1 /* 2 * TLS check program for CUPS. 3 * 4 * Copyright 2007-2017 by Apple Inc. 5 * Copyright 1997-2006 by Easy Software Products. 6 * 7 * These coded instructions, statements, and computer programs are the 8 * property of Apple Inc. and are protected by Federal copyright 9 * law. Distribution and use rights are outlined in the file "LICENSE.txt" 10 * which should have been included with this file. If this file is 11 * missing or damaged, see the license at "http://www.cups.org/". 12 * 13 * This file is subject to the Apple OS-Developed Software exception. 14 */ 15 16 /* 17 * Include necessary headers... 18 */ 19 20 #include "cups-private.h" 21 22 23 #ifndef HAVE_SSL 24 int main(void) { puts("Sorry, no TLS support compiled in."); return (1); } 25 #else 26 27 /* 28 * Local functions... 29 */ 30 31 static void usage(void); 32 33 34 /* 35 * 'main()' - Main entry. 36 */ 37 38 int /* O - Exit status */ 39 main(int argc, /* I - Number of command-line arguments */ 40 char *argv[]) /* I - Command-line arguments */ 41 { 42 int i; /* Looping var */ 43 http_t *http; /* HTTP connection */ 44 const char *server = NULL; /* Hostname from command-line */ 45 int port = 0; /* Port number */ 46 const char *cipherName = "UNKNOWN";/* Cipher suite name */ 47 int dhBits = 0; /* Diffie-Hellman bits */ 48 int tlsVersion = 0; /* TLS version number */ 49 char uri[1024], /* Printer URI */ 50 scheme[32], /* URI scheme */ 51 host[256], /* Hostname */ 52 userpass[256], /* Username/password */ 53 resource[256]; /* Resource path */ 54 int af = AF_UNSPEC, /* Address family */ 55 tls_options = _HTTP_TLS_NONE, 56 /* TLS options */ 57 verbose = 0; /* Verbosity */ 58 ipp_t *request, /* IPP Get-Printer-Attributes request */ 59 *response; /* IPP Get-Printer-Attributes response */ 60 ipp_attribute_t *attr; /* Current attribute */ 61 const char *name; /* Attribute name */ 62 char value[1024]; /* Attribute (string) value */ 63 static const char * const pattrs[] = /* Requested attributes */ 64 { 65 "color-supported", 66 "compression-supported", 67 "document-format-supported", 68 "pages-per-minute", 69 "printer-location", 70 "printer-make-and-model", 71 "printer-state", 72 "printer-state-reasons", 73 "sides-supported", 74 "uri-authentication-supported", 75 "uri-security-supported" 76 }; 77 78 79 for (i = 1; i < argc; i ++) 80 { 81 if (!strcmp(argv[i], "--dh")) 82 { 83 tls_options |= _HTTP_TLS_ALLOW_DH; 84 } 85 else if (!strcmp(argv[i], "--no-cbc")) 86 { 87 tls_options |= _HTTP_TLS_DENY_CBC; 88 } 89 else if (!strcmp(argv[i], "--no-tls10")) 90 { 91 tls_options |= _HTTP_TLS_DENY_TLS10; 92 } 93 else if (!strcmp(argv[i], "--tls10")) 94 { 95 tls_options |= _HTTP_TLS_ONLY_TLS10; 96 } 97 else if (!strcmp(argv[i], "--rc4")) 98 { 99 tls_options |= _HTTP_TLS_ALLOW_RC4; 100 } 101 else if (!strcmp(argv[i], "--verbose") || !strcmp(argv[i], "-v")) 102 { 103 verbose = 1; 104 } 105 else if (!strcmp(argv[i], "-4")) 106 { 107 af = AF_INET; 108 } 109 else if (!strcmp(argv[i], "-6")) 110 { 111 af = AF_INET6; 112 } 113 else if (argv[i][0] == '-') 114 { 115 printf("tlscheck: Unknown option '%s'.\n", argv[i]); 116 usage(); 117 } 118 else if (!server) 119 { 120 if (!strncmp(argv[i], "ipps://", 7)) 121 { 122 httpSeparateURI(HTTP_URI_CODING_ALL, argv[i], scheme, sizeof(scheme), userpass, sizeof(userpass), host, sizeof(host), &port, resource, sizeof(resource)); 123 server = host; 124 } 125 else 126 { 127 server = argv[i]; 128 strlcpy(resource, "/ipp/print", sizeof(resource)); 129 } 130 } 131 else if (!port && (argv[i][0] == '=' || isdigit(argv[i][0] & 255))) 132 { 133 if (argv[i][0] == '=') 134 port = atoi(argv[i] + 1); 135 else 136 port = atoi(argv[i]); 137 } 138 else 139 { 140 printf("tlscheck: Unexpected argument '%s'.\n", argv[i]); 141 usage(); 142 } 143 } 144 145 if (!server) 146 usage(); 147 148 if (!port) 149 port = 631; 150 151 _httpTLSSetOptions(tls_options); 152 153 http = httpConnect2(server, port, NULL, af, HTTP_ENCRYPTION_ALWAYS, 1, 30000, NULL); 154 if (!http) 155 { 156 printf("%s: ERROR (%s)\n", server, cupsLastErrorString()); 157 return (1); 158 } 159 160 #ifdef __APPLE__ 161 SSLProtocol protocol; 162 SSLCipherSuite cipher; 163 char unknownCipherName[256]; 164 int paramsNeeded = 0; 165 const void *params; 166 size_t paramsLen; 167 OSStatus err; 168 169 if ((err = SSLGetNegotiatedProtocolVersion(http->tls, &protocol)) != noErr) 170 { 171 printf("%s: ERROR (No protocol version - %d)\n", server, (int)err); 172 httpClose(http); 173 return (1); 174 } 175 176 switch (protocol) 177 { 178 default : 179 tlsVersion = 0; 180 break; 181 case kSSLProtocol3 : 182 tlsVersion = 30; 183 break; 184 case kTLSProtocol1 : 185 tlsVersion = 10; 186 break; 187 case kTLSProtocol11 : 188 tlsVersion = 11; 189 break; 190 case kTLSProtocol12 : 191 tlsVersion = 12; 192 break; 193 } 194 195 if ((err = SSLGetNegotiatedCipher(http->tls, &cipher)) != noErr) 196 { 197 printf("%s: ERROR (No cipher suite - %d)\n", server, (int)err); 198 httpClose(http); 199 return (1); 200 } 201 202 switch (cipher) 203 { 204 case TLS_NULL_WITH_NULL_NULL: 205 cipherName = "TLS_NULL_WITH_NULL_NULL"; 206 break; 207 case TLS_RSA_WITH_NULL_MD5: 208 cipherName = "TLS_RSA_WITH_NULL_MD5"; 209 break; 210 case TLS_RSA_WITH_NULL_SHA: 211 cipherName = "TLS_RSA_WITH_NULL_SHA"; 212 break; 213 case TLS_RSA_WITH_RC4_128_MD5: 214 cipherName = "TLS_RSA_WITH_RC4_128_MD5"; 215 break; 216 case TLS_RSA_WITH_RC4_128_SHA: 217 cipherName = "TLS_RSA_WITH_RC4_128_SHA"; 218 break; 219 case TLS_RSA_WITH_3DES_EDE_CBC_SHA: 220 cipherName = "TLS_RSA_WITH_3DES_EDE_CBC_SHA"; 221 break; 222 case TLS_RSA_WITH_NULL_SHA256: 223 cipherName = "TLS_RSA_WITH_NULL_SHA256"; 224 break; 225 case TLS_RSA_WITH_AES_128_CBC_SHA256: 226 cipherName = "TLS_RSA_WITH_AES_128_CBC_SHA256"; 227 break; 228 case TLS_RSA_WITH_AES_256_CBC_SHA256: 229 cipherName = "TLS_RSA_WITH_AES_256_CBC_SHA256"; 230 break; 231 case TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA: 232 cipherName = "TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA"; 233 paramsNeeded = 1; 234 break; 235 case TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA: 236 cipherName = "TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA"; 237 paramsNeeded = 1; 238 break; 239 case TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA: 240 cipherName = "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA"; 241 paramsNeeded = 1; 242 break; 243 case TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA: 244 cipherName = "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA"; 245 paramsNeeded = 1; 246 break; 247 case TLS_DH_DSS_WITH_AES_128_CBC_SHA256: 248 cipherName = "TLS_DH_DSS_WITH_AES_128_CBC_SHA256"; 249 paramsNeeded = 1; 250 break; 251 case TLS_DH_RSA_WITH_AES_128_CBC_SHA256: 252 cipherName = "TLS_DH_RSA_WITH_AES_128_CBC_SHA256"; 253 paramsNeeded = 1; 254 break; 255 case TLS_DHE_DSS_WITH_AES_128_CBC_SHA256: 256 cipherName = "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256"; 257 paramsNeeded = 1; 258 break; 259 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: 260 cipherName = "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256"; 261 paramsNeeded = 1; 262 break; 263 case TLS_DH_DSS_WITH_AES_256_CBC_SHA256: 264 cipherName = "TLS_DH_DSS_WITH_AES_256_CBC_SHA256"; 265 paramsNeeded = 1; 266 break; 267 case TLS_DH_RSA_WITH_AES_256_CBC_SHA256: 268 cipherName = "TLS_DH_RSA_WITH_AES_256_CBC_SHA256"; 269 paramsNeeded = 1; 270 break; 271 case TLS_DHE_DSS_WITH_AES_256_CBC_SHA256: 272 cipherName = "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256"; 273 paramsNeeded = 1; 274 break; 275 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: 276 cipherName = "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256"; 277 paramsNeeded = 1; 278 break; 279 case TLS_DH_anon_WITH_RC4_128_MD5: 280 cipherName = "TLS_DH_anon_WITH_RC4_128_MD5"; 281 paramsNeeded = 1; 282 break; 283 case TLS_DH_anon_WITH_3DES_EDE_CBC_SHA: 284 cipherName = "TLS_DH_anon_WITH_3DES_EDE_CBC_SHA"; 285 paramsNeeded = 1; 286 break; 287 case TLS_DH_anon_WITH_AES_128_CBC_SHA256: 288 cipherName = "TLS_DH_anon_WITH_AES_128_CBC_SHA256"; 289 paramsNeeded = 1; 290 break; 291 case TLS_DH_anon_WITH_AES_256_CBC_SHA256: 292 cipherName = "TLS_DH_anon_WITH_AES_256_CBC_SHA256"; 293 paramsNeeded = 1; 294 break; 295 case TLS_PSK_WITH_RC4_128_SHA: 296 cipherName = "TLS_PSK_WITH_RC4_128_SHA"; 297 break; 298 case TLS_PSK_WITH_3DES_EDE_CBC_SHA: 299 cipherName = "TLS_PSK_WITH_3DES_EDE_CBC_SHA"; 300 break; 301 case TLS_PSK_WITH_AES_128_CBC_SHA: 302 cipherName = "TLS_PSK_WITH_AES_128_CBC_SHA"; 303 break; 304 case TLS_PSK_WITH_AES_256_CBC_SHA: 305 cipherName = "TLS_PSK_WITH_AES_256_CBC_SHA"; 306 break; 307 case TLS_DHE_PSK_WITH_RC4_128_SHA: 308 cipherName = "TLS_DHE_PSK_WITH_RC4_128_SHA"; 309 paramsNeeded = 1; 310 break; 311 case TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA: 312 cipherName = "TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA"; 313 paramsNeeded = 1; 314 break; 315 case TLS_DHE_PSK_WITH_AES_128_CBC_SHA: 316 cipherName = "TLS_DHE_PSK_WITH_AES_128_CBC_SHA"; 317 paramsNeeded = 1; 318 break; 319 case TLS_DHE_PSK_WITH_AES_256_CBC_SHA: 320 cipherName = "TLS_DHE_PSK_WITH_AES_256_CBC_SHA"; 321 paramsNeeded = 1; 322 break; 323 case TLS_RSA_PSK_WITH_RC4_128_SHA: 324 cipherName = "TLS_RSA_PSK_WITH_RC4_128_SHA"; 325 break; 326 case TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA: 327 cipherName = "TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA"; 328 break; 329 case TLS_RSA_PSK_WITH_AES_128_CBC_SHA: 330 cipherName = "TLS_RSA_PSK_WITH_AES_128_CBC_SHA"; 331 break; 332 case TLS_RSA_PSK_WITH_AES_256_CBC_SHA: 333 cipherName = "TLS_RSA_PSK_WITH_AES_256_CBC_SHA"; 334 break; 335 case TLS_PSK_WITH_NULL_SHA: 336 cipherName = "TLS_PSK_WITH_NULL_SHA"; 337 break; 338 case TLS_DHE_PSK_WITH_NULL_SHA: 339 cipherName = "TLS_DHE_PSK_WITH_NULL_SHA"; 340 paramsNeeded = 1; 341 break; 342 case TLS_RSA_PSK_WITH_NULL_SHA: 343 cipherName = "TLS_RSA_PSK_WITH_NULL_SHA"; 344 break; 345 case TLS_RSA_WITH_AES_128_GCM_SHA256: 346 cipherName = "TLS_RSA_WITH_AES_128_GCM_SHA256"; 347 break; 348 case TLS_RSA_WITH_AES_256_GCM_SHA384: 349 cipherName = "TLS_RSA_WITH_AES_256_GCM_SHA384"; 350 break; 351 case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256: 352 cipherName = "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"; 353 paramsNeeded = 1; 354 break; 355 case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384: 356 cipherName = "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"; 357 paramsNeeded = 1; 358 break; 359 case TLS_DH_RSA_WITH_AES_128_GCM_SHA256: 360 cipherName = "TLS_DH_RSA_WITH_AES_128_GCM_SHA256"; 361 paramsNeeded = 1; 362 break; 363 case TLS_DH_RSA_WITH_AES_256_GCM_SHA384: 364 cipherName = "TLS_DH_RSA_WITH_AES_256_GCM_SHA384"; 365 paramsNeeded = 1; 366 break; 367 case TLS_DHE_DSS_WITH_AES_128_GCM_SHA256: 368 cipherName = "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256"; 369 paramsNeeded = 1; 370 break; 371 case TLS_DHE_DSS_WITH_AES_256_GCM_SHA384: 372 cipherName = "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384"; 373 paramsNeeded = 1; 374 break; 375 case TLS_DH_DSS_WITH_AES_128_GCM_SHA256: 376 cipherName = "TLS_DH_DSS_WITH_AES_128_GCM_SHA256"; 377 paramsNeeded = 1; 378 break; 379 case TLS_DH_DSS_WITH_AES_256_GCM_SHA384: 380 cipherName = "TLS_DH_DSS_WITH_AES_256_GCM_SHA384"; 381 paramsNeeded = 1; 382 break; 383 case TLS_DH_anon_WITH_AES_128_GCM_SHA256: 384 cipherName = "TLS_DH_anon_WITH_AES_128_GCM_SHA256"; 385 paramsNeeded = 1; 386 break; 387 case TLS_DH_anon_WITH_AES_256_GCM_SHA384: 388 cipherName = "TLS_DH_anon_WITH_AES_256_GCM_SHA384"; 389 paramsNeeded = 1; 390 break; 391 case TLS_PSK_WITH_AES_128_GCM_SHA256: 392 cipherName = "TLS_PSK_WITH_AES_128_GCM_SHA256"; 393 break; 394 case TLS_PSK_WITH_AES_256_GCM_SHA384: 395 cipherName = "TLS_PSK_WITH_AES_256_GCM_SHA384"; 396 break; 397 case TLS_DHE_PSK_WITH_AES_128_GCM_SHA256: 398 cipherName = "TLS_DHE_PSK_WITH_AES_128_GCM_SHA256"; 399 paramsNeeded = 1; 400 break; 401 case TLS_DHE_PSK_WITH_AES_256_GCM_SHA384: 402 cipherName = "TLS_DHE_PSK_WITH_AES_256_GCM_SHA384"; 403 paramsNeeded = 1; 404 break; 405 case TLS_RSA_PSK_WITH_AES_128_GCM_SHA256: 406 cipherName = "TLS_RSA_PSK_WITH_AES_128_GCM_SHA256"; 407 break; 408 case TLS_RSA_PSK_WITH_AES_256_GCM_SHA384: 409 cipherName = "TLS_RSA_PSK_WITH_AES_256_GCM_SHA384"; 410 break; 411 case TLS_PSK_WITH_AES_128_CBC_SHA256: 412 cipherName = "TLS_PSK_WITH_AES_128_CBC_SHA256"; 413 break; 414 case TLS_PSK_WITH_AES_256_CBC_SHA384: 415 cipherName = "TLS_PSK_WITH_AES_256_CBC_SHA384"; 416 break; 417 case TLS_PSK_WITH_NULL_SHA256: 418 cipherName = "TLS_PSK_WITH_NULL_SHA256"; 419 break; 420 case TLS_PSK_WITH_NULL_SHA384: 421 cipherName = "TLS_PSK_WITH_NULL_SHA384"; 422 break; 423 case TLS_DHE_PSK_WITH_AES_128_CBC_SHA256: 424 cipherName = "TLS_DHE_PSK_WITH_AES_128_CBC_SHA256"; 425 paramsNeeded = 1; 426 break; 427 case TLS_DHE_PSK_WITH_AES_256_CBC_SHA384: 428 cipherName = "TLS_DHE_PSK_WITH_AES_256_CBC_SHA384"; 429 paramsNeeded = 1; 430 break; 431 case TLS_DHE_PSK_WITH_NULL_SHA256: 432 cipherName = "TLS_DHE_PSK_WITH_NULL_SHA256"; 433 paramsNeeded = 1; 434 break; 435 case TLS_DHE_PSK_WITH_NULL_SHA384: 436 cipherName = "TLS_DHE_PSK_WITH_NULL_SHA384"; 437 paramsNeeded = 1; 438 break; 439 case TLS_RSA_PSK_WITH_AES_128_CBC_SHA256: 440 cipherName = "TLS_RSA_PSK_WITH_AES_128_CBC_SHA256"; 441 break; 442 case TLS_RSA_PSK_WITH_AES_256_CBC_SHA384: 443 cipherName = "TLS_RSA_PSK_WITH_AES_256_CBC_SHA384"; 444 break; 445 case TLS_RSA_PSK_WITH_NULL_SHA256: 446 cipherName = "TLS_RSA_PSK_WITH_NULL_SHA256"; 447 break; 448 case TLS_RSA_PSK_WITH_NULL_SHA384: 449 cipherName = "TLS_RSA_PSK_WITH_NULL_SHA384"; 450 break; 451 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256: 452 cipherName = "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"; 453 paramsNeeded = 1; 454 break; 455 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384: 456 cipherName = "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384"; 457 paramsNeeded = 1; 458 break; 459 case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256: 460 cipherName = "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256"; 461 paramsNeeded = 1; 462 break; 463 case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384: 464 cipherName = "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384"; 465 paramsNeeded = 1; 466 break; 467 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256: 468 cipherName = "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"; 469 paramsNeeded = 1; 470 break; 471 case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384: 472 cipherName = "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"; 473 paramsNeeded = 1; 474 break; 475 case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256: 476 cipherName = "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256"; 477 paramsNeeded = 1; 478 break; 479 case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384: 480 cipherName = "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384"; 481 paramsNeeded = 1; 482 break; 483 case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: 484 cipherName = "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"; 485 paramsNeeded = 1; 486 break; 487 case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: 488 cipherName = "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"; 489 paramsNeeded = 1; 490 break; 491 case TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256: 492 cipherName = "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256"; 493 paramsNeeded = 1; 494 break; 495 case TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384: 496 cipherName = "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384"; 497 paramsNeeded = 1; 498 break; 499 case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: 500 cipherName = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"; 501 paramsNeeded = 1; 502 break; 503 case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: 504 cipherName = "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"; 505 paramsNeeded = 1; 506 break; 507 case TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256: 508 cipherName = "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256"; 509 paramsNeeded = 1; 510 break; 511 case TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384: 512 cipherName = "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384"; 513 paramsNeeded = 1; 514 break; 515 case TLS_RSA_WITH_AES_128_CBC_SHA: 516 cipherName = "TLS_RSA_WITH_AES_128_CBC_SHA"; 517 break; 518 case TLS_DH_DSS_WITH_AES_128_CBC_SHA: 519 cipherName = "TLS_DH_DSS_WITH_AES_128_CBC_SHA"; 520 paramsNeeded = 1; 521 break; 522 case TLS_DH_RSA_WITH_AES_128_CBC_SHA: 523 cipherName = "TLS_DH_RSA_WITH_AES_128_CBC_SHA"; 524 paramsNeeded = 1; 525 break; 526 case TLS_DHE_DSS_WITH_AES_128_CBC_SHA: 527 cipherName = "TLS_DHE_DSS_WITH_AES_128_CBC_SHA"; 528 paramsNeeded = 1; 529 break; 530 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA: 531 cipherName = "TLS_DHE_RSA_WITH_AES_128_CBC_SHA"; 532 paramsNeeded = 1; 533 break; 534 case TLS_DH_anon_WITH_AES_128_CBC_SHA: 535 cipherName = "TLS_DH_anon_WITH_AES_128_CBC_SHA"; 536 paramsNeeded = 1; 537 break; 538 case TLS_RSA_WITH_AES_256_CBC_SHA: 539 cipherName = "TLS_RSA_WITH_AES_256_CBC_SHA"; 540 break; 541 case TLS_DH_DSS_WITH_AES_256_CBC_SHA: 542 cipherName = "TLS_DH_DSS_WITH_AES_256_CBC_SHA"; 543 paramsNeeded = 1; 544 break; 545 case TLS_DH_RSA_WITH_AES_256_CBC_SHA: 546 cipherName = "TLS_DH_RSA_WITH_AES_256_CBC_SHA"; 547 paramsNeeded = 1; 548 break; 549 case TLS_DHE_DSS_WITH_AES_256_CBC_SHA: 550 cipherName = "TLS_DHE_DSS_WITH_AES_256_CBC_SHA"; 551 paramsNeeded = 1; 552 break; 553 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA: 554 cipherName = "TLS_DHE_RSA_WITH_AES_256_CBC_SHA"; 555 paramsNeeded = 1; 556 break; 557 case TLS_DH_anon_WITH_AES_256_CBC_SHA: 558 cipherName = "TLS_DH_anon_WITH_AES_256_CBC_SHA"; 559 paramsNeeded = 1; 560 break; 561 case TLS_ECDH_ECDSA_WITH_NULL_SHA: 562 cipherName = "TLS_ECDH_ECDSA_WITH_NULL_SHA"; 563 paramsNeeded = 1; 564 break; 565 case TLS_ECDH_ECDSA_WITH_RC4_128_SHA: 566 cipherName = "TLS_ECDH_ECDSA_WITH_RC4_128_SHA"; 567 paramsNeeded = 1; 568 break; 569 case TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA: 570 cipherName = "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA"; 571 paramsNeeded = 1; 572 break; 573 case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA: 574 cipherName = "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA"; 575 paramsNeeded = 1; 576 break; 577 case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA: 578 cipherName = "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA"; 579 paramsNeeded = 1; 580 break; 581 case TLS_ECDHE_ECDSA_WITH_NULL_SHA: 582 cipherName = "TLS_ECDHE_ECDSA_WITH_NULL_SHA"; 583 paramsNeeded = 1; 584 break; 585 case TLS_ECDHE_ECDSA_WITH_RC4_128_SHA: 586 cipherName = "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA"; 587 paramsNeeded = 1; 588 break; 589 case TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA: 590 cipherName = "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA"; 591 paramsNeeded = 1; 592 break; 593 case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA: 594 cipherName = "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA"; 595 paramsNeeded = 1; 596 break; 597 case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA: 598 cipherName = "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"; 599 paramsNeeded = 1; 600 break; 601 case TLS_ECDH_RSA_WITH_NULL_SHA: 602 cipherName = "TLS_ECDH_RSA_WITH_NULL_SHA"; 603 paramsNeeded = 1; 604 break; 605 case TLS_ECDH_RSA_WITH_RC4_128_SHA: 606 cipherName = "TLS_ECDH_RSA_WITH_RC4_128_SHA"; 607 paramsNeeded = 1; 608 break; 609 case TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA: 610 cipherName = "TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA"; 611 paramsNeeded = 1; 612 break; 613 case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA: 614 cipherName = "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA"; 615 paramsNeeded = 1; 616 break; 617 case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA: 618 cipherName = "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA"; 619 paramsNeeded = 1; 620 break; 621 case TLS_ECDHE_RSA_WITH_NULL_SHA: 622 cipherName = "TLS_ECDHE_RSA_WITH_NULL_SHA"; 623 paramsNeeded = 1; 624 break; 625 case TLS_ECDHE_RSA_WITH_RC4_128_SHA: 626 cipherName = "TLS_ECDHE_RSA_WITH_RC4_128_SHA"; 627 paramsNeeded = 1; 628 break; 629 case TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA: 630 cipherName = "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA"; 631 paramsNeeded = 1; 632 break; 633 case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA: 634 cipherName = "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"; 635 paramsNeeded = 1; 636 break; 637 case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA: 638 cipherName = "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"; 639 paramsNeeded = 1; 640 break; 641 case TLS_ECDH_anon_WITH_NULL_SHA: 642 cipherName = "TLS_ECDH_anon_WITH_NULL_SHA"; 643 paramsNeeded = 1; 644 break; 645 case TLS_ECDH_anon_WITH_RC4_128_SHA: 646 cipherName = "TLS_ECDH_anon_WITH_RC4_128_SHA"; 647 paramsNeeded = 1; 648 break; 649 case TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA: 650 cipherName = "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA"; 651 paramsNeeded = 1; 652 break; 653 case TLS_ECDH_anon_WITH_AES_128_CBC_SHA: 654 cipherName = "TLS_ECDH_anon_WITH_AES_128_CBC_SHA"; 655 paramsNeeded = 1; 656 break; 657 case TLS_ECDH_anon_WITH_AES_256_CBC_SHA: 658 cipherName = "TLS_ECDH_anon_WITH_AES_256_CBC_SHA"; 659 paramsNeeded = 1; 660 break; 661 default : 662 snprintf(unknownCipherName, sizeof(unknownCipherName), "UNKNOWN_%04X", cipher); 663 cipherName = unknownCipherName; 664 break; 665 } 666 667 if (cipher == TLS_RSA_WITH_RC4_128_MD5 || 668 cipher == TLS_RSA_WITH_RC4_128_SHA) 669 { 670 printf("%s: ERROR (Printers MUST NOT negotiate RC4 cipher suites.)\n", server); 671 httpClose(http); 672 return (1); 673 } 674 675 if ((err = SSLGetDiffieHellmanParams(http->tls, ¶ms, ¶msLen)) != noErr && paramsNeeded) 676 { 677 printf("%s: ERROR (Unable to get Diffie-Hellman parameters - %d)\n", server, (int)err); 678 httpClose(http); 679 return (1); 680 } 681 682 if (paramsLen < 128 && paramsLen != 0) 683 { 684 printf("%s: ERROR (Diffie-Hellman parameters MUST be at least 2048 bits, but Printer uses only %d bits/%d bytes)\n", server, (int)paramsLen * 8, (int)paramsLen); 685 httpClose(http); 686 return (1); 687 } 688 689 dhBits = (int)paramsLen * 8; 690 #endif /* __APPLE__ */ 691 692 if (dhBits > 0) 693 printf("%s: OK (TLS: %d.%d, %s, %d DH bits)\n", server, tlsVersion / 10, tlsVersion % 10, cipherName, dhBits); 694 else 695 printf("%s: OK (TLS: %d.%d, %s)\n", server, tlsVersion / 10, tlsVersion % 10, cipherName); 696 697 if (verbose) 698 { 699 httpAssembleURI(HTTP_URI_CODING_ALL, uri, sizeof(uri), "ipps", NULL, host, port, resource); 700 request = ippNewRequest(IPP_OP_GET_PRINTER_ATTRIBUTES); 701 ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "printer-uri", NULL, uri); 702 ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME, "requesting-user-name", NULL, cupsUser()); 703 ippAddStrings(request, IPP_TAG_OPERATION, IPP_TAG_KEYWORD, "requested-attributes", (int)(sizeof(pattrs) / sizeof(pattrs[0])), NULL, pattrs); 704 705 response = cupsDoRequest(http, request, resource); 706 707 for (attr = ippFirstAttribute(response); attr; attr = ippNextAttribute(response)) 708 { 709 if (ippGetGroupTag(attr) != IPP_TAG_PRINTER) 710 continue; 711 712 if ((name = ippGetName(attr)) == NULL) 713 continue; 714 715 ippAttributeString(attr, value, sizeof(value)); 716 printf(" %s=%s\n", name, value); 717 } 718 719 ippDelete(response); 720 } 721 722 httpClose(http); 723 724 return (0); 725 } 726 727 728 /* 729 * 'usage()' - Show program usage. 730 */ 731 732 static void 733 usage(void) 734 { 735 puts("Usage: ./tlscheck [options] server [port]"); 736 puts(" ./tlscheck [options] ipps://server[:port]/path"); 737 puts(""); 738 puts("Options:"); 739 puts(" --dh Allow DH/DHE key exchange"); 740 puts(" --no-cbc Disable CBC cipher suites"); 741 puts(" --no-tls10 Disable TLS/1.0"); 742 puts(" --rc4 Allow RC4 encryption"); 743 puts(" --tls10 Only use TLS/1.0"); 744 puts(" --verbose Be verbose"); 745 puts(" -4 Connect using IPv4 addresses only"); 746 puts(" -6 Connect using IPv6 addresses only"); 747 puts(" -v Be verbose"); 748 puts(""); 749 puts("The default port is 631."); 750 751 exit(1); 752 } 753 #endif /* !HAVE_SSL */ 754
