static int early_data = 0;
#ifndef OPENSSL_NO_PSK
-static const char psk_identity[] = "Client_identity";
+static char *psk_identity = "Client_identity";
char *psk_key = NULL; /* by default PSK is not used */
static unsigned int psk_server_cb(SSL *ssl, const char *identity,
/* here we could lookup the given identity e.g. from a database */
if (strcmp(identity, psk_identity) != 0) {
- BIO_printf(bio_s_out, "PSK error: client identity not found"
+ BIO_printf(bio_s_out, "PSK warning: client identity not what we expected"
" (got '%s' expected '%s')\n", identity, psk_identity);
- goto out_err;
- }
- if (s_debug)
+ } else {
+ if (s_debug)
BIO_printf(bio_s_out, "PSK client identity found\n");
+ }
/* convert the PSK key to binary */
key = OPENSSL_hexstr2buf(psk_key, &key_len);
OPT_STATUS_TIMEOUT, OPT_STATUS_URL, OPT_STATUS_FILE, OPT_MSG, OPT_MSGFILE,
OPT_TRACE, OPT_SECURITY_DEBUG, OPT_SECURITY_DEBUG_VERBOSE, OPT_STATE,
OPT_CRLF, OPT_QUIET, OPT_BRIEF, OPT_NO_DHE,
- OPT_NO_RESUME_EPHEMERAL, OPT_PSK_HINT, OPT_PSK, OPT_SRPVFILE,
+ OPT_NO_RESUME_EPHEMERAL, OPT_PSK_IDENTITY, OPT_PSK_HINT, OPT_PSK, OPT_SRPVFILE,
OPT_SRPUSERSEED, OPT_REV, OPT_WWW, OPT_UPPER_WWW, OPT_HTTP, OPT_ASYNC,
OPT_SSL_CONFIG,
OPT_MAX_SEND_FRAG, OPT_SPLIT_SEND_FRAG, OPT_MAX_PIPELINES, OPT_READ_BUF,
{"ssl_config", OPT_SSL_CONFIG, 's',
"Configure SSL_CTX using the configuration 'val'"},
{"max_send_frag", OPT_MAX_SEND_FRAG, 'p', "Maximum Size of send frames "},
- {"split_send_frag", OPT_SPLIT_SEND_FRAG, 'n',
+ {"split_send_frag", OPT_SPLIT_SEND_FRAG, 'p',
"Size used to split data for encrypt pipelines"},
- {"max_pipelines", OPT_MAX_PIPELINES, 'n',
+ {"max_pipelines", OPT_MAX_PIPELINES, 'p',
"Maximum number of encrypt/decrypt pipelines to be used"},
- {"read_buf", OPT_READ_BUF, 'n',
+ {"read_buf", OPT_READ_BUF, 'p',
"Default read buffer size to be used for connections"},
OPT_S_OPTIONS,
OPT_V_OPTIONS,
OPT_X_OPTIONS,
{"nbio", OPT_NBIO, '-', "Use non-blocking IO"},
#ifndef OPENSSL_NO_PSK
+ {"psk_identity", OPT_PSK_IDENTITY, 's', "PSK identity to expect"},
{"psk_hint", OPT_PSK_HINT, 's', "PSK identity hint to use"},
{"psk", OPT_PSK, 's', "PSK in hex (without 0x)"},
#endif
case OPT_NO_RESUME_EPHEMERAL:
no_resume_ephemeral = 1;
break;
+ case OPT_PSK_IDENTITY:
+#ifndef OPENSSL_NO_PSK
+ psk_identity = opt_arg();
+#endif
+ break;
case OPT_PSK_HINT:
#ifndef OPENSSL_NO_PSK
psk_identity_hint = opt_arg();
break;
case OPT_MAX_SEND_FRAG:
max_send_fragment = atoi(opt_arg());
- if (max_send_fragment == 0) {
- /*
- * Not allowed - set to a deliberately bad value so we get an
- * error message below
- */
- max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH + 1;
- }
break;
case OPT_SPLIT_SEND_FRAG:
split_send_fragment = atoi(opt_arg());
- if (split_send_fragment == 0) {
- /*
- * Not allowed - set to a deliberately bad value so we get an
- * error message below
- */
- split_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH + 1;
- }
break;
case OPT_MAX_PIPELINES:
max_pipelines = atoi(opt_arg());
socket_type = SOCK_STREAM;
}
#endif
- if (max_send_fragment > SSL3_RT_MAX_PLAIN_LENGTH) {
- BIO_printf(bio_err, "%s: Bad max send fragment size\n", prog);
- goto end;
- }
-
- if (split_send_fragment > SSL3_RT_MAX_PLAIN_LENGTH) {
- BIO_printf(bio_err, "%s:Bad split send fragment size\n", prog);
- goto end;
- }
-
- if (max_pipelines > SSL_MAX_PIPELINES) {
- BIO_printf(bio_err, "%s:too large max-pipelines value\n", prog);
- goto end;
- }
if (!app_passwd(passarg, dpassarg, &pass, &dpass)) {
BIO_printf(bio_err, "Error getting password\n");
SSL_CTX_set_mode(ctx, SSL_MODE_ASYNC);
}
- if (max_send_fragment > 0)
- SSL_CTX_set_max_send_fragment(ctx, max_send_fragment);
+ if (max_send_fragment > 0
+ && !SSL_CTX_set_max_send_fragment(ctx, max_send_fragment)) {
+ BIO_printf(bio_err, "%s: Max send fragment size %u is out of permitted range\n",
+ prog, max_send_fragment);
+ goto end;
+ }
- if (split_send_fragment > 0) {
- SSL_CTX_set_split_send_fragment(ctx, split_send_fragment);
+ if (split_send_fragment > 0
+ && !SSL_CTX_set_split_send_fragment(ctx, split_send_fragment)) {
+ BIO_printf(bio_err, "%s: Split send fragment size %u is out of permitted range\n",
+ prog, split_send_fragment);
+ goto end;
}
- if (max_pipelines > 0) {
- SSL_CTX_set_max_pipelines(ctx, max_pipelines);
+ if (max_pipelines > 0
+ && !SSL_CTX_set_max_pipelines(ctx, max_pipelines)) {
+ BIO_printf(bio_err, "%s: Max pipelines %u is out of permitted range\n",
+ prog, max_pipelines);
+ goto end;
}
if (read_buf_len > 0) {
}
}
+static int is_retryable(SSL *con, int i)
+{
+ int err = SSL_get_error(con, i);
+
+ /* If it's not a fatal error, it must be retryable */
+ return (err != SSL_ERROR_SSL)
+ && (err != SSL_ERROR_SYSCALL)
+ && (err != SSL_ERROR_ZERO_RETURN);
+}
+
static int init_ssl_connection(SSL *con)
{
int i;
i = SSL_accept(con);
if (i <= 0)
- retry = !SSL_want_nothing(con);
+ retry = is_retryable(con, i);
#ifdef CERT_CB_TEST_RETRY
{
while (i <= 0
"LOOKUP from certificate callback during accept\n");
i = SSL_accept(con);
if (i <= 0)
- retry = !SSL_want_nothing(con);
+ retry = is_retryable(con, i);
}
}
#endif
BIO_printf(bio_s_out, "LOOKUP not successful\n");
i = SSL_accept(con);
if (i <= 0)
- retry = !SSL_want_nothing(con);
+ retry = is_retryable(con, i);
}
#endif
} while (i < 0 && SSL_waiting_for_async(con));
BIO_printf(bio_s_out, "Reused session-id\n");
BIO_printf(bio_s_out, "Secure Renegotiation IS%s supported\n",
SSL_get_secure_renegotiation_support(con) ? "" : " NOT");
+ if ((SSL_get_options(con) & SSL_OP_NO_RENEGOTIATION))
+ BIO_printf(bio_s_out, "Renegotiation is DISABLED\n");
+
if (keymatexportlabel != NULL) {
BIO_printf(bio_s_out, "Keying material exporter:\n");
BIO_printf(bio_s_out, " Label: '%s'\n", keymatexportlabel);
projects / openssl.git / blobdiff