prvPath := flag.String("key", "", "Path to client PKCS#8 private key")
casPath := flag.String("ca", "", "Path to CA certificates file")
hostname := flag.String("name", "example.com", "Expected server's hostname")
+ insecure := flag.Bool("insecure", false, "Insecure mode")
fpr := flag.String("fpr", "", "Expected SHA256 hash of server certificate's SPKI")
flag.Usage = func() {
fmt.Fprintf(os.Stderr, `Usage: tcpclient host port tlsc -name expected.name
}
cfg := &tls.Config{}
- if *hostname == "" || *onlyShow {
+ if *hostname == "" || *onlyShow || *insecure {
cfg.InsecureSkipVerify = true
- } else {
+ }
+ if *hostname != "" {
cfg.ServerName = *hostname
}
if *crtPath != "" {
}
if *casPath != "" {
var err error
- cfg.RootCAs, err = ucspi.CertPoolFromFile(*casPath)
+ _, cfg.RootCAs, err = ucspi.CertPoolFromFile(*casPath)
if err != nil {
log.Fatalln(err)
}
}
}
- conn := &ucspi.Conn{R: os.NewFile(6, "R"), W: os.NewFile(7, "W")}
- if conn.R == nil {
- log.Fatalln("no 6 file descriptor")
- }
- if conn.W == nil {
- log.Fatalln("no 7 file descriptor")
+ conn, err := ucspi.NewConn(os.NewFile(6, "R"), os.NewFile(7, "W"))
+ if err != nil {
+ log.Fatalln(err)
}
tlsConn := tls.Client(conn, cfg)
if err := tlsConn.Handshake(); err != nil {
connState := tlsConn.ConnectionState()
if *onlyShow {
fmt.Fprintf(
- os.Stderr, "Version: %04x\nCipherSuite: %s\n",
- connState.Version, tls.CipherSuiteName(connState.CipherSuite),
+ os.Stderr,
+ "Version: %s\nCipherSuite: %s\n",
+ ucspi.TLSVersion(connState.Version),
+ tls.CipherSuiteName(connState.CipherSuite),
)
for _, cert := range connState.PeerCertificates {
os.Stderr.WriteString("\n")
if err = cmd.Start(); err != nil {
log.Fatalln(err)
}
- copiers := make(chan struct{})
+ worker := make(chan struct{})
go func() {
io.Copy(rw, tlsConn)
rw.Close()
- close(copiers)
+ close(worker)
}()
go func() {
io.Copy(tlsConn, wr)
}()
_, err = cmd.Process.Wait()
- <-copiers
+ <-worker
+ tlsConn.Close()
if err != nil {
log.Fatalln(err)
}