summaryrefslogtreecommitdiff
path: root/cmd/tstclnt/tstclnt.c
Commit message (Collapse)AuthorAgeFilesLines
* Bug 1694214 - tstclnt can't enable middlebox compat mode r=beurdoucheHubert Kario2021-02-271-1/+17
| | | | Differential Revision: https://phabricator.services.mozilla.com/D106617
* Bug 1689228 - Minor ECH -09 fixes for interop testing, fuzzing. r=mtKevin Jacobs2021-01-311-0/+5
| | | | | | | | | | | | | | | A few minor ECH -09 fixes for interop testing and fuzzing: - selfserv now takes a PKCS8 keypair for ECH. This is more maintainable and significantly less terrible than parsing the ECHConfigs and cobbling one together within selfserv (e.g. we can support other KEMs without modifying the server). - Get rid of the newline character in tstclnt retry_configs output. - Fuzzer fixes in tls13_HandleHrrCookie: - We shouldn't use internal_error when PK11_HPKE_ImportContext fails. Cookies are unprotected in fuzzer mode, so this can be expected to occur. - Only restore the application token when recovering hash state, otherwise the copy could happen twice, leaking one of the allocations. Differential Revision: https://phabricator.services.mozilla.com/D103247
* Bug 1570539 - Removed -X alt-server-hello option from tstclnt r=kjacobsyogesh2020-12-031-1/+0
| | | | Differential Revision: https://phabricator.services.mozilla.com/D98634
* Bug 1654332 - Update ESNI to draft-08 (ECH). r=mtKevin Jacobs2020-11-171-14/+40
| | | | | | | | | | | | | | | | | | | | | | | This patch adds support for Encrypted Client Hello (draft-ietf-tls-esni-08), replacing the existing ESNI (draft -02) support. There are five new experimental functions to enable this: - SSL_EncodeEchConfig: Generates an encoded (not BASE64) ECHConfig given a set of parameters. - SSL_SetClientEchConfigs: Configures the provided ECHConfig to the given socket. When configured, an ephemeral HPKE keypair will be generated for the CH encryption. - SSL_SetServerEchConfigs: Configures the provided ECHConfig and keypair to the socket. The keypair specified will be used for HPKE operations in order to decrypt encrypted Client Hellos as they are received. - SSL_GetEchRetryConfigs: If ECH is rejected by the server and compatible retry_configs are provided, this API allows the application to extract those retry_configs for use in a new connection. - SSL_EnableTls13GreaseEch: When enabled, non-ECH Client Hellos will have a "GREASE ECH" (i.e. fake) extension appended. GREASE ECH is disabled by default, as there are known compatibility issues that will be addressed in a subsequent draft. The following ESNI experimental functions are deprecated by this update: - SSL_EncodeESNIKeys - SSL_EnableESNI - SSL_SetESNIKeyPair In order to be used, NSS must be compiled with `NSS_ENABLE_DRAFT_HPKE` defined. Differential Revision: https://phabricator.services.mozilla.com/D86106
* Bug 1603042 - Support external PSKs in tstclnt/selfserv. r=jcjKevin Jacobs2020-06-101-5/+55
| | | | | | | | | | | | | | | This patch adds support for TLS 1.3 external PSKs in tstclnt and selfserv with the `-z` option. Command examples: - `selfserv -D -p 4443 -d . -n localhost.localdomain -w nss -V tls1.3: -H 1 -z 0xAAAAAAAABBBBBBBBCCCCCCCCDDDDDDDD[:label] -m` - `tstclnt -h 127.0.0.1 -p 4443 -z 0xAAAAAAAABBBBBBBBCCCCCCCCDDDDDDDD[:label] -d . -w nss` For OpenSSL interop: - `openssl s_server -nocert -port 4433 -psk AAAAAAAABBBBBBBBCCCCCCCCDDDDDDDD [-psk_identity label]` Note: If the optional label is omitted, both NSS tools and OpenSSL default to "Client_identity". Differential Revision: https://phabricator.services.mozilla.com/D75836
* Bug 1494063, add -x option to tstclnt/selfserv to export keying material, r=mtDaiki Ueno2019-09-271-1/+33
| | | | | | | | | | | | Reviewers: rrelyea, mt Reviewed By: mt Subscribers: HubertKario Bug #: 1494063 Differential Revision: https://phabricator.services.mozilla.com/D29166
* Bug 1574220 - Improve controls after errors in tstcln, selfserv and vfyserv ↵Marcus Burghardt2019-08-151-1/+4
| | | | | | cmds. r=kjacobs Differential Revision: https://phabricator.services.mozilla.com/D42165
* Bug 1561591 - Remove -Wmaybe-uninitialized warning in tstclnt.c ↵Giulio Benetti2019-07-101-1/+1
| | | | r=marcusburghardt,jcj
* Bug 1540403 - draft-ietf-tls-subcerts-03, r=mt,jcjChristopher Patton2019-06-251-3/+19
| | | | Differential Revision: https://phabricator.services.mozilla.com/D25654
* Bug 1532312, add -E option to selfserv/tstclnt to enable post-handshake ↵Daiki Ueno2019-04-081-2/+24
| | | | | | | | | | | | auth, r=mt Reviewers: mt Reviewed By: mt Bug #: 1532312 Differential Revision: https://phabricator.services.mozilla.com/D21936
* Bug 1494901 - Implement ESNI. r=mtEKR2018-06-301-2/+31
| | | | | Phabricator: https://phabricator.services.mozilla.com/D6042
* Bug 1423075 - Remove -z option for tstclnt/selfserv, r=kaieMartin Thomson2018-08-151-17/+5
|
* Bug 1482747 - Options for controlling signature scheme in tstclnt/selfserv, ↵Martin Thomson2018-08-151-8/+77
| | | | r=franziskus
* Bug 1464778 - tstclnt - Check pollset[STDIN_FD] before accessing r=franziskusTim Taubert2018-05-301-2/+2
| | | | | | | | | | Reviewers: franziskus Reviewed By: franziskus Bug #: 1464778 Differential Revision: https://phabricator.services.mozilla.com/D1433
* Bug 1423018 - Retain write polling when 0-RTT is enabled, r=ekrMartin Thomson2017-11-281-95/+73
| | | | | | | | | | | | | | | | | | | | | | | This is a nasty one. I was having trouble with tstclnt when testing against other implementations. It would hang. I made similar changes to that for kazuho and picotls, where the input file is read for every connection. So, I did that here too and it also worked nicely. In order to get 0-RTT working though, I needed to teach ssl_Poll about 0-RTT. Luckily, there was code already there for that and it just needed a tweak. The only thing I ran into here was that boringssl (the server I was using to test against here), was too fast. By the time we had written out the ClientHello, it had produced a response and we would complete the handshake before leaving the handshake loop in ssl3_Do1stHandshake(). That meant that we would never actually send any 0-RTT data, either before or after this patch. Adding a sleep(1) to the handshake in boringssl did the trick and I could show that we can send data before the handshake completes. Nothing really actionable here unless you can think of ways to make our handshake more performant. Mostly just information. Separately, people have noticed that tstclnt writes 0-RTT after the first round trip. That's a symptom of not retaining the poll on write.
* Bug 1309068 - Enable -Wshadow, r=franziskusMartin Thomson2018-02-141-28/+27
|
* Bug 1423016 - DTLS support for tstclnt. r=mtEKR2017-11-111-66/+217
| | | | | | | Reviewers: mt Differential Revision: https://phabricator.services.mozilla.com/D314
* Bug 1415795 - revert renaming of SSL_UseAltServerHelloType, r=mtFranziskus Kiefer2017-11-211-1/+1
| | | | | | | | | | | | | | | Summary: Reverting name change of experimental API (transplanted changed from 3.34 branch). blocks D222 Reviewers: mt Reviewed By: mt Bug #: 1415795 Differential Revision: https://phabricator.services.mozilla.com/D261
* Bug 1411475 - Google Hack, r=ekrMartin Thomson2017-10-251-2/+2
| | | | | | | | | | | | | | | | | | | | | | | This makes the TLS 1.3 handshake look like TLS 1.2. The trickiest part here is in 0-RTT. I've chosen to remember that the alternative handshake was used and send a ChangeCipherSpec if the previous session used the alternative AND if the client enables the alternative. This assumes that a server will commit to supporting - and selecting - this alternative handshake type for as long as it supports 0-RTT from sessions that have the alternative handshake type. That is, if you negotiate the alternative handshake and the server supports 0-RTT, then it will not just support TLS 1.3 for the duration of the ticket, but also the alternative handshake type. A client can disable the alternative handshake because the version in the ClientHello indicates whether the client intended to send a CCS, but the server cannot refuse to pick it if the client offers. Of course, if we agree that the final TLS 1.3 is in this form, we don't have a problem, it's only an issue because we need to switch-hit. I chose to remove the Facebook alternative content type hack as all signs indicate that it doesn't help.
* Bug 1385917 - Part 2: Add alternate handshake support to tstclnt. r=mtEKR2017-07-311-1/+21
| | | | | | | Reviewers: mt Differential Revision: https://nss-review.dev.mozaws.net/D389
* Bug 1348728 - Update help for tstclnt and selfserv, r=ttaubertMartin Thomson2017-03-201-4/+3
|
* Bug 1341229, tstclnt: preserve error code after cert verify failure, r=kaieDaiki Ueno2017-02-211-0/+4
|
* Bug 1341054, tstclnt: use correct option spec for -W, r=kaieDaiki Ueno2017-02-201-1/+1
|
* Bug 1321806, Error out if version range cannot be parsed, r=kaieDaiki Ueno2016-12-081-0/+1
|
* Bug 1321520 - Only one poll description, r=ekrMartin Thomson2016-12-021-7/+7
|
* Bug 1321520 - Re-transmit 0-RTT on rejection. r=mtEKR2016-11-301-23/+45
| | | | | | | Reviewers: mt Differential Revision: https://nss-review.dev.mozaws.net/D110
* Bug 1317091 - fix tstclnt help, r=mtFranziskus Kiefer2016-11-131-1/+1
| | | | Differential Revision: https://nss-review.dev.mozaws.net/D60
* Bug 1208405 - fix cid1394326, r=mtFranziskus Kiefer2016-11-141-2/+6
| | | | Differential Revision: https://nss-review.dev.mozaws.net/D61
* Bug 1317094 - Send 0-RTT in tstclnt. r=mtEKR2016-11-121-2/+18
| | | | | Differential Revision: https://nss-review.dev.mozaws.net/D57
* Bug 1316994 - Modify tstclnt so that it has an auto-disconnect andEKR2016-11-081-460/+562
| | | | | | | | | | | | | | | | | | | | resume. r=mt Summary: It is difficult to resumption and 0-RTT with tstclnt as it currently is. This CL fixes that. The changes involve two new flags: A -- Read a fixed request from a file and use that instead of reading from stdin L -- Disconnect and reconnect L - 1 times. Reviewers: mt Differential Revision: https://nss-review.dev.mozaws.net/D39 Fix npds
* Backed out changesets e76d6d66733d, 37723fa31b87, 0d5d0574e512Martin Thomson2016-11-121-564/+461
|
* Fix pre-connect check. Probable fix for bustage. r=meEKR2016-11-121-1/+2
|
* Fix memory leak. r=meEKR2016-11-121-1/+5
|
* Bug 1316994 - Modify tstclnt so that it has an auto-disconnect andEKR2016-11-081-461/+559
| | | | | | | | | | | | | | | | | | | | resume. r=mt Summary: It is difficult to resumption and 0-RTT with tstclnt as it currently is. This CL fixes that. The changes involve two new flags: A -- Read a fixed request from a file and use that instead of reading from stdin L -- Disconnect and reconnect L - 1 times. Reviewers: mt Differential Revision: https://nss-review.dev.mozaws.net/D39 Fix npds
* Bug 1286080 - tstclnt: incorrect error message for -H flag ↵catdesk2016-10-291-1/+1
| | | | (requireDHNamedGroups). r=franziskus
* Bug 1308198 - allow group config in selfserv and tstclnt, r=mtFranziskus Kiefer2016-10-101-6/+32
|
* Bug 1303224 - Remove the PKCS#11 bypass r=franziskus,mtTim Taubert2016-09-161-16/+3
|
* Bug 1252849 - Remove export-grade cipher suites r=mtTim Taubert2016-09-161-45/+27
|
* Bug 1295115 - follow up to clang-format for CI, r= kaieFranziskus Kiefer2016-08-141-1/+2
|
* Bug 1292130 - selfserv/tstclnt stale for 30 minutes on Win 2008 x64, r=ttaubertKai Engert2016-08-041-2/+2
|
* Bug 1285145 - Enable SSL tests on LSan runs r=franziskusNSS_3.26_BETA2Tim Taubert2016-07-071-9/+9
|
* Bug 1284272 - Follow-up to fix dbtests failures r=bustageTim Taubert2016-07-061-2/+2
|
* Bug 1284272 - Enable Chains tests on LSan runs r=franziskusTim Taubert2016-07-061-37/+68
|
* Bug 1283380 - Enable DB tests on LSan runs r=franziskusTim Taubert2016-06-301-0/+1
|
* Bug 1266237 - Enable FFDHE and DHE for TLS 1.3, r=ekrMartin Thomson2016-06-011-1/+17
|
* Bug 1271881 - Fix messages for tstclnt, r=ttaubertMartin Thomson2016-05-111-9/+6
|
* Bug 1247021, Backed out changeset 487a06b963f7, r=martin.thomsonKai Engert2016-04-291-6/+1
|
* Bug 1247021 - Add protective mechanisms to SSL_GetChannelInfo. Macro patch ↵Kai Engert2016-04-221-1/+6
| | | | v3 with improvements by Martin Thomson, r=rrelyea
* Bug 1254918 - clang-format NSS: cmd, r=kaieFranziskus Kiefer2016-04-211-815/+894
|
* Bug 1256630 - Fix scan-build errors. r=mtEKR2016-03-131-0/+6
|
View Lorry Controller Status