Add TLS_FALLBACK_SCSV documentation, and move s_client -fallback_scsv (3f4d81e8) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP OpenSSL

apps/s_client.c

+4 −4

Original line number	Diff line number	Diff line
		@@ -482,10 +482,6 @@ int MAIN(int argc, char **argv)
		meth=DTLSv1_client_method();
		sock_type=SOCK_DGRAM;
		}
		else if (strcmp(*argv,"-fallback_scsv") == 0)
		{
		fallback_scsv = 1;
		}
		else if (strcmp(*argv,"-timeout") == 0)
		enable_timeouts=1;
		else if (strcmp(*argv,"-mtu") == 0)
		@@ -494,6 +490,10 @@ int MAIN(int argc, char **argv)
		socket_mtu = atol(*(++argv));
		}
		#endif
		else if (strcmp(*argv,"-fallback_scsv") == 0)
		{
		fallback_scsv = 1;
		}
		else if (strcmp(*argv,"-bugs") == 0)
		bugs=1;
		else if (strcmp(*argv,"-keyform") == 0)

+7 −3

Original line number	Diff line number	Diff line
		@@ -50,6 +50,7 @@ B<openssl> B<s_client>
		[B<-no_ssl2>]
		[B<-no_ssl3>]
		[B<-no_tls1>]
		[B<-fallback_scsv>]
		[B<-bugs>]
		[B<-cipher cipherlist>]
		[B<-starttls protocol>]
		@@ -198,10 +199,13 @@ these options disable the use of certain SSL or TLS protocols. By default
		the initial handshake uses a method which should be compatible with all
		servers and permit them to use SSL v3, SSL v2 or TLS as appropriate.

		Unfortunately there are a lot of ancient and broken servers in use which
		Unfortunately there are still ancient and broken servers in use which
		cannot handle this technique and will fail to connect. Some servers only
		work if TLS is turned off with the B<-no_tls> option others will only
		support SSL v2 and may need the B<-ssl2> option.
		work if TLS is turned off.

		=item B<-fallback_scsv>

		Send TLS_FALLBACK_SCSV in the ClientHello.

		=item B<-bugs>

+6 −0

Original line number	Diff line number	Diff line
		@@ -61,6 +61,12 @@ deal with read/write operations returning without success report. The
		flag SSL_MODE_AUTO_RETRY will cause read/write operations to only
		return after the handshake and successful completion.

		=item SSL_MODE_FALLBACK_SCSV

		Send TLS_FALLBACK_SCSV in the ClientHello.
		To be set by applications that reconnect with a downgraded protocol
		version; see draft-ietf-tls-downgrade-scsv-00 for details.

		=back

		=head1 RETURN VALUES