This commit was manufactured by cvs2svn to create branch
'OpenSSL_0_9_7-stable'.
This commit is contained in:
cvs2svn
commit
7f36acd8fe
2 changed files with 234 additions and 0 deletions
67
crypto/o_str.h
Normal file
67
crypto/o_str.h
Normal file
|
|
@ -0,0 +1,67 @@
|
|||
/* crypto/o_str.h -*- mode:C; c-file-style: "eay" -*- */
|
||||
/* Written by Richard Levitte (richard@levitte.org) for the OpenSSL
|
||||
* project 2003.
|
||||
*/
|
||||
/* ====================================================================
|
||||
* Copyright (c) 2003 The OpenSSL Project. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* 3. All advertising materials mentioning features or use of this
|
||||
* software must display the following acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
|
||||
*
|
||||
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
||||
* endorse or promote products derived from this software without
|
||||
* prior written permission. For written permission, please contact
|
||||
* licensing@OpenSSL.org.
|
||||
*
|
||||
* 5. Products derived from this software may not be called "OpenSSL"
|
||||
* nor may "OpenSSL" appear in their names without prior written
|
||||
* permission of the OpenSSL Project.
|
||||
*
|
||||
* 6. Redistributions of any form whatsoever must retain the following
|
||||
* acknowledgment:
|
||||
* "This product includes software developed by the OpenSSL Project
|
||||
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
||||
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
||||
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||||
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||||
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||||
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||||
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
* ====================================================================
|
||||
*
|
||||
* This product includes cryptographic software written by Eric Young
|
||||
* (eay@cryptsoft.com). This product includes software written by Tim
|
||||
* Hudson (tjh@cryptsoft.com).
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef HEADER_O_STR_H
|
||||
#define HEADER_O_STR_H
|
||||
|
||||
#include <string.h>
|
||||
|
||||
int OPENSSL_strcasecmp(const char *str1, const char *str2);
|
||||
int OPENSSL_strncasecmp(const char *str1, const char *str2, size_t n);
|
||||
|
||||
#endif
|
||||
167
doc/apps/s_time.pod
Normal file
167
doc/apps/s_time.pod
Normal file
|
|
@ -0,0 +1,167 @@
|
|||
|
||||
=pod
|
||||
|
||||
=head1 NAME
|
||||
|
||||
s_time - SSL/TLS performance timing program
|
||||
|
||||
=head1 SYNOPSIS
|
||||
|
||||
B<openssl> B<s_time>
|
||||
[B<-connect host:port>]
|
||||
[B<-www page>]
|
||||
[B<-cert filename>]
|
||||
[B<-key filename>]
|
||||
[B<-CApath directory>]
|
||||
[B<-CAfile filename>]
|
||||
[B<-reuse>]
|
||||
[B<-new>]
|
||||
[B<-verify depth>]
|
||||
[B<-nbio>]
|
||||
[B<-time seconds>]
|
||||
[B<-ssl2>]
|
||||
[B<-ssl3>]
|
||||
[B<-bugs>]
|
||||
[B<-cipher cipherlist>]
|
||||
|
||||
=head1 DESCRIPTION
|
||||
|
||||
The B<s_client> command implements a generic SSL/TLS client which connects to a
|
||||
remote host using SSL/TLS. It can request a page from the server and includes
|
||||
the time to transfer the payload data in its timing measurements. It measures
|
||||
the number of connections within a given timeframe, the amount of data
|
||||
transferred (if any), and calculates the average time spent for one connection.
|
||||
|
||||
=head1 OPTIONS
|
||||
|
||||
=over 4
|
||||
|
||||
=item B<-connect host:port>
|
||||
|
||||
This specifies the host and optional port to connect to.
|
||||
|
||||
=item B<-www page>
|
||||
|
||||
This specifies the page to GET from the server. A value of '/' gets the
|
||||
index.htm[l] page. If this parameter is not specified, then B<s_time> will only
|
||||
perform the handshake to establish SSL connections but not transfer any
|
||||
payload data.
|
||||
|
||||
=item B<-cert certname>
|
||||
|
||||
The certificate to use, if one is requested by the server. The default is
|
||||
not to use a certificate. The file is in PEM format.
|
||||
|
||||
=item B<-key keyfile>
|
||||
|
||||
The private key to use. If not specified then the certificate file will
|
||||
be used. The file is in PEM format.
|
||||
|
||||
=item B<-verify depth>
|
||||
|
||||
The verify depth to use. This specifies the maximum length of the
|
||||
server certificate chain and turns on server certificate verification.
|
||||
Currently the verify operation continues after errors so all the problems
|
||||
with a certificate chain can be seen. As a side effect the connection
|
||||
will never fail due to a server certificate verify failure.
|
||||
|
||||
=item B<-CApath directory>
|
||||
|
||||
The directory to use for server certificate verification. This directory
|
||||
must be in "hash format", see B<verify> for more information. These are
|
||||
also used when building the client certificate chain.
|
||||
|
||||
=item B<-CAfile file>
|
||||
|
||||
A file containing trusted certificates to use during server authentication
|
||||
and to use when attempting to build the client certificate chain.
|
||||
|
||||
=item B<-new>
|
||||
|
||||
performs the timing test using a new session ID for each connection.
|
||||
If neither B<-new> nor B<-reuse> are specified, they are both on by default
|
||||
and executed in sequence.
|
||||
|
||||
=item B<-reuse>
|
||||
|
||||
performs the timing test using the same session ID; this can be used as a test
|
||||
that session caching is working. If neither B<-new> nor B<-reuse> are
|
||||
specified, they are both on by default and executed in sequence.
|
||||
|
||||
=item B<-nbio>
|
||||
|
||||
turns on non-blocking I/O.
|
||||
|
||||
=item B<-ssl2>, B<-ssl3>
|
||||
|
||||
these options disable the use of certain SSL or TLS protocols. By default
|
||||
the initial handshake uses a method which should be compatible with all
|
||||
servers and permit them to use SSL v3, SSL v2 or TLS as appropriate.
|
||||
The timing program is not as rich in options to turn protocols on and off as
|
||||
the L<s_client(1)|s_client(1)> program and may not connect to all servers.
|
||||
|
||||
Unfortunately there are a lot of ancient and broken servers in use which
|
||||
cannot handle this technique and will fail to connect. Some servers only
|
||||
work if TLS is turned off with the B<-ssl3> option; others
|
||||
will only support SSL v2 and may need the B<-ssl2> option.
|
||||
|
||||
=item B<-bugs>
|
||||
|
||||
there are several known bug in SSL and TLS implementations. Adding this
|
||||
option enables various workarounds.
|
||||
|
||||
=item B<-cipher cipherlist>
|
||||
|
||||
this allows the cipher list sent by the client to be modified. Although
|
||||
the server determines which cipher suite is used it should take the first
|
||||
supported cipher in the list sent by the client.
|
||||
See the L<ciphers(1)|ciphers(1)> command for more information.
|
||||
|
||||
=back
|
||||
|
||||
=head1 NOTES
|
||||
|
||||
B<s_client> can be used to measure the performance of an SSL connection.
|
||||
To connect to an SSL HTTP server and get the default page the command
|
||||
|
||||
openssl s_time -connect servername:443 -www / -CApath yourdir -CAfile yourfile.pem -cipher commoncipher [-ssl3]
|
||||
|
||||
would typically be used (https uses port 443). 'commoncipher' is a cipher to
|
||||
which both client and server can agree, see the L<cipher(1)|cipher(1)> command
|
||||
for details.
|
||||
|
||||
If the handshake fails then there are several possible causes, if it is
|
||||
nothing obvious like no client certificate then the B<-bugs>, B<-ssl2>,
|
||||
B<-ssl3> options can be tried
|
||||
in case it is a buggy server. In particular you should play with these
|
||||
options B<before> submitting a bug report to an OpenSSL mailing list.
|
||||
|
||||
A frequent problem when attempting to get client certificates working
|
||||
is that a web client complains it has no certificates or gives an empty
|
||||
list to choose from. This is normally because the server is not sending
|
||||
the clients certificate authority in its "acceptable CA list" when it
|
||||
requests a certificate. By using L<s_client(1)|s_client(1)> the CA list can be
|
||||
viewed and checked. However some servers only request client authentication
|
||||
after a specific URL is requested. To obtain the list in this case it
|
||||
is necessary to use the B<-prexit> option of L<s_client(1)|s_client(1)> and
|
||||
send an HTTP request for an appropriate page.
|
||||
|
||||
If a certificate is specified on the command line using the B<-cert>
|
||||
option it will not be used unless the server specifically requests
|
||||
a client certificate. Therefor merely including a client certificate
|
||||
on the command line is no guarantee that the certificate works.
|
||||
|
||||
=head1 BUGS
|
||||
|
||||
Because this program does not have all the options of the
|
||||
L<s_client(1)|s_client(1)> program to turn protocols on and off, you may not be
|
||||
able to measure the performance of all protocols with all servers.
|
||||
|
||||
The B<-verify> option should really exit if the server verification
|
||||
fails.
|
||||
|
||||
=head1 SEE ALSO
|
||||
|
||||
L<s_client(1)|s_client(1)>, L<s_server(1)|s_server(1)>, L<ciphers(1)|ciphers(1)>
|
||||
|
||||
=cut
|
||||
Loading…
Reference in a new issue