1 /* $OpenBSD: client.c,v 1.5 2018/11/10 08:33:45 bluhm Exp $ */ 2 /* 3 * Copyright (c) 2018 Alexander Bluhm <bluhm@openbsd.org> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 #include <sys/types.h> 19 #include <sys/socket.h> 20 21 #include <err.h> 22 #include <netdb.h> 23 #include <stdio.h> 24 #include <string.h> 25 #include <unistd.h> 26 27 #include <openssl/err.h> 28 #include <openssl/ssl.h> 29 30 #include "util.h" 31 32 void __dead usage(void); 33 34 void __dead 35 usage(void) 36 { 37 fprintf(stderr, 38 "usage: client [-sv] [-C CA] [-c crt -k key] host port"); 39 exit(2); 40 } 41 42 int 43 main(int argc, char *argv[]) 44 { 45 const SSL_METHOD *method; 46 SSL_CTX *ctx; 47 SSL *ssl; 48 BIO *bio; 49 SSL_SESSION *session = NULL; 50 int error, sessionreuse = 0, verify = 0; 51 char buf[256], ch; 52 char *ca = NULL, *crt = NULL, *key = NULL; 53 char *host_port, *host, *port; 54 55 while ((ch = getopt(argc, argv, "C:c:k:sv")) != -1) { 56 switch (ch) { 57 case 'C': 58 ca = optarg; 59 break; 60 case 'c': 61 crt = optarg; 62 break; 63 case 'k': 64 key = optarg; 65 break; 66 case 's': 67 /* multiple reueses are possible */ 68 sessionreuse++; 69 break; 70 case 'v': 71 verify = 1; 72 break; 73 default: 74 usage(); 75 } 76 } 77 argc -= optind; 78 argv += optind; 79 if (argc == 2) { 80 host = argv[0]; 81 port = argv[1]; 82 } else { 83 usage(); 84 } 85 if (asprintf(&host_port, strchr(host, ':') ? "[%s]:%s" : "%s:%s", 86 host, port) == -1) 87 err(1, "asprintf host port"); 88 if ((crt == NULL && key != NULL) || (crt != NULL && key == NULL)) 89 errx(1, "certificate and private key must be used together"); 90 91 SSL_library_init(); 92 SSL_load_error_strings(); 93 print_version(); 94 95 /* setup method and context */ 96 #if OPENSSL_VERSION_NUMBER >= 0x1010000f 97 method = TLS_client_method(); 98 if (method == NULL) 99 err_ssl(1, "TLS_client_method"); 100 #else 101 method = SSLv23_client_method(); 102 if (method == NULL) 103 err_ssl(1, "SSLv23_client_method"); 104 #endif 105 ctx = SSL_CTX_new(method); 106 if (ctx == NULL) 107 err_ssl(1, "SSL_CTX_new"); 108 109 /* load client certificate */ 110 if (crt != NULL) { 111 if (SSL_CTX_use_certificate_file(ctx, crt, 112 SSL_FILETYPE_PEM) <= 0) 113 err_ssl(1, "SSL_CTX_use_certificate_file"); 114 if (SSL_CTX_use_PrivateKey_file(ctx, key, 115 SSL_FILETYPE_PEM) <= 0) 116 err_ssl(1, "SSL_CTX_use_PrivateKey_file"); 117 if (SSL_CTX_check_private_key(ctx) <= 0) 118 err_ssl(1, "SSL_CTX_check_private_key"); 119 } 120 121 /* verify server certificate */ 122 if (ca != NULL) { 123 if (SSL_CTX_load_verify_locations(ctx, ca, NULL) <= 0) 124 err_ssl(1, "SSL_CTX_load_verify_locations"); 125 } 126 SSL_CTX_set_verify(ctx, verify ? SSL_VERIFY_PEER : SSL_VERIFY_NONE, 127 verify_callback); 128 129 if (sessionreuse) { 130 SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_CLIENT); 131 } 132 133 do { 134 /* setup bio for socket operations */ 135 bio = BIO_new_connect(host_port); 136 if (bio == NULL) 137 err_ssl(1, "BIO_new_connect"); 138 139 /* connect */ 140 if (BIO_do_connect(bio) <= 0) 141 err_ssl(1, "BIO_do_connect"); 142 printf("connect "); 143 print_sockname(bio); 144 printf("connect "); 145 print_peername(bio); 146 147 /* do ssl client handshake */ 148 ssl = SSL_new(ctx); 149 if (ssl == NULL) 150 err_ssl(1, "SSL_new"); 151 print_ciphers(SSL_get_ciphers(ssl)); 152 SSL_set_bio(ssl, bio, bio); 153 /* resuse session if possible */ 154 if (session != NULL) { 155 if (SSL_set_session(ssl, session) <= 0) 156 err_ssl(1, "SSL_set_session"); 157 } 158 if ((error = SSL_connect(ssl)) <= 0) 159 err_ssl(1, "SSL_connect %d", error); 160 printf("session %d: %s\n", sessionreuse, 161 SSL_session_reused(ssl) ? "reuse" : "new"); 162 if (fflush(stdout) != 0) 163 err(1, "fflush stdout"); 164 165 /* print session statistics */ 166 if (sessionreuse) { 167 session = SSL_get1_session(ssl); 168 if (session == NULL) 169 err_ssl(1, "SSL1_get_session"); 170 } else { 171 session = SSL_get_session(ssl); 172 if (session == NULL) 173 err_ssl(1, "SSL_get_session"); 174 } 175 if (SSL_SESSION_print_fp(stdout, session) <= 0) 176 err_ssl(1, "SSL_SESSION_print_fp"); 177 178 /* read server greeting and write client hello over TLS */ 179 if ((error = SSL_read(ssl, buf, 9)) <= 0) 180 err_ssl(1, "SSL_read %d", error); 181 if (error != 9) 182 errx(1, "read not 9 bytes greeting: %d", error); 183 buf[9] = '\0'; 184 printf("<<< %s", buf); 185 if (fflush(stdout) != 0) 186 err(1, "fflush stdout"); 187 strlcpy(buf, "hello\n", sizeof(buf)); 188 printf(">>> %s", buf); 189 if (fflush(stdout) != 0) 190 err(1, "fflush stdout"); 191 if ((error = SSL_write(ssl, buf, 6)) <= 0) 192 err_ssl(1, "SSL_write %d", error); 193 if (error != 6) 194 errx(1, "write not 6 bytes hello: %d", error); 195 196 /* shutdown connection */ 197 if ((error = SSL_shutdown(ssl)) < 0) 198 err_ssl(1, "SSL_shutdown unidirectional %d", error); 199 if (error <= 0) { 200 if ((error = SSL_shutdown(ssl)) <= 0) 201 err_ssl(1, "SSL_shutdown bidirectional %d", 202 error); 203 } 204 205 SSL_free(ssl); 206 } while (sessionreuse--); 207 208 SSL_CTX_free(ctx); 209 210 printf("success\n"); 211 212 return 0; 213 } 214