diff options
| author | Jo-Philipp Wich <jo@mein.io> | 2020-02-15 22:39:30 +0100 |
|---|---|---|
| committer | Jo-Philipp Wich <jo@mein.io> | 2020-02-15 23:51:01 +0100 |
| commit | af585dbd1d444faafa370a73c1db43aece731f85 (patch) | |
| tree | 9e0c64b9e0ff2ead8eaff1a040b8a18c4ccb3639 | |
| parent | fef6d3d311ac45c662c01e0ebd9cb0f6c8d7145c (diff) | |
| download | uclient-af585dbd1d444faafa370a73c1db43aece731f85.tar.gz | |
uclient-fetch: support specifying advertised TLS ciphers
Introduce a new `--ciphers` option which allows specifying a colon separated
list of usable TLS ciphers.
Depending on the underlying ustream-ssl provider, the list either follows
OpenSSL's cipher string format or, in case of mbedTLS, is a simple colon
separated cipher whitelist.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
| -rw-r--r-- | uclient-fetch.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/uclient-fetch.c b/uclient-fetch.c index 38c9c53..a06be5d 100644 --- a/uclient-fetch.c +++ b/uclient-fetch.c @@ -467,6 +467,7 @@ static int usage(const char *progname) "HTTPS options:\n" " --ca-certificate=<cert> Load CA certificates from file <cert>\n" " --no-check-certificate don't validate the server's certificate\n" + " --ciphers=<cipherlist> Set the cipher list string\n" "\n", progname); return 1; } @@ -510,6 +511,7 @@ static int no_ssl(const char *progname) enum { L_NO_CHECK_CERTIFICATE, L_CA_CERTIFICATE, + L_CIPHERS, L_USER, L_PASSWORD, L_USER_AGENT, @@ -525,6 +527,7 @@ enum { static const struct option longopts[] = { [L_NO_CHECK_CERTIFICATE] = { "no-check-certificate", no_argument }, [L_CA_CERTIFICATE] = { "ca-certificate", required_argument }, + [L_CIPHERS] = { "ciphers", required_argument }, [L_USER] = { "user", required_argument }, [L_PASSWORD] = { "password", required_argument }, [L_USER_AGENT] = { "user-agent", required_argument }, @@ -568,6 +571,15 @@ int main(int argc, char **argv) if (ssl_ctx) ssl_ops->context_add_ca_crt_file(ssl_ctx, optarg); break; + case L_CIPHERS: + if (ssl_ctx) { + if (ssl_ops->context_set_ciphers(ssl_ctx, optarg)) { + if (!quiet) + fprintf(stderr, "No recognized ciphers in cipher list\n"); + exit(1); + } + } + break; case L_USER: if (!strlen(optarg)) break; |