1 /* 2 * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 /* callback functions used by s_client, s_server, and s_time */ 11 #include <stdio.h> 12 #include <stdlib.h> 13 #include <string.h> /* for memcpy() and strcmp() */ 14 #include "apps.h" 15 #include <openssl/err.h> 16 #include <openssl/rand.h> 17 #include <openssl/x509.h> 18 #include <openssl/ssl.h> 19 #include <openssl/bn.h> 20 #ifndef OPENSSL_NO_DH 21 # include <openssl/dh.h> 22 #endif 23 #include "s_apps.h" 24 25 #define COOKIE_SECRET_LENGTH 16 26 27 VERIFY_CB_ARGS verify_args = { -1, 0, X509_V_OK, 0 }; 28 29 #ifndef OPENSSL_NO_SOCK 30 static unsigned char cookie_secret[COOKIE_SECRET_LENGTH]; 31 static int cookie_initialized = 0; 32 #endif 33 static BIO *bio_keylog = NULL; 34 35 static const char *lookup(int val, const STRINT_PAIR* list, const char* def) 36 { 37 for ( ; list->name; ++list) 38 if (list->retval == val) 39 return list->name; 40 return def; 41 } 42 43 int verify_callback(int ok, X509_STORE_CTX *ctx) 44 { 45 X509 *err_cert; 46 int err, depth; 47 48 err_cert = X509_STORE_CTX_get_current_cert(ctx); 49 err = X509_STORE_CTX_get_error(ctx); 50 depth = X509_STORE_CTX_get_error_depth(ctx); 51 52 if (!verify_args.quiet || !ok) { 53 BIO_printf(bio_err, "depth=%d ", depth); 54 if (err_cert != NULL) { 55 X509_NAME_print_ex(bio_err, 56 X509_get_subject_name(err_cert), 57 0, get_nameopt()); 58 BIO_puts(bio_err, "\n"); 59 } else { 60 BIO_puts(bio_err, "<no cert>\n"); 61 } 62 } 63 if (!ok) { 64 BIO_printf(bio_err, "verify error:num=%d:%s\n", err, 65 X509_verify_cert_error_string(err)); 66 if (verify_args.depth < 0 || verify_args.depth >= depth) { 67 if (!verify_args.return_error) 68 ok = 1; 69 verify_args.error = err; 70 } else { 71 ok = 0; 72 verify_args.error = X509_V_ERR_CERT_CHAIN_TOO_LONG; 73 } 74 } 75 switch (err) { 76 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT: 77 if (err_cert != NULL) { 78 BIO_puts(bio_err, "issuer= "); 79 X509_NAME_print_ex(bio_err, X509_get_issuer_name(err_cert), 80 0, get_nameopt()); 81 BIO_puts(bio_err, "\n"); 82 } 83 break; 84 case X509_V_ERR_CERT_NOT_YET_VALID: 85 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD: 86 if (err_cert != NULL) { 87 BIO_printf(bio_err, "notBefore="); 88 ASN1_TIME_print(bio_err, X509_get0_notBefore(err_cert)); 89 BIO_printf(bio_err, "\n"); 90 } 91 break; 92 case X509_V_ERR_CERT_HAS_EXPIRED: 93 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD: 94 if (err_cert != NULL) { 95 BIO_printf(bio_err, "notAfter="); 96 ASN1_TIME_print(bio_err, X509_get0_notAfter(err_cert)); 97 BIO_printf(bio_err, "\n"); 98 } 99 break; 100 case X509_V_ERR_NO_EXPLICIT_POLICY: 101 if (!verify_args.quiet) 102 policies_print(ctx); 103 break; 104 } 105 if (err == X509_V_OK && ok == 2 && !verify_args.quiet) 106 policies_print(ctx); 107 if (ok && !verify_args.quiet) 108 BIO_printf(bio_err, "verify return:%d\n", ok); 109 return ok; 110 } 111 112 int set_cert_stuff(SSL_CTX *ctx, char *cert_file, char *key_file) 113 { 114 if (cert_file != NULL) { 115 if (SSL_CTX_use_certificate_file(ctx, cert_file, 116 SSL_FILETYPE_PEM) <= 0) { 117 BIO_printf(bio_err, "unable to get certificate from '%s'\n", 118 cert_file); 119 ERR_print_errors(bio_err); 120 return 0; 121 } 122 if (key_file == NULL) 123 key_file = cert_file; 124 if (SSL_CTX_use_PrivateKey_file(ctx, key_file, SSL_FILETYPE_PEM) <= 0) { 125 BIO_printf(bio_err, "unable to get private key from '%s'\n", 126 key_file); 127 ERR_print_errors(bio_err); 128 return 0; 129 } 130 131 /* 132 * If we are using DSA, we can copy the parameters from the private 133 * key 134 */ 135 136 /* 137 * Now we know that a key and cert have been set against the SSL 138 * context 139 */ 140 if (!SSL_CTX_check_private_key(ctx)) { 141 BIO_printf(bio_err, 142 "Private key does not match the certificate public key\n"); 143 return 0; 144 } 145 } 146 return 1; 147 } 148 149 int set_cert_key_stuff(SSL_CTX *ctx, X509 *cert, EVP_PKEY *key, 150 STACK_OF(X509) *chain, int build_chain) 151 { 152 int chflags = chain ? SSL_BUILD_CHAIN_FLAG_CHECK : 0; 153 if (cert == NULL) 154 return 1; 155 if (SSL_CTX_use_certificate(ctx, cert) <= 0) { 156 BIO_printf(bio_err, "error setting certificate\n"); 157 ERR_print_errors(bio_err); 158 return 0; 159 } 160 161 if (SSL_CTX_use_PrivateKey(ctx, key) <= 0) { 162 BIO_printf(bio_err, "error setting private key\n"); 163 ERR_print_errors(bio_err); 164 return 0; 165 } 166 167 /* 168 * Now we know that a key and cert have been set against the SSL context 169 */ 170 if (!SSL_CTX_check_private_key(ctx)) { 171 BIO_printf(bio_err, 172 "Private key does not match the certificate public key\n"); 173 return 0; 174 } 175 if (chain && !SSL_CTX_set1_chain(ctx, chain)) { 176 BIO_printf(bio_err, "error setting certificate chain\n"); 177 ERR_print_errors(bio_err); 178 return 0; 179 } 180 if (build_chain && !SSL_CTX_build_cert_chain(ctx, chflags)) { 181 BIO_printf(bio_err, "error building certificate chain\n"); 182 ERR_print_errors(bio_err); 183 return 0; 184 } 185 return 1; 186 } 187 188 static STRINT_PAIR cert_type_list[] = { 189 {"RSA sign", TLS_CT_RSA_SIGN}, 190 {"DSA sign", TLS_CT_DSS_SIGN}, 191 {"RSA fixed DH", TLS_CT_RSA_FIXED_DH}, 192 {"DSS fixed DH", TLS_CT_DSS_FIXED_DH}, 193 {"ECDSA sign", TLS_CT_ECDSA_SIGN}, 194 {"RSA fixed ECDH", TLS_CT_RSA_FIXED_ECDH}, 195 {"ECDSA fixed ECDH", TLS_CT_ECDSA_FIXED_ECDH}, 196 {"GOST01 Sign", TLS_CT_GOST01_SIGN}, 197 {"GOST12 Sign", TLS_CT_GOST12_SIGN}, 198 {NULL} 199 }; 200 201 static void ssl_print_client_cert_types(BIO *bio, SSL *s) 202 { 203 const unsigned char *p; 204 int i; 205 int cert_type_num = SSL_get0_certificate_types(s, &p); 206 if (!cert_type_num) 207 return; 208 BIO_puts(bio, "Client Certificate Types: "); 209 for (i = 0; i < cert_type_num; i++) { 210 unsigned char cert_type = p[i]; 211 const char *cname = lookup((int)cert_type, cert_type_list, NULL); 212 213 if (i) 214 BIO_puts(bio, ", "); 215 if (cname != NULL) 216 BIO_puts(bio, cname); 217 else 218 BIO_printf(bio, "UNKNOWN (%d),", cert_type); 219 } 220 BIO_puts(bio, "\n"); 221 } 222 223 static const char *get_sigtype(int nid) 224 { 225 switch (nid) { 226 case EVP_PKEY_RSA: 227 return "RSA"; 228 229 case EVP_PKEY_RSA_PSS: 230 return "RSA-PSS"; 231 232 case EVP_PKEY_DSA: 233 return "DSA"; 234 235 case EVP_PKEY_EC: 236 return "ECDSA"; 237 238 case NID_ED25519: 239 return "Ed25519"; 240 241 case NID_ED448: 242 return "Ed448"; 243 244 case NID_id_GostR3410_2001: 245 return "gost2001"; 246 247 case NID_id_GostR3410_2012_256: 248 return "gost2012_256"; 249 250 case NID_id_GostR3410_2012_512: 251 return "gost2012_512"; 252 253 default: 254 return NULL; 255 } 256 } 257 258 static int do_print_sigalgs(BIO *out, SSL *s, int shared) 259 { 260 int i, nsig, client; 261 client = SSL_is_server(s) ? 0 : 1; 262 if (shared) 263 nsig = SSL_get_shared_sigalgs(s, 0, NULL, NULL, NULL, NULL, NULL); 264 else 265 nsig = SSL_get_sigalgs(s, -1, NULL, NULL, NULL, NULL, NULL); 266 if (nsig == 0) 267 return 1; 268 269 if (shared) 270 BIO_puts(out, "Shared "); 271 272 if (client) 273 BIO_puts(out, "Requested "); 274 BIO_puts(out, "Signature Algorithms: "); 275 for (i = 0; i < nsig; i++) { 276 int hash_nid, sign_nid; 277 unsigned char rhash, rsign; 278 const char *sstr = NULL; 279 if (shared) 280 SSL_get_shared_sigalgs(s, i, &sign_nid, &hash_nid, NULL, 281 &rsign, &rhash); 282 else 283 SSL_get_sigalgs(s, i, &sign_nid, &hash_nid, NULL, &rsign, &rhash); 284 if (i) 285 BIO_puts(out, ":"); 286 sstr = get_sigtype(sign_nid); 287 if (sstr) 288 BIO_printf(out, "%s", sstr); 289 else 290 BIO_printf(out, "0x%02X", (int)rsign); 291 if (hash_nid != NID_undef) 292 BIO_printf(out, "+%s", OBJ_nid2sn(hash_nid)); 293 else if (sstr == NULL) 294 BIO_printf(out, "+0x%02X", (int)rhash); 295 } 296 BIO_puts(out, "\n"); 297 return 1; 298 } 299 300 int ssl_print_sigalgs(BIO *out, SSL *s) 301 { 302 int nid; 303 if (!SSL_is_server(s)) 304 ssl_print_client_cert_types(out, s); 305 do_print_sigalgs(out, s, 0); 306 do_print_sigalgs(out, s, 1); 307 if (SSL_get_peer_signature_nid(s, &nid) && nid != NID_undef) 308 BIO_printf(out, "Peer signing digest: %s\n", OBJ_nid2sn(nid)); 309 if (SSL_get_peer_signature_type_nid(s, &nid)) 310 BIO_printf(out, "Peer signature type: %s\n", get_sigtype(nid)); 311 return 1; 312 } 313 314 #ifndef OPENSSL_NO_EC 315 int ssl_print_point_formats(BIO *out, SSL *s) 316 { 317 int i, nformats; 318 const char *pformats; 319 nformats = SSL_get0_ec_point_formats(s, &pformats); 320 if (nformats <= 0) 321 return 1; 322 BIO_puts(out, "Supported Elliptic Curve Point Formats: "); 323 for (i = 0; i < nformats; i++, pformats++) { 324 if (i) 325 BIO_puts(out, ":"); 326 switch (*pformats) { 327 case TLSEXT_ECPOINTFORMAT_uncompressed: 328 BIO_puts(out, "uncompressed"); 329 break; 330 331 case TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime: 332 BIO_puts(out, "ansiX962_compressed_prime"); 333 break; 334 335 case TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2: 336 BIO_puts(out, "ansiX962_compressed_char2"); 337 break; 338 339 default: 340 BIO_printf(out, "unknown(%d)", (int)*pformats); 341 break; 342 343 } 344 } 345 BIO_puts(out, "\n"); 346 return 1; 347 } 348 349 int ssl_print_groups(BIO *out, SSL *s, int noshared) 350 { 351 int i, ngroups, *groups, nid; 352 const char *gname; 353 354 ngroups = SSL_get1_groups(s, NULL); 355 if (ngroups <= 0) 356 return 1; 357 groups = app_malloc(ngroups * sizeof(int), "groups to print"); 358 SSL_get1_groups(s, groups); 359 360 BIO_puts(out, "Supported Elliptic Groups: "); 361 for (i = 0; i < ngroups; i++) { 362 if (i) 363 BIO_puts(out, ":"); 364 nid = groups[i]; 365 /* If unrecognised print out hex version */ 366 if (nid & TLSEXT_nid_unknown) { 367 BIO_printf(out, "0x%04X", nid & 0xFFFF); 368 } else { 369 /* TODO(TLS1.3): Get group name here */ 370 /* Use NIST name for curve if it exists */ 371 gname = EC_curve_nid2nist(nid); 372 if (gname == NULL) 373 gname = OBJ_nid2sn(nid); 374 BIO_printf(out, "%s", gname); 375 } 376 } 377 OPENSSL_free(groups); 378 if (noshared) { 379 BIO_puts(out, "\n"); 380 return 1; 381 } 382 BIO_puts(out, "\nShared Elliptic groups: "); 383 ngroups = SSL_get_shared_group(s, -1); 384 for (i = 0; i < ngroups; i++) { 385 if (i) 386 BIO_puts(out, ":"); 387 nid = SSL_get_shared_group(s, i); 388 /* TODO(TLS1.3): Convert for DH groups */ 389 gname = EC_curve_nid2nist(nid); 390 if (gname == NULL) 391 gname = OBJ_nid2sn(nid); 392 BIO_printf(out, "%s", gname); 393 } 394 if (ngroups == 0) 395 BIO_puts(out, "NONE"); 396 BIO_puts(out, "\n"); 397 return 1; 398 } 399 #endif 400 401 int ssl_print_tmp_key(BIO *out, SSL *s) 402 { 403 EVP_PKEY *key; 404 405 if (!SSL_get_peer_tmp_key(s, &key)) 406 return 1; 407 BIO_puts(out, "Server Temp Key: "); 408 switch (EVP_PKEY_id(key)) { 409 case EVP_PKEY_RSA: 410 BIO_printf(out, "RSA, %d bits\n", EVP_PKEY_bits(key)); 411 break; 412 413 case EVP_PKEY_DH: 414 BIO_printf(out, "DH, %d bits\n", EVP_PKEY_bits(key)); 415 break; 416 #ifndef OPENSSL_NO_EC 417 case EVP_PKEY_EC: 418 { 419 EC_KEY *ec = EVP_PKEY_get1_EC_KEY(key); 420 int nid; 421 const char *cname; 422 nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec)); 423 EC_KEY_free(ec); 424 cname = EC_curve_nid2nist(nid); 425 if (cname == NULL) 426 cname = OBJ_nid2sn(nid); 427 BIO_printf(out, "ECDH, %s, %d bits\n", cname, EVP_PKEY_bits(key)); 428 } 429 break; 430 #endif 431 default: 432 BIO_printf(out, "%s, %d bits\n", OBJ_nid2sn(EVP_PKEY_id(key)), 433 EVP_PKEY_bits(key)); 434 } 435 EVP_PKEY_free(key); 436 return 1; 437 } 438 439 long bio_dump_callback(BIO *bio, int cmd, const char *argp, 440 int argi, long argl, long ret) 441 { 442 BIO *out; 443 444 out = (BIO *)BIO_get_callback_arg(bio); 445 if (out == NULL) 446 return ret; 447 448 if (cmd == (BIO_CB_READ | BIO_CB_RETURN)) { 449 BIO_printf(out, "read from %p [%p] (%lu bytes => %ld (0x%lX))\n", 450 (void *)bio, (void *)argp, (unsigned long)argi, ret, ret); 451 BIO_dump(out, argp, (int)ret); 452 return ret; 453 } else if (cmd == (BIO_CB_WRITE | BIO_CB_RETURN)) { 454 BIO_printf(out, "write to %p [%p] (%lu bytes => %ld (0x%lX))\n", 455 (void *)bio, (void *)argp, (unsigned long)argi, ret, ret); 456 BIO_dump(out, argp, (int)ret); 457 } 458 return ret; 459 } 460 461 void apps_ssl_info_callback(const SSL *s, int where, int ret) 462 { 463 const char *str; 464 int w; 465 466 w = where & ~SSL_ST_MASK; 467 468 if (w & SSL_ST_CONNECT) 469 str = "SSL_connect"; 470 else if (w & SSL_ST_ACCEPT) 471 str = "SSL_accept"; 472 else 473 str = "undefined"; 474 475 if (where & SSL_CB_LOOP) { 476 BIO_printf(bio_err, "%s:%s\n", str, SSL_state_string_long(s)); 477 } else if (where & SSL_CB_ALERT) { 478 str = (where & SSL_CB_READ) ? "read" : "write"; 479 BIO_printf(bio_err, "SSL3 alert %s:%s:%s\n", 480 str, 481 SSL_alert_type_string_long(ret), 482 SSL_alert_desc_string_long(ret)); 483 } else if (where & SSL_CB_EXIT) { 484 if (ret == 0) 485 BIO_printf(bio_err, "%s:failed in %s\n", 486 str, SSL_state_string_long(s)); 487 else if (ret < 0) 488 BIO_printf(bio_err, "%s:error in %s\n", 489 str, SSL_state_string_long(s)); 490 } 491 } 492 493 static STRINT_PAIR ssl_versions[] = { 494 {"SSL 3.0", SSL3_VERSION}, 495 {"TLS 1.0", TLS1_VERSION}, 496 {"TLS 1.1", TLS1_1_VERSION}, 497 {"TLS 1.2", TLS1_2_VERSION}, 498 {"TLS 1.3", TLS1_3_VERSION}, 499 {"DTLS 1.0", DTLS1_VERSION}, 500 {"DTLS 1.0 (bad)", DTLS1_BAD_VER}, 501 {NULL} 502 }; 503 504 static STRINT_PAIR alert_types[] = { 505 {" close_notify", 0}, 506 {" end_of_early_data", 1}, 507 {" unexpected_message", 10}, 508 {" bad_record_mac", 20}, 509 {" decryption_failed", 21}, 510 {" record_overflow", 22}, 511 {" decompression_failure", 30}, 512 {" handshake_failure", 40}, 513 {" bad_certificate", 42}, 514 {" unsupported_certificate", 43}, 515 {" certificate_revoked", 44}, 516 {" certificate_expired", 45}, 517 {" certificate_unknown", 46}, 518 {" illegal_parameter", 47}, 519 {" unknown_ca", 48}, 520 {" access_denied", 49}, 521 {" decode_error", 50}, 522 {" decrypt_error", 51}, 523 {" export_restriction", 60}, 524 {" protocol_version", 70}, 525 {" insufficient_security", 71}, 526 {" internal_error", 80}, 527 {" inappropriate_fallback", 86}, 528 {" user_canceled", 90}, 529 {" no_renegotiation", 100}, 530 {" missing_extension", 109}, 531 {" unsupported_extension", 110}, 532 {" certificate_unobtainable", 111}, 533 {" unrecognized_name", 112}, 534 {" bad_certificate_status_response", 113}, 535 {" bad_certificate_hash_value", 114}, 536 {" unknown_psk_identity", 115}, 537 {" certificate_required", 116}, 538 {NULL} 539 }; 540 541 static STRINT_PAIR handshakes[] = { 542 {", HelloRequest", SSL3_MT_HELLO_REQUEST}, 543 {", ClientHello", SSL3_MT_CLIENT_HELLO}, 544 {", ServerHello", SSL3_MT_SERVER_HELLO}, 545 {", HelloVerifyRequest", DTLS1_MT_HELLO_VERIFY_REQUEST}, 546 {", NewSessionTicket", SSL3_MT_NEWSESSION_TICKET}, 547 {", EndOfEarlyData", SSL3_MT_END_OF_EARLY_DATA}, 548 {", EncryptedExtensions", SSL3_MT_ENCRYPTED_EXTENSIONS}, 549 {", Certificate", SSL3_MT_CERTIFICATE}, 550 {", ServerKeyExchange", SSL3_MT_SERVER_KEY_EXCHANGE}, 551 {", CertificateRequest", SSL3_MT_CERTIFICATE_REQUEST}, 552 {", ServerHelloDone", SSL3_MT_SERVER_DONE}, 553 {", CertificateVerify", SSL3_MT_CERTIFICATE_VERIFY}, 554 {", ClientKeyExchange", SSL3_MT_CLIENT_KEY_EXCHANGE}, 555 {", Finished", SSL3_MT_FINISHED}, 556 {", CertificateUrl", SSL3_MT_CERTIFICATE_URL}, 557 {", CertificateStatus", SSL3_MT_CERTIFICATE_STATUS}, 558 {", SupplementalData", SSL3_MT_SUPPLEMENTAL_DATA}, 559 {", KeyUpdate", SSL3_MT_KEY_UPDATE}, 560 #ifndef OPENSSL_NO_NEXTPROTONEG 561 {", NextProto", SSL3_MT_NEXT_PROTO}, 562 #endif 563 {", MessageHash", SSL3_MT_MESSAGE_HASH}, 564 {NULL} 565 }; 566 567 void msg_cb(int write_p, int version, int content_type, const void *buf, 568 size_t len, SSL *ssl, void *arg) 569 { 570 BIO *bio = arg; 571 const char *str_write_p = write_p ? ">>>" : "<<<"; 572 const char *str_version = lookup(version, ssl_versions, "???"); 573 const char *str_content_type = "", *str_details1 = "", *str_details2 = ""; 574 const unsigned char* bp = buf; 575 576 if (version == SSL3_VERSION || 577 version == TLS1_VERSION || 578 version == TLS1_1_VERSION || 579 version == TLS1_2_VERSION || 580 version == TLS1_3_VERSION || 581 version == DTLS1_VERSION || version == DTLS1_BAD_VER) { 582 switch (content_type) { 583 case 20: 584 str_content_type = ", ChangeCipherSpec"; 585 break; 586 case 21: 587 str_content_type = ", Alert"; 588 str_details1 = ", ???"; 589 if (len == 2) { 590 switch (bp[0]) { 591 case 1: 592 str_details1 = ", warning"; 593 break; 594 case 2: 595 str_details1 = ", fatal"; 596 break; 597 } 598 str_details2 = lookup((int)bp[1], alert_types, " ???"); 599 } 600 break; 601 case 22: 602 str_content_type = ", Handshake"; 603 str_details1 = "???"; 604 if (len > 0) 605 str_details1 = lookup((int)bp[0], handshakes, "???"); 606 break; 607 case 23: 608 str_content_type = ", ApplicationData"; 609 break; 610 #ifndef OPENSSL_NO_HEARTBEATS 611 case 24: 612 str_details1 = ", Heartbeat"; 613 614 if (len > 0) { 615 switch (bp[0]) { 616 case 1: 617 str_details1 = ", HeartbeatRequest"; 618 break; 619 case 2: 620 str_details1 = ", HeartbeatResponse"; 621 break; 622 } 623 } 624 break; 625 #endif 626 } 627 } 628 629 BIO_printf(bio, "%s %s%s [length %04lx]%s%s\n", str_write_p, str_version, 630 str_content_type, (unsigned long)len, str_details1, 631 str_details2); 632 633 if (len > 0) { 634 size_t num, i; 635 636 BIO_printf(bio, " "); 637 num = len; 638 for (i = 0; i < num; i++) { 639 if (i % 16 == 0 && i > 0) 640 BIO_printf(bio, "\n "); 641 BIO_printf(bio, " %02x", ((const unsigned char *)buf)[i]); 642 } 643 if (i < len) 644 BIO_printf(bio, " ..."); 645 BIO_printf(bio, "\n"); 646 } 647 (void)BIO_flush(bio); 648 } 649 650 static STRINT_PAIR tlsext_types[] = { 651 {"server name", TLSEXT_TYPE_server_name}, 652 {"max fragment length", TLSEXT_TYPE_max_fragment_length}, 653 {"client certificate URL", TLSEXT_TYPE_client_certificate_url}, 654 {"trusted CA keys", TLSEXT_TYPE_trusted_ca_keys}, 655 {"truncated HMAC", TLSEXT_TYPE_truncated_hmac}, 656 {"status request", TLSEXT_TYPE_status_request}, 657 {"user mapping", TLSEXT_TYPE_user_mapping}, 658 {"client authz", TLSEXT_TYPE_client_authz}, 659 {"server authz", TLSEXT_TYPE_server_authz}, 660 {"cert type", TLSEXT_TYPE_cert_type}, 661 {"supported_groups", TLSEXT_TYPE_supported_groups}, 662 {"EC point formats", TLSEXT_TYPE_ec_point_formats}, 663 {"SRP", TLSEXT_TYPE_srp}, 664 {"signature algorithms", TLSEXT_TYPE_signature_algorithms}, 665 {"use SRTP", TLSEXT_TYPE_use_srtp}, 666 {"heartbeat", TLSEXT_TYPE_heartbeat}, 667 {"session ticket", TLSEXT_TYPE_session_ticket}, 668 {"renegotiation info", TLSEXT_TYPE_renegotiate}, 669 {"signed certificate timestamps", TLSEXT_TYPE_signed_certificate_timestamp}, 670 {"TLS padding", TLSEXT_TYPE_padding}, 671 #ifdef TLSEXT_TYPE_next_proto_neg 672 {"next protocol", TLSEXT_TYPE_next_proto_neg}, 673 #endif 674 #ifdef TLSEXT_TYPE_encrypt_then_mac 675 {"encrypt-then-mac", TLSEXT_TYPE_encrypt_then_mac}, 676 #endif 677 #ifdef TLSEXT_TYPE_application_layer_protocol_negotiation 678 {"application layer protocol negotiation", 679 TLSEXT_TYPE_application_layer_protocol_negotiation}, 680 #endif 681 #ifdef TLSEXT_TYPE_extended_master_secret 682 {"extended master secret", TLSEXT_TYPE_extended_master_secret}, 683 #endif 684 {"key share", TLSEXT_TYPE_key_share}, 685 {"supported versions", TLSEXT_TYPE_supported_versions}, 686 {"psk", TLSEXT_TYPE_psk}, 687 {"psk kex modes", TLSEXT_TYPE_psk_kex_modes}, 688 {"certificate authorities", TLSEXT_TYPE_certificate_authorities}, 689 {"post handshake auth", TLSEXT_TYPE_post_handshake_auth}, 690 {NULL} 691 }; 692 693 /* from rfc8446 4.2.3. + gost (https://tools.ietf.org/id/draft-smyshlyaev-tls12-gost-suites-04.html) */ 694 static STRINT_PAIR signature_tls13_scheme_list[] = { 695 {"rsa_pkcs1_sha1", 0x0201 /* TLSEXT_SIGALG_rsa_pkcs1_sha1 */}, 696 {"ecdsa_sha1", 0x0203 /* TLSEXT_SIGALG_ecdsa_sha1 */}, 697 /* {"rsa_pkcs1_sha224", 0x0301 TLSEXT_SIGALG_rsa_pkcs1_sha224}, not in rfc8446 */ 698 /* {"ecdsa_sha224", 0x0303 TLSEXT_SIGALG_ecdsa_sha224} not in rfc8446 */ 699 {"rsa_pkcs1_sha256", 0x0401 /* TLSEXT_SIGALG_rsa_pkcs1_sha256 */}, 700 {"ecdsa_secp256r1_sha256", 0x0403 /* TLSEXT_SIGALG_ecdsa_secp256r1_sha256 */}, 701 {"rsa_pkcs1_sha384", 0x0501 /* TLSEXT_SIGALG_rsa_pkcs1_sha384 */}, 702 {"ecdsa_secp384r1_sha384", 0x0503 /* TLSEXT_SIGALG_ecdsa_secp384r1_sha384 */}, 703 {"rsa_pkcs1_sha512", 0x0601 /* TLSEXT_SIGALG_rsa_pkcs1_sha512 */}, 704 {"ecdsa_secp521r1_sha512", 0x0603 /* TLSEXT_SIGALG_ecdsa_secp521r1_sha512 */}, 705 {"rsa_pss_rsae_sha256", 0x0804 /* TLSEXT_SIGALG_rsa_pss_rsae_sha256 */}, 706 {"rsa_pss_rsae_sha384", 0x0805 /* TLSEXT_SIGALG_rsa_pss_rsae_sha384 */}, 707 {"rsa_pss_rsae_sha512", 0x0806 /* TLSEXT_SIGALG_rsa_pss_rsae_sha512 */}, 708 {"ed25519", 0x0807 /* TLSEXT_SIGALG_ed25519 */}, 709 {"ed448", 0x0808 /* TLSEXT_SIGALG_ed448 */}, 710 {"rsa_pss_pss_sha256", 0x0809 /* TLSEXT_SIGALG_rsa_pss_pss_sha256 */}, 711 {"rsa_pss_pss_sha384", 0x080a /* TLSEXT_SIGALG_rsa_pss_pss_sha384 */}, 712 {"rsa_pss_pss_sha512", 0x080b /* TLSEXT_SIGALG_rsa_pss_pss_sha512 */}, 713 {"gostr34102001", 0xeded /* TLSEXT_SIGALG_gostr34102001_gostr3411 */}, 714 {"gostr34102012_256", 0xeeee /* TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256 */}, 715 {"gostr34102012_512", 0xefef /* TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512 */}, 716 {NULL} 717 }; 718 719 /* from rfc5246 7.4.1.4.1. */ 720 static STRINT_PAIR signature_tls12_alg_list[] = { 721 {"anonymous", TLSEXT_signature_anonymous /* 0 */}, 722 {"RSA", TLSEXT_signature_rsa /* 1 */}, 723 {"DSA", TLSEXT_signature_dsa /* 2 */}, 724 {"ECDSA", TLSEXT_signature_ecdsa /* 3 */}, 725 {NULL} 726 }; 727 728 /* from rfc5246 7.4.1.4.1. */ 729 static STRINT_PAIR signature_tls12_hash_list[] = { 730 {"none", TLSEXT_hash_none /* 0 */}, 731 {"MD5", TLSEXT_hash_md5 /* 1 */}, 732 {"SHA1", TLSEXT_hash_sha1 /* 2 */}, 733 {"SHA224", TLSEXT_hash_sha224 /* 3 */}, 734 {"SHA256", TLSEXT_hash_sha256 /* 4 */}, 735 {"SHA384", TLSEXT_hash_sha384 /* 5 */}, 736 {"SHA512", TLSEXT_hash_sha512 /* 6 */}, 737 {NULL} 738 }; 739 740 void tlsext_cb(SSL *s, int client_server, int type, 741 const unsigned char *data, int len, void *arg) 742 { 743 BIO *bio = arg; 744 const char *extname = lookup(type, tlsext_types, "unknown"); 745 746 BIO_printf(bio, "TLS %s extension \"%s\" (id=%d), len=%d\n", 747 client_server ? "server" : "client", extname, type, len); 748 BIO_dump(bio, (const char *)data, len); 749 (void)BIO_flush(bio); 750 } 751 752 #ifndef OPENSSL_NO_SOCK 753 int generate_cookie_callback(SSL *ssl, unsigned char *cookie, 754 unsigned int *cookie_len) 755 { 756 unsigned char *buffer; 757 size_t length = 0; 758 unsigned short port; 759 BIO_ADDR *lpeer = NULL, *peer = NULL; 760 761 /* Initialize a random secret */ 762 if (!cookie_initialized) { 763 if (RAND_bytes(cookie_secret, COOKIE_SECRET_LENGTH) <= 0) { 764 BIO_printf(bio_err, "error setting random cookie secret\n"); 765 return 0; 766 } 767 cookie_initialized = 1; 768 } 769 770 if (SSL_is_dtls(ssl)) { 771 lpeer = peer = BIO_ADDR_new(); 772 if (peer == NULL) { 773 BIO_printf(bio_err, "memory full\n"); 774 return 0; 775 } 776 777 /* Read peer information */ 778 (void)BIO_dgram_get_peer(SSL_get_rbio(ssl), peer); 779 } else { 780 peer = ourpeer; 781 } 782 783 /* Create buffer with peer's address and port */ 784 if (!BIO_ADDR_rawaddress(peer, NULL, &length)) { 785 BIO_printf(bio_err, "Failed getting peer address\n"); 786 return 0; 787 } 788 OPENSSL_assert(length != 0); 789 port = BIO_ADDR_rawport(peer); 790 length += sizeof(port); 791 buffer = app_malloc(length, "cookie generate buffer"); 792 793 memcpy(buffer, &port, sizeof(port)); 794 BIO_ADDR_rawaddress(peer, buffer + sizeof(port), NULL); 795 796 /* Calculate HMAC of buffer using the secret */ 797 HMAC(EVP_sha1(), cookie_secret, COOKIE_SECRET_LENGTH, 798 buffer, length, cookie, cookie_len); 799 800 OPENSSL_free(buffer); 801 BIO_ADDR_free(lpeer); 802 803 return 1; 804 } 805 806 int verify_cookie_callback(SSL *ssl, const unsigned char *cookie, 807 unsigned int cookie_len) 808 { 809 unsigned char result[EVP_MAX_MD_SIZE]; 810 unsigned int resultlength; 811 812 /* Note: we check cookie_initialized because if it's not, 813 * it cannot be valid */ 814 if (cookie_initialized 815 && generate_cookie_callback(ssl, result, &resultlength) 816 && cookie_len == resultlength 817 && memcmp(result, cookie, resultlength) == 0) 818 return 1; 819 820 return 0; 821 } 822 823 int generate_stateless_cookie_callback(SSL *ssl, unsigned char *cookie, 824 size_t *cookie_len) 825 { 826 unsigned int temp; 827 int res = generate_cookie_callback(ssl, cookie, &temp); 828 829 if (res != 0) 830 *cookie_len = temp; 831 return res; 832 } 833 834 int verify_stateless_cookie_callback(SSL *ssl, const unsigned char *cookie, 835 size_t cookie_len) 836 { 837 return verify_cookie_callback(ssl, cookie, cookie_len); 838 } 839 840 #endif 841 842 /* 843 * Example of extended certificate handling. Where the standard support of 844 * one certificate per algorithm is not sufficient an application can decide 845 * which certificate(s) to use at runtime based on whatever criteria it deems 846 * appropriate. 847 */ 848 849 /* Linked list of certificates, keys and chains */ 850 struct ssl_excert_st { 851 int certform; 852 const char *certfile; 853 int keyform; 854 const char *keyfile; 855 const char *chainfile; 856 X509 *cert; 857 EVP_PKEY *key; 858 STACK_OF(X509) *chain; 859 int build_chain; 860 struct ssl_excert_st *next, *prev; 861 }; 862 863 static STRINT_PAIR chain_flags[] = { 864 {"Overall Validity", CERT_PKEY_VALID}, 865 {"Sign with EE key", CERT_PKEY_SIGN}, 866 {"EE signature", CERT_PKEY_EE_SIGNATURE}, 867 {"CA signature", CERT_PKEY_CA_SIGNATURE}, 868 {"EE key parameters", CERT_PKEY_EE_PARAM}, 869 {"CA key parameters", CERT_PKEY_CA_PARAM}, 870 {"Explicitly sign with EE key", CERT_PKEY_EXPLICIT_SIGN}, 871 {"Issuer Name", CERT_PKEY_ISSUER_NAME}, 872 {"Certificate Type", CERT_PKEY_CERT_TYPE}, 873 {NULL} 874 }; 875 876 static void print_chain_flags(SSL *s, int flags) 877 { 878 STRINT_PAIR *pp; 879 880 for (pp = chain_flags; pp->name; ++pp) 881 BIO_printf(bio_err, "\t%s: %s\n", 882 pp->name, 883 (flags & pp->retval) ? "OK" : "NOT OK"); 884 BIO_printf(bio_err, "\tSuite B: "); 885 if (SSL_set_cert_flags(s, 0) & SSL_CERT_FLAG_SUITEB_128_LOS) 886 BIO_puts(bio_err, flags & CERT_PKEY_SUITEB ? "OK\n" : "NOT OK\n"); 887 else 888 BIO_printf(bio_err, "not tested\n"); 889 } 890 891 /* 892 * Very basic selection callback: just use any certificate chain reported as 893 * valid. More sophisticated could prioritise according to local policy. 894 */ 895 static int set_cert_cb(SSL *ssl, void *arg) 896 { 897 int i, rv; 898 SSL_EXCERT *exc = arg; 899 #ifdef CERT_CB_TEST_RETRY 900 static int retry_cnt; 901 if (retry_cnt < 5) { 902 retry_cnt++; 903 BIO_printf(bio_err, 904 "Certificate callback retry test: count %d\n", 905 retry_cnt); 906 return -1; 907 } 908 #endif 909 SSL_certs_clear(ssl); 910 911 if (exc == NULL) 912 return 1; 913 914 /* 915 * Go to end of list and traverse backwards since we prepend newer 916 * entries this retains the original order. 917 */ 918 while (exc->next != NULL) 919 exc = exc->next; 920 921 i = 0; 922 923 while (exc != NULL) { 924 i++; 925 rv = SSL_check_chain(ssl, exc->cert, exc->key, exc->chain); 926 BIO_printf(bio_err, "Checking cert chain %d:\nSubject: ", i); 927 X509_NAME_print_ex(bio_err, X509_get_subject_name(exc->cert), 0, 928 get_nameopt()); 929 BIO_puts(bio_err, "\n"); 930 print_chain_flags(ssl, rv); 931 if (rv & CERT_PKEY_VALID) { 932 if (!SSL_use_certificate(ssl, exc->cert) 933 || !SSL_use_PrivateKey(ssl, exc->key)) { 934 return 0; 935 } 936 /* 937 * NB: we wouldn't normally do this as it is not efficient 938 * building chains on each connection better to cache the chain 939 * in advance. 940 */ 941 if (exc->build_chain) { 942 if (!SSL_build_cert_chain(ssl, 0)) 943 return 0; 944 } else if (exc->chain != NULL) { 945 if (!SSL_set1_chain(ssl, exc->chain)) 946 return 0; 947 } 948 } 949 exc = exc->prev; 950 } 951 return 1; 952 } 953 954 void ssl_ctx_set_excert(SSL_CTX *ctx, SSL_EXCERT *exc) 955 { 956 SSL_CTX_set_cert_cb(ctx, set_cert_cb, exc); 957 } 958 959 static int ssl_excert_prepend(SSL_EXCERT **pexc) 960 { 961 SSL_EXCERT *exc = app_malloc(sizeof(*exc), "prepend cert"); 962 963 memset(exc, 0, sizeof(*exc)); 964 965 exc->next = *pexc; 966 *pexc = exc; 967 968 if (exc->next) { 969 exc->certform = exc->next->certform; 970 exc->keyform = exc->next->keyform; 971 exc->next->prev = exc; 972 } else { 973 exc->certform = FORMAT_PEM; 974 exc->keyform = FORMAT_PEM; 975 } 976 return 1; 977 978 } 979 980 void ssl_excert_free(SSL_EXCERT *exc) 981 { 982 SSL_EXCERT *curr; 983 984 if (exc == NULL) 985 return; 986 while (exc) { 987 X509_free(exc->cert); 988 EVP_PKEY_free(exc->key); 989 sk_X509_pop_free(exc->chain, X509_free); 990 curr = exc; 991 exc = exc->next; 992 OPENSSL_free(curr); 993 } 994 } 995 996 int load_excert(SSL_EXCERT **pexc) 997 { 998 SSL_EXCERT *exc = *pexc; 999 if (exc == NULL) 1000 return 1; 1001 /* If nothing in list, free and set to NULL */ 1002 if (exc->certfile == NULL && exc->next == NULL) { 1003 ssl_excert_free(exc); 1004 *pexc = NULL; 1005 return 1; 1006 } 1007 for (; exc; exc = exc->next) { 1008 if (exc->certfile == NULL) { 1009 BIO_printf(bio_err, "Missing filename\n"); 1010 return 0; 1011 } 1012 exc->cert = load_cert(exc->certfile, exc->certform, 1013 "Server Certificate"); 1014 if (exc->cert == NULL) 1015 return 0; 1016 if (exc->keyfile != NULL) { 1017 exc->key = load_key(exc->keyfile, exc->keyform, 1018 0, NULL, NULL, "Server Key"); 1019 } else { 1020 exc->key = load_key(exc->certfile, exc->certform, 1021 0, NULL, NULL, "Server Key"); 1022 } 1023 if (exc->key == NULL) 1024 return 0; 1025 if (exc->chainfile != NULL) { 1026 if (!load_certs(exc->chainfile, &exc->chain, FORMAT_PEM, NULL, 1027 "Server Chain")) 1028 return 0; 1029 } 1030 } 1031 return 1; 1032 } 1033 1034 enum range { OPT_X_ENUM }; 1035 1036 int args_excert(int opt, SSL_EXCERT **pexc) 1037 { 1038 SSL_EXCERT *exc = *pexc; 1039 1040 assert(opt > OPT_X__FIRST); 1041 assert(opt < OPT_X__LAST); 1042 1043 if (exc == NULL) { 1044 if (!ssl_excert_prepend(&exc)) { 1045 BIO_printf(bio_err, " %s: Error initialising xcert\n", 1046 opt_getprog()); 1047 goto err; 1048 } 1049 *pexc = exc; 1050 } 1051 1052 switch ((enum range)opt) { 1053 case OPT_X__FIRST: 1054 case OPT_X__LAST: 1055 return 0; 1056 case OPT_X_CERT: 1057 if (exc->certfile != NULL && !ssl_excert_prepend(&exc)) { 1058 BIO_printf(bio_err, "%s: Error adding xcert\n", opt_getprog()); 1059 goto err; 1060 } 1061 *pexc = exc; 1062 exc->certfile = opt_arg(); 1063 break; 1064 case OPT_X_KEY: 1065 if (exc->keyfile != NULL) { 1066 BIO_printf(bio_err, "%s: Key already specified\n", opt_getprog()); 1067 goto err; 1068 } 1069 exc->keyfile = opt_arg(); 1070 break; 1071 case OPT_X_CHAIN: 1072 if (exc->chainfile != NULL) { 1073 BIO_printf(bio_err, "%s: Chain already specified\n", 1074 opt_getprog()); 1075 goto err; 1076 } 1077 exc->chainfile = opt_arg(); 1078 break; 1079 case OPT_X_CHAIN_BUILD: 1080 exc->build_chain = 1; 1081 break; 1082 case OPT_X_CERTFORM: 1083 if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &exc->certform)) 1084 return 0; 1085 break; 1086 case OPT_X_KEYFORM: 1087 if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &exc->keyform)) 1088 return 0; 1089 break; 1090 } 1091 return 1; 1092 1093 err: 1094 ERR_print_errors(bio_err); 1095 ssl_excert_free(exc); 1096 *pexc = NULL; 1097 return 0; 1098 } 1099 1100 static void print_raw_cipherlist(SSL *s) 1101 { 1102 const unsigned char *rlist; 1103 static const unsigned char scsv_id[] = { 0, 0xFF }; 1104 size_t i, rlistlen, num; 1105 if (!SSL_is_server(s)) 1106 return; 1107 num = SSL_get0_raw_cipherlist(s, NULL); 1108 OPENSSL_assert(num == 2); 1109 rlistlen = SSL_get0_raw_cipherlist(s, &rlist); 1110 BIO_puts(bio_err, "Client cipher list: "); 1111 for (i = 0; i < rlistlen; i += num, rlist += num) { 1112 const SSL_CIPHER *c = SSL_CIPHER_find(s, rlist); 1113 if (i) 1114 BIO_puts(bio_err, ":"); 1115 if (c != NULL) { 1116 BIO_puts(bio_err, SSL_CIPHER_get_name(c)); 1117 } else if (memcmp(rlist, scsv_id, num) == 0) { 1118 BIO_puts(bio_err, "SCSV"); 1119 } else { 1120 size_t j; 1121 BIO_puts(bio_err, "0x"); 1122 for (j = 0; j < num; j++) 1123 BIO_printf(bio_err, "%02X", rlist[j]); 1124 } 1125 } 1126 BIO_puts(bio_err, "\n"); 1127 } 1128 1129 /* 1130 * Hex encoder for TLSA RRdata, not ':' delimited. 1131 */ 1132 static char *hexencode(const unsigned char *data, size_t len) 1133 { 1134 static const char *hex = "0123456789abcdef"; 1135 char *out; 1136 char *cp; 1137 size_t outlen = 2 * len + 1; 1138 int ilen = (int) outlen; 1139 1140 if (outlen < len || ilen < 0 || outlen != (size_t)ilen) { 1141 BIO_printf(bio_err, "%s: %zu-byte buffer too large to hexencode\n", 1142 opt_getprog(), len); 1143 exit(1); 1144 } 1145 cp = out = app_malloc(ilen, "TLSA hex data buffer"); 1146 1147 while (len-- > 0) { 1148 *cp++ = hex[(*data >> 4) & 0x0f]; 1149 *cp++ = hex[*data++ & 0x0f]; 1150 } 1151 *cp = '\0'; 1152 return out; 1153 } 1154 1155 void print_verify_detail(SSL *s, BIO *bio) 1156 { 1157 int mdpth; 1158 EVP_PKEY *mspki; 1159 long verify_err = SSL_get_verify_result(s); 1160 1161 if (verify_err == X509_V_OK) { 1162 const char *peername = SSL_get0_peername(s); 1163 1164 BIO_printf(bio, "Verification: OK\n"); 1165 if (peername != NULL) 1166 BIO_printf(bio, "Verified peername: %s\n", peername); 1167 } else { 1168 const char *reason = X509_verify_cert_error_string(verify_err); 1169 1170 BIO_printf(bio, "Verification error: %s\n", reason); 1171 } 1172 1173 if ((mdpth = SSL_get0_dane_authority(s, NULL, &mspki)) >= 0) { 1174 uint8_t usage, selector, mtype; 1175 const unsigned char *data = NULL; 1176 size_t dlen = 0; 1177 char *hexdata; 1178 1179 mdpth = SSL_get0_dane_tlsa(s, &usage, &selector, &mtype, &data, &dlen); 1180 1181 /* 1182 * The TLSA data field can be quite long when it is a certificate, 1183 * public key or even a SHA2-512 digest. Because the initial octets of 1184 * ASN.1 certificates and public keys contain mostly boilerplate OIDs 1185 * and lengths, we show the last 12 bytes of the data instead, as these 1186 * are more likely to distinguish distinct TLSA records. 1187 */ 1188 #define TLSA_TAIL_SIZE 12 1189 if (dlen > TLSA_TAIL_SIZE) 1190 hexdata = hexencode(data + dlen - TLSA_TAIL_SIZE, TLSA_TAIL_SIZE); 1191 else 1192 hexdata = hexencode(data, dlen); 1193 BIO_printf(bio, "DANE TLSA %d %d %d %s%s %s at depth %d\n", 1194 usage, selector, mtype, 1195 (dlen > TLSA_TAIL_SIZE) ? "..." : "", hexdata, 1196 (mspki != NULL) ? "signed the certificate" : 1197 mdpth ? "matched TA certificate" : "matched EE certificate", 1198 mdpth); 1199 OPENSSL_free(hexdata); 1200 } 1201 } 1202 1203 void print_ssl_summary(SSL *s) 1204 { 1205 const SSL_CIPHER *c; 1206 X509 *peer; 1207 1208 BIO_printf(bio_err, "Protocol version: %s\n", SSL_get_version(s)); 1209 print_raw_cipherlist(s); 1210 c = SSL_get_current_cipher(s); 1211 BIO_printf(bio_err, "Ciphersuite: %s\n", SSL_CIPHER_get_name(c)); 1212 do_print_sigalgs(bio_err, s, 0); 1213 peer = SSL_get_peer_certificate(s); 1214 if (peer != NULL) { 1215 int nid; 1216 1217 BIO_puts(bio_err, "Peer certificate: "); 1218 X509_NAME_print_ex(bio_err, X509_get_subject_name(peer), 1219 0, get_nameopt()); 1220 BIO_puts(bio_err, "\n"); 1221 if (SSL_get_peer_signature_nid(s, &nid)) 1222 BIO_printf(bio_err, "Hash used: %s\n", OBJ_nid2sn(nid)); 1223 if (SSL_get_peer_signature_type_nid(s, &nid)) 1224 BIO_printf(bio_err, "Signature type: %s\n", get_sigtype(nid)); 1225 print_verify_detail(s, bio_err); 1226 } else { 1227 BIO_puts(bio_err, "No peer certificate\n"); 1228 } 1229 X509_free(peer); 1230 #ifndef OPENSSL_NO_EC 1231 ssl_print_point_formats(bio_err, s); 1232 if (SSL_is_server(s)) 1233 ssl_print_groups(bio_err, s, 1); 1234 else 1235 ssl_print_tmp_key(bio_err, s); 1236 #else 1237 if (!SSL_is_server(s)) 1238 ssl_print_tmp_key(bio_err, s); 1239 #endif 1240 } 1241 1242 int config_ctx(SSL_CONF_CTX *cctx, STACK_OF(OPENSSL_STRING) *str, 1243 SSL_CTX *ctx) 1244 { 1245 int i; 1246 1247 SSL_CONF_CTX_set_ssl_ctx(cctx, ctx); 1248 for (i = 0; i < sk_OPENSSL_STRING_num(str); i += 2) { 1249 const char *flag = sk_OPENSSL_STRING_value(str, i); 1250 const char *arg = sk_OPENSSL_STRING_value(str, i + 1); 1251 if (SSL_CONF_cmd(cctx, flag, arg) <= 0) { 1252 if (arg != NULL) 1253 BIO_printf(bio_err, "Error with command: \"%s %s\"\n", 1254 flag, arg); 1255 else 1256 BIO_printf(bio_err, "Error with command: \"%s\"\n", flag); 1257 ERR_print_errors(bio_err); 1258 return 0; 1259 } 1260 } 1261 if (!SSL_CONF_CTX_finish(cctx)) { 1262 BIO_puts(bio_err, "Error finishing context\n"); 1263 ERR_print_errors(bio_err); 1264 return 0; 1265 } 1266 return 1; 1267 } 1268 1269 static int add_crls_store(X509_STORE *st, STACK_OF(X509_CRL) *crls) 1270 { 1271 X509_CRL *crl; 1272 int i; 1273 for (i = 0; i < sk_X509_CRL_num(crls); i++) { 1274 crl = sk_X509_CRL_value(crls, i); 1275 X509_STORE_add_crl(st, crl); 1276 } 1277 return 1; 1278 } 1279 1280 int ssl_ctx_add_crls(SSL_CTX *ctx, STACK_OF(X509_CRL) *crls, int crl_download) 1281 { 1282 X509_STORE *st; 1283 st = SSL_CTX_get_cert_store(ctx); 1284 add_crls_store(st, crls); 1285 if (crl_download) 1286 store_setup_crl_download(st); 1287 return 1; 1288 } 1289 1290 int ssl_load_stores(SSL_CTX *ctx, 1291 const char *vfyCApath, const char *vfyCAfile, 1292 const char *chCApath, const char *chCAfile, 1293 STACK_OF(X509_CRL) *crls, int crl_download) 1294 { 1295 X509_STORE *vfy = NULL, *ch = NULL; 1296 int rv = 0; 1297 if (vfyCApath != NULL || vfyCAfile != NULL) { 1298 vfy = X509_STORE_new(); 1299 if (vfy == NULL) 1300 goto err; 1301 if (!X509_STORE_load_locations(vfy, vfyCAfile, vfyCApath)) 1302 goto err; 1303 add_crls_store(vfy, crls); 1304 SSL_CTX_set1_verify_cert_store(ctx, vfy); 1305 if (crl_download) 1306 store_setup_crl_download(vfy); 1307 } 1308 if (chCApath != NULL || chCAfile != NULL) { 1309 ch = X509_STORE_new(); 1310 if (ch == NULL) 1311 goto err; 1312 if (!X509_STORE_load_locations(ch, chCAfile, chCApath)) 1313 goto err; 1314 SSL_CTX_set1_chain_cert_store(ctx, ch); 1315 } 1316 rv = 1; 1317 err: 1318 X509_STORE_free(vfy); 1319 X509_STORE_free(ch); 1320 return rv; 1321 } 1322 1323 /* Verbose print out of security callback */ 1324 1325 typedef struct { 1326 BIO *out; 1327 int verbose; 1328 int (*old_cb) (const SSL *s, const SSL_CTX *ctx, int op, int bits, int nid, 1329 void *other, void *ex); 1330 } security_debug_ex; 1331 1332 static STRINT_PAIR callback_types[] = { 1333 {"Supported Ciphersuite", SSL_SECOP_CIPHER_SUPPORTED}, 1334 {"Shared Ciphersuite", SSL_SECOP_CIPHER_SHARED}, 1335 {"Check Ciphersuite", SSL_SECOP_CIPHER_CHECK}, 1336 #ifndef OPENSSL_NO_DH 1337 {"Temp DH key bits", SSL_SECOP_TMP_DH}, 1338 #endif 1339 {"Supported Curve", SSL_SECOP_CURVE_SUPPORTED}, 1340 {"Shared Curve", SSL_SECOP_CURVE_SHARED}, 1341 {"Check Curve", SSL_SECOP_CURVE_CHECK}, 1342 {"Supported Signature Algorithm", SSL_SECOP_SIGALG_SUPPORTED}, 1343 {"Shared Signature Algorithm", SSL_SECOP_SIGALG_SHARED}, 1344 {"Check Signature Algorithm", SSL_SECOP_SIGALG_CHECK}, 1345 {"Signature Algorithm mask", SSL_SECOP_SIGALG_MASK}, 1346 {"Certificate chain EE key", SSL_SECOP_EE_KEY}, 1347 {"Certificate chain CA key", SSL_SECOP_CA_KEY}, 1348 {"Peer Chain EE key", SSL_SECOP_PEER_EE_KEY}, 1349 {"Peer Chain CA key", SSL_SECOP_PEER_CA_KEY}, 1350 {"Certificate chain CA digest", SSL_SECOP_CA_MD}, 1351 {"Peer chain CA digest", SSL_SECOP_PEER_CA_MD}, 1352 {"SSL compression", SSL_SECOP_COMPRESSION}, 1353 {"Session ticket", SSL_SECOP_TICKET}, 1354 {NULL} 1355 }; 1356 1357 static int security_callback_debug(const SSL *s, const SSL_CTX *ctx, 1358 int op, int bits, int nid, 1359 void *other, void *ex) 1360 { 1361 security_debug_ex *sdb = ex; 1362 int rv, show_bits = 1, cert_md = 0; 1363 const char *nm; 1364 int show_nm; 1365 rv = sdb->old_cb(s, ctx, op, bits, nid, other, ex); 1366 if (rv == 1 && sdb->verbose < 2) 1367 return 1; 1368 BIO_puts(sdb->out, "Security callback: "); 1369 1370 nm = lookup(op, callback_types, NULL); 1371 show_nm = nm != NULL; 1372 switch (op) { 1373 case SSL_SECOP_TICKET: 1374 case SSL_SECOP_COMPRESSION: 1375 show_bits = 0; 1376 show_nm = 0; 1377 break; 1378 case SSL_SECOP_VERSION: 1379 BIO_printf(sdb->out, "Version=%s", lookup(nid, ssl_versions, "???")); 1380 show_bits = 0; 1381 show_nm = 0; 1382 break; 1383 case SSL_SECOP_CA_MD: 1384 case SSL_SECOP_PEER_CA_MD: 1385 cert_md = 1; 1386 break; 1387 case SSL_SECOP_SIGALG_SUPPORTED: 1388 case SSL_SECOP_SIGALG_SHARED: 1389 case SSL_SECOP_SIGALG_CHECK: 1390 case SSL_SECOP_SIGALG_MASK: 1391 show_nm = 0; 1392 break; 1393 } 1394 if (show_nm) 1395 BIO_printf(sdb->out, "%s=", nm); 1396 1397 switch (op & SSL_SECOP_OTHER_TYPE) { 1398 1399 case SSL_SECOP_OTHER_CIPHER: 1400 BIO_puts(sdb->out, SSL_CIPHER_get_name(other)); 1401 break; 1402 1403 #ifndef OPENSSL_NO_EC 1404 case SSL_SECOP_OTHER_CURVE: 1405 { 1406 const char *cname; 1407 cname = EC_curve_nid2nist(nid); 1408 if (cname == NULL) 1409 cname = OBJ_nid2sn(nid); 1410 BIO_puts(sdb->out, cname); 1411 } 1412 break; 1413 #endif 1414 #ifndef OPENSSL_NO_DH 1415 case SSL_SECOP_OTHER_DH: 1416 { 1417 DH *dh = other; 1418 BIO_printf(sdb->out, "%d", DH_bits(dh)); 1419 break; 1420 } 1421 #endif 1422 case SSL_SECOP_OTHER_CERT: 1423 { 1424 if (cert_md) { 1425 int sig_nid = X509_get_signature_nid(other); 1426 BIO_puts(sdb->out, OBJ_nid2sn(sig_nid)); 1427 } else { 1428 EVP_PKEY *pkey = X509_get0_pubkey(other); 1429 const char *algname = ""; 1430 EVP_PKEY_asn1_get0_info(NULL, NULL, NULL, NULL, 1431 &algname, EVP_PKEY_get0_asn1(pkey)); 1432 BIO_printf(sdb->out, "%s, bits=%d", 1433 algname, EVP_PKEY_bits(pkey)); 1434 } 1435 break; 1436 } 1437 case SSL_SECOP_OTHER_SIGALG: 1438 { 1439 const unsigned char *salg = other; 1440 const char *sname = NULL; 1441 int raw_sig_code = (salg[0] << 8) + salg[1]; /* always big endian (msb, lsb) */ 1442 /* raw_sig_code: signature_scheme from tls1.3, or signature_and_hash from tls1.2 */ 1443 1444 if (nm != NULL) 1445 BIO_printf(sdb->out, "%s", nm); 1446 else 1447 BIO_printf(sdb->out, "s_cb.c:security_callback_debug op=0x%x", op); 1448 1449 sname = lookup(raw_sig_code, signature_tls13_scheme_list, NULL); 1450 if (sname != NULL) { 1451 BIO_printf(sdb->out, " scheme=%s", sname); 1452 } else { 1453 int alg_code = salg[1]; 1454 int hash_code = salg[0]; 1455 const char *alg_str = lookup(alg_code, signature_tls12_alg_list, NULL); 1456 const char *hash_str = lookup(hash_code, signature_tls12_hash_list, NULL); 1457 1458 if (alg_str != NULL && hash_str != NULL) 1459 BIO_printf(sdb->out, " digest=%s, algorithm=%s", hash_str, alg_str); 1460 else 1461 BIO_printf(sdb->out, " scheme=unknown(0x%04x)", raw_sig_code); 1462 } 1463 } 1464 1465 } 1466 1467 if (show_bits) 1468 BIO_printf(sdb->out, ", security bits=%d", bits); 1469 BIO_printf(sdb->out, ": %s\n", rv ? "yes" : "no"); 1470 return rv; 1471 } 1472 1473 void ssl_ctx_security_debug(SSL_CTX *ctx, int verbose) 1474 { 1475 static security_debug_ex sdb; 1476 1477 sdb.out = bio_err; 1478 sdb.verbose = verbose; 1479 sdb.old_cb = SSL_CTX_get_security_callback(ctx); 1480 SSL_CTX_set_security_callback(ctx, security_callback_debug); 1481 SSL_CTX_set0_security_ex_data(ctx, &sdb); 1482 } 1483 1484 static void keylog_callback(const SSL *ssl, const char *line) 1485 { 1486 if (bio_keylog == NULL) { 1487 BIO_printf(bio_err, "Keylog callback is invoked without valid file!\n"); 1488 return; 1489 } 1490 1491 /* 1492 * There might be concurrent writers to the keylog file, so we must ensure 1493 * that the given line is written at once. 1494 */ 1495 BIO_printf(bio_keylog, "%s\n", line); 1496 (void)BIO_flush(bio_keylog); 1497 } 1498 1499 int set_keylog_file(SSL_CTX *ctx, const char *keylog_file) 1500 { 1501 /* Close any open files */ 1502 BIO_free_all(bio_keylog); 1503 bio_keylog = NULL; 1504 1505 if (ctx == NULL || keylog_file == NULL) { 1506 /* Keylogging is disabled, OK. */ 1507 return 0; 1508 } 1509 1510 /* 1511 * Append rather than write in order to allow concurrent modification. 1512 * Furthermore, this preserves existing keylog files which is useful when 1513 * the tool is run multiple times. 1514 */ 1515 bio_keylog = BIO_new_file(keylog_file, "a"); 1516 if (bio_keylog == NULL) { 1517 BIO_printf(bio_err, "Error writing keylog file %s\n", keylog_file); 1518 return 1; 1519 } 1520 1521 /* Write a header for seekable, empty files (this excludes pipes). */ 1522 if (BIO_tell(bio_keylog) == 0) { 1523 BIO_puts(bio_keylog, 1524 "# SSL/TLS secrets log file, generated by OpenSSL\n"); 1525 (void)BIO_flush(bio_keylog); 1526 } 1527 SSL_CTX_set_keylog_callback(ctx, keylog_callback); 1528 return 0; 1529 } 1530 1531 void print_ca_names(BIO *bio, SSL *s) 1532 { 1533 const char *cs = SSL_is_server(s) ? "server" : "client"; 1534 const STACK_OF(X509_NAME) *sk = SSL_get0_peer_CA_list(s); 1535 int i; 1536 1537 if (sk == NULL || sk_X509_NAME_num(sk) == 0) { 1538 if (!SSL_is_server(s)) 1539 BIO_printf(bio, "---\nNo %s certificate CA names sent\n", cs); 1540 return; 1541 } 1542 1543 BIO_printf(bio, "---\nAcceptable %s certificate CA names\n",cs); 1544 for (i = 0; i < sk_X509_NAME_num(sk); i++) { 1545 X509_NAME_print_ex(bio, sk_X509_NAME_value(sk, i), 0, get_nameopt()); 1546 BIO_write(bio, "\n", 1); 1547 } 1548 } 1549
Indexes created Tue Mar 03 05:31:39 UTC 2026