client.c 158 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084308530863087308830893090309130923093309430953096309730983099310031013102310331043105310631073108310931103111311231133114311531163117311831193120312131223123312431253126312731283129313031313132313331343135313631373138313931403141314231433144314531463147314831493150315131523153315431553156315731583159316031613162316331643165316631673168316931703171317231733174317531763177317831793180318131823183318431853186318731883189319031913192319331943195319631973198319932003201320232033204320532063207320832093210321132123213321432153216321732183219322032213222322332243225322632273228322932303231323232333234323532363237323832393240324132423243324432453246324732483249325032513252325332543255325632573258325932603261326232633264326532663267326832693270327132723273327432753276327732783279328032813282328332843285328632873288328932903291329232933294329532963297329832993300330133023303330433053306330733083309331033113312331333143315331633173318331933203321332233233324332533263327332833293330333133323333333433353336333733383339334033413342334333443345334633473348334933503351335233533354335533563357335833593360336133623363336433653366336733683369337033713372337333743375337633773378337933803381338233833384338533863387338833893390339133923393339433953396339733983399340034013402340334043405340634073408340934103411341234133414341534163417341834193420342134223423342434253426342734283429343034313432343334343435343634373438343934403441344234433444344534463447344834493450345134523453345434553456345734583459346034613462346334643465346634673468346934703471347234733474347534763477347834793480348134823483348434853486348734883489349034913492349334943495349634973498349935003501350235033504350535063507350835093510351135123513351435153516351735183519352035213522352335243525352635273528352935303531353235333534353535363537353835393540354135423543354435453546354735483549355035513552355335543555355635573558355935603561356235633564356535663567356835693570357135723573357435753576357735783579358035813582358335843585358635873588358935903591359235933594359535963597359835993600360136023603360436053606360736083609361036113612361336143615361636173618361936203621362236233624362536263627362836293630363136323633363436353636363736383639364036413642364336443645364636473648364936503651365236533654365536563657365836593660366136623663366436653666366736683669367036713672367336743675367636773678367936803681368236833684368536863687368836893690369136923693369436953696369736983699370037013702370337043705370637073708370937103711371237133714371537163717371837193720372137223723372437253726372737283729373037313732373337343735373637373738373937403741374237433744374537463747374837493750375137523753375437553756375737583759376037613762376337643765376637673768376937703771377237733774377537763777377837793780378137823783378437853786378737883789379037913792379337943795379637973798379938003801380238033804380538063807380838093810381138123813381438153816381738183819382038213822382338243825382638273828382938303831383238333834383538363837383838393840384138423843384438453846384738483849385038513852385338543855385638573858385938603861386238633864386538663867386838693870387138723873387438753876387738783879388038813882388338843885388638873888388938903891389238933894389538963897389838993900390139023903390439053906390739083909391039113912391339143915391639173918391939203921392239233924392539263927392839293930393139323933393439353936393739383939394039413942394339443945394639473948394939503951395239533954395539563957395839593960396139623963396439653966396739683969397039713972397339743975397639773978397939803981398239833984398539863987398839893990399139923993399439953996399739983999400040014002400340044005400640074008400940104011401240134014401540164017401840194020402140224023402440254026402740284029403040314032403340344035403640374038403940404041404240434044404540464047404840494050405140524053405440554056405740584059406040614062406340644065406640674068406940704071407240734074407540764077407840794080408140824083408440854086408740884089409040914092409340944095409640974098409941004101410241034104410541064107410841094110411141124113411441154116411741184119412041214122412341244125412641274128412941304131413241334134413541364137413841394140414141424143414441454146414741484149415041514152415341544155415641574158415941604161416241634164416541664167416841694170417141724173417441754176417741784179418041814182418341844185418641874188418941904191419241934194419541964197419841994200420142024203420442054206420742084209421042114212421342144215421642174218421942204221422242234224422542264227422842294230423142324233423442354236423742384239424042414242424342444245424642474248424942504251425242534254425542564257425842594260426142624263426442654266426742684269427042714272427342744275427642774278427942804281428242834284428542864287428842894290429142924293429442954296429742984299430043014302430343044305430643074308430943104311431243134314431543164317431843194320432143224323432443254326432743284329433043314332433343344335433643374338433943404341434243434344434543464347434843494350435143524353435443554356435743584359436043614362436343644365436643674368436943704371437243734374437543764377437843794380438143824383438443854386438743884389439043914392439343944395439643974398439944004401440244034404440544064407440844094410441144124413441444154416441744184419442044214422442344244425442644274428442944304431443244334434443544364437443844394440444144424443444444454446444744484449445044514452445344544455445644574458445944604461446244634464446544664467446844694470447144724473447444754476447744784479448044814482448344844485448644874488448944904491449244934494449544964497449844994500450145024503450445054506450745084509451045114512451345144515451645174518451945204521452245234524452545264527452845294530453145324533453445354536453745384539454045414542454345444545454645474548454945504551455245534554455545564557455845594560456145624563456445654566456745684569457045714572457345744575457645774578457945804581458245834584458545864587458845894590459145924593459445954596459745984599460046014602460346044605460646074608460946104611461246134614461546164617461846194620462146224623462446254626462746284629463046314632463346344635463646374638463946404641464246434644464546464647464846494650465146524653465446554656465746584659466046614662466346644665466646674668466946704671467246734674467546764677467846794680468146824683468446854686468746884689469046914692469346944695469646974698469947004701470247034704470547064707470847094710471147124713471447154716471747184719472047214722472347244725472647274728472947304731473247334734473547364737473847394740474147424743474447454746474747484749475047514752475347544755475647574758475947604761
  1. /* client.c
  2. *
  3. * Copyright (C) 2006-2023 wolfSSL Inc.
  4. *
  5. * This file is part of wolfSSL.
  6. *
  7. * wolfSSL is free software; you can redistribute it and/or modify
  8. * it under the terms of the GNU General Public License as published by
  9. * the Free Software Foundation; either version 2 of the License, or
  10. * (at your option) any later version.
  11. *
  12. * wolfSSL is distributed in the hope that it will be useful,
  13. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15. * GNU General Public License for more details.
  16. *
  17. * You should have received a copy of the GNU General Public License
  18. * along with this program; if not, write to the Free Software
  19. * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20. */
  21. /* For simpler wolfSSL TLS client examples, visit
  22. * https://github.com/wolfSSL/wolfssl-examples/tree/master/tls
  23. */
  24. #ifdef HAVE_CONFIG_H
  25. #include <config.h>
  26. #endif
  27. #ifndef WOLFSSL_USER_SETTINGS
  28. #include <wolfssl/options.h>
  29. #endif
  30. #include <wolfssl/wolfcrypt/settings.h>
  31. #include <wolfssl/ssl.h>
  32. #ifdef WOLFSSL_WOLFSENTRY_HOOKS
  33. #include <wolfsentry/wolfsentry.h>
  34. #if !defined(NO_FILESYSTEM) && !defined(WOLFSENTRY_NO_JSON)
  35. static const char *wolfsentry_config_path = NULL;
  36. #endif
  37. #endif /* WOLFSSL_WOLFSENTRY_HOOKS */
  38. #if defined(WOLFSSL_MDK_ARM) || defined(WOLFSSL_KEIL_TCP_NET)
  39. #include <stdio.h>
  40. #include <string.h>
  41. #include "rl_fs.h"
  42. #include "rl_net.h"
  43. #endif
  44. #include <wolfssl/test.h>
  45. #include <examples/client/client.h>
  46. #include <wolfssl/error-ssl.h>
  47. #ifndef NO_WOLFSSL_CLIENT
  48. #ifdef NO_FILESYSTEM
  49. #ifdef NO_RSA
  50. #error currently the example only tries to load in a RSA buffer
  51. #endif
  52. #undef USE_CERT_BUFFERS_256
  53. #define USE_CERT_BUFFERS_256
  54. #undef USE_CERT_BUFFERS_2048
  55. #define USE_CERT_BUFFERS_2048
  56. #include <wolfssl/certs_test.h>
  57. #endif
  58. #include <wolfssl/wolfcrypt/wolfmath.h> /* for max bits */
  59. #ifdef HAVE_ECC
  60. #include <wolfssl/wolfcrypt/ecc.h>
  61. #endif
  62. #ifdef WOLFSSL_ASYNC_CRYPT
  63. static int devId = INVALID_DEVID;
  64. #endif
  65. #define DEFAULT_TIMEOUT_SEC 2
  66. #ifndef MAX_NON_BLOCK_SEC
  67. #define MAX_NON_BLOCK_SEC 10
  68. #endif
  69. #define OCSP_STAPLING 1
  70. #define OCSP_STAPLINGV2 2
  71. #define OCSP_STAPLINGV2_MULTI 3
  72. #define OCSP_STAPLING_OPT_MAX OCSP_STAPLINGV2_MULTI
  73. #ifdef WOLFSSL_ALT_TEST_STRINGS
  74. #define TEST_STR_TERM "\n"
  75. #else
  76. #define TEST_STR_TERM
  77. #endif
  78. static const char kHelloMsg[] = "hello wolfssl!" TEST_STR_TERM;
  79. #ifndef NO_SESSION_CACHE
  80. static const char kResumeMsg[] = "resuming wolfssl!" TEST_STR_TERM;
  81. #endif
  82. #if defined(WOLFSSL_TLS13) && defined(WOLFSSL_EARLY_DATA)
  83. static const char kEarlyMsg[] = "A drop of info" TEST_STR_TERM;
  84. #endif
  85. static const char kHttpGetMsg[] = "GET /index.html HTTP/1.0\r\n\r\n";
  86. /* Write needs to be largest of the above strings (29) */
  87. #define CLI_MSG_SZ 32
  88. /* Read needs to be at least sizeof server.c `webServerMsg` (226) */
  89. #define CLI_REPLY_SZ 256
  90. #if defined(XSLEEP_US) && defined(NO_MAIN_DRIVER)
  91. /* This is to force the server's thread to get a chance to
  92. * execute before continuing the resume in non-blocking
  93. * DTLS test cases. */
  94. #define TEST_DELAY() XSLEEP_US(10000)
  95. #else
  96. #define TEST_DELAY() XSLEEP_MS(1000)
  97. #endif
  98. /* Note on using port 0: the client standalone example doesn't utilize the
  99. * port 0 port sharing; that is used by (1) the server in external control
  100. * test mode and (2) the testsuite which uses this code and sets up the correct
  101. * port numbers when the internal thread using the server code using port 0. */
  102. static int lng_index = 0;
  103. #ifdef WOLFSSL_CALLBACKS
  104. WOLFSSL_TIMEVAL timeoutConnect;
  105. static int handShakeCB(HandShakeInfo* info)
  106. {
  107. (void)info;
  108. return 0;
  109. }
  110. static int timeoutCB(TimeoutInfo* info)
  111. {
  112. (void)info;
  113. return 0;
  114. }
  115. #endif
  116. static int quieter = 0; /* Print fewer messages. This is helpful with overly
  117. * ambitious log parsers. */
  118. #define LOG_ERROR(...) \
  119. do { \
  120. if (!quieter) \
  121. fprintf(stderr, __VA_ARGS__); \
  122. } while(0)
  123. #ifdef HAVE_SESSION_TICKET
  124. #ifndef SESSION_TICKET_LEN
  125. #define SESSION_TICKET_LEN 256
  126. #endif
  127. static int sessionTicketCB(WOLFSSL* ssl,
  128. const unsigned char* ticket, int ticketSz,
  129. void* ctx)
  130. {
  131. (void)ssl;
  132. (void)ticket;
  133. printf("Session Ticket CB: ticketSz = %d, ctx = %s\n",
  134. ticketSz, (char*)ctx);
  135. return 0;
  136. }
  137. #endif
  138. static int NonBlockingSSL_Connect(WOLFSSL* ssl)
  139. {
  140. int ret;
  141. int error;
  142. SOCKET_T sockfd;
  143. int select_ret = 0;
  144. int elapsedSec = 0;
  145. #ifndef WOLFSSL_CALLBACKS
  146. ret = wolfSSL_connect(ssl);
  147. #else
  148. ret = wolfSSL_connect_ex(ssl, handShakeCB, timeoutCB, timeoutConnect);
  149. #endif
  150. error = wolfSSL_get_error(ssl, 0);
  151. sockfd = (SOCKET_T)wolfSSL_get_fd(ssl);
  152. while (ret != WOLFSSL_SUCCESS &&
  153. (error == WOLFSSL_ERROR_WANT_READ || error == WOLFSSL_ERROR_WANT_WRITE
  154. #ifdef WOLFSSL_ASYNC_CRYPT
  155. || error == WC_PENDING_E
  156. #endif
  157. #ifdef WOLFSSL_NONBLOCK_OCSP
  158. || error == OCSP_WANT_READ
  159. #endif
  160. )) {
  161. int currTimeout = 1;
  162. if (error == WOLFSSL_ERROR_WANT_READ)
  163. printf("... client would read block\n");
  164. else if (error == WOLFSSL_ERROR_WANT_WRITE)
  165. printf("... client would write block\n");
  166. #ifdef WOLFSSL_ASYNC_CRYPT
  167. if (error == WC_PENDING_E) {
  168. ret = wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW);
  169. if (ret < 0) break;
  170. }
  171. else
  172. #endif
  173. {
  174. if (error == WOLFSSL_ERROR_WANT_WRITE) {
  175. select_ret = tcp_select_tx(sockfd, currTimeout);
  176. }
  177. else
  178. {
  179. #ifdef WOLFSSL_DTLS
  180. if (wolfSSL_dtls(ssl))
  181. currTimeout = wolfSSL_dtls_get_current_timeout(ssl);
  182. #endif
  183. select_ret = tcp_select(sockfd, currTimeout);
  184. }
  185. }
  186. if ((select_ret == TEST_RECV_READY) || (select_ret == TEST_SEND_READY)
  187. || (select_ret == TEST_ERROR_READY)
  188. #ifdef WOLFSSL_ASYNC_CRYPT
  189. || error == WC_PENDING_E
  190. #endif
  191. #ifdef WOLFSSL_NONBLOCK_OCSP
  192. || error == OCSP_WANT_READ
  193. #endif
  194. ) {
  195. #ifndef WOLFSSL_CALLBACKS
  196. ret = wolfSSL_connect(ssl);
  197. #else
  198. ret = wolfSSL_connect_ex(ssl, handShakeCB, timeoutCB,
  199. timeoutConnect);
  200. #endif
  201. error = wolfSSL_get_error(ssl, 0);
  202. elapsedSec = 0; /* reset elapsed */
  203. }
  204. else if (select_ret == TEST_TIMEOUT && !wolfSSL_dtls(ssl)) {
  205. error = WOLFSSL_ERROR_WANT_READ;
  206. elapsedSec += currTimeout;
  207. if (elapsedSec > MAX_NON_BLOCK_SEC) {
  208. printf("Nonblocking connect timeout\n");
  209. error = WOLFSSL_FATAL_ERROR;
  210. }
  211. }
  212. #ifdef WOLFSSL_DTLS
  213. else if (select_ret == TEST_TIMEOUT && wolfSSL_dtls(ssl)) {
  214. ret = wolfSSL_dtls_got_timeout(ssl);
  215. if (ret != WOLFSSL_SUCCESS)
  216. error = wolfSSL_get_error(ssl, ret);
  217. else
  218. error = WOLFSSL_ERROR_WANT_READ;
  219. ret = WOLFSSL_FAILURE; /* Reset error so we loop */
  220. }
  221. #endif
  222. else {
  223. error = WOLFSSL_FATAL_ERROR;
  224. }
  225. }
  226. return ret;
  227. }
  228. static void ShowCiphers(void)
  229. {
  230. static char ciphers[WOLFSSL_CIPHER_LIST_MAX_SIZE];
  231. int ret = wolfSSL_get_ciphers(ciphers, (int)sizeof(ciphers));
  232. if (ret == WOLFSSL_SUCCESS) {
  233. printf("%s\n", ciphers);
  234. }
  235. }
  236. /* Shows which versions are valid */
  237. static void ShowVersions(void)
  238. {
  239. char verStr[100];
  240. XMEMSET(verStr, 0, sizeof(verStr));
  241. #ifndef NO_OLD_TLS
  242. #ifdef WOLFSSL_ALLOW_SSLV3
  243. XSTRNCAT(verStr, "0:", 3);
  244. #endif
  245. #ifdef WOLFSSL_ALLOW_TLSV10
  246. XSTRNCAT(verStr, "1:", 3);
  247. #endif
  248. XSTRNCAT(verStr, "2:", 3);
  249. #endif /* NO_OLD_TLS */
  250. #ifndef WOLFSSL_NO_TLS12
  251. XSTRNCAT(verStr, "3:", 3);
  252. #endif
  253. #ifdef WOLFSSL_TLS13
  254. XSTRNCAT(verStr, "4:", 3);
  255. #endif
  256. XSTRNCAT(verStr, "d(downgrade):", 14);
  257. #if defined(OPENSSL_EXTRA) || defined(WOLFSSL_EITHER_SIDE)
  258. XSTRNCAT(verStr, "e(either):", 11);
  259. #endif
  260. /* print all strings at same time on stdout to avoid any flush issues */
  261. printf("%s\n", verStr);
  262. }
  263. #if defined(WOLFSSL_TLS13) && defined(HAVE_SUPPORTED_CURVES)
  264. #define MAX_GROUP_NUMBER 4
  265. static void SetKeyShare(WOLFSSL* ssl, int onlyKeyShare, int useX25519,
  266. int useX448, int usePqc, char* pqcAlg, int setGroups)
  267. {
  268. int ret;
  269. int groups[MAX_GROUP_NUMBER] = {0};
  270. int count = 0;
  271. (void)useX25519;
  272. (void)useX448;
  273. (void)usePqc;
  274. (void)pqcAlg;
  275. WOLFSSL_START(WC_FUNC_CLIENT_KEY_EXCHANGE_SEND);
  276. if (onlyKeyShare == 0 || onlyKeyShare == 2) {
  277. if (useX25519) {
  278. #ifdef HAVE_CURVE25519
  279. do {
  280. ret = wolfSSL_UseKeyShare(ssl, WOLFSSL_ECC_X25519);
  281. if (ret == WOLFSSL_SUCCESS)
  282. groups[count++] = WOLFSSL_ECC_X25519;
  283. #ifdef WOLFSSL_ASYNC_CRYPT
  284. else if (ret == WC_PENDING_E)
  285. wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW);
  286. #endif
  287. else
  288. err_sys("unable to use curve x25519");
  289. } while (ret == WC_PENDING_E);
  290. #endif
  291. }
  292. else if (useX448) {
  293. #ifdef HAVE_CURVE448
  294. do {
  295. ret = wolfSSL_UseKeyShare(ssl, WOLFSSL_ECC_X448);
  296. if (ret == WOLFSSL_SUCCESS)
  297. groups[count++] = WOLFSSL_ECC_X448;
  298. #ifdef WOLFSSL_ASYNC_CRYPT
  299. else if (ret == WC_PENDING_E)
  300. wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW);
  301. #endif
  302. else
  303. err_sys("unable to use curve x448");
  304. } while (ret == WC_PENDING_E);
  305. #endif
  306. }
  307. else {
  308. #ifdef HAVE_ECC
  309. #if !defined(NO_ECC256) || defined(HAVE_ALL_CURVES)
  310. do {
  311. ret = wolfSSL_UseKeyShare(ssl, WOLFSSL_ECC_SECP256R1);
  312. if (ret == WOLFSSL_SUCCESS)
  313. groups[count++] = WOLFSSL_ECC_SECP256R1;
  314. #ifdef WOLFSSL_ASYNC_CRYPT
  315. else if (ret == WC_PENDING_E)
  316. wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW);
  317. #endif
  318. else
  319. err_sys("unable to use curve secp256r1");
  320. } while (ret == WC_PENDING_E);
  321. #endif
  322. #ifdef WOLFSSL_SM2
  323. do {
  324. ret = wolfSSL_UseKeyShare(ssl, WOLFSSL_ECC_SM2P256V1);
  325. if (ret == WOLFSSL_SUCCESS)
  326. groups[count++] = WOLFSSL_ECC_SM2P256V1;
  327. #ifdef WOLFSSL_ASYNC_CRYPT
  328. else if (ret == WC_PENDING_E)
  329. wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW);
  330. #endif
  331. else
  332. err_sys("unable to use curve sm2p256v1");
  333. } while (ret == WC_PENDING_E);
  334. #endif
  335. #endif
  336. }
  337. }
  338. if (onlyKeyShare == 0 || onlyKeyShare == 1) {
  339. #ifdef HAVE_FFDHE_2048
  340. do {
  341. ret = wolfSSL_UseKeyShare(ssl, WOLFSSL_FFDHE_2048);
  342. if (ret == WOLFSSL_SUCCESS)
  343. groups[count++] = WOLFSSL_FFDHE_2048;
  344. #ifdef WOLFSSL_ASYNC_CRYPT
  345. else if (ret == WC_PENDING_E)
  346. wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW);
  347. #endif
  348. else
  349. err_sys("unable to use DH 2048-bit parameters");
  350. } while (ret == WC_PENDING_E);
  351. #endif
  352. }
  353. #ifdef HAVE_PQC
  354. if (onlyKeyShare == 0 || onlyKeyShare == 3) {
  355. if (usePqc) {
  356. int group = 0;
  357. if (XSTRCMP(pqcAlg, "KYBER_LEVEL1") == 0) {
  358. group = WOLFSSL_KYBER_LEVEL1;
  359. }
  360. else if (XSTRCMP(pqcAlg, "KYBER_LEVEL3") == 0) {
  361. group = WOLFSSL_KYBER_LEVEL3;
  362. }
  363. else if (XSTRCMP(pqcAlg, "KYBER_LEVEL5") == 0) {
  364. group = WOLFSSL_KYBER_LEVEL5;
  365. }
  366. else if (XSTRCMP(pqcAlg, "P256_KYBER_LEVEL1") == 0) {
  367. group = WOLFSSL_P256_KYBER_LEVEL1;
  368. }
  369. else if (XSTRCMP(pqcAlg, "P384_KYBER_LEVEL3") == 0) {
  370. group = WOLFSSL_P384_KYBER_LEVEL3;
  371. }
  372. else if (XSTRCMP(pqcAlg, "P521_KYBER_LEVEL5") == 0) {
  373. group = WOLFSSL_P521_KYBER_LEVEL5;
  374. } else {
  375. err_sys("invalid post-quantum KEM specified");
  376. }
  377. printf("Using Post-Quantum KEM: %s\n", pqcAlg);
  378. if (wolfSSL_UseKeyShare(ssl, group) == WOLFSSL_SUCCESS) {
  379. groups[count++] = group;
  380. }
  381. else {
  382. err_sys("unable to use post-quantum KEM");
  383. }
  384. }
  385. }
  386. #endif
  387. if (count >= MAX_GROUP_NUMBER)
  388. err_sys("example group array size error");
  389. if (setGroups && count > 0) {
  390. if (wolfSSL_set_groups(ssl, groups, count) != WOLFSSL_SUCCESS)
  391. err_sys("unable to set groups");
  392. }
  393. WOLFSSL_END(WC_FUNC_CLIENT_KEY_EXCHANGE_SEND);
  394. }
  395. #endif /* WOLFSSL_TLS13 && HAVE_SUPPORTED_CURVES */
  396. #ifdef WOLFSSL_EARLY_DATA
  397. static void EarlyData(WOLFSSL_CTX* ctx, WOLFSSL* ssl, const char* msg,
  398. int msgSz, char* buffer)
  399. {
  400. int err;
  401. int ret;
  402. do {
  403. err = 0; /* reset error */
  404. ret = wolfSSL_write_early_data(ssl, msg, msgSz, &msgSz);
  405. if (ret <= 0) {
  406. err = wolfSSL_get_error(ssl, 0);
  407. #ifdef WOLFSSL_ASYNC_CRYPT
  408. if (err == WC_PENDING_E) {
  409. ret = wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW);
  410. if (ret < 0) break;
  411. }
  412. #endif
  413. }
  414. } while (err == WC_PENDING_E);
  415. if (ret != msgSz) {
  416. LOG_ERROR("SSL_write_early_data msg error %d, %s\n", err,
  417. wolfSSL_ERR_error_string((unsigned long)err, buffer));
  418. wolfSSL_free(ssl); ssl = NULL;
  419. wolfSSL_CTX_free(ctx); ctx = NULL;
  420. err_sys("SSL_write_early_data failed");
  421. }
  422. }
  423. #endif
  424. /* Measures average time to create, connect and disconnect a connection (TPS).
  425. Benchmark = number of connections. */
  426. static const char* client_bench_conmsg[][5] = {
  427. /* English */
  428. {
  429. "wolfSSL_resume avg took:", "milliseconds\n",
  430. "wolfSSL_connect avg took:", "milliseconds\n",
  431. NULL
  432. },
  433. #ifndef NO_MULTIBYTE_PRINT
  434. /* Japanese */
  435. {
  436. "wolfSSL_resume 平均時間:", "ミリ秒\n",
  437. "wolfSSL_connect 平均時間:", "ミリ秒\n",
  438. }
  439. #endif
  440. };
  441. static int ClientBenchmarkConnections(WOLFSSL_CTX* ctx, char* host, word16 port,
  442. int dtlsUDP, int dtlsSCTP, int benchmark, int resumeSession, int useX25519,
  443. int useX448, int usePqc, char* pqcAlg, int helloRetry, int onlyKeyShare,
  444. int version, int earlyData)
  445. {
  446. /* time passed in number of connects give average */
  447. int times = benchmark, skip = (int)((double)times * 0.1);
  448. int loops = resumeSession ? 2 : 1;
  449. int i = 0, err, ret;
  450. #ifndef NO_SESSION_CACHE
  451. WOLFSSL_SESSION* benchSession = NULL;
  452. #endif
  453. #ifdef WOLFSSL_TLS13
  454. byte reply[CLI_REPLY_SZ];
  455. #endif
  456. const char** words = client_bench_conmsg[lng_index];
  457. (void)resumeSession;
  458. (void)useX25519;
  459. (void)useX448;
  460. (void)usePqc;
  461. (void)pqcAlg;
  462. (void)helloRetry;
  463. (void)onlyKeyShare;
  464. (void)version;
  465. (void)earlyData;
  466. while (loops--) {
  467. #ifndef NO_SESSION_CACHE
  468. int benchResume = resumeSession && loops == 0;
  469. #endif
  470. double start = current_time(1), avg;
  471. for (i = 0; i < times; i++) {
  472. SOCKET_T sockfd;
  473. WOLFSSL* ssl;
  474. if (i == skip)
  475. start = current_time(1);
  476. ssl = wolfSSL_new(ctx);
  477. if (ssl == NULL)
  478. err_sys("unable to get SSL object");
  479. #ifndef NO_SESSION_CACHE
  480. if (benchResume)
  481. wolfSSL_set_session(ssl, benchSession);
  482. #endif
  483. #if defined(WOLFSSL_TLS13) && defined(HAVE_SUPPORTED_CURVES)
  484. else if (version >= 4) {
  485. if (!helloRetry)
  486. SetKeyShare(ssl, onlyKeyShare, useX25519, useX448,
  487. usePqc, pqcAlg, 1);
  488. else
  489. wolfSSL_NoKeyShares(ssl);
  490. }
  491. #endif
  492. tcp_connect(&sockfd, host, port, dtlsUDP, dtlsSCTP, ssl);
  493. if (wolfSSL_set_fd(ssl, sockfd) != WOLFSSL_SUCCESS) {
  494. err_sys("error in setting fd");
  495. }
  496. #if defined(WOLFSSL_TLS13) && !defined(NO_SESSION_CACHE) && \
  497. defined(WOLFSSL_EARLY_DATA)
  498. if (version >= 4 && benchResume && earlyData) {
  499. char buffer[WOLFSSL_MAX_ERROR_SZ];
  500. EarlyData(ctx, ssl, kEarlyMsg, sizeof(kEarlyMsg)-1, buffer);
  501. }
  502. #endif
  503. do {
  504. err = 0; /* reset error */
  505. ret = wolfSSL_connect(ssl);
  506. if (ret != WOLFSSL_SUCCESS) {
  507. err = wolfSSL_get_error(ssl, 0);
  508. #ifdef WOLFSSL_ASYNC_CRYPT
  509. if (err == WC_PENDING_E) {
  510. /* returns the number of polled items or <0 for error */
  511. ret = wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW);
  512. if (ret < 0) break;
  513. }
  514. #endif
  515. }
  516. } while (err == WC_PENDING_E);
  517. #ifdef WOLFSSL_EARLY_DATA
  518. EarlyDataStatus(ssl);
  519. #endif
  520. if (ret != WOLFSSL_SUCCESS) {
  521. err_sys("SSL_connect failed");
  522. }
  523. #ifdef WOLFSSL_TLS13
  524. #ifndef NO_SESSION_CACHE
  525. if (version >= 4 && resumeSession && !benchResume)
  526. #else
  527. if (version >= 4 && resumeSession)
  528. #endif
  529. {
  530. /* no null term */
  531. if (wolfSSL_write(ssl, kHttpGetMsg, sizeof(kHttpGetMsg)-1) <= 0)
  532. err_sys("SSL_write failed");
  533. if (wolfSSL_read(ssl, reply, sizeof(reply)-1) <= 0)
  534. err_sys("SSL_read failed");
  535. }
  536. #endif
  537. wolfSSL_shutdown(ssl);
  538. #ifndef NO_SESSION_CACHE
  539. if (i == (times-1) && resumeSession) {
  540. if (benchSession != NULL)
  541. wolfSSL_SESSION_free(benchSession);
  542. benchSession = wolfSSL_get1_session(ssl);
  543. }
  544. #endif
  545. wolfSSL_free(ssl); ssl = NULL;
  546. CloseSocket(sockfd);
  547. }
  548. avg = current_time(0) - start;
  549. avg /= (times - skip);
  550. avg *= 1000; /* milliseconds */
  551. #ifndef NO_SESSION_CACHE
  552. if (benchResume)
  553. printf("%s %8.3f %s\n", words[0],avg, words[1]);
  554. else
  555. #endif
  556. printf("%s %8.3f %s\n", words[2],avg, words[3]);
  557. WOLFSSL_TIME(times);
  558. }
  559. #ifndef NO_SESSION_CACHE
  560. if (benchSession != NULL)
  561. wolfSSL_SESSION_free(benchSession);
  562. #endif
  563. return EXIT_SUCCESS;
  564. }
  565. /* Measures throughput in mbps. Throughput = number of bytes */
  566. static int ClientBenchmarkThroughput(WOLFSSL_CTX* ctx, char* host, word16 port,
  567. int dtlsUDP, int dtlsSCTP, int block, size_t throughput, int useX25519,
  568. int useX448, int usePqc, char* pqcAlg, int exitWithRet, int version,
  569. int onlyKeyShare)
  570. {
  571. double start, conn_time = 0, tx_time = 0, rx_time = 0;
  572. SOCKET_T sockfd = WOLFSSL_SOCKET_INVALID;
  573. WOLFSSL* ssl;
  574. int ret = 0, err = 0;
  575. start = current_time(1);
  576. ssl = wolfSSL_new(ctx);
  577. if (ssl == NULL)
  578. err_sys("unable to get SSL object");
  579. tcp_connect(&sockfd, host, port, dtlsUDP, dtlsSCTP, ssl);
  580. if (wolfSSL_set_fd(ssl, sockfd) != WOLFSSL_SUCCESS) {
  581. err_sys("error in setting fd");
  582. }
  583. (void)useX25519;
  584. (void)useX448;
  585. (void)usePqc;
  586. (void)pqcAlg;
  587. (void)version;
  588. (void)onlyKeyShare;
  589. #if defined(WOLFSSL_TLS13) && defined(HAVE_SUPPORTED_CURVES)
  590. if (version >= 4) {
  591. SetKeyShare(ssl, onlyKeyShare, useX25519, useX448, usePqc,
  592. pqcAlg, 1);
  593. }
  594. #endif
  595. do {
  596. err = 0; /* reset error */
  597. ret = wolfSSL_connect(ssl);
  598. if (ret != WOLFSSL_SUCCESS) {
  599. err = wolfSSL_get_error(ssl, 0);
  600. #ifdef WOLFSSL_ASYNC_CRYPT
  601. if (err == WC_PENDING_E) {
  602. ret = wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW);
  603. if (ret < 0) break;
  604. }
  605. #endif
  606. }
  607. } while (err == WC_PENDING_E);
  608. if (ret == WOLFSSL_SUCCESS) {
  609. /* Perform throughput test */
  610. char *tx_buffer, *rx_buffer;
  611. /* Record connection time */
  612. conn_time = current_time(0) - start;
  613. /* Allocate TX/RX buffers */
  614. tx_buffer = (char*)XMALLOC((size_t)block, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  615. rx_buffer = (char*)XMALLOC((size_t)block, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  616. if (tx_buffer && rx_buffer) {
  617. WC_RNG rng;
  618. /* Startup the RNG */
  619. #if !defined(HAVE_FIPS) && defined(WOLFSSL_ASYNC_CRYPT)
  620. ret = wc_InitRng_ex(&rng, NULL, devId);
  621. #else
  622. ret = wc_InitRng(&rng);
  623. #endif
  624. if (ret == 0) {
  625. size_t xfer_bytes;
  626. /* Generate random data to send */
  627. ret = wc_RNG_GenerateBlock(&rng, (byte*)tx_buffer, (word32)block);
  628. wc_FreeRng(&rng);
  629. if(ret != 0) {
  630. err_sys("wc_RNG_GenerateBlock failed");
  631. }
  632. /* Perform TX and RX of bytes */
  633. xfer_bytes = 0;
  634. while (throughput > xfer_bytes) {
  635. int len, rx_pos, select_ret;
  636. /* Determine packet size */
  637. len = (int)min((word32)block, (word32)(throughput - xfer_bytes));
  638. /* Perform TX */
  639. start = current_time(1);
  640. do {
  641. err = 0; /* reset error */
  642. ret = wolfSSL_write(ssl, tx_buffer, len);
  643. if (ret <= 0) {
  644. err = wolfSSL_get_error(ssl, 0);
  645. #ifdef WOLFSSL_ASYNC_CRYPT
  646. if (err == WC_PENDING_E) {
  647. ret = wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW);
  648. if (ret < 0) break;
  649. }
  650. #endif
  651. }
  652. } while (err == WC_PENDING_E);
  653. if (ret != len) {
  654. LOG_ERROR("SSL_write bench error %d!\n", err);
  655. if (!exitWithRet)
  656. err_sys("SSL_write failed");
  657. goto doExit;
  658. }
  659. tx_time += current_time(0) - start;
  660. /* Perform RX */
  661. select_ret = tcp_select(sockfd, DEFAULT_TIMEOUT_SEC);
  662. if (select_ret == TEST_RECV_READY) {
  663. start = current_time(1);
  664. rx_pos = 0;
  665. while (rx_pos < len) {
  666. ret = wolfSSL_read(ssl, &rx_buffer[rx_pos],
  667. len - rx_pos);
  668. if (ret <= 0) {
  669. err = wolfSSL_get_error(ssl, 0);
  670. #ifdef WOLFSSL_ASYNC_CRYPT
  671. if (err == WC_PENDING_E) {
  672. ret = wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW);
  673. if (ret < 0) break;
  674. }
  675. else
  676. #endif
  677. if (err != WOLFSSL_ERROR_WANT_READ &&
  678. err != WOLFSSL_ERROR_WANT_WRITE) {
  679. LOG_ERROR("SSL_read bench error %d\n", err);
  680. err_sys("SSL_read failed");
  681. }
  682. }
  683. else {
  684. rx_pos += ret;
  685. }
  686. }
  687. rx_time += current_time(0) - start;
  688. }
  689. /* Compare TX and RX buffers */
  690. if (XMEMCMP(tx_buffer, rx_buffer, (size_t)len) != 0) {
  691. free(tx_buffer);
  692. tx_buffer = NULL;
  693. free(rx_buffer);
  694. rx_buffer = NULL;
  695. err_sys("Compare TX and RX buffers failed");
  696. }
  697. /* Update overall position */
  698. xfer_bytes += (size_t)len;
  699. }
  700. }
  701. else {
  702. err_sys("wc_InitRng failed");
  703. }
  704. (void)rng; /* for WC_NO_RNG case */
  705. }
  706. else {
  707. err_sys("Client buffer malloc failed");
  708. }
  709. doExit:
  710. XFREE(tx_buffer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  711. XFREE(rx_buffer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  712. }
  713. else {
  714. err_sys("wolfSSL_connect failed");
  715. }
  716. wolfSSL_shutdown(ssl);
  717. wolfSSL_free(ssl); ssl = NULL;
  718. CloseSocket(sockfd);
  719. if (exitWithRet)
  720. return err;
  721. #if defined(__MINGW32__) || defined(_WIN32)
  722. #define SIZE_FMT "%d"
  723. #define SIZE_TYPE int
  724. #else
  725. #define SIZE_FMT "%zu"
  726. #define SIZE_TYPE size_t
  727. #endif
  728. printf(
  729. "wolfSSL Client Benchmark " SIZE_FMT " bytes\n"
  730. "\tConnect %8.3f ms\n"
  731. "\tTX %8.3f ms (%8.3f MBps)\n"
  732. "\tRX %8.3f ms (%8.3f MBps)\n",
  733. (SIZE_TYPE)throughput,
  734. conn_time * 1000,
  735. (double)tx_time * 1000, (double)throughput / tx_time / 1024 / 1024,
  736. (double)rx_time * 1000, (double)throughput / rx_time / 1024 / 1024
  737. );
  738. return EXIT_SUCCESS;
  739. }
  740. const char* starttlsCmd[6] = {
  741. "220",
  742. "EHLO mail.example.com\r\n",
  743. "250",
  744. "STARTTLS\r\n",
  745. "220",
  746. "QUIT\r\n",
  747. };
  748. /* Initiates the STARTTLS command sequence over TCP */
  749. static int StartTLS_Init(SOCKET_T* sockfd)
  750. {
  751. char tmpBuf[512];
  752. if (sockfd == NULL)
  753. return BAD_FUNC_ARG;
  754. /* S: 220 <host> SMTP service ready */
  755. XMEMSET(tmpBuf, 0, sizeof(tmpBuf));
  756. if (recv(*sockfd, tmpBuf, sizeof(tmpBuf)-1, 0) < 0)
  757. err_sys("failed to read STARTTLS command\n");
  758. if ((!XSTRNCMP(tmpBuf, starttlsCmd[0], XSTRLEN(starttlsCmd[0]))) &&
  759. (tmpBuf[XSTRLEN(starttlsCmd[0])] == ' ')) {
  760. printf("%s\n", tmpBuf);
  761. } else {
  762. err_sys("incorrect STARTTLS command received");
  763. }
  764. /* C: EHLO mail.example.com */
  765. if (send(*sockfd, starttlsCmd[1], (SIZE_TYPE)XSTRLEN(starttlsCmd[1]), 0) !=
  766. (int)XSTRLEN(starttlsCmd[1]))
  767. err_sys("failed to send STARTTLS EHLO command\n");
  768. /* S: 250 <host> offers a warm hug of welcome */
  769. XMEMSET(tmpBuf, 0, sizeof(tmpBuf));
  770. if (recv(*sockfd, tmpBuf, sizeof(tmpBuf)-1, 0) < 0)
  771. err_sys("failed to read STARTTLS command\n");
  772. if ((!XSTRNCMP(tmpBuf, starttlsCmd[2], XSTRLEN(starttlsCmd[2]))) &&
  773. (tmpBuf[XSTRLEN(starttlsCmd[2])] == '-')) {
  774. printf("%s\n", tmpBuf);
  775. } else {
  776. err_sys("incorrect STARTTLS command received");
  777. }
  778. /* C: STARTTLS */
  779. if (send(*sockfd, starttlsCmd[3], (SIZE_TYPE)XSTRLEN(starttlsCmd[3]), 0) !=
  780. (int)XSTRLEN(starttlsCmd[3])) {
  781. err_sys("failed to send STARTTLS command\n");
  782. }
  783. /* S: 220 Go ahead */
  784. XMEMSET(tmpBuf, 0, sizeof(tmpBuf));
  785. if (recv(*sockfd, tmpBuf, sizeof(tmpBuf)-1, 0) < 0)
  786. err_sys("failed to read STARTTLS command\n");
  787. tmpBuf[sizeof(tmpBuf)-1] = '\0';
  788. if ((!XSTRNCMP(tmpBuf, starttlsCmd[4], XSTRLEN(starttlsCmd[4]))) &&
  789. (tmpBuf[XSTRLEN(starttlsCmd[4])] == ' ')) {
  790. printf("%s\n", tmpBuf);
  791. } else {
  792. err_sys("incorrect STARTTLS command received, expected 220");
  793. }
  794. return WOLFSSL_SUCCESS;
  795. }
  796. /* Closes down the SMTP connection */
  797. static int SMTP_Shutdown(WOLFSSL* ssl, int wc_shutdown)
  798. {
  799. int ret, err = 0;
  800. char tmpBuf[256];
  801. if (ssl == NULL)
  802. return BAD_FUNC_ARG;
  803. printf("\nwolfSSL client shutting down SMTP connection\n");
  804. XMEMSET(tmpBuf, 0, sizeof(tmpBuf));
  805. /* C: QUIT */
  806. do {
  807. ret = wolfSSL_write(ssl, starttlsCmd[5], (int)XSTRLEN(starttlsCmd[5]));
  808. if (ret < 0) {
  809. err = wolfSSL_get_error(ssl, 0);
  810. #ifdef WOLFSSL_ASYNC_CRYPT
  811. if (err == WC_PENDING_E) {
  812. ret = wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW);
  813. if (ret < 0) break;
  814. }
  815. #endif
  816. }
  817. } while (err == WC_PENDING_E);
  818. if (ret != (int)XSTRLEN(starttlsCmd[5])) {
  819. err_sys("failed to send SMTP QUIT command\n");
  820. }
  821. /* S: 221 2.0.0 Service closing transmission channel */
  822. do {
  823. ret = wolfSSL_read(ssl, tmpBuf, sizeof(tmpBuf)-1);
  824. if (ret < 0) {
  825. err = wolfSSL_get_error(ssl, 0);
  826. #ifdef WOLFSSL_ASYNC_CRYPT
  827. if (err == WC_PENDING_E) {
  828. ret = wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW);
  829. if (ret < 0) break;
  830. }
  831. #endif
  832. }
  833. } while (err == WC_PENDING_E);
  834. if (ret < 0) {
  835. err_sys("failed to read SMTP closing down response\n");
  836. }
  837. tmpBuf[ret] = 0; /* null terminate message */
  838. printf("%s\n", tmpBuf);
  839. ret = wolfSSL_shutdown(ssl);
  840. if (wc_shutdown && ret == WOLFSSL_SHUTDOWN_NOT_DONE) {
  841. if (tcp_select(wolfSSL_get_fd(ssl), DEFAULT_TIMEOUT_SEC) ==
  842. TEST_RECV_READY) {
  843. ret = wolfSSL_shutdown(ssl); /* bidirectional shutdown */
  844. if (ret == WOLFSSL_SUCCESS)
  845. printf("Bidirectional shutdown complete\n");
  846. }
  847. if (ret != WOLFSSL_SUCCESS)
  848. LOG_ERROR("Bidirectional shutdown failed\n");
  849. }
  850. return WOLFSSL_SUCCESS;
  851. }
  852. static int ClientWrite(WOLFSSL* ssl, const char* msg, int msgSz, const char* str,
  853. int exitWithRet)
  854. {
  855. int ret, err;
  856. do {
  857. err = 0; /* reset error */
  858. ret = wolfSSL_write(ssl, msg, msgSz);
  859. if (ret <= 0) {
  860. err = wolfSSL_get_error(ssl, 0);
  861. #ifdef WOLFSSL_ASYNC_CRYPT
  862. if (err == WC_PENDING_E) {
  863. ret = wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW);
  864. if (ret < 0) break;
  865. }
  866. #endif
  867. }
  868. } while (err == WOLFSSL_ERROR_WANT_WRITE ||
  869. err == WOLFSSL_ERROR_WANT_READ
  870. #ifdef WOLFSSL_ASYNC_CRYPT
  871. || err == WC_PENDING_E
  872. #endif
  873. );
  874. if (ret != msgSz) {
  875. char buffer[WOLFSSL_MAX_ERROR_SZ];
  876. LOG_ERROR("SSL_write%s msg error %d, %s\n", str, err,
  877. wolfSSL_ERR_error_string((unsigned long)err, buffer));
  878. if (!exitWithRet) {
  879. err_sys("SSL_write failed");
  880. }
  881. }
  882. return err;
  883. }
  884. static int ClientRead(WOLFSSL* ssl, char* reply, int replyLen, int mustRead,
  885. const char* str, int exitWithRet)
  886. {
  887. int ret, err;
  888. char buffer[WOLFSSL_MAX_ERROR_SZ];
  889. double start = current_time(1), elapsed;
  890. do {
  891. err = 0; /* reset error */
  892. ret = wolfSSL_read(ssl, reply, replyLen);
  893. if (ret <= 0) {
  894. err = wolfSSL_get_error(ssl, 0);
  895. #ifdef WOLFSSL_ASYNC_CRYPT
  896. if (err == WC_PENDING_E) {
  897. ret = wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW);
  898. if (ret < 0) break;
  899. }
  900. else
  901. #endif
  902. if (err != WOLFSSL_ERROR_WANT_READ &&
  903. err != WOLFSSL_ERROR_WANT_WRITE && err != APP_DATA_READY) {
  904. LOG_ERROR("SSL_read reply error %d, %s\n", err,
  905. wolfSSL_ERR_error_string((unsigned long)err, buffer));
  906. if (!exitWithRet) {
  907. err_sys("SSL_read failed");
  908. }
  909. else {
  910. break;
  911. }
  912. }
  913. }
  914. if (mustRead &&
  915. (err == WOLFSSL_ERROR_WANT_READ
  916. || err == WOLFSSL_ERROR_WANT_WRITE)) {
  917. elapsed = current_time(0) - start;
  918. if (elapsed > MAX_NON_BLOCK_SEC) {
  919. LOG_ERROR("Nonblocking read timeout\n");
  920. ret = WOLFSSL_FATAL_ERROR;
  921. break;
  922. }
  923. }
  924. } while ((mustRead && err == WOLFSSL_ERROR_WANT_READ)
  925. || err == WOLFSSL_ERROR_WANT_WRITE
  926. #ifdef WOLFSSL_ASYNC_CRYPT
  927. || err == WC_PENDING_E
  928. #endif
  929. || err == APP_DATA_READY
  930. );
  931. if (ret > 0) {
  932. reply[ret] = 0; /* null terminate */
  933. printf("%s%s\n", str, reply);
  934. }
  935. return err;
  936. }
  937. static int ClientWriteRead(WOLFSSL* ssl, const char* msg, int msgSz,
  938. char* reply, int replyLen, int mustRead,
  939. const char* str, int exitWithRet)
  940. {
  941. int ret = 0;
  942. do {
  943. ret = ClientWrite(ssl, msg, msgSz, str, exitWithRet);
  944. if (ret != 0) {
  945. if (!exitWithRet)
  946. err_sys("ClientWrite failed");
  947. else
  948. break;
  949. }
  950. if (wolfSSL_dtls(ssl)) {
  951. ret = tcp_select(wolfSSL_get_fd(ssl), DEFAULT_TIMEOUT_SEC);
  952. if (ret == TEST_TIMEOUT) {
  953. continue;
  954. }
  955. else if (ret == TEST_RECV_READY) {
  956. /* Ready to read */
  957. }
  958. else {
  959. LOG_ERROR("%s tcp_select error\n", str);
  960. if (!exitWithRet)
  961. err_sys("tcp_select failed");
  962. else
  963. ret = WOLFSSL_FATAL_ERROR;
  964. break;
  965. }
  966. }
  967. ret = ClientRead(ssl, reply, replyLen, mustRead, str, exitWithRet);
  968. if (mustRead && ret != 0) {
  969. if (!exitWithRet)
  970. err_sys("ClientRead failed");
  971. else
  972. break;
  973. }
  974. break;
  975. } while (1);
  976. if (ret != 0) {
  977. char buffer[WOLFSSL_MAX_ERROR_SZ];
  978. LOG_ERROR("SSL_write%s msg error %d, %s\n", str, ret,
  979. wolfSSL_ERR_error_string((unsigned long)ret, buffer));
  980. }
  981. return ret;
  982. }
  983. /* when adding new option, please follow the steps below: */
  984. /* 1. add new option message in English section */
  985. /* 2. increase the number of the second column */
  986. /* 3. increase the array dimension */
  987. /* 4. add the same message into Japanese section */
  988. /* (will be translated later) */
  989. /* 5. add printf() into suitable position of Usage() */
  990. static const char* client_usage_msg[][78] = {
  991. /* English */
  992. {
  993. " NOTE: All files relative to wolfSSL home dir\n", /* 0 */
  994. "Max RSA key size in bits for build is set at : ", /* 1 */
  995. #ifdef NO_RSA
  996. "RSA not supported\n", /* 2 */
  997. #elif defined(WOLFSSL_SP_MATH) /* case of SP math only */
  998. #ifdef WOLFSSL_SP_4096
  999. "4096\n", /* 2 */
  1000. #elif !defined(WOLFSSL_SP_NO_3072)
  1001. "3072\n", /* 2 */
  1002. #elif !defined(WOLFSSL_SP_NO_2048)
  1003. "2048\n", /* 2 */
  1004. #else
  1005. "0\n", /* 2 */
  1006. #endif
  1007. #elif defined(USE_FAST_MATH)
  1008. #else
  1009. "INFINITE\n", /* 2 */
  1010. #endif
  1011. "-? <num> Help, print this usage\n"
  1012. " 0: English, 1: Japanese\n"
  1013. "--help Help, in English\n", /* 3 */
  1014. "-h <host> Host to connect to, default", /* 4 */
  1015. "-p <num> Port to connect on, not 0, default", /* 5 */
  1016. #ifndef WOLFSSL_TLS13
  1017. "-v <num> SSL version [0-3], SSLv3(0) - TLS1.2(3)), default", /* 6 */
  1018. "-V Prints valid ssl version numbers"
  1019. ", SSLv3(0) - TLS1.2(3)\n", /* 7 */
  1020. #else
  1021. "-v <num> SSL version [0-4], SSLv3(0) - TLS1.3(4)), default", /* 6 */
  1022. "-V Prints valid ssl version numbers,"
  1023. " SSLv3(0) - TLS1.3(4)\n", /* 7 */
  1024. #endif
  1025. "-l <str> Cipher suite list (: delimited)\n", /* 8 */
  1026. #ifndef NO_CERTS
  1027. "-c <file> Certificate file, default", /* 9 */
  1028. "-k <file> Key file, default", /* 10 */
  1029. "-A <file> Certificate Authority file, default", /* 11 */
  1030. #endif
  1031. #ifndef NO_DH
  1032. "-Z <num> Minimum DH key bits, default", /* 12 */
  1033. #endif
  1034. "-b <num> Benchmark <num> connections and print stats\n", /* 13 */
  1035. #ifdef HAVE_ALPN
  1036. "-L <str> Application-Layer Protocol"
  1037. " Negotiation ({C,F}:<list>)\n", /* 14 */
  1038. #endif
  1039. "-B <num> Benchmark throughput"
  1040. " using <num> bytes and print stats\n", /* 15 */
  1041. #ifndef NO_PSK
  1042. "-s Use pre Shared keys\n", /* 16 */
  1043. #endif
  1044. "-d Disable peer checks\n", /* 17 */
  1045. "-D Override Date Errors example\n", /* 18 */
  1046. "-e List Every cipher suite available, \n", /* 19 */
  1047. "-g Send server HTTP GET\n", /* 20 */
  1048. #ifndef WOLFSSL_DTLS13
  1049. "-u Use UDP DTLS, add -v 2 for DTLSv1, -v 3 for DTLSv1.2"
  1050. " (default)\n", /* 21 */
  1051. #else
  1052. "-u Use UDP DTLS, add -v 2 for DTLSv1, -v 3 for DTLSv1.2"
  1053. " (default), -v 4 for DTLSv1.3\n", /* 21 */
  1054. #endif /* !WOLFSSL_DTLS13 */
  1055. #ifdef WOLFSSL_SCTP
  1056. "-G Use SCTP DTLS,"
  1057. " add -v 2 for DTLSv1, -v 3 for DTLSv1.2 (default)\n", /* 22 */
  1058. #endif
  1059. #ifndef NO_CERTS
  1060. "-m Match domain name in cert\n", /* 23 */
  1061. #endif
  1062. "-N Use Non-blocking sockets\n", /* 24 */
  1063. #ifndef NO_SESSION_CACHE
  1064. "-r Resume session\n", /* 25 */
  1065. #endif
  1066. "-w Wait for bidirectional shutdown\n", /* 26 */
  1067. "-M <prot> Use STARTTLS, using <prot> protocol (smtp)\n", /* 27 */
  1068. #ifdef HAVE_SECURE_RENEGOTIATION
  1069. "-R Allow Secure Renegotiation\n", /* 28 */
  1070. "-i <str> Force client Initiated Secure Renegotiation. If the\n"
  1071. " string 'scr-app-data' is passed in as the value and\n"
  1072. " Non-blocking sockets are enabled ('-N') then wolfSSL\n"
  1073. " sends a test message during the secure renegotiation.\n"
  1074. " The string parameter is optional.\n", /* 29 */
  1075. #endif
  1076. "-f Fewer packets/group messages\n", /* 30 */
  1077. #ifndef NO_CERTS
  1078. "-x Disable client cert/key loading\n", /* 31 */
  1079. #endif
  1080. "-X Driven by eXternal test case\n", /* 32 */
  1081. "-j Use verify callback override\n", /* 33 */
  1082. #ifdef SHOW_SIZES
  1083. "-z Print structure sizes\n", /* 34 */
  1084. #endif
  1085. #ifdef HAVE_SNI
  1086. "-S <str> Use Host Name Indication\n", /* 35 */
  1087. #endif
  1088. #ifdef HAVE_MAX_FRAGMENT
  1089. "-F <num> Use Maximum Fragment Length [1-6]\n", /* 36 */
  1090. #endif
  1091. #ifdef HAVE_TRUNCATED_HMAC
  1092. "-T Use Truncated HMAC\n", /* 37 */
  1093. #endif
  1094. #ifdef HAVE_EXTENDED_MASTER
  1095. "-n Disable Extended Master Secret\n", /* 38 */
  1096. #endif
  1097. #ifdef HAVE_OCSP
  1098. "-o Perform OCSP lookup on peer certificate\n", /* 39 */
  1099. "-O <url> Perform OCSP lookup using <url> as responder\n", /* 40 */
  1100. #endif
  1101. #if defined(HAVE_CERTIFICATE_STATUS_REQUEST) \
  1102. || defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
  1103. "-W <num> Use OCSP Stapling (1 v1, 2 v2, 3 v2 multi)\n", /* 41 */
  1104. " With 'm' at end indicates MUST staple\n", /* 42 */
  1105. #endif
  1106. #if defined(ATOMIC_USER) && !defined(WOLFSSL_AEAD_ONLY)
  1107. "-U Atomic User Record Layer Callbacks\n", /* 43 */
  1108. #endif
  1109. #ifdef HAVE_PK_CALLBACKS
  1110. "-P Public Key Callbacks\n", /* 44 */
  1111. #endif
  1112. #ifdef HAVE_ANON
  1113. "-a Anonymous client\n", /* 45 */
  1114. #endif
  1115. #ifdef HAVE_CRL
  1116. "-C Disable CRL\n", /* 46 */
  1117. #endif
  1118. #ifdef WOLFSSL_TRUST_PEER_CERT
  1119. "-E <file> Path to load trusted peer cert\n", /* 47 */
  1120. #endif
  1121. #ifdef HAVE_WNR
  1122. "-q <file> Whitewood config file, defaults\n", /* 48 */
  1123. #endif
  1124. "-H <arg> Internal tests"
  1125. " [defCipherList, exitWithRet, verifyFail, useSupCurve,\n", /* 49 */
  1126. " loadSSL, disallowETM]\n", /* 50 */
  1127. #ifdef WOLFSSL_TLS13
  1128. "-J Use HelloRetryRequest to choose group for KE\n", /* 51 */
  1129. "-K Key Exchange for PSK not using (EC)DHE\n", /* 52 */
  1130. "-I Update keys and IVs before sending data\n", /* 53 */
  1131. #ifndef NO_DH
  1132. "-y Key Share with FFDHE named groups only\n", /* 54 */
  1133. #endif
  1134. #ifdef HAVE_ECC
  1135. "-Y Key Share with ECC named groups only\n", /* 55 */
  1136. #endif
  1137. #endif /* WOLFSSL_TLS13 */
  1138. #ifdef HAVE_CURVE25519
  1139. "-t Use X25519 for key exchange\n", /* 56 */
  1140. #endif
  1141. #if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH)
  1142. "-Q Support requesting certificate post-handshake\n", /* 57 */
  1143. #endif
  1144. #ifdef WOLFSSL_EARLY_DATA
  1145. "-0 Early data sent to server (0-RTT handshake)\n", /* 58 */
  1146. #endif
  1147. #ifdef WOLFSSL_MULTICAST
  1148. "-3 <grpid> Multicast, grpid < 256\n", /* 59 */
  1149. #endif
  1150. "-1 <num> Display a result by specified language.\n"
  1151. " 0: English, 1: Japanese\n", /* 60 */
  1152. #if !defined(NO_DH) && !defined(HAVE_FIPS) && \
  1153. !defined(HAVE_SELFTEST) && !defined(WOLFSSL_OLD_PRIME_CHECK)
  1154. "-2 Disable DH Prime check\n", /* 61 */
  1155. #endif
  1156. #ifdef HAVE_SECURE_RENEGOTIATION
  1157. "-4 Use resumption for renegotiation\n", /* 62 */
  1158. #endif
  1159. #ifdef HAVE_TRUSTED_CA
  1160. "-5 Use Trusted CA Key Indication\n", /* 63 */
  1161. #endif
  1162. "-6 Simulate WANT_WRITE errors on every other IO send\n",
  1163. #ifdef HAVE_CURVE448
  1164. "-8 Use X448 for key exchange\n", /* 66 */
  1165. #endif
  1166. #if defined(OPENSSL_ALL) && defined(WOLFSSL_CERT_GEN) && \
  1167. (defined(WOLFSSL_CERT_REQ) || defined(WOLFSSL_CERT_EXT)) && \
  1168. !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR)
  1169. "-9 Use hash dir look up for certificate loading\n"
  1170. " loading from <wolfSSL home>/certs folder\n"
  1171. " files in the folder would have the form \"hash.N\" file name\n"
  1172. " e.g symbolic link to the file at certs folder\n"
  1173. " ln -s ca-cert.pem `openssl x509 -in ca-cert.pem -hash -noout`.0\n",
  1174. /* 67 */
  1175. #endif
  1176. #if defined(WOLFSSL_WOLFSENTRY_HOOKS) && !defined(NO_FILESYSTEM) && \
  1177. !defined(WOLFSENTRY_NO_JSON)
  1178. "--wolfsentry-config <file> Path for JSON wolfSentry config\n",
  1179. /* 68 */
  1180. #endif
  1181. #ifndef WOLFSSL_TLS13
  1182. "-7 Set minimum downgrade protocol version [0-3] "
  1183. " SSLv3(0) - TLS1.2(3)\n",
  1184. #else
  1185. "-7 Set minimum downgrade protocol version [0-4] "
  1186. " SSLv3(0) - TLS1.3(4)\n", /* 69 */
  1187. #endif
  1188. #ifdef HAVE_PQC
  1189. "--pqc <alg> Key Share with specified post-quantum algorithm only [KYBER_LEVEL1, KYBER_LEVEL3,\n"
  1190. " KYBER_LEVEL5, P256_KYBER_LEVEL1, P384_KYBER_LEVEL3, P521_KYBER_LEVEL5]\n", /* 70 */
  1191. #endif
  1192. #ifdef WOLFSSL_SRTP
  1193. "--srtp <profile> (default is SRTP_AES128_CM_SHA1_80)\n", /* 71 */
  1194. #endif
  1195. #ifdef WOLFSSL_SYS_CA_CERTS
  1196. "--sys-ca-certs Load system CA certs for server cert verification\n", /* 72 */
  1197. #endif
  1198. #ifdef HAVE_SUPPORTED_CURVES
  1199. "--onlyPskDheKe Must use DHE key exchange with PSK\n", /* 73 */
  1200. #endif
  1201. #ifndef NO_PSK
  1202. "--openssl-psk Use TLS 1.3 PSK callback compatible with OpenSSL\n", /* 74 */
  1203. #endif
  1204. #ifdef HAVE_RPK
  1205. "--rpk Use RPK for the defined certificates\n", /* 75 */
  1206. #endif
  1207. "--files-are-der Specified files are in DER, not PEM format\n", /* 76 */
  1208. "\n"
  1209. "For simpler wolfSSL TLS client examples, visit\n"
  1210. "https://github.com/wolfSSL/wolfssl-examples/tree/master/tls\n", /* 77 */
  1211. NULL,
  1212. },
  1213. #ifndef NO_MULTIBYTE_PRINT
  1214. /* Japanese */
  1215. {
  1216. " 注意 : 全てのファイルは wolfSSL ホーム・ディレクトリからの相対です。"
  1217. "\n", /* 0 */
  1218. "RSAの最大ビットは次のように設定されています: ", /* 1 */
  1219. #ifdef NO_RSA
  1220. "RSAはサポートされていません。\n", /* 2 */
  1221. #elif defined(WOLFSSL_SP_MATH) /* case of SP math only */
  1222. #ifndef WOLFSSL_SP_NO_3072
  1223. "3072\n", /* 2 */
  1224. #elif !defined(WOLFSSL_SP_NO_2048)
  1225. "2048\n", /* 2 */
  1226. #else
  1227. "0\n", /* 2 */
  1228. #endif
  1229. #elif defined(USE_FAST_MATH)
  1230. #else
  1231. "無限\n", /* 2 */
  1232. #endif
  1233. "-? <num> ヘルプ, 使い方を表示\n"
  1234. " 0: 英語、 1: 日本語\n"
  1235. "--ヘルプ 日本語で使い方を表示\n", /* 3 */
  1236. "-h <host> 接続先ホスト, 既定値", /* 4 */
  1237. "-p <num> 接続先ポート, 0は無効, 既定値", /* 5 */
  1238. #ifndef WOLFSSL_TLS13
  1239. "-v <num> SSL バージョン [0-3], SSLv3(0) - TLS1.2(3)),"
  1240. " 既定値", /* 6 */
  1241. "-V 有効な ssl バージョン番号を出力, SSLv3(0) -"
  1242. " TLS1.2(3)\n", /* 7 */
  1243. #else
  1244. "-v <num> SSL バージョン [0-4], SSLv3(0) - TLS1.3(4)),"
  1245. " 既定値", /* 6 */
  1246. "-V 有効な ssl バージョン番号を出力, SSLv3(0) -"
  1247. " TLS1.3(4)\n", /* 7 */
  1248. #endif
  1249. "-l <str> 暗号スイートリスト (区切り文字 :)\n", /* 8 */
  1250. #ifndef NO_CERTS
  1251. "-c <file> 証明書ファイル, 既定値", /* 9 */
  1252. "-k <file> 鍵ファイル, 既定値", /* 10 */
  1253. "-A <file> 認証局ファイル, 既定値", /* 11 */
  1254. #endif
  1255. #ifndef NO_DH
  1256. "-Z <num> 最小 DH 鍵 ビット, 既定値", /* 12 */
  1257. #endif
  1258. "-b <num> ベンチマーク <num> 接続及び結果出力する\n", /* 13 */
  1259. #ifdef HAVE_ALPN
  1260. "-L <str> アプリケーション層プロトコルネゴシエーションを行う"
  1261. " ({C,F}:<list>)\n", /* 14 */
  1262. #endif
  1263. "-B <num> <num> バイトを用いてのベンチマーク・スループット測定"
  1264. "と結果を出力する\n", /* 15 */
  1265. #ifndef NO_PSK
  1266. "-s 事前共有鍵を使用する\n", /* 16 */
  1267. #endif
  1268. "-d ピア確認を無効とする\n", /* 17 */
  1269. "-D 日付エラー用コールバック例の上書きを行う\n", /* 18 */
  1270. "-e 利用可能な全ての暗号スイートをリスト, \n", /* 19 */
  1271. "-g サーバーへ HTTP GET を送信\n", /* 20 */
  1272. "-u UDP DTLSを使用する。\n"
  1273. #ifndef WOLFSSL_DTLS13
  1274. " -v 2 を追加指定するとDTLSv1, "
  1275. "-v 3 を追加指定すると DTLSv1.2 (既定値)\n", /* 21 */
  1276. #else
  1277. " -v 2 を追加指定するとDTLSv1, "
  1278. "-v 3 を追加指定すると DTLSv1.2 (既定値),\n"
  1279. " -v 4 を追加指定すると DTLSv1.3\n", /* 21 */
  1280. #endif /* !WOLFSSL_DTLS13 */
  1281. #ifdef WOLFSSL_SCTP
  1282. "-G SCTP DTLSを使用する。-v 2 を追加指定すると"
  1283. " DTLSv1, -v 3 を追加指定すると DTLSv1.2 (既定値)\n", /* 22 */
  1284. #endif
  1285. #ifndef NO_CERTS
  1286. "-m 証明書内のドメイン名一致を確認する\n", /* 23 */
  1287. #endif
  1288. "-N ノンブロッキング・ソケットを使用する\n", /* 24 */
  1289. #ifndef NO_SESSION_CACHE
  1290. "-r セッションを継続する\n", /* 25 */
  1291. #endif
  1292. "-w 双方向シャットダウンを待つ\n", /* 26 */
  1293. "-M <prot> STARTTLSを使用する, <prot>プロトコル(smtp)を"
  1294. "使用する\n", /* 27 */
  1295. #ifdef HAVE_SECURE_RENEGOTIATION
  1296. "-R セキュアな再ネゴシエーションを許可する\n", /* 28 */
  1297. "-i <str> クライアント主導のネゴシエーションを強制する\n", /* 29 */
  1298. #endif
  1299. "-f より少ないパケット/グループメッセージを使用する\n",/* 30 */
  1300. #ifndef NO_CERTS
  1301. "-x クライアントの証明書/鍵のロードを無効する\n", /* 31 */
  1302. #endif
  1303. "-X 外部テスト・ケースにより動作する\n", /* 32 */
  1304. "-j コールバック・オーバーライドの検証を使用する\n", /* 33 */
  1305. #ifdef SHOW_SIZES
  1306. "-z 構造体のサイズを表示する\n", /* 34 */
  1307. #endif
  1308. #ifdef HAVE_SNI
  1309. "-S <str> ホスト名表示を使用する\n", /* 35 */
  1310. #endif
  1311. #ifdef HAVE_MAX_FRAGMENT
  1312. "-F <num> 最大フラグメント長[1-6]を設定する\n", /* 36 */
  1313. #endif
  1314. #ifdef HAVE_TRUNCATED_HMAC
  1315. "-T Truncated HMACを使用する\n", /* 37 */
  1316. #endif
  1317. #ifdef HAVE_EXTENDED_MASTER
  1318. "-n マスターシークレット拡張を無効にする\n", /* 38 */
  1319. #endif
  1320. #ifdef HAVE_OCSP
  1321. "-o OCSPルックアップをピア証明書で実施する\n", /* 39 */
  1322. "-O <url> OCSPルックアップを、<url>を使用し"
  1323. "応答者として実施する\n", /* 40 */
  1324. #endif
  1325. #if defined(HAVE_CERTIFICATE_STATUS_REQUEST) \
  1326. || defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
  1327. "-W <num> OCSP Staplingを使用する"
  1328. " (1 v1, 2 v2, 3 v2 multi)\n", /* 41 */
  1329. " 'm' を最後に指定すると必ず staple を使用する\n" /* 42 */
  1330. #endif
  1331. #if defined(ATOMIC_USER) && !defined(WOLFSSL_AEAD_ONLY)
  1332. "-U アトミック・ユーザー記録の"
  1333. "コールバックを利用する\n", /* 43 */
  1334. #endif
  1335. #ifdef HAVE_PK_CALLBACKS
  1336. "-P 公開鍵コールバック\n", /* 44 */
  1337. #endif
  1338. #ifdef HAVE_ANON
  1339. "-a 匿名クライアント\n", /* 45 */
  1340. #endif
  1341. #ifdef HAVE_CRL
  1342. "-C CRLを無効\n", /* 46 */
  1343. #endif
  1344. #ifdef WOLFSSL_TRUST_PEER_CERT
  1345. "-E <file> 信頼出来るピアの証明書ロードの為のパス\n", /* 47 */
  1346. #endif
  1347. #ifdef HAVE_WNR
  1348. "-q <file> Whitewood コンフィグファイル, 既定値\n", /* 48 */
  1349. #endif
  1350. "-H <arg> 内部テスト"
  1351. " [defCipherList, exitWithRet, verifyFail, useSupCurve,\n", /* 49 */
  1352. " loadSSL, disallowETM]\n", /* 50 */
  1353. #ifdef WOLFSSL_TLS13
  1354. "-J HelloRetryRequestをKEのグループ選択に使用する\n", /* 51 */
  1355. "-K 鍵交換にPSKを使用、(EC)DHEは使用しない\n", /* 52 */
  1356. "-I データ送信前に、鍵とIVを更新する\n", /* 53 */
  1357. #ifndef NO_DH
  1358. "-y FFDHE名前付きグループとの鍵共有のみ\n", /* 54 */
  1359. #endif
  1360. #ifdef HAVE_ECC
  1361. "-Y ECC名前付きグループとの鍵共有のみ\n", /* 55 */
  1362. #endif
  1363. #endif /* WOLFSSL_TLS13 */
  1364. #ifdef HAVE_CURVE25519
  1365. "-t X25519を鍵交換に使用する\n", /* 56 */
  1366. #endif
  1367. #if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH)
  1368. "-Q ポストハンドシェークの証明要求をサポートする\n", /* 57 */
  1369. #endif
  1370. #ifdef WOLFSSL_EARLY_DATA
  1371. "-0 Early data をサーバーへ送信する"
  1372. "(0-RTTハンドシェイク)\n", /* 58 */
  1373. #endif
  1374. #ifdef WOLFSSL_MULTICAST
  1375. "-3 <grpid> マルチキャスト, grpid < 256\n", /* 59 */
  1376. #endif
  1377. "-1 <num> 指定された言語で結果を表示します。\n"
  1378. " 0: 英語、 1: 日本語\n", /* 60 */
  1379. #if !defined(NO_DH) && !defined(HAVE_FIPS) && \
  1380. !defined(HAVE_SELFTEST) && !defined(WOLFSSL_OLD_PRIME_CHECK)
  1381. "-2 DHプライム番号チェックを無効にする\n", /* 61 */
  1382. #endif
  1383. #ifdef HAVE_SECURE_RENEGOTIATION
  1384. "-4 再交渉に再開を使用\n", /* 62 */
  1385. #endif
  1386. #ifdef HAVE_TRUSTED_CA
  1387. "-5 信頼できる認証局の鍵表示を使用する\n", /* 63 */
  1388. #endif
  1389. "-6 WANT_WRITE エラーを全てのIO 送信でシミュレートします\n",
  1390. #ifdef HAVE_CURVE448
  1391. "-8 鍵交換に X448 を使用する\n", /* 66 */
  1392. #endif
  1393. #if defined(OPENSSL_ALL) && defined(WOLFSSL_CERT_GEN) && \
  1394. (defined(WOLFSSL_CERT_REQ) || defined(WOLFSSL_CERT_EXT)) && \
  1395. !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR)
  1396. "-9 証明書の読み込みに hash dir 機能を使用する\n"
  1397. " <wolfSSL home>/certs フォルダーからロードします\n"
  1398. " フォルダー中のファイルは、\"hash.N\"[N:0-9]名である必要があります\n"
  1399. " 以下の例ではca-cert.pemにシンボリックリンクを設定します\n"
  1400. " ln -s ca-cert.pem `openssl x509 -in ca-cert.pem -hash -noout`.0\n",
  1401. /* 67 */
  1402. #endif
  1403. #if defined(WOLFSSL_WOLFSENTRY_HOOKS) && !defined(NO_FILESYSTEM) && \
  1404. !defined(WOLFSENTRY_NO_JSON)
  1405. "--wolfsentry-config <file> wolfSentry コンフィグファイル\n",
  1406. /* 68 */
  1407. #endif
  1408. #ifndef WOLFSSL_TLS13
  1409. "-7 最小ダウングレード可能なプロトコルバージョンを設定します [0-3] "
  1410. " SSLv3(0) - TLS1.2(3)\n",
  1411. #else
  1412. "-7 最小ダウングレード可能なプロトコルバージョンを設定します [0-4] "
  1413. " SSLv3(0) - TLS1.3(4)\n", /* 69 */
  1414. #endif
  1415. #ifdef HAVE_PQC
  1416. "--pqc <alg> post-quantum 名前付きグループとの鍵共有のみ [KYBER_LEVEL1, KYBER_LEVEL3,\n"
  1417. " KYBER_LEVEL5, P256_KYBER_LEVEL1, P384_KYBER_LEVEL3, P521_KYBER_LEVEL5]\n", /* 70 */
  1418. #endif
  1419. #ifdef WOLFSSL_SRTP
  1420. "--srtp <profile> (デフォルトは SRTP_AES128_CM_SHA1_80)\n", /* 71 */
  1421. #endif
  1422. #ifdef WOLFSSL_SYS_CA_CERTS
  1423. "--sys-ca-certs Load system CA certs for server cert verification\n", /* 72 */
  1424. #endif
  1425. #ifdef HAVE_SUPPORTED_CURVES
  1426. "--onlyPskDheKe Must use DHE key exchange with PSK\n", /* 73 */
  1427. #endif
  1428. #ifndef NO_PSK
  1429. "--openssl-psk Use TLS 1.3 PSK callback compatible with OpenSSL\n", /* 74 */
  1430. #endif
  1431. #ifdef HAVE_RPK
  1432. "--rpk Use RPK for the defined certificates\n", /* 75 */
  1433. #endif
  1434. "--files-are-der Specified files are in DER, not PEM format\n", /* 76 */
  1435. "\n"
  1436. "より簡単なwolfSSL TLS クライアントの例については"
  1437. "下記にアクセスしてください\n"
  1438. "https://github.com/wolfSSL/wolfssl-examples/tree/master/tls\n", /* 77 */
  1439. NULL,
  1440. },
  1441. #endif
  1442. };
  1443. static void showPeerPEM(WOLFSSL* ssl)
  1444. {
  1445. #if defined(OPENSSL_ALL) && !defined(NO_BIO) && defined(WOLFSSL_CERT_GEN)
  1446. WOLFSSL_X509* peer = wolfSSL_get_peer_certificate(ssl);
  1447. if (peer) {
  1448. WOLFSSL_BIO* bioOut = wolfSSL_BIO_new(wolfSSL_BIO_s_file());
  1449. if (bioOut == NULL) {
  1450. LOG_ERROR("failed to get bio on stdout\n");
  1451. }
  1452. else {
  1453. if (wolfSSL_BIO_set_fp(bioOut, stdout, BIO_NOCLOSE)
  1454. != WOLFSSL_SUCCESS) {
  1455. LOG_ERROR("failed to set stdout to bio output\n");
  1456. wolfSSL_BIO_free(bioOut);
  1457. bioOut = NULL;
  1458. }
  1459. }
  1460. if (bioOut) {
  1461. wolfSSL_BIO_write(bioOut, "---\nServer certificate\n",
  1462. XSTRLEN("---\nServer certificate\n"));
  1463. wolfSSL_PEM_write_bio_X509(bioOut, peer);
  1464. }
  1465. wolfSSL_BIO_free(bioOut);
  1466. }
  1467. wolfSSL_FreeX509(peer);
  1468. #endif /* OPENSSL_ALL && WOLFSSL_CERT_GEN && !NO_BIO */
  1469. (void)ssl;
  1470. }
  1471. static void Usage(void)
  1472. {
  1473. int msgid = 0;
  1474. const char** msg = client_usage_msg[lng_index];
  1475. printf("%s%s%s", "wolfSSL client ", LIBWOLFSSL_VERSION_STRING,
  1476. msg[msgid]);
  1477. /* print out so that scripts can know what the max supported key size is */
  1478. printf("%s", msg[++msgid]);
  1479. #ifdef NO_RSA
  1480. printf("%s", msg[++msgid]);
  1481. #elif defined(WOLFSSL_SP_MATH) /* case of SP math only */
  1482. #ifndef WOLFSSL_SP_NO_3072
  1483. printf("%s", msg[++msgid]);
  1484. #elif !defined(WOLFSSL_SP_NO_2048)
  1485. printf("%s", msg[++msgid]);
  1486. #else
  1487. printf("%s", msg[++msgid]);
  1488. #endif
  1489. #elif defined(USE_FAST_MATH)
  1490. #if !defined(WOLFSSL_SP_MATH_ALL) && !defined(WOLFSSL_SP_MATH)
  1491. printf("%d\n", FP_MAX_BITS/2);
  1492. #else
  1493. printf("%d\n", SP_INT_MAX_BITS/2);
  1494. #endif
  1495. #else
  1496. /* normal math has unlimited max size */
  1497. printf("%s", msg[++msgid]);
  1498. #endif
  1499. printf("%s", msg[++msgid]); /* ? */
  1500. printf("%s %s\n", msg[++msgid], wolfSSLIP); /* -h */
  1501. printf("%s %d\n", msg[++msgid], wolfSSLPort); /* -p */
  1502. #ifndef WOLFSSL_TLS13
  1503. printf("%s %d\n", msg[++msgid], CLIENT_DEFAULT_VERSION); /* -v */
  1504. printf("%s", msg[++msgid]); /* -V */
  1505. #else
  1506. printf("%s %d\n", msg[++msgid], CLIENT_DEFAULT_VERSION); /* -v */
  1507. printf("%s", msg[++msgid]); /* -V */
  1508. #endif
  1509. printf("%s", msg[++msgid]); /* -l */
  1510. #ifndef NO_CERTS
  1511. printf("%s %s\n", msg[++msgid], cliCertFile); /* -c */
  1512. printf("%s %s\n", msg[++msgid], cliKeyFile); /* -k */
  1513. printf("%s %s\n", msg[++msgid], caCertFile); /* -A */
  1514. #endif
  1515. #ifndef NO_DH
  1516. printf("%s %d\n", msg[++msgid], DEFAULT_MIN_DHKEY_BITS);
  1517. #endif
  1518. printf("%s", msg[++msgid]); /* -b */
  1519. #ifdef HAVE_ALPN
  1520. printf("%s", msg[++msgid]); /* -L <str> */
  1521. #endif
  1522. printf("%s", msg[++msgid]); /* -B <num> */
  1523. #ifndef NO_PSK
  1524. printf("%s", msg[++msgid]); /* -s */
  1525. #endif
  1526. printf("%s", msg[++msgid]); /* -d */
  1527. printf("%s", msg[++msgid]); /* -D */
  1528. printf("%s", msg[++msgid]); /* -e */
  1529. printf("%s", msg[++msgid]); /* -g */
  1530. printf("%s", msg[++msgid]); /* -u */
  1531. #ifdef WOLFSSL_SCTP
  1532. printf("%s", msg[++msgid]); /* -G */
  1533. #endif
  1534. #ifndef NO_CERTS
  1535. printf("%s", msg[++msgid]); /* -m */
  1536. #endif
  1537. printf("%s", msg[++msgid]); /* -N */
  1538. #ifndef NO_SESSION_CACHE
  1539. printf("%s", msg[++msgid]); /* -r */
  1540. #endif
  1541. printf("%s", msg[++msgid]); /* -w */
  1542. printf("%s", msg[++msgid]); /* -M */
  1543. #ifdef HAVE_SECURE_RENEGOTIATION
  1544. printf("%s", msg[++msgid]); /* -R */
  1545. printf("%s", msg[++msgid]); /* -i */
  1546. #endif
  1547. printf("%s", msg[++msgid]); /* -f */
  1548. #ifndef NO_CERTS
  1549. printf("%s", msg[++msgid]); /* -x */
  1550. #endif
  1551. printf("%s", msg[++msgid]); /* -X */
  1552. printf("%s", msg[++msgid]); /* -j */
  1553. #ifdef SHOW_SIZES
  1554. printf("%s", msg[++msgid]); /* -z */
  1555. #endif
  1556. #ifdef HAVE_SNI
  1557. printf("%s", msg[++msgid]); /* -S */
  1558. #endif
  1559. #ifdef HAVE_MAX_FRAGMENT
  1560. printf("%s", msg[++msgid]); /* -F */
  1561. #endif
  1562. #ifdef HAVE_TRUNCATED_HMAC
  1563. printf("%s", msg[++msgid]); /* -T */
  1564. #endif
  1565. #ifdef HAVE_EXTENDED_MASTER
  1566. printf("%s", msg[++msgid]); /* -n */
  1567. #endif
  1568. #ifdef HAVE_OCSP
  1569. printf("%s", msg[++msgid]); /* -o */
  1570. printf("%s", msg[++msgid]); /* -O */
  1571. #endif
  1572. #if defined(HAVE_CERTIFICATE_STATUS_REQUEST) \
  1573. || defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
  1574. printf("%s", msg[++msgid]); /* -W */
  1575. printf("%s", msg[++msgid]); /* note for -W */
  1576. #endif
  1577. #if defined(ATOMIC_USER) && !defined(WOLFSSL_AEAD_ONLY)
  1578. printf("%s", msg[++msgid]); /* -U */
  1579. #endif
  1580. #ifdef HAVE_PK_CALLBACKS
  1581. printf("%s", msg[++msgid]); /* -P */
  1582. #endif
  1583. #ifdef HAVE_ANON
  1584. printf("%s", msg[++msgid]); /* -a */
  1585. #endif
  1586. #ifdef HAVE_CRL
  1587. printf("%s", msg[++msgid]); /* -C */
  1588. #endif
  1589. #ifdef WOLFSSL_TRUST_PEER_CERT
  1590. printf("%s", msg[++msgid]); /* -E */
  1591. #endif
  1592. #ifdef HAVE_WNR
  1593. printf("%s %s\n", msg[++msgid], wnrConfig); /* -q */
  1594. #endif
  1595. printf("%s", msg[++msgid]); /* -H */
  1596. printf("%s", msg[++msgid]); /* more -H options */
  1597. #ifdef WOLFSSL_TLS13
  1598. printf("%s", msg[++msgid]); /* -J */
  1599. printf("%s", msg[++msgid]); /* -K */
  1600. printf("%s", msg[++msgid]); /* -I */
  1601. #ifndef NO_DH
  1602. printf("%s", msg[++msgid]); /* -y */
  1603. #endif
  1604. #ifdef HAVE_ECC
  1605. printf("%s", msg[++msgid]); /* -Y */
  1606. #endif
  1607. #endif /* WOLFSSL_TLS13 */
  1608. #ifdef HAVE_CURVE25519
  1609. printf("%s", msg[++msgid]); /* -t */
  1610. #endif
  1611. #if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH)
  1612. printf("%s", msg[++msgid]); /* -Q */
  1613. #endif
  1614. #ifdef WOLFSSL_EARLY_DATA
  1615. printf("%s", msg[++msgid]); /* -0 */
  1616. #endif
  1617. #ifdef WOLFSSL_MULTICAST
  1618. printf("%s", msg[++msgid]); /* -3 */
  1619. #endif
  1620. printf("%s", msg[++msgid]); /* -1 */
  1621. #if !defined(NO_DH) && !defined(HAVE_FIPS) && \
  1622. !defined(HAVE_SELFTEST) && !defined(WOLFSSL_OLD_PRIME_CHECK)
  1623. printf("%s", msg[++msgid]); /* -2 */
  1624. #endif
  1625. #ifdef HAVE_SECURE_RENEGOTIATION
  1626. printf("%s", msg[++msgid]); /* -4 */
  1627. #endif
  1628. #ifdef HAVE_TRUSTED_CA
  1629. printf("%s", msg[++msgid]); /* -5 */
  1630. #endif
  1631. printf("%s", msg[++msgid]); /* -6 */
  1632. #ifdef HAVE_CURVE448
  1633. printf("%s", msg[++msgid]); /* -8 */
  1634. #endif
  1635. #if defined(OPENSSL_ALL) && defined(WOLFSSL_CERT_GEN) && \
  1636. (defined(WOLFSSL_CERT_REQ) || defined(WOLFSSL_CERT_EXT)) && \
  1637. !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR)
  1638. printf("%s", msg[++msgid]); /* -9 */
  1639. #endif
  1640. #if defined(WOLFSSL_WOLFSENTRY_HOOKS) && !defined(NO_FILESYSTEM) && \
  1641. !defined(WOLFSENTRY_NO_JSON)
  1642. printf("%s", msg[++msgid]); /* --wolfsentry-config */
  1643. #endif
  1644. printf("%s", msg[++msgid]); /* -7 */
  1645. printf("%s", msg[++msgid]); /* Examples repo link */
  1646. #ifdef HAVE_PQC
  1647. printf("%s", msg[++msgid]); /* --pqc */
  1648. #endif
  1649. #ifdef WOLFSSL_SRTP
  1650. printf("%s", msg[++msgid]); /* dtls-srtp */
  1651. #endif
  1652. #ifdef WOLFSSL_SYS_CA_CERTS
  1653. printf("%s", msg[++msgid]); /* --sys-ca-certs */
  1654. #endif
  1655. #ifdef HAVE_SUPPORTED_CURVES
  1656. printf("%s", msg[++msgid]); /* --onlyPskDheKe */
  1657. #endif
  1658. #ifndef NO_PSK
  1659. printf("%s", msg[++msgid]); /* --openssl-psk */
  1660. #endif
  1661. #ifdef HAVE_RPK
  1662. printf("%s", msg[++msgid]); /* --rpk */
  1663. #endif
  1664. printf("%s", msg[++msgid]); /* --files-are-der */
  1665. printf("%s", msg[++msgid]); /* Documentation Hint */
  1666. }
  1667. #ifdef WOLFSSL_SRTP
  1668. /**
  1669. * client_srtp_test() - test that the computed ekm matches with the server one
  1670. * @ssl: ssl context
  1671. * @srtp_helper: srtp_test_helper struct shared with the server
  1672. *
  1673. * if @srtp_helper is NULL no check is made, but the ekm is printed.
  1674. *
  1675. * calls srtp_helper_get_ekm() to wait and then get the ekm computed by the
  1676. * server, then check if it matches the one computed by itself.
  1677. */
  1678. static int client_srtp_test(WOLFSSL *ssl, func_args *args)
  1679. {
  1680. size_t srtp_secret_length;
  1681. byte *srtp_secret, *p;
  1682. int ret;
  1683. #ifdef WOLFSSL_COND
  1684. srtp_test_helper *srtp_helper = args->srtp_helper;
  1685. byte *other_secret = NULL;
  1686. size_t other_size = 0;
  1687. #else
  1688. (void)args;
  1689. #endif
  1690. ret = wolfSSL_export_dtls_srtp_keying_material(ssl, NULL,
  1691. &srtp_secret_length);
  1692. if (ret != LENGTH_ONLY_E) {
  1693. LOG_ERROR("DTLS SRTP: Error getting keying material length\n");
  1694. return ret;
  1695. }
  1696. srtp_secret = (byte*)XMALLOC(srtp_secret_length,
  1697. NULL, DYNAMIC_TYPE_TMP_BUFFER);
  1698. if (srtp_secret == NULL) {
  1699. err_sys("DTLS SRTP: Low memory");
  1700. }
  1701. ret = wolfSSL_export_dtls_srtp_keying_material(ssl, srtp_secret,
  1702. &srtp_secret_length);
  1703. if (ret != WOLFSSL_SUCCESS) {
  1704. XFREE(srtp_secret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  1705. LOG_ERROR("DTLS SRTP: Error getting keying material\n");
  1706. return ret;
  1707. }
  1708. printf("DTLS SRTP: Exported key material: ");
  1709. for (p = srtp_secret; p < srtp_secret + srtp_secret_length; p++)
  1710. printf("%02X", *p);
  1711. printf("\n");
  1712. #ifdef WOLFSSL_COND
  1713. if (srtp_helper != NULL) {
  1714. srtp_helper_get_ekm(srtp_helper, &other_secret, &other_size);
  1715. if (other_size != srtp_secret_length ||
  1716. (XMEMCMP(other_secret, srtp_secret, srtp_secret_length) != 0)) {
  1717. /* we are delegated from server to free this buffer */
  1718. XFREE(other_secret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  1719. printf("DTLS SRTP: Exported Keying Material mismatch\n");
  1720. return WOLFSSL_UNKNOWN;
  1721. }
  1722. /* we are delegated from server to free this buffer */
  1723. XFREE(other_secret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  1724. }
  1725. #endif /* WOLFSSL_COND */
  1726. XFREE(srtp_secret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  1727. return 0;
  1728. }
  1729. #endif /* WOLFSSL_SRTP */
  1730. #if defined(WOLFSSL_STATIC_MEMORY) && \
  1731. defined(WOLFSSL_STATIC_MEMORY_DEBUG_CALLBACK)
  1732. static void ExampleDebugMemoryCb(size_t sz, int bucketSz, byte st, int type) {
  1733. switch (st) {
  1734. case WOLFSSL_DEBUG_MEMORY_ALLOC:
  1735. if (type == DYNAMIC_TYPE_IN_BUFFER) {
  1736. printf("IN BUFFER: ");
  1737. }
  1738. if (type == DYNAMIC_TYPE_OUT_BUFFER) {
  1739. printf("OUT BUFFER: ");
  1740. }
  1741. printf("Alloc'd %d bytes using bucket size %d\n", (int)sz,
  1742. bucketSz);
  1743. break;
  1744. case WOLFSSL_DEBUG_MEMORY_FAIL:
  1745. printf("Failed when trying to allocate %d bytes\n", (int)sz);
  1746. break;
  1747. case WOLFSSL_DEBUG_MEMORY_FREE:
  1748. printf("Free'ing : %d\n", (int)sz);
  1749. break;
  1750. case WOLFSSL_DEBUG_MEMORY_INIT:
  1751. printf("Creating memory bucket of size : %d\n", bucketSz);
  1752. break;
  1753. }
  1754. }
  1755. #endif
  1756. THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
  1757. {
  1758. SOCKET_T sockfd = WOLFSSL_SOCKET_INVALID;
  1759. wolfSSL_method_func method = NULL;
  1760. WOLFSSL_CTX* ctx = NULL;
  1761. WOLFSSL* ssl = NULL;
  1762. #ifdef WOLFSSL_WOLFSENTRY_HOOKS
  1763. wolfsentry_errcode_t wolfsentry_ret;
  1764. #endif
  1765. WOLFSSL* sslResume = NULL;
  1766. WOLFSSL_SESSION* session = NULL;
  1767. #if !defined(NO_SESSION_CACHE) && (defined(OPENSSL_EXTRA) || \
  1768. defined(HAVE_EXT_CACHE))
  1769. byte* flatSession = NULL;
  1770. int flatSessionSz = 0;
  1771. #endif
  1772. char msg[CLI_MSG_SZ];
  1773. int msgSz = 0;
  1774. char reply[CLI_REPLY_SZ];
  1775. word16 port = wolfSSLPort;
  1776. char* host = (char*)wolfSSLIP;
  1777. const char* domain = "localhost"; /* can't default to www.wolfssl.com
  1778. because can't tell if we're really
  1779. going there to detect old chacha-poly
  1780. */
  1781. #ifndef WOLFSSL_VXWORKS
  1782. int ch;
  1783. static const struct mygetopt_long_config long_options[] = {
  1784. #if defined(WOLFSSL_WOLFSENTRY_HOOKS) && !defined(NO_FILESYSTEM) && \
  1785. !defined(WOLFSENTRY_NO_JSON)
  1786. { "wolfsentry-config", 1, 256 },
  1787. #endif
  1788. { "help", 0, 257 },
  1789. #ifndef NO_MULTIBYTE_PRINT
  1790. { "ヘルプ", 0, 258 },
  1791. #endif
  1792. #if defined(HAVE_PQC)
  1793. { "pqc", 1, 259 },
  1794. #endif
  1795. #ifdef WOLFSSL_SRTP
  1796. { "srtp", 2, 260 }, /* optional argument */
  1797. #endif
  1798. #ifdef WOLFSSL_DTLS13
  1799. /* allow waitTicket option even when HAVE_SESSION_TICKET is 0. Otherwise
  1800. * tests that use this option will ignore the options following
  1801. * --waitTicket in the command line and fail */
  1802. {"waitTicket", 0, 261},
  1803. #endif /* WOLFSSL_DTLS13 */
  1804. #ifdef WOLFSSL_DTLS_CID
  1805. {"cid", 2, 262},
  1806. #endif /* WOLFSSL_DTLS_CID */
  1807. #ifdef WOLFSSL_SYS_CA_CERTS
  1808. { "sys-ca-certs", 0, 263 },
  1809. #endif
  1810. #ifdef HAVE_SUPPORTED_CURVES
  1811. { "onlyPskDheKe", 0, 264 },
  1812. #endif
  1813. #ifndef NO_PSK
  1814. { "openssl-psk", 0, 265 },
  1815. #endif
  1816. { "quieter", 0, 266 },
  1817. #ifdef HAVE_RPK
  1818. { "rpk", 0, 267 },
  1819. #endif /* HAVE_RPK */
  1820. { "files-are-der", 0, 268 },
  1821. { 0, 0, 0 }
  1822. };
  1823. #endif
  1824. int version = CLIENT_INVALID_VERSION;
  1825. int minVersion = CLIENT_INVALID_VERSION;
  1826. int usePsk = 0;
  1827. int opensslPsk = 0;
  1828. int useAnon = 0;
  1829. int sendGET = 0;
  1830. int benchmark = 0;
  1831. int block = TEST_BUFFER_SIZE;
  1832. size_t throughput = 0;
  1833. int doDTLS = 0;
  1834. int dtlsUDP = 0;
  1835. #if (defined(WOLFSSL_SCTP) || defined(WOLFSSL_DTLS_MTU)) && \
  1836. defined(WOLFSSL_DTLS)
  1837. int dtlsMTU = 0;
  1838. #endif
  1839. int dtlsSCTP = 0;
  1840. int doMcast = 0;
  1841. int matchName = 0;
  1842. int doPeerCheck = 1;
  1843. int nonBlocking = 0;
  1844. int simulateWantWrite = 0;
  1845. int resumeSession = 0;
  1846. int wc_shutdown = 0;
  1847. int disableCRL = 0;
  1848. int externalTest = 0;
  1849. int ret;
  1850. int err = 0;
  1851. int scr = 0; /* allow secure renegotiation */
  1852. int forceScr = 0; /* force client initiated scr */
  1853. int scrAppData = 0;
  1854. int resumeScr = 0; /* use resumption for renegotiation */
  1855. #ifndef WOLFSSL_NO_CLIENT_AUTH
  1856. int useClientCert = 1;
  1857. #else
  1858. int useClientCert = 0;
  1859. #endif
  1860. int fewerPackets = 0;
  1861. int atomicUser = 0;
  1862. #ifdef HAVE_PK_CALLBACKS
  1863. int pkCallbacks = 0;
  1864. PkCbInfo pkCbInfo;
  1865. #endif
  1866. int minDhKeyBits = DEFAULT_MIN_DHKEY_BITS;
  1867. char* alpnList = NULL;
  1868. unsigned char alpn_opt = 0;
  1869. char* cipherList = NULL;
  1870. int useDefCipherList = 0;
  1871. int customVerifyCert = 0;
  1872. const char* verifyCert;
  1873. const char* ourCert;
  1874. const char* ourKey;
  1875. int doSTARTTLS = 0;
  1876. char* starttlsProt = NULL;
  1877. int useVerifyCb = 0;
  1878. int useSupCurve = 0;
  1879. #ifdef WOLFSSL_TRUST_PEER_CERT
  1880. const char* trustCert = NULL;
  1881. #endif
  1882. #ifdef HAVE_SNI
  1883. char* sniHostName = NULL;
  1884. #endif
  1885. #ifdef HAVE_TRUSTED_CA
  1886. int trustedCaKeyId = 0;
  1887. #endif
  1888. #ifdef HAVE_MAX_FRAGMENT
  1889. byte maxFragment = 0;
  1890. #endif
  1891. #ifdef HAVE_TRUNCATED_HMAC
  1892. byte truncatedHMAC = 0;
  1893. #endif
  1894. #if defined(HAVE_CERTIFICATE_STATUS_REQUEST) \
  1895. || defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
  1896. byte statusRequest = 0;
  1897. byte mustStaple = 0;
  1898. #endif
  1899. #ifdef HAVE_EXTENDED_MASTER
  1900. byte disableExtMasterSecret = 0;
  1901. #endif
  1902. int helloRetry = 0;
  1903. int onlyKeyShare = 0;
  1904. #ifdef WOLFSSL_TLS13
  1905. int noPskDheKe = 0;
  1906. #ifdef HAVE_SUPPORTED_CURVES
  1907. int onlyPskDheKe = 0;
  1908. #endif
  1909. int postHandAuth = 0;
  1910. #endif
  1911. int updateKeysIVs = 0;
  1912. int earlyData = 0;
  1913. #ifdef WOLFSSL_MULTICAST
  1914. byte mcastID = 0;
  1915. #endif
  1916. #if !defined(NO_DH) && !defined(HAVE_FIPS) && \
  1917. !defined(HAVE_SELFTEST) && !defined(WOLFSSL_OLD_PRIME_CHECK)
  1918. int doDhKeyCheck = 1;
  1919. #endif
  1920. #ifdef HAVE_OCSP
  1921. int useOcsp = 0;
  1922. char* ocspUrl = NULL;
  1923. #endif
  1924. int useX25519 = 0;
  1925. int useX448 = 0;
  1926. int usePqc = 0;
  1927. char* pqcAlg = NULL;
  1928. int exitWithRet = 0;
  1929. int loadCertKeyIntoSSLObj = 0;
  1930. #ifdef WOLFSSL_SYS_CA_CERTS
  1931. byte loadSysCaCerts = 0;
  1932. #endif
  1933. #ifdef HAVE_ENCRYPT_THEN_MAC
  1934. int disallowETM = 0;
  1935. #endif
  1936. #ifdef HAVE_WNR
  1937. const char* wnrConfigFile = wnrConfig;
  1938. #endif
  1939. #if defined(OPENSSL_ALL) && defined(WOLFSSL_CERT_GEN) && \
  1940. (defined(WOLFSSL_CERT_REQ) || defined(WOLFSSL_CERT_EXT)) && \
  1941. !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR)
  1942. int useCertFolder = 0;
  1943. #endif
  1944. #ifdef WOLFSSL_SRTP
  1945. const char* dtlsSrtpProfiles = NULL;
  1946. #endif
  1947. #ifdef HAVE_SESSION_TICKET
  1948. int waitTicket = 0;
  1949. #endif /* HAVE_SESSION_TICKET */
  1950. #ifdef WOLFSSL_DTLS_CID
  1951. int useDtlsCID = 0;
  1952. char dtlsCID[DTLS_CID_BUFFER_SIZE] = { 0 };
  1953. #endif /* WOLFSSL_DTLS_CID */
  1954. #ifdef HAVE_RPK
  1955. int useRPK = 0;
  1956. #endif /* HAVE_RPK */
  1957. int fileFormat = WOLFSSL_FILETYPE_PEM;
  1958. char buffer[WOLFSSL_MAX_ERROR_SZ];
  1959. int argc = ((func_args*)args)->argc;
  1960. char** argv = ((func_args*)args)->argv;
  1961. #ifdef WOLFSSL_STATIC_MEMORY
  1962. #if (defined(HAVE_ECC) && !defined(ALT_ECC_SIZE)) \
  1963. || defined(SESSION_CERTS)
  1964. /* big enough to handle most cases including session certs */
  1965. byte memory[320000];
  1966. #else
  1967. byte memory[80000];
  1968. #endif
  1969. byte memoryIO[34500]; /* max for IO buffer (TLS packet can be 16k) */
  1970. #if !defined(WOLFSSL_STATIC_MEMORY_LEAN)
  1971. WOLFSSL_MEM_CONN_STATS ssl_stats;
  1972. #if defined(DEBUG_WOLFSSL)
  1973. WOLFSSL_MEM_STATS mem_stats;
  1974. #endif
  1975. #endif
  1976. WOLFSSL_HEAP_HINT *heap = NULL;
  1977. #endif
  1978. #ifdef WOLFSSL_DUAL_ALG_CERTS
  1979. /* Set our preference for verification to be for both the native and
  1980. * alternative chains. Ultimately, its the server's choice. This will be
  1981. * used in the call to wolfSSL_UseCKS(). */
  1982. byte cks_order[3] = {
  1983. WOLFSSL_CKS_SIGSPEC_BOTH,
  1984. WOLFSSL_CKS_SIGSPEC_ALTERNATIVE,
  1985. WOLFSSL_CKS_SIGSPEC_NATIVE,
  1986. };
  1987. #endif /* WOLFSSL_DUAL_ALG_CERTS */
  1988. ((func_args*)args)->return_code = -1; /* error state */
  1989. #ifndef NO_RSA
  1990. verifyCert = caCertFile;
  1991. ourCert = cliCertFile;
  1992. ourKey = cliKeyFile;
  1993. #else
  1994. #ifdef HAVE_ECC
  1995. verifyCert = caEccCertFile;
  1996. ourCert = cliEccCertFile;
  1997. ourKey = cliEccKeyFile;
  1998. #elif defined(HAVE_ED25519)
  1999. verifyCert = caEdCertFile;
  2000. ourCert = cliEdCertFile;
  2001. ourKey = cliEdKeyFile;
  2002. #elif defined(HAVE_ED448)
  2003. verifyCert = caEd448CertFile;
  2004. ourCert = cliEd448CertFile;
  2005. ourKey = cliEd448KeyFile;
  2006. #else
  2007. verifyCert = NULL;
  2008. ourCert = NULL;
  2009. ourKey = NULL;
  2010. #endif
  2011. #endif
  2012. (void)session;
  2013. (void)sslResume;
  2014. (void)atomicUser;
  2015. (void)scr;
  2016. (void)forceScr;
  2017. (void)scrAppData;
  2018. (void)resumeScr;
  2019. (void)ourKey;
  2020. (void)ourCert;
  2021. (void)verifyCert;
  2022. (void)useClientCert;
  2023. (void)disableCRL;
  2024. (void)minDhKeyBits;
  2025. (void)alpnList;
  2026. (void)alpn_opt;
  2027. (void)updateKeysIVs;
  2028. (void)earlyData;
  2029. (void)useX25519;
  2030. (void)useX448;
  2031. (void)helloRetry;
  2032. (void)onlyKeyShare;
  2033. (void)useSupCurve;
  2034. (void)loadCertKeyIntoSSLObj;
  2035. (void)usePqc;
  2036. (void)pqcAlg;
  2037. (void)opensslPsk;
  2038. (void)fileFormat;
  2039. StackTrap();
  2040. /* Reinitialize the global myVerifyAction. */
  2041. myVerifyAction = VERIFY_OVERRIDE_ERROR;
  2042. #ifndef WOLFSSL_VXWORKS
  2043. /* Not used: All used */
  2044. while ((ch = mygetopt_long(argc, argv, "?:"
  2045. "ab:c:defgh:i;jk:l:mnop:q:rstu;v:wxyz"
  2046. "A:B:CDE:F:GH:IJKL:M:NO:PQRS:TUVW:XYZ:"
  2047. "01:23:4567:89"
  2048. "@#", long_options, 0)) != -1) {
  2049. switch (ch) {
  2050. case '?' :
  2051. if(myoptarg!=NULL) {
  2052. lng_index = atoi(myoptarg);
  2053. if(lng_index<0||lng_index>1){
  2054. lng_index = 0;
  2055. }
  2056. }
  2057. Usage();
  2058. XEXIT_T(EXIT_SUCCESS);
  2059. case 257 :
  2060. lng_index = 0;
  2061. Usage();
  2062. XEXIT_T(EXIT_SUCCESS);
  2063. case 258 :
  2064. lng_index = 1;
  2065. Usage();
  2066. XEXIT_T(EXIT_SUCCESS);
  2067. case 'g' :
  2068. sendGET = 1;
  2069. break;
  2070. case 'd' :
  2071. doPeerCheck = 0;
  2072. break;
  2073. case 'e' :
  2074. ShowCiphers();
  2075. XEXIT_T(EXIT_SUCCESS);
  2076. case 'D' :
  2077. myVerifyAction = VERIFY_OVERRIDE_DATE_ERR;
  2078. break;
  2079. case 'C' :
  2080. #ifdef HAVE_CRL
  2081. disableCRL = 1;
  2082. #endif
  2083. break;
  2084. case 'u' :
  2085. doDTLS = 1;
  2086. dtlsUDP = 1;
  2087. #if (defined(WOLFSSL_SCTP) || defined(WOLFSSL_DTLS_MTU)) && \
  2088. defined(WOLFSSL_DTLS)
  2089. dtlsMTU = atoi(myoptarg);
  2090. #endif
  2091. break;
  2092. #ifdef WOLFSSL_SRTP
  2093. case 260:
  2094. doDTLS = 1;
  2095. dtlsUDP = 1;
  2096. dtlsSrtpProfiles = myoptarg != NULL ? myoptarg :
  2097. "SRTP_AES128_CM_SHA1_80";
  2098. printf("Using SRTP Profile(s): %s\n", dtlsSrtpProfiles);
  2099. break;
  2100. #endif
  2101. #ifdef WOLFSSL_DTLS13
  2102. case 261:
  2103. #ifdef HAVE_SESSION_TICKET
  2104. waitTicket = 1;
  2105. #endif /* HAVE_SESSION_TICKET */
  2106. break;
  2107. #endif /* WOLFSSL_DTLS13 */
  2108. #ifdef WOLFSSL_DTLS_CID
  2109. case 262:
  2110. useDtlsCID = 1;
  2111. if (myoptarg != NULL) {
  2112. if (XSTRLEN(myoptarg) >= DTLS_CID_BUFFER_SIZE) {
  2113. err_sys("provided connection ID is too big");
  2114. }
  2115. else {
  2116. strcpy(dtlsCID, myoptarg);
  2117. }
  2118. }
  2119. break;
  2120. #endif /* WOLFSSL_CID */
  2121. case 'G' :
  2122. #ifdef WOLFSSL_SCTP
  2123. doDTLS = 1;
  2124. dtlsUDP = 1;
  2125. dtlsSCTP = 1;
  2126. #endif
  2127. break;
  2128. case 's' :
  2129. usePsk = 1;
  2130. break;
  2131. #ifdef WOLFSSL_TRUST_PEER_CERT
  2132. case 'E' :
  2133. trustCert = myoptarg;
  2134. break;
  2135. #endif
  2136. case 'm' :
  2137. matchName = 1;
  2138. break;
  2139. case 'x' :
  2140. useClientCert = 0;
  2141. break;
  2142. case 'X' :
  2143. externalTest = 1;
  2144. break;
  2145. case 'f' :
  2146. fewerPackets = 1;
  2147. break;
  2148. case 'U' :
  2149. #if defined(ATOMIC_USER) && !defined(WOLFSSL_AEAD_ONLY)
  2150. atomicUser = 1;
  2151. #endif
  2152. break;
  2153. case 'P' :
  2154. #ifdef HAVE_PK_CALLBACKS
  2155. pkCallbacks = 1;
  2156. #endif
  2157. break;
  2158. case 'h' :
  2159. host = myoptarg;
  2160. domain = myoptarg;
  2161. break;
  2162. case 'p' :
  2163. port = (word16)atoi(myoptarg);
  2164. #if !defined(NO_MAIN_DRIVER) || defined(USE_WINDOWS_API)
  2165. if (port == 0)
  2166. err_sys("port number cannot be 0");
  2167. #endif
  2168. break;
  2169. case 'v' :
  2170. if (myoptarg[0] == 'd') {
  2171. version = CLIENT_DOWNGRADE_VERSION;
  2172. break;
  2173. }
  2174. #if defined(OPENSSL_EXTRA) || defined(WOLFSSL_EITHER_SIDE)
  2175. else if (myoptarg[0] == 'e') {
  2176. version = EITHER_DOWNGRADE_VERSION;
  2177. #ifndef NO_CERTS
  2178. loadCertKeyIntoSSLObj = 1;
  2179. #endif
  2180. break;
  2181. }
  2182. #endif
  2183. version = atoi(myoptarg);
  2184. if (version < 0 || version > 4) {
  2185. Usage();
  2186. XEXIT_T(MY_EX_USAGE);
  2187. }
  2188. break;
  2189. case 'V' :
  2190. ShowVersions();
  2191. XEXIT_T(EXIT_SUCCESS);
  2192. case 'l' :
  2193. cipherList = myoptarg;
  2194. break;
  2195. case 'H' :
  2196. if (XSTRCMP(myoptarg, "defCipherList") == 0) {
  2197. printf("Using default cipher list for testing\n");
  2198. useDefCipherList = 1;
  2199. }
  2200. else if (XSTRCMP(myoptarg, "exitWithRet") == 0) {
  2201. printf("Skip exit() for testing\n");
  2202. exitWithRet = 1;
  2203. }
  2204. else if (XSTRCMP(myoptarg, "verifyFail") == 0) {
  2205. printf("Verify should fail\n");
  2206. myVerifyAction = VERIFY_FORCE_FAIL;
  2207. }
  2208. else if (XSTRCMP(myoptarg, "verifyInfo") == 0) {
  2209. printf("Verify should not override error\n");
  2210. myVerifyAction = VERIFY_USE_PREVERFIY;
  2211. }
  2212. else if (XSTRCMP(myoptarg, "useSupCurve") == 0) {
  2213. printf("Attempting to test use supported curve\n");
  2214. #if defined(HAVE_ECC) && defined(HAVE_SUPPORTED_CURVES)
  2215. useSupCurve = 1;
  2216. #else
  2217. printf("Supported curves not compiled in!\n");
  2218. #endif
  2219. }
  2220. else if (XSTRCMP(myoptarg, "loadSSL") == 0) {
  2221. printf("Load cert/key into wolfSSL object\n");
  2222. #ifndef NO_CERTS
  2223. loadCertKeyIntoSSLObj = 1;
  2224. #else
  2225. printf("Certs turned off with NO_CERTS!\n");
  2226. #endif
  2227. }
  2228. else if (XSTRCMP(myoptarg, "disallowETM") == 0) {
  2229. printf("Disallow Encrypt-Then-MAC\n");
  2230. #ifdef HAVE_ENCRYPT_THEN_MAC
  2231. disallowETM = 1;
  2232. #endif
  2233. }
  2234. else {
  2235. Usage();
  2236. XEXIT_T(MY_EX_USAGE);
  2237. }
  2238. break;
  2239. case 'A' :
  2240. customVerifyCert = 1;
  2241. verifyCert = myoptarg;
  2242. break;
  2243. case 'c' :
  2244. ourCert = myoptarg;
  2245. break;
  2246. case 'k' :
  2247. ourKey = myoptarg;
  2248. break;
  2249. case 'Z' :
  2250. #ifndef NO_DH
  2251. minDhKeyBits = atoi(myoptarg);
  2252. if (minDhKeyBits <= 0 || minDhKeyBits > 16000) {
  2253. Usage();
  2254. XEXIT_T(MY_EX_USAGE);
  2255. }
  2256. #endif
  2257. break;
  2258. case 'b' :
  2259. benchmark = atoi(myoptarg);
  2260. if (benchmark < 0 || benchmark > 1000000) {
  2261. Usage();
  2262. XEXIT_T(MY_EX_USAGE);
  2263. }
  2264. break;
  2265. case 'B' :
  2266. throughput = (size_t)atol(myoptarg);
  2267. for (; *myoptarg != '\0'; myoptarg++) {
  2268. if (*myoptarg == ',') {
  2269. block = atoi(myoptarg + 1);
  2270. break;
  2271. }
  2272. }
  2273. if (throughput == 0 || block <= 0) {
  2274. Usage();
  2275. XEXIT_T(MY_EX_USAGE);
  2276. }
  2277. break;
  2278. case 'N' :
  2279. nonBlocking = 1;
  2280. break;
  2281. case 'r' :
  2282. resumeSession = 1;
  2283. break;
  2284. case 'w' :
  2285. wc_shutdown = 1;
  2286. break;
  2287. case 'R' :
  2288. #ifdef HAVE_SECURE_RENEGOTIATION
  2289. scr = 1;
  2290. #endif
  2291. break;
  2292. case 'i' :
  2293. #ifdef HAVE_SECURE_RENEGOTIATION
  2294. scr = 1;
  2295. forceScr = 1;
  2296. if (XSTRCMP(myoptarg, "scr-app-data") == 0) {
  2297. scrAppData = 1;
  2298. }
  2299. #endif
  2300. break;
  2301. case 'z' :
  2302. #ifndef WOLFSSL_LEANPSK
  2303. wolfSSL_GetObjectSize();
  2304. #endif
  2305. break;
  2306. case 'S' :
  2307. if (XSTRCMP(myoptarg, "check") == 0) {
  2308. #ifdef HAVE_SNI
  2309. printf("SNI is: ON\n");
  2310. #else
  2311. printf("SNI is: OFF\n");
  2312. #endif
  2313. XEXIT_T(EXIT_SUCCESS);
  2314. }
  2315. #ifdef HAVE_SNI
  2316. sniHostName = myoptarg;
  2317. #endif
  2318. break;
  2319. case 'F' :
  2320. #ifdef HAVE_MAX_FRAGMENT
  2321. maxFragment = (byte)atoi(myoptarg);
  2322. if (maxFragment < WOLFSSL_MFL_MIN ||
  2323. maxFragment > WOLFSSL_MFL_MAX) {
  2324. Usage();
  2325. XEXIT_T(MY_EX_USAGE);
  2326. }
  2327. #endif
  2328. break;
  2329. case 'T' :
  2330. #ifdef HAVE_TRUNCATED_HMAC
  2331. truncatedHMAC = 1;
  2332. #endif
  2333. break;
  2334. case 'n' :
  2335. #ifdef HAVE_EXTENDED_MASTER
  2336. disableExtMasterSecret = 1;
  2337. #endif
  2338. break;
  2339. case 'W' :
  2340. #if defined(HAVE_CERTIFICATE_STATUS_REQUEST) \
  2341. || defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
  2342. {
  2343. word32 myoptargSz;
  2344. statusRequest = (byte)atoi(myoptarg);
  2345. if (statusRequest > OCSP_STAPLING_OPT_MAX) {
  2346. Usage();
  2347. XEXIT_T(MY_EX_USAGE);
  2348. }
  2349. myoptargSz = (word32)XSTRLEN(myoptarg);
  2350. if (myoptargSz > 0 &&
  2351. XTOUPPER((unsigned char)myoptarg[myoptargSz-1]) == 'M') {
  2352. mustStaple = 1;
  2353. }
  2354. }
  2355. #endif
  2356. break;
  2357. case 'o' :
  2358. #ifdef HAVE_OCSP
  2359. useOcsp = 1;
  2360. #endif
  2361. break;
  2362. case 'O' :
  2363. #ifdef HAVE_OCSP
  2364. useOcsp = 1;
  2365. ocspUrl = myoptarg;
  2366. #endif
  2367. break;
  2368. case 'a' :
  2369. #ifdef HAVE_ANON
  2370. useAnon = 1;
  2371. #endif
  2372. break;
  2373. case 'L' :
  2374. #ifdef HAVE_ALPN
  2375. alpnList = myoptarg;
  2376. if (alpnList[0] == 'C' && alpnList[1] == ':')
  2377. alpn_opt = WOLFSSL_ALPN_CONTINUE_ON_MISMATCH;
  2378. else if (alpnList[0] == 'F' && alpnList[1] == ':')
  2379. alpn_opt = WOLFSSL_ALPN_FAILED_ON_MISMATCH;
  2380. else {
  2381. Usage();
  2382. XEXIT_T(MY_EX_USAGE);
  2383. }
  2384. alpnList += 2;
  2385. #endif
  2386. break;
  2387. case 'M' :
  2388. doSTARTTLS = 1;
  2389. starttlsProt = myoptarg;
  2390. if (XSTRCMP(starttlsProt, "smtp") != 0) {
  2391. Usage();
  2392. XEXIT_T(MY_EX_USAGE);
  2393. }
  2394. break;
  2395. case 'q' :
  2396. #ifdef HAVE_WNR
  2397. wnrConfigFile = myoptarg;
  2398. #endif
  2399. break;
  2400. case 'J' :
  2401. #ifdef WOLFSSL_TLS13
  2402. helloRetry = 1;
  2403. #endif
  2404. break;
  2405. case 'K' :
  2406. #ifdef WOLFSSL_TLS13
  2407. noPskDheKe = 1;
  2408. #endif
  2409. break;
  2410. case 'I' :
  2411. #ifdef WOLFSSL_TLS13
  2412. updateKeysIVs = 1;
  2413. #endif
  2414. break;
  2415. case 'y' :
  2416. #if defined(WOLFSSL_TLS13) && \
  2417. defined(HAVE_SUPPORTED_CURVES) && !defined(NO_DH)
  2418. onlyKeyShare = 1;
  2419. #endif
  2420. break;
  2421. case 'Y' :
  2422. #if defined(WOLFSSL_TLS13) && \
  2423. defined(HAVE_SUPPORTED_CURVES) && defined(HAVE_ECC)
  2424. onlyKeyShare = 2;
  2425. #endif
  2426. break;
  2427. case 'j' :
  2428. useVerifyCb = 1;
  2429. break;
  2430. case 't' :
  2431. #ifdef HAVE_CURVE25519
  2432. useX25519 = 1;
  2433. #ifdef HAVE_ECC
  2434. useSupCurve = 1;
  2435. #if defined(WOLFSSL_TLS13) && \
  2436. defined(HAVE_SUPPORTED_CURVES)
  2437. onlyKeyShare = 2;
  2438. #endif
  2439. #endif
  2440. #endif
  2441. break;
  2442. case 'Q' :
  2443. #if defined(WOLFSSL_TLS13) && \
  2444. defined(WOLFSSL_POST_HANDSHAKE_AUTH)
  2445. postHandAuth = 1;
  2446. #endif
  2447. break;
  2448. case '0' :
  2449. #ifdef WOLFSSL_EARLY_DATA
  2450. earlyData = 1;
  2451. #endif
  2452. break;
  2453. case '1' :
  2454. lng_index = atoi(myoptarg);
  2455. if(lng_index<0||lng_index>1){
  2456. lng_index = 0;
  2457. }
  2458. break;
  2459. case '2' :
  2460. #if !defined(NO_DH) && !defined(HAVE_FIPS) && \
  2461. !defined(HAVE_SELFTEST) && !defined(WOLFSSL_OLD_PRIME_CHECK)
  2462. doDhKeyCheck = 0;
  2463. #endif
  2464. break;
  2465. case '3' :
  2466. #ifdef WOLFSSL_MULTICAST
  2467. doMcast = 1;
  2468. mcastID = (byte)(atoi(myoptarg) & 0xFF);
  2469. #endif
  2470. break;
  2471. case '4' :
  2472. #ifdef HAVE_SECURE_RENEGOTIATION
  2473. scr = 1;
  2474. forceScr = 1;
  2475. resumeScr = 1;
  2476. #endif
  2477. break;
  2478. case '5' :
  2479. #ifdef HAVE_TRUSTED_CA
  2480. trustedCaKeyId = 1;
  2481. #endif /* HAVE_TRUSTED_CA */
  2482. break;
  2483. case '6' :
  2484. #ifdef WOLFSSL_ASYNC_IO
  2485. nonBlocking = 1;
  2486. simulateWantWrite = 1;
  2487. #else
  2488. LOG_ERROR("Ignoring -6 since async I/O support not "
  2489. "compiled in.\n");
  2490. #endif
  2491. break;
  2492. case '7' :
  2493. minVersion = atoi(myoptarg);
  2494. if (minVersion < 0 || minVersion > 4) {
  2495. Usage();
  2496. XEXIT_T(MY_EX_USAGE);
  2497. }
  2498. break;
  2499. case '8' :
  2500. #ifdef HAVE_CURVE448
  2501. useX448 = 1;
  2502. #ifdef HAVE_ECC
  2503. useSupCurve = 1;
  2504. #if defined(WOLFSSL_TLS13) && \
  2505. defined(HAVE_SUPPORTED_CURVES)
  2506. onlyKeyShare = 2;
  2507. #endif
  2508. #endif
  2509. #endif
  2510. break;
  2511. case '9' :
  2512. #if defined(OPENSSL_ALL) && defined(WOLFSSL_CERT_GEN) && \
  2513. (defined(WOLFSSL_CERT_REQ) || defined(WOLFSSL_CERT_EXT)) && \
  2514. !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR)
  2515. useCertFolder = 1;
  2516. #endif
  2517. break;
  2518. case '@' :
  2519. {
  2520. #ifdef HAVE_WC_INTROSPECTION
  2521. const char *conf_args = wolfSSL_configure_args();
  2522. if (conf_args) {
  2523. puts(conf_args);
  2524. XEXIT_T(EXIT_SUCCESS);
  2525. } else {
  2526. fputs("configure args not compiled in.\n",stderr);
  2527. XEXIT_T(MY_EX_USAGE);
  2528. }
  2529. #else
  2530. fputs("compiled without BUILD_INTROSPECTION.\n",stderr);
  2531. XEXIT_T(MY_EX_USAGE);
  2532. #endif
  2533. }
  2534. case '#' :
  2535. {
  2536. #ifdef HAVE_WC_INTROSPECTION
  2537. const char *cflags = wolfSSL_global_cflags();
  2538. if (cflags) {
  2539. puts(cflags);
  2540. XEXIT_T(EXIT_SUCCESS);
  2541. } else {
  2542. fputs("CFLAGS not compiled in.\n",stderr);
  2543. XEXIT_T(MY_EX_USAGE);
  2544. }
  2545. #else
  2546. fputs("compiled without BUILD_INTROSPECTION.\n",stderr);
  2547. XEXIT_T(MY_EX_USAGE);
  2548. #endif
  2549. }
  2550. #ifdef WOLFSSL_WOLFSENTRY_HOOKS
  2551. case 256:
  2552. #if !defined(NO_FILESYSTEM) && !defined(WOLFSENTRY_NO_JSON)
  2553. wolfsentry_config_path = myoptarg;
  2554. #endif
  2555. break;
  2556. #endif
  2557. #if defined(WOLFSSL_TLS13) && defined(HAVE_SUPPORTED_CURVES) && \
  2558. defined(HAVE_PQC)
  2559. case 259:
  2560. usePqc = 1;
  2561. onlyKeyShare = 3;
  2562. pqcAlg = myoptarg;
  2563. break;
  2564. #endif
  2565. #ifdef WOLFSSL_SYS_CA_CERTS
  2566. case 263:
  2567. loadSysCaCerts = 1;
  2568. break;
  2569. #endif
  2570. case 264:
  2571. #ifdef HAVE_SUPPORTED_CURVES
  2572. #ifdef WOLFSSL_TLS13
  2573. onlyPskDheKe = 1;
  2574. #endif
  2575. #endif
  2576. break;
  2577. case 265:
  2578. #ifndef NO_PSK
  2579. opensslPsk = 1;
  2580. #endif
  2581. break;
  2582. case 266:
  2583. quieter = 1;
  2584. break;
  2585. case 267:
  2586. #ifdef HAVE_RPK
  2587. useRPK = 1;
  2588. #endif /* HAVE_RPK */
  2589. break;
  2590. case 268:
  2591. fileFormat = WOLFSSL_FILETYPE_ASN1;
  2592. break;
  2593. default:
  2594. Usage();
  2595. XEXIT_T(MY_EX_USAGE);
  2596. }
  2597. }
  2598. myoptind = 0; /* reset for test cases */
  2599. #endif /* !WOLFSSL_VXWORKS */
  2600. if (externalTest) {
  2601. /* detect build cases that wouldn't allow test against wolfssl.com */
  2602. int done = 0;
  2603. #ifdef NO_RSA
  2604. done += 1; /* require RSA for external tests */
  2605. #endif
  2606. if (!XSTRCMP(domain, "www.globalsign.com")) {
  2607. /* www.globalsign.com does not respond to ipv6 ocsp requests */
  2608. #if defined(TEST_IPV6) && defined(HAVE_OCSP)
  2609. done += 1;
  2610. #endif
  2611. /* www.globalsign.com has limited supported cipher suites */
  2612. #if defined(NO_AES) && defined(HAVE_OCSP)
  2613. done += 1;
  2614. #endif
  2615. /* www.globalsign.com only supports static RSA or ECDHE with AES */
  2616. /* We cannot expect users to have on static RSA so test for ECC only
  2617. * as some users will most likely be on 32-bit systems where ECC
  2618. * is not enabled by default */
  2619. #if defined(HAVE_OCSP) && !defined(HAVE_ECC)
  2620. done += 1;
  2621. #endif
  2622. }
  2623. #ifndef NO_PSK
  2624. if (usePsk) {
  2625. done += 1; /* don't perform external tests if PSK is enabled */
  2626. }
  2627. #endif
  2628. #ifdef NO_SHA
  2629. done += 1; /* external cert chain most likely has SHA */
  2630. #endif
  2631. #if !defined(HAVE_ECC) && !defined(WOLFSSL_STATIC_RSA) \
  2632. || ( defined(HAVE_ECC) && !defined(HAVE_SUPPORTED_CURVES) \
  2633. && !defined(WOLFSSL_STATIC_RSA) )
  2634. /* google needs ECDHE+Supported Curves or static RSA */
  2635. if (!XSTRCASECMP(domain, "www.google.com"))
  2636. done += 1;
  2637. #endif
  2638. #if !defined(HAVE_ECC) && !defined(WOLFSSL_STATIC_RSA)
  2639. /* wolfssl needs ECDHE or static RSA */
  2640. if (!XSTRCASECMP(domain, "www.wolfssl.com"))
  2641. done += 1;
  2642. #endif
  2643. #if !defined(WOLFSSL_SHA384)
  2644. if (!XSTRCASECMP(domain, "www.wolfssl.com")) {
  2645. /* wolfssl need sha384 for cert chain verify */
  2646. done += 1;
  2647. }
  2648. #endif
  2649. #if !defined(HAVE_AESGCM) && defined(NO_AES) && \
  2650. !(defined(HAVE_CHACHA) && defined(HAVE_POLY1305))
  2651. /* need at least one of these for external tests */
  2652. done += 1;
  2653. #endif
  2654. /* For the external test, if we disable AES, GoDaddy will reject the
  2655. * connection. They only currently support AES suites, RC4 and 3DES
  2656. * suites. With AES disabled we only offer PolyChacha suites. */
  2657. #if defined(NO_AES) && !defined(HAVE_AESGCM)
  2658. if (!XSTRCASECMP(domain, "www.wolfssl.com")) {
  2659. done += 1;
  2660. }
  2661. #endif
  2662. if (done) {
  2663. LOG_ERROR("external test can't be run in this mode\n");
  2664. ((func_args*)args)->return_code = 0;
  2665. XEXIT_T(EXIT_SUCCESS);
  2666. }
  2667. }
  2668. /* sort out DTLS versus TLS versions */
  2669. if (version == CLIENT_INVALID_VERSION) {
  2670. if (doDTLS)
  2671. version = CLIENT_DTLS_DEFAULT_VERSION;
  2672. else
  2673. version = CLIENT_DEFAULT_VERSION;
  2674. }
  2675. else {
  2676. if (doDTLS) {
  2677. if (version == 3) {
  2678. version = -2;
  2679. }
  2680. #if defined(OPENSSL_EXTRA) || defined(WOLFSSL_EITHER_SIDE)
  2681. else if (version == EITHER_DOWNGRADE_VERSION) {
  2682. version = -3;
  2683. }
  2684. #endif
  2685. else if (version == 4) {
  2686. #ifdef WOLFSSL_DTLS13
  2687. version = -4;
  2688. #else
  2689. err_sys("Bad DTLS version");
  2690. #endif /* WOLFSSL_DTLS13 */
  2691. }
  2692. else if (version == 2)
  2693. version = -1;
  2694. }
  2695. }
  2696. #ifndef HAVE_SESSION_TICKET
  2697. if ((version >= 4) && resumeSession) {
  2698. LOG_ERROR("Can't do TLS 1.3 resumption; need session tickets!\n");
  2699. }
  2700. #endif
  2701. #ifdef HAVE_WNR
  2702. if (wc_InitNetRandom(wnrConfigFile, NULL, 5000) != 0)
  2703. err_sys("can't load whitewood net random config file");
  2704. #endif
  2705. #ifdef HAVE_PQC
  2706. if (usePqc) {
  2707. if (version == CLIENT_DOWNGRADE_VERSION ||
  2708. version == EITHER_DOWNGRADE_VERSION)
  2709. LOG_ERROR(
  2710. "WARNING: If a TLS 1.3 connection is not negotiated, you "
  2711. "will not be using a post-quantum group.\n");
  2712. else if (version != 4 && version != -4)
  2713. err_sys("can only use post-quantum groups with TLS 1.3 or DTLS 1.3");
  2714. }
  2715. #endif
  2716. switch (version) {
  2717. #ifndef NO_OLD_TLS
  2718. #ifdef WOLFSSL_ALLOW_SSLV3
  2719. case 0:
  2720. method = wolfSSLv3_client_method_ex;
  2721. break;
  2722. #endif
  2723. #ifndef NO_TLS
  2724. #ifdef WOLFSSL_ALLOW_TLSV10
  2725. case 1:
  2726. method = wolfTLSv1_client_method_ex;
  2727. break;
  2728. #endif
  2729. case 2:
  2730. method = wolfTLSv1_1_client_method_ex;
  2731. break;
  2732. #endif /* !NO_TLS */
  2733. #endif /* !NO_OLD_TLS */
  2734. #ifndef NO_TLS
  2735. #ifndef WOLFSSL_NO_TLS12
  2736. case 3:
  2737. method = wolfTLSv1_2_client_method_ex;
  2738. break;
  2739. #endif
  2740. #ifdef WOLFSSL_TLS13
  2741. case 4:
  2742. method = wolfTLSv1_3_client_method_ex;
  2743. break;
  2744. #endif
  2745. case CLIENT_DOWNGRADE_VERSION:
  2746. if (!doDTLS) {
  2747. method = wolfSSLv23_client_method_ex;
  2748. }
  2749. else {
  2750. #ifdef WOLFSSL_DTLS
  2751. method = wolfDTLS_client_method_ex;
  2752. #else
  2753. err_sys("version not supported");
  2754. #endif /* WOLFSSL_DTLS */
  2755. }
  2756. break;
  2757. #if defined(OPENSSL_EXTRA) || defined(WOLFSSL_EITHER_SIDE)
  2758. case EITHER_DOWNGRADE_VERSION:
  2759. method = wolfSSLv23_method_ex;
  2760. break;
  2761. #endif
  2762. #endif /* NO_TLS */
  2763. #ifdef WOLFSSL_DTLS
  2764. #ifndef NO_OLD_TLS
  2765. case -1:
  2766. method = wolfDTLSv1_client_method_ex;
  2767. break;
  2768. #endif
  2769. #ifndef WOLFSSL_NO_TLS12
  2770. case -2:
  2771. method = wolfDTLSv1_2_client_method_ex;
  2772. break;
  2773. #endif
  2774. #ifdef WOLFSSL_DTLS13
  2775. case -4:
  2776. method = wolfDTLSv1_3_client_method_ex;
  2777. break;
  2778. #endif /* WOLFSSL_DTLS13 */
  2779. #if defined(OPENSSL_EXTRA) || defined(WOLFSSL_EITHER_SIDE)
  2780. case -3:
  2781. method = wolfDTLSv1_2_method_ex;
  2782. break;
  2783. #endif
  2784. #endif
  2785. default:
  2786. err_sys("Bad SSL version");
  2787. }
  2788. if (method == NULL)
  2789. err_sys("unable to get method");
  2790. #ifdef WOLFSSL_STATIC_MEMORY
  2791. #if defined(DEBUG_WOLFSSL) && !defined(WOLFSSL_STATIC_MEMORY_LEAN)
  2792. /* print off helper buffer sizes for use with static memory
  2793. * printing to stderr in case of debug mode turned on */
  2794. LOG_ERROR("static memory management size = %d\n",
  2795. wolfSSL_MemoryPaddingSz());
  2796. LOG_ERROR("calculated optimum general buffer size = %d\n",
  2797. wolfSSL_StaticBufferSz(memory, sizeof(memory), 0));
  2798. LOG_ERROR("calculated optimum IO buffer size = %d\n",
  2799. wolfSSL_StaticBufferSz(memoryIO, sizeof(memoryIO),
  2800. WOLFMEM_IO_POOL_FIXED));
  2801. #endif /* DEBUG_WOLFSSL */
  2802. if (wc_LoadStaticMemory(&heap, memory, sizeof(memory), WOLFMEM_GENERAL, 1)
  2803. != 0) {
  2804. err_sys("unable to load static memory");
  2805. }
  2806. #if defined(WOLFSSL_STATIC_MEMORY) && \
  2807. defined(WOLFSSL_STATIC_MEMORY_DEBUG_CALLBACK)
  2808. wolfSSL_SetDebugMemoryCb(ExampleDebugMemoryCb);
  2809. #endif
  2810. ctx = wolfSSL_CTX_new_ex(method(heap), heap);
  2811. if (ctx == NULL)
  2812. err_sys("unable to get ctx");
  2813. #ifdef WOLFSSL_CALLBACKS
  2814. wolfSSL_CTX_set_msg_callback(ctx, msgDebugCb);
  2815. #endif
  2816. if (wolfSSL_CTX_load_static_memory(&ctx, NULL, memoryIO, sizeof(memoryIO),
  2817. WOLFMEM_IO_POOL_FIXED | WOLFMEM_TRACK_STATS, 1) != WOLFSSL_SUCCESS) {
  2818. err_sys("unable to load static memory");
  2819. }
  2820. #else
  2821. if (method != NULL) {
  2822. ctx = wolfSSL_CTX_new(method(NULL));
  2823. if (ctx == NULL)
  2824. err_sys("unable to get ctx");
  2825. }
  2826. #endif
  2827. #ifdef WOLFSSL_SYS_CA_CERTS
  2828. if (loadSysCaCerts &&
  2829. wolfSSL_CTX_load_system_CA_certs(ctx) != WOLFSSL_SUCCESS) {
  2830. err_sys("wolfSSL_CTX_load_system_CA_certs failed");
  2831. }
  2832. #endif /* WOLFSSL_SYS_CA_CERTS */
  2833. if (minVersion != CLIENT_INVALID_VERSION) {
  2834. #ifdef WOLFSSL_DTLS
  2835. if (doDTLS) {
  2836. switch (minVersion) {
  2837. case 4:
  2838. #ifdef WOLFSSL_DTLS13
  2839. minVersion = WOLFSSL_DTLSV1_3;
  2840. break;
  2841. #else
  2842. err_sys("invalid minimum downgrade version");
  2843. #endif /* WOLFSSL_DTLS13 */
  2844. case 3:
  2845. minVersion = WOLFSSL_DTLSV1_2;
  2846. break;
  2847. case 2:
  2848. minVersion = WOLFSSL_DTLSV1;
  2849. break;
  2850. }
  2851. }
  2852. #endif /* WOLFSSL_DTLS */
  2853. if (wolfSSL_CTX_SetMinVersion(ctx, minVersion) != WOLFSSL_SUCCESS)
  2854. err_sys("can't set minimum downgrade version");
  2855. }
  2856. if (simulateWantWrite) {
  2857. #ifdef USE_WOLFSSL_IO
  2858. wolfSSL_CTX_SetIOSend(ctx, SimulateWantWriteIOSendCb);
  2859. #endif
  2860. }
  2861. #ifdef SINGLE_THREADED
  2862. if (wolfSSL_CTX_new_rng(ctx) != WOLFSSL_SUCCESS) {
  2863. wolfSSL_CTX_free(ctx); ctx = NULL;
  2864. err_sys("Single Threaded new rng at CTX failed");
  2865. }
  2866. #endif
  2867. #ifdef OPENSSL_COMPATIBLE_DEFAULTS
  2868. /* Restore wolfSSL verify defaults */
  2869. if (ctx) {
  2870. wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_DEFAULT, NULL);
  2871. }
  2872. #endif
  2873. #ifdef WOLFSSL_SRTP
  2874. if (dtlsSrtpProfiles != NULL) {
  2875. if (wolfSSL_CTX_set_tlsext_use_srtp(ctx, dtlsSrtpProfiles)
  2876. != WOLFSSL_SUCCESS) {
  2877. err_sys("unable to set DTLS SRTP profile");
  2878. }
  2879. }
  2880. #endif
  2881. #ifdef WOLFSSL_WOLFSENTRY_HOOKS
  2882. if (wolfsentry_setup(&wolfsentry, wolfsentry_config_path,
  2883. WOLFSENTRY_ROUTE_FLAG_DIRECTION_OUT) < 0) {
  2884. err_sys("unable to initialize wolfSentry");
  2885. }
  2886. if (wolfSSL_CTX_set_ConnectFilter(
  2887. ctx,
  2888. (NetworkFilterCallback_t)wolfSentry_NetworkFilterCallback,
  2889. wolfsentry) < 0) {
  2890. err_sys("unable to install wolfSentry_NetworkFilterCallback");
  2891. }
  2892. #endif
  2893. if (cipherList && !useDefCipherList) {
  2894. if (wolfSSL_CTX_set_cipher_list(ctx, cipherList) != WOLFSSL_SUCCESS) {
  2895. wolfSSL_CTX_free(ctx); ctx = NULL;
  2896. err_sys("client can't set cipher list 1");
  2897. }
  2898. }
  2899. #ifdef WOLFSSL_LEANPSK
  2900. if (!usePsk) {
  2901. usePsk = 1;
  2902. }
  2903. #endif
  2904. #if defined(NO_RSA) && !defined(HAVE_ECC) && !defined(HAVE_ED25519) && \
  2905. !defined(HAVE_ED448)
  2906. if (!usePsk) {
  2907. usePsk = 1;
  2908. }
  2909. #endif
  2910. if (fewerPackets)
  2911. wolfSSL_CTX_set_group_messages(ctx);
  2912. #if (defined(WOLFSSL_SCTP) || defined(WOLFSSL_DTLS_MTU)) && \
  2913. defined(WOLFSSL_DTLS)
  2914. if (dtlsMTU)
  2915. wolfSSL_CTX_dtls_set_mtu(ctx, dtlsMTU);
  2916. #endif
  2917. #ifndef NO_DH
  2918. if (wolfSSL_CTX_SetMinDhKey_Sz(ctx, (word16)minDhKeyBits)
  2919. != WOLFSSL_SUCCESS) {
  2920. err_sys("Error setting minimum DH key size");
  2921. }
  2922. #endif
  2923. #ifdef HAVE_RPK
  2924. if (useRPK) {
  2925. char ctype[] = {WOLFSSL_CERT_TYPE_RPK};
  2926. char stype[] = {WOLFSSL_CERT_TYPE_RPK};
  2927. wolfSSL_CTX_set_client_cert_type(ctx, ctype, sizeof(ctype)/sizeof(ctype[0]));
  2928. wolfSSL_CTX_set_server_cert_type(ctx, stype, sizeof(stype)/sizeof(stype[0]));
  2929. usePsk = 0;
  2930. #ifdef HAVE_CRL
  2931. disableCRL = 1;
  2932. #endif
  2933. doPeerCheck = 0;
  2934. }
  2935. #endif /* HAVE_RPK */
  2936. if (usePsk) {
  2937. #ifndef NO_PSK
  2938. const char *defaultCipherList = cipherList;
  2939. wolfSSL_CTX_set_psk_client_callback(ctx, my_psk_client_cb);
  2940. #ifdef WOLFSSL_TLS13
  2941. #if !defined(WOLFSSL_PSK_TLS13_CB) && !defined(WOLFSSL_PSK_ONE_ID)
  2942. if (!opensslPsk) {
  2943. wolfSSL_CTX_set_psk_client_cs_callback(ctx, my_psk_client_cs_cb);
  2944. }
  2945. else
  2946. #endif
  2947. {
  2948. wolfSSL_CTX_set_psk_client_tls13_callback(ctx,
  2949. my_psk_client_tls13_cb);
  2950. }
  2951. #endif
  2952. if (defaultCipherList == NULL) {
  2953. #if defined(HAVE_AESGCM) && !defined(NO_DH)
  2954. #ifdef WOLFSSL_TLS13
  2955. defaultCipherList = "TLS13-AES128-GCM-SHA256"
  2956. #ifndef WOLFSSL_NO_TLS12
  2957. ":DHE-PSK-AES128-GCM-SHA256"
  2958. #endif
  2959. ;
  2960. #else
  2961. defaultCipherList = "DHE-PSK-AES128-GCM-SHA256";
  2962. #endif
  2963. #elif defined(HAVE_AESGCM) && defined(WOLFSSL_TLS13)
  2964. defaultCipherList = "TLS13-AES128-GCM-SHA256"
  2965. #ifndef WOLFSSL_NO_TLS12
  2966. ":PSK-AES128-GCM-SHA256"
  2967. #endif
  2968. ;
  2969. #elif defined(HAVE_NULL_CIPHER)
  2970. defaultCipherList = "PSK-NULL-SHA256";
  2971. #elif !defined(NO_AES_CBC)
  2972. defaultCipherList = "PSK-AES128-CBC-SHA256";
  2973. #else
  2974. defaultCipherList = "PSK-AES128-GCM-SHA256";
  2975. #endif
  2976. if (wolfSSL_CTX_set_cipher_list(ctx, defaultCipherList)
  2977. !=WOLFSSL_SUCCESS) {
  2978. wolfSSL_CTX_free(ctx); ctx = NULL;
  2979. err_sys("client can't set cipher list 2");
  2980. }
  2981. }
  2982. wolfSSL_CTX_set_psk_callback_ctx(ctx, (void*)defaultCipherList);
  2983. #endif
  2984. if (useClientCert) {
  2985. useClientCert = 0;
  2986. }
  2987. }
  2988. if (useAnon) {
  2989. #ifdef HAVE_ANON
  2990. if (cipherList == NULL || (cipherList && useDefCipherList)) {
  2991. const char* defaultCipherList;
  2992. wolfSSL_CTX_allow_anon_cipher(ctx);
  2993. defaultCipherList = "ADH-AES256-GCM-SHA384:"
  2994. "ADH-AES128-SHA";
  2995. if (wolfSSL_CTX_set_cipher_list(ctx,defaultCipherList)
  2996. != WOLFSSL_SUCCESS) {
  2997. wolfSSL_CTX_free(ctx); ctx = NULL;
  2998. err_sys("client can't set cipher list 4");
  2999. }
  3000. }
  3001. #endif
  3002. if (useClientCert) {
  3003. useClientCert = 0;
  3004. }
  3005. }
  3006. #ifdef WOLFSSL_SCTP
  3007. if (dtlsSCTP)
  3008. wolfSSL_CTX_dtls_set_sctp(ctx);
  3009. #endif
  3010. #ifdef WOLFSSL_ENCRYPTED_KEYS
  3011. wolfSSL_CTX_set_default_passwd_cb(ctx, PasswordCallBack);
  3012. #endif
  3013. #ifdef WOLFSSL_SNIFFER
  3014. if (cipherList == NULL && version < 4) {
  3015. /* static RSA or ECC cipher suites */
  3016. const char* staticCipherList = "AES128-SHA:ECDH-ECDSA-AES128-SHA";
  3017. if (wolfSSL_CTX_set_cipher_list(ctx, staticCipherList) != WOLFSSL_SUCCESS) {
  3018. wolfSSL_CTX_free(ctx); ctx = NULL;
  3019. err_sys("client can't set cipher list 3");
  3020. }
  3021. }
  3022. #endif
  3023. #ifdef HAVE_OCSP
  3024. if (useOcsp) {
  3025. #if defined(HAVE_IO_TIMEOUT) && defined(HAVE_HTTP_CLIENT)
  3026. wolfIO_SetTimeout(DEFAULT_TIMEOUT_SEC);
  3027. #endif
  3028. if (ocspUrl != NULL) {
  3029. wolfSSL_CTX_SetOCSP_OverrideURL(ctx, ocspUrl);
  3030. wolfSSL_CTX_EnableOCSP(ctx, WOLFSSL_OCSP_NO_NONCE
  3031. | WOLFSSL_OCSP_URL_OVERRIDE);
  3032. }
  3033. else {
  3034. wolfSSL_CTX_EnableOCSP(ctx, WOLFSSL_OCSP_CHECKALL);
  3035. }
  3036. #ifdef WOLFSSL_NONBLOCK_OCSP
  3037. wolfSSL_CTX_SetOCSP_Cb(ctx, OCSPIOCb, OCSPRespFreeCb, NULL);
  3038. #endif
  3039. }
  3040. #endif
  3041. #ifdef USER_CA_CB
  3042. wolfSSL_CTX_SetCACb(ctx, CaCb);
  3043. #endif
  3044. #if defined(HAVE_EXT_CACHE) && !defined(NO_SESSION_CACHE)
  3045. wolfSSL_CTX_sess_set_get_cb(ctx, mySessGetCb);
  3046. wolfSSL_CTX_sess_set_new_cb(ctx, mySessNewCb);
  3047. wolfSSL_CTX_sess_set_remove_cb(ctx, mySessRemCb);
  3048. #endif
  3049. #ifndef NO_CERTS
  3050. if (useClientCert && !loadCertKeyIntoSSLObj){
  3051. #if defined(NO_FILESYSTEM) && defined(USE_CERT_BUFFERS_2048)
  3052. if (wolfSSL_CTX_use_certificate_chain_buffer_format(ctx,
  3053. client_cert_der_2048, sizeof_client_cert_der_2048,
  3054. WOLFSSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS)
  3055. err_sys("can't load client cert buffer");
  3056. #elif !defined(TEST_LOAD_BUFFER)
  3057. if (wolfSSL_CTX_use_certificate_chain_file_format(ctx, ourCert, fileFormat)
  3058. != WOLFSSL_SUCCESS) {
  3059. wolfSSL_CTX_free(ctx); ctx = NULL;
  3060. err_sys("can't load client cert file, check file and run from"
  3061. " wolfSSL home dir");
  3062. }
  3063. #else
  3064. load_buffer(ctx, ourCert, WOLFSSL_CERT_CHAIN);
  3065. #endif
  3066. }
  3067. #ifdef HAVE_PK_CALLBACKS
  3068. pkCbInfo.ourKey = ourKey;
  3069. #endif
  3070. if (useClientCert && !loadCertKeyIntoSSLObj
  3071. #if defined(HAVE_PK_CALLBACKS) && defined(TEST_PK_PRIVKEY)
  3072. && !pkCallbacks
  3073. #endif
  3074. ) {
  3075. #ifdef NO_FILESYSTEM
  3076. if (wolfSSL_CTX_use_PrivateKey_buffer(ctx, client_key_der_2048,
  3077. sizeof_client_key_der_2048, SSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS)
  3078. err_sys("can't load client private key buffer");
  3079. #elif !defined(TEST_LOAD_BUFFER)
  3080. if (wolfSSL_CTX_use_PrivateKey_file(ctx, ourKey, fileFormat)
  3081. != WOLFSSL_SUCCESS) {
  3082. wolfSSL_CTX_free(ctx); ctx = NULL;
  3083. err_sys("can't load client private key file, check file and run "
  3084. "from wolfSSL home dir");
  3085. }
  3086. #else
  3087. load_buffer(ctx, ourKey, WOLFSSL_KEY);
  3088. #endif
  3089. }
  3090. if (!usePsk && !useAnon && !useVerifyCb && myVerifyAction != VERIFY_FORCE_FAIL) {
  3091. #if defined(OPENSSL_ALL) && defined(WOLFSSL_CERT_GEN) && \
  3092. (defined(WOLFSSL_CERT_REQ) || defined(WOLFSSL_CERT_EXT)) && \
  3093. !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR)
  3094. if (useCertFolder) {
  3095. WOLFSSL_X509_STORE *store;
  3096. WOLFSSL_X509_LOOKUP *lookup;
  3097. store = wolfSSL_CTX_get_cert_store(ctx);
  3098. if (store == NULL) {
  3099. wolfSSL_CTX_free(ctx); ctx = NULL;
  3100. err_sys("can't get WOLFSSL_X509_STORE");
  3101. }
  3102. lookup = wolfSSL_X509_STORE_add_lookup(store, X509_LOOKUP_hash_dir());
  3103. if (lookup == NULL) {
  3104. wolfSSL_CTX_free(ctx); ctx = NULL;
  3105. err_sys("can't add lookup");
  3106. }
  3107. if (wolfSSL_X509_LOOKUP_ctrl(lookup, WOLFSSL_X509_L_ADD_DIR, caCertFolder,
  3108. X509_FILETYPE_PEM, NULL) != WOLFSSL_SUCCESS) {
  3109. err_sys("X509_LOOKUP_ctrl w/ L_ADD_DIR failed");
  3110. }
  3111. } else {
  3112. #endif
  3113. #ifdef NO_FILESYSTEM
  3114. if (wolfSSL_CTX_load_verify_buffer(ctx, ca_cert_der_2048,
  3115. sizeof_ca_cert_der_2048, SSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS) {
  3116. wolfSSL_CTX_free(ctx); ctx = NULL;
  3117. err_sys("can't load ca buffer, Please run from wolfSSL home dir");
  3118. }
  3119. #elif !defined(TEST_LOAD_BUFFER)
  3120. unsigned int verify_flags = 0;
  3121. #ifdef TEST_BEFORE_DATE
  3122. verify_flags |= WOLFSSL_LOAD_FLAG_DATE_ERR_OKAY;
  3123. #endif
  3124. if (doPeerCheck != 0 &&
  3125. wolfSSL_CTX_load_verify_locations_ex(ctx, verifyCert, 0, verify_flags)
  3126. != WOLFSSL_SUCCESS) {
  3127. wolfSSL_CTX_free(ctx); ctx = NULL;
  3128. err_sys("can't load ca file, Please run from wolfSSL home dir");
  3129. }
  3130. #else
  3131. load_buffer(ctx, verifyCert, WOLFSSL_CA);
  3132. #endif /* !NO_FILESYSTEM */
  3133. #ifdef HAVE_ECC
  3134. /* load ecc verify too, echoserver uses it by default w/ ecc */
  3135. #ifdef NO_FILESYSTEM
  3136. if (doPeerCheck != 0 &&
  3137. wolfSSL_CTX_load_verify_buffer(ctx, ca_ecc_cert_der_256,
  3138. sizeof_ca_ecc_cert_der_256, SSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS) {
  3139. wolfSSL_CTX_free(ctx); ctx = NULL;
  3140. err_sys("can't load ecc ca buffer");
  3141. }
  3142. #elif !defined(TEST_LOAD_BUFFER)
  3143. if (doPeerCheck != 0 && !customVerifyCert &&
  3144. wolfSSL_CTX_load_verify_locations_ex(ctx, eccCertFile, 0, verify_flags)
  3145. != WOLFSSL_SUCCESS) {
  3146. wolfSSL_CTX_free(ctx); ctx = NULL;
  3147. err_sys("can't load ecc ca file, Please run from wolfSSL home dir");
  3148. }
  3149. #else
  3150. load_buffer(ctx, eccCertFile, WOLFSSL_CA);
  3151. #endif /* !TEST_LOAD_BUFFER */
  3152. #endif /* HAVE_ECC */
  3153. #if defined(WOLFSSL_TRUST_PEER_CERT) && !defined(NO_FILESYSTEM)
  3154. if (trustCert) {
  3155. if (wolfSSL_CTX_trust_peer_cert(ctx, trustCert,
  3156. WOLFSSL_FILETYPE_PEM) != WOLFSSL_SUCCESS) {
  3157. wolfSSL_CTX_free(ctx); ctx = NULL;
  3158. err_sys("can't load trusted peer cert file");
  3159. }
  3160. }
  3161. #endif /* WOLFSSL_TRUST_PEER_CERT && !NO_FILESYSTEM */
  3162. #if defined(OPENSSL_ALL) && defined(WOLFSSL_CERT_GEN) && \
  3163. (defined(WOLFSSL_CERT_REQ) || defined(WOLFSSL_CERT_EXT)) && \
  3164. !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR)
  3165. }
  3166. #endif
  3167. }
  3168. if (useVerifyCb || myVerifyAction == VERIFY_FORCE_FAIL ||
  3169. myVerifyAction == VERIFY_USE_PREVERFIY) {
  3170. wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_PEER, myVerify);
  3171. }
  3172. else if (!usePsk && !useAnon && doPeerCheck == 0) {
  3173. wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_NONE, NULL);
  3174. }
  3175. else if (!usePsk && !useAnon && myVerifyAction == VERIFY_OVERRIDE_DATE_ERR) {
  3176. wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_PEER, myVerify);
  3177. }
  3178. #endif /* !NO_CERTS */
  3179. #ifdef WOLFSSL_ASYNC_CRYPT
  3180. ret = wolfAsync_DevOpen(&devId);
  3181. if (ret < 0) {
  3182. LOG_ERROR("Async device open failed\nRunning without async\n");
  3183. }
  3184. wolfSSL_CTX_SetDevId(ctx, devId);
  3185. #endif /* WOLFSSL_ASYNC_CRYPT */
  3186. #ifdef HAVE_SNI
  3187. if (sniHostName) {
  3188. if (wolfSSL_CTX_UseSNI(ctx, WOLFSSL_SNI_HOST_NAME, sniHostName,
  3189. (word16) XSTRLEN(sniHostName)) != WOLFSSL_SUCCESS) {
  3190. wolfSSL_CTX_free(ctx); ctx = NULL;
  3191. err_sys("UseSNI failed");
  3192. }
  3193. }
  3194. #endif
  3195. #ifdef HAVE_MAX_FRAGMENT
  3196. if (maxFragment)
  3197. if (wolfSSL_CTX_UseMaxFragment(ctx, maxFragment) != WOLFSSL_SUCCESS) {
  3198. wolfSSL_CTX_free(ctx); ctx = NULL;
  3199. err_sys("UseMaxFragment failed");
  3200. }
  3201. #endif
  3202. #ifdef HAVE_TRUNCATED_HMAC
  3203. if (truncatedHMAC)
  3204. if (wolfSSL_CTX_UseTruncatedHMAC(ctx) != WOLFSSL_SUCCESS) {
  3205. wolfSSL_CTX_free(ctx); ctx = NULL;
  3206. err_sys("UseTruncatedHMAC failed");
  3207. }
  3208. #endif
  3209. #ifdef HAVE_SESSION_TICKET
  3210. if (wolfSSL_CTX_UseSessionTicket(ctx) != WOLFSSL_SUCCESS) {
  3211. wolfSSL_CTX_free(ctx); ctx = NULL;
  3212. err_sys("UseSessionTicket failed");
  3213. }
  3214. #endif
  3215. #ifdef HAVE_EXTENDED_MASTER
  3216. if (disableExtMasterSecret)
  3217. if (wolfSSL_CTX_DisableExtendedMasterSecret(ctx) != WOLFSSL_SUCCESS) {
  3218. wolfSSL_CTX_free(ctx); ctx = NULL;
  3219. err_sys("DisableExtendedMasterSecret failed");
  3220. }
  3221. #endif
  3222. #if defined(HAVE_SUPPORTED_CURVES)
  3223. #if defined(HAVE_CURVE25519)
  3224. if (useX25519) {
  3225. if (wolfSSL_CTX_UseSupportedCurve(ctx, WOLFSSL_ECC_X25519)
  3226. != WOLFSSL_SUCCESS) {
  3227. err_sys("unable to support X25519");
  3228. }
  3229. }
  3230. #endif /* HAVE_CURVE25519 */
  3231. #if defined(HAVE_CURVE448)
  3232. if (useX448) {
  3233. if (wolfSSL_CTX_UseSupportedCurve(ctx, WOLFSSL_ECC_X448)
  3234. != WOLFSSL_SUCCESS) {
  3235. err_sys("unable to support X448");
  3236. }
  3237. }
  3238. #endif /* HAVE_CURVE448 */
  3239. #ifdef HAVE_ECC
  3240. if (useSupCurve) {
  3241. #if !defined(NO_ECC_SECP) && \
  3242. (defined(HAVE_ECC384) || defined(HAVE_ALL_CURVES))
  3243. if (wolfSSL_CTX_UseSupportedCurve(ctx, WOLFSSL_ECC_SECP384R1)
  3244. != WOLFSSL_SUCCESS) {
  3245. err_sys("unable to support secp384r1");
  3246. }
  3247. #endif
  3248. #if !defined(NO_ECC_SECP) && \
  3249. (!defined(NO_ECC256) || defined(HAVE_ALL_CURVES))
  3250. if (wolfSSL_CTX_UseSupportedCurve(ctx, WOLFSSL_ECC_SECP256R1)
  3251. != WOLFSSL_SUCCESS) {
  3252. err_sys("unable to support secp256r1");
  3253. }
  3254. #endif
  3255. }
  3256. #endif /* HAVE_ECC */
  3257. #ifdef HAVE_FFDHE_2048
  3258. if (useSupCurve) {
  3259. if (wolfSSL_CTX_UseSupportedCurve(ctx, WOLFSSL_FFDHE_2048)
  3260. != WOLFSSL_SUCCESS) {
  3261. err_sys("unable to support FFDHE 2048");
  3262. }
  3263. }
  3264. #endif
  3265. #endif /* HAVE_SUPPORTED_CURVES */
  3266. #ifdef WOLFSSL_TLS13
  3267. if (noPskDheKe)
  3268. wolfSSL_CTX_no_dhe_psk(ctx);
  3269. #ifdef HAVE_SUPPORTED_CURVES
  3270. if (onlyPskDheKe)
  3271. wolfSSL_CTX_only_dhe_psk(ctx);
  3272. #endif
  3273. #endif
  3274. #if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH)
  3275. if (postHandAuth)
  3276. wolfSSL_CTX_allow_post_handshake_auth(ctx);
  3277. #endif
  3278. if (benchmark) {
  3279. ((func_args*)args)->return_code =
  3280. ClientBenchmarkConnections(ctx, host, port, dtlsUDP, dtlsSCTP,
  3281. benchmark, resumeSession, useX25519,
  3282. useX448, usePqc, pqcAlg, helloRetry,
  3283. onlyKeyShare, version, earlyData);
  3284. wolfSSL_CTX_free(ctx); ctx = NULL;
  3285. XEXIT_T(EXIT_SUCCESS);
  3286. }
  3287. if (throughput) {
  3288. ((func_args*)args)->return_code =
  3289. ClientBenchmarkThroughput(ctx, host, port, dtlsUDP, dtlsSCTP,
  3290. block, throughput, useX25519, useX448,
  3291. usePqc, pqcAlg, exitWithRet, version,
  3292. onlyKeyShare);
  3293. wolfSSL_CTX_free(ctx); ctx = NULL;
  3294. if (((func_args*)args)->return_code != EXIT_SUCCESS && !exitWithRet)
  3295. XEXIT_T(EXIT_SUCCESS);
  3296. else
  3297. goto exit;
  3298. }
  3299. #if defined(WOLFSSL_MDK_ARM)
  3300. wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_NONE, NULL);
  3301. #endif
  3302. #if defined(OPENSSL_EXTRA)
  3303. if (wolfSSL_CTX_get_read_ahead(ctx) != 0) {
  3304. wolfSSL_CTX_free(ctx); ctx = NULL;
  3305. err_sys("bad read ahead default value");
  3306. }
  3307. if (wolfSSL_CTX_set_read_ahead(ctx, 1) != WOLFSSL_SUCCESS) {
  3308. wolfSSL_CTX_free(ctx); ctx = NULL;
  3309. err_sys("error setting read ahead value");
  3310. }
  3311. #endif
  3312. #if defined(WOLFSSL_STATIC_MEMORY) && defined(DEBUG_WOLFSSL) && \
  3313. !defined(WOLFSSL_STATIC_MEMORY_LEAN)
  3314. LOG_ERROR("Before creating SSL\n");
  3315. if (wolfSSL_CTX_is_static_memory(ctx, &mem_stats) != 1)
  3316. err_sys("ctx not using static memory");
  3317. if (wolfSSL_PrintStats(&mem_stats) != 1) /* function in test.h */
  3318. err_sys("error printing out memory stats");
  3319. #endif
  3320. if (doMcast) {
  3321. #ifdef WOLFSSL_MULTICAST
  3322. wolfSSL_CTX_mcast_set_member_id(ctx, mcastID);
  3323. if (wolfSSL_CTX_set_cipher_list(ctx, "WDM-NULL-SHA256")
  3324. != WOLFSSL_SUCCESS) {
  3325. wolfSSL_CTX_free(ctx); ctx = NULL;
  3326. err_sys("Couldn't set multicast cipher list.");
  3327. }
  3328. #endif
  3329. }
  3330. #ifdef HAVE_PK_CALLBACKS
  3331. if (pkCallbacks)
  3332. SetupPkCallbacks(ctx);
  3333. #endif
  3334. ssl = wolfSSL_new(ctx);
  3335. if (ssl == NULL) {
  3336. wolfSSL_CTX_free(ctx); ctx = NULL;
  3337. err_sys("unable to get SSL object");
  3338. }
  3339. #ifdef WOLFSSL_DUAL_ALG_CERTS
  3340. if (!wolfSSL_UseCKS(ssl, cks_order, sizeof(cks_order))) {
  3341. wolfSSL_CTX_free(ctx); ctx = NULL;
  3342. err_sys("unable to set the CKS order.");
  3343. }
  3344. #endif /* WOLFSSL_DUAL_ALG_CERTS */
  3345. #ifndef NO_PSK
  3346. if (usePsk) {
  3347. #if defined(OPENSSL_EXTRA) && defined(WOLFSSL_TLS13) && defined(TEST_PSK_USE_SESSION)
  3348. SSL_set_psk_use_session_callback(ssl, my_psk_use_session_cb);
  3349. #endif
  3350. }
  3351. #endif
  3352. #ifndef NO_CERTS
  3353. if (useClientCert && loadCertKeyIntoSSLObj){
  3354. #ifdef NO_FILESYSTEM
  3355. if (wolfSSL_use_certificate_buffer(ssl, client_cert_der_2048,
  3356. sizeof_client_cert_der_2048, SSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS) {
  3357. wolfSSL_CTX_free(ctx); ctx = NULL;
  3358. err_sys("can't load client cert buffer");
  3359. }
  3360. #elif !defined(TEST_LOAD_BUFFER)
  3361. if (wolfSSL_use_certificate_chain_file_format(ssl, ourCert, fileFormat)
  3362. != WOLFSSL_SUCCESS) {
  3363. wolfSSL_CTX_free(ctx); ctx = NULL;
  3364. err_sys("can't load client cert file, check file and run from"
  3365. " wolfSSL home dir");
  3366. }
  3367. #else
  3368. load_ssl_buffer(ssl, ourCert, WOLFSSL_CERT_CHAIN);
  3369. #endif
  3370. }
  3371. if (loadCertKeyIntoSSLObj
  3372. #if defined(HAVE_PK_CALLBACKS) && defined(TEST_PK_PRIVKEY)
  3373. && !pkCallbacks
  3374. #endif
  3375. ) {
  3376. #ifdef NO_FILESYSTEM
  3377. if (wolfSSL_CTX_use_PrivateKey_buffer(ctx, client_key_der_2048,
  3378. sizeof_client_key_der_2048, SSL_FILETYPE_ASN1) != WOLFSSL_SUCCESS)
  3379. err_sys("can't load client private key buffer");
  3380. #elif !defined(TEST_LOAD_BUFFER)
  3381. if (wolfSSL_use_PrivateKey_file(ssl, ourKey, fileFormat)
  3382. != WOLFSSL_SUCCESS) {
  3383. wolfSSL_CTX_free(ctx); ctx = NULL;
  3384. err_sys("can't load client private key file, check file and run "
  3385. "from wolfSSL home dir");
  3386. }
  3387. #else
  3388. load_ssl_buffer(ssl, ourKey, WOLFSSL_KEY);
  3389. #endif
  3390. }
  3391. #endif /* !NO_CERTS */
  3392. #if defined(OPENSSL_EXTRA) || defined(HAVE_SECRET_CALLBACK)
  3393. wolfSSL_KeepArrays(ssl);
  3394. #endif
  3395. #ifdef HAVE_PK_CALLBACKS
  3396. /* This must be before SetKeyShare */
  3397. if (pkCallbacks) {
  3398. SetupPkCallbackContexts(ssl, &pkCbInfo);
  3399. }
  3400. #endif
  3401. #if defined(WOLFSSL_STATIC_MEMORY) && defined(DEBUG_WOLFSSL) && \
  3402. !defined(WOLFSSL_STATIC_MEMORY_LEAN)
  3403. LOG_ERROR("After creating SSL\n");
  3404. if (wolfSSL_CTX_is_static_memory(ctx, &mem_stats) != 1)
  3405. err_sys("ctx not using static memory");
  3406. if (wolfSSL_PrintStats(&mem_stats) != 1) /* function in test.h */
  3407. err_sys("error printing out memory stats");
  3408. #endif
  3409. #if defined(WOLFSSL_TLS13) && defined(HAVE_SUPPORTED_CURVES)
  3410. if (!helloRetry && (version >= 4 || version <= -4)) {
  3411. SetKeyShare(ssl, onlyKeyShare, useX25519, useX448, usePqc,
  3412. pqcAlg, 0);
  3413. }
  3414. else {
  3415. wolfSSL_NoKeyShares(ssl);
  3416. }
  3417. #endif
  3418. if (doMcast) {
  3419. #ifdef WOLFSSL_MULTICAST
  3420. /* DTLS multicast secret for testing only */
  3421. #define CLI_SRV_RANDOM_SZ 32 /* RAN_LEN (see internal.h) */
  3422. #define PMS_SZ 512 /* ENCRYPT_LEN (see internal.h) */
  3423. byte pms[PMS_SZ]; /* pre master secret */
  3424. byte cr[CLI_SRV_RANDOM_SZ]; /* client random */
  3425. byte sr[CLI_SRV_RANDOM_SZ]; /* server random */
  3426. const byte suite[2] = {0, 0xfe}; /* WDM_WITH_NULL_SHA256 */
  3427. XMEMSET(pms, 0x23, sizeof(pms));
  3428. XMEMSET(cr, 0xA5, sizeof(cr));
  3429. XMEMSET(sr, 0x5A, sizeof(sr));
  3430. if (wolfSSL_set_secret(ssl, 1, pms, sizeof(pms), cr, sr, suite)
  3431. != WOLFSSL_SUCCESS) {
  3432. wolfSSL_CTX_free(ctx); ctx = NULL;
  3433. err_sys("unable to set mcast secret");
  3434. }
  3435. #endif
  3436. }
  3437. #ifdef HAVE_SESSION_TICKET
  3438. wolfSSL_set_SessionTicket_cb(ssl, sessionTicketCB, (void*)"initial session");
  3439. #endif
  3440. #ifdef HAVE_TRUSTED_CA
  3441. if (trustedCaKeyId) {
  3442. if (wolfSSL_UseTrustedCA(ssl, WOLFSSL_TRUSTED_CA_PRE_AGREED,
  3443. NULL, 0) != WOLFSSL_SUCCESS) {
  3444. err_sys("UseTrustedCA failed");
  3445. }
  3446. }
  3447. #endif
  3448. #ifdef HAVE_ALPN
  3449. if (alpnList != NULL) {
  3450. printf("ALPN accepted protocols list : %s\n", alpnList);
  3451. wolfSSL_UseALPN(ssl, alpnList, (word32)XSTRLEN(alpnList), alpn_opt);
  3452. }
  3453. #endif
  3454. #if defined(HAVE_CERTIFICATE_STATUS_REQUEST) || \
  3455. defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
  3456. if (statusRequest) {
  3457. if (version == 4 &&
  3458. (statusRequest == OCSP_STAPLINGV2 || \
  3459. statusRequest == OCSP_STAPLINGV2_MULTI)) {
  3460. err_sys("Cannot use OCSP Stapling V2 with TLSv1.3");
  3461. }
  3462. if (wolfSSL_CTX_EnableOCSPStapling(ctx) != WOLFSSL_SUCCESS)
  3463. err_sys("can't enable OCSP Stapling Certificate Manager");
  3464. if (mustStaple) {
  3465. if (wolfSSL_CTX_EnableOCSPMustStaple(ctx) != WOLFSSL_SUCCESS)
  3466. err_sys("can't enable OCSP Must Staple");
  3467. }
  3468. switch (statusRequest) {
  3469. #ifdef HAVE_CERTIFICATE_STATUS_REQUEST
  3470. case OCSP_STAPLING:
  3471. if (wolfSSL_UseOCSPStapling(ssl, WOLFSSL_CSR_OCSP,
  3472. WOLFSSL_CSR_OCSP_USE_NONCE) != WOLFSSL_SUCCESS) {
  3473. wolfSSL_free(ssl); ssl = NULL;
  3474. CloseSocket(sockfd);
  3475. wolfSSL_CTX_free(ctx); ctx = NULL;
  3476. err_sys("UseCertificateStatusRequest failed");
  3477. }
  3478. break;
  3479. #endif
  3480. #ifdef HAVE_CERTIFICATE_STATUS_REQUEST_V2
  3481. case OCSP_STAPLINGV2:
  3482. if (wolfSSL_UseOCSPStaplingV2(ssl,
  3483. WOLFSSL_CSR2_OCSP, WOLFSSL_CSR2_OCSP_USE_NONCE)
  3484. != WOLFSSL_SUCCESS) {
  3485. wolfSSL_free(ssl); ssl = NULL;
  3486. CloseSocket(sockfd);
  3487. wolfSSL_CTX_free(ctx); ctx = NULL;
  3488. err_sys("UseCertificateStatusRequest failed");
  3489. }
  3490. break;
  3491. case OCSP_STAPLINGV2_MULTI:
  3492. if (wolfSSL_UseOCSPStaplingV2(ssl,
  3493. WOLFSSL_CSR2_OCSP_MULTI, 0)
  3494. != WOLFSSL_SUCCESS) {
  3495. wolfSSL_free(ssl); ssl = NULL;
  3496. CloseSocket(sockfd);
  3497. wolfSSL_CTX_free(ctx); ctx = NULL;
  3498. err_sys("UseCertificateStatusRequest failed");
  3499. }
  3500. break;
  3501. #endif
  3502. default:
  3503. err_sys("Invalid OCSP Stapling option");
  3504. }
  3505. wolfSSL_CTX_EnableOCSP(ctx, 0);
  3506. }
  3507. #endif
  3508. #if !defined(NO_DH) && !defined(WOLFSSL_OLD_PRIME_CHECK) && \
  3509. !defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)
  3510. if (!doDhKeyCheck)
  3511. wolfSSL_SetEnableDhKeyTest(ssl, 0);
  3512. #endif
  3513. #ifdef HAVE_ENCRYPT_THEN_MAC
  3514. if (disallowETM)
  3515. wolfSSL_AllowEncryptThenMac(ssl, 0);
  3516. #endif
  3517. tcp_connect(&sockfd, host, port, dtlsUDP, dtlsSCTP, ssl);
  3518. if (wolfSSL_set_fd(ssl, sockfd) != WOLFSSL_SUCCESS) {
  3519. wolfSSL_free(ssl); ssl = NULL;
  3520. CloseSocket(sockfd);
  3521. wolfSSL_CTX_free(ctx); ctx = NULL;
  3522. err_sys("error in setting fd");
  3523. }
  3524. if (simulateWantWrite) {
  3525. if (dtlsUDP) {
  3526. wolfSSL_SetIOWriteCtx(ssl, (void*)&sockfd);
  3527. udp_connect(&sockfd, host, port);
  3528. }
  3529. }
  3530. /* STARTTLS */
  3531. if (doSTARTTLS) {
  3532. if (StartTLS_Init(&sockfd) != WOLFSSL_SUCCESS) {
  3533. wolfSSL_free(ssl); ssl = NULL;
  3534. CloseSocket(sockfd);
  3535. wolfSSL_CTX_free(ctx); ctx = NULL;
  3536. err_sys("error during STARTTLS protocol");
  3537. }
  3538. }
  3539. #if defined(HAVE_CRL) && !defined(NO_FILESYSTEM)
  3540. if (disableCRL == 0 && !useVerifyCb) {
  3541. #if defined(HAVE_IO_TIMEOUT) && defined(HAVE_HTTP_CLIENT)
  3542. wolfIO_SetTimeout(DEFAULT_TIMEOUT_SEC);
  3543. #endif
  3544. if (wolfSSL_EnableCRL(ssl, WOLFSSL_CRL_CHECKALL) != WOLFSSL_SUCCESS) {
  3545. wolfSSL_free(ssl); ssl = NULL;
  3546. CloseSocket(sockfd);
  3547. wolfSSL_CTX_free(ctx); ctx = NULL;
  3548. err_sys("can't enable crl check");
  3549. }
  3550. if (wolfSSL_LoadCRL(ssl, crlPemDir, WOLFSSL_FILETYPE_PEM, 0)
  3551. != WOLFSSL_SUCCESS) {
  3552. wolfSSL_free(ssl); ssl = NULL;
  3553. CloseSocket(sockfd);
  3554. wolfSSL_CTX_free(ctx); ctx = NULL;
  3555. err_sys("can't load crl, check crlfile and date validity");
  3556. }
  3557. if (wolfSSL_SetCRL_Cb(ssl, CRL_CallBack) != WOLFSSL_SUCCESS) {
  3558. wolfSSL_free(ssl); ssl = NULL;
  3559. CloseSocket(sockfd);
  3560. wolfSSL_CTX_free(ctx); ctx = NULL;
  3561. err_sys("can't set crl callback");
  3562. }
  3563. }
  3564. #endif
  3565. #ifdef HAVE_SECURE_RENEGOTIATION
  3566. if (scr) {
  3567. if (wolfSSL_UseSecureRenegotiation(ssl) != WOLFSSL_SUCCESS) {
  3568. wolfSSL_free(ssl); ssl = NULL;
  3569. CloseSocket(sockfd);
  3570. wolfSSL_CTX_free(ctx); ctx = NULL;
  3571. err_sys("can't enable secure renegotiation");
  3572. }
  3573. }
  3574. #endif
  3575. #if defined(ATOMIC_USER) && !defined(WOLFSSL_AEAD_ONLY)
  3576. if (atomicUser)
  3577. SetupAtomicUser(ctx, ssl);
  3578. #endif
  3579. #ifdef WOLFSSL_DTLS_CID
  3580. if (useDtlsCID) {
  3581. ret = wolfSSL_dtls_cid_use(ssl);
  3582. if (ret != WOLFSSL_SUCCESS)
  3583. err_sys("Can't enable DTLS ConnectionID");
  3584. ret = wolfSSL_dtls_cid_set(ssl, (unsigned char*)dtlsCID,
  3585. (word32)XSTRLEN(dtlsCID));
  3586. if (ret != WOLFSSL_SUCCESS)
  3587. err_sys("Can't set DTLS ConnectionID");
  3588. }
  3589. #endif /* WOLFSSL_DTLS_CID */
  3590. if (matchName && doPeerCheck)
  3591. wolfSSL_check_domain_name(ssl, domain);
  3592. #ifndef WOLFSSL_CALLBACKS
  3593. if (nonBlocking) {
  3594. #ifdef WOLFSSL_DTLS
  3595. if (doDTLS) {
  3596. wolfSSL_dtls_set_using_nonblock(ssl, 1);
  3597. }
  3598. #endif
  3599. tcp_set_nonblocking(&sockfd);
  3600. ret = NonBlockingSSL_Connect(ssl);
  3601. }
  3602. else {
  3603. #ifdef WOLFSSL_EARLY_DATA
  3604. if (usePsk && earlyData)
  3605. EarlyData(ctx, ssl, kEarlyMsg, sizeof(kEarlyMsg)-1, buffer);
  3606. #endif
  3607. do {
  3608. err = 0; /* reset error */
  3609. ret = wolfSSL_connect(ssl);
  3610. if (ret != WOLFSSL_SUCCESS) {
  3611. err = wolfSSL_get_error(ssl, 0);
  3612. #ifdef WOLFSSL_ASYNC_CRYPT
  3613. if (err == WC_PENDING_E) {
  3614. ret = wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW);
  3615. if (ret < 0) break;
  3616. }
  3617. #endif
  3618. }
  3619. } while (err == WC_PENDING_E);
  3620. }
  3621. #else
  3622. timeoutConnect.tv_sec = DEFAULT_TIMEOUT_SEC;
  3623. timeoutConnect.tv_usec = 0;
  3624. ret = NonBlockingSSL_Connect(ssl); /* will keep retrying on timeout */
  3625. #endif
  3626. if (ret != WOLFSSL_SUCCESS) {
  3627. err = wolfSSL_get_error(ssl, 0);
  3628. LOG_ERROR("wolfSSL_connect error %d, %s\n", err,
  3629. wolfSSL_ERR_error_string((unsigned long)err, buffer));
  3630. /* cleanup */
  3631. wolfSSL_free(ssl); ssl = NULL;
  3632. wolfSSL_CTX_free(ctx); ctx = NULL;
  3633. CloseSocket(sockfd);
  3634. if (!exitWithRet)
  3635. err_sys("wolfSSL_connect failed");
  3636. /* see note at top of README */
  3637. /* if you're getting an error here */
  3638. ((func_args*)args)->return_code = err;
  3639. goto exit;
  3640. }
  3641. showPeerEx(ssl, lng_index);
  3642. showPeerPEM(ssl);
  3643. /* if the caller requested a particular cipher, check here that either
  3644. * a canonical name of the established cipher matches the requested
  3645. * cipher name, or the requested cipher name is marked as an alias
  3646. * that matches the established cipher.
  3647. */
  3648. if (cipherList && !useDefCipherList && (! XSTRSTR(cipherList, ":"))) {
  3649. WOLFSSL_CIPHER* established_cipher = wolfSSL_get_current_cipher(ssl);
  3650. byte requested_cipherSuite0, requested_cipherSuite;
  3651. int requested_cipherFlags;
  3652. if (established_cipher &&
  3653. /* don't test for pseudo-ciphers like "ALL" and "DEFAULT". */
  3654. (wolfSSL_get_cipher_suite_from_name(cipherList,
  3655. &requested_cipherSuite0,
  3656. &requested_cipherSuite,
  3657. &requested_cipherFlags) == 0)) {
  3658. word32 established_cipher_id =
  3659. wolfSSL_CIPHER_get_id(established_cipher);
  3660. byte established_cipherSuite0 = (established_cipher_id >> 8) & 0xff;
  3661. byte established_cipherSuite = established_cipher_id & 0xff;
  3662. const char *established_cipher_name =
  3663. wolfSSL_get_cipher_name_from_suite(established_cipherSuite0,
  3664. established_cipherSuite);
  3665. const char *established_cipher_name_iana =
  3666. wolfSSL_get_cipher_name_iana_from_suite(established_cipherSuite0,
  3667. established_cipherSuite);
  3668. if (established_cipher_name == NULL)
  3669. err_sys("error looking up name of established cipher");
  3670. if (strcmp(cipherList, established_cipher_name) &&
  3671. ((established_cipher_name_iana == NULL) ||
  3672. strcmp(cipherList, established_cipher_name_iana))) {
  3673. if (! (requested_cipherFlags & WOLFSSL_CIPHER_SUITE_FLAG_NAMEALIAS))
  3674. err_sys("Unexpected mismatch between names of requested and established ciphers.");
  3675. else if ((requested_cipherSuite0 != established_cipherSuite0) ||
  3676. (requested_cipherSuite != established_cipherSuite))
  3677. err_sys("Mismatch between IDs of requested and established ciphers.");
  3678. }
  3679. }
  3680. }
  3681. #if defined(HAVE_OCSP) && !defined(NO_ASN_TIME)
  3682. #ifdef HAVE_STRFTIME
  3683. {
  3684. struct tm tm;
  3685. char date[32];
  3686. ret = wolfSSL_get_ocsp_producedDate_tm(ssl, &tm);
  3687. if ((ret == 0) && (strftime(date, sizeof date, "%Y-%m-%d %H:%M:%S %z", &tm) > 0))
  3688. printf("OCSP response timestamp: %s\n", date);
  3689. }
  3690. #else
  3691. {
  3692. byte date[MAX_DATE_SIZE];
  3693. int asn_date_format;
  3694. ret = wolfSSL_get_ocsp_producedDate(ssl, date, sizeof date, &asn_date_format);
  3695. if (ret == 0)
  3696. printf("OCSP response timestamp: %s (ASN.1 type %d)\n", (char *)date, asn_date_format);
  3697. }
  3698. #endif
  3699. #endif
  3700. #if defined(OPENSSL_EXTRA) || defined(HAVE_SECRET_CALLBACK)
  3701. printf("Session timeout set to %ld seconds\n", wolfSSL_get_timeout(ssl));
  3702. {
  3703. byte* rnd;
  3704. byte* pt;
  3705. size_t size;
  3706. /* get size of buffer then print */
  3707. size = wolfSSL_get_client_random(NULL, NULL, 0);
  3708. if (size == 0) {
  3709. wolfSSL_free(ssl); ssl = NULL;
  3710. CloseSocket(sockfd);
  3711. wolfSSL_CTX_free(ctx); ctx = NULL;
  3712. err_sys("error getting client random buffer size");
  3713. }
  3714. rnd = (byte*)XMALLOC(size, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  3715. if (rnd == NULL) {
  3716. wolfSSL_free(ssl); ssl = NULL;
  3717. CloseSocket(sockfd);
  3718. wolfSSL_CTX_free(ctx); ctx = NULL;
  3719. err_sys("error creating client random buffer");
  3720. }
  3721. size = wolfSSL_get_client_random(ssl, rnd, size);
  3722. if (size == 0) {
  3723. XFREE(rnd, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  3724. wolfSSL_free(ssl); ssl = NULL;
  3725. CloseSocket(sockfd);
  3726. wolfSSL_CTX_free(ctx); ctx = NULL;
  3727. err_sys("error getting client random buffer");
  3728. }
  3729. printf("Client Random : ");
  3730. for (pt = rnd; pt < rnd + size; pt++) printf("%02X", *pt);
  3731. printf("\n");
  3732. XFREE(rnd, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  3733. }
  3734. #endif
  3735. #if defined(OPENSSL_ALL) || (defined(OPENSSL_EXTRA) && (defined(HAVE_STUNNEL) || \
  3736. defined(WOLFSSL_NGINX) || defined(HAVE_LIGHTY) || \
  3737. defined(WOLFSSL_HAPROXY) || defined(WOLFSSL_OPENSSH)))
  3738. #if !defined(NO_SESSION_CACHE) && \
  3739. (defined(HAVE_SESSION_TICKET) || defined(SESSION_CERTS)) && \
  3740. !defined(NO_FILESYSTEM)
  3741. #ifndef NO_BIO
  3742. /* print out session to stdout */
  3743. {
  3744. WOLFSSL_BIO* bio = wolfSSL_BIO_new_fp(stdout, BIO_NOCLOSE);
  3745. if (bio != NULL) {
  3746. if (wolfSSL_SESSION_print(bio, wolfSSL_get_session(ssl)) !=
  3747. WOLFSSL_SUCCESS) {
  3748. wolfSSL_BIO_printf(bio, "BIO error printing session\n");
  3749. }
  3750. }
  3751. wolfSSL_BIO_free(bio);
  3752. }
  3753. #endif /* !NO_BIO */
  3754. #endif
  3755. #endif
  3756. if (doSTARTTLS && starttlsProt != NULL) {
  3757. if (XSTRCMP(starttlsProt, "smtp") == 0) {
  3758. if (SMTP_Shutdown(ssl, wc_shutdown) != WOLFSSL_SUCCESS) {
  3759. wolfSSL_free(ssl); ssl = NULL;
  3760. CloseSocket(sockfd);
  3761. wolfSSL_CTX_free(ctx); ctx = NULL;
  3762. err_sys("error closing STARTTLS connection");
  3763. }
  3764. }
  3765. wolfSSL_free(ssl); ssl = NULL;
  3766. CloseSocket(sockfd);
  3767. wolfSSL_CTX_free(ctx); ctx = NULL;
  3768. ((func_args*)args)->return_code = 0;
  3769. WOLFSSL_RETURN_FROM_THREAD(0);
  3770. }
  3771. #ifdef HAVE_ALPN
  3772. if (alpnList != NULL) {
  3773. char *protocol_name = NULL;
  3774. word16 protocol_nameSz = 0;
  3775. err = wolfSSL_ALPN_GetProtocol(ssl, &protocol_name, &protocol_nameSz);
  3776. if (err == WOLFSSL_SUCCESS)
  3777. printf("Received ALPN protocol : %s (%d)\n",
  3778. protocol_name, protocol_nameSz);
  3779. else if (err == WOLFSSL_ALPN_NOT_FOUND)
  3780. printf("No ALPN response received (no match with server)\n");
  3781. else
  3782. printf("Getting ALPN protocol name failed\n");
  3783. }
  3784. #endif
  3785. #ifdef WOLFSSL_DTLS_CID
  3786. if (useDtlsCID && wolfSSL_dtls_cid_is_enabled(ssl)) {
  3787. unsigned char receivedCID[DTLS_CID_BUFFER_SIZE];
  3788. unsigned int receivedCIDSz;
  3789. printf("CID extension was negotiated\n");
  3790. ret = wolfSSL_dtls_cid_get_tx_size(ssl, &receivedCIDSz);
  3791. if (ret != WOLFSSL_SUCCESS)
  3792. err_sys("Can't get negotiated DTLS CID size\n");
  3793. if (receivedCIDSz > 0) {
  3794. ret = wolfSSL_dtls_cid_get_tx(ssl, receivedCID,
  3795. DTLS_CID_BUFFER_SIZE - 1);
  3796. if (ret != WOLFSSL_SUCCESS)
  3797. err_sys("Can't get negotiated DTLS CID\n");
  3798. printf("Sending CID is ");
  3799. printBuffer(receivedCID, receivedCIDSz);
  3800. printf("\n");
  3801. }
  3802. else {
  3803. printf("other peer provided empty CID\n");
  3804. }
  3805. }
  3806. #endif /* WOLFSSL_DTLS_CID */
  3807. #ifdef HAVE_SECURE_RENEGOTIATION
  3808. if (scr && forceScr) {
  3809. if (nonBlocking) {
  3810. if (!resumeScr) {
  3811. if (wolfSSL_Rehandshake(ssl) != WOLFSSL_SUCCESS) {
  3812. err = wolfSSL_get_error(ssl, 0);
  3813. if (err == WOLFSSL_ERROR_WANT_READ ||
  3814. err == WOLFSSL_ERROR_WANT_WRITE) {
  3815. if (scrAppData) {
  3816. ret = ClientWrite(ssl,
  3817. "msg sent during renegotiation",
  3818. sizeof("msg sent during renegotiation") - 1,
  3819. "", 1);
  3820. }
  3821. else {
  3822. ret = 0;
  3823. }
  3824. if (ret != 0) {
  3825. ret = WOLFSSL_FAILURE;
  3826. }
  3827. else {
  3828. do {
  3829. #ifdef WOLFSSL_ASYNC_CRYPT
  3830. if (err == WC_PENDING_E) {
  3831. ret = wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW);
  3832. if (ret < 0) break;
  3833. }
  3834. #endif
  3835. if (err == APP_DATA_READY) {
  3836. if (wolfSSL_read(ssl, reply,
  3837. sizeof(reply)-1) < 0) {
  3838. err_sys("APP DATA should be present "
  3839. "but error returned");
  3840. }
  3841. printf("Received message during "
  3842. "renegotiation: %s\n", reply);
  3843. }
  3844. err = 0;
  3845. if ((ret = wolfSSL_connect(ssl))
  3846. != WOLFSSL_SUCCESS) {
  3847. err = wolfSSL_get_error(ssl, ret);
  3848. }
  3849. } while (ret != WOLFSSL_SUCCESS &&
  3850. (err == WOLFSSL_ERROR_WANT_READ ||
  3851. err == WOLFSSL_ERROR_WANT_WRITE ||
  3852. err == APP_DATA_READY ||
  3853. err == WC_PENDING_E));
  3854. }
  3855. if (ret == WOLFSSL_SUCCESS) {
  3856. printf("NON-BLOCKING RENEGOTIATION SUCCESSFUL\n");
  3857. }
  3858. }
  3859. if (ret != WOLFSSL_SUCCESS) {
  3860. err = wolfSSL_get_error(ssl, 0);
  3861. LOG_ERROR("wolfSSL_Rehandshake error %d, %s\n", err,
  3862. wolfSSL_ERR_error_string(err, buffer));
  3863. wolfSSL_free(ssl); ssl = NULL;
  3864. CloseSocket(sockfd);
  3865. wolfSSL_CTX_free(ctx); ctx = NULL;
  3866. err_sys("non-blocking wolfSSL_Rehandshake failed");
  3867. }
  3868. }
  3869. }
  3870. else {
  3871. LOG_ERROR("not doing secure resumption with non-blocking");
  3872. }
  3873. } else {
  3874. if (!resumeScr) {
  3875. printf("Beginning secure renegotiation.\n");
  3876. if ((ret = wolfSSL_Rehandshake(ssl)) != WOLFSSL_SUCCESS) {
  3877. err = wolfSSL_get_error(ssl, 0);
  3878. #ifdef WOLFSSL_ASYNC_CRYPT
  3879. while (err == WC_PENDING_E) {
  3880. err = 0;
  3881. ret = wolfSSL_negotiate(ssl);
  3882. if (ret != WOLFSSL_SUCCESS) {
  3883. err = wolfSSL_get_error(ssl, 0);
  3884. if (err == WC_PENDING_E) {
  3885. ret = wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW);
  3886. if (ret < 0) break;
  3887. }
  3888. }
  3889. }
  3890. #endif
  3891. if (ret != WOLFSSL_SUCCESS) {
  3892. printf("err = %d, %s\n", err,
  3893. wolfSSL_ERR_error_string(err, buffer));
  3894. wolfSSL_free(ssl); ssl = NULL;
  3895. CloseSocket(sockfd);
  3896. wolfSSL_CTX_free(ctx); ctx = NULL;
  3897. err_sys("wolfSSL_Rehandshake failed");
  3898. }
  3899. }
  3900. else {
  3901. printf("RENEGOTIATION SUCCESSFUL\n");
  3902. }
  3903. }
  3904. else {
  3905. printf("Beginning secure resumption.\n");
  3906. if ((ret = wolfSSL_SecureResume(ssl)) != WOLFSSL_SUCCESS) {
  3907. err = wolfSSL_get_error(ssl, 0);
  3908. #ifdef WOLFSSL_ASYNC_CRYPT
  3909. while (err == WC_PENDING_E) {
  3910. err = 0;
  3911. ret = wolfSSL_negotiate(ssl);
  3912. if (ret != WOLFSSL_SUCCESS) {
  3913. err = wolfSSL_get_error(ssl, 0);
  3914. if (err == WC_PENDING_E) {
  3915. ret = wolfSSL_AsyncPoll(ssl, WOLF_POLL_FLAG_CHECK_HW);
  3916. if (ret < 0) break;
  3917. }
  3918. }
  3919. }
  3920. #endif
  3921. if (ret != WOLFSSL_SUCCESS) {
  3922. printf("err = %d, %s\n", err,
  3923. wolfSSL_ERR_error_string(err, buffer));
  3924. wolfSSL_free(ssl); ssl = NULL;
  3925. CloseSocket(sockfd);
  3926. wolfSSL_CTX_free(ctx); ctx = NULL;
  3927. err_sys("wolfSSL_SecureResume failed");
  3928. }
  3929. }
  3930. else {
  3931. printf("SECURE RESUMPTION SUCCESSFUL\n");
  3932. }
  3933. }
  3934. }
  3935. }
  3936. #endif /* HAVE_SECURE_RENEGOTIATION */
  3937. XMEMSET(msg, 0, sizeof(msg));
  3938. if (sendGET) {
  3939. printf("SSL connect ok, sending GET...\n");
  3940. msgSz = (int)XSTRLEN(kHttpGetMsg);
  3941. XMEMCPY(msg, kHttpGetMsg, (size_t)msgSz);
  3942. }
  3943. else {
  3944. msgSz = (int)XSTRLEN(kHelloMsg);
  3945. XMEMCPY(msg, kHelloMsg, (size_t)msgSz);
  3946. }
  3947. /* allow some time for exporting the session */
  3948. #ifdef WOLFSSL_SESSION_EXPORT_DEBUG
  3949. TEST_DELAY();
  3950. #endif /* WOLFSSL_SESSION_EXPORT_DEBUG */
  3951. #ifdef WOLFSSL_SRTP
  3952. if (dtlsSrtpProfiles != NULL) {
  3953. err = client_srtp_test(ssl, (func_args*)args);
  3954. if (err != 0) {
  3955. if (exitWithRet) {
  3956. ((func_args*)args)->return_code = err;
  3957. wolfSSL_free(ssl); ssl = NULL;
  3958. CloseSocket(sockfd);
  3959. wolfSSL_CTX_free(ctx); ctx = NULL;
  3960. goto exit;
  3961. }
  3962. /* else */
  3963. err_sys("SRTP check failed");
  3964. }
  3965. }
  3966. #endif /* WOLFSSL_SRTP */
  3967. #ifdef WOLFSSL_TLS13
  3968. if (updateKeysIVs)
  3969. wolfSSL_update_keys(ssl);
  3970. #endif
  3971. err = ClientWriteRead(ssl, msg, msgSz, reply, sizeof(reply)-1, 1, "",
  3972. exitWithRet);
  3973. if (exitWithRet && (err != 0)) {
  3974. ((func_args*)args)->return_code = err;
  3975. wolfSSL_free(ssl); ssl = NULL;
  3976. CloseSocket(sockfd);
  3977. wolfSSL_CTX_free(ctx); ctx = NULL;
  3978. goto exit;
  3979. }
  3980. #if defined(WOLFSSL_TLS13)
  3981. if (updateKeysIVs || postHandAuth)
  3982. (void)ClientWrite(ssl, msg, msgSz, "", 0);
  3983. #endif
  3984. #if defined(HAVE_SESSION_TICKET)
  3985. while (waitTicket == 1) {
  3986. unsigned char ticketBuf[SESSION_TICKET_LEN];
  3987. int zeroReturn = 0;
  3988. word32 size;
  3989. (void)zeroReturn;
  3990. size = sizeof(ticketBuf);
  3991. err = wolfSSL_get_SessionTicket(ssl, ticketBuf, &size);
  3992. if (err < 0)
  3993. err_sys("wolfSSL_get_SessionTicket failed");
  3994. if (size == 0) {
  3995. err = process_handshake_messages(ssl, !nonBlocking, &zeroReturn);
  3996. if (err < 0)
  3997. err_sys("error waiting for session ticket ");
  3998. }
  3999. else {
  4000. waitTicket = 0;
  4001. }
  4002. }
  4003. #endif
  4004. #ifndef NO_SESSION_CACHE
  4005. if (resumeSession) {
  4006. session = wolfSSL_get1_session(ssl);
  4007. }
  4008. #endif
  4009. #if !defined(NO_SESSION_CACHE) && (defined(OPENSSL_EXTRA) || \
  4010. defined(HAVE_EXT_CACHE))
  4011. if (session != NULL && resumeSession) {
  4012. flatSessionSz = wolfSSL_i2d_SSL_SESSION(session, NULL);
  4013. if (flatSessionSz != 0) {
  4014. int checkSz = wolfSSL_i2d_SSL_SESSION(session, &flatSession);
  4015. if (flatSession == NULL)
  4016. err_sys("error creating flattened session buffer");
  4017. if (checkSz != flatSessionSz) {
  4018. XFREE(flatSession, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  4019. err_sys("flat session size check failure");
  4020. }
  4021. /* using heap based flat session, free original session */
  4022. wolfSSL_SESSION_free(session);
  4023. session = NULL;
  4024. }
  4025. }
  4026. #endif
  4027. ret = wolfSSL_shutdown(ssl);
  4028. if (wc_shutdown && ret == WOLFSSL_SHUTDOWN_NOT_DONE) {
  4029. while (tcp_select(wolfSSL_get_fd(ssl), DEFAULT_TIMEOUT_SEC) ==
  4030. TEST_RECV_READY) {
  4031. ret = wolfSSL_shutdown(ssl); /* bidirectional shutdown */
  4032. if (ret == WOLFSSL_SUCCESS) {
  4033. printf("Bidirectional shutdown complete\n");
  4034. break;
  4035. }
  4036. else if (ret != WOLFSSL_SHUTDOWN_NOT_DONE) {
  4037. LOG_ERROR("Bidirectional shutdown failed\n");
  4038. break;
  4039. }
  4040. }
  4041. if (ret != WOLFSSL_SUCCESS)
  4042. LOG_ERROR("Bidirectional shutdown failed\n");
  4043. }
  4044. #if defined(ATOMIC_USER) && !defined(WOLFSSL_AEAD_ONLY)
  4045. if (atomicUser)
  4046. FreeAtomicUser(ssl);
  4047. #endif
  4048. /* display collected statistics */
  4049. #if defined(WOLFSSL_STATIC_MEMORY) && !defined(WOLFSSL_STATIC_MEMORY_LEAN)
  4050. if (wolfSSL_is_static_memory(ssl, &ssl_stats) != 1)
  4051. err_sys("static memory was not used with ssl");
  4052. LOG_ERROR("\nprint off SSL memory stats\n");
  4053. LOG_ERROR("*** This is memory state before wolfSSL_free is called\n");
  4054. wolfSSL_PrintStatsConn(&ssl_stats);
  4055. #endif
  4056. wolfSSL_free(ssl); ssl = NULL;
  4057. CloseSocket(sockfd);
  4058. #ifndef NO_SESSION_CACHE
  4059. if (resumeSession) {
  4060. sslResume = wolfSSL_new(ctx);
  4061. if (sslResume == NULL) {
  4062. wolfSSL_CTX_free(ctx); ctx = NULL;
  4063. err_sys("unable to get SSL object");
  4064. }
  4065. #if !defined(NO_DH) && !defined(WOLFSSL_OLD_PRIME_CHECK) && \
  4066. !defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)
  4067. if (!doDhKeyCheck)
  4068. wolfSSL_SetEnableDhKeyTest(sslResume, 0);
  4069. #endif
  4070. #ifdef HAVE_PK_CALLBACKS
  4071. if (pkCallbacks) {
  4072. SetupPkCallbackContexts(sslResume, &pkCbInfo);
  4073. }
  4074. #endif
  4075. if (dtlsUDP) {
  4076. TEST_DELAY();
  4077. }
  4078. tcp_connect(&sockfd, host, port, dtlsUDP, dtlsSCTP, sslResume);
  4079. if (wolfSSL_set_fd(sslResume, sockfd) != WOLFSSL_SUCCESS) {
  4080. wolfSSL_free(sslResume); sslResume = NULL;
  4081. CloseSocket(sockfd);
  4082. wolfSSL_CTX_free(ctx); ctx = NULL;
  4083. err_sys("error in setting fd");
  4084. }
  4085. if (simulateWantWrite) {
  4086. if (dtlsUDP) {
  4087. wolfSSL_SetIOWriteCtx(ssl, (void*)&sockfd);
  4088. udp_connect(&sockfd, host, port);
  4089. }
  4090. }
  4091. #ifdef HAVE_ALPN
  4092. if (alpnList != NULL) {
  4093. printf("ALPN accepted protocols list : %s\n", alpnList);
  4094. wolfSSL_UseALPN(sslResume, alpnList, (word32)XSTRLEN(alpnList),
  4095. alpn_opt);
  4096. }
  4097. #endif
  4098. #ifdef HAVE_SECURE_RENEGOTIATION
  4099. if (scr) {
  4100. if (wolfSSL_UseSecureRenegotiation(sslResume) != WOLFSSL_SUCCESS) {
  4101. wolfSSL_free(sslResume); sslResume = NULL;
  4102. CloseSocket(sockfd);
  4103. wolfSSL_CTX_free(ctx); ctx = NULL;
  4104. err_sys("can't enable secure renegotiation");
  4105. }
  4106. }
  4107. #endif
  4108. #if !defined(NO_SESSION_CACHE) && (defined(OPENSSL_EXTRA) || \
  4109. defined(HAVE_EXT_CACHE))
  4110. if (flatSession) {
  4111. const byte* constFlatSession = flatSession;
  4112. session = wolfSSL_d2i_SSL_SESSION(NULL,
  4113. &constFlatSession, flatSessionSz);
  4114. }
  4115. #endif
  4116. wolfSSL_set_session(sslResume, session);
  4117. #if !defined(NO_SESSION_CACHE) && (defined(OPENSSL_EXTRA) || \
  4118. defined(HAVE_EXT_CACHE))
  4119. XFREE(flatSession, NULL, DYNAMIC_TYPE_TMP_BUFFER);
  4120. #endif
  4121. wolfSSL_SESSION_free(session);
  4122. session = NULL;
  4123. #ifdef HAVE_SESSION_TICKET
  4124. wolfSSL_set_SessionTicket_cb(sslResume, sessionTicketCB,
  4125. (void*)"resumed session");
  4126. #endif
  4127. #ifndef WOLFSSL_CALLBACKS
  4128. if (nonBlocking) {
  4129. #ifdef WOLFSSL_DTLS
  4130. if (doDTLS) {
  4131. wolfSSL_dtls_set_using_nonblock(sslResume, 1);
  4132. }
  4133. #endif
  4134. tcp_set_nonblocking(&sockfd);
  4135. ret = NonBlockingSSL_Connect(sslResume);
  4136. }
  4137. else {
  4138. #ifdef WOLFSSL_EARLY_DATA
  4139. #ifndef HAVE_SESSION_TICKET
  4140. if (!usePsk) {
  4141. }
  4142. else
  4143. #endif
  4144. if (earlyData) {
  4145. EarlyData(ctx, sslResume, kEarlyMsg, sizeof(kEarlyMsg)-1, buffer);
  4146. }
  4147. #endif
  4148. do {
  4149. err = 0; /* reset error */
  4150. ret = wolfSSL_connect(sslResume);
  4151. if (ret != WOLFSSL_SUCCESS) {
  4152. err = wolfSSL_get_error(sslResume, 0);
  4153. #ifdef WOLFSSL_ASYNC_CRYPT
  4154. if (err == WC_PENDING_E) {
  4155. ret = wolfSSL_AsyncPoll(sslResume,
  4156. WOLF_POLL_FLAG_CHECK_HW);
  4157. if (ret < 0) break;
  4158. }
  4159. #endif
  4160. }
  4161. } while (err == WC_PENDING_E);
  4162. }
  4163. #else
  4164. timeoutConnect.tv_sec = DEFAULT_TIMEOUT_SEC;
  4165. timeoutConnect.tv_usec = 0;
  4166. ret = NonBlockingSSL_Connect(sslResume); /* will keep retrying on timeout */
  4167. #endif
  4168. if (ret != WOLFSSL_SUCCESS) {
  4169. LOG_ERROR("wolfSSL_connect resume error %d, %s\n", err,
  4170. wolfSSL_ERR_error_string((unsigned long)err, buffer));
  4171. wolfSSL_free(sslResume); sslResume = NULL;
  4172. CloseSocket(sockfd);
  4173. wolfSSL_CTX_free(ctx); ctx = NULL;
  4174. err_sys("wolfSSL_connect resume failed");
  4175. }
  4176. showPeerEx(sslResume, lng_index);
  4177. showPeerPEM(sslResume);
  4178. if (wolfSSL_session_reused(sslResume))
  4179. printf("reused session id\n");
  4180. else
  4181. LOG_ERROR("didn't reuse session id!!!\n");
  4182. #ifdef HAVE_ALPN
  4183. if (alpnList != NULL) {
  4184. char *protocol_name = NULL;
  4185. word16 protocol_nameSz = 0;
  4186. printf("Sending ALPN accepted list : %s\n", alpnList);
  4187. err = wolfSSL_ALPN_GetProtocol(sslResume, &protocol_name,
  4188. &protocol_nameSz);
  4189. if (err == WOLFSSL_SUCCESS)
  4190. printf("Received ALPN protocol : %s (%d)\n",
  4191. protocol_name, protocol_nameSz);
  4192. else if (err == WOLFSSL_ALPN_NOT_FOUND)
  4193. printf("Not received ALPN response (no match with server)\n");
  4194. else
  4195. printf("Getting ALPN protocol name failed\n");
  4196. }
  4197. #endif
  4198. /* allow some time for exporting the session */
  4199. #ifdef WOLFSSL_SESSION_EXPORT_DEBUG
  4200. TEST_DELAY();
  4201. #endif /* WOLFSSL_SESSION_EXPORT_DEBUG */
  4202. #ifdef HAVE_SECURE_RENEGOTIATION
  4203. if (scr && forceScr) {
  4204. if (nonBlocking) {
  4205. printf("not doing secure renegotiation on example with"
  4206. " nonblocking yet\n");
  4207. } else {
  4208. if (!resumeScr) {
  4209. printf("Beginning secure renegotiation.\n");
  4210. if (wolfSSL_Rehandshake(sslResume) != WOLFSSL_SUCCESS) {
  4211. err = wolfSSL_get_error(sslResume, 0);
  4212. LOG_ERROR("err = %d, %s\n", err,
  4213. wolfSSL_ERR_error_string(err, buffer));
  4214. wolfSSL_free(sslResume); sslResume = NULL;
  4215. CloseSocket(sockfd);
  4216. wolfSSL_CTX_free(ctx); ctx = NULL;
  4217. err_sys("wolfSSL_Rehandshake failed");
  4218. }
  4219. else {
  4220. printf("RENEGOTIATION SUCCESSFUL\n");
  4221. }
  4222. }
  4223. else {
  4224. printf("Beginning secure resumption.\n");
  4225. if (wolfSSL_SecureResume(sslResume) != WOLFSSL_SUCCESS) {
  4226. err = wolfSSL_get_error(sslResume, 0);
  4227. LOG_ERROR("err = %d, %s\n", err,
  4228. wolfSSL_ERR_error_string(err, buffer));
  4229. wolfSSL_free(sslResume); sslResume = NULL;
  4230. CloseSocket(sockfd);
  4231. wolfSSL_CTX_free(ctx); ctx = NULL;
  4232. err_sys("wolfSSL_SecureResume failed");
  4233. }
  4234. else {
  4235. printf("SECURE RESUMPTION SUCCESSFUL\n");
  4236. }
  4237. }
  4238. }
  4239. }
  4240. #endif /* HAVE_SECURE_RENEGOTIATION */
  4241. XMEMSET(msg, 0, sizeof(msg));
  4242. if (sendGET) {
  4243. msgSz = (int)XSTRLEN(kHttpGetMsg);
  4244. XMEMCPY(msg, kHttpGetMsg, (size_t)msgSz);
  4245. }
  4246. else {
  4247. msgSz = (int)XSTRLEN(kResumeMsg);
  4248. XMEMCPY(msg, kResumeMsg, (size_t)msgSz);
  4249. }
  4250. (void)ClientWriteRead(sslResume, msg, msgSz, reply, sizeof(reply)-1,
  4251. sendGET, " resume", 0);
  4252. ret = wolfSSL_shutdown(sslResume);
  4253. if (wc_shutdown && ret == WOLFSSL_SHUTDOWN_NOT_DONE)
  4254. wolfSSL_shutdown(sslResume); /* bidirectional shutdown */
  4255. /* display collected statistics */
  4256. #if defined(WOLFSSL_STATIC_MEMORY) && !defined(WOLFSSL_STATIC_MEMORY_LEAN)
  4257. if (wolfSSL_is_static_memory(sslResume, &ssl_stats) != 1)
  4258. err_sys("static memory was not used with ssl");
  4259. LOG_ERROR("\nprint off SSLresume memory stats\n");
  4260. LOG_ERROR("*** This is memory state before wolfSSL_free is called\n");
  4261. wolfSSL_PrintStatsConn(&ssl_stats);
  4262. #endif
  4263. wolfSSL_free(sslResume); sslResume = NULL;
  4264. CloseSocket(sockfd);
  4265. }
  4266. #endif /* !NO_SESSION_CACHE */
  4267. wolfSSL_CTX_free(ctx); ctx = NULL;
  4268. ((func_args*)args)->return_code = 0;
  4269. exit:
  4270. #ifdef WOLFSSL_WOLFSENTRY_HOOKS
  4271. wolfsentry_ret =
  4272. wolfsentry_shutdown(WOLFSENTRY_CONTEXT_ARGS_OUT_EX4(&wolfsentry, NULL));
  4273. if (wolfsentry_ret < 0) {
  4274. LOG_ERROR(
  4275. "wolfsentry_shutdown() returned " WOLFSENTRY_ERROR_FMT "\n",
  4276. WOLFSENTRY_ERROR_FMT_ARGS(wolfsentry_ret));
  4277. }
  4278. #endif
  4279. #ifdef WOLFSSL_ASYNC_CRYPT
  4280. wolfAsync_DevClose(&devId);
  4281. #endif
  4282. #if defined(HAVE_ECC) && defined(FP_ECC) && defined(HAVE_THREAD_LS) \
  4283. && defined(HAVE_STACK_SIZE)
  4284. wc_ecc_fp_free(); /* free per thread cache */
  4285. #endif
  4286. /* There are use cases when these assignments are not read. To avoid
  4287. * potential confusion those warnings have been handled here.
  4288. */
  4289. (void) useClientCert;
  4290. (void) verifyCert;
  4291. (void) ourCert;
  4292. (void) ourKey;
  4293. (void) useVerifyCb;
  4294. (void) customVerifyCert;
  4295. WOLFSSL_RETURN_FROM_THREAD(0);
  4296. }
  4297. #endif /* !NO_WOLFSSL_CLIENT */
  4298. /* so overall tests can pull in test function */
  4299. #ifndef NO_MAIN_DRIVER
  4300. int main(int argc, char** argv)
  4301. {
  4302. func_args args;
  4303. StartTCP();
  4304. #if defined(WOLFSSL_SRTP) && defined(WOLFSSL_COND)
  4305. args.srtp_helper = NULL;
  4306. #endif
  4307. args.argc = argc;
  4308. args.argv = argv;
  4309. args.return_code = 0;
  4310. #if defined(DEBUG_WOLFSSL) && !defined(WOLFSSL_MDK_SHELL) && !defined(STACK_TRAP)
  4311. wolfSSL_Debugging_ON();
  4312. #endif
  4313. wolfSSL_Init();
  4314. ChangeToWolfRoot();
  4315. #ifndef NO_WOLFSSL_CLIENT
  4316. #ifdef HAVE_STACK_SIZE
  4317. StackSizeCheck(&args, client_test);
  4318. #else
  4319. client_test(&args);
  4320. #endif
  4321. #else
  4322. fprintf(stderr, "Client not compiled in!\n");
  4323. #endif
  4324. wolfSSL_Cleanup();
  4325. #ifdef HAVE_WNR
  4326. if (wc_FreeNetRandom() < 0)
  4327. err_sys("Failed to free netRandom context");
  4328. #endif /* HAVE_WNR */
  4329. return args.return_code;
  4330. }
  4331. int myoptind = 0;
  4332. char* myoptarg = NULL;
  4333. #endif /* NO_MAIN_DRIVER */