aboutsummaryrefslogtreecommitdiffstats
path: root/apps/s_client.c
Commit message (Collapse)AuthorAgeFilesLines
* Fix the no-nextprotoneg optionMatt Caswell2016-04-111-0/+2
| | | | | | Misc fixes to get no-nextprotoneg config option working again. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Suppress CT callback as appropriateViktor Dukhovni2016-04-071-28/+39
| | | | | | | | | | | | | | | | | | | | | | Suppress CT callbacks with aNULL or PSK ciphersuites that involve no certificates. Ditto when the certificate chain is validated via DANE-TA(2) or DANE-EE(3) TLSA records. Also skip SCT processing when the chain is fails verification. Move and consolidate CT callbacks from libcrypto to libssl. We also simplify the interface to SSL_{,CTX_}_enable_ct() which can specify either a permissive mode that just collects information or a strict mode that requires at least one valid SCT or else asks to abort the connection. Simplified SCT processing and options in s_client(1) which now has just a simple pair of "-noct" vs. "-ct" options, the latter enables the permissive callback so that we can complete the handshake and report all relevant information. When printing SCTs, print the validation status if set and not valid. Signed-off-by: Rob Percival <robpercival@google.com> Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Fix no-ocspMatt Caswell2016-04-061-0/+8
| | | | | | Misc fixes for no-ocsp Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix no-sockMatt Caswell2016-03-211-0/+4
| | | | | | Misc fixes for no-sock Reviewed-by: Richard Levitte <levitte@openssl.org>
* GH886: CONNECT should use HTTP/1.1Rich Salz2016-03-201-1/+1
| | | | | | | | By default you get 0.9 which isn't widely available. But we use HTTP/1.0 for now. Courtesy beusink@users.github.com Reviewed-by: Tim Hudson <tjh@openssl.org>
* Fix no-dgramMatt Caswell2016-03-181-3/+10
| | | | | | | A few places in s_client needed some OPENSSL_NO_DTLS guards which fixes no-dgram. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove Netware and OS/2Rich Salz2016-03-171-16/+3
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Surround ctx_set_ctlog_list_file() with #ifndef OPENSSL_NO_CTRob Percival2016-03-111-1/+1
| | | | | Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* check reviewer --reviewer=emiliaRob Percival2016-03-101-6/+9
| | | | | | | Use SSL_get_SSL_CTX instead of passing SSL_CTX to s_client.c:print_stuff Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* check reviewer --reviewer=emiliaRob Percival2016-03-101-6/+6
| | | | | | | | | | | | Remove 'log' field from SCT and related accessors In order to still have access to an SCT's CTLOG when calling SCT_print, SSL_CTX_get0_ctlog_store has been added. Improved documentation for some CT functions in openssl/ssl.h. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Use minimum and maximum protocol version instead of version fixed methodsKurt Roeckx2016-03-091-19/+30
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1824
* Minor improvement to formatting of SCT output in s_clientRob Percival2016-03-091-5/+10
| | | | | Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Do not display a CT log error message if CT validation is disabledRob Percival2016-03-091-2/+12
| | | | | Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Treat boolean functions as booleansRob Percival2016-03-091-1/+1
| | | | | | | | Use "!x" instead of "x <= 0", as these functions never return a negative value. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* GH787: Fix ALPNTodd Short2016-03-081-2/+2
| | | | | | | | | | | | * Perform ALPN after the SNI callback; the SSL_CTX may change due to that processing * Add flags to indicate that we actually sent ALPN, to properly error out if unexpectedly received. * clean up ssl3_free() no need to explicitly clear when doing memset * document ALPN functions Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Fix s_server/s_client handling of the split_send_frag argumentMatt Caswell2016-03-071-2/+5
| | | | | | | Ensure that a value of 0 is correctly handled for the split_send_frag argument. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add documentation for new s_server/s_client optionsMatt Caswell2016-03-071-1/+1
| | | | | | Document the new split_send_frag, max_pipelines and read_buf options. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Ensure s_client and s_server work when read_ahead is setMatt Caswell2016-03-071-1/+1
| | | | | | | | | Previously s_client and s_server relied on using SSL_pending() which does not take into account read_ahead. For read pipelining to work, read_ahead gets set automatically. Therefore s_client and s_server have been converted to use SSL_has_pending() instead. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add an ability to set the SSL read buffer sizeMatt Caswell2016-03-071-1/+11
| | | | | | | | | This capability is required for read pipelining. We will only read in as many records as will fit in the read buffer (and the network can provide in one go). The bigger the buffer the more records we can process in parallel. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add pipeline support to s_server and s_clientMatt Caswell2016-03-071-1/+33
| | | | | | | | | Add the options min_send_frag and max_pipelines to s_server and s_client in order to control pipelining capabilities. This will only have an effect if a pipeline capable cipher is used (such as the one provided by the dasync engine). Reviewed-by: Tim Hudson <tjh@openssl.org>
* ISSUE 43: Add BIO_sock_shutdownRich Salz2016-03-071-4/+4
| | | | | | This replaces SHUTDOWN/SHUTDOWN2 with BIO_closesocket. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Extends s_client to allow a basic CT policy to be enabledRob Percival2016-03-041-0/+57
| | | | | Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* RT2275: use BIO_sock_nbio()Rich Salz2016-02-271-12/+2
| | | | | | Now that BIO_sock_nbio is available, use it in the apps. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove unused parameters from internal functionsRich Salz2016-02-221-3/+2
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* MemorySanitizer: address false positiveEmilia Kasper2016-02-221-0/+16
| | | | | | | | Explicitly unpoison the result of FD_ZERO Tests now pass, using -fsanitize=memory Reviewed-by: Rich Salz <rsalz@openssl.org>
* argv was set but unusedKurt Roeckx2016-02-201-1/+2
| | | | | | | | Also gives an error message when you gave it a parameter it didn't expect. Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #2009
* GH681: More command help cleanupRich Salz2016-02-181-22/+35
| | | | | | | | | | | enc: - typo in -base64 option - missing help opt text ocsp, req, rsautl, s_client: - missing help opt text Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove JPAKERich Salz2016-02-171-26/+5
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Make sure to use unsigned char for is*() functionsRichard Levitte2016-02-141-5/+5
| | | | | | | | | | | On some platforms, the implementation is such that a signed char triggers a warning when used with is*() functions. On others, the behavior is outright buggy when presented with a char that happens to get promoted to a negative integer. The safest thing is to cast the char that's used to an unsigned char. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Auto init/deinit libcryptoMatt Caswell2016-02-091-4/+0
| | | | | | | This builds on the previous commit to auto initialise/deinitialise libcrypto. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Suppress DANE TLSA reflection when verification failsViktor Dukhovni2016-02-081-15/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As documented both SSL_get0_dane_authority() and SSL_get0_dane_tlsa() are expected to return a negative match depth and nothing else when verification fails. However, this only happened when verification failed during chain construction. Errors in verification of the constructed chain did not have the intended effect on these functions. This commit updates the functions to check for verify_result == X509_V_OK, and no longer erases any accumulated match information when chain construction fails. Sophisticated developers can, with care, use SSL_set_verify_result(ssl, X509_V_OK) to "peek" at TLSA info even when verification fail. They must of course first check and save the real error, and restore the original error as quickly as possible. Hiding by default seems to be the safer interface. Introduced X509_V_ERR_DANE_NO_MATCH code to signal failure to find matching TLSA records. Previously reported via X509_V_ERR_CERT_UNTRUSTED. This also changes the "-brief" output from s_client to include verification results and TLSA match information. Mentioned session resumption in code example in SSL_CTX_dane_enable(3). Also mentioned that depths returned are relative to the verified chain which is now available via SSL_get0_verified_chain(3). Added a few more test-cases to danetest, that exercise the new code. Resolved thread safety issue in use of static buffer in X509_verify_cert_error_string(). Fixed long-stating issue in apps/s_cb.c which always sets verify_error to either X509_V_OK or "chain to long", code elsewhere (e.g. s_time.c), seems to expect the actual error. [ The new chain construction code is expected to correctly generate "chain too long" errors, so at some point we need to drop the work-arounds, once SSL_set_verify_depth() is also fixed to propagate the depth to X509_STORE_CTX reliably. ] Reviewed-by: Rich Salz <rsalz@openssl.org>
* Deprecate undocumented SSL_cache_hit().Dr. Stephen Henson2016-02-081-1/+1
| | | | | | | Deprecate undocumented SSL_cache_hit(). Make SSL_session_reused() into a real function. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Refactoring BIO: Adapt s_client and s_serverRichard Levitte2016-02-031-22/+95
| | | | | | | | | | | | | | | | | | | s_socket.c gets brutally cleaned out and now consists of only two functions, one for client and the other for server. They both handle AF_INET, AF_INET6 and additionally AF_UNIX where supported. The rest is just easy adaptation. Both s_client and s_server get the new flags -4 and -6 to force the use of IPv4 or IPv6 only. Also, the default host "localhost" in s_client is removed. It's not certain that this host is set up for both IPv4 and IPv6. For example, Debian has "ip6-localhost" as the default hostname for [::1]. The better way is to default |host| to NULL and rely on BIO_lookup() to return a BIO_ADDRINFO with the appropriate loopback address for IPv4 or IPv6 as indicated by the |family| parameter. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Implement Async SSL_shutdownMatt Caswell2016-01-291-2/+23
| | | | | | | | This extends the existing async functionality to SSL_shutdown(), i.e. SSL_shutdown() can now casuse an SSL_ERROR_WANT_ASYNC error to be returned from SSL_get_error() if async mode has been enabled. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Refactor apps load_certs/load_crls to work incrementallyViktor Dukhovni2016-01-201-3/+2
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Support disabling any or all TLS or DTLS versionsViktor Dukhovni2016-01-191-14/+31
| | | | | | | | | | | | | | | Some users want to disable SSL 3.0/TLS 1.0/TLS 1.1, and enable just TLS 1.2. In the future they might want to disable TLS 1.2 and enable just TLS 1.3, ... This commit makes it possible to disable any or all of the TLS or DTLS protocols. It also considerably simplifies the SSL/TLS tests, by auto-generating the min/max version tests based on the set of supported protocols (425 explicitly written out tests got replaced by two loops that generate all 425 tests if all protocols are enabled, fewer otherwise). Reviewed-by: Richard Levitte <levitte@openssl.org>
* RT4232: Extra space in help message.Rich Salz2016-01-141-11/+1
| | | | | | | | | It turns out that -pause calls the undocumented function SSL_set_debug. That just sets flag inside the SSL structure. That flag, despite the command is never used. So remove the flag, the field, and the function. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Another portability fix.Rich Salz2016-01-081-1/+1
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Portability fix for apps/s_client.cRich Salz2016-01-081-13/+16
| | | | | | Make some local variables and a table of them be static. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* DANE s_client supportViktor Dukhovni2016-01-071-2/+222
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add ssl configuration support to s_server and s_clientDr. Stephen Henson2015-12-221-1/+15
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix s_server problem with no-ecMatt Caswell2015-12-151-1/+1
| | | | | | | | | | s_server was trying to set the ECDH curve when no-ec was defined. This also highlighted the fact that the -no_ecdhe option to s_server is broken, and doesn't make any sense any more (ECDHE is on by default and the only way it can be disabled is through the cipherstring). Therefore this commit removes the option. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* New function X509_get0_pubkeyDr. Stephen Henson2015-12-141-2/+1
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Use OPENSSL_NO_DTLS instead of OPENSSL_NO_DTLS1Kurt Roeckx2015-12-121-2/+2
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix grammar errorsQuanah Gibson-Mount2015-11-241-4/+4
| | | | | | | Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@akamai.com> GH: #481
* Convert __thread to pthreads for Thread Local StorageMatt Caswell2015-11-201-2/+2
| | | | | | | | | | | | In theory the pthreads approach for Thread Local Storage should be more portable. This also changes some APIs in order to accommodate this change. In particular ASYNC_init_pool is renamed ASYNC_init_thread and ASYNC_free_pool is renamed ASYNC_cleanup_thread. Also introduced ASYNC_init and ASYNC_cleanup. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add s_client support for waiting for asyncMatt Caswell2015-11-201-0/+2
| | | | | | | s_server already had the ability to wait on an async file descriptor. This adds it to s_client too. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix pools for s_clientMatt Caswell2015-11-201-1/+7
| | | | | | s_client was not freeing up the async pool if async mode was enabled. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add s_server and s_client async supportMatt Caswell2015-11-201-0/+21
| | | | | | | A new -async option is added which activates SSL_MODE_ASYNC. Also SSL_WANT_ASYNC errors are handled appropriately. Reviewed-by: Rich Salz <rsalz@openssl.org>
* RT2667: Add IRC support to -starttlsNathan Phillip Brink2015-11-131-2/+66
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-10 17:54:11 +0000