X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=apps%2Fs_server.c;h=2051459c3b34e2e17a87d0e2a8e11fcb4905ddda;hp=9cbff09b858dd565db2a16761577f6099bebbf34;hb=73a9f60dd127df9ca05bec7afd835ff7c9bee9ae;hpb=fc7f190c732729c1d0eb9dcdb7ff05ed6b06056f diff --git a/apps/s_server.c b/apps/s_server.c index 9cbff09b85..2051459c3b 100644 --- a/apps/s_server.c +++ b/apps/s_server.c @@ -1,112 +1,12 @@ -/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) - * All rights reserved. - * - * This package is an SSL implementation written - * by Eric Young (eay@cryptsoft.com). - * The implementation was written so as to conform with Netscapes SSL. - * - * This library is free for commercial and non-commercial use as long as - * the following conditions are aheared to. The following conditions - * apply to all code found in this distribution, be it the RC4, RSA, - * lhash, DES, etc., code; not just the SSL code. The SSL documentation - * included with this distribution is covered by the same copyright terms - * except that the holder is Tim Hudson (tjh@cryptsoft.com). - * - * Copyright remains Eric Young's, and as such any Copyright notices in - * the code are not to be removed. - * If this package is used in a product, Eric Young should be given attribution - * as the author of the parts of the library used. - * This can be in the form of a textual message at program startup or - * in documentation (online or textual) provided with the package. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. All advertising materials mentioning features or use of this software - * must display the following acknowledgement: - * "This product includes cryptographic software written by - * Eric Young (eay@cryptsoft.com)" - * The word 'cryptographic' can be left out if the rouines from the library - * being used are not cryptographic related :-). - * 4. If you include any Windows specific code (or a derivative thereof) from - * the apps directory (application code) you must include an acknowledgement: - * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" - * - * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND - * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE - * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL - * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS - * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT - * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY - * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. - * - * The licence and distribution terms for any publically available version or - * derivative of this code cannot be changed. i.e. this code cannot simply be - * copied and put under another distribution licence - * [including the GNU Public Licence.] - */ -/* ==================================================================== - * Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * openssl-core@openssl.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.openssl.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). +/* + * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved. * + * Licensed under the OpenSSL license (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html */ + /* ==================================================================== * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. * ECC cipher suite support in OpenSSL originally developed by @@ -143,9 +43,14 @@ #include #include #include -#include +#if defined(_WIN32) +/* Included before async.h to avoid some warnings */ +# include +#endif #include +#include +#include #ifndef OPENSSL_NO_SOCK @@ -200,27 +105,14 @@ static void free_sessions(void); static DH *load_dh_param(const char *dhfile); #endif -static void s_server_init(void); - /* static int load_CA(SSL_CTX *ctx, char *file);*/ -#undef BUFSIZZ -#define BUFSIZZ 16*1024 -static int bufsize = BUFSIZZ; +static const int bufsize = 16 * 1024; static int accept_socket = -1; #define TEST_CERT "server.pem" #define TEST_CERT2 "server2.pem" -extern int verify_depth, verify_return_error, verify_quiet; - -static int s_server_verify = SSL_VERIFY_NONE; -static int s_server_session_id_context = 1; /* anything will do */ -static const char *s_cert_file = TEST_CERT, *s_key_file = - NULL, *s_chain_file = NULL; - -static const char *s_cert_file2 = TEST_CERT2, *s_key_file2 = NULL; -static char *s_dcert_file = NULL, *s_dkey_file = NULL, *s_dchain_file = NULL; static int s_nbio = 0; static int s_nbio_test = 0; static int s_crlf = 0; @@ -232,8 +124,6 @@ static BIO *bio_s_out = NULL; static BIO *bio_s_msg = NULL; static int s_debug = 0; static int s_tlsextdebug = 0; -static int s_tlsextstatus = 0; -static int no_resume_ephemeral = 0; static int s_msg = 0; static int s_quiet = 0; static int s_ign_eof = 0; @@ -243,24 +133,16 @@ static char *keymatexportlabel = NULL; static int keymatexportlen = 20; static int async = 0; -static unsigned int split_send_fragment = 0; -static unsigned int max_pipelines = 0; -#ifndef OPENSSL_NO_ENGINE -static char *engine_id = NULL; -#endif static const char *session_id_prefix = NULL; #ifndef OPENSSL_NO_DTLS static int enable_timeouts = 0; static long socket_mtu; -static int cert_chain = 0; + #endif static int dtlslisten = 0; -static BIO *serverinfo_in = NULL; -static const char *s_serverinfo_file = NULL; - #ifndef OPENSSL_NO_PSK static char *psk_identity = "Client_identity"; char *psk_key = NULL; /* by default PSK is not used */ @@ -269,9 +151,8 @@ static unsigned int psk_server_cb(SSL *ssl, const char *identity, unsigned char *psk, unsigned int max_psk_len) { - unsigned int psk_len = 0; - int ret; - BIGNUM *bn = NULL; + long key_len = 0; + unsigned char *key; if (s_debug) BIO_printf(bio_s_out, "psk_server_cb\n"); @@ -293,31 +174,26 @@ static unsigned int psk_server_cb(SSL *ssl, const char *identity, BIO_printf(bio_s_out, "PSK client identity found\n"); /* convert the PSK key to binary */ - ret = BN_hex2bn(&bn, psk_key); - if (!ret) { - BIO_printf(bio_err, "Could not convert PSK key '%s' to BIGNUM\n", + key = OPENSSL_hexstr2buf(psk_key, &key_len); + if (key == NULL) { + BIO_printf(bio_err, "Could not convert PSK key '%s' to buffer\n", psk_key); - BN_free(bn); return 0; } - if (BN_num_bytes(bn) > (int)max_psk_len) { + if (key_len > (int)max_psk_len) { BIO_printf(bio_err, - "psk buffer of callback is too small (%d) for key (%d)\n", - max_psk_len, BN_num_bytes(bn)); - BN_free(bn); + "psk buffer of callback is too small (%d) for key (%ld)\n", + max_psk_len, key_len); + OPENSSL_free(key); return 0; } - ret = BN_bn2bin(bn, psk); - BN_free(bn); - - if (ret < 0) - goto out_err; - psk_len = (unsigned int)ret; + memcpy(psk, key, key_len); + OPENSSL_free(key); if (s_debug) - BIO_printf(bio_s_out, "fetched PSK len=%d\n", psk_len); - return psk_len; + BIO_printf(bio_s_out, "fetched PSK len=%ld\n", key_len); + return key_len; out_err: if (s_debug) BIO_printf(bio_err, "Error in PSK server callback\n"); @@ -370,7 +246,7 @@ static int ssl_srp_server_param_cb(SSL *s, int *ad, void *arg) p->login, p->user->info); ret = SSL_ERROR_NONE; -err: + err: SRP_user_pwd_free(p->user); p->user = NULL; p->login = NULL; @@ -379,37 +255,6 @@ err: #endif -static void s_server_init(void) -{ - accept_socket = -1; - verify_depth = 0; - s_server_verify = SSL_VERIFY_NONE; - s_dcert_file = NULL; - s_dkey_file = NULL; - s_dchain_file = NULL; - s_cert_file = TEST_CERT; - s_key_file = NULL; - s_chain_file = NULL; - s_cert_file2 = TEST_CERT2; - s_key_file2 = NULL; - ctx2 = NULL; - s_nbio = 0; - s_nbio_test = 0; - ctx = NULL; - www = 0; - bio_s_out = NULL; - s_debug = 0; - s_msg = 0; - s_quiet = 0; - s_brief = 0; - async = 0; - split_send_fragment = 0; - max_pipelines = 0; -#ifndef OPENSSL_NO_ENGINE - engine_id = NULL; -#endif -} - static int local_argc = 0; static char **local_argv; @@ -435,8 +280,8 @@ static const BIO_METHOD *BIO_f_ebcdic_filter() { if (methods_ebcdic == NULL) { methods_ebcdic = BIO_meth_new(BIO_TYPE_EBCDIC_FILTER, - "EBCDIC/ASCII filter"); - if ( methods_ebcdic == NULL + "EBCDIC/ASCII filter"); + if (methods_ebcdic == NULL || !BIO_meth_set_write(methods_ebcdic, ebcdic_write) || !BIO_meth_set_read(methods_ebcdic, ebcdic_read) || !BIO_meth_set_puts(methods_ebcdic, ebcdic_puts) @@ -676,19 +521,19 @@ static int cert_status_cb(SSL *s, void *arg) SSL_CTX_get_cert_store(SSL_get_SSL_CTX(s)), NULL, NULL)) goto err; - obj = X509_STORE_get_X509_by_subject(inctx, X509_LU_X509, - X509_get_issuer_name(x)); + obj = X509_STORE_CTX_get_obj_by_subject(inctx, X509_LU_X509, + X509_get_issuer_name(x)); if (obj == NULL) { BIO_puts(bio_err, "cert_status: Can't retrieve issuer certificate.\n"); goto done; } - req = OCSP_REQUEST_new(); - if (req == NULL) - goto err; id = OCSP_cert_to_id(NULL, x, X509_OBJECT_get0_X509(obj)); X509_OBJECT_free(obj); if (!id) goto err; + req = OCSP_REQUEST_new(); + if (req == NULL) + goto err; if (!OCSP_request_add0_id(req, id)) goto err; id = NULL; @@ -825,7 +670,7 @@ typedef enum OPTION_choice { OPT_SRPUSERSEED, OPT_REV, OPT_WWW, OPT_UPPER_WWW, OPT_HTTP, OPT_ASYNC, OPT_SSL_CONFIG, OPT_SPLIT_SEND_FRAG, OPT_MAX_PIPELINES, OPT_READ_BUF, OPT_SSL3, OPT_TLS1_2, OPT_TLS1_1, OPT_TLS1, OPT_DTLS, OPT_DTLS1, - OPT_DTLS1_2, OPT_TIMEOUT, OPT_MTU, OPT_CHAIN, OPT_LISTEN, + OPT_DTLS1_2, OPT_TIMEOUT, OPT_MTU, OPT_LISTEN, OPT_ID_PREFIX, OPT_RAND, OPT_SERVERNAME, OPT_SERVERNAME_FATAL, OPT_CERT2, OPT_KEY2, OPT_NEXTPROTONEG, OPT_ALPN, OPT_SRTP_PROFILES, OPT_KEYMATEXPORT, OPT_KEYMATEXPORTLEN, @@ -853,7 +698,7 @@ OPTIONS s_server_options[] = { {"Verify", OPT_UPPER_V_VERIFY, 'n', "Turn on peer certificate verification, must have a cert"}, {"cert", OPT_CERT, '<', "Certificate file to use; default is " TEST_CERT}, - {"naccept", OPT_NACCEPT, 'p', "Terminate after pnum connections"}, + {"naccept", OPT_NACCEPT, 'p', "Terminate after #num connections"}, {"serverinfo", OPT_SERVERINFO, 's', "PEM serverinfo file for certificate"}, {"certform", OPT_CERTFORM, 'F', @@ -901,7 +746,7 @@ OPTIONS s_server_options[] = { "-Private Key file to use for servername if not in -cert2"}, {"tlsextdebug", OPT_TLSEXTDEBUG, '-', "Hex dump of all TLS extensions received"}, - {"HTTP", OPT_HTTP, '-', "Like -WWW but ./path incluedes HTTP headers"}, + {"HTTP", OPT_HTTP, '-', "Like -WWW but ./path includes HTTP headers"}, {"id_prefix", OPT_ID_PREFIX, 's', "Generate SSL/TLS session IDs prefixed by arg"}, {"rand", OPT_RAND, 's', @@ -924,7 +769,7 @@ OPTIONS s_server_options[] = { {"no_cache", OPT_NO_CACHE, '-', "Disable session cache"}, {"ext_cache", OPT_EXT_CACHE, '-', "Disable internal cache, setup and use external cache"}, - {"CRLform", OPT_CRLFORM, 'F', "CRL format (PEM or DER) PEM is default" }, + {"CRLform", OPT_CRLFORM, 'F', "CRL format (PEM or DER) PEM is default"}, {"verify_return_error", OPT_VERIFY_RET_ERROR, '-', "Close connection on verification error"}, {"verify_quiet", OPT_VERIFY_QUIET, '-', @@ -951,12 +796,12 @@ OPTIONS s_server_options[] = { "Print output from SSL/TLS security framework"}, {"security_debug_verbose", OPT_SECURITY_DEBUG_VERBOSE, '-', "Print more output from SSL/TLS security framework"}, - {"brief", OPT_BRIEF, '-', \ + {"brief", OPT_BRIEF, '-', "Restrict output to brief summary of connection parameters"}, {"rev", OPT_REV, '-', "act as a simple test server which just sends back with the received text reversed"}, {"async", OPT_ASYNC, '-', "Operate in asynchronous mode"}, - {"ssl_config", OPT_SSL_CONFIG, 's', \ + {"ssl_config", OPT_SSL_CONFIG, 's', "Configure SSL_CTX using the configuration 'val'"}, {"split_send_frag", OPT_SPLIT_SEND_FRAG, 'n', "Size used to split data for encrypt pipelines"}, @@ -993,7 +838,6 @@ OPTIONS s_server_options[] = { {"dtls", OPT_DTLS, '-', "Use any DTLS version"}, {"timeout", OPT_TIMEOUT, '-', "Enable timeouts"}, {"mtu", OPT_MTU, 'p', "Set link layer MTU"}, - {"chain", OPT_CHAIN, '-', "Read a certificate chain"}, {"listen", OPT_LISTEN, '-', "Listen for a DTLS ClientHello with a cookie and then connect"}, #endif @@ -1019,12 +863,16 @@ OPTIONS s_server_options[] = { #ifndef OPENSSL_NO_ENGINE {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, #endif - {NULL} + {NULL, OPT_EOF, 0, NULL} }; +#define IS_PROT_FLAG(o) \ + (o == OPT_SSL3 || o == OPT_TLS1 || o == OPT_TLS1_1 || o == OPT_TLS1_2 \ + || o == OPT_DTLS || o == OPT_DTLS1 || o == OPT_DTLS1_2) + int s_server_main(int argc, char *argv[]) { - ENGINE *e = NULL; + ENGINE *engine = NULL; EVP_PKEY *s_key = NULL, *s_dkey = NULL; SSL_CONF_CTX *cctx = NULL; const SSL_METHOD *meth = TLS_server_method(); @@ -1034,22 +882,17 @@ int s_server_main(int argc, char *argv[]) STACK_OF(X509_CRL) *crls = NULL; X509 *s_cert = NULL, *s_dcert = NULL; X509_VERIFY_PARAM *vpm = NULL; - char *CApath = NULL, *CAfile = NULL, *chCApath = NULL, *chCAfile = NULL; -#ifndef OPENSSL_NO_DH - char *dhfile = NULL; -#endif + const char *CApath = NULL, *CAfile = NULL, *chCApath = NULL, *chCAfile = NULL; char *dpassarg = NULL, *dpass = NULL, *inrand = NULL; char *passarg = NULL, *pass = NULL, *vfyCApath = NULL, *vfyCAfile = NULL; char *crl_file = NULL, *prog; -#ifndef OPENSSL_NO_PSK - char *p; -#endif #ifdef AF_UNIX int unlink_unix_path = 0; #endif do_server_cb server_cb; int vpmtouched = 0, build_chain = 0, no_cache = 0, ext_cache = 0; #ifndef OPENSSL_NO_DH + char *dhfile = NULL; int no_dhe = 0; #endif int nocert = 0, ret = 1; @@ -1077,25 +920,59 @@ int s_server_main(int argc, char *argv[]) #ifndef OPENSSL_NO_PSK /* by default do not send a PSK identity hint */ static char *psk_identity_hint = NULL; + char *p; #endif #ifndef OPENSSL_NO_SRP char *srpuserseed = NULL; char *srp_verifier_file = NULL; #endif - int min_version = 0, max_version = 0; + int min_version = 0, max_version = 0, prot_opt = 0, no_prot_opt = 0; + int s_server_verify = SSL_VERIFY_NONE; + int s_server_session_id_context = 1; /* anything will do */ + const char *s_cert_file = TEST_CERT, *s_key_file = NULL, *s_chain_file = NULL; + const char *s_cert_file2 = TEST_CERT2, *s_key_file2 = NULL; + char *s_dcert_file = NULL, *s_dkey_file = NULL, *s_dchain_file = NULL; +#ifndef OPENSSL_NO_OCSP + int s_tlsextstatus = 0; +#endif + int no_resume_ephemeral = 0; + unsigned int split_send_fragment = 0, max_pipelines = 0; + const char *s_serverinfo_file = NULL; + /* Init of few remaining global variables */ local_argc = argc; local_argv = argv; - s_server_init(); + ctx = ctx2 = NULL; + s_nbio = s_nbio_test = 0; + www = 0; + bio_s_out = NULL; + s_debug = 0; + s_msg = 0; + s_quiet = 0; + s_brief = 0; + async = 0; + cctx = SSL_CONF_CTX_new(); vpm = X509_VERIFY_PARAM_new(); if (cctx == NULL || vpm == NULL) goto end; - SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_SERVER | SSL_CONF_FLAG_CMDLINE); + SSL_CONF_CTX_set_flags(cctx, + SSL_CONF_FLAG_SERVER | SSL_CONF_FLAG_CMDLINE); prog = opt_init(argc, argv, s_server_options); while ((o = opt_next()) != OPT_EOF) { + if (IS_PROT_FLAG(o) && ++prot_opt > 1) { + BIO_printf(bio_err, "Cannot supply multiple protocol flags\n"); + goto end; + } + if (IS_NO_PROT_FLAG(o)) + no_prot_opt++; + if (prot_opt == 1 && no_prot_opt) { + BIO_printf(bio_err, + "Cannot supply both a protocol flag and '-no_'\n"); + goto end; + } switch (o) { case OPT_EOF: case OPT_ERR: @@ -1177,19 +1054,19 @@ int s_server_main(int argc, char *argv[]) break; case OPT_VERIFY: s_server_verify = SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE; - verify_depth = atoi(opt_arg()); + verify_args.depth = atoi(opt_arg()); if (!s_quiet) - BIO_printf(bio_err, "verify depth is %d\n", verify_depth); + BIO_printf(bio_err, "verify depth is %d\n", verify_args.depth); break; case OPT_UPPER_V_VERIFY: s_server_verify = SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT | SSL_VERIFY_CLIENT_ONCE; - verify_depth = atoi(opt_arg()); + verify_args.depth = atoi(opt_arg()); if (!s_quiet) BIO_printf(bio_err, "verify depth is %d, must return a certificate\n", - verify_depth); + verify_args.depth); break; case OPT_CONTEXT: context = (unsigned char *)opt_arg(); @@ -1293,10 +1170,10 @@ int s_server_main(int argc, char *argv[]) goto end; break; case OPT_VERIFY_RET_ERROR: - verify_return_error = 1; + verify_args.return_error = 1; break; case OPT_VERIFY_QUIET: - verify_quiet = 1; + verify_args.quiet = 1; break; case OPT_BUILD_CHAIN: build_chain = 1; @@ -1332,14 +1209,20 @@ int s_server_main(int argc, char *argv[]) s_tlsextdebug = 1; break; case OPT_STATUS: +#ifndef OPENSSL_NO_OCSP s_tlsextstatus = 1; +#endif break; case OPT_STATUS_VERBOSE: +#ifndef OPENSSL_NO_OCSP s_tlsextstatus = tlscstatp.verbose = 1; +#endif break; case OPT_STATUS_TIMEOUT: +#ifndef OPENSSL_NO_OCSP s_tlsextstatus = 1; tlscstatp.timeout = atoi(opt_arg()); +#endif break; case OPT_STATUS_URL: #ifndef OPENSSL_NO_OCSP @@ -1380,7 +1263,7 @@ int s_server_main(int argc, char *argv[]) s_quiet = 1; break; case OPT_BRIEF: - s_quiet = s_brief = verify_quiet = 1; + s_quiet = s_brief = verify_args.quiet = 1; break; case OPT_NO_DHE: #ifndef OPENSSL_NO_DH @@ -1480,11 +1363,6 @@ int s_server_main(int argc, char *argv[]) case OPT_MTU: #ifndef OPENSSL_NO_DTLS socket_mtu = atol(opt_arg()); -#endif - break; - case OPT_CHAIN: -#ifndef OPENSSL_NO_DTLS - cert_chain = 1; #endif break; case OPT_LISTEN: @@ -1496,7 +1374,7 @@ int s_server_main(int argc, char *argv[]) session_id_prefix = opt_arg(); break; case OPT_ENGINE: - e = setup_engine(opt_arg(), 1); + engine = setup_engine(opt_arg(), 1); break; case OPT_RAND: inrand = opt_arg(); @@ -1602,7 +1480,7 @@ int s_server_main(int argc, char *argv[]) goto end; if (nocert == 0) { - s_key = load_key(s_key_file, s_key_format, 0, pass, e, + s_key = load_key(s_key_file, s_key_format, 0, pass, engine, "server certificate private key file"); if (!s_key) { ERR_print_errors(bio_err); @@ -1623,7 +1501,7 @@ int s_server_main(int argc, char *argv[]) } if (tlsextcbp.servername) { - s_key2 = load_key(s_key_file2, s_key_format, 0, pass, e, + s_key2 = load_key(s_key_file2, s_key_format, 0, pass, engine, "second server certificate private key file"); if (!s_key2) { ERR_print_errors(bio_err); @@ -1682,7 +1560,7 @@ int s_server_main(int argc, char *argv[]) s_dkey_file = s_dcert_file; s_dkey = load_key(s_dkey_file, s_dkey_format, - 0, dpass, e, "second certificate private key file"); + 0, dpass, engine, "second certificate private key file"); if (!s_dkey) { ERR_print_errors(bio_err); goto end; @@ -1745,8 +1623,8 @@ int s_server_main(int argc, char *argv[]) if (SSL_CTX_config(ctx, ssl_config) == 0) { BIO_printf(bio_err, "Error using configuration \"%s\"\n", ssl_config); - ERR_print_errors(bio_err); - goto end; + ERR_print_errors(bio_err); + goto end; } } if (SSL_CTX_set_min_proto_version(ctx, min_version) == 0) @@ -1791,7 +1669,6 @@ int s_server_main(int argc, char *argv[]) if (read_buf_len > 0) { SSL_CTX_set_default_read_buffer_len(ctx, read_buf_len); } - #ifndef OPENSSL_NO_SRTP if (srtp_profiles != NULL) { /* Returns 0 on success! */ @@ -1866,9 +1743,10 @@ int s_server_main(int argc, char *argv[]) if (async) SSL_CTX_set_mode(ctx2, SSL_MODE_ASYNC); - if ((!SSL_CTX_load_verify_locations(ctx2, CAfile, CApath)) || - (!SSL_CTX_set_default_verify_paths(ctx2))) { + if (!ctx_set_verify_locations(ctx2, CAfile, CApath, noCAfile, + noCApath)) { ERR_print_errors(bio_err); + goto end; } if (vpmtouched && !SSL_CTX_set1_param(ctx2, vpm)) { BIO_printf(bio_err, "Error setting verify params\n"); @@ -1965,8 +1843,7 @@ int s_server_main(int argc, char *argv[]) #ifndef OPENSSL_NO_PSK if (psk_key != NULL) { if (s_debug) - BIO_printf(bio_s_out, - "PSK key given, setting server callback\n"); + BIO_printf(bio_s_out, "PSK key given, setting server callback\n"); SSL_CTX_set_psk_server_callback(ctx, psk_server_cb); } @@ -1979,8 +1856,8 @@ int s_server_main(int argc, char *argv[]) SSL_CTX_set_verify(ctx, s_server_verify, verify_callback); if (!SSL_CTX_set_session_id_context(ctx, - (void *)&s_server_session_id_context, - sizeof s_server_session_id_context)) { + (void *)&s_server_session_id_context, + sizeof s_server_session_id_context)) { BIO_printf(bio_err, "error setting session id context\n"); ERR_print_errors(bio_err); goto end; @@ -2079,7 +1956,6 @@ int s_server_main(int argc, char *argv[]) SSL_CTX_free(ctx2); X509_free(s_cert2); EVP_PKEY_free(s_key2); - BIO_free(serverinfo_in); #ifndef OPENSSL_NO_NEXTPROTONEG OPENSSL_free(next_proto.data); #endif @@ -2158,8 +2034,8 @@ static int sv_body(int s, int stype, unsigned char *context) } if (context - && !SSL_set_session_id_context(con, - context, strlen((char *)context))) { + && !SSL_set_session_id_context(con, + context, strlen((char *)context))) { BIO_printf(bio_err, "Error setting session id context\n"); ret = -1; goto err; @@ -2240,7 +2116,10 @@ static int sv_body(int s, int stype, unsigned char *context) SSL_set_tlsext_debug_arg(con, bio_s_out); } - width = s + 1; + if (fileno_stdin() > s) + width = fileno_stdin() + 1; + else + width = s + 1; for (;;) { int read_from_terminal; int read_from_sslcon; @@ -2252,7 +2131,7 @@ static int sv_body(int s, int stype, unsigned char *context) if (!read_from_sslcon) { FD_ZERO(&readfds); #if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_MSDOS) - openssl_fdset(fileno(stdin), &readfds); + openssl_fdset(fileno_stdin(), &readfds); #endif openssl_fdset(s, &readfds); /* @@ -2272,10 +2151,10 @@ static int sv_body(int s, int stype, unsigned char *context) tv.tv_sec = 1; tv.tv_usec = 0; i = select(width, (void *)&readfds, NULL, NULL, &tv); - if ((i < 0) || (!i && !_kbhit())) - continue; - if (_kbhit()) + if (has_stdin_waiting()) read_from_terminal = 1; + if ((i < 0) || (!i && !read_from_terminal)) + continue; #else if ((SSL_version(con) == DTLS1_VERSION) && DTLSv1_get_timeout(con, &timeout)) @@ -2292,7 +2171,7 @@ static int sv_body(int s, int stype, unsigned char *context) if (i <= 0) continue; - if (FD_ISSET(fileno(stdin), &readfds)) + if (FD_ISSET(fileno_stdin(), &readfds)) read_from_terminal = 1; #endif if (FD_ISSET(s, &readfds)) @@ -2319,6 +2198,7 @@ static int sv_body(int s, int stype, unsigned char *context) assert(lf_num == 0); } else i = raw_read_stdin(buf, bufsize); + if (!s_quiet && !s_brief) { if ((i <= 0) || (buf[0] == 'Q')) { BIO_printf(bio_s_out, "DONE\n"); @@ -2385,12 +2265,10 @@ static int sv_body(int s, int stype, unsigned char *context) for (;;) { /* should do a select for the write */ #ifdef RENEG - { - static count = 0; - if (++count == 100) { - count = 0; - SSL_renegotiate(con); - } + static count = 0; + if (++count == 100) { + count = 0; + SSL_renegotiate(con); } #endif k = SSL_write(con, &(buf[l]), (unsigned int)i); @@ -2414,12 +2292,14 @@ static int sv_body(int s, int stype, unsigned char *context) break; case SSL_ERROR_WANT_ASYNC: BIO_printf(bio_s_out, "Write BLOCK (Async)\n"); + (void)BIO_flush(bio_s_out); wait_for_async(con); break; case SSL_ERROR_WANT_WRITE: case SSL_ERROR_WANT_READ: case SSL_ERROR_WANT_X509_LOOKUP: BIO_printf(bio_s_out, "Write BLOCK\n"); + (void)BIO_flush(bio_s_out); break; case SSL_ERROR_WANT_ASYNC_JOB: /* @@ -2488,16 +2368,19 @@ static int sv_body(int s, int stype, unsigned char *context) ascii2ebcdic(buf, buf, i); #endif raw_write_stdout(buf, (unsigned int)i); + (void)BIO_flush(bio_s_out); if (SSL_has_pending(con)) goto again; break; case SSL_ERROR_WANT_ASYNC: BIO_printf(bio_s_out, "Read BLOCK (Async)\n"); + (void)BIO_flush(bio_s_out); wait_for_async(con); break; case SSL_ERROR_WANT_WRITE: case SSL_ERROR_WANT_READ: BIO_printf(bio_s_out, "Read BLOCK\n"); + (void)BIO_flush(bio_s_out); break; case SSL_ERROR_WANT_ASYNC_JOB: /* @@ -2553,9 +2436,10 @@ static int init_ssl_connection(SSL *con) unsigned next_proto_neg_len; #endif unsigned char *exportedkeymat; + int retry = 0; #ifndef OPENSSL_NO_DTLS - if(dtlslisten) { + if (dtlslisten) { BIO_ADDR *client = NULL; if ((client = BIO_ADDR_new()) == NULL) { @@ -2568,11 +2452,11 @@ static int init_ssl_connection(SSL *con) int fd = -1; wbio = SSL_get_wbio(con); - if(wbio) { + if (wbio) { BIO_get_fd(wbio, &fd); } - if(!wbio || BIO_connect(fd, client, 0) == 0) { + if (!wbio || BIO_connect(fd, client, 0) == 0) { BIO_printf(bio_err, "ERROR - unable to connect\n"); BIO_ADDR_free(client); return 0; @@ -2580,6 +2464,8 @@ static int init_ssl_connection(SSL *con) BIO_ADDR_free(client); dtlslisten = 0; i = SSL_accept(con); + } else { + BIO_ADDR_free(client); } } else #endif @@ -2587,19 +2473,25 @@ static int init_ssl_connection(SSL *con) do { i = SSL_accept(con); + if (i <= 0) + retry = BIO_sock_should_retry(i); #ifdef CERT_CB_TEST_RETRY { - while (i <= 0 && SSL_get_error(con, i) == SSL_ERROR_WANT_X509_LOOKUP + while (i <= 0 + && SSL_get_error(con, i) == SSL_ERROR_WANT_X509_LOOKUP && SSL_get_state(con) == TLS_ST_SR_CLNT_HELLO) { BIO_printf(bio_err, - "LOOKUP from certificate callback during accept\n"); + "LOOKUP from certificate callback during accept\n"); i = SSL_accept(con); + if (i <= 0) + retry = BIO_sock_should_retry(i); } } #endif #ifndef OPENSSL_NO_SRP - while (i <= 0 && SSL_get_error(con, i) == SSL_ERROR_WANT_X509_LOOKUP) { + while (i <= 0 + && SSL_get_error(con, i) == SSL_ERROR_WANT_X509_LOOKUP) { BIO_printf(bio_s_out, "LOOKUP during accept %s\n", srp_callback_parm.login); SRP_user_pwd_free(srp_callback_parm.user); @@ -2612,13 +2504,15 @@ static int init_ssl_connection(SSL *con) else BIO_printf(bio_s_out, "LOOKUP not successful\n"); i = SSL_accept(con); + if (i <= 0) + retry = BIO_sock_should_retry(i); } #endif } while (i < 0 && SSL_waiting_for_async(con)); if (i <= 0) { if ((dtlslisten && i == 0) - || (!dtlslisten && BIO_sock_should_retry(i))) { + || (!dtlslisten && retry)) { BIO_printf(bio_s_out, "DELAY\n"); return (1); } @@ -2704,6 +2598,7 @@ static int init_ssl_connection(SSL *con) OPENSSL_free(exportedkeymat); } + (void)BIO_flush(bio_s_out); return (1); } @@ -2764,8 +2659,9 @@ static int www_body(int s, int stype, unsigned char *context) SSL_set_tlsext_debug_arg(con, bio_s_out); } - if (context && !SSL_set_session_id_context(con, context, - strlen((char *)context))) + if (context + && !SSL_set_session_id_context(con, context, + strlen((char *)context))) goto err; sbio = BIO_new_socket(s, BIO_NOCLOSE); @@ -2862,7 +2758,8 @@ static int www_body(int s, int stype, unsigned char *context) openssl_fdset(s, &readfds); i = select(width, (void *)&readfds, NULL, NULL, NULL); if (i <= 0 || !FD_ISSET(s, &readfds)) { - BIO_printf(bio_s_out, "Error waiting for client response\n"); + BIO_printf(bio_s_out, + "Error waiting for client response\n"); ERR_print_errors(bio_err); goto err; } @@ -3061,16 +2958,15 @@ static int www_body(int s, int stype, unsigned char *context) for (j = 0; j < i;) { #ifdef RENEG - { - static count = 0; - if (++count == 13) { - SSL_renegotiate(con); - } + static count = 0; + if (++count == 13) { + SSL_renegotiate(con); } #endif k = BIO_write(io, &(buf[j]), i - j); if (k <= 0) { - if (!BIO_should_retry(io) && !SSL_waiting_for_async(con)) + if (!BIO_should_retry(io) + && !SSL_waiting_for_async(con)) goto write_error; else { BIO_printf(bio_s_out, "rwrite W BLOCK\n"); @@ -3131,8 +3027,9 @@ static int rev_body(int s, int stype, unsigned char *context) SSL_set_tlsext_debug_callback(con, tlsext_cb); SSL_set_tlsext_debug_arg(con, bio_s_out); } - if (context && !SSL_set_session_id_context(con, context, - strlen((char *)context))) { + if (context + && !SSL_set_session_id_context(con, context, + strlen((char *)context))) { ERR_print_errors(bio_err); goto err; } @@ -3400,4 +3297,4 @@ static void free_sessions(void) first = NULL; } -#endif +#endif /* OPENSSL_NO_SOCK */