generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add TLS_FALLBACK_SCSV documentation, and move s_client -fallback_scsv

Browse Source 
handling out of #ifndef OPENSSL_NO_DTLS1 section.

Reviewed-by: Rich Salz <rsalz@openssl.org>
This commit is contained in:
Bodo Moeller 2014-10-15 11:14:34 +02:00
parent 68828f167c
commit 8745c0815c
3 changed files with 17 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
apps/s_client.c
View File

@ -604,10 +604,6 @@ int MAIN(int argc, char **argv)
meth=DTLSv1_client_method();
socket_type=SOCK_DGRAM;
}
else if (strcmp(*argv,"-fallback_scsv") == 0)
{
fallback_scsv = 1;
}
else if (strcmp(*argv,"-timeout") == 0)
enable_timeouts=1;
else if (strcmp(*argv,"-mtu") == 0)
@ -616,6 +612,10 @@ int MAIN(int argc, char **argv)
socket_mtu = atol(*(++argv));
}
#endif
else if (strcmp(*argv,"-fallback_scsv") == 0)
{
fallback_scsv = 1;
}
else if (strcmp(*argv,"-bugs") == 0)
bugs=1;
else if (strcmp(*argv,"-keyform") == 0)

10
doc/apps/s_client.pod
View File

@ -37,6 +37,7 @@ B<openssl> B<s_client>
[B<-no_ssl2>]
[B<-no_ssl3>]
[B<-no_tls1>]
[B<-fallback_scsv>]
[B<-bugs>]
[B<-cipher cipherlist>]
[B<-serverpref>]
@ -201,10 +202,13 @@ these options disable the use of certain SSL or TLS protocols. By default
the initial handshake uses a method which should be compatible with all
servers and permit them to use SSL v3, SSL v2 or TLS as appropriate.
Unfortunately there are a lot of ancient and broken servers in use which
Unfortunately there are still ancient and broken servers in use which
cannot handle this technique and will fail to connect. Some servers only
work if TLS is turned off with the B<-no_tls> option others will only
support SSL v2 and may need the B<-ssl2> option.
work if TLS is turned off.
=item B<-fallback_scsv>
Send TLS_FALLBACK_SCSV in the ClientHello.
=item B<-bugs>

6
doc/ssl/SSL_CTX_set_mode.pod
View File

@ -71,6 +71,12 @@ SSL_CTX->freelist_max_len, which defaults to 32. Using this flag can
save around 34k per idle SSL connection.
This flag has no effect on SSL v2 connections, or on DTLS connections.
=item SSL_MODE_FALLBACK_SCSV
Send TLS_FALLBACK_SCSV in the ClientHello.
To be set by applications that reconnect with a downgraded protocol
version; see draft-ietf-tls-downgrade-scsv-00 for details.
=back
=head1 RETURN VALUES