1*0Sstevel@tonic-gate /* apps/s_cb.c - callback functions used by s_client, s_server, and s_time */ 2*0Sstevel@tonic-gate /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3*0Sstevel@tonic-gate * All rights reserved. 4*0Sstevel@tonic-gate * 5*0Sstevel@tonic-gate * This package is an SSL implementation written 6*0Sstevel@tonic-gate * by Eric Young (eay@cryptsoft.com). 7*0Sstevel@tonic-gate * The implementation was written so as to conform with Netscapes SSL. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * This library is free for commercial and non-commercial use as long as 10*0Sstevel@tonic-gate * the following conditions are aheared to. The following conditions 11*0Sstevel@tonic-gate * apply to all code found in this distribution, be it the RC4, RSA, 12*0Sstevel@tonic-gate * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13*0Sstevel@tonic-gate * included with this distribution is covered by the same copyright terms 14*0Sstevel@tonic-gate * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15*0Sstevel@tonic-gate * 16*0Sstevel@tonic-gate * Copyright remains Eric Young's, and as such any Copyright notices in 17*0Sstevel@tonic-gate * the code are not to be removed. 18*0Sstevel@tonic-gate * If this package is used in a product, Eric Young should be given attribution 19*0Sstevel@tonic-gate * as the author of the parts of the library used. 20*0Sstevel@tonic-gate * This can be in the form of a textual message at program startup or 21*0Sstevel@tonic-gate * in documentation (online or textual) provided with the package. 22*0Sstevel@tonic-gate * 23*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without 24*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions 25*0Sstevel@tonic-gate * are met: 26*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the copyright 27*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer. 28*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright 29*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in the 30*0Sstevel@tonic-gate * documentation and/or other materials provided with the distribution. 31*0Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this software 32*0Sstevel@tonic-gate * must display the following acknowledgement: 33*0Sstevel@tonic-gate * "This product includes cryptographic software written by 34*0Sstevel@tonic-gate * Eric Young (eay@cryptsoft.com)" 35*0Sstevel@tonic-gate * The word 'cryptographic' can be left out if the rouines from the library 36*0Sstevel@tonic-gate * being used are not cryptographic related :-). 37*0Sstevel@tonic-gate * 4. If you include any Windows specific code (or a derivative thereof) from 38*0Sstevel@tonic-gate * the apps directory (application code) you must include an acknowledgement: 39*0Sstevel@tonic-gate * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40*0Sstevel@tonic-gate * 41*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42*0Sstevel@tonic-gate * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43*0Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44*0Sstevel@tonic-gate * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45*0Sstevel@tonic-gate * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46*0Sstevel@tonic-gate * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47*0Sstevel@tonic-gate * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48*0Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49*0Sstevel@tonic-gate * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50*0Sstevel@tonic-gate * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51*0Sstevel@tonic-gate * SUCH DAMAGE. 52*0Sstevel@tonic-gate * 53*0Sstevel@tonic-gate * The licence and distribution terms for any publically available version or 54*0Sstevel@tonic-gate * derivative of this code cannot be changed. i.e. this code cannot simply be 55*0Sstevel@tonic-gate * copied and put under another distribution licence 56*0Sstevel@tonic-gate * [including the GNU Public Licence.] 57*0Sstevel@tonic-gate */ 58*0Sstevel@tonic-gate /* ==================================================================== 59*0Sstevel@tonic-gate * Copyright (c) 1998-2001 The OpenSSL Project. All rights reserved. 60*0Sstevel@tonic-gate * 61*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without 62*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions 63*0Sstevel@tonic-gate * are met: 64*0Sstevel@tonic-gate * 65*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright 66*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer. 67*0Sstevel@tonic-gate * 68*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright 69*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in 70*0Sstevel@tonic-gate * the documentation and/or other materials provided with the 71*0Sstevel@tonic-gate * distribution. 72*0Sstevel@tonic-gate * 73*0Sstevel@tonic-gate * 3. All advertising materials mentioning features or use of this 74*0Sstevel@tonic-gate * software must display the following acknowledgment: 75*0Sstevel@tonic-gate * "This product includes software developed by the OpenSSL Project 76*0Sstevel@tonic-gate * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 77*0Sstevel@tonic-gate * 78*0Sstevel@tonic-gate * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 79*0Sstevel@tonic-gate * endorse or promote products derived from this software without 80*0Sstevel@tonic-gate * prior written permission. For written permission, please contact 81*0Sstevel@tonic-gate * openssl-core@openssl.org. 82*0Sstevel@tonic-gate * 83*0Sstevel@tonic-gate * 5. Products derived from this software may not be called "OpenSSL" 84*0Sstevel@tonic-gate * nor may "OpenSSL" appear in their names without prior written 85*0Sstevel@tonic-gate * permission of the OpenSSL Project. 86*0Sstevel@tonic-gate * 87*0Sstevel@tonic-gate * 6. Redistributions of any form whatsoever must retain the following 88*0Sstevel@tonic-gate * acknowledgment: 89*0Sstevel@tonic-gate * "This product includes software developed by the OpenSSL Project 90*0Sstevel@tonic-gate * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 91*0Sstevel@tonic-gate * 92*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 93*0Sstevel@tonic-gate * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 94*0Sstevel@tonic-gate * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 95*0Sstevel@tonic-gate * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 96*0Sstevel@tonic-gate * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 97*0Sstevel@tonic-gate * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 98*0Sstevel@tonic-gate * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 99*0Sstevel@tonic-gate * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 100*0Sstevel@tonic-gate * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 101*0Sstevel@tonic-gate * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 102*0Sstevel@tonic-gate * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 103*0Sstevel@tonic-gate * OF THE POSSIBILITY OF SUCH DAMAGE. 104*0Sstevel@tonic-gate * ==================================================================== 105*0Sstevel@tonic-gate * 106*0Sstevel@tonic-gate * This product includes cryptographic software written by Eric Young 107*0Sstevel@tonic-gate * (eay@cryptsoft.com). This product includes software written by Tim 108*0Sstevel@tonic-gate * Hudson (tjh@cryptsoft.com). 109*0Sstevel@tonic-gate * 110*0Sstevel@tonic-gate */ 111*0Sstevel@tonic-gate 112*0Sstevel@tonic-gate #include <stdio.h> 113*0Sstevel@tonic-gate #include <stdlib.h> 114*0Sstevel@tonic-gate #define USE_SOCKETS 115*0Sstevel@tonic-gate #define NON_MAIN 116*0Sstevel@tonic-gate #include "apps.h" 117*0Sstevel@tonic-gate #undef NON_MAIN 118*0Sstevel@tonic-gate #undef USE_SOCKETS 119*0Sstevel@tonic-gate #include <openssl/err.h> 120*0Sstevel@tonic-gate #include <openssl/x509.h> 121*0Sstevel@tonic-gate #include <openssl/ssl.h> 122*0Sstevel@tonic-gate #include "s_apps.h" 123*0Sstevel@tonic-gate 124*0Sstevel@tonic-gate int verify_depth=0; 125*0Sstevel@tonic-gate int verify_error=X509_V_OK; 126*0Sstevel@tonic-gate 127*0Sstevel@tonic-gate int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx) 128*0Sstevel@tonic-gate { 129*0Sstevel@tonic-gate char buf[256]; 130*0Sstevel@tonic-gate X509 *err_cert; 131*0Sstevel@tonic-gate int err,depth; 132*0Sstevel@tonic-gate 133*0Sstevel@tonic-gate err_cert=X509_STORE_CTX_get_current_cert(ctx); 134*0Sstevel@tonic-gate err= X509_STORE_CTX_get_error(ctx); 135*0Sstevel@tonic-gate depth= X509_STORE_CTX_get_error_depth(ctx); 136*0Sstevel@tonic-gate 137*0Sstevel@tonic-gate X509_NAME_oneline(X509_get_subject_name(err_cert),buf,sizeof buf); 138*0Sstevel@tonic-gate BIO_printf(bio_err,"depth=%d %s\n",depth,buf); 139*0Sstevel@tonic-gate if (!ok) 140*0Sstevel@tonic-gate { 141*0Sstevel@tonic-gate BIO_printf(bio_err,"verify error:num=%d:%s\n",err, 142*0Sstevel@tonic-gate X509_verify_cert_error_string(err)); 143*0Sstevel@tonic-gate if (verify_depth >= depth) 144*0Sstevel@tonic-gate { 145*0Sstevel@tonic-gate ok=1; 146*0Sstevel@tonic-gate verify_error=X509_V_OK; 147*0Sstevel@tonic-gate } 148*0Sstevel@tonic-gate else 149*0Sstevel@tonic-gate { 150*0Sstevel@tonic-gate ok=0; 151*0Sstevel@tonic-gate verify_error=X509_V_ERR_CERT_CHAIN_TOO_LONG; 152*0Sstevel@tonic-gate } 153*0Sstevel@tonic-gate } 154*0Sstevel@tonic-gate switch (ctx->error) 155*0Sstevel@tonic-gate { 156*0Sstevel@tonic-gate case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT: 157*0Sstevel@tonic-gate X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert),buf,sizeof buf); 158*0Sstevel@tonic-gate BIO_printf(bio_err,"issuer= %s\n",buf); 159*0Sstevel@tonic-gate break; 160*0Sstevel@tonic-gate case X509_V_ERR_CERT_NOT_YET_VALID: 161*0Sstevel@tonic-gate case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD: 162*0Sstevel@tonic-gate BIO_printf(bio_err,"notBefore="); 163*0Sstevel@tonic-gate ASN1_TIME_print(bio_err,X509_get_notBefore(ctx->current_cert)); 164*0Sstevel@tonic-gate BIO_printf(bio_err,"\n"); 165*0Sstevel@tonic-gate break; 166*0Sstevel@tonic-gate case X509_V_ERR_CERT_HAS_EXPIRED: 167*0Sstevel@tonic-gate case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD: 168*0Sstevel@tonic-gate BIO_printf(bio_err,"notAfter="); 169*0Sstevel@tonic-gate ASN1_TIME_print(bio_err,X509_get_notAfter(ctx->current_cert)); 170*0Sstevel@tonic-gate BIO_printf(bio_err,"\n"); 171*0Sstevel@tonic-gate break; 172*0Sstevel@tonic-gate } 173*0Sstevel@tonic-gate BIO_printf(bio_err,"verify return:%d\n",ok); 174*0Sstevel@tonic-gate return(ok); 175*0Sstevel@tonic-gate } 176*0Sstevel@tonic-gate 177*0Sstevel@tonic-gate int set_cert_stuff(SSL_CTX *ctx, char *cert_file, char *key_file) 178*0Sstevel@tonic-gate { 179*0Sstevel@tonic-gate if (cert_file != NULL) 180*0Sstevel@tonic-gate { 181*0Sstevel@tonic-gate /* 182*0Sstevel@tonic-gate SSL *ssl; 183*0Sstevel@tonic-gate X509 *x509; 184*0Sstevel@tonic-gate */ 185*0Sstevel@tonic-gate 186*0Sstevel@tonic-gate if (SSL_CTX_use_certificate_file(ctx,cert_file, 187*0Sstevel@tonic-gate SSL_FILETYPE_PEM) <= 0) 188*0Sstevel@tonic-gate { 189*0Sstevel@tonic-gate BIO_printf(bio_err,"unable to get certificate from '%s'\n",cert_file); 190*0Sstevel@tonic-gate ERR_print_errors(bio_err); 191*0Sstevel@tonic-gate return(0); 192*0Sstevel@tonic-gate } 193*0Sstevel@tonic-gate if (key_file == NULL) key_file=cert_file; 194*0Sstevel@tonic-gate if (SSL_CTX_use_PrivateKey_file(ctx,key_file, 195*0Sstevel@tonic-gate SSL_FILETYPE_PEM) <= 0) 196*0Sstevel@tonic-gate { 197*0Sstevel@tonic-gate BIO_printf(bio_err,"unable to get private key from '%s'\n",key_file); 198*0Sstevel@tonic-gate ERR_print_errors(bio_err); 199*0Sstevel@tonic-gate return(0); 200*0Sstevel@tonic-gate } 201*0Sstevel@tonic-gate 202*0Sstevel@tonic-gate /* 203*0Sstevel@tonic-gate In theory this is no longer needed 204*0Sstevel@tonic-gate ssl=SSL_new(ctx); 205*0Sstevel@tonic-gate x509=SSL_get_certificate(ssl); 206*0Sstevel@tonic-gate 207*0Sstevel@tonic-gate if (x509 != NULL) { 208*0Sstevel@tonic-gate EVP_PKEY *pktmp; 209*0Sstevel@tonic-gate pktmp = X509_get_pubkey(x509); 210*0Sstevel@tonic-gate EVP_PKEY_copy_parameters(pktmp, 211*0Sstevel@tonic-gate SSL_get_privatekey(ssl)); 212*0Sstevel@tonic-gate EVP_PKEY_free(pktmp); 213*0Sstevel@tonic-gate } 214*0Sstevel@tonic-gate SSL_free(ssl); 215*0Sstevel@tonic-gate */ 216*0Sstevel@tonic-gate 217*0Sstevel@tonic-gate /* If we are using DSA, we can copy the parameters from 218*0Sstevel@tonic-gate * the private key */ 219*0Sstevel@tonic-gate 220*0Sstevel@tonic-gate 221*0Sstevel@tonic-gate /* Now we know that a key and cert have been set against 222*0Sstevel@tonic-gate * the SSL context */ 223*0Sstevel@tonic-gate if (!SSL_CTX_check_private_key(ctx)) 224*0Sstevel@tonic-gate { 225*0Sstevel@tonic-gate BIO_printf(bio_err,"Private key does not match the certificate public key\n"); 226*0Sstevel@tonic-gate return(0); 227*0Sstevel@tonic-gate } 228*0Sstevel@tonic-gate } 229*0Sstevel@tonic-gate return(1); 230*0Sstevel@tonic-gate } 231*0Sstevel@tonic-gate 232*0Sstevel@tonic-gate long MS_CALLBACK bio_dump_cb(BIO *bio, int cmd, const char *argp, int argi, 233*0Sstevel@tonic-gate long argl, long ret) 234*0Sstevel@tonic-gate { 235*0Sstevel@tonic-gate BIO *out; 236*0Sstevel@tonic-gate 237*0Sstevel@tonic-gate out=(BIO *)BIO_get_callback_arg(bio); 238*0Sstevel@tonic-gate if (out == NULL) return(ret); 239*0Sstevel@tonic-gate 240*0Sstevel@tonic-gate if (cmd == (BIO_CB_READ|BIO_CB_RETURN)) 241*0Sstevel@tonic-gate { 242*0Sstevel@tonic-gate BIO_printf(out,"read from %08X [%08lX] (%d bytes => %ld (0x%X))\n", 243*0Sstevel@tonic-gate bio,argp,argi,ret,ret); 244*0Sstevel@tonic-gate BIO_dump(out,argp,(int)ret); 245*0Sstevel@tonic-gate return(ret); 246*0Sstevel@tonic-gate } 247*0Sstevel@tonic-gate else if (cmd == (BIO_CB_WRITE|BIO_CB_RETURN)) 248*0Sstevel@tonic-gate { 249*0Sstevel@tonic-gate BIO_printf(out,"write to %08X [%08lX] (%d bytes => %ld (0x%X))\n", 250*0Sstevel@tonic-gate bio,argp,argi,ret,ret); 251*0Sstevel@tonic-gate BIO_dump(out,argp,(int)ret); 252*0Sstevel@tonic-gate } 253*0Sstevel@tonic-gate return(ret); 254*0Sstevel@tonic-gate } 255*0Sstevel@tonic-gate 256*0Sstevel@tonic-gate void MS_CALLBACK apps_ssl_info_callback(const SSL *s, int where, int ret) 257*0Sstevel@tonic-gate { 258*0Sstevel@tonic-gate char *str; 259*0Sstevel@tonic-gate int w; 260*0Sstevel@tonic-gate 261*0Sstevel@tonic-gate w=where& ~SSL_ST_MASK; 262*0Sstevel@tonic-gate 263*0Sstevel@tonic-gate if (w & SSL_ST_CONNECT) str="SSL_connect"; 264*0Sstevel@tonic-gate else if (w & SSL_ST_ACCEPT) str="SSL_accept"; 265*0Sstevel@tonic-gate else str="undefined"; 266*0Sstevel@tonic-gate 267*0Sstevel@tonic-gate if (where & SSL_CB_LOOP) 268*0Sstevel@tonic-gate { 269*0Sstevel@tonic-gate BIO_printf(bio_err,"%s:%s\n",str,SSL_state_string_long(s)); 270*0Sstevel@tonic-gate } 271*0Sstevel@tonic-gate else if (where & SSL_CB_ALERT) 272*0Sstevel@tonic-gate { 273*0Sstevel@tonic-gate str=(where & SSL_CB_READ)?"read":"write"; 274*0Sstevel@tonic-gate BIO_printf(bio_err,"SSL3 alert %s:%s:%s\n", 275*0Sstevel@tonic-gate str, 276*0Sstevel@tonic-gate SSL_alert_type_string_long(ret), 277*0Sstevel@tonic-gate SSL_alert_desc_string_long(ret)); 278*0Sstevel@tonic-gate } 279*0Sstevel@tonic-gate else if (where & SSL_CB_EXIT) 280*0Sstevel@tonic-gate { 281*0Sstevel@tonic-gate if (ret == 0) 282*0Sstevel@tonic-gate BIO_printf(bio_err,"%s:failed in %s\n", 283*0Sstevel@tonic-gate str,SSL_state_string_long(s)); 284*0Sstevel@tonic-gate else if (ret < 0) 285*0Sstevel@tonic-gate { 286*0Sstevel@tonic-gate BIO_printf(bio_err,"%s:error in %s\n", 287*0Sstevel@tonic-gate str,SSL_state_string_long(s)); 288*0Sstevel@tonic-gate } 289*0Sstevel@tonic-gate } 290*0Sstevel@tonic-gate } 291*0Sstevel@tonic-gate 292*0Sstevel@tonic-gate 293*0Sstevel@tonic-gate void MS_CALLBACK msg_cb(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg) 294*0Sstevel@tonic-gate { 295*0Sstevel@tonic-gate BIO *bio = arg; 296*0Sstevel@tonic-gate const char *str_write_p, *str_version, *str_content_type = "", *str_details1 = "", *str_details2= ""; 297*0Sstevel@tonic-gate 298*0Sstevel@tonic-gate str_write_p = write_p ? ">>>" : "<<<"; 299*0Sstevel@tonic-gate 300*0Sstevel@tonic-gate switch (version) 301*0Sstevel@tonic-gate { 302*0Sstevel@tonic-gate case SSL2_VERSION: 303*0Sstevel@tonic-gate str_version = "SSL 2.0"; 304*0Sstevel@tonic-gate break; 305*0Sstevel@tonic-gate case SSL3_VERSION: 306*0Sstevel@tonic-gate str_version = "SSL 3.0 "; 307*0Sstevel@tonic-gate break; 308*0Sstevel@tonic-gate case TLS1_VERSION: 309*0Sstevel@tonic-gate str_version = "TLS 1.0 "; 310*0Sstevel@tonic-gate break; 311*0Sstevel@tonic-gate default: 312*0Sstevel@tonic-gate str_version = "???"; 313*0Sstevel@tonic-gate } 314*0Sstevel@tonic-gate 315*0Sstevel@tonic-gate if (version == SSL2_VERSION) 316*0Sstevel@tonic-gate { 317*0Sstevel@tonic-gate str_details1 = "???"; 318*0Sstevel@tonic-gate 319*0Sstevel@tonic-gate if (len > 0) 320*0Sstevel@tonic-gate { 321*0Sstevel@tonic-gate switch (((unsigned char*)buf)[0]) 322*0Sstevel@tonic-gate { 323*0Sstevel@tonic-gate case 0: 324*0Sstevel@tonic-gate str_details1 = ", ERROR:"; 325*0Sstevel@tonic-gate str_details2 = " ???"; 326*0Sstevel@tonic-gate if (len >= 3) 327*0Sstevel@tonic-gate { 328*0Sstevel@tonic-gate unsigned err = (((unsigned char*)buf)[1]<<8) + ((unsigned char*)buf)[2]; 329*0Sstevel@tonic-gate 330*0Sstevel@tonic-gate switch (err) 331*0Sstevel@tonic-gate { 332*0Sstevel@tonic-gate case 0x0001: 333*0Sstevel@tonic-gate str_details2 = " NO-CIPHER-ERROR"; 334*0Sstevel@tonic-gate break; 335*0Sstevel@tonic-gate case 0x0002: 336*0Sstevel@tonic-gate str_details2 = " NO-CERTIFICATE-ERROR"; 337*0Sstevel@tonic-gate break; 338*0Sstevel@tonic-gate case 0x0004: 339*0Sstevel@tonic-gate str_details2 = " BAD-CERTIFICATE-ERROR"; 340*0Sstevel@tonic-gate break; 341*0Sstevel@tonic-gate case 0x0006: 342*0Sstevel@tonic-gate str_details2 = " UNSUPPORTED-CERTIFICATE-TYPE-ERROR"; 343*0Sstevel@tonic-gate break; 344*0Sstevel@tonic-gate } 345*0Sstevel@tonic-gate } 346*0Sstevel@tonic-gate 347*0Sstevel@tonic-gate break; 348*0Sstevel@tonic-gate case 1: 349*0Sstevel@tonic-gate str_details1 = ", CLIENT-HELLO"; 350*0Sstevel@tonic-gate break; 351*0Sstevel@tonic-gate case 2: 352*0Sstevel@tonic-gate str_details1 = ", CLIENT-MASTER-KEY"; 353*0Sstevel@tonic-gate break; 354*0Sstevel@tonic-gate case 3: 355*0Sstevel@tonic-gate str_details1 = ", CLIENT-FINISHED"; 356*0Sstevel@tonic-gate break; 357*0Sstevel@tonic-gate case 4: 358*0Sstevel@tonic-gate str_details1 = ", SERVER-HELLO"; 359*0Sstevel@tonic-gate break; 360*0Sstevel@tonic-gate case 5: 361*0Sstevel@tonic-gate str_details1 = ", SERVER-VERIFY"; 362*0Sstevel@tonic-gate break; 363*0Sstevel@tonic-gate case 6: 364*0Sstevel@tonic-gate str_details1 = ", SERVER-FINISHED"; 365*0Sstevel@tonic-gate break; 366*0Sstevel@tonic-gate case 7: 367*0Sstevel@tonic-gate str_details1 = ", REQUEST-CERTIFICATE"; 368*0Sstevel@tonic-gate break; 369*0Sstevel@tonic-gate case 8: 370*0Sstevel@tonic-gate str_details1 = ", CLIENT-CERTIFICATE"; 371*0Sstevel@tonic-gate break; 372*0Sstevel@tonic-gate } 373*0Sstevel@tonic-gate } 374*0Sstevel@tonic-gate } 375*0Sstevel@tonic-gate 376*0Sstevel@tonic-gate if (version == SSL3_VERSION || version == TLS1_VERSION) 377*0Sstevel@tonic-gate { 378*0Sstevel@tonic-gate switch (content_type) 379*0Sstevel@tonic-gate { 380*0Sstevel@tonic-gate case 20: 381*0Sstevel@tonic-gate str_content_type = "ChangeCipherSpec"; 382*0Sstevel@tonic-gate break; 383*0Sstevel@tonic-gate case 21: 384*0Sstevel@tonic-gate str_content_type = "Alert"; 385*0Sstevel@tonic-gate break; 386*0Sstevel@tonic-gate case 22: 387*0Sstevel@tonic-gate str_content_type = "Handshake"; 388*0Sstevel@tonic-gate break; 389*0Sstevel@tonic-gate } 390*0Sstevel@tonic-gate 391*0Sstevel@tonic-gate if (content_type == 21) /* Alert */ 392*0Sstevel@tonic-gate { 393*0Sstevel@tonic-gate str_details1 = ", ???"; 394*0Sstevel@tonic-gate 395*0Sstevel@tonic-gate if (len == 2) 396*0Sstevel@tonic-gate { 397*0Sstevel@tonic-gate switch (((unsigned char*)buf)[0]) 398*0Sstevel@tonic-gate { 399*0Sstevel@tonic-gate case 1: 400*0Sstevel@tonic-gate str_details1 = ", warning"; 401*0Sstevel@tonic-gate break; 402*0Sstevel@tonic-gate case 2: 403*0Sstevel@tonic-gate str_details1 = ", fatal"; 404*0Sstevel@tonic-gate break; 405*0Sstevel@tonic-gate } 406*0Sstevel@tonic-gate 407*0Sstevel@tonic-gate str_details2 = " ???"; 408*0Sstevel@tonic-gate switch (((unsigned char*)buf)[1]) 409*0Sstevel@tonic-gate { 410*0Sstevel@tonic-gate case 0: 411*0Sstevel@tonic-gate str_details2 = " close_notify"; 412*0Sstevel@tonic-gate break; 413*0Sstevel@tonic-gate case 10: 414*0Sstevel@tonic-gate str_details2 = " unexpected_message"; 415*0Sstevel@tonic-gate break; 416*0Sstevel@tonic-gate case 20: 417*0Sstevel@tonic-gate str_details2 = " bad_record_mac"; 418*0Sstevel@tonic-gate break; 419*0Sstevel@tonic-gate case 21: 420*0Sstevel@tonic-gate str_details2 = " decryption_failed"; 421*0Sstevel@tonic-gate break; 422*0Sstevel@tonic-gate case 22: 423*0Sstevel@tonic-gate str_details2 = " record_overflow"; 424*0Sstevel@tonic-gate break; 425*0Sstevel@tonic-gate case 30: 426*0Sstevel@tonic-gate str_details2 = " decompression_failure"; 427*0Sstevel@tonic-gate break; 428*0Sstevel@tonic-gate case 40: 429*0Sstevel@tonic-gate str_details2 = " handshake_failure"; 430*0Sstevel@tonic-gate break; 431*0Sstevel@tonic-gate case 42: 432*0Sstevel@tonic-gate str_details2 = " bad_certificate"; 433*0Sstevel@tonic-gate break; 434*0Sstevel@tonic-gate case 43: 435*0Sstevel@tonic-gate str_details2 = " unsupported_certificate"; 436*0Sstevel@tonic-gate break; 437*0Sstevel@tonic-gate case 44: 438*0Sstevel@tonic-gate str_details2 = " certificate_revoked"; 439*0Sstevel@tonic-gate break; 440*0Sstevel@tonic-gate case 45: 441*0Sstevel@tonic-gate str_details2 = " certificate_expired"; 442*0Sstevel@tonic-gate break; 443*0Sstevel@tonic-gate case 46: 444*0Sstevel@tonic-gate str_details2 = " certificate_unknown"; 445*0Sstevel@tonic-gate break; 446*0Sstevel@tonic-gate case 47: 447*0Sstevel@tonic-gate str_details2 = " illegal_parameter"; 448*0Sstevel@tonic-gate break; 449*0Sstevel@tonic-gate case 48: 450*0Sstevel@tonic-gate str_details2 = " unknown_ca"; 451*0Sstevel@tonic-gate break; 452*0Sstevel@tonic-gate case 49: 453*0Sstevel@tonic-gate str_details2 = " access_denied"; 454*0Sstevel@tonic-gate break; 455*0Sstevel@tonic-gate case 50: 456*0Sstevel@tonic-gate str_details2 = " decode_error"; 457*0Sstevel@tonic-gate break; 458*0Sstevel@tonic-gate case 51: 459*0Sstevel@tonic-gate str_details2 = " decrypt_error"; 460*0Sstevel@tonic-gate break; 461*0Sstevel@tonic-gate case 60: 462*0Sstevel@tonic-gate str_details2 = " export_restriction"; 463*0Sstevel@tonic-gate break; 464*0Sstevel@tonic-gate case 70: 465*0Sstevel@tonic-gate str_details2 = " protocol_version"; 466*0Sstevel@tonic-gate break; 467*0Sstevel@tonic-gate case 71: 468*0Sstevel@tonic-gate str_details2 = " insufficient_security"; 469*0Sstevel@tonic-gate break; 470*0Sstevel@tonic-gate case 80: 471*0Sstevel@tonic-gate str_details2 = " internal_error"; 472*0Sstevel@tonic-gate break; 473*0Sstevel@tonic-gate case 90: 474*0Sstevel@tonic-gate str_details2 = " user_canceled"; 475*0Sstevel@tonic-gate break; 476*0Sstevel@tonic-gate case 100: 477*0Sstevel@tonic-gate str_details2 = " no_renegotiation"; 478*0Sstevel@tonic-gate break; 479*0Sstevel@tonic-gate } 480*0Sstevel@tonic-gate } 481*0Sstevel@tonic-gate } 482*0Sstevel@tonic-gate 483*0Sstevel@tonic-gate if (content_type == 22) /* Handshake */ 484*0Sstevel@tonic-gate { 485*0Sstevel@tonic-gate str_details1 = "???"; 486*0Sstevel@tonic-gate 487*0Sstevel@tonic-gate if (len > 0) 488*0Sstevel@tonic-gate { 489*0Sstevel@tonic-gate switch (((unsigned char*)buf)[0]) 490*0Sstevel@tonic-gate { 491*0Sstevel@tonic-gate case 0: 492*0Sstevel@tonic-gate str_details1 = ", HelloRequest"; 493*0Sstevel@tonic-gate break; 494*0Sstevel@tonic-gate case 1: 495*0Sstevel@tonic-gate str_details1 = ", ClientHello"; 496*0Sstevel@tonic-gate break; 497*0Sstevel@tonic-gate case 2: 498*0Sstevel@tonic-gate str_details1 = ", ServerHello"; 499*0Sstevel@tonic-gate break; 500*0Sstevel@tonic-gate case 11: 501*0Sstevel@tonic-gate str_details1 = ", Certificate"; 502*0Sstevel@tonic-gate break; 503*0Sstevel@tonic-gate case 12: 504*0Sstevel@tonic-gate str_details1 = ", ServerKeyExchange"; 505*0Sstevel@tonic-gate break; 506*0Sstevel@tonic-gate case 13: 507*0Sstevel@tonic-gate str_details1 = ", CertificateRequest"; 508*0Sstevel@tonic-gate break; 509*0Sstevel@tonic-gate case 14: 510*0Sstevel@tonic-gate str_details1 = ", ServerHelloDone"; 511*0Sstevel@tonic-gate break; 512*0Sstevel@tonic-gate case 15: 513*0Sstevel@tonic-gate str_details1 = ", CertificateVerify"; 514*0Sstevel@tonic-gate break; 515*0Sstevel@tonic-gate case 16: 516*0Sstevel@tonic-gate str_details1 = ", ClientKeyExchange"; 517*0Sstevel@tonic-gate break; 518*0Sstevel@tonic-gate case 20: 519*0Sstevel@tonic-gate str_details1 = ", Finished"; 520*0Sstevel@tonic-gate break; 521*0Sstevel@tonic-gate } 522*0Sstevel@tonic-gate } 523*0Sstevel@tonic-gate } 524*0Sstevel@tonic-gate } 525*0Sstevel@tonic-gate 526*0Sstevel@tonic-gate BIO_printf(bio, "%s %s%s [length %04lx]%s%s\n", str_write_p, str_version, str_content_type, (unsigned long)len, str_details1, str_details2); 527*0Sstevel@tonic-gate 528*0Sstevel@tonic-gate if (len > 0) 529*0Sstevel@tonic-gate { 530*0Sstevel@tonic-gate size_t num, i; 531*0Sstevel@tonic-gate 532*0Sstevel@tonic-gate BIO_printf(bio, " "); 533*0Sstevel@tonic-gate num = len; 534*0Sstevel@tonic-gate #if 0 535*0Sstevel@tonic-gate if (num > 16) 536*0Sstevel@tonic-gate num = 16; 537*0Sstevel@tonic-gate #endif 538*0Sstevel@tonic-gate for (i = 0; i < num; i++) 539*0Sstevel@tonic-gate { 540*0Sstevel@tonic-gate if (i % 16 == 0 && i > 0) 541*0Sstevel@tonic-gate BIO_printf(bio, "\n "); 542*0Sstevel@tonic-gate BIO_printf(bio, " %02x", ((unsigned char*)buf)[i]); 543*0Sstevel@tonic-gate } 544*0Sstevel@tonic-gate if (i < len) 545*0Sstevel@tonic-gate BIO_printf(bio, " ..."); 546*0Sstevel@tonic-gate BIO_printf(bio, "\n"); 547*0Sstevel@tonic-gate } 548*0Sstevel@tonic-gate BIO_flush(bio); 549*0Sstevel@tonic-gate } 550