Add TLS_FALLBACK_SCSV documentation, and move s_client -fallback_scsv (8745c081) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP OpenSSL

apps/s_client.c

+4 −4

Original line number	Diff line number	Diff line
		@@ -604,10 +604,6 @@ int MAIN(int argc, char **argv)
		meth=DTLSv1_client_method();
		socket_type=SOCK_DGRAM;
		}
		else if (strcmp(*argv,"-fallback_scsv") == 0)
		{
		fallback_scsv = 1;
		}
		else if (strcmp(*argv,"-timeout") == 0)
		enable_timeouts=1;
		else if (strcmp(*argv,"-mtu") == 0)
		@@ -616,6 +612,10 @@ int MAIN(int argc, char **argv)
		socket_mtu = atol(*(++argv));
		}
		#endif
		else if (strcmp(*argv,"-fallback_scsv") == 0)
		{
		fallback_scsv = 1;
		}
		else if (strcmp(*argv,"-bugs") == 0)
		bugs=1;
		else if (strcmp(*argv,"-keyform") == 0)

+7 −3

Original line number	Diff line number	Diff line
		@@ -37,6 +37,7 @@ B<openssl> B<s_client>
		[B<-no_ssl2>]
		[B<-no_ssl3>]
		[B<-no_tls1>]
		[B<-fallback_scsv>]
		[B<-bugs>]
		[B<-cipher cipherlist>]
		[B<-serverpref>]
		@@ -201,10 +202,13 @@ these options disable the use of certain SSL or TLS protocols. By default
		the initial handshake uses a method which should be compatible with all
		servers and permit them to use SSL v3, SSL v2 or TLS as appropriate.

		Unfortunately there are a lot of ancient and broken servers in use which
		Unfortunately there are still ancient and broken servers in use which
		cannot handle this technique and will fail to connect. Some servers only
		work if TLS is turned off with the B<-no_tls> option others will only
		support SSL v2 and may need the B<-ssl2> option.
		work if TLS is turned off.

		=item B<-fallback_scsv>

		Send TLS_FALLBACK_SCSV in the ClientHello.

		=item B<-bugs>

+6 −0

Original line number	Diff line number	Diff line
		@@ -71,6 +71,12 @@ SSL_CTX->freelist_max_len, which defaults to 32. Using this flag can
		save around 34k per idle SSL connection.
		This flag has no effect on SSL v2 connections, or on DTLS connections.

		=item SSL_MODE_FALLBACK_SCSV

		Send TLS_FALLBACK_SCSV in the ClientHello.
		To be set by applications that reconnect with a downgraded protocol
		version; see draft-ietf-tls-downgrade-scsv-00 for details.

		=back

		=head1 RETURN VALUES