ciphers.c 7.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277
  1. /*
  2. * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include <stdlib.h>
  11. #include <string.h>
  12. #include "apps.h"
  13. #include "progs.h"
  14. #include <openssl/err.h>
  15. #include <openssl/ssl.h>
  16. #include "s_apps.h"
  17. typedef enum OPTION_choice {
  18. OPT_COMMON,
  19. OPT_STDNAME,
  20. OPT_CONVERT,
  21. OPT_SSL3,
  22. OPT_TLS1,
  23. OPT_TLS1_1,
  24. OPT_TLS1_2,
  25. OPT_TLS1_3,
  26. OPT_PSK,
  27. OPT_SRP,
  28. OPT_CIPHERSUITES,
  29. OPT_V, OPT_UPPER_V, OPT_S, OPT_PROV_ENUM
  30. } OPTION_CHOICE;
  31. const OPTIONS ciphers_options[] = {
  32. {OPT_HELP_STR, 1, '-', "Usage: %s [options] [cipher]\n"},
  33. OPT_SECTION("General"),
  34. {"help", OPT_HELP, '-', "Display this summary"},
  35. OPT_SECTION("Output"),
  36. {"v", OPT_V, '-', "Verbose listing of the SSL/TLS ciphers"},
  37. {"V", OPT_UPPER_V, '-', "Even more verbose"},
  38. {"stdname", OPT_STDNAME, '-', "Show standard cipher names"},
  39. {"convert", OPT_CONVERT, 's', "Convert standard name into OpenSSL name"},
  40. OPT_SECTION("Cipher specification"),
  41. {"s", OPT_S, '-', "Only supported ciphers"},
  42. #ifndef OPENSSL_NO_SSL3
  43. {"ssl3", OPT_SSL3, '-', "Ciphers compatible with SSL3"},
  44. #endif
  45. #ifndef OPENSSL_NO_TLS1
  46. {"tls1", OPT_TLS1, '-', "Ciphers compatible with TLS1"},
  47. #endif
  48. #ifndef OPENSSL_NO_TLS1_1
  49. {"tls1_1", OPT_TLS1_1, '-', "Ciphers compatible with TLS1.1"},
  50. #endif
  51. #ifndef OPENSSL_NO_TLS1_2
  52. {"tls1_2", OPT_TLS1_2, '-', "Ciphers compatible with TLS1.2"},
  53. #endif
  54. #ifndef OPENSSL_NO_TLS1_3
  55. {"tls1_3", OPT_TLS1_3, '-', "Ciphers compatible with TLS1.3"},
  56. #endif
  57. #ifndef OPENSSL_NO_PSK
  58. {"psk", OPT_PSK, '-', "Include ciphersuites requiring PSK"},
  59. #endif
  60. #ifndef OPENSSL_NO_SRP
  61. {"srp", OPT_SRP, '-', "(deprecated) Include ciphersuites requiring SRP"},
  62. #endif
  63. {"ciphersuites", OPT_CIPHERSUITES, 's',
  64. "Configure the TLSv1.3 ciphersuites to use"},
  65. OPT_PROV_OPTIONS,
  66. OPT_PARAMETERS(),
  67. {"cipher", 0, 0, "Cipher string to decode (optional)"},
  68. {NULL}
  69. };
  70. #ifndef OPENSSL_NO_PSK
  71. static unsigned int dummy_psk(SSL *ssl, const char *hint, char *identity,
  72. unsigned int max_identity_len,
  73. unsigned char *psk,
  74. unsigned int max_psk_len)
  75. {
  76. return 0;
  77. }
  78. #endif
  79. int ciphers_main(int argc, char **argv)
  80. {
  81. SSL_CTX *ctx = NULL;
  82. SSL *ssl = NULL;
  83. STACK_OF(SSL_CIPHER) *sk = NULL;
  84. const SSL_METHOD *meth = TLS_server_method();
  85. int ret = 1, i, verbose = 0, Verbose = 0, use_supported = 0;
  86. int stdname = 0;
  87. #ifndef OPENSSL_NO_PSK
  88. int psk = 0;
  89. #endif
  90. #ifndef OPENSSL_NO_SRP
  91. int srp = 0;
  92. #endif
  93. const char *p;
  94. char *ciphers = NULL, *prog, *convert = NULL, *ciphersuites = NULL;
  95. char buf[512];
  96. OPTION_CHOICE o;
  97. int min_version = 0, max_version = 0;
  98. prog = opt_init(argc, argv, ciphers_options);
  99. while ((o = opt_next()) != OPT_EOF) {
  100. switch (o) {
  101. case OPT_EOF:
  102. case OPT_ERR:
  103. opthelp:
  104. BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
  105. goto end;
  106. case OPT_HELP:
  107. opt_help(ciphers_options);
  108. ret = 0;
  109. goto end;
  110. case OPT_V:
  111. verbose = 1;
  112. break;
  113. case OPT_UPPER_V:
  114. verbose = Verbose = 1;
  115. break;
  116. case OPT_S:
  117. use_supported = 1;
  118. break;
  119. case OPT_STDNAME:
  120. stdname = verbose = 1;
  121. break;
  122. case OPT_CONVERT:
  123. convert = opt_arg();
  124. break;
  125. case OPT_SSL3:
  126. min_version = SSL3_VERSION;
  127. max_version = SSL3_VERSION;
  128. break;
  129. case OPT_TLS1:
  130. min_version = TLS1_VERSION;
  131. max_version = TLS1_VERSION;
  132. break;
  133. case OPT_TLS1_1:
  134. min_version = TLS1_1_VERSION;
  135. max_version = TLS1_1_VERSION;
  136. break;
  137. case OPT_TLS1_2:
  138. min_version = TLS1_2_VERSION;
  139. max_version = TLS1_2_VERSION;
  140. break;
  141. case OPT_TLS1_3:
  142. min_version = TLS1_3_VERSION;
  143. max_version = TLS1_3_VERSION;
  144. break;
  145. case OPT_PSK:
  146. #ifndef OPENSSL_NO_PSK
  147. psk = 1;
  148. #endif
  149. break;
  150. case OPT_SRP:
  151. #ifndef OPENSSL_NO_SRP
  152. srp = 1;
  153. #endif
  154. break;
  155. case OPT_CIPHERSUITES:
  156. ciphersuites = opt_arg();
  157. break;
  158. case OPT_PROV_CASES:
  159. if (!opt_provider(o))
  160. goto end;
  161. break;
  162. }
  163. }
  164. /* Optional arg is cipher name. */
  165. argv = opt_rest();
  166. argc = opt_num_rest();
  167. if (argc == 1)
  168. ciphers = argv[0];
  169. else if (argc != 0)
  170. goto opthelp;
  171. if (convert != NULL) {
  172. BIO_printf(bio_out, "OpenSSL cipher name: %s\n",
  173. OPENSSL_cipher_name(convert));
  174. goto end;
  175. }
  176. ctx = SSL_CTX_new(meth);
  177. if (ctx == NULL)
  178. goto err;
  179. if (SSL_CTX_set_min_proto_version(ctx, min_version) == 0)
  180. goto err;
  181. if (SSL_CTX_set_max_proto_version(ctx, max_version) == 0)
  182. goto err;
  183. #ifndef OPENSSL_NO_PSK
  184. if (psk)
  185. SSL_CTX_set_psk_client_callback(ctx, dummy_psk);
  186. #endif
  187. #ifndef OPENSSL_NO_SRP
  188. if (srp)
  189. set_up_dummy_srp(ctx);
  190. #endif
  191. if (ciphersuites != NULL && !SSL_CTX_set_ciphersuites(ctx, ciphersuites)) {
  192. BIO_printf(bio_err, "Error setting TLSv1.3 ciphersuites\n");
  193. goto err;
  194. }
  195. if (ciphers != NULL) {
  196. if (!SSL_CTX_set_cipher_list(ctx, ciphers)) {
  197. BIO_printf(bio_err, "Error in cipher list\n");
  198. goto err;
  199. }
  200. }
  201. ssl = SSL_new(ctx);
  202. if (ssl == NULL)
  203. goto err;
  204. if (use_supported)
  205. sk = SSL_get1_supported_ciphers(ssl);
  206. else
  207. sk = SSL_get_ciphers(ssl);
  208. if (!verbose) {
  209. for (i = 0; i < sk_SSL_CIPHER_num(sk); i++) {
  210. const SSL_CIPHER *c = sk_SSL_CIPHER_value(sk, i);
  211. p = SSL_CIPHER_get_name(c);
  212. if (p == NULL)
  213. break;
  214. if (i != 0)
  215. BIO_printf(bio_out, ":");
  216. BIO_printf(bio_out, "%s", p);
  217. }
  218. BIO_printf(bio_out, "\n");
  219. } else {
  220. for (i = 0; i < sk_SSL_CIPHER_num(sk); i++) {
  221. const SSL_CIPHER *c;
  222. c = sk_SSL_CIPHER_value(sk, i);
  223. if (Verbose) {
  224. unsigned long id = SSL_CIPHER_get_id(c);
  225. int id0 = (int)(id >> 24);
  226. int id1 = (int)((id >> 16) & 0xffL);
  227. int id2 = (int)((id >> 8) & 0xffL);
  228. int id3 = (int)(id & 0xffL);
  229. if ((id & 0xff000000L) == 0x03000000L)
  230. BIO_printf(bio_out, " 0x%02X,0x%02X - ", id2, id3); /* SSL3
  231. * cipher */
  232. else
  233. BIO_printf(bio_out, "0x%02X,0x%02X,0x%02X,0x%02X - ", id0, id1, id2, id3); /* whatever */
  234. }
  235. if (stdname) {
  236. const char *nm = SSL_CIPHER_standard_name(c);
  237. if (nm == NULL)
  238. nm = "UNKNOWN";
  239. BIO_printf(bio_out, "%-45s - ", nm);
  240. }
  241. BIO_puts(bio_out, SSL_CIPHER_description(c, buf, sizeof(buf)));
  242. }
  243. }
  244. ret = 0;
  245. goto end;
  246. err:
  247. ERR_print_errors(bio_err);
  248. end:
  249. if (use_supported)
  250. sk_SSL_CIPHER_free(sk);
  251. SSL_CTX_free(ctx);
  252. SSL_free(ssl);
  253. return ret;
  254. }