xref: /openbsd-src/usr.bin/openssl/s_time.c (revision 9b9d2a55a62c8e82206c25f94fcc7f4e2765250e)
1 /* $OpenBSD: s_time.c,v 1.9 2015/08/22 16:36:05 jsing Exp $ */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3  * All rights reserved.
4  *
5  * This package is an SSL implementation written
6  * by Eric Young (eay@cryptsoft.com).
7  * The implementation was written so as to conform with Netscapes SSL.
8  *
9  * This library is free for commercial and non-commercial use as long as
10  * the following conditions are aheared to.  The following conditions
11  * apply to all code found in this distribution, be it the RC4, RSA,
12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
13  * included with this distribution is covered by the same copyright terms
14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15  *
16  * Copyright remains Eric Young's, and as such any Copyright notices in
17  * the code are not to be removed.
18  * If this package is used in a product, Eric Young should be given attribution
19  * as the author of the parts of the library used.
20  * This can be in the form of a textual message at program startup or
21  * in documentation (online or textual) provided with the package.
22  *
23  * Redistribution and use in source and binary forms, with or without
24  * modification, are permitted provided that the following conditions
25  * are met:
26  * 1. Redistributions of source code must retain the copyright
27  *    notice, this list of conditions and the following disclaimer.
28  * 2. Redistributions in binary form must reproduce the above copyright
29  *    notice, this list of conditions and the following disclaimer in the
30  *    documentation and/or other materials provided with the distribution.
31  * 3. All advertising materials mentioning features or use of this software
32  *    must display the following acknowledgement:
33  *    "This product includes cryptographic software written by
34  *     Eric Young (eay@cryptsoft.com)"
35  *    The word 'cryptographic' can be left out if the rouines from the library
36  *    being used are not cryptographic related :-).
37  * 4. If you include any Windows specific code (or a derivative thereof) from
38  *    the apps directory (application code) you must include an acknowledgement:
39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40  *
41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51  * SUCH DAMAGE.
52  *
53  * The licence and distribution terms for any publically available version or
54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
55  * copied and put under another distribution licence
56  * [including the GNU Public Licence.]
57  */
58 
59 #define NO_SHUTDOWN
60 
61 /*-----------------------------------------
62    s_time - SSL client connection timer program
63    Written and donated by Larry Streepy <streepy@healthcare.com>
64   -----------------------------------------*/
65 
66 #include <sys/types.h>
67 #include <sys/socket.h>
68 
69 #include <stdio.h>
70 #include <stdlib.h>
71 #include <limits.h>
72 #include <string.h>
73 #include <unistd.h>
74 #include <poll.h>
75 
76 #include "apps.h"
77 
78 #include <openssl/err.h>
79 #include <openssl/pem.h>
80 #include <openssl/ssl.h>
81 #include <openssl/x509.h>
82 
83 #include "s_apps.h"
84 
85 #define SSL_CONNECT_NAME	"localhost:4433"
86 
87 #define BUFSIZZ 1024*10
88 
89 #define MYBUFSIZ 1024*8
90 
91 #undef min
92 #undef max
93 #define min(a,b) (((a) < (b)) ? (a) : (b))
94 #define max(a,b) (((a) > (b)) ? (a) : (b))
95 
96 #define SECONDS	30
97 extern int verify_depth;
98 extern int verify_error;
99 
100 static void s_time_usage(void);
101 static SSL *doConnection(SSL * scon);
102 
103 static SSL_CTX *tm_ctx = NULL;
104 static const SSL_METHOD *s_time_meth = NULL;
105 static long bytes_read = 0;
106 
107 struct {
108 	int bugs;
109 	char *CAfile;
110 	char *CApath;
111 	char *certfile;
112 	char *cipher;
113 	char *host;
114 	char *keyfile;
115 	int maxtime;
116 	int nbio;
117 	int perform;
118 	int verify;
119 	int verify_depth;
120 	char *www_path;
121 } s_time_config;
122 
123 struct option s_time_options[] = {
124 	{
125 		.name = "bugs",
126 		.desc = "Enable workarounds for known SSL/TLS bugs",
127 		.type = OPTION_FLAG,
128 		.opt.flag = &s_time_config.bugs,
129 	},
130 	{
131 		.name = "CAfile",
132 		.argname = "file",
133 		.desc = "File containing trusted certificates in PEM format",
134 		.type = OPTION_ARG,
135 		.opt.arg = &s_time_config.CAfile,
136 	},
137 	{
138 		.name = "CApath",
139 		.argname = "path",
140 		.desc = "Directory containing trusted certificates",
141 		.type = OPTION_ARG,
142 		.opt.arg = &s_time_config.CApath,
143 	},
144 	{
145 		.name = "cert",
146 		.argname = "file",
147 		.desc = "Client certificate to use, if one is requested",
148 		.type = OPTION_ARG,
149 		.opt.arg = &s_time_config.certfile,
150 	},
151 	{
152 		.name = "cipher",
153 		.argname = "list",
154 		.desc = "List of cipher suites to send to the server",
155 		.type = OPTION_ARG,
156 		.opt.arg = &s_time_config.cipher,
157 	},
158 	{
159 		.name = "connect",
160 		.argname = "host:port",
161 		.desc = "Host and port to connect to (default "
162 		    SSL_CONNECT_NAME ")",
163 		.type = OPTION_ARG,
164 		.opt.arg = &s_time_config.host,
165 	},
166 	{
167 		.name = "key",
168 		.argname = "file",
169 		.desc = "Client private key to use, if one is required",
170 		.type = OPTION_ARG,
171 		.opt.arg = &s_time_config.keyfile,
172 	},
173 	{
174 		.name = "nbio",
175 		.desc = "Use non-blocking I/O",
176 		.type = OPTION_FLAG,
177 		.opt.flag = &s_time_config.nbio,
178 	},
179 	{
180 		.name = "new",
181 		.desc = "Use a new session ID for each connection",
182 		.type = OPTION_VALUE,
183 		.opt.value = &s_time_config.perform,
184 		.value = 1,
185 	},
186 	{
187 		.name = "reuse",
188 		.desc = "Reuse the same session ID for each connection",
189 		.type = OPTION_VALUE,
190 		.opt.value = &s_time_config.perform,
191 		.value = 2,
192 	},
193 	{
194 		.name = "time",
195 		.argname = "seconds",
196 		.desc = "Duration to perform timing tests for (default 30)",
197 		.type = OPTION_ARG_INT,
198 		.opt.value = &s_time_config.maxtime,
199 	},
200 	{
201 		.name = "verify",
202 		.argname = "depth",
203 		.desc = "Enable peer certificate verification with given depth",
204 		.type = OPTION_ARG_INT,
205 		.opt.value = &s_time_config.verify_depth,
206 	},
207 	{
208 		.name = "www",
209 		.argname = "page",
210 		.desc = "Page to GET from the server (default none)",
211 		.type = OPTION_ARG,
212 		.opt.arg = &s_time_config.www_path,
213 	},
214 	{ NULL },
215 };
216 
217 static void
218 s_time_usage(void)
219 {
220 	fprintf(stderr,
221 	    "usage: s_time "
222 	    "[-bugs] [-CAfile file] [-CApath directory] [-cert file]\n"
223 	    "    [-cipher cipherlist] [-connect host:port] [-key keyfile]\n"
224 	    "    [-nbio] [-new] [-reuse] [-time seconds]\n"
225 	    "    [-verify depth] [-www page]\n\n");
226 	options_usage(s_time_options);
227 }
228 
229 /***********************************************************************
230  * TIME - time functions
231  */
232 #define START	0
233 #define STOP	1
234 
235 static double
236 tm_Time_F(int s)
237 {
238 	return app_tminterval(s, 1);
239 }
240 
241 /***********************************************************************
242  * MAIN - main processing area for client
243  *			real name depends on MONOLITH
244  */
245 int
246 s_time_main(int argc, char **argv)
247 {
248 	double totalTime = 0.0;
249 	int nConn = 0;
250 	SSL *scon = NULL;
251 	long finishtime = 0;
252 	int ret = 1, i;
253 	char buf[1024 * 8];
254 	int ver;
255 
256 	s_time_meth = SSLv23_client_method();
257 
258 	verify_depth = 0;
259 	verify_error = X509_V_OK;
260 
261 	memset(&s_time_config, 0, sizeof(s_time_config));
262 
263 	s_time_config.host = SSL_CONNECT_NAME;
264 	s_time_config.maxtime = SECONDS;
265 	s_time_config.perform = 3;
266 	s_time_config.verify = SSL_VERIFY_NONE;
267 	s_time_config.verify_depth = -1;
268 
269 	if (options_parse(argc, argv, s_time_options, NULL, NULL) != 0) {
270 		s_time_usage();
271 		goto end;
272 	}
273 
274 	if (s_time_config.verify_depth >= 0) {
275 		s_time_config.verify = SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE;
276 		verify_depth = s_time_config.verify_depth;
277 		BIO_printf(bio_err, "verify depth is %d\n", verify_depth);
278 	}
279 
280 	if (s_time_config.www_path != NULL &&
281 	    strlen(s_time_config.www_path) > MYBUFSIZ - 100) {
282 		BIO_printf(bio_err, "-www option too long\n");
283 		goto end;
284 	}
285 
286 	if ((tm_ctx = SSL_CTX_new(s_time_meth)) == NULL)
287 		return (1);
288 
289 	SSL_CTX_set_quiet_shutdown(tm_ctx, 1);
290 
291 	if (s_time_config.bugs)
292 		SSL_CTX_set_options(tm_ctx, SSL_OP_ALL);
293 
294 	if (s_time_config.cipher != NULL) {
295 		if (!SSL_CTX_set_cipher_list(tm_ctx, s_time_config.cipher)) {
296 			BIO_printf(bio_err, "error setting cipher list\n");
297 			ERR_print_errors(bio_err);
298 			goto end;
299 		}
300 	}
301 
302 	if (!set_cert_stuff(tm_ctx, s_time_config.certfile,
303 	    s_time_config.keyfile))
304 		goto end;
305 
306 	if ((!SSL_CTX_load_verify_locations(tm_ctx, s_time_config.CAfile,
307 	    s_time_config.CApath)) ||
308 	    (!SSL_CTX_set_default_verify_paths(tm_ctx))) {
309 		/*
310 		 * BIO_printf(bio_err,"error setting default verify
311 		 * locations\n");
312 		 */
313 		ERR_print_errors(bio_err);
314 		/* goto end; */
315 	}
316 
317 	if (!(s_time_config.perform & 1))
318 		goto next;
319 	printf("Collecting connection statistics for %d seconds\n",
320 	    s_time_config.maxtime);
321 
322 	/* Loop and time how long it takes to make connections */
323 
324 	bytes_read = 0;
325 	finishtime = (long) time(NULL) + s_time_config.maxtime;
326 	tm_Time_F(START);
327 	for (;;) {
328 		if (finishtime < (long) time(NULL))
329 			break;
330 		if ((scon = doConnection(NULL)) == NULL)
331 			goto end;
332 
333 		if (s_time_config.www_path != NULL) {
334 			int retval = snprintf(buf, sizeof buf,
335 			    "GET %s HTTP/1.0\r\n\r\n", s_time_config.www_path);
336 			if ((size_t)retval >= sizeof buf) {
337 				fprintf(stderr, "URL too long\n");
338 				goto end;
339 			}
340 			SSL_write(scon, buf, strlen(buf));
341 			while ((i = SSL_read(scon, buf, sizeof(buf))) > 0)
342 				bytes_read += i;
343 		}
344 #ifdef NO_SHUTDOWN
345 		SSL_set_shutdown(scon, SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN);
346 #else
347 		SSL_shutdown(scon);
348 #endif
349 		shutdown(SSL_get_fd(scon), SHUT_RDWR);
350 		close(SSL_get_fd(scon));
351 
352 		nConn += 1;
353 		if (SSL_session_reused(scon))
354 			ver = 'r';
355 		else {
356 			ver = SSL_version(scon);
357 			if (ver == TLS1_VERSION)
358 				ver = 't';
359 			else if (ver == SSL3_VERSION)
360 				ver = '3';
361 			else if (ver == SSL2_VERSION)
362 				ver = '2';
363 			else
364 				ver = '*';
365 		}
366 		fputc(ver, stdout);
367 		fflush(stdout);
368 
369 		SSL_free(scon);
370 		scon = NULL;
371 	}
372 	totalTime += tm_Time_F(STOP);	/* Add the time for this iteration */
373 
374 	i = (int) ((long) time(NULL) - finishtime + s_time_config.maxtime);
375 	printf("\n\n%d connections in %.2fs; %.2f connections/user sec, bytes read %ld\n", nConn, totalTime, ((double) nConn / totalTime), bytes_read);
376 	printf("%d connections in %ld real seconds, %ld bytes read per connection\n", nConn, (long) time(NULL) - finishtime + s_time_config.maxtime, bytes_read / nConn);
377 
378 	/*
379 	 * Now loop and time connections using the same session id over and
380 	 * over
381 	 */
382 
383 next:
384 	if (!(s_time_config.perform & 2))
385 		goto end;
386 	printf("\n\nNow timing with session id reuse.\n");
387 
388 	/* Get an SSL object so we can reuse the session id */
389 	if ((scon = doConnection(NULL)) == NULL) {
390 		fprintf(stderr, "Unable to get connection\n");
391 		goto end;
392 	}
393 	if (s_time_config.www_path != NULL) {
394 		int retval = snprintf(buf, sizeof buf,
395 		    "GET %s HTTP/1.0\r\n\r\n", s_time_config.www_path);
396 		if ((size_t)retval >= sizeof buf) {
397 			fprintf(stderr, "URL too long\n");
398 			goto end;
399 		}
400 		SSL_write(scon, buf, strlen(buf));
401 		while (SSL_read(scon, buf, sizeof(buf)) > 0);
402 	}
403 #ifdef NO_SHUTDOWN
404 	SSL_set_shutdown(scon, SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN);
405 #else
406 	SSL_shutdown(scon);
407 #endif
408 	shutdown(SSL_get_fd(scon), SHUT_RDWR);
409 	close(SSL_get_fd(scon));
410 
411 	nConn = 0;
412 	totalTime = 0.0;
413 
414 	finishtime = (long) time(NULL) + s_time_config.maxtime;
415 
416 	printf("starting\n");
417 	bytes_read = 0;
418 	tm_Time_F(START);
419 
420 	for (;;) {
421 		if (finishtime < (long) time(NULL))
422 			break;
423 		if ((doConnection(scon)) == NULL)
424 			goto end;
425 
426 		if (s_time_config.www_path) {
427 			int retval = snprintf(buf, sizeof buf,
428 			    "GET %s HTTP/1.0\r\n\r\n", s_time_config.www_path);
429 			if ((size_t)retval >= sizeof buf) {
430 				fprintf(stderr, "URL too long\n");
431 				goto end;
432 			}
433 			SSL_write(scon, buf, strlen(buf));
434 			while ((i = SSL_read(scon, buf, sizeof(buf))) > 0)
435 				bytes_read += i;
436 		}
437 #ifdef NO_SHUTDOWN
438 		SSL_set_shutdown(scon, SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN);
439 #else
440 		SSL_shutdown(scon);
441 #endif
442 		shutdown(SSL_get_fd(scon), SHUT_RDWR);
443 		close(SSL_get_fd(scon));
444 
445 		nConn += 1;
446 		if (SSL_session_reused(scon))
447 			ver = 'r';
448 		else {
449 			ver = SSL_version(scon);
450 			if (ver == TLS1_VERSION)
451 				ver = 't';
452 			else if (ver == SSL3_VERSION)
453 				ver = '3';
454 			else if (ver == SSL2_VERSION)
455 				ver = '2';
456 			else
457 				ver = '*';
458 		}
459 		fputc(ver, stdout);
460 		fflush(stdout);
461 	}
462 	totalTime += tm_Time_F(STOP);	/* Add the time for this iteration */
463 
464 
465 	printf("\n\n%d connections in %.2fs; %.2f connections/user sec, bytes read %ld\n", nConn, totalTime, ((double) nConn / totalTime), bytes_read);
466 	printf("%d connections in %ld real seconds, %ld bytes read per connection\n", nConn, (long) time(NULL) - finishtime + s_time_config.maxtime, bytes_read / nConn);
467 
468 	ret = 0;
469 end:
470 	if (scon != NULL)
471 		SSL_free(scon);
472 
473 	if (tm_ctx != NULL) {
474 		SSL_CTX_free(tm_ctx);
475 		tm_ctx = NULL;
476 	}
477 
478 	return (ret);
479 }
480 
481 /***********************************************************************
482  * doConnection - make a connection
483  * Args:
484  *		scon	= earlier ssl connection for session id, or NULL
485  * Returns:
486  *		SSL *	= the connection pointer.
487  */
488 static SSL *
489 doConnection(SSL * scon)
490 {
491 	struct pollfd pfd[1];
492 	SSL *serverCon;
493 	BIO *conn;
494 	int i;
495 
496 	if ((conn = BIO_new(BIO_s_connect())) == NULL)
497 		return (NULL);
498 
499 /*	BIO_set_conn_port(conn,port);*/
500 	BIO_set_conn_hostname(conn, s_time_config.host);
501 
502 	if (scon == NULL)
503 		serverCon = SSL_new(tm_ctx);
504 	else {
505 		serverCon = scon;
506 		SSL_set_connect_state(serverCon);
507 	}
508 
509 	SSL_set_bio(serverCon, conn, conn);
510 
511 	/* ok, lets connect */
512 	for (;;) {
513 		i = SSL_connect(serverCon);
514 		if (BIO_sock_should_retry(i)) {
515 			BIO_printf(bio_err, "DELAY\n");
516 
517 			i = SSL_get_fd(serverCon);
518 			pfd[0].fd = i;
519 			pfd[0].events = POLLIN;
520 			poll(pfd, 1, -1);
521 			continue;
522 		}
523 		break;
524 	}
525 	if (i <= 0) {
526 		BIO_printf(bio_err, "ERROR\n");
527 		if (verify_error != X509_V_OK)
528 			BIO_printf(bio_err, "verify error:%s\n",
529 			    X509_verify_cert_error_string(verify_error));
530 		else
531 			ERR_print_errors(bio_err);
532 		if (scon == NULL)
533 			SSL_free(serverCon);
534 		return NULL;
535 	}
536 	return serverCon;
537 }
538