in tool/client.cc [545:775]
bool DoClient(std::map<std::string, std::string> args_map, bool is_openssl_s_client) {
if (!InitSocketLibrary()) {
return false;
}
bssl::UniquePtr<SSL_CTX> ctx(SSL_CTX_new(TLS_method()));
const char *keylog_file = getenv("SSLKEYLOGFILE");
if (keylog_file) {
g_keylog_file = fopen(keylog_file, "a");
if (g_keylog_file == nullptr) {
perror("fopen");
return false;
}
SSL_CTX_set_keylog_callback(ctx.get(), KeyLogCallback);
}
if (args_map.count("-cipher") != 0 &&
!SSL_CTX_set_strict_cipher_list(ctx.get(), args_map["-cipher"].c_str())) {
fprintf(stderr, "Failed setting cipher list\n");
return false;
}
if (args_map.count("-curves") != 0 &&
!SSL_CTX_set1_curves_list(ctx.get(), args_map["-curves"].c_str())) {
fprintf(stderr, "Failed setting curves list\n");
return false;
}
if (args_map.count("-sigalgs") != 0 &&
!SSL_CTX_set1_sigalgs_list(ctx.get(), args_map["-sigalgs"].c_str())) {
fprintf(stderr, "Failed setting signature algorithms list\n");
return false;
}
uint16_t max_version = TLS1_3_VERSION;
if (args_map.count("-max-version") != 0 &&
!VersionFromString(&max_version, args_map["-max-version"])) {
fprintf(stderr, "Unknown protocol version: '%s'\n",
args_map["-max-version"].c_str());
return false;
}
if (!SSL_CTX_set_max_proto_version(ctx.get(), max_version)) {
return false;
}
if (args_map.count("-min-version") != 0) {
uint16_t version;
if (!VersionFromString(&version, args_map["-min-version"])) {
fprintf(stderr, "Unknown protocol version: '%s'\n",
args_map["-min-version"].c_str());
return false;
}
if (!SSL_CTX_set_min_proto_version(ctx.get(), version)) {
return false;
}
}
if (args_map.count("-select-next-proto") != 0) {
const std::string &proto = args_map["-select-next-proto"];
if (proto.size() > 255) {
fprintf(stderr, "Bad NPN protocol: '%s'\n", proto.c_str());
return false;
}
// |SSL_CTX_set_next_proto_select_cb| is not const-correct.
SSL_CTX_set_next_proto_select_cb(ctx.get(), NextProtoSelectCallback,
const_cast<char *>(proto.c_str()));
}
if (args_map.count("-alpn-protos") != 0) {
const std::string &alpn_protos = args_map["-alpn-protos"];
std::vector<uint8_t> wire;
size_t i = 0;
while (i <= alpn_protos.size()) {
size_t j = alpn_protos.find(',', i);
if (j == std::string::npos) {
j = alpn_protos.size();
}
size_t len = j - i;
if (len > 255) {
fprintf(stderr, "Invalid ALPN protocols: '%s'\n", alpn_protos.c_str());
return false;
}
wire.push_back(static_cast<uint8_t>(len));
wire.resize(wire.size() + len);
OPENSSL_memcpy(wire.data() + wire.size() - len, alpn_protos.data() + i,
len);
i = j + 1;
}
if (SSL_CTX_set_alpn_protos(ctx.get(), wire.data(), wire.size()) != 0) {
return false;
}
}
if (args_map.count("-fallback-scsv") != 0) {
SSL_CTX_set_mode(ctx.get(), SSL_MODE_SEND_FALLBACK_SCSV);
}
if (args_map.count("-ocsp-stapling") != 0) {
SSL_CTX_enable_ocsp_stapling(ctx.get());
}
if (args_map.count("-signed-certificate-timestamps") != 0) {
SSL_CTX_enable_signed_cert_timestamps(ctx.get());
}
if (args_map.count("-channel-id-key") != 0) {
bssl::UniquePtr<EVP_PKEY> pkey =
LoadPrivateKey(args_map["-channel-id-key"]);
if (!pkey || !SSL_CTX_set1_tls_channel_id(ctx.get(), pkey.get())) {
return false;
}
}
if (args_map.count("-false-start") != 0) {
SSL_CTX_set_mode(ctx.get(), SSL_MODE_ENABLE_FALSE_START);
}
if (args_map.count("-key") != 0) {
const std::string &key = args_map["-key"];
if (!SSL_CTX_use_PrivateKey_file(ctx.get(), key.c_str(),
SSL_FILETYPE_PEM)) {
fprintf(stderr, "Failed to load private key: %s\n", key.c_str());
return false;
}
const std::string &cert =
args_map.count("-cert") != 0 ? args_map["-cert"] : key;
if (!SSL_CTX_use_certificate_chain_file(ctx.get(), cert.c_str())) {
fprintf(stderr, "Failed to load cert chain: %s\n", cert.c_str());
return false;
}
}
SSL_CTX_set_session_cache_mode(ctx.get(), SSL_SESS_CACHE_CLIENT);
SSL_CTX_sess_set_new_cb(ctx.get(), NewSessionCallback);
if (args_map.count("-session-out") != 0) {
session_out.reset(BIO_new_file(args_map["-session-out"].c_str(), "wb"));
if (!session_out) {
fprintf(stderr, "Error while opening %s:\n",
args_map["-session-out"].c_str());
ERR_print_errors_fp(stderr);
return false;
}
}
if (args_map.count("-grease") != 0) {
SSL_CTX_set_grease_enabled(ctx.get(), 1);
}
if (args_map.count("-permute-extensions") != 0) {
SSL_CTX_set_permute_extensions(ctx.get(), 1);
}
std::string certPathFlag;
int verify = SSL_VERIFY_NONE;
if (args_map.count("-root-certs") != 0) {
certPathFlag = "-root-certs";
verify = SSL_VERIFY_PEER;
}
// For the OpenSSL tool, simply specifying -CAfile does not imply verification
if (args_map.count("-CAfile") != 0) {
certPathFlag = "-CAfile";
}
if (!certPathFlag.empty()) {
if (!SSL_CTX_load_verify_locations(
ctx.get(), args_map[certPathFlag].c_str(), nullptr)) {
fprintf(stderr, "Failed to load root certificates.\n");
ERR_print_errors_fp(stderr);
return false;
}
}
certPathFlag = "";
if (args_map.count("-root-cert-dir") != 0) {
certPathFlag = "-root-cert-dir";
verify = SSL_VERIFY_PEER;
}
// For the OpenSSL tool, simply specifying -CApath does not imply verification
if (args_map.count("-CApath") != 0) {
certPathFlag = "-CApath";
}
if (!certPathFlag.empty()) {
if (!SSL_CTX_load_verify_locations(
ctx.get(), nullptr, args_map[certPathFlag].c_str())) {
fprintf(stderr, "Failed to load root certificates.\n");
ERR_print_errors_fp(stderr);
return false;
}
}
if (args_map.count("-verify") != 0) {
unsigned int depth;
if (!GetUnsigned(&depth, "-verify", 0, args_map)) {
fprintf(stderr, "s_client: Can't parse \"%s\" as a number\n", args_map.find("-verify")->second.c_str());
return false;
}
fprintf(stdout, "verify depth is %d\n", (int)depth);
verify = SSL_VERIFY_PEER;
}
if (is_openssl_s_client) { // openssl tool
SSL_CTX_set_verify(ctx.get(), verify, verify_cb);
} else {
SSL_CTX_set_verify(ctx.get(), verify, nullptr);
}
if (args_map.count("-early-data") != 0) {
SSL_CTX_set_early_data_enabled(ctx.get(), 1);
}
if (args_map.count("-debug") != 0) {
SSL_CTX_set_info_callback(ctx.get(), InfoCallback);
}
if (args_map.count("-test-resumption") != 0) {
if (args_map.count("-session-in") != 0) {
fprintf(stderr,
"Flags -session-in and -test-resumption are incompatible.\n");
return false;
}
if (!DoConnection(ctx.get(), args_map, &WaitForSession, is_openssl_s_client)) {
return false;
}
}
return DoConnection(ctx.get(), args_map, &TransferData, is_openssl_s_client);
}