diff options
author | Rob Percival <robpercival@google.com> | 2016-03-02 13:34:05 +0000 |
---|---|---|
committer | Rich Salz <rsalz@openssl.org> | 2016-03-04 10:50:10 -0500 |
commit | dd696a55a2554cc8c89dd64f7e1171ce211dfc5c (patch) | |
tree | fe2299f0f9f213f0e07179fe1548b2be1a745c87 /apps | |
parent | 98d8ddd25474b954d52f01086fcc2536965d015b (diff) |
Extends s_client to allow a basic CT policy to be enabled
Reviewed-by: Ben Laurie <ben@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
Diffstat (limited to 'apps')
-rw-r--r-- | apps/Makefile.in | 21 | ||||
-rw-r--r-- | apps/apps.c | 13 | ||||
-rw-r--r-- | apps/apps.h | 2 | ||||
-rw-r--r-- | apps/ct_log_list.cnf | 34 | ||||
-rw-r--r-- | apps/s_cb.c | 1 | ||||
-rw-r--r-- | apps/s_client.c | 57 |
6 files changed, 122 insertions, 6 deletions
diff --git a/apps/Makefile.in b/apps/Makefile.in index 956d84b4d7..f9eba16d53 100644 --- a/apps/Makefile.in +++ b/apps/Makefile.in @@ -30,6 +30,7 @@ LIBSSL=-L.. -lssl SCRIPTS=CA.pl tsget EXE= openssl$(EXE_EXT) +CONFS=openssl.cnf ct_log_list.cnf COMMANDS= \ asn1pars.o ca.o ciphers.o cms.o crl.o crl2p7.o dgst.o dhparam.o \ @@ -92,10 +93,14 @@ install: cp $$i $(DESTDIR)$(OPENSSLDIR)/misc/$$i.new; \ chmod 755 $(DESTDIR)$(OPENSSLDIR)/misc/$$i.new; \ mv -f $(DESTDIR)$(OPENSSLDIR)/misc/$$i.new $(DESTDIR)$(OPENSSLDIR)/misc/$$i ); \ - done - @cp openssl.cnf $(DESTDIR)$(OPENSSLDIR)/openssl.cnf.new; \ - chmod 644 $(DESTDIR)$(OPENSSLDIR)/openssl.cnf.new; \ - mv -f $(DESTDIR)$(OPENSSLDIR)/openssl.cnf.new $(DESTDIR)$(OPENSSLDIR)/openssl.cnf + done; + @set -e; for i in $(CONFS); \ + do \ + (echo installing $$i; \ + cp $$i $(DESTDIR)$(OPENSSLDIR)/$$i.new; \ + chmod 644 $(DESTDIR)$(OPENSSLDIR)/$$i.new; \ + mv -f $(DESTDIR)$(OPENSSLDIR)/$$i.new $(DESTDIR)$(OPENSSLDIR)/$$i ); \ + done; uninstall: @set -e; for i in $(EXE); \ @@ -107,8 +112,12 @@ uninstall: do \ echo $(RM) $(DESTDIR)$(OPENSSLDIR)/misc/$$i; \ $(RM) $(DESTDIR)$(OPENSSLDIR)/misc/$$i; \ - done - $(RM) $(DESTDIR)$(OPENSSLDIR)/openssl.cnf + done; + @set -e; for i in $(CONFS); \ + do \ + echo $(RM) $(DESTDIR)$(OPENSSLDIR)/$$i; \ + $(RM) $(DESTDIR)$(OPENSSLDIR)/$$i; \ + done; generate: openssl-vms.cnf progs.h diff --git a/apps/apps.c b/apps/apps.c index 9f60e76dd8..19523d68fc 100644 --- a/apps/apps.c +++ b/apps/apps.c @@ -235,6 +235,19 @@ int ctx_set_verify_locations(SSL_CTX *ctx, const char *CAfile, return SSL_CTX_load_verify_locations(ctx, CAfile, CApath); } +int ctx_set_ctlog_list_file(SSL_CTX *ctx, const char *path) +{ + if (path == NULL) { + if (SSL_CTX_set_default_ctlog_list_file(ctx) <= 0) { + BIO_puts(bio_err, "Failed to load default Certificate Transparency " + "log list\n"); + } + return 1; /* Do not treat failure to load the default as an error */ + } + + return SSL_CTX_set_ctlog_list_file(ctx, path); +} + int dump_cert_text(BIO *out, X509 *x) { char *p; diff --git a/apps/apps.h b/apps/apps.h index 4540a63cfe..5450def13d 100644 --- a/apps/apps.h +++ b/apps/apps.h @@ -489,6 +489,8 @@ X509_STORE *setup_verify(char *CAfile, char *CApath, int noCAfile, int noCApath); int ctx_set_verify_locations(SSL_CTX *ctx, const char *CAfile, const char *CApath, int noCAfile, int noCApath); +int ctx_set_ctlog_list_file(SSL_CTX *ctx, const char *path); + # ifdef OPENSSL_NO_ENGINE # define setup_engine(engine, debug) NULL # else diff --git a/apps/ct_log_list.cnf b/apps/ct_log_list.cnf new file mode 100644 index 0000000000..243487453c --- /dev/null +++ b/apps/ct_log_list.cnf @@ -0,0 +1,34 @@ +enabled_logs=pilot,aviator,rocketeer,digicert,certly,izempe,symantec,venafi + +[pilot] +description = Google Pilot Log +key = MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEfahLEimAoz2t01p3uMziiLOl/fHTDM0YDOhBRuiBARsV4UvxG2LdNgoIGLrtCzWE0J5APC2em4JlvR8EEEFMoA== + +[aviator] +description = Google Aviator log +key = MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1/TMabLkDpCjiupacAlP7xNi0I1JYP8bQFAHDG1xhtolSY1l4QgNRzRrvSe8liE+NPWHdjGxfx3JhTsN9x8/6Q== + +[rocketeer] +description = Google Rocketeer log +key = MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIFsYyDzBi7MxCAC/oJBXK7dHjG+1aLCOkHjpoHPqTyghLpzA9BYbqvnV16mAw04vUjyYASVGJCUoI3ctBcJAeg== + +[digicert] +description = DigiCert Log Server +key = MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEAkbFvhu7gkAW6MHSrBlpE1n4+HCFRkC5OLAjgqhkTH+/uzSfSl8ois8ZxAD2NgaTZe1M9akhYlrYkes4JECs6A== + +[certly] +description = Certly.IO log +key = MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAECyPLhWKYYUgEc+tUXfPQB4wtGS2MNvXrjwFCCnyYJifBtd2Sk7Cu+Js9DNhMTh35FftHaHu6ZrclnNBKwmbbSA== + +[izempe] +description = Izempe log +key = MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJ2Q5DC3cUBj4IQCiDu0s6j51up+TZAkAEcQRF6tczw90rLWXkJMAW7jr9yc92bIKgV8vDXU4lDeZHvYHduDuvg== + +[symantec] +description = Symantec log +key = MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEluqsHEYMG1XcDfy1lCdGV0JwOmkY4r87xNuroPS2bMBTP01CEDPwWJePa75y9CrsHEKqAy8afig1dpkIPSEUhg== + +[venafi] +description = Venafi log +key = MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAolpIHxdSlTXLo1s6H1OCdpSj/4DyHDc8wLG9wVmLqy1lk9fz4ATVmm+/1iN2Nk8jmctUKK2MFUtlWXZBSpym97M7frGlSaQXUWyA3CqQUEuIJOmlEjKTBEiQAvpfDjCHjlV2Be4qTM6jamkJbiWtgnYPhJL6ONaGTiSPm7Byy57iaz/hbckldSOIoRhYBiMzeNoA0DiRZ9KmfSeXZ1rB8y8X5urSW+iBzf2SaOfzBvDpcoTuAaWx2DPazoOl28fP1hZ+kHUYvxbcMjttjauCFx+JII0dmuZNIwjfeG/GBb9frpSX219k1O4Wi6OEbHEr8at/XQ0y7gTikOxBn/s5wQIDAQAB + diff --git a/apps/s_cb.c b/apps/s_cb.c index 8a25d173b0..3e9d0f63a9 100644 --- a/apps/s_cb.c +++ b/apps/s_cb.c @@ -711,6 +711,7 @@ static STRINT_PAIR tlsext_types[] = { {"heartbeat", TLSEXT_TYPE_heartbeat}, {"session ticket", TLSEXT_TYPE_session_ticket}, {"renegotiation info", TLSEXT_TYPE_renegotiate}, + {"signed certificate timestamps", TLSEXT_TYPE_signed_certificate_timestamp}, {"TLS padding", TLSEXT_TYPE_padding}, #ifdef TLSEXT_TYPE_next_proto_neg {"next protocol", TLSEXT_TYPE_next_proto_neg}, diff --git a/apps/s_client.c b/apps/s_client.c index 85fca1fc4e..cce8e244b5 100644 --- a/apps/s_client.c +++ b/apps/s_client.c @@ -165,6 +165,9 @@ typedef unsigned int u_int; #ifndef OPENSSL_NO_SRP # include <openssl/srp.h> #endif +#ifndef OPENSSL_NO_CT +# include <openssl/ct.h> +#endif #include "s_apps.h" #include "timeouts.h" @@ -656,6 +659,9 @@ typedef enum OPTION_choice { OPT_X_ENUM, OPT_S_ENUM, OPT_FALLBACKSCSV, OPT_NOCMDS, OPT_PROXY, OPT_DANE_TLSA_DOMAIN, +#ifndef OPENSSL_NO_CT + OPT_NOCT, OPT_REQUESTCT, OPT_REQUIRECT, OPT_CTLOG_FILE, +#endif OPT_DANE_TLSA_RRDATA } OPTION_CHOICE; @@ -810,6 +816,12 @@ OPTIONS s_client_options[] = { {"ssl_client_engine", OPT_SSL_CLIENT_ENGINE, 's', "Specify engine to be used for client certificate operations"}, #endif +#ifndef OPENSSL_NO_CT + {"noct", OPT_NOCT, '-', "Do not request or parse SCTs (default)"}, + {"requestct", OPT_REQUESTCT, '-', "Request SCTs (enables OCSP stapling)"}, + {"requirect", OPT_REQUIRECT, '-', "Require at least 1 SCT (enables OCSP stapling)"}, + {"ctlogfile", OPT_CTLOG_FILE, '<', "CT log list CONF file"}, +#endif {NULL} }; @@ -903,6 +915,10 @@ int s_client_main(int argc, char **argv) int srp_lateuser = 0; SRP_ARG srp_arg = { NULL, NULL, 0, 0, 0, 1024 }; #endif +#ifndef OPENSSL_NO_CT + char *ctlog_file = NULL; + ct_validation_cb ct_validation = NULL; +#endif FD_ZERO(&readfds); FD_ZERO(&writefds); @@ -1293,6 +1309,20 @@ int s_client_main(int argc, char **argv) case OPT_NOCAFILE: noCAfile = 1; break; +#ifndef OPENSSL_NO_CT + case OPT_NOCT: + ct_validation = NULL; + break; + case OPT_REQUESTCT: + ct_validation = CT_verify_no_bad_scts; + break; + case OPT_REQUIRECT: + ct_validation = CT_verify_at_least_one_good_sct; + break; + case OPT_CTLOG_FILE: + ctlog_file = opt_arg(); + break; +#endif case OPT_CHAINCAFILE: chCAfile = opt_arg(); break; @@ -1588,6 +1618,18 @@ int s_client_main(int argc, char **argv) if (state) SSL_CTX_set_info_callback(ctx, apps_ssl_info_callback); +#ifndef OPENSSL_NO_CT + if (!SSL_CTX_set_ct_validation_callback(ctx, ct_validation, NULL)) { + ERR_print_errors(bio_err); + goto end; + } + + if (ctx_set_ctlog_list_file(ctx, ctlog_file) <= 0) { + ERR_print_errors(bio_err); + goto end; + } +#endif + SSL_CTX_set_verify(ctx, verify, verify_callback); if (!ctx_set_verify_locations(ctx, CAfile, CApath, noCAfile, noCApath)) { @@ -2459,6 +2501,9 @@ static void print_stuff(BIO *bio, SSL *s, int full) const COMP_METHOD *comp, *expansion; #endif unsigned char *exportedkeymat; +#ifndef OPENSSL_NO_CT + const STACK_OF(SCT) *scts; +#endif if (full) { int got_a_chain = 0; @@ -2511,6 +2556,18 @@ static void print_stuff(BIO *bio, SSL *s, int full) ssl_print_sigalgs(bio, s); ssl_print_tmp_key(bio, s); +#ifndef OPENSSL_NO_CT + scts = SSL_get0_peer_scts(s); + BIO_printf(bio, "---\nSCTs present (%i)\n---\n", + scts ? sk_SCT_num(scts) : 0); + SCT_LIST_print(scts, bio, 0, "\n---\n"); + BIO_printf(bio, "\n"); + if (SSL_get_ct_validation_callback(s) == NULL) { + BIO_printf(bio, "---\nWarning: CT validation is disabled, so not all " + "SCTs may be displayed. Re-run with \"-requestct\".\n"); + } +#endif + BIO_printf(bio, "---\nSSL handshake has read %"PRIu64" bytes and written %"PRIu64" bytes\n", BIO_number_read(SSL_get_rbio(s)), |