Changes In Branch tls-1.8 Through [eccfed0ed3] Excluding Merge-Ins
This is equivalent to a diff from f5d3f859aa to eccfed0ed3
2024-05-27
| ||
13:23 | Remove tclconfig directory (since it should be extracted from "tclconfig" repository). Update configure to autoconf 2.72 check-in: 49aef5cb6c user: jan.nijtmans tags: trunk, main | |
2024-05-15
| ||
05:19 | Added install doc files on Windows. Windows makefile.vc improvements. check-in: 6b301093cd user: bohagan tags: tls-1.8 | |
02:26 | Updated pkgIndex file to only load script after package require check-in: eccfed0ed3 user: bohagan tags: tls-1.8 | |
2024-05-14
| ||
04:08 | Updated ignore files lists check-in: b8045a5c6a user: bohagan tags: tls-1.8 | |
2024-03-26
| ||
21:28 | Minor cleanups to remove obsolete code and add missing change log entry check-in: bb89d73224 user: bohagan tags: tls-1.8 | |
05:00 | Created tls1.8 branch Closed-Leaf check-in: 94d2753492 user: bohagan tags: tls1.8 | |
2024-03-15
| ||
23:39 | Updated make file to correct bugs Closed-Leaf check-in: f5d3f859aa user: bohagan tags: trunk | |
22:17 | Fix warnings for compile with GCC on TCL 9.0 check-in: 562bd95399 user: bohagan tags: trunk | |
Added .fossil-settings/crlf-glob version [e8a8a5e1b3].
Modified .fossil-settings/ignore-glob
from [9f8147414d]
to [31c2f7f395].
︙ | ︙ | |||
13 14 15 16 17 18 19 | autom4te.cache config.cache config.log config.status configure manifest.uuid pkgIndex.tcl | < < < | | > > > > | | 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 | autom4te.cache config.cache config.log config.status configure manifest.uuid pkgIndex.tcl *Uuid.h win/Debug* win/Release* win/version*.vc win/nmakehlp.exe win/nmakehlp.obj win/nmakehlp.out win/_junk.pch win/nmhlp-out.txt *~ |
Modified ChangeLog
from [7400a29b58]
to [03077231f7].
1 2 3 4 5 6 7 | 2015-05-01 Andreas Kupries <andreask@activestate.com> * configure.in: Bump to version 1.6.5. * win/makefile.vc: * configure: regen with ac-2.59 * tls.c: Accepted SF TLS [bug/patch #57](https://sourceforge.net/p/tls/bugs/57/). * tlsIO.c: Accepted core Tcl patch in [ticket](http://core.tcl.tk/tcl/tktview/0f94f855cafed92d0e174b7d835453a02831b4dd). | > > > > > > > | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 | TclTLS 1.7.22 ========== Release Date: Mon Oct 12 15:40:16 CDT 2020 https://tcltls.rkeene.org/ 2015-05-01 Andreas Kupries <andreask@activestate.com> * configure.in: Bump to version 1.6.5. * win/makefile.vc: * configure: regen with ac-2.59 * tls.c: Accepted SF TLS [bug/patch #57](https://sourceforge.net/p/tls/bugs/57/). * tlsIO.c: Accepted core Tcl patch in [ticket](http://core.tcl.tk/tcl/tktview/0f94f855cafed92d0e174b7d835453a02831b4dd). |
︙ | ︙ |
Modified Makefile.in
from [61dd86b789]
to [11cfd5196c].
︙ | ︙ | |||
212 213 214 215 216 217 218 | doc: @echo "If you have documentation to create, place the commands to" @echo "build the docs in the 'doc:' target. For example:" @echo " xml2nroff sample.xml > sample.n" @echo " xml2html sample.xml > sample.html" | | | | | > > > > > > > > > > | | > | 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 | doc: @echo "If you have documentation to create, place the commands to" @echo "build the docs in the 'doc:' target. For example:" @echo " xml2nroff sample.xml > sample.n" @echo " xml2html sample.xml > sample.html" install: all install-binaries install-libraries install-doc-n install-doc-html install-binaries: binaries install-lib-binaries install-bin-binaries #======================================================================== # This rule installs platform-independent files, such as header files. # The list=...; for p in $$list handles the empty list case x-platform. #======================================================================== install-libraries: libraries @$(INSTALL_DATA_DIR) "$(DESTDIR)$(includedir)" @echo "Installing header files in $(DESTDIR)$(includedir)" @list='$(PKG_HEADERS)'; for i in $$list; do \ echo "Installing $(srcdir)/$$i" ; \ $(INSTALL_DATA) $(srcdir)/$$i "$(DESTDIR)$(includedir)" ; \ done #======================================================================== # Install documentation. Unix manpages should go in the $(mandir) # directory. #======================================================================== install-doc-html: doc @$(INSTALL_DATA_DIR) "$(DESTDIR)$(pkglibdir)/html" @list='$(srcdir)/doc/*.html'; for i in $$list; do \ if test -f $$i ; then \ echo "Installing $$i"; \ $(INSTALL_DATA) $$i "$(DESTDIR)$(pkglibdir)/html"; \ fi; \ done install-doc-n: doc @$(INSTALL_DATA_DIR) "$(DESTDIR)$(mandir)/mann" @echo "Installing documentation in $(DESTDIR)$(mandir)" @list='$(srcdir)/doc/*.n'; for i in $$list; do \ if test -f $$i ; then \ echo "Installing $$i"; \ $(INSTALL_DATA) $$i "$(DESTDIR)$(mandir)/mann" ; \ fi; \ done test: binaries libraries $(TCLSH) `@CYGPATH@ $(srcdir)/tests/all.tcl` $(TESTFLAGS) \ -load "package ifneeded $(PACKAGE_NAME) $(PACKAGE_VERSION) \ [list load `@CYGPATH@ $(PKG_LIB_FILE)` [string totitle $(PACKAGE_NAME)]]" |
︙ | ︙ | |||
306 307 308 309 310 311 312 | # Setting the VPATH variable to a list of paths will cause the makefile # to look into these paths when resolving .c to .obj dependencies. # As necessary, add $(srcdir):$(srcdir)/compat:.... #======================================================================== VPATH = $(srcdir):$(srcdir)/generic:$(srcdir)/unix:$(srcdir)/win:$(srcdir)/macosx | < < < < < > > > > > | 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 | # Setting the VPATH variable to a list of paths will cause the makefile # to look into these paths when resolving .c to .obj dependencies. # As necessary, add $(srcdir):$(srcdir)/compat:.... #======================================================================== VPATH = $(srcdir):$(srcdir)/generic:$(srcdir)/unix:$(srcdir)/win:$(srcdir)/macosx # Create a C-source-ified version of the script resources # for TclTLS so that we only need a single file to enable # this extension tls.tcl.h: @srcdir@/library/tls.tcl Makefile od -A n -v -t xC < '@srcdir@/library/tls.tcl' > tls.tcl.h.new.1 sed 's@[^0-9A-Fa-f]@@g;s@..@0x&, @g' < tls.tcl.h.new.1 > tls.tcl.h.new.2 rm -f tls.tcl.h.new.1 mv tls.tcl.h.new.2 @srcdir@/generic/tls.tcl.h $(srcdir)/manifest.uuid: printf "git-" >$(srcdir)/manifest.uuid (cd $(srcdir); git rev-parse HEAD >>$(srcdir)/manifest.uuid || \ (printf "svn-r" >$(srcdir)/manifest.uuid ; \ svn info --show-item last-changed-revision >>$(srcdir)/manifest.uuid) || \ printf "unknown" >$(srcdir)/manifest.uuid) tlsUuid.h: $(srcdir)/manifest.uuid echo "#define TLS_VERSION_UUID \\" >$@ cat $(srcdir)/manifest.uuid >>$@ echo "" >>$@ tls.@OBJEXT@: tlsUuid.h tls.tcl.h .c.@OBJEXT@: $(COMPILE) -c `@CYGPATH@ $<` -o $@ #======================================================================== # Create the pkgIndex.tcl file. # It is usually easiest to let Tcl do this for you with pkg_mkIndex, but # you may find that you need to customize the package. If so, either # modify the -hand version, or create a pkgIndex.tcl.in file and have # the configure script output the pkgIndex.tcl by editing configure.in. #======================================================================== |
︙ | ︙ | |||
359 360 361 362 363 364 365 | DIST_DIR = $(DIST_ROOT)/$(PKG_DIR) DIST_INSTALL_DATA = CPPROG='cp -p' $(INSTALL) -m 644 DIST_INSTALL_DATA_RECUR = CPPROG='cp -p -R' $(INSTALL) DIST_INSTALL_SCRIPT = CPPROG='cp -p' $(INSTALL) -m 755 dist-clean: | | | | 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 | DIST_DIR = $(DIST_ROOT)/$(PKG_DIR) DIST_INSTALL_DATA = CPPROG='cp -p' $(INSTALL) -m 644 DIST_INSTALL_DATA_RECUR = CPPROG='cp -p -R' $(INSTALL) DIST_INSTALL_SCRIPT = CPPROG='cp -p' $(INSTALL) -m 755 dist-clean: rm -rf $(DIST_DIR) $(top_builddir)/$(PKG_DIR).tar.* dist: dist-clean $(srcdir)/manifest.uuid # TEA files $(INSTALL_DATA_DIR) $(DIST_DIR) $(DIST_INSTALL_DATA) $(srcdir)/Makefile.in \ $(srcdir)/acinclude.m4 $(srcdir)/aclocal.m4 \ $(srcdir)/configure.ac $(DIST_DIR)/ $(DIST_INSTALL_SCRIPT) $(srcdir)/configure $(DIST_DIR)/ |
︙ | ︙ | |||
394 395 396 397 398 399 400 | if test -d $(srcdir)/$$p ; then \ $(INSTALL_DATA_DIR) $(DIST_DIR)/$$p; \ $(DIST_INSTALL_DATA_RECUR) $(srcdir)/$$p/* $(DIST_DIR)/$$p/; \ fi; \ done (cd $(DIST_ROOT); $(COMPRESS);) | | | | 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 | if test -d $(srcdir)/$$p ; then \ $(INSTALL_DATA_DIR) $(DIST_DIR)/$$p; \ $(DIST_INSTALL_DATA_RECUR) $(srcdir)/$$p/* $(DIST_DIR)/$$p/; \ fi; \ done (cd $(DIST_ROOT); $(COMPRESS);) mv $(PKG_DIR).tar.gz $(top_builddir) cd $(top_builddir) #======================================================================== # End of user-definable section #======================================================================== #======================================================================== # Don't modify the file to clean here. Instead, set the "CLEANFILES" |
︙ | ︙ |
Modified configure.ac
from [7ae4b1d7b6]
to [8eaa936f41].
1 2 3 4 5 | #!/bin/bash -norc dnl This file is an input file used by the GNU "autoconf" program to dnl generate the file "configure", which is run during Tcl installation dnl to configure the system for the local environment. | < < < | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 | #!/bin/bash -norc dnl This file is an input file used by the GNU "autoconf" program to dnl generate the file "configure", which is run during Tcl installation dnl to configure the system for the local environment. #----------------------------------------------------------------------- # This is the configure.ac for the TclTLS extension. The only places you # should need to modify this file are marked by the string __CHANGE__. #----------------------------------------------------------------------- #----------------------------------------------------------------------- # This initializes the environment with PACKAGE_NAME and PACKAGE_VERSION # set as provided. These will also be added as -D defs in your Makefile # so you can encode the package version directly into the source files. # This will also define a special symbol for Windows (BUILD_<PACKAGE_NAME> # so that we create the export library with the dll. #----------------------------------------------------------------------- |
︙ | ︙ | |||
58 59 60 61 62 63 64 | # This also calls AC_PROG_CC and a few others to create the basic setup # necessary to compile executables. #----------------------------------------------------------------------- TEA_SETUP_COMPILER #----------------------------------------------------------------------- | < | < > | < | | | 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 | # This also calls AC_PROG_CC and a few others to create the basic setup # necessary to compile executables. #----------------------------------------------------------------------- TEA_SETUP_COMPILER #----------------------------------------------------------------------- # Specify the C source files to compile in TEA_ADD_SOURCES, # public headers that need to be installed in TEA_ADD_HEADERS, # stub library C source files to compile in TEA_ADD_STUB_SOURCES, # and runtime Tcl library files in TEA_ADD_TCL_SOURCES. # This defines PKG(_STUB)_SOURCES, PKG(_STUB)_OBJECTS, PKG_HEADERS # and PKG_TCL_SOURCES. #----------------------------------------------------------------------- TEA_ADD_SOURCES([tls.c tlsBIO.c tlsIO.c tlsX509.c]) TEA_ADD_HEADERS([generic/tls.h]) TEA_ADD_INCLUDES([]) TEA_ADD_LIBS([]) TEA_ADD_CFLAGS([]) TEA_ADD_STUB_SOURCES([]) TEA_ADD_TCL_SOURCES([library/tls.tcl license.terms README.txt]) #-------------------------------------------------------------------- # You can add more files to clean if your extension creates any extra # files by extending CLEANFILES. # Add pkgIndex.tcl if it is generated in the Makefile instead of ./configure # and change Makefile.in to move it from CONFIG_CLEAN_FILES to BINARIES var. # # A few miscellaneous platform-specific items: # TEA_ADD_* any platform specific compiler/build info here. #-------------------------------------------------------------------- TEA_ADD_CLEANFILES([pkgIndex.tcl tls.tcl.h.*]) if test "${TEA_PLATFORM}" = "windows" ; then AC_DEFINE(BUILD_tls) TEA_ADD_CLEANFILES([*.lib *.dll *.exp *.ilk *.pdb vc*.pch]) else TEA_ADD_CLEANFILES([*.so]) fi AC_SUBST(CLEANFILES) #-------------------------------------------------------------------- # Choose which headers you need. Extension authors should try very # hard to only rely on the Tcl public header files. Internal headers # contain private data structures and are subject to change without |
︙ | ︙ |
Modified doc/tls.html
from [f3734629c9]
to [a7248f0188].
1 2 3 4 5 6 7 8 9 10 11 | <!DOCTYPE html> <html lang="en"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Copyright" content="1999 Matt Newman / 2004 Starfish Systems"> <title>TLS (SSL) TCL Commands</title> <link rel="stylesheet" href="docs.css" type="text/css" media="all"> </head> <body class="vsc-initialized"> | | | | | | | | | | | | | | | > | | | < | > > | | > > > | | | > > | < | | < | | | | < | | | < | < | | < | < > | | | | | | | > | < | | | | | < | | | | | | | | < < | < | | < | | | | | < | | | | | | < | | | | | | | | | | | | < | | | > > > | < < | < | | | | | | | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 | <!DOCTYPE html> <html lang="en"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Copyright" content="1999 Matt Newman / 2004 Starfish Systems"> <title>TLS (SSL) TCL Commands</title> <link rel="stylesheet" href="docs.css" type="text/css" media="all"> </head> <body class="vsc-initialized"> <h2>TCL Tls Extension Documentation</h2> <dl> <dd><a href="#NAME">NAME</a> <dl> <dd><b>tls</b> - binding to <b>OpenSSL</b> library for encrypted socket and I/O channel communications.</dd> </dl> </dd> <dd><a href="#SYNOPSIS">SYNOPSIS</a> </dd> <dd><dl> <dd><b>package require Tcl</b> <em>?<b>8.5-</b>?</em></dd> <dd><b>package require tls</b> <em>?<b>1.8-</b>?</em></dd> <dt> </dt> <dd><b>tls::init</b> <em>?options?</em> </dd> <dd><b>tls::socket</b> <em>?options? host port</em></dd> <dd><b>tls::socket</b> <em>?-server command? ?options? port</em></dd> <dd><b>tls::handshake</b> <em> channel</em></dd> <dd><b>tls::status</b> <em>?-local? channel</em></dd> <dd><b>tls::connection</b> <em>channel</em></dd> <dd><b>tls::import</b> <em>channel ?options?</em></dd> <dd><b>tls::unimport</b> <em>channel</em></dd> <dt> </dt> <dd><b>tls::ciphers</b> <em>?protocol? ?verbose? ?supported?</em></dd> <dd><b>tls::protocols</b></dd> <dd><b>tls::version</b></dd> </dl></dd> <dd><a href="#COMMANDS">COMMANDS</a></dd> <dd><a href="#CALLBACK OPTIONS">CALLBACK OPTIONS</a></dd> <dd><a href="#HTTPS EXAMPLE">HTTPS EXAMPLE</a></dd> <dd><a href="#SEE ALSO">SPECIAL CONSIDERATIONS</a></dd> <dd><a href="#SEE ALSO">SEE ALSO</a></dd> </dl> <hr> <h3><a name="NAME">NAME</a></h3> <p><strong>tls</strong> - binding to <strong>OpenSSL</strong> library for encrypted socket and I/O channel communications.</p> <hr> <h3><a name="SYNOPSIS">SYNOPSIS</a></h3> <p><b>package require Tcl</b> <em>?<b>8.5-</b>?</em><br> <b>package require tls</b> <em>?<b>1.8-</b>?</em><br> <br> <a href="#tls::init"><b>tls::init</b> <i>?options?</i></a><br> <a href="#tls::socket"><b>tls::socket</b> <i>?options? host port</i><br> <a href="#tls::socket"><b>tls::socket</b> <i>?-server command? ?options? port</i></a><br> <a href="#tls::status"><b>tls::status</b> <i>?-local? channel</i></a><br> <a href="#tls::connection"><b>tls::connection</b> <i>channel</i></a><br> <a href="#tls::handshake"><b>tls::handshake</b> <i>channel</i></a><br> <a href="#tls::import"><b>tls::import</b> <i>channel ?options?</i></a><br> <a href="#tls::unimport"><b>tls::unimport</b> <i>channel</i></a><br> <br> <a href="#tls::ciphers"><b>tls::ciphers</b> <i>?protocol? ?verbose? ?supported?</i></a><br> <a href="#tls::protocols"><b>tls::protocols</b></a><br> <a href="#tls::version"><b>tls::version</b></a><br> </p> <hr> <h3><a name="DESCRIPTION">DESCRIPTION</a></h3> <p>This extension provides TCL script access to secure socket communications using the Transport Layer Security (TLS) protocol. It provides a generic binding to <a href="https://www.openssl.org/">OpenSSL</a>, utilizing the <strong>Tcl_StackChannel</strong> API in TCL 8.4 and higher. These sockets behave exactly the same as channels created using the built-in <strong>socket</strong> command, along with additional options for controlling the SSL/TLS session. </p> <hr> <h3><a name="COMMANDS">COMMANDS</a></h3> <p>Typically one would use the <strong>tls::socket </strong>command which provides compatibility with the native TCL <strong>socket</strong> command. In such cases <strong>tls::import</strong> should not be used directly.</p> <dl> <dt><a name="tls::init"><b>tls::init </b><i>?options?</i></a></dt> <dd>Optional function to set the default options used by <strong>tls::socket</strong>. If you call <strong>tls::import</strong> directly, this command has no effect. This command supports all of the same options as the <strong>tls::socket</strong> command, though you should limit your options to only TLS related ones.</dd> <dt> </dt> <dt><a name="tls::socket"><b>tls::socket </b><em>?options? host port</em></a></dt> <dt><b>tls::socket</b><em> ?-server command? ?options? port</em></dt> <dd>This is a helper function that utilizes the underlying commands (<strong>socket</strong> and <strong>tls::import</strong>) to create the connection. It behaves the same as the native TCL <strong>socket</strong> command, but also supports the <a href="#tls::import"><strong>tls:import</strong></a> command options and one additional option:</dd> <dl><blockquote> <dt><strong>-autoservername</strong> <em>bool</em></dt> <dd>Automatically set the -servername argument to the <em>host</em> argument (default is <em>false</em>).</dd> </blockquote></dl> <dt><a name="tls::import"><b>tls::import </b><i>channel ?options?</i></a></dt> <dd>Add SSL/TLS encryption to a regular TCL channel. It need not be a socket, but must provide bi-directional flow. Also set session parameters for SSL handshake.</dd> <dl><blockquote> <dt><strong>-alpn</strong> <em>list</em></dt> <dd>List of protocols to offer during Application-Layer Protocol Negotiation (ALPN). For example: <em>h2</em> and <em>http/1.1</em>, but not <em>h3</em> or <em>quic</em>.</dd> <dt><strong>-cadir</strong> <em>dir</em></dt> <dd>Specifies the directory where the Certificate Authority (CA) certificates are stored. The default is platform specific and can be set at compile time. This can be overridden via the <b>SSL_CERT_DIR</b> environment variable.</dd> <dt><strong>-cafile </strong><em>filename</em></dt> <dd>Specifies the file with the Certificate Authority (CA) certificates to use. The default is <b>cert.pem</b>, in the OpenSSL directory. This can also be overridden via the <b>SSL_CERT_FILE</b> environment variable.</dd> <dt><strong>-certfile</strong> <em>filename</em></dt> <dd>Specifies the file with the certificate to use in PEM format. This also contains the public key.</dd> <dt><strong>-cert</strong> <em>binary_string</em></dt> <dd>Specifies the certificate to use as a DER encoded string (X.509 DER).</dd> <dt><strong>-cipher</strong> <em>string</em></dt> <dd>Specifies the list of ciphers to use for TLS 1.2 and earlier. String is a colon (":") separated list of ciphers. Ciphers can be combined using the <b>+</b> character. Prefixes can be used to permanently remove ("!"), delete ("-"), or move a cipher to the end of the list ("+"). Keywords <b>@STRENGTH</b> (sort by algorithm key length), <b>@SECLEVEL=</b><i>n</i> (set security level to n), and <b>DEFAULT</b> (use default cipher list, at start only) can also be specified. See OpenSSL documentation for the full list of valid values.</dd> <dt><strong>-ciphersuites</strong> <em>string</em></dt> <dd>Specifies the list of cipher suites to use for TLS 1.3. String is a colon (":") separated list of cipher suite names.</dd> <dt><strong>-command</strong> <em>callback</em></dt> <dd>Specifies the callback command to be invoked at several points during the handshake to pass errors, tracing information, and protocol messages. See <a href="#CALLBACK OPTIONS">CALLBACK OPTIONS</a> for more info.</dd> <dt><strong>-dhparams </strong><em>filename</em></dt> <dd>Specifies the Diffie-Hellman (DH) parameters file.</dd> <dt><strong>-keyfile</strong> <em>filename</em></dt> <dd>Specifies the private key file. (default is value of -certfile).</dd> <dt><strong>-key</strong> <em>filename</em></dt> <dd>Specifies the private key to use as a DER encoded string (PKCS#1 DER).</dd> <dt><strong>-model</strong> <em>channel</em></dt> <dd>Force this channel to share the same <em><strong>SSL_CTX</strong></em> structure as the specified <em>channel</em>, and therefore share callbacks etc.</dd> <dt><strong>-password</strong> <em>callback</em></dt> <dd>Specifies the callback command to invoke when OpenSSL needs to obtain a password. This is typically used to unlock the private key of a certificate. The callback should return a password string. See <a href="#CALLBACK OPTIONS">CALLBACK OPTIONS</a> for more info.</dd> <dt><strong>-post_handshake</strong> <em>bool</em></dt> <dd>Allow post-handshake session ticket updates.</dd> <dt><strong>-request </strong><em>bool</em></dt> <dd>Request a certificate from peer during the SSL handshake. This is needed to do certificate validation. (default is <em>true</em>)</dd> <dt><strong>-require</strong> <em>bool</em></dt> <dd>Require a valid certificate from peer during SSL handshake. If this is set to true, then <strong>-request</strong> must also be set to true and a either a -cadir, -cafile, or platform default must be provided in order to validate against. (default is <em>false</em>)</dd> <dt><strong>-security_level</strong> <em>integer</em></dt> <dd>Specifies the security level (value from 0 to 5). The security level affects the cipher suite encryption algorithms, supported ECC curves, supported signature algorithms, DH parameter sizes, certificate key sizes and signature algorithms. The default is 1. Level 3 and higher disable support for session tickets and only accept cipher suites that provide forward secrecy.</dd> <dt><strong>-server</strong> <em>bool</em></dt> <dd>Specifies whether to act as a server and respond with a server handshake when a client connects and provides a client handshake. (default is <em>false</em>)</dd> <dt><strong>-servername</strong> <em>host</em></dt> <dd>Specify server's hostname. This is used to set the TLS Server Name Indication (SNI) extension. Set this to the expected servername in the server's certificate or one of the subjectAltName alternates.</dd> <dt><strong>-session_id</strong> <em>string</em></dt> <dd>Specifies the session id to resume session.</dd> <dt><strong>-ssl2</strong> <em>bool</em></dt> <dd>Enable use of SSL v2. (default is <em>false</em>)</dd> <dt><strong>-ssl3 </strong><em>bool</em></dt> <dd>Enable use of SSL v3. (default is <em>false</em>)</dd> <dt>-<strong>tls1</strong> <em>bool</em></dt> <dd>Enable use of TLS v1. (default is <em>true</em>)</dd> <dt>-<strong>tls1.1</strong> <em>bool</em></dt> <dd>Enable use of TLS v1.1 (default is <em>true</em>)</dd> <dt>-<strong>tls1.2</strong> <em>bool</em></dt> <dd>Enable use of TLS v1.2 (default is <em>true</em>)</dd> <dt>-<strong>tls1.3</strong> <em>bool</em></dt> <dd>Enable use of TLS v1.3 (default is <em>true</em>)</dd> <dt><strong>-validatecommand</strong> <em>callback</em></dt> <dd>Specifies the callback command to invoke to validate protocol config parameters during the protocol negotiation phase. This can be used by TCL scripts to perform their own certificate validation to supplement the default validation provided by OpenSSL. The script must return a boolean true to continue the negotiation. See <a href="#CALLBACK OPTIONS">CALLBACK OPTIONS</a> for more info.</dd> </blockquote></dl> <dt><a name="tls::unimport"><b>tls::unimport </b><i>channel</i></a></dt> <dd>Provided for symmetry to <strong>tls::import</strong>, this unstacks the encryption of a regular TCL channel. An error is thrown if TLS is not the top stacked channel type.</dd> <dt> </dt> <dt><a name="tls::handshake"><strong>tls::handshake</strong> <em>channel</em></a></dt> <dd>Forces handshake to take place, and returns 0 if handshake is still in progress (non-blocking), or 1 if the handshake was successful. If the handshake failed this routine will throw an error.</dd> <dt> </dt> <dt><a name="tls::status"><strong>tls::status</strong> <em>?</em><b>-local</b><em>? channel</em></a></dt> <dd>Returns the current status of an SSL channel. The result is a list of key-value pairs describing the SSL, certificate, and certificate verification status. If the SSL handshake has not yet completed, an empty list is returned. If <b>-local</b> is specified, then the local certificate is used.</dd> <blockquote> <b>SSL Status</b> <dl> <dt><strong>alpn</strong> <em>protocol</em></dt> <dd>The protocol selected after Application-Layer Protocol Negotiation (ALPN).</dd> <dt><strong>cipher</strong> <em>cipher</em></dt> <dd>The current cipher in use for the session.</dd> <dt><strong>peername</strong> <em>name</em></dt> <dd>The peername from the certificate.</dd> <dt><strong>protocol</strong> <em>version</em></dt> <dd>The protocol version used for the connection: SSL2, SSL3, TLS1, TLS1.1, TLS1.2, TLS1.3, or unknown.</dd> <dt><strong>sbits</strong> <em>n</em></dt> <dd>The number of bits used for the session key.</dd> |
︙ | ︙ | |||
267 268 269 270 271 272 273 | <dt><strong>verifyMode</strong> <em>list</em></dt> <dd>List of certificate verification modes.</dd> <dt><strong>verifyResult</strong> <em>result</em></dt> <dd>Certificate verification result.</dd> <dt><strong>ca_names</strong> <em>list</em></dt> <dd>List of the Certificate Authorities used to create the certificate.</dd> </dl> | < < | < | | < | | < < < | | | | 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 | <dt><strong>verifyMode</strong> <em>list</em></dt> <dd>List of certificate verification modes.</dd> <dt><strong>verifyResult</strong> <em>result</em></dt> <dd>Certificate verification result.</dd> <dt><strong>ca_names</strong> <em>list</em></dt> <dd>List of the Certificate Authorities used to create the certificate.</dd> </dl> <b>Certificate Status</b> <dl> <dt><strong>all</strong> <em>string</em></dt> <dd>Dump of all certificate info.</dd> <dt><strong>version</strong> <em>value</em></dt> <dd>The certificate version.</dd> <dt><strong>serialNumber</strong> <em>n</em></dt> <dd>The serial number of the certificate as a hex string.</dd> <dt><strong>signature</strong> <em>algorithm</em></dt> <dd>Cipher algorithm used for certificate signature.</dd> <dt><strong>issuer</strong> <em>dn</em></dt> <dd>The distinguished name (DN) of the certificate issuer.</dd> <dt><strong>notBefore</strong> <em>date</em></dt> <dd>The beginning date of the certificate validity.</dd> <dt><strong>notAfter</strong> <em>date</em></dt> <dd>The expiration date of the certificate validity.</dd> <dt><strong>subject</strong> <em>dn</em></dt> <dd>The distinguished name (DN) of the certificate subject. Fields include: Common Name (CN), Organization (O), Locality or City (L), State or Province (S), and Country Name (C).</dd> <dt><strong>issuerUniqueID</strong> <em>string</em></dt> <dd>The issuer unique id.</dd> <dt><strong>subjectUniqueID</strong> <em>string</em></dt> <dd>The subject unique id.</dd> <dt><strong>num_extensions</strong> <em>n</em></dt> <dd>Number of certificate extensions.</dd> <dt><strong>extensions</strong> <em>list</em></dt> <dd>List of certificate extension names.</dd> <dt><strong>authorityKeyIdentifier</strong> <em>string</em></dt> <dd>(AKI) Key identifier of the Issuing CA certificate that signed the SSL certificate as a hex string. This value matches the SKI value of the Intermediate CA certificate.</dd> <dt><strong>subjectKeyIdentifier</strong> <em>string</em></dt> <dd>(SKI) Hash of the public key inside the certificate as a hex string. Used to identify certificates that contain a particular public key.</dd> <dt><strong>subjectAltName</strong> <em>list</em></dt> <dd>List of all of the alternative domain names, sub domains, and IP addresses that are secured by the certificate.</dd> <dt><strong>ocsp</strong> <em>list</em></dt> <dd>List of all Online Certificate Status Protocol (OCSP) URLs.</dd> <dt><strong>certificate</strong> <em>cert</em></dt> <dd>The PEM encoded certificate.</dd> <dt><strong>signatureAlgorithm</strong> <em>algorithm</em></dt> <dd>Cipher algorithm used for the certificate signature.</dd> <dt><strong>signatureValue</strong> <em>string</em></dt> <dd>Certificate signature as a hex string.</dd> <dt><strong>signatureDigest</strong> <em>version</em></dt> <dd>Certificate signing digest as a hex string.</dd> <dt><strong>publicKeyAlgorithm</strong> <em>algorithm</em></dt> <dd>Certificate signature public key algorithm.</dd> <dt><strong>publicKey</strong> <em>string</em></dt> <dd>Certificate signature public key as a hex string.</dd> <dt><strong>bits</strong> <em>n</em></dt> <dd>Number of bits used for certificate signature key.</dd> <dt><strong>self_signed</strong> <em>boolean</em></dt> <dd>Whether the certificate signature is self signed.</dd> <dt><strong>sha1_hash</strong> <em>hash</em></dt> <dd>The SHA1 hash of the certificate as a hex string.</dd> <dt><strong>sha256_hash</strong> <em>hash</em></dt> <dd>The SHA256 hash of the certificate as a hex string.</dd> </dl> </blockquote> <dt><a name="tls::connection"><strong>tls::connection</strong> <em>channel</em></a></dt> <dd>Returns the current connection status of an SSL channel. The result is a list of key-value pairs describing the connection.</dd> <blockquote> <b>SSL Status</b> <dl> <dt><strong>state</strong> <em>state</em></dt> <dd>State of the connection.</dd> <dt><strong>servername</strong> <em>name</em></dt> <dd>The name of the connected to server.</dd> <dt><strong>protocol</strong> <em>version</em></dt> <dd>The protocol version used for the connection: |
︙ | ︙ | |||
367 368 369 370 371 372 373 | <dt><strong>compression</strong> <em>mode</em></dt> <dd>Compression method.</dd> <dt><strong>expansion</strong> <em>mode</em></dt> <dd>Expansion method.</dd> <dt><strong>caList</strong> <em>list</em></dt> <dd>List of Certificate Authorities (CA) for X.509 certificate.</dd> </dl> | < < | | < < | | 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 | <dt><strong>compression</strong> <em>mode</em></dt> <dd>Compression method.</dd> <dt><strong>expansion</strong> <em>mode</em></dt> <dd>Expansion method.</dd> <dt><strong>caList</strong> <em>list</em></dt> <dd>List of Certificate Authorities (CA) for X.509 certificate.</dd> </dl> <b>Cipher Info</b> <dl> <dt><strong>cipher</strong> <em>cipher</em></dt> <dd>The current cipher in use for the connection.</dd> <dt><strong>standard_name</strong> <em>name</em></dt> <dd>The standard RFC name of cipher.</dd> <dt><strong>algorithm_bits</strong> <em>n</em></dt> <dd>The number of processed bits used for cipher.</dd> <dt><strong>secret_bits</strong> <em>n</em></dt> <dd>The number of secret bits used for cipher.</dd> <dt><strong>min_version</strong> <em>version</em></dt> <dd>The minimum protocol version for cipher.</dd> <dt><strong>cipher_is_aead</strong> <em>boolean</em></dt> <dd>Whether the cipher is Authenticated Encryption with Associated Data (AEAD).</dd> <dt><strong>cipher_id</strong> <em>id</em></dt> <dd>The OpenSSL cipher id.</dd> <dt><strong>description</strong> <em>string</em></dt> <dd>A text description of the cipher.</dd> <dt><strong>handshake_digest</strong> <em>boolean</em></dt> <dd>Digest used during handshake.</dd> </dl> <b>Session Info</b> <dl> <dt><strong>alpn</strong> <em>protocol</em></dt> <dd>The protocol selected after Application-Layer Protocol Negotiation (ALPN).</dd> <dt><strong>resumable</strong> <em>boolean</em></dt> <dd>Whether the session can be resumed or not.</dd> <dt><strong>start_time</strong> <em>seconds</em></dt> |
︙ | ︙ | |||
417 418 419 420 421 422 423 | <dt><strong>ticket_app_data</strong> <em>binary_string</em></dt> <dd>Unique session ticket application data.</dd> <dt><strong>master_key</strong> <em>binary_string</em></dt> <dd>Unique session master key.</dd> <dt><strong>session_cache_mode</strong> <em>mode</em></dt> <dd>Server cache mode (client, server, or both).</dd> </dl> | | > > > > > > > > > > > | | > > < < < | < < | < | | | | | < < | | | | | | | | | | | | | | | | | | < | | | | | | | | | | < | | | | | | | | | < | | | | < < < < | | | | | | | | < | | > | | | < < < < < | | | | | | | | | | | < | < | | | | | | | | | | | < | < | | | | | | | | | | | | < | < | | | | | | | | | | | | | | | | | | | | | | < | | | > < < | > > < | < < | | 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 | <dt><strong>ticket_app_data</strong> <em>binary_string</em></dt> <dd>Unique session ticket application data.</dd> <dt><strong>master_key</strong> <em>binary_string</em></dt> <dd>Unique session master key.</dd> <dt><strong>session_cache_mode</strong> <em>mode</em></dt> <dd>Server cache mode (client, server, or both).</dd> </dl> </blockquote> <dt><a name="tls::ciphers"><strong>tls::ciphers</strong> <em>?protocol? ?verbose? ?supported?</em></a></dt> <dd>Without any args, returns a list of all symmetric ciphers for use with the <strong>-cipher</strong> option. With <em>protocol</em>, only the ciphers supported for that protocol are returned. See <a href="#tls::protocols"><strong>tls::protocols</strong></a> command for the supported protocols. If <em>verbose</em> is specified as true then a verbose, human readable list is returned with additional information on the cipher. If <em>supported</em> is specified as true, then only the ciphers supported for protocol will be listed.</dd> <dt> </dt> <dt><a name="tls::protocols"><strong>tls::protocols</strong></a></dt> <dd>Returns a list of the supported SSL/TLS protocols. Valid values are: <b>ssl2</b>, <b>ssl3</b>, <b>tls1</b>, <b>tls1.1</b>, <b>tls1.2</b>, and <b>tls1.3</b>. Exact list depends on OpenSSL version and compile time flags.</dd> <dt> </dt> <dt><a name="tls::version"><strong>tls::version</strong></a></dt> <dd>Returns the OpenSSL version string.</dd> </dl> <hr> <h3><a name="CALLBACK OPTIONS">CALLBACK OPTIONS</a></h3> <p> As indicated above, individual channels can be given their own callbacks to handle intermediate processing by the OpenSSL library, using the <strong>-command</strong>, <strong>-password</strong>, and <strong>-validate_command</strong> options passed to either of <strong>tls::socket</strong> or <strong>tls::import</strong>. If the callback generates an error, the <b>bgerror</b> command will be invoked with the error information. </p> <dl> <dt><strong>-command</strong> <em>callback</em></dt> <dd> Invokes the specified <em>callback</em> script at several points during the OpenSSL handshake and use. See below for the possible arguments passed to the callback script. Values returned from the callback are ignored. <br> <dl> <dt> <strong>error</strong> <em>channelId message</em> </dt> <dd> This form of callback is invoked whenever an error occurs during the initial connection, handshake, or I/O operations. The <em>message</em> argument can be from the Tcl_ErrnoMsg, OpenSSL function <code>ERR_reason_error_string()</code>, or a custom message. </dd> <br> <dt> <strong>info</strong> <em>channelId major minor message type</em> </dt> <dd> This form of callback is invoked by the OpenSSL function <code>SSL_set_info_callback()</code> during the initial connection and handshake operations. The <em>type</em> argument is new for TLS 1.8. The arguments are: <br> <ul> <li>Possible values for <em>major</em> are: <code>handshake, alert, connect, accept</code>.</li> <li>Possible values for <em>minor</em> are: <code>start, done, read, write, loop, exit</code>.</li> <li>The <em>message</em> argument is a descriptive string which may be generated either by <code>SSL_state_string_long()</code> or by <code>SSL_alert_desc_string_long()</code>, depending on the context.</li> <li>For alerts, the possible values for <em>type</em> are: <code>warning, fatal, and unknown</code>. For others, <code>info</code> is used.</li> </ul> </dd> <dt> <strong>message</strong> <em>channelId direction version content_type message</em> </dt> <dd> This form of callback is invoked by the OpenSSL function <code>SSL_set_msg_callback()</code> whenever a message is sent or received during the initial connection, handshake, or I/O operations. It is only available when OpenSSL is complied with the <em>enable-ssl-trace</em> option. Arguments are: <em>direction</em> is <b>Sent</b> or <b>Received</b>, <em>version</em> is the protocol version, <em>content_type</em> is the message content type, and <em>message</em> is more info from the <code>SSL_trace</code> API. This callback is new for TLS 1.8. </dd> <br> <dt> <strong>session</strong> <em>channelId session_id ticket lifetime</em> </dt> <dd> This form of callback is invoked by the OpenSSL function <code>SSL_CTX_sess_set_new_cb()</code> whenever a new session id is sent by the server during the initial connection and handshake, but can also be received later if the <b>-post_handshake</b> option is used. Arguments are: <em>session_id</em> is the current session identifier, <em>ticket</em> is the session ticket info, and <em>lifetime</em> is the the ticket lifetime in seconds. This callback is new for TLS 1.8. </dd> </dl> </dd> </dl> <br> <dl> <dt><strong>-password</strong> <em>callback</em></dt> <dd> Invokes the specified <em>callback</em> script when OpenSSL needs to obtain a password. See below for the possible arguments passed to the callback script. See below for valid return values. <br> <dl> <dt> <strong>password</strong> <em>rwflag size</em> </dt> <dd> Invoked when loading or storing a PEM certificate with encryption. Where <em>rwflag</em> is 0 for reading/decryption or 1 for writing/encryption (can prompt user to confirm) and <em>size</em> is the max password length in bytes. The callback should return the password as a string. Both arguments are new for TLS 1.8. </dd> </dl> </dd> </dl> <br> <dl> <dt><strong>-validatecommand</strong> <em>callback</em></dt> <dd> Invokes the specified <em>callback</em> script during handshake in order to validate the provided value(s). See below for the possible arguments passed to the callback script. If not specified, OpenSSL will accept valid certificates and extensions. To reject the value and abort the connection, the callback should return 0. To accept the value and continue the connection, it should return 1. To reject the value, but continue the connection, it should return 2. <br> <dl> <dt> <strong>alpn</strong> <em>channelId protocol match</em> </dt> <dd> For servers, this form of callback is invoked when the client ALPN extension is received. If <em>match</em> is true, <em>protocol</em> is the first <b>-alpn</b> option specified protocol common to both the client and server. If not, the first client specified protocol is used. It is called after the hello and ALPN callbacks. This callback is new for TLS 1.8. </dd> <br> <dt> <strong>hello</strong> <em>channelId servername</em> </dt> <dd> For servers, this form of callback is invoked during client hello message processing. The purpose is so the server can select the appropriate certificate to present to the client, and to make other configuration adjustments relevant to that server name and its configuration. It is called before the SNI and ALPN callbacks. This callback is new for TLS 1.8. </dd> <br> <dt> <strong>sni</strong> <em>channelId servername</em> </dt> <dd> For servers, this form of callback is invoked when the Server Name Indication (SNI) extension is received. The <em>servername</em> argument is the client provided server name in the <b>-servername</b> option. The purpose is so when a server supports multiple names, the right certificate can be used. It is called after the hello callback but before the ALPN callback. This callback is new for TLS 1.8. </dd> <br> <dt> <strong>verify</strong> <em>channelId depth cert status error</em> </dt> <dd> This form of callback is invoked by OpenSSL when a new certificate is received from the peer. It allows the client to check the certificate verification results and choose whether to continue or not. It is called for each certificate in the certificate chain. <ul> <li>The <em>depth</em> argument is the integer depth of the certificate in the certificate chain, where 0 is the peer certificate and higher values going up to the Certificate Authority (CA).</li> <li>The <em>cert</em> argument is a list of key-value pairs similar to those returned by <a href="#tls::status"><strong>tls::status</strong></a>.</li> <li>The <em>status</em> argument is the boolean validity of the current certificate where 0 is invalid and 1 is valid.</li> <li>The <em>error</em> argument is the error message, if any, generated by <code>X509_STORE_CTX_get_error()</code>.</li> </ul> </dd> <br> </dl> </dd> </dl> <p> Reference implementations of these callbacks are provided in the distribution as <strong>tls::callback</strong>, <strong>tls::password</strong>, and <strong>tls::validate_command</strong> respectively. Note that these are <em>sample</em> implementations only. In a more realistic deployment you would specify your own callback scripts on each TLS channel using the <strong>-command</strong>, <strong>-password</strong>, and <strong>-validate_command</strong> options. </p> <p> The default behavior when the <strong>-command</strong> and <strong>-validate_command</strong> options are not specified is for TLS to process the associated library callbacks internally. The default behavior when the <strong>-password</strong> option is not specified is for TLS to process the associated library callbacks by attempting to call <strong>tls::password</strong>. The difference between these two behaviors is a consequence of maintaining compatibility with earlier implementations. </p> <p> <em> The use of the reference callbacks <strong>tls::callback</strong>, <strong>tls::password</strong>, and <strong>tls::validate_command</strong> is not recommended. They may be removed from future releases. </em> </p> <hr> <h3><a name="DEBUG">DEBUG</a></h3> TLS key logging can be enabled by setting the environment variable <b>SSLKEYLOGFILE</b> to the name of the file to log to. Then whenever TLS key material is generated or received it will be logged to the file. This is useful for logging key data for network logging tools to use to decrypt the data. <p> The <strong>tls::debug</strong> variable provides some additional control over these reference callbacks. Its value is zero by default. Higher values produce more diagnostic output, and will also force the verify method in <strong>tls::callback</strong> to accept the certificate, even when it is invalid if the <b>tls::validate_command</b> callback is used for the <b>-validatecommand</b> option. </p> <p> <em> The use of the variable <strong>tls::debug</strong> is not recommended. It may be removed from future releases. </em> </p> <h4><a name="DEBUG_EXAMPLES">Debug Examples</a></h4> <p>These examples use the default Unix platform SSL certificates. For standard installations, -cadir and -cafile should not be needed. If your certificates are in non-standard locations, update -cadir or use -cafile as needed.</p> <br> <p>Example #1: Use HTTP package</p> <pre><code> package require http package require tls set url "https://www.tcl.tk/" http::register https 443 [list ::tls::socket -autoservername true -require true -cadir /etc/ssl/certs \ -command ::tls::callback -password ::tls::password -validatecommand ::tls::validate_command] |
︙ | ︙ | |||
720 721 722 723 724 725 726 | set data [http::data $token] puts [string length $data] # Cleanup ::http::cleanup $token </code></pre> | | | 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 | set data [http::data $token] puts [string length $data] # Cleanup ::http::cleanup $token </code></pre> <p>Example #2: Use raw socket</p> <pre><code> package require tls set url "www.tcl-lang.org" set port 443 set ch [tls::socket -autoservername 1 -servername $url -request 1 -require 1 \ |
︙ | ︙ | |||
747 748 749 750 751 752 753 754 755 756 757 758 759 760 | array set chan [chan configure $ch] close $ch parray status parray conn parray chan </code></pre> <h3><a name="HTTPS EXAMPLE">HTTPS EXAMPLE</a></h3> <p>These examples use the default Unix platform SSL certificates. For standard installations, -cadir and -cafile should not be needed. If your certificates are in non-standard locations, update -cadir or use -cafile as needed.</p> | > | < | 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 | array set chan [chan configure $ch] close $ch parray status parray conn parray chan </code></pre> <hr> <h3><a name="HTTPS EXAMPLE">HTTPS EXAMPLE</a></h3> <p>These examples use the default Unix platform SSL certificates. For standard installations, -cadir and -cafile should not be needed. If your certificates are in non-standard locations, update -cadir or use -cafile as needed.</p> <p>Example #1: Get web page</p> <pre><code> package require http package require tls set url "https://www.tcl.tk/" http::register https 443 [list ::tls::socket -autoservername true -require true -cadir /etc/ssl/certs] |
︙ | ︙ | |||
777 778 779 780 781 782 783 | set data [http::data $token] puts $data # Cleanup ::http::cleanup $token </code></pre> | | < > > > > | | 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 | set data [http::data $token] puts $data # Cleanup ::http::cleanup $token </code></pre> <p>Example #2: Download file</p> <pre><code> package require http package require tls set url "https://wiki.tcl-lang.org/sitemap.xml" set filename [file tail $url] http::register https 443 [list ::tls::socket -autoservername true -require true -cadir /etc/ssl/certs] # Get file set ch [open $filename wb] set token [::http::geturl $url -blocksize 65536 -channel $ch] # Cleanup close $ch ::http::cleanup $token </code></pre> <hr> <h3><a name="SPECIAL CONSIDERATIONS">SPECIAL CONSIDERATIONS</a></h3> <p>The capabilities of this package can vary enormously based upon how the linked to OpenSSL library was configured and built. New versions may obsolete older protocol versions, add or remove ciphers, change default values, etc. Use the <strong>tls::protocols</strong> commands to obtain the supported protocol versions.</p> <hr> <h3><a name="SEE ALSO">SEE ALSO</a></h3> <p><strong>socket</strong>, <strong>fileevent</strong>, <strong>http</strong>, <a href="https://www.openssl.org/"><strong>OpenSSL</strong></a></p> <hr> <pre> Copyright © 1999 Matt Newman. Copyright © 2004 Starfish Systems. Copyright © 2023 Brian O'Hagan. </pre> </body> </html> |
Modified generic/tls.c
from [62e132dc18]
to [5901aadd4f].
︙ | ︙ | |||
156 157 158 159 160 161 162 | *------------------------------------------------------------------- */ static void InfoCallback(const SSL *ssl, int where, int ret) { State *statePtr = (State*)SSL_get_app_data((SSL *)ssl); Tcl_Interp *interp = statePtr->interp; Tcl_Obj *cmdPtr; | | | 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 | *------------------------------------------------------------------- */ static void InfoCallback(const SSL *ssl, int where, int ret) { State *statePtr = (State*)SSL_get_app_data((SSL *)ssl); Tcl_Interp *interp = statePtr->interp; Tcl_Obj *cmdPtr; char *major, *minor; dprintf("Called"); if (statePtr->callback == (Tcl_Obj*)NULL) return; if (where & SSL_CB_HANDSHAKE_START) { |
︙ | ︙ | |||
2186 2187 2188 2189 2190 2191 2192 2193 2194 2195 2196 2197 2198 2199 2200 2201 2202 2203 2204 2205 2206 | res = SSL_get_peer_signature_nid(statePtr->ssl, &nid); } else { res = SSL_get_signature_nid(statePtr->ssl, &nid); } if (!res) {nid = 0;} LAPPEND_STR(interp, objPtr, "signatureHashAlgorithm", OBJ_nid2ln(nid), -1); if (objc == 2) { res = SSL_get_peer_signature_type_nid(statePtr->ssl, &nid); } else { res = SSL_get_signature_type_nid(statePtr->ssl, &nid); } if (!res) {nid = 0;} LAPPEND_STR(interp, objPtr, "signatureType", OBJ_nid2ln(nid), -1); Tcl_SetObjResult(interp, objPtr); return TCL_OK; } /* *------------------------------------------------------------------- | > > > | 2186 2187 2188 2189 2190 2191 2192 2193 2194 2195 2196 2197 2198 2199 2200 2201 2202 2203 2204 2205 2206 2207 2208 2209 | res = SSL_get_peer_signature_nid(statePtr->ssl, &nid); } else { res = SSL_get_signature_nid(statePtr->ssl, &nid); } if (!res) {nid = 0;} LAPPEND_STR(interp, objPtr, "signatureHashAlgorithm", OBJ_nid2ln(nid), -1); /* Added in OpenSSL 1.1.1a */ #if OPENSSL_VERSION_NUMBER > 0x10101000L if (objc == 2) { res = SSL_get_peer_signature_type_nid(statePtr->ssl, &nid); } else { res = SSL_get_signature_type_nid(statePtr->ssl, &nid); } if (!res) {nid = 0;} LAPPEND_STR(interp, objPtr, "signatureType", OBJ_nid2ln(nid), -1); #endif Tcl_SetObjResult(interp, objPtr); return TCL_OK; } /* *------------------------------------------------------------------- |
︙ | ︙ | |||
3016 3017 3018 3019 3020 3021 3022 | /* Initialize BOTH libcrypto and libssl. */ OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS | OPENSSL_INIT_LOAD_CRYPTO_STRINGS | OPENSSL_INIT_ADD_ALL_CIPHERS | OPENSSL_INIT_ADD_ALL_DIGESTS, NULL); BIO_new_tcl(NULL, 0); | < < < < < < < < < < < < < < < < < < < < < < < < < | 3019 3020 3021 3022 3023 3024 3025 3026 3027 3028 3029 3030 3031 | /* Initialize BOTH libcrypto and libssl. */ OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS | OPENSSL_INIT_LOAD_CRYPTO_STRINGS | OPENSSL_INIT_ADD_ALL_CIPHERS | OPENSSL_INIT_ADD_ALL_DIGESTS, NULL); BIO_new_tcl(NULL, 0); #if defined(OPENSSL_THREADS) && defined(TCL_THREADS) Tcl_MutexUnlock(&init_mx); #endif return status; } |
Modified generic/tlsInt.h
from [ec109c3ca8]
to [82f0ee7773].
︙ | ︙ | |||
38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 | # endif #endif /* * Backwards compatibility for size type change */ #if TCL_MAJOR_VERSION < 9 && TCL_MINOR_VERSION < 7 #ifndef Tcl_Size typedef int Tcl_Size; #endif #define TCL_SIZE_MODIFIER "" #endif #include <openssl/ssl.h> #include <openssl/err.h> #include <openssl/rand.h> #include <openssl/opensslv.h> | > > > > > > | 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 | # endif #endif /* * Backwards compatibility for size type change */ #if TCL_MAJOR_VERSION < 9 && TCL_MINOR_VERSION < 7 #include <limits.h> #define TCL_SIZE_MAX INT_MAX #ifndef Tcl_Size typedef int Tcl_Size; #endif #define TCL_SIZE_MODIFIER "" #define Tcl_GetSizeIntFromObj Tcl_GetIntFromObj #define Tcl_NewSizeIntObj Tcl_NewIntObj #define Tcl_NewSizeIntFromObj Tcl_NewWideIntObj #endif #include <openssl/ssl.h> #include <openssl/err.h> #include <openssl/rand.h> #include <openssl/opensslv.h> |
︙ | ︙ |
Modified pkgIndex.tcl.in
from [4281cedefb]
to [e6c743ae4f].
1 2 3 4 | # -*- tcl -*- # Tcl package index file, version 1.1 # if {[package vsatisfies [package provide Tcl] 9.0-]} { | | > | > > | | | | > > > > | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 | # -*- tcl -*- # Tcl package index file, version 1.1 # if {[package vsatisfies [package provide Tcl] 9.0-]} { package ifneeded @PACKAGE_NAME@ @PACKAGE_VERSION@ [list apply {{dir} { # Load library load [file join $dir @PKG_LIB_FILE9@] [string totitle @PACKAGE_NAME@] # Source init file set initScript [file join $dir @PACKAGE_NAME@.tcl] if {[file exists $initScript]} { source -encoding utf-8 $initScript } }} $dir] } else { if {![package vsatisfies [package provide Tcl] 8.5]} {return} package ifneeded @PACKAGE_NAME@ @PACKAGE_VERSION@ [list apply {{dir} { # Load library if {[string tolower [file extension @PKG_LIB_FILE8@]] in [list .dll .dylib .so]} { # Load dynamic library load [file join $dir @PKG_LIB_FILE8@] [string totitle @PACKAGE_NAME@] } else { # Static library load {} [string totitle @PACKAGE_NAME@] } # Source init file set initScript [file join $dir @PACKAGE_NAME@.tcl] if {[file exists $initScript]} { source -encoding utf-8 $initScript } }} $dir] } |
Modified win/makefile.vc
from [40f325b18a]
to [83b0269d62].
1 2 | #------------------------------------------------------------- -*- makefile -*- # | | | 1 2 3 4 5 6 7 8 9 10 | #------------------------------------------------------------- -*- makefile -*- # # Makefile for TCL TLS extension # # Basic build, test and install # nmake /f makefile.vc INSTALLDIR=c:\path\to\tcl # nmake /f makefile.vc INSTALLDIR=c:\path\to\tcl test # nmake /f makefile.vc INSTALLDIR=c:\path\to\tcl install # # For other build options (debug, static etc.), |
︙ | ︙ | |||
28 29 30 31 32 33 34 | PRJ_OBJS = $(TMP_DIR)\tls.obj \ $(TMP_DIR)\tlsBIO.obj \ $(TMP_DIR)\tlsIO.obj \ $(TMP_DIR)\tlsX509.obj # Define any additional project include flags # SSL_INSTALL_FOLDER = with the OpenSSL installation folder following. | | | 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 | PRJ_OBJS = $(TMP_DIR)\tls.obj \ $(TMP_DIR)\tlsBIO.obj \ $(TMP_DIR)\tlsIO.obj \ $(TMP_DIR)\tlsX509.obj # Define any additional project include flags # SSL_INSTALL_FOLDER = with the OpenSSL installation folder following. PRJ_INCLUDES = -I"$(SSL_INSTALL_FOLDER)\include" -I"$(OPENSSL_INSTALL_DIR)\include" -I"$(TMP_DIR)" # Define any additional compiler flags that might be required for the project PRJ_DEFINES = -D NO_SSL2 -D NO_SSL3 -D _CRT_SECURE_NO_WARNINGS # # SSL Libs: # 1. ${LIBCRYPTO}.dll |
︙ | ︙ | |||
55 56 57 58 59 60 61 | !include "targets.vc" # Project specific targets all: default-target clean: default-clean | < < > | > > | > > | > > | | > | | 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 | !include "targets.vc" # Project specific targets all: default-target clean: default-clean realclean: default-hose # We must define a pkgindex target that will create a pkgIndex.tcl # file in the $(OUT_DIR) directory. We can just redirect to the # default-pkgindex target for our sample extension. pkgindex: default-pkgindex-tea $(ROOT)\manifest.uuid: if not exist $(ROOT)\manifest.uuid ( copy $(WIN_DIR)\gitmanifest.in $(ROOT)\manifest.uuid where git if ERRORLEVEL 0 ( git rev-parse HEAD >>$(ROOT)\manifest.uuid ) else ( echo unknown >>$(ROOT)\manifest.uuid ) ) $(TMP_DIR)\tlsUuid.h: $(ROOT)\manifest.uuid copy $(WIN_DIR)\tlsUuid.h.in+$(ROOT)\manifest.uuid $(TMP_DIR)\tlsUuid.h echo: >>$(TMP_DIR)\tlsUuid.h # The default install target only installs binaries and scripts so add # an additional target for our documentation. Note this *adds* a target # since no commands are listed after it. The original targets for # install (from targets.vc) will remain. install: default-pkgindex-tea default-install default-install-docs-html if exist "$(SSL_INSTALL_FOLDER)\bin\libcrypto-*-x64.dll" ( xcopy /c /y "$(SSL_INSTALL_FOLDER)\bin\libcrypto-*-x64.dll" "$(PRJ_INSTALL_DIR)" ) if exist "$(SSL_INSTALL_FOLDER)\bin\libssl-*-x64.dll" ( xcopy /c /y "$(SSL_INSTALL_FOLDER)\bin\libssl-*-x64.dll" "$(PRJ_INSTALL_DIR)" ) # Explicit dependency rules $(GENERICDIR)\tls.c: $(TMP_DIR)\tlsUuid.h # Test package test: default-test |