1 /* $OpenBSD: client.c,v 1.10 2020/09/14 00:51:04 bluhm Exp $ */ 2 /* 3 * Copyright (c) 2018-2019 Alexander Bluhm <bluhm@openbsd.org> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 #include <sys/types.h> 19 #include <sys/socket.h> 20 21 #include <err.h> 22 #include <netdb.h> 23 #include <stdio.h> 24 #include <string.h> 25 #include <unistd.h> 26 27 #include <openssl/err.h> 28 #include <openssl/ssl.h> 29 30 #include "util.h" 31 32 void __dead usage(void); 33 34 void __dead 35 usage(void) 36 { 37 fprintf(stderr, "usage: client [-Lsv] [-C CA] [-c crt -k key] " 38 "[-l ciphers] [-V version] host port\n"); 39 exit(2); 40 } 41 42 int 43 main(int argc, char *argv[]) 44 { 45 const SSL_METHOD *method; 46 SSL_CTX *ctx; 47 SSL *ssl; 48 BIO *bio; 49 SSL_SESSION *session = NULL; 50 int ch, error, listciphers = 0, sessionreuse = 0, verify = 0; 51 int version = 0; 52 char buf[256]; 53 char *ca = NULL, *crt = NULL, *key = NULL, *ciphers = NULL; 54 char *host_port, *host = "127.0.0.1", *port = "0"; 55 56 while ((ch = getopt(argc, argv, "C:c:k:Ll:p:sV:v")) != -1) { 57 switch (ch) { 58 case 'C': 59 ca = optarg; 60 break; 61 case 'c': 62 crt = optarg; 63 break; 64 case 'k': 65 key = optarg; 66 break; 67 case 'L': 68 listciphers = 1; 69 break; 70 case 'l': 71 ciphers = optarg; 72 break; 73 case 's': 74 /* multiple reueses are possible */ 75 sessionreuse++; 76 break; 77 case 'V': 78 if (strcmp(optarg, "TLS1") == 0) { 79 version = TLS1_VERSION; 80 } else if (strcmp(optarg, "TLS1_1") == 0) { 81 version = TLS1_1_VERSION; 82 } else if (strcmp(optarg, "TLS1_2") == 0) { 83 version = TLS1_2_VERSION; 84 #ifdef TLS1_3_VERSION 85 } else if (strcmp(optarg, "TLS1_3") == 0) { 86 version = TLS1_3_VERSION; 87 #endif 88 } else { 89 errx(1, "unknown protocol version: %s", optarg); 90 } 91 break; 92 case 'v': 93 verify = 1; 94 break; 95 default: 96 usage(); 97 } 98 } 99 argc -= optind; 100 argv += optind; 101 if (argc == 2) { 102 host = argv[0]; 103 port = argv[1]; 104 } else if (!listciphers) { 105 usage(); 106 } 107 if (asprintf(&host_port, strchr(host, ':') ? "[%s]:%s" : "%s:%s", 108 host, port) == -1) 109 err(1, "asprintf host port"); 110 if ((crt == NULL && key != NULL) || (crt != NULL && key == NULL)) 111 errx(1, "certificate and private key must be used together"); 112 113 SSL_library_init(); 114 SSL_load_error_strings(); 115 print_version(); 116 117 /* setup method and context */ 118 #if OPENSSL_VERSION_NUMBER >= 0x1010000f 119 method = TLS_client_method(); 120 if (method == NULL) 121 err_ssl(1, "TLS_client_method"); 122 #else 123 switch (version) { 124 case TLS1_VERSION: 125 method = TLSv1_client_method(); 126 break; 127 case TLS1_1_VERSION: 128 method = TLSv1_1_client_method(); 129 break; 130 case TLS1_2_VERSION: 131 method = TLSv1_2_client_method(); 132 break; 133 #ifdef TLS1_3_VERSION 134 case TLS1_3_VERSION: 135 err(1, "TLS1_3 not supported"); 136 #endif 137 default: 138 method = SSLv23_client_method(); 139 break; 140 } 141 if (method == NULL) 142 err_ssl(1, "SSLv23_client_method"); 143 #endif 144 ctx = SSL_CTX_new(method); 145 if (ctx == NULL) 146 err_ssl(1, "SSL_CTX_new"); 147 148 #if OPENSSL_VERSION_NUMBER >= 0x1010000f 149 if (version) { 150 if (SSL_CTX_set_min_proto_version(ctx, version) != 1) 151 err_ssl(1, "SSL_CTX_set_min_proto_version"); 152 if (SSL_CTX_set_max_proto_version(ctx, version) != 1) 153 err_ssl(1, "SSL_CTX_set_max_proto_version"); 154 } 155 #endif 156 157 /* load client certificate */ 158 if (crt != NULL) { 159 if (SSL_CTX_use_certificate_file(ctx, crt, 160 SSL_FILETYPE_PEM) <= 0) 161 err_ssl(1, "SSL_CTX_use_certificate_file"); 162 if (SSL_CTX_use_PrivateKey_file(ctx, key, 163 SSL_FILETYPE_PEM) <= 0) 164 err_ssl(1, "SSL_CTX_use_PrivateKey_file"); 165 if (SSL_CTX_check_private_key(ctx) <= 0) 166 err_ssl(1, "SSL_CTX_check_private_key"); 167 } 168 169 /* verify server certificate */ 170 if (ca != NULL) { 171 if (SSL_CTX_load_verify_locations(ctx, ca, NULL) <= 0) 172 err_ssl(1, "SSL_CTX_load_verify_locations"); 173 } 174 SSL_CTX_set_verify(ctx, verify ? SSL_VERIFY_PEER : SSL_VERIFY_NONE, 175 verify_callback); 176 177 if (sessionreuse) { 178 SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_CLIENT); 179 } 180 181 if (ciphers) { 182 if (SSL_CTX_set_cipher_list(ctx, ciphers) <= 0) 183 err_ssl(1, "SSL_CTX_set_cipher_list"); 184 } 185 186 if (listciphers) { 187 ssl = SSL_new(ctx); 188 if (ssl == NULL) 189 err_ssl(1, "SSL_new"); 190 print_ciphers(SSL_get_ciphers(ssl)); 191 return 0; 192 } 193 194 do { 195 /* setup bio for socket operations */ 196 bio = BIO_new_connect(host_port); 197 if (bio == NULL) 198 err_ssl(1, "BIO_new_connect"); 199 200 /* connect */ 201 if (BIO_do_connect(bio) <= 0) 202 err_ssl(1, "BIO_do_connect"); 203 printf("connect "); 204 print_sockname(bio); 205 printf("connect "); 206 print_peername(bio); 207 208 /* do ssl client handshake */ 209 ssl = SSL_new(ctx); 210 if (ssl == NULL) 211 err_ssl(1, "SSL_new"); 212 SSL_set_bio(ssl, bio, bio); 213 /* resuse session if possible */ 214 if (session != NULL) { 215 if (SSL_set_session(ssl, session) <= 0) 216 err_ssl(1, "SSL_set_session"); 217 } 218 if ((error = SSL_connect(ssl)) <= 0) 219 err_ssl(1, "SSL_connect %d", error); 220 printf("session %d: %s\n", sessionreuse, 221 SSL_session_reused(ssl) ? "reuse" : "new"); 222 if (fflush(stdout) != 0) 223 err(1, "fflush stdout"); 224 225 /* print session statistics */ 226 if (sessionreuse) { 227 session = SSL_get1_session(ssl); 228 if (session == NULL) 229 err_ssl(1, "SSL1_get_session"); 230 } else { 231 session = SSL_get_session(ssl); 232 if (session == NULL) 233 err_ssl(1, "SSL_get_session"); 234 } 235 if (SSL_SESSION_print_fp(stdout, session) <= 0) 236 err_ssl(1, "SSL_SESSION_print_fp"); 237 238 /* read server greeting and write client hello over TLS */ 239 if ((error = SSL_read(ssl, buf, 9)) <= 0) 240 err_ssl(1, "SSL_read %d", error); 241 if (error != 9) 242 errx(1, "read not 9 bytes greeting: %d", error); 243 buf[9] = '\0'; 244 printf("<<< %s", buf); 245 if (fflush(stdout) != 0) 246 err(1, "fflush stdout"); 247 strlcpy(buf, "hello\n", sizeof(buf)); 248 printf(">>> %s", buf); 249 if (fflush(stdout) != 0) 250 err(1, "fflush stdout"); 251 if ((error = SSL_write(ssl, buf, 6)) <= 0) 252 err_ssl(1, "SSL_write %d", error); 253 if (error != 6) 254 errx(1, "write not 6 bytes hello: %d", error); 255 256 /* shutdown connection */ 257 if ((error = SSL_shutdown(ssl)) < 0) 258 err_ssl(1, "SSL_shutdown unidirectional %d", error); 259 if (error <= 0) { 260 if ((error = SSL_shutdown(ssl)) <= 0) 261 err_ssl(1, "SSL_shutdown bidirectional %d", 262 error); 263 } 264 265 SSL_free(ssl); 266 } while (sessionreuse--); 267 268 SSL_CTX_free(ctx); 269 270 printf("success\n"); 271 272 return 0; 273 } 274