -CAfile arg - PEM format file of CA's\n"); 227 BIO_printf(bio_err, 228 " -reconnect - Drop and re-make the connection with the same Session-ID\n"); 229 BIO_printf(bio_err, 230 " -pause - sleep(1) after each read(2) and write(2) system call\n"); 231 BIO_printf(bio_err, 232 " -showcerts - show all certificates in the chain\n"); 233 BIO_printf(bio_err, " -debug - extra output\n"); 234#ifdef WATT32 235 BIO_printf(bio_err, " -wdebug - WATT-32 tcp debugging\n"); 236#endif 237 BIO_printf(bio_err, " -msg - Show protocol messages\n"); 238 BIO_printf(bio_err, " -nbio_test - more ssl protocol testing\n"); 239 BIO_printf(bio_err, " -state - print the 'ssl' states\n"); 240#ifdef FIONBIO 241 BIO_printf(bio_err, " -nbio - Run with non-blocking IO\n"); 242#endif 243 BIO_printf(bio_err, 244 " -crlf - convert LF from terminal into CRLF\n"); 245 BIO_printf(bio_err, " -quiet - no s_client output\n"); 246 BIO_printf(bio_err, 247 " -ign_eof - ignore input eof (default when -quiet)\n"); 248 BIO_printf(bio_err, " -no_ign_eof - don't ignore input eof\n"); 249 BIO_printf(bio_err, " -ssl2 - just use SSLv2\n"); 250 BIO_printf(bio_err, " -ssl3 - just use SSLv3\n"); 251 BIO_printf(bio_err, " -tls1 - just use TLSv1\n"); 252 BIO_printf(bio_err, " -dtls1 - just use DTLSv1\n"); 253 BIO_printf(bio_err, " -fallback_scsv - send TLS_FALLBACK_SCSV\n"); 254 BIO_printf(bio_err, " -mtu - set the link layer MTU\n"); 255 BIO_printf(bio_err, 256 " -no_tls1/-no_ssl3/-no_ssl2 - turn off that protocol\n"); 257 BIO_printf(bio_err, 258 " -bugs - Switch on all SSL implementation bug workarounds\n"); 259 BIO_printf(bio_err, 260 " -serverpref - Use server's cipher preferences (only SSLv2)\n"); 261 BIO_printf(bio_err, 262 " -cipher - preferred cipher to use, use the 'openssl ciphers'\n"); 263 BIO_printf(bio_err, 264 " command to see what is available\n"); 265 BIO_printf(bio_err, 266 " -starttls prot - use the STARTTLS command before starting TLS\n"); 267 BIO_printf(bio_err, 268 " for those protocols that support it, where\n"); 269 BIO_printf(bio_err, 270 " 'prot' defines which one to assume. Currently,\n"); 271 BIO_printf(bio_err, 272 " only \"smtp\", \"pop3\", \"imap\", \"ftp\" and \"xmpp\"\n"); 273 BIO_printf(bio_err, " are supported.\n"); 274#ifndef OPENSSL_NO_ENGINE 275 BIO_printf(bio_err, 276 " -engine id - Initialise and use the specified engine\n"); 277#endif 278 BIO_printf(bio_err, " -rand file%cfile%c...\n", LIST_SEPARATOR_CHAR, 279 LIST_SEPARATOR_CHAR); 280 BIO_printf(bio_err, " -sess_out arg - file to write SSL session to\n"); 281 BIO_printf(bio_err, " -sess_in arg - file to read SSL session from\n"); 282#ifndef OPENSSL_NO_TLSEXT 283 BIO_printf(bio_err, 284 " -servername host - Set TLS extension servername in ClientHello\n"); 285 BIO_printf(bio_err, 286 " -tlsextdebug - hex dump of all TLS extensions received\n"); 287 BIO_printf(bio_err, 288 " -status - request certificate status from server\n"); 289 BIO_printf(bio_err, 290 " -no_ticket - disable use of RFC4507bis session tickets\n"); 291#endif 292 BIO_printf(bio_err, 293 " -legacy_renegotiation - enable use of legacy renegotiation (dangerous)\n"); 294} 295 296#ifndef OPENSSL_NO_TLSEXT 297 298/* This is a context that we pass to callbacks */ 299typedef struct tlsextctx_st { 300 BIO *biodebug; 301 int ack; 302} tlsextctx; 303 304static int MS_CALLBACK ssl_servername_cb(SSL *s, int *ad, void *arg) 305{ 306 tlsextctx *p = (tlsextctx *) arg; 307 const char *hn = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name); 308 if (SSL_get_servername_type(s) != -1) 309 p->ack = !SSL_session_reused(s) && hn != NULL; 310 else 311 BIO_printf(bio_err, "Can't use SSL_get_servername\n"); 312 313 return SSL_TLSEXT_ERR_OK; 314} 315#endif 316enum { 317 PROTO_OFF = 0, 318 PROTO_SMTP, 319 PROTO_POP3, 320 PROTO_IMAP, 321 PROTO_FTP, 322 PROTO_XMPP 323}; 324 325int MAIN(int, char **); 326 327int MAIN(int argc, char **argv) 328{ 329 int off = 0, clr = 0; 330 SSL *con = NULL, *con2 = NULL; 331 X509_STORE *store = NULL; 332 int s, k, width, state = 0; 333 char *cbuf = NULL, *sbuf = NULL, *mbuf = NULL; 334 int cbuf_len, cbuf_off; 335 int sbuf_len, sbuf_off; 336 fd_set readfds, writefds; 337 short port = PORT; 338 int full_log = 1; 339 char *host = SSL_HOST_NAME; 340 char *cert_file = NULL, *key_file = NULL; 341 int cert_format = FORMAT_PEM, key_format = FORMAT_PEM; 342 char *passarg = NULL, *pass = NULL; 343 X509 *cert = NULL; 344 EVP_PKEY *key = NULL; 345 char *CApath = NULL, *CAfile = NULL, *cipher = NULL; 346 int reconnect = 0, badop = 0, verify = SSL_VERIFY_NONE, bugs = 0; 347 int crlf = 0; 348 int write_tty, read_tty, write_ssl, read_ssl, tty_on, ssl_pending; 349 SSL_CTX *ctx = NULL; 350 int ret = 1, in_init = 1, i, nbio_test = 0; 351 int starttls_proto = PROTO_OFF; 352 int prexit = 0, vflags = 0; 353 SSL_METHOD *meth = NULL; 354#ifdef sock_type 355# undef sock_type 356#endif 357 int sock_type = SOCK_STREAM; 358 BIO *sbio; 359 char *inrand = NULL; 360 int mbuf_len = 0; 361 struct timeval timeout, *timeoutp; 362#ifndef OPENSSL_NO_ENGINE 363 char *engine_id = NULL; 364 char *ssl_client_engine_id = NULL; 365 ENGINE *ssl_client_engine = NULL; 366#endif 367 ENGINE *e = NULL; 368#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE) 369 struct timeval tv; 370#endif 371 372#ifndef OPENSSL_NO_TLSEXT 373 char *servername = NULL; 374 tlsextctx tlsextcbp = { NULL, 0 }; 375#endif 376 char *sess_in = NULL; 377 char *sess_out = NULL; 378 struct sockaddr peer; 379 int peerlen = sizeof(peer); 380 int fallback_scsv = 0; 381 int enable_timeouts = 0; 382 long socket_mtu = 0; 383#ifndef OPENSSL_NO_JPAKE 384 char *jpake_secret = NULL; 385#endif 386 387 meth = SSLv23_client_method(); 388 389 apps_startup(); 390 c_Pause = 0; 391 c_quiet = 0; 392 c_ign_eof = 0; 393 c_debug = 0; 394 c_msg = 0; 395 c_showcerts = 0; 396 397 if (bio_err == NULL) 398 bio_err = BIO_new_fp(stderr, BIO_NOCLOSE); 399 400 if (!load_config(bio_err, NULL)) 401 goto end; 402 403 if (((cbuf = OPENSSL_malloc(BUFSIZZ)) == NULL) || 404 ((sbuf = OPENSSL_malloc(BUFSIZZ)) == NULL) || 405 ((mbuf = OPENSSL_malloc(BUFSIZZ)) == NULL)) { 406 BIO_printf(bio_err, "out of memory\n"); 407 goto end; 408 } 409 410 verify_depth = 0; 411 verify_error = X509_V_OK; 412#ifdef FIONBIO 413 c_nbio = 0; 414#endif 415 416 argc--; 417 argv++; 418 while (argc >= 1) { 419 if (strcmp(*argv, "-host") == 0) { 420 if (--argc < 1) 421 goto bad; 422 host = *(++argv); 423 } else if (strcmp(*argv, "-port") == 0) { 424 if (--argc < 1) 425 goto bad; 426 port = atoi(*(++argv)); 427 if (port == 0) 428 goto bad; 429 } else if (strcmp(*argv, "-connect") == 0) { 430 if (--argc < 1) 431 goto bad; 432 if (!extract_host_port(*(++argv), &host, NULL, &port)) 433 goto bad; 434 } else if (strcmp(*argv, "-verify") == 0) { 435 verify = SSL_VERIFY_PEER; 436 if (--argc < 1) 437 goto bad; 438 verify_depth = atoi(*(++argv)); 439 BIO_printf(bio_err, "verify depth is %d\n", verify_depth); 440 } else if (strcmp(*argv, "-cert") == 0) { 441 if (--argc < 1) 442 goto bad; 443 cert_file = *(++argv); 444 } else if (strcmp(*argv, "-sess_out") == 0) { 445 if (--argc < 1) 446 goto bad; 447 sess_out = *(++argv); 448 } else if (strcmp(*argv, "-sess_in") == 0) { 449 if (--argc < 1) 450 goto bad; 451 sess_in = *(++argv); 452 } else if (strcmp(*argv, "-certform") == 0) { 453 if (--argc < 1) 454 goto bad; 455 cert_format = str2fmt(*(++argv)); 456 } else if (strcmp(*argv, "-crl_check") == 0) 457 vflags |= X509_V_FLAG_CRL_CHECK; 458 else if (strcmp(*argv, "-crl_check_all") == 0) 459 vflags |= X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL; 460 else if (strcmp(*argv, "-prexit") == 0) 461 prexit = 1; 462 else if (strcmp(*argv, "-crlf") == 0) 463 crlf = 1; 464 else if (strcmp(*argv, "-quiet") == 0) { 465 c_quiet = 1; 466 c_ign_eof = 1; 467 } else if (strcmp(*argv, "-ign_eof") == 0) 468 c_ign_eof = 1; 469 else if (strcmp(*argv, "-no_ign_eof") == 0) 470 c_ign_eof = 0; 471 else if (strcmp(*argv, "-pause") == 0) 472 c_Pause = 1; 473 else if (strcmp(*argv, "-debug") == 0) 474 c_debug = 1; 475#ifndef OPENSSL_NO_TLSEXT 476 else if (strcmp(*argv, "-tlsextdebug") == 0) 477 c_tlsextdebug = 1; 478 else if (strcmp(*argv, "-status") == 0) 479 c_status_req = 1; 480#endif 481#ifdef WATT32 482 else if (strcmp(*argv, "-wdebug") == 0) 483 dbug_init(); 484#endif 485 else if (strcmp(*argv, "-msg") == 0) 486 c_msg = 1; 487 else if (strcmp(*argv, "-showcerts") == 0) 488 c_showcerts = 1; 489 else if (strcmp(*argv, "-nbio_test") == 0) 490 nbio_test = 1; 491 else if (strcmp(*argv, "-state") == 0) 492 state = 1; 493#ifndef OPENSSL_NO_SSL2 494 else if (strcmp(*argv, "-ssl2") == 0) 495 meth = SSLv2_client_method(); 496#endif 497#ifndef OPENSSL_NO_SSL3 498 else if (strcmp(*argv, "-ssl3") == 0) 499 meth = SSLv3_client_method(); 500#endif 501#ifndef OPENSSL_NO_TLS1 502 else if (strcmp(*argv, "-tls1") == 0) 503 meth = TLSv1_client_method(); 504#endif 505#ifndef OPENSSL_NO_DTLS1 506 else if (strcmp(*argv, "-dtls1") == 0) { 507 meth = DTLSv1_client_method(); 508 sock_type = SOCK_DGRAM; 509 } else if (strcmp(*argv, "-timeout") == 0) 510 enable_timeouts = 1; 511 else if (strcmp(*argv, "-mtu") == 0) { 512 if (--argc < 1) 513 goto bad; 514 socket_mtu = atol(*(++argv)); 515 } 516#endif 517 else if (strcmp(*argv, "-fallback_scsv") == 0) { 518 fallback_scsv = 1; 519 } else if (strcmp(*argv, "-bugs") == 0) 520 bugs = 1; 521 else if (strcmp(*argv, "-keyform") == 0) { 522 if (--argc < 1) 523 goto bad; 524 key_format = str2fmt(*(++argv)); 525 } else if (strcmp(*argv, "-pass") == 0) { 526 if (--argc < 1) 527 goto bad; 528 passarg = *(++argv); 529 } else if (strcmp(*argv, "-key") == 0) { 530 if (--argc < 1) 531 goto bad; 532 key_file = *(++argv); 533 } else if (strcmp(*argv, "-reconnect") == 0) { 534 reconnect = 5; 535 } else if (strcmp(*argv, "-CApath") == 0) { 536 if (--argc < 1) 537 goto bad; 538 CApath = *(++argv); 539 } else if (strcmp(*argv, "-CAfile") == 0) { 540 if (--argc < 1) 541 goto bad; 542 CAfile = *(++argv); 543 } else if (strcmp(*argv, "-no_tls1") == 0) 544 off |= SSL_OP_NO_TLSv1; 545 else if (strcmp(*argv, "-no_ssl3") == 0) 546 off |= SSL_OP_NO_SSLv3; 547 else if (strcmp(*argv, "-no_ssl2") == 0) 548 off |= SSL_OP_NO_SSLv2; 549#ifndef OPENSSL_NO_TLSEXT 550 else if (strcmp(*argv, "-no_ticket") == 0) { 551 off |= SSL_OP_NO_TICKET; 552 } 553#endif 554 else if (strcmp(*argv, "-serverpref") == 0) 555 off |= SSL_OP_CIPHER_SERVER_PREFERENCE; 556 else if (strcmp(*argv, "-legacy_renegotiation") == 0) 557 off |= SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION; 558 else if (strcmp(*argv, "-legacy_server_connect") == 0) { 559 off |= SSL_OP_LEGACY_SERVER_CONNECT; 560 } else if (strcmp(*argv, "-no_legacy_server_connect") == 0) { 561 clr |= SSL_OP_LEGACY_SERVER_CONNECT; 562 } else if (strcmp(*argv, "-cipher") == 0) { 563 if (--argc < 1) 564 goto bad; 565 cipher = *(++argv); 566 } 567#ifdef FIONBIO 568 else if (strcmp(*argv, "-nbio") == 0) { 569 c_nbio = 1; 570 } 571#endif 572 else if (strcmp(*argv, "-starttls") == 0) { 573 if (--argc < 1) 574 goto bad; 575 ++argv; 576 if (strcmp(*argv, "smtp") == 0) 577 starttls_proto = PROTO_SMTP; 578 else if (strcmp(*argv, "pop3") == 0) 579 starttls_proto = PROTO_POP3; 580 else if (strcmp(*argv, "imap") == 0) 581 starttls_proto = PROTO_IMAP; 582 else if (strcmp(*argv, "ftp") == 0) 583 starttls_proto = PROTO_FTP; 584 else if (strcmp(*argv, "xmpp") == 0) 585 starttls_proto = PROTO_XMPP; 586 else 587 goto bad; 588 } 589#ifndef OPENSSL_NO_ENGINE 590 else if (strcmp(*argv, "-engine") == 0) { 591 if (--argc < 1) 592 goto bad; 593 engine_id = *(++argv); 594 } else if (strcmp(*argv, "-ssl_client_engine") == 0) { 595 if (--argc < 1) 596 goto bad; 597 ssl_client_engine_id = *(++argv); 598 } 599#endif 600 else if (strcmp(*argv, "-rand") == 0) { 601 if (--argc < 1) 602 goto bad; 603 inrand = *(++argv); 604 } 605#ifndef OPENSSL_NO_TLSEXT 606 else if (strcmp(*argv, "-servername") == 0) { 607 if (--argc < 1) 608 goto bad; 609 servername = *(++argv); 610 /* meth=TLSv1_client_method(); */ 611 } 612#endif 613#ifndef OPENSSL_NO_JPAKE 614 else if (strcmp(*argv, "-jpake") == 0) { 615 if (--argc < 1) 616 goto bad; 617 jpake_secret = *++argv; 618 } 619#endif 620 else { 621 BIO_printf(bio_err, "unknown option %s\n", *argv); 622 badop = 1; 623 break; 624 } 625 argc--; 626 argv++; 627 } 628 if (badop) { 629 bad: 630 sc_usage(); 631 goto end; 632 } 633 634 OpenSSL_add_ssl_algorithms(); 635 SSL_load_error_strings(); 636 637#ifndef OPENSSL_NO_ENGINE 638 e = setup_engine(bio_err, engine_id, 1); 639 if (ssl_client_engine_id) { 640 ssl_client_engine = ENGINE_by_id(ssl_client_engine_id); 641 if (!ssl_client_engine) { 642 BIO_printf(bio_err, "Error getting client auth engine\n"); 643 goto end; 644 } 645 } 646#endif 647 if (!app_passwd(bio_err, passarg, NULL, &pass, NULL)) { 648 BIO_printf(bio_err, "Error getting password\n"); 649 goto end; 650 } 651 652 if (key_file == NULL) 653 key_file = cert_file; 654 655 if (key_file) { 656 657 key = load_key(bio_err, key_file, key_format, 0, pass, e, 658 "client certificate private key file"); 659 if (!key) { 660 ERR_print_errors(bio_err); 661 goto end; 662 } 663 664 } 665 666 if (cert_file) { 667 cert = load_cert(bio_err, cert_file, cert_format, 668 NULL, e, "client certificate file"); 669 670 if (!cert) { 671 ERR_print_errors(bio_err); 672 goto end; 673 } 674 } 675 676 if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL 677 && !RAND_status()) { 678 BIO_printf(bio_err, 679 "warning, not much extra random data, consider using the -rand option\n"); 680 } 681 if (inrand != NULL) 682 BIO_printf(bio_err, "%ld semi-random bytes loaded\n", 683 app_RAND_load_files(inrand)); 684 685 if (bio_c_out == NULL) { 686 if (c_quiet && !c_debug && !c_msg) { 687 bio_c_out = BIO_new(BIO_s_null()); 688 } else { 689 if (bio_c_out == NULL) 690 bio_c_out = BIO_new_fp(stdout, BIO_NOCLOSE); 691 } 692 } 693 694 ctx = SSL_CTX_new(meth); 695 if (ctx == NULL) { 696 ERR_print_errors(bio_err); 697 goto end; 698 } 699#ifndef OPENSSL_NO_ENGINE 700 if (ssl_client_engine) { 701 if (!SSL_CTX_set_client_cert_engine(ctx, ssl_client_engine)) { 702 BIO_puts(bio_err, "Error setting client auth engine\n"); 703 ERR_print_errors(bio_err); 704 ENGINE_free(ssl_client_engine); 705 goto end; 706 } 707 ENGINE_free(ssl_client_engine); 708 } 709#endif 710 711 if (bugs) 712 SSL_CTX_set_options(ctx, SSL_OP_ALL | off); 713 else 714 SSL_CTX_set_options(ctx, off); 715 716 if (clr) 717 SSL_CTX_clear_options(ctx, clr); 718 /* 719 * DTLS: partial reads end up discarding unread UDP bytes :-( Setting 720 * read ahead solves this problem. 721 */ 722 if (sock_type == SOCK_DGRAM) 723 SSL_CTX_set_read_ahead(ctx, 1); 724 725 if (state) 726 SSL_CTX_set_info_callback(ctx, apps_ssl_info_callback); 727 if (cipher != NULL) 728 if (!SSL_CTX_set_cipher_list(ctx, cipher)) { 729 BIO_printf(bio_err, "error setting cipher list\n"); 730 ERR_print_errors(bio_err); 731 goto end; 732 } 733#if 0 734 else 735 SSL_CTX_set_cipher_list(ctx, getenv("SSL_CIPHER")); 736#endif 737 738 SSL_CTX_set_verify(ctx, verify, verify_callback); 739 if (!set_cert_key_stuff(ctx, cert, key)) 740 goto end; 741 742 if ((!SSL_CTX_load_verify_locations(ctx, CAfile, CApath)) || 743 (!SSL_CTX_set_default_verify_paths(ctx))) { 744 /* 745 * BIO_printf(bio_err,"error setting default verify locations\n"); 746 */ 747 ERR_print_errors(bio_err); 748 /* goto end; */ 749 } 750 751 store = SSL_CTX_get_cert_store(ctx); 752 X509_STORE_set_flags(store, vflags); 753#ifndef OPENSSL_NO_TLSEXT 754 if (servername != NULL) { 755 tlsextcbp.biodebug = bio_err; 756 SSL_CTX_set_tlsext_servername_callback(ctx, ssl_servername_cb); 757 SSL_CTX_set_tlsext_servername_arg(ctx, &tlsextcbp); 758 } 759#endif 760 761 con = SSL_new(ctx); 762 if (sess_in) { 763 SSL_SESSION *sess; 764 BIO *stmp = BIO_new_file(sess_in, "r"); 765 if (!stmp) { 766 BIO_printf(bio_err, "Can't open session file %s\n", sess_in); 767 ERR_print_errors(bio_err); 768 goto end; 769 } 770 sess = PEM_read_bio_SSL_SESSION(stmp, NULL, 0, NULL); 771 BIO_free(stmp); 772 if (!sess) { 773 BIO_printf(bio_err, "Can't open session file %s\n", sess_in); 774 ERR_print_errors(bio_err); 775 goto end; 776 } 777 SSL_set_session(con, sess); 778 SSL_SESSION_free(sess); 779 } 780 781 if (fallback_scsv) 782 SSL_set_mode(con, SSL_MODE_SEND_FALLBACK_SCSV); 783 784#ifndef OPENSSL_NO_TLSEXT 785 if (servername != NULL) { 786 if (!SSL_set_tlsext_host_name(con, servername)) { 787 BIO_printf(bio_err, "Unable to set TLS servername extension.\n"); 788 ERR_print_errors(bio_err); 789 goto end; 790 } 791 } 792#endif 793 794#ifndef OPENSSL_NO_KRB5 795 if (con && (con->kssl_ctx = kssl_ctx_new()) != NULL) { 796 kssl_ctx_setstring(con->kssl_ctx, KSSL_SERVER, host); 797 } 798#endif /* OPENSSL_NO_KRB5 */ 799/* SSL_set_cipher_list(con,"RC4-MD5"); */ 800 801 re_start: 802 803 if (init_client(&s, host, port, sock_type) == 0) { 804 BIO_printf(bio_err, "connect:errno=%d\n", get_last_socket_error()); 805 SHUTDOWN(s); 806 goto end; 807 } 808 BIO_printf(bio_c_out, "CONNECTED(%08X)\n", s); 809 810#ifdef FIONBIO 811 if (c_nbio) { 812 unsigned long l = 1; 813 BIO_printf(bio_c_out, "turning on non blocking io\n"); 814 if (BIO_socket_ioctl(s, FIONBIO, &l) < 0) { 815 ERR_print_errors(bio_err); 816 goto end; 817 } 818 } 819#endif 820 if (c_Pause & 0x01) 821 con->debug = 1; 822 823 if (SSL_version(con) == DTLS1_VERSION) { 824 825 sbio = BIO_new_dgram(s, BIO_NOCLOSE); 826 if (getsockname(s, &peer, (void *)&peerlen) < 0) { 827 BIO_printf(bio_err, "getsockname:errno=%d\n", 828 get_last_socket_error()); 829 SHUTDOWN(s); 830 goto end; 831 } 832 833 (void)BIO_ctrl_set_connected(sbio, 1, &peer); 834 835 if (enable_timeouts) { 836 timeout.tv_sec = 0; 837 timeout.tv_usec = DGRAM_RCV_TIMEOUT; 838 BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_RECV_TIMEOUT, 0, &timeout); 839 840 timeout.tv_sec = 0; 841 timeout.tv_usec = DGRAM_SND_TIMEOUT; 842 BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_SEND_TIMEOUT, 0, &timeout); 843 } 844 845 if (socket_mtu > 28) { 846 SSL_set_options(con, SSL_OP_NO_QUERY_MTU); 847 SSL_set_mtu(con, socket_mtu - 28); 848 } else 849 /* want to do MTU discovery */ 850 BIO_ctrl(sbio, BIO_CTRL_DGRAM_MTU_DISCOVER, 0, NULL); 851 } else 852 sbio = BIO_new_socket(s, BIO_NOCLOSE); 853 854 if (nbio_test) { 855 BIO *test; 856 857 test = BIO_new(BIO_f_nbio_test()); 858 sbio = BIO_push(test, sbio); 859 } 860 861 if (c_debug) { 862 con->debug = 1; 863 BIO_set_callback(sbio, bio_dump_callback); 864 BIO_set_callback_arg(sbio, (char *)bio_c_out); 865 } 866 if (c_msg) { 867 SSL_set_msg_callback(con, msg_cb); 868 SSL_set_msg_callback_arg(con, bio_c_out); 869 } 870#ifndef OPENSSL_NO_TLSEXT 871 if (c_tlsextdebug) { 872 SSL_set_tlsext_debug_callback(con, tlsext_cb); 873 SSL_set_tlsext_debug_arg(con, bio_c_out); 874 } 875 if (c_status_req) { 876 SSL_set_tlsext_status_type(con, TLSEXT_STATUSTYPE_ocsp); 877 SSL_CTX_set_tlsext_status_cb(ctx, ocsp_resp_cb); 878 SSL_CTX_set_tlsext_status_arg(ctx, bio_c_out); 879# if 0 880 { 881 STACK_OF(OCSP_RESPID) *ids = sk_OCSP_RESPID_new_null(); 882 OCSP_RESPID *id = OCSP_RESPID_new(); 883 id->value.byKey = ASN1_OCTET_STRING_new(); 884 id->type = V_OCSP_RESPID_KEY; 885 ASN1_STRING_set(id->value.byKey, "Hello World", -1); 886 sk_OCSP_RESPID_push(ids, id); 887 SSL_set_tlsext_status_ids(con, ids); 888 } 889# endif 890 } 891#endif 892#ifndef OPENSSL_NO_JPAKE 893 if (jpake_secret) 894 jpake_client_auth(bio_c_out, sbio, jpake_secret); 895#endif 896 897 SSL_set_bio(con, sbio, sbio); 898 SSL_set_connect_state(con); 899 900 /* ok, lets connect */ 901 width = SSL_get_fd(con) + 1; 902 903 read_tty = 1; 904 write_tty = 0; 905 tty_on = 0; 906 read_ssl = 1; 907 write_ssl = 1; 908 909 cbuf_len = 0; 910 cbuf_off = 0; 911 sbuf_len = 0; 912 sbuf_off = 0; 913 914 /* This is an ugly hack that does a lot of assumptions */ 915 /* 916 * We do have to handle multi-line responses which may come in a single 917 * packet or not. We therefore have to use BIO_gets() which does need a 918 * buffering BIO. So during the initial chitchat we do push a buffering 919 * BIO into the chain that is removed again later on to not disturb the 920 * rest of the s_client operation. 921 */ 922 if (starttls_proto == PROTO_SMTP) { 923 int foundit = 0; 924 BIO *fbio = BIO_new(BIO_f_buffer()); 925 BIO_push(fbio, sbio); 926 /* wait for multi-line response to end from SMTP */ 927 do { 928 mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ); 929 } 930 while (mbuf_len > 3 && mbuf[3] == '-'); 931 /* STARTTLS command requires EHLO... */ 932 BIO_printf(fbio, "EHLO openssl.client.net\r\n"); 933 (void)BIO_flush(fbio); 934 /* wait for multi-line response to end EHLO SMTP response */ 935 do { 936 mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ); 937 if (strstr(mbuf, "STARTTLS")) 938 foundit = 1; 939 } 940 while (mbuf_len > 3 && mbuf[3] == '-'); 941 (void)BIO_flush(fbio); 942 BIO_pop(fbio); 943 BIO_free(fbio); 944 if (!foundit) 945 BIO_printf(bio_err, 946 "didn't found starttls in server response," 947 " try anyway...\n"); 948 BIO_printf(sbio, "STARTTLS\r\n"); 949 BIO_read(sbio, sbuf, BUFSIZZ); 950 } else if (starttls_proto == PROTO_POP3) { 951 BIO_read(sbio, mbuf, BUFSIZZ); 952 BIO_printf(sbio, "STLS\r\n"); 953 BIO_read(sbio, sbuf, BUFSIZZ); 954 } else if (starttls_proto == PROTO_IMAP) { 955 int foundit = 0; 956 BIO *fbio = BIO_new(BIO_f_buffer()); 957 BIO_push(fbio, sbio); 958 BIO_gets(fbio, mbuf, BUFSIZZ); 959 /* STARTTLS command requires CAPABILITY... */ 960 BIO_printf(fbio, ". CAPABILITY\r\n"); 961 (void)BIO_flush(fbio); 962 /* wait for multi-line CAPABILITY response */ 963 do { 964 mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ); 965 if (strstr(mbuf, "STARTTLS")) 966 foundit = 1; 967 } 968 while (mbuf_len > 3 && mbuf[0] != '.'); 969 (void)BIO_flush(fbio); 970 BIO_pop(fbio); 971 BIO_free(fbio); 972 if (!foundit) 973 BIO_printf(bio_err, 974 "didn't found STARTTLS in server response," 975 " try anyway...\n"); 976 BIO_printf(sbio, ". STARTTLS\r\n"); 977 BIO_read(sbio, sbuf, BUFSIZZ); 978 } else if (starttls_proto == PROTO_FTP) { 979 BIO *fbio = BIO_new(BIO_f_buffer()); 980 BIO_push(fbio, sbio); 981 /* wait for multi-line response to end from FTP */ 982 do { 983 mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ); 984 } 985 while (mbuf_len > 3 && mbuf[3] == '-'); 986 (void)BIO_flush(fbio); 987 BIO_pop(fbio); 988 BIO_free(fbio); 989 BIO_printf(sbio, "AUTH TLS\r\n"); 990 BIO_read(sbio, sbuf, BUFSIZZ); 991 } 992 if (starttls_proto == PROTO_XMPP) { 993 int seen = 0; 994 BIO_printf(sbio, "<stream:stream " 995 "xmlns:stream='http://etherx.jabber.org/streams' " 996 "xmlns='jabber:client' to='%s' version='1.0'>", host); 997 seen = BIO_read(sbio, mbuf, BUFSIZZ); 998 mbuf[seen] = 0; 999 while (!strstr 1000 (mbuf, "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'")) { 1001 if (strstr(mbuf, "/stream:features>")) 1002 goto shut; 1003 seen = BIO_read(sbio, mbuf, BUFSIZZ); 1004 mbuf[seen] = 0; 1005 } 1006 BIO_printf(sbio, 1007 "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>"); 1008 seen = BIO_read(sbio, sbuf, BUFSIZZ); 1009 sbuf[seen] = 0; 1010 if (!strstr(sbuf, "<proceed")) 1011 goto shut; 1012 mbuf[0] = 0; 1013 } 1014 1015 for (;;) { 1016 FD_ZERO(&readfds); 1017 FD_ZERO(&writefds); 1018 1019 if ((SSL_version(con) == DTLS1_VERSION) && 1020 DTLSv1_get_timeout(con, &timeout)) 1021 timeoutp = &timeout; 1022 else 1023 timeoutp = NULL; 1024 1025 if (SSL_in_init(con) && !SSL_total_renegotiations(con)) { 1026 in_init = 1; 1027 tty_on = 0; 1028 } else { 1029 tty_on = 1; 1030 if (in_init) { 1031 in_init = 0; 1032 if (sess_out) { 1033 BIO *stmp = BIO_new_file(sess_out, "w"); 1034 if (stmp) { 1035 PEM_write_bio_SSL_SESSION(stmp, SSL_get_session(con)); 1036 BIO_free(stmp); 1037 } else 1038 BIO_printf(bio_err, "Error writing session file %s\n", 1039 sess_out); 1040 } 1041 print_stuff(bio_c_out, con, full_log); 1042 if (full_log > 0) 1043 full_log--; 1044 1045 if (starttls_proto) { 1046 BIO_printf(bio_err, "%s", mbuf); 1047 /* We don't need to know any more */ 1048 starttls_proto = PROTO_OFF; 1049 } 1050 1051 if (reconnect) { 1052 reconnect--; 1053 BIO_printf(bio_c_out, 1054 "drop connection and then reconnect\n"); 1055 SSL_shutdown(con); 1056 SSL_set_connect_state(con); 1057 SHUTDOWN(SSL_get_fd(con)); 1058 goto re_start; 1059 } 1060 } 1061 } 1062 1063 ssl_pending = read_ssl && SSL_pending(con); 1064 1065 if (!ssl_pending) { 1066#if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_NETWARE) 1067 if (tty_on) { 1068 if (read_tty) 1069 FD_SET(fileno(stdin), &readfds); 1070 if (write_tty) 1071 FD_SET(fileno(stdout), &writefds); 1072 } 1073 if (read_ssl) 1074 FD_SET(SSL_get_fd(con), &readfds); 1075 if (write_ssl) 1076 FD_SET(SSL_get_fd(con), &writefds); 1077#else 1078 if (!tty_on || !write_tty) { 1079 if (read_ssl) 1080 FD_SET(SSL_get_fd(con), &readfds); 1081 if (write_ssl) 1082 FD_SET(SSL_get_fd(con), &writefds); 1083 } 1084#endif 1085/*- printf("mode tty(%d %d%d) ssl(%d%d)\n", 1086 tty_on,read_tty,write_tty,read_ssl,write_ssl);*/ 1087 1088 /* 1089 * Note: under VMS with SOCKETSHR the second parameter is 1090 * currently of type (int *) whereas under other systems it is 1091 * (void *) if you don't have a cast it will choke the compiler: 1092 * if you do have a cast then you can either go for (int *) or 1093 * (void *). 1094 */ 1095#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) 1096 /* 1097 * Under Windows/DOS we make the assumption that we can always 1098 * write to the tty: therefore if we need to write to the tty we 1099 * just fall through. Otherwise we timeout the select every 1100 * second and see if there are any keypresses. Note: this is a 1101 * hack, in a proper Windows application we wouldn't do this. 1102 */ 1103 i = 0; 1104 if (!write_tty) { 1105 if (read_tty) { 1106 tv.tv_sec = 1; 1107 tv.tv_usec = 0; 1108 i = select(width, (void *)&readfds, (void *)&writefds, 1109 NULL, &tv); 1110# if defined(OPENSSL_SYS_WINCE) || defined(OPENSSL_SYS_MSDOS) 1111 if (!i && (!_kbhit() || !read_tty)) 1112 continue; 1113# else 1114 if (!i && (!((_kbhit()) 1115 || (WAIT_OBJECT_0 == 1116 WaitForSingleObject(GetStdHandle 1117 (STD_INPUT_HANDLE), 1118 0))) 1119 || !read_tty)) 1120 continue; 1121# endif 1122 } else 1123 i = select(width, (void *)&readfds, (void *)&writefds, 1124 NULL, timeoutp); 1125 } 1126#elif defined(OPENSSL_SYS_NETWARE) 1127 if (!write_tty) { 1128 if (read_tty) { 1129 tv.tv_sec = 1; 1130 tv.tv_usec = 0; 1131 i = select(width, (void *)&readfds, (void *)&writefds, 1132 NULL, &tv); 1133 } else 1134 i = select(width, (void *)&readfds, (void *)&writefds, 1135 NULL, timeoutp); 1136 } 1137#else 1138 i = select(width, (void *)&readfds, (void *)&writefds, 1139 NULL, timeoutp); 1140#endif 1141 if (i < 0) { 1142 BIO_printf(bio_err, "bad select %d\n", 1143 get_last_socket_error()); 1144 goto shut; 1145 /* goto end; */ 1146 } 1147 } 1148 1149 if ((SSL_version(con) == DTLS1_VERSION) 1150 && DTLSv1_handle_timeout(con) > 0) { 1151 BIO_printf(bio_err, "TIMEOUT occured\n"); 1152 } 1153 1154 if (!ssl_pending && FD_ISSET(SSL_get_fd(con), &writefds)) { 1155 k = SSL_write(con, &(cbuf[cbuf_off]), (unsigned int)cbuf_len); 1156 switch (SSL_get_error(con, k)) { 1157 case SSL_ERROR_NONE: 1158 cbuf_off += k; 1159 cbuf_len -= k; 1160 if (k <= 0) 1161 goto end; 1162 /* we have done a write(con,NULL,0); */ 1163 if (cbuf_len <= 0) { 1164 read_tty = 1; 1165 write_ssl = 0; 1166 } else { /* if (cbuf_len > 0) */ 1167 1168 read_tty = 0; 1169 write_ssl = 1; 1170 } 1171 break; 1172 case SSL_ERROR_WANT_WRITE: 1173 BIO_printf(bio_c_out, "write W BLOCK\n"); 1174 write_ssl = 1; 1175 read_tty = 0; 1176 break; 1177 case SSL_ERROR_WANT_READ: 1178 BIO_printf(bio_c_out, "write R BLOCK\n"); 1179 write_tty = 0; 1180 read_ssl = 1; 1181 write_ssl = 0; 1182 break; 1183 case SSL_ERROR_WANT_X509_LOOKUP: 1184 BIO_printf(bio_c_out, "write X BLOCK\n"); 1185 break; 1186 case SSL_ERROR_ZERO_RETURN: 1187 if (cbuf_len != 0) { 1188 BIO_printf(bio_c_out, "shutdown\n"); 1189 goto shut; 1190 } else { 1191 read_tty = 1; 1192 write_ssl = 0; 1193 break; 1194 } 1195 1196 case SSL_ERROR_SYSCALL: 1197 if ((k != 0) || (cbuf_len != 0)) { 1198 BIO_printf(bio_err, "write:errno=%d\n", 1199 get_last_socket_error()); 1200 goto shut; 1201 } else { 1202 read_tty = 1; 1203 write_ssl = 0; 1204 } 1205 break; 1206 case SSL_ERROR_SSL: 1207 ERR_print_errors(bio_err); 1208 goto shut; 1209 } 1210 } 1211#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE) 1212 /* Assume Windows/DOS can always write */ 1213 else if (!ssl_pending && write_tty) 1214#else 1215 else if (!ssl_pending && FD_ISSET(fileno(stdout), &writefds)) 1216#endif 1217 { 1218#ifdef CHARSET_EBCDIC 1219 ascii2ebcdic(&(sbuf[sbuf_off]), &(sbuf[sbuf_off]), sbuf_len); 1220#endif 1221 i = write(fileno(stdout), &(sbuf[sbuf_off]), sbuf_len); 1222 1223 if (i <= 0) { 1224 BIO_printf(bio_c_out, "DONE\n"); 1225 goto shut; 1226 /* goto end; */ 1227 } 1228 1229 sbuf_len -= i;; 1230 sbuf_off += i; 1231 if (sbuf_len <= 0) { 1232 read_ssl = 1; 1233 write_tty = 0; 1234 } 1235 } else if (ssl_pending || FD_ISSET(SSL_get_fd(con), &readfds)) { 1236#ifdef RENEG 1237 { 1238 static int iiii; 1239 if (++iiii == 52) { 1240 SSL_renegotiate(con); 1241 iiii = 0; 1242 } 1243 } 1244#endif 1245#if 1 1246 k = SSL_read(con, sbuf, 1024 /* BUFSIZZ */ ); 1247#else 1248/* Demo for pending and peek :-) */ 1249 k = SSL_read(con, sbuf, 16); 1250 { 1251 char zbuf[10240]; 1252 printf("read=%d pending=%d peek=%d\n", k, SSL_pending(con), 1253 SSL_peek(con, zbuf, 10240)); 1254 } 1255#endif 1256 1257 switch (SSL_get_error(con, k)) { 1258 case SSL_ERROR_NONE: 1259 if (k <= 0) 1260 goto end; 1261 sbuf_off = 0; 1262 sbuf_len = k; 1263 1264 read_ssl = 0; 1265 write_tty = 1; 1266 break; 1267 case SSL_ERROR_WANT_WRITE: 1268 BIO_printf(bio_c_out, "read W BLOCK\n"); 1269 write_ssl = 1; 1270 read_tty = 0; 1271 break; 1272 case SSL_ERROR_WANT_READ: 1273 BIO_printf(bio_c_out, "read R BLOCK\n"); 1274 write_tty = 0; 1275 read_ssl = 1; 1276 if ((read_tty == 0) && (write_ssl == 0)) 1277 write_ssl = 1; 1278 break; 1279 case SSL_ERROR_WANT_X509_LOOKUP: 1280 BIO_printf(bio_c_out, "read X BLOCK\n"); 1281 break; 1282 case SSL_ERROR_SYSCALL: 1283 BIO_printf(bio_err, "read:errno=%d\n", 1284 get_last_socket_error()); 1285 goto shut; 1286 case SSL_ERROR_ZERO_RETURN: 1287 BIO_printf(bio_c_out, "closed\n"); 1288 goto shut; 1289 case SSL_ERROR_SSL: 1290 ERR_print_errors(bio_err); 1291 goto shut; 1292 /* break; */ 1293 } 1294 } 1295#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) 1296# if defined(OPENSSL_SYS_WINCE) || defined(OPENSSL_SYS_MSDOS) 1297 else if (_kbhit()) 1298# else 1299 else if ((_kbhit()) 1300 || (WAIT_OBJECT_0 == 1301 WaitForSingleObject(GetStdHandle(STD_INPUT_HANDLE), 0))) 1302# endif 1303#elif defined (OPENSSL_SYS_NETWARE) 1304 else if (_kbhit()) 1305#else 1306 else if (FD_ISSET(fileno(stdin), &readfds)) 1307#endif 1308 { 1309 if (crlf) { 1310 int j, lf_num; 1311 1312 i = read(fileno(stdin), cbuf, BUFSIZZ / 2); 1313 lf_num = 0; 1314 /* both loops are skipped when i <= 0 */ 1315 for (j = 0; j < i; j++) 1316 if (cbuf[j] == '\n') 1317 lf_num++; 1318 for (j = i - 1; j >= 0; j--) { 1319 cbuf[j + lf_num] = cbuf[j]; 1320 if (cbuf[j] == '\n') { 1321 lf_num--; 1322 i++; 1323 cbuf[j + lf_num] = '\r'; 1324 } 1325 } 1326 assert(lf_num == 0); 1327 } else 1328 i = read(fileno(stdin), cbuf, BUFSIZZ); 1329 1330 if ((!c_ign_eof) && ((i <= 0) || (cbuf[0] == 'Q'))) { 1331 BIO_printf(bio_err, "DONE\n"); 1332 goto shut; 1333 } 1334 1335 if ((!c_ign_eof) && (cbuf[0] == 'R')) { 1336 BIO_printf(bio_err, "RENEGOTIATING\n"); 1337 SSL_renegotiate(con); 1338 cbuf_len = 0; 1339 } else { 1340 cbuf_len = i; 1341 cbuf_off = 0; 1342#ifdef CHARSET_EBCDIC 1343 ebcdic2ascii(cbuf, cbuf, i); 1344#endif 1345 } 1346 1347 write_ssl = 1; 1348 read_tty = 0; 1349 } 1350 } 1351 shut: 1352 SSL_shutdown(con); 1353 SHUTDOWN(SSL_get_fd(con)); 1354 ret = 0; 1355 end: 1356 if (prexit) 1357 print_stuff(bio_c_out, con, 1); 1358 if (con != NULL) 1359 SSL_free(con); 1360 if (con2 != NULL) 1361 SSL_free(con2); 1362 if (ctx != NULL) 1363 SSL_CTX_free(ctx); 1364 if (cert) 1365 X509_free(cert); 1366 if (key) 1367 EVP_PKEY_free(key); 1368 if (pass) 1369 OPENSSL_free(pass); 1370 if (cbuf != NULL) { 1371 OPENSSL_cleanse(cbuf, BUFSIZZ); 1372 OPENSSL_free(cbuf); 1373 } 1374 if (sbuf != NULL) { 1375 OPENSSL_cleanse(sbuf, BUFSIZZ); 1376 OPENSSL_free(sbuf); 1377 } 1378 if (mbuf != NULL) { 1379 OPENSSL_cleanse(mbuf, BUFSIZZ); 1380 OPENSSL_free(mbuf); 1381 } 1382 if (bio_c_out != NULL) { 1383 BIO_free(bio_c_out); 1384 bio_c_out = NULL; 1385 } 1386 apps_shutdown(); 1387 OPENSSL_EXIT(ret); 1388} 1389 1390static void print_stuff(BIO *bio, SSL *s, int full) 1391{ 1392 X509 *peer = NULL; 1393 char *p; 1394 static const char *space = " "; 1395 char buf[BUFSIZ]; 1396 STACK_OF(X509) *sk; 1397 STACK_OF(X509_NAME) *sk2; 1398 SSL_CIPHER *c; 1399 X509_NAME *xn; 1400 int j, i; 1401#ifndef OPENSSL_NO_COMP 1402 const COMP_METHOD *comp, *expansion; 1403#endif 1404 1405 if (full) { 1406 int got_a_chain = 0; 1407 1408 sk = SSL_get_peer_cert_chain(s); 1409 if (sk != NULL) { 1410 got_a_chain = 1; /* we don't have it for SSL2 (yet) */ 1411 1412 BIO_printf(bio, "---\nCertificate chain\n"); 1413 for (i = 0; i < sk_X509_num(sk); i++) { 1414 X509_NAME_oneline(X509_get_subject_name(sk_X509_value(sk, i)), 1415 buf, sizeof buf); 1416 BIO_printf(bio, "%2d s:%s\n", i, buf); 1417 X509_NAME_oneline(X509_get_issuer_name(sk_X509_value(sk, i)), 1418 buf, sizeof buf); 1419 BIO_printf(bio, " i:%s\n", buf); 1420 if (c_showcerts) 1421 PEM_write_bio_X509(bio, sk_X509_value(sk, i)); 1422 } 1423 } 1424 1425 BIO_printf(bio, "---\n"); 1426 peer = SSL_get_peer_certificate(s); 1427 if (peer != NULL) { 1428 BIO_printf(bio, "Server certificate\n"); 1429 1430 /* Redundant if we showed the whole chain */ 1431 if (!(c_showcerts && got_a_chain)) 1432 PEM_write_bio_X509(bio, peer); 1433 X509_NAME_oneline(X509_get_subject_name(peer), buf, sizeof buf); 1434 BIO_printf(bio, "subject=%s\n", buf); 1435 X509_NAME_oneline(X509_get_issuer_name(peer), buf, sizeof buf); 1436 BIO_printf(bio, "issuer=%s\n", buf); 1437 } else 1438 BIO_printf(bio, "no peer certificate available\n"); 1439 1440 sk2 = SSL_get_client_CA_list(s); 1441 if ((sk2 != NULL) && (sk_X509_NAME_num(sk2) > 0)) { 1442 BIO_printf(bio, "---\nAcceptable client certificate CA names\n"); 1443 for (i = 0; i < sk_X509_NAME_num(sk2); i++) { 1444 xn = sk_X509_NAME_value(sk2, i); 1445 X509_NAME_oneline(xn, buf, sizeof(buf)); 1446 BIO_write(bio, buf, strlen(buf)); 1447 BIO_write(bio, "\n", 1); 1448 } 1449 } else { 1450 BIO_printf(bio, "---\nNo client certificate CA names sent\n"); 1451 } 1452 p = SSL_get_shared_ciphers(s, buf, sizeof buf); 1453 if (p != NULL) { 1454 /* 1455 * This works only for SSL 2. In later protocol versions, the 1456 * client does not know what other ciphers (in addition to the 1457 * one to be used in the current connection) the server supports. 1458 */ 1459 1460 BIO_printf(bio, 1461 "---\nCiphers common between both SSL endpoints:\n"); 1462 j = i = 0; 1463 while (*p) { 1464 if (*p == ':') { 1465 BIO_write(bio, space, 15 - j % 25); 1466 i++; 1467 j = 0; 1468 BIO_write(bio, ((i % 3) ? " " : "\n"), 1); 1469 } else { 1470 BIO_write(bio, p, 1); 1471 j++; 1472 } 1473 p++; 1474 } 1475 BIO_write(bio, "\n", 1); 1476 } 1477 1478 BIO_printf(bio, 1479 "---\nSSL handshake has read %ld bytes and written %ld bytes\n", 1480 BIO_number_read(SSL_get_rbio(s)), 1481 BIO_number_written(SSL_get_wbio(s))); 1482 } 1483 BIO_printf(bio, ((s->hit) ? "---\nReused, " : "---\nNew, ")); 1484 c = SSL_get_current_cipher(s); 1485 BIO_printf(bio, "%s, Cipher is %s\n", 1486 SSL_CIPHER_get_version(c), SSL_CIPHER_get_name(c)); 1487 if (peer != NULL) { 1488 EVP_PKEY *pktmp; 1489 pktmp = X509_get_pubkey(peer); 1490 BIO_printf(bio, "Server public key is %d bit\n", 1491 EVP_PKEY_bits(pktmp)); 1492 EVP_PKEY_free(pktmp); 1493 } 1494 BIO_printf(bio, "Secure Renegotiation IS%s supported\n", 1495 SSL_get_secure_renegotiation_support(s) ? "" : " NOT"); 1496#ifndef OPENSSL_NO_COMP 1497 comp = SSL_get_current_compression(s); 1498 expansion = SSL_get_current_expansion(s); 1499 BIO_printf(bio, "Compression: %s\n", 1500 comp ? SSL_COMP_get_name(comp) : "NONE"); 1501 BIO_printf(bio, "Expansion: %s\n", 1502 expansion ? SSL_COMP_get_name(expansion) : "NONE"); 1503#endif 1504 SSL_SESSION_print(bio, SSL_get_session(s)); 1505 BIO_printf(bio, "---\n"); 1506 if (peer != NULL) 1507 X509_free(peer); 1508 /* flush, or debugging output gets mixed with http response */ 1509 (void)BIO_flush(bio); 1510} 1511 1512#ifndef OPENSSL_NO_TLSEXT 1513 1514static int ocsp_resp_cb(SSL *s, void *arg) 1515{ 1516 const unsigned char *p; 1517 int len; 1518 OCSP_RESPONSE *rsp; 1519 len = SSL_get_tlsext_status_ocsp_resp(s, &p); 1520 BIO_puts(arg, "OCSP response: "); 1521 if (!p) { 1522 BIO_puts(arg, "no response sent\n"); 1523 return 1; 1524 } 1525 rsp = d2i_OCSP_RESPONSE(NULL, &p, len); 1526 if (!rsp) { 1527 BIO_puts(arg, "response parse error\n"); 1528 BIO_dump_indent(arg, (char *)p, len, 4); 1529 return 0; 1530 } 1531 BIO_puts(arg, "\n======================================\n"); 1532 OCSP_RESPONSE_print(arg, rsp, 0); 1533 BIO_puts(arg, "======================================\n"); 1534 OCSP_RESPONSE_free(rsp); 1535 return 1; 1536} 1537#endif /* ndef OPENSSL_NO_TLSEXT */ 1538