X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=apps%2Fs_server.c;h=36ad2663869d69b4e4af1aab7787015cc595a8ad;hp=cd7a1e1a25ef4612b1134a29e7c89337b69ae6e6;hb=65e2d672548e7c4bcb28f1c5c835362830b1745b;hpb=d631602533d2e06f9a7a7645ee66638190e0db54 diff --git a/apps/s_server.c b/apps/s_server.c index cd7a1e1a25..36ad266386 100644 --- a/apps/s_server.c +++ b/apps/s_server.c @@ -1,112 +1,12 @@ -/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) - * All rights reserved. - * - * This package is an SSL implementation written - * by Eric Young (eay@cryptsoft.com). - * The implementation was written so as to conform with Netscapes SSL. - * - * This library is free for commercial and non-commercial use as long as - * the following conditions are aheared to. The following conditions - * apply to all code found in this distribution, be it the RC4, RSA, - * lhash, DES, etc., code; not just the SSL code. The SSL documentation - * included with this distribution is covered by the same copyright terms - * except that the holder is Tim Hudson (tjh@cryptsoft.com). - * - * Copyright remains Eric Young's, and as such any Copyright notices in - * the code are not to be removed. - * If this package is used in a product, Eric Young should be given attribution - * as the author of the parts of the library used. - * This can be in the form of a textual message at program startup or - * in documentation (online or textual) provided with the package. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. All advertising materials mentioning features or use of this software - * must display the following acknowledgement: - * "This product includes cryptographic software written by - * Eric Young (eay@cryptsoft.com)" - * The word 'cryptographic' can be left out if the rouines from the library - * being used are not cryptographic related :-). - * 4. If you include any Windows specific code (or a derivative thereof) from - * the apps directory (application code) you must include an acknowledgement: - * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" - * - * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND - * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE - * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL - * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS - * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT - * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY - * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. - * - * The licence and distribution terms for any publically available version or - * derivative of this code cannot be changed. i.e. this code cannot simply be - * copied and put under another distribution licence - * [including the GNU Public Licence.] - */ -/* ==================================================================== - * Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved. - * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. All advertising materials mentioning features or use of this - * software must display the following acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" - * - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to - * endorse or promote products derived from this software without - * prior written permission. For written permission, please contact - * openssl-core@openssl.org. - * - * 5. Products derived from this software may not be called "OpenSSL" - * nor may "OpenSSL" appear in their names without prior written - * permission of the OpenSSL Project. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes software developed by the OpenSSL Project - * for use in the OpenSSL Toolkit (http://www.openssl.org/)" - * - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR - * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * ==================================================================== - * - * This product includes cryptographic software written by Eric Young - * (eay@cryptsoft.com). This product includes software written by Tim - * Hudson (tjh@cryptsoft.com). +/* + * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved. * + * Licensed under the OpenSSL license (the "License"). You may not use + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html */ + /* ==================================================================== * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. * ECC cipher suite support in OpenSSL originally developed by @@ -147,10 +47,7 @@ #include -/* conflicts with winsock2 stuff on netware */ -#if !defined(OPENSSL_SYS_NETWARE) -# include -#endif +#ifndef OPENSSL_NO_SOCK /* * With IPv6, it looks like Digital has mixed up the proper order of @@ -184,6 +81,9 @@ typedef unsigned int u_int; #endif #include "s_apps.h" #include "timeouts.h" +#ifdef CHARSET_EBCDIC +#include +#endif static int not_resumable_sess_cb(SSL *s, int is_forward_secure); static int sv_body(int s, int stype, unsigned char *context); @@ -233,7 +133,6 @@ static BIO *bio_s_msg = NULL; static int s_debug = 0; static int s_tlsextdebug = 0; static int s_tlsextstatus = 0; -static int cert_status_cb(SSL *s, void *arg); static int no_resume_ephemeral = 0; static int s_msg = 0; static int s_quiet = 0; @@ -244,20 +143,18 @@ static char *keymatexportlabel = NULL; static int keymatexportlen = 20; static int async = 0; +static unsigned int split_send_fragment = 0; +static unsigned int max_pipelines = 0; -#ifndef OPENSSL_NO_ENGINE -static char *engine_id = NULL; -#endif static const char *session_id_prefix = NULL; #ifndef OPENSSL_NO_DTLS static int enable_timeouts = 0; static long socket_mtu; -static int cert_chain = 0; + #endif static int dtlslisten = 0; -static BIO *serverinfo_in = NULL; static const char *s_serverinfo_file = NULL; #ifndef OPENSSL_NO_PSK @@ -268,9 +165,8 @@ static unsigned int psk_server_cb(SSL *ssl, const char *identity, unsigned char *psk, unsigned int max_psk_len) { - unsigned int psk_len = 0; - int ret; - BIGNUM *bn = NULL; + long key_len = 0; + unsigned char *key; if (s_debug) BIO_printf(bio_s_out, "psk_server_cb\n"); @@ -292,31 +188,26 @@ static unsigned int psk_server_cb(SSL *ssl, const char *identity, BIO_printf(bio_s_out, "PSK client identity found\n"); /* convert the PSK key to binary */ - ret = BN_hex2bn(&bn, psk_key); - if (!ret) { - BIO_printf(bio_err, "Could not convert PSK key '%s' to BIGNUM\n", + key = OPENSSL_hexstr2buf(psk_key, &key_len); + if (key == NULL) { + BIO_printf(bio_err, "Could not convert PSK key '%s' to buffer\n", psk_key); - BN_free(bn); return 0; } - if (BN_num_bytes(bn) > (int)max_psk_len) { + if (key_len > (int)max_psk_len) { BIO_printf(bio_err, - "psk buffer of callback is too small (%d) for key (%d)\n", - max_psk_len, BN_num_bytes(bn)); - BN_free(bn); + "psk buffer of callback is too small (%d) for key (%ld)\n", + max_psk_len, key_len); + OPENSSL_free(key); return 0; } - ret = BN_bn2bin(bn, psk); - BN_free(bn); - - if (ret < 0) - goto out_err; - psk_len = (unsigned int)ret; + memcpy(psk, key, key_len); + OPENSSL_free(key); if (s_debug) - BIO_printf(bio_s_out, "fetched PSK len=%d\n", psk_len); - return psk_len; + BIO_printf(bio_s_out, "fetched PSK len=%ld\n", key_len); + return key_len; out_err: if (s_debug) BIO_printf(bio_err, "Error in PSK server callback\n"); @@ -402,9 +293,8 @@ static void s_server_init(void) s_quiet = 0; s_brief = 0; async = 0; -#ifndef OPENSSL_NO_ENGINE - engine_id = NULL; -#endif + split_send_fragment = 0; + max_pipelines = 0; } static int local_argc = 0; @@ -420,17 +310,7 @@ static int ebcdic_gets(BIO *bp, char *buf, int size); static int ebcdic_puts(BIO *bp, const char *str); # define BIO_TYPE_EBCDIC_FILTER (18|0x0200) -static BIO_METHOD methods_ebcdic = { - BIO_TYPE_EBCDIC_FILTER, - "EBCDIC/ASCII filter", - ebcdic_write, - ebcdic_read, - ebcdic_puts, - ebcdic_gets, - ebcdic_ctrl, - ebcdic_new, - ebcdic_free, -}; +static BIO_METHOD *methods_ebcdic = NULL; /* This struct is "unwarranted chumminess with the compiler." */ typedef struct { @@ -438,9 +318,22 @@ typedef struct { char buff[1]; } EBCDIC_OUTBUFF; -BIO_METHOD *BIO_f_ebcdic_filter() +static const BIO_METHOD *BIO_f_ebcdic_filter() { - return (&methods_ebcdic); + if (methods_ebcdic == NULL) { + methods_ebcdic = BIO_meth_new(BIO_TYPE_EBCDIC_FILTER, + "EBCDIC/ASCII filter"); + if ( methods_ebcdic == NULL + || !BIO_meth_set_write(methods_ebcdic, ebcdic_write) + || !BIO_meth_set_read(methods_ebcdic, ebcdic_read) + || !BIO_meth_set_puts(methods_ebcdic, ebcdic_puts) + || !BIO_meth_set_gets(methods_ebcdic, ebcdic_gets) + || !BIO_meth_set_ctrl(methods_ebcdic, ebcdic_ctrl) + || !BIO_meth_set_create(methods_ebcdic, ebcdic_new) + || !BIO_meth_set_destroy(methods_ebcdic, ebcdic_free)) + return NULL; + } + return methods_ebcdic; } static int ebcdic_new(BIO *bi) @@ -451,68 +344,71 @@ static int ebcdic_new(BIO *bi) wbuf->alloced = 1024; wbuf->buff[0] = '\0'; - bi->ptr = (char *)wbuf; - bi->init = 1; - bi->flags = 0; - return (1); + BIO_set_data(bi, wbuf); + BIO_set_init(bi, 1); + return 1; } static int ebcdic_free(BIO *a) { + EBCDIC_OUTBUFF *wbuf; + if (a == NULL) - return (0); - OPENSSL_free(a->ptr); - a->ptr = NULL; - a->init = 0; - a->flags = 0; - return (1); + return 0; + wbuf = BIO_get_data(a); + OPENSSL_free(wbuf); + BIO_set_data(a, NULL); + BIO_set_init(a, 0); + + return 1; } static int ebcdic_read(BIO *b, char *out, int outl) { int ret = 0; + BIO *next = BIO_next(b); if (out == NULL || outl == 0) return (0); - if (b->next_bio == NULL) + if (next == NULL) return (0); - ret = BIO_read(b->next_bio, out, outl); + ret = BIO_read(next, out, outl); if (ret > 0) ascii2ebcdic(out, out, ret); - return (ret); + return ret; } static int ebcdic_write(BIO *b, const char *in, int inl) { EBCDIC_OUTBUFF *wbuf; + BIO *next = BIO_next(b); int ret = 0; int num; - unsigned char n; if ((in == NULL) || (inl <= 0)) return (0); - if (b->next_bio == NULL) - return (0); + if (next == NULL) + return 0; - wbuf = (EBCDIC_OUTBUFF *) b->ptr; + wbuf = (EBCDIC_OUTBUFF *) BIO_get_data(b); if (inl > (num = wbuf->alloced)) { num = num + num; /* double the size */ if (num < inl) num = inl; + OPENSSL_free(wbuf); wbuf = app_malloc(sizeof(*wbuf) + num, "grow ebcdic wbuf"); - OPENSSL_free(b->ptr); wbuf->alloced = num; wbuf->buff[0] = '\0'; - b->ptr = (char *)wbuf; + BIO_set_data(b, wbuf); } ebcdic2ascii(wbuf->buff, in, inl); - ret = BIO_write(b->next_bio, wbuf->buff, inl); + ret = BIO_write(next, wbuf->buff, inl); return (ret); } @@ -520,15 +416,16 @@ static int ebcdic_write(BIO *b, const char *in, int inl) static long ebcdic_ctrl(BIO *b, int cmd, long num, void *ptr) { long ret; + BIO *next = BIO_next(b); - if (b->next_bio == NULL) + if (next == NULL) return (0); switch (cmd) { case BIO_CTRL_DUP: ret = 0L; break; default: - ret = BIO_ctrl(b->next_bio, cmd, num, ptr); + ret = BIO_ctrl(next, cmd, num, ptr); break; } return (ret); @@ -537,8 +434,10 @@ static long ebcdic_ctrl(BIO *b, int cmd, long num, void *ptr) static int ebcdic_gets(BIO *bp, char *buf, int size) { int i, ret = 0; - if (bp->next_bio == NULL) - return (0); + BIO *next = BIO_next(bp); + + if (next == NULL) + return 0; /* return(BIO_gets(bp->next_bio,buf,size));*/ for (i = 0; i < size - 1; ++i) { ret = ebcdic_read(bp, &buf[i], 1); @@ -556,8 +455,8 @@ static int ebcdic_gets(BIO *bp, char *buf, int size) static int ebcdic_puts(BIO *bp, const char *str) { - if (bp->next_bio == NULL) - return (0); + if (BIO_next(bp) == NULL) + return 0; return ebcdic_write(bp, str, strlen(str)); } #endif @@ -603,6 +502,7 @@ typedef struct tlsextstatusctx_st { static tlsextstatusctx tlscstatp = { NULL, NULL, NULL, 0, -1, 0 }; +#ifndef OPENSSL_NO_OCSP /* * Certificate Status callback. This is called when a client includes a * certificate status request extension. This is a simplified version. It @@ -621,8 +521,8 @@ static int cert_status_cb(SSL *s, void *arg) int rspderlen; STACK_OF(OPENSSL_STRING) *aia = NULL; X509 *x = NULL; - X509_STORE_CTX inctx; - X509_OBJECT obj; + X509_STORE_CTX *inctx = NULL; + X509_OBJECT *obj; OCSP_REQUEST *req = NULL; OCSP_RESPONSE *resp = NULL; OCSP_CERTID *id = NULL; @@ -656,24 +556,26 @@ static int cert_status_cb(SSL *s, void *arg) use_ssl = srctx->use_ssl; } - if (!X509_STORE_CTX_init(&inctx, + inctx = X509_STORE_CTX_new(); + if (inctx == NULL) + goto err; + if (!X509_STORE_CTX_init(inctx, SSL_CTX_get_cert_store(SSL_get_SSL_CTX(s)), NULL, NULL)) goto err; - if (X509_STORE_get_by_subject(&inctx, X509_LU_X509, - X509_get_issuer_name(x), &obj) <= 0) { + obj = X509_STORE_CTX_get_obj_by_subject(inctx, X509_LU_X509, + X509_get_issuer_name(x)); + if (obj == NULL) { BIO_puts(bio_err, "cert_status: Can't retrieve issuer certificate.\n"); - X509_STORE_CTX_cleanup(&inctx); goto done; } + id = OCSP_cert_to_id(NULL, x, X509_OBJECT_get0_X509(obj)); + X509_OBJECT_free(obj); + if (!id) + goto err; req = OCSP_REQUEST_new(); if (req == NULL) goto err; - id = OCSP_cert_to_id(NULL, x, obj.data.x509); - X509_free(obj.data.x509); - X509_STORE_CTX_cleanup(&inctx); - if (!id) - goto err; if (!OCSP_request_add0_id(req, id)) goto err; id = NULL; @@ -699,6 +601,10 @@ static int cert_status_cb(SSL *s, void *arg) OCSP_RESPONSE_print(bio_err, resp, 2); } ret = SSL_TLSEXT_ERR_OK; + goto done; + + err: + ret = SSL_TLSEXT_ERR_ALERT_FATAL; done: if (ret != SSL_TLSEXT_ERR_OK) ERR_print_errors(bio_err); @@ -711,11 +617,10 @@ static int cert_status_cb(SSL *s, void *arg) OCSP_CERTID_free(id); OCSP_REQUEST_free(req); OCSP_RESPONSE_free(resp); + X509_STORE_CTX_free(inctx); return ret; - err: - ret = SSL_TLSEXT_ERR_ALERT_FATAL; - goto done; } +#endif #ifndef OPENSSL_NO_NEXTPROTONEG /* This is the context that we pass to next_proto_cb */ @@ -739,7 +644,7 @@ static int next_proto_cb(SSL *s, const unsigned char **data, /* This the context that we pass to alpn_cb */ typedef struct tlsextalpnctx_st { unsigned char *data; - unsigned short len; + size_t len; } tlsextalpnctx; static int alpn_cb(SSL *s, const unsigned char **out, unsigned char *outlen, @@ -749,7 +654,7 @@ static int alpn_cb(SSL *s, const unsigned char **out, unsigned char *outlen, if (!s_quiet) { /* We can assume that |in| is syntactically valid. */ - unsigned i; + unsigned int i; BIO_printf(bio_s_out, "ALPN protocols advertised by the client: "); for (i = 0; i < inlen;) { if (i) @@ -805,9 +710,9 @@ typedef enum OPTION_choice { OPT_QUIET, OPT_BRIEF, OPT_NO_DHE, OPT_NO_RESUME_EPHEMERAL, OPT_PSK_HINT, OPT_PSK, OPT_SRPVFILE, OPT_SRPUSERSEED, OPT_REV, OPT_WWW, OPT_UPPER_WWW, OPT_HTTP, OPT_ASYNC, - OPT_SSL_CONFIG, OPT_SSL3, - OPT_TLS1_2, OPT_TLS1_1, OPT_TLS1, OPT_DTLS, OPT_DTLS1, - OPT_DTLS1_2, OPT_TIMEOUT, OPT_MTU, OPT_CHAIN, OPT_LISTEN, + OPT_SSL_CONFIG, OPT_SPLIT_SEND_FRAG, OPT_MAX_PIPELINES, OPT_READ_BUF, + OPT_SSL3, OPT_TLS1_2, OPT_TLS1_1, OPT_TLS1, OPT_DTLS, OPT_DTLS1, + OPT_DTLS1_2, OPT_TIMEOUT, OPT_MTU, OPT_LISTEN, OPT_ID_PREFIX, OPT_RAND, OPT_SERVERNAME, OPT_SERVERNAME_FATAL, OPT_CERT2, OPT_KEY2, OPT_NEXTPROTONEG, OPT_ALPN, OPT_SRTP_PROFILES, OPT_KEYMATEXPORT, OPT_KEYMATEXPORTLEN, @@ -835,7 +740,7 @@ OPTIONS s_server_options[] = { {"Verify", OPT_UPPER_V_VERIFY, 'n', "Turn on peer certificate verification, must have a cert"}, {"cert", OPT_CERT, '<', "Certificate file to use; default is " TEST_CERT}, - {"naccept", OPT_NACCEPT, 'p', "Terminate after pnum connections"}, + {"naccept", OPT_NACCEPT, 'p', "Terminate after #num connections"}, {"serverinfo", OPT_SERVERINFO, 's', "PEM serverinfo file for certificate"}, {"certform", OPT_CERTFORM, 'F', @@ -883,7 +788,7 @@ OPTIONS s_server_options[] = { "-Private Key file to use for servername if not in -cert2"}, {"tlsextdebug", OPT_TLSEXTDEBUG, '-', "Hex dump of all TLS extensions received"}, - {"HTTP", OPT_HTTP, '-', "Like -WWW but ./path incluedes HTTP headers"}, + {"HTTP", OPT_HTTP, '-', "Like -WWW but ./path includes HTTP headers"}, {"id_prefix", OPT_ID_PREFIX, 's', "Generate SSL/TLS session IDs prefixed by arg"}, {"rand", OPT_RAND, 's', @@ -918,12 +823,14 @@ OPTIONS s_server_options[] = { "CA file for certificate verification (PEM format)"}, {"ign_eof", OPT_IGN_EOF, '-', "ignore input eof (default when -quiet)"}, {"no_ign_eof", OPT_NO_IGN_EOF, '-', "Do not ignore input eof"}, +#ifndef OPENSSL_NO_OCSP {"status", OPT_STATUS, '-', "Request certificate status from server"}, {"status_verbose", OPT_STATUS_VERBOSE, '-', "Print more output in certificate status callback"}, {"status_timeout", OPT_STATUS_TIMEOUT, 'n', "Status request responder timeout"}, {"status_url", OPT_STATUS_URL, 's', "Status request fallback URL"}, +#endif #ifndef OPENSSL_NO_SSL_TRACE {"trace", OPT_TRACE, '-', "trace protocol messages"}, #endif @@ -938,6 +845,12 @@ OPTIONS s_server_options[] = { {"async", OPT_ASYNC, '-', "Operate in asynchronous mode"}, {"ssl_config", OPT_SSL_CONFIG, 's', \ "Configure SSL_CTX using the configuration 'val'"}, + {"split_send_frag", OPT_SPLIT_SEND_FRAG, 'n', + "Size used to split data for encrypt pipelines"}, + {"max_pipelines", OPT_MAX_PIPELINES, 'n', + "Maximum number of encrypt/decrypt pipelines to be used"}, + {"read_buf", OPT_READ_BUF, 'n', + "Default read buffer size to be used for connections"}, OPT_S_OPTIONS, OPT_V_OPTIONS, OPT_X_OPTIONS, @@ -967,7 +880,6 @@ OPTIONS s_server_options[] = { {"dtls", OPT_DTLS, '-', "Use any DTLS version"}, {"timeout", OPT_TIMEOUT, '-', "Enable timeouts"}, {"mtu", OPT_MTU, 'p', "Set link layer MTU"}, - {"chain", OPT_CHAIN, '-', "Read a certificate chain"}, {"listen", OPT_LISTEN, '-', "Listen for a DTLS ClientHello with a cookie and then connect"}, #endif @@ -993,12 +905,16 @@ OPTIONS s_server_options[] = { #ifndef OPENSSL_NO_ENGINE {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"}, #endif - {NULL} + {NULL, OPT_EOF, 0, NULL} }; +#define IS_PROT_FLAG(o) \ + (o == OPT_SSL3 || o == OPT_TLS1 || o == OPT_TLS1_1 || o == OPT_TLS1_2 \ + || o == OPT_DTLS || o == OPT_DTLS1 || o == OPT_DTLS1_2) + int s_server_main(int argc, char *argv[]) { - ENGINE *e = NULL; + ENGINE *engine = NULL; EVP_PKEY *s_key = NULL, *s_dkey = NULL; SSL_CONF_CTX *cctx = NULL; const SSL_METHOD *meth = TLS_server_method(); @@ -1041,6 +957,7 @@ int s_server_main(int argc, char *argv[]) X509 *s_cert2 = NULL; tlsextctx tlsextcbp = { NULL, NULL, SSL_TLSEXT_ERR_ALERT_WARNING }; const char *ssl_config = NULL; + int read_buf_len = 0; #ifndef OPENSSL_NO_NEXTPROTONEG const char *next_proto_neg_in = NULL; tlsextnextprotoctx next_proto = { NULL, 0 }; @@ -1055,6 +972,7 @@ int s_server_main(int argc, char *argv[]) char *srpuserseed = NULL; char *srp_verifier_file = NULL; #endif + int min_version = 0, max_version = 0, prot_opt = 0, no_prot_opt = 0; local_argc = argc; local_argv = argv; @@ -1068,6 +986,17 @@ int s_server_main(int argc, char *argv[]) prog = opt_init(argc, argv, s_server_options); while ((o = opt_next()) != OPT_EOF) { + if (IS_PROT_FLAG(o) && ++prot_opt > 1) { + BIO_printf(bio_err, "Cannot supply multiple protocol flags\n"); + goto end; + } + if (IS_NO_PROT_FLAG(o)) + no_prot_opt++; + if (prot_opt == 1 && no_prot_opt) { + BIO_printf(bio_err, "Cannot supply both a protocol flag and " + "\"-no_\"\n"); + goto end; + } switch (o) { case OPT_EOF: case OPT_ERR: @@ -1314,6 +1243,7 @@ int s_server_main(int argc, char *argv[]) tlscstatp.timeout = atoi(opt_arg()); break; case OPT_STATUS_URL: +#ifndef OPENSSL_NO_OCSP s_tlsextstatus = 1; if (!OCSP_parse_url(opt_arg(), &tlscstatp.host, @@ -1322,6 +1252,7 @@ int s_server_main(int argc, char *argv[]) BIO_printf(bio_err, "Error parsing URL\n"); goto end; } +#endif break; case OPT_MSG: s_msg = 1; @@ -1332,9 +1263,8 @@ int s_server_main(int argc, char *argv[]) case OPT_TRACE: #ifndef OPENSSL_NO_SSL_TRACE s_msg = 2; -#else - break; #endif + break; case OPT_SECURITY_DEBUG: sdebug = 1; break; @@ -1379,13 +1309,15 @@ int s_server_main(int argc, char *argv[]) case OPT_SRPVFILE: #ifndef OPENSSL_NO_SRP srp_verifier_file = opt_arg(); - meth = TLSv1_server_method(); + if (min_version < TLS1_VERSION) + min_version = TLS1_VERSION; #endif break; case OPT_SRPUSERSEED: #ifndef OPENSSL_NO_SRP srpuserseed = opt_arg(); - meth = TLSv1_server_method(); + if (min_version < TLS1_VERSION) + min_version = TLS1_VERSION; #endif break; case OPT_REV: @@ -1404,24 +1336,20 @@ int s_server_main(int argc, char *argv[]) ssl_config = opt_arg(); break; case OPT_SSL3: -#ifndef OPENSSL_NO_SSL3 - meth = SSLv3_server_method(); -#endif + min_version = SSL3_VERSION; + max_version = SSL3_VERSION; break; case OPT_TLS1_2: -#ifndef OPENSSL_NO_TLS1_2 - meth = TLSv1_2_server_method(); -#endif + min_version = TLS1_2_VERSION; + max_version = TLS1_2_VERSION; break; case OPT_TLS1_1: -#ifndef OPENSSL_NO_TLS1_1 - meth = TLSv1_1_server_method(); -#endif + min_version = TLS1_1_VERSION; + max_version = TLS1_1_VERSION; break; case OPT_TLS1: -#ifndef OPENSSL_NO_TLS1 - meth = TLSv1_server_method(); -#endif + min_version = TLS1_VERSION; + max_version = TLS1_VERSION; break; case OPT_DTLS: #ifndef OPENSSL_NO_DTLS @@ -1430,14 +1358,18 @@ int s_server_main(int argc, char *argv[]) #endif break; case OPT_DTLS1: -#ifndef OPENSSL_NO_DTLS1 - meth = DTLSv1_server_method(); +#ifndef OPENSSL_NO_DTLS + meth = DTLS_server_method(); + min_version = DTLS1_VERSION; + max_version = DTLS1_VERSION; socket_type = SOCK_DGRAM; #endif break; case OPT_DTLS1_2: -#ifndef OPENSSL_NO_DTLS1_2 - meth = DTLSv1_2_server_method(); +#ifndef OPENSSL_NO_DTLS + meth = DTLS_server_method(); + min_version = DTLS1_2_VERSION; + max_version = DTLS1_2_VERSION; socket_type = SOCK_DGRAM; #endif break; @@ -1449,11 +1381,6 @@ int s_server_main(int argc, char *argv[]) case OPT_MTU: #ifndef OPENSSL_NO_DTLS socket_mtu = atol(opt_arg()); -#endif - break; - case OPT_CHAIN: -#ifndef OPENSSL_NO_DTLS - cert_chain = 1; #endif break; case OPT_LISTEN: @@ -1465,7 +1392,7 @@ int s_server_main(int argc, char *argv[]) session_id_prefix = opt_arg(); break; case OPT_ENGINE: - e = setup_engine(opt_arg(), 1); + engine = setup_engine(opt_arg(), 1); break; case OPT_RAND: inrand = opt_arg(); @@ -1504,6 +1431,23 @@ int s_server_main(int argc, char *argv[]) case OPT_ASYNC: async = 1; break; + case OPT_SPLIT_SEND_FRAG: + split_send_fragment = atoi(opt_arg()); + if (split_send_fragment == 0) { + /* + * Not allowed - set to a deliberately bad value so we get an + * error message below + */ + split_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH + 1; + } + break; + case OPT_MAX_PIPELINES: + max_pipelines = atoi(opt_arg()); + break; + case OPT_READ_BUF: + read_buf_len = atoi(opt_arg()); + break; + } } argc = opt_num_rest(); @@ -1529,6 +1473,16 @@ int s_server_main(int argc, char *argv[]) } #endif + if (split_send_fragment > SSL3_RT_MAX_PLAIN_LENGTH) { + BIO_printf(bio_err, "Bad split send fragment size\n"); + goto end; + } + + if (max_pipelines > SSL_MAX_PIPELINES) { + BIO_printf(bio_err, "Bad max pipelines value\n"); + goto end; + } + if (!app_passwd(passarg, dpassarg, &pass, &dpass)) { BIO_printf(bio_err, "Error getting password\n"); goto end; @@ -1544,7 +1498,7 @@ int s_server_main(int argc, char *argv[]) goto end; if (nocert == 0) { - s_key = load_key(s_key_file, s_key_format, 0, pass, e, + s_key = load_key(s_key_file, s_key_format, 0, pass, engine, "server certificate private key file"); if (!s_key) { ERR_print_errors(bio_err); @@ -1565,7 +1519,7 @@ int s_server_main(int argc, char *argv[]) } if (tlsextcbp.servername) { - s_key2 = load_key(s_key_file2, s_key_format, 0, pass, e, + s_key2 = load_key(s_key_file2, s_key_format, 0, pass, engine, "second server certificate private key file"); if (!s_key2) { ERR_print_errors(bio_err); @@ -1583,7 +1537,7 @@ int s_server_main(int argc, char *argv[]) } #if !defined(OPENSSL_NO_NEXTPROTONEG) if (next_proto_neg_in) { - unsigned short len; + size_t len; next_proto.data = next_protos_parse(&len, next_proto_neg_in); if (next_proto.data == NULL) goto end; @@ -1594,7 +1548,7 @@ int s_server_main(int argc, char *argv[]) #endif alpn_ctx.data = NULL; if (alpn_in) { - unsigned short len; + size_t len; alpn_ctx.data = next_protos_parse(&len, alpn_in); if (alpn_ctx.data == NULL) goto end; @@ -1624,7 +1578,7 @@ int s_server_main(int argc, char *argv[]) s_dkey_file = s_dcert_file; s_dkey = load_key(s_dkey_file, s_dkey_format, - 0, dpass, e, "second certificate private key file"); + 0, dpass, engine, "second certificate private key file"); if (!s_dkey) { ERR_print_errors(bio_err); goto end; @@ -1691,6 +1645,10 @@ int s_server_main(int argc, char *argv[]) goto end; } } + if (SSL_CTX_set_min_proto_version(ctx, min_version) == 0) + goto end; + if (SSL_CTX_set_max_proto_version(ctx, max_version) == 0) + goto end; if (session_id_prefix) { if (strlen(session_id_prefix) >= 32) @@ -1719,6 +1677,16 @@ int s_server_main(int argc, char *argv[]) if (async) { SSL_CTX_set_mode(ctx, SSL_MODE_ASYNC); } + if (split_send_fragment > 0) { + SSL_CTX_set_split_send_fragment(ctx, split_send_fragment); + } + if (max_pipelines > 0) { + SSL_CTX_set_max_pipelines(ctx, max_pipelines); + } + + if (read_buf_len > 0) { + SSL_CTX_set_default_read_buffer_len(ctx, read_buf_len); + } #ifndef OPENSSL_NO_SRTP if (srtp_profiles != NULL) { @@ -1794,9 +1762,10 @@ int s_server_main(int argc, char *argv[]) if (async) SSL_CTX_set_mode(ctx2, SSL_MODE_ASYNC); - if ((!SSL_CTX_load_verify_locations(ctx2, CAfile, CApath)) || - (!SSL_CTX_set_default_verify_paths(ctx2))) { + if (!ctx_set_verify_locations(ctx2, CAfile, CApath, noCAfile, + noCApath)) { ERR_print_errors(bio_err); + goto end; } if (vpmtouched && !SSL_CTX_set1_param(ctx2, vpm)) { BIO_printf(bio_err, "Error setting verify params\n"); @@ -1958,6 +1927,7 @@ int s_server_main(int argc, char *argv[]) if (ctx2) SSL_CTX_set_client_CA_list(ctx2, SSL_load_client_CA_file(CAfile)); } +#ifndef OPENSSL_NO_OCSP if (s_tlsextstatus) { SSL_CTX_set_tlsext_status_cb(ctx, cert_status_cb); SSL_CTX_set_tlsext_status_arg(ctx, &tlscstatp); @@ -1966,6 +1936,7 @@ int s_server_main(int argc, char *argv[]) SSL_CTX_set_tlsext_status_arg(ctx2, &tlscstatp); } } +#endif BIO_printf(bio_s_out, "ACCEPT\n"); (void)BIO_flush(bio_s_out); @@ -2005,7 +1976,6 @@ int s_server_main(int argc, char *argv[]) SSL_CTX_free(ctx2); X509_free(s_cert2); EVP_PKEY_free(s_key2); - BIO_free(serverinfo_in); #ifndef OPENSSL_NO_NEXTPROTONEG OPENSSL_free(next_proto.data); #endif @@ -2017,6 +1987,9 @@ int s_server_main(int argc, char *argv[]) bio_s_out = NULL; BIO_free(bio_s_msg); bio_s_msg = NULL; +#ifdef CHARSET_EBCDIC + BIO_meth_free(methods_ebcdic); +#endif return (ret); } @@ -2058,7 +2031,7 @@ static int sv_body(int s, int stype, unsigned char *context) SSL *con = NULL; BIO *sbio; struct timeval timeout; -#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE) +#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) struct timeval tv; #else struct timeval *timeoutp; @@ -2169,12 +2142,12 @@ static int sv_body(int s, int stype, unsigned char *context) int read_from_sslcon; read_from_terminal = 0; - read_from_sslcon = SSL_pending(con) + read_from_sslcon = SSL_has_pending(con) || (async && SSL_waiting_for_async(con)); if (!read_from_sslcon) { FD_ZERO(&readfds); -#if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_NETWARE) +#if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_MSDOS) openssl_fdset(fileno(stdin), &readfds); #endif openssl_fdset(s, &readfds); @@ -2185,7 +2158,7 @@ static int sv_body(int s, int stype, unsigned char *context) * if you do have a cast then you can either go for (int *) or * (void *). */ -#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE) +#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) /* * Under DOS (non-djgpp) and Windows we can't select on stdin: * only on sockets. As a workaround we timeout the select every @@ -2195,10 +2168,10 @@ static int sv_body(int s, int stype, unsigned char *context) tv.tv_sec = 1; tv.tv_usec = 0; i = select(width, (void *)&readfds, NULL, NULL, &tv); - if ((i < 0) || (!i && !_kbhit())) - continue; - if (_kbhit()) + if (has_stdin_waiting()) read_from_terminal = 1; + if ((i < 0) || (!i && !read_from_terminal)) + continue; #else if ((SSL_version(con) == DTLS1_VERSION) && DTLSv1_get_timeout(con, &timeout)) @@ -2246,7 +2219,7 @@ static int sv_body(int s, int stype, unsigned char *context) if ((i <= 0) || (buf[0] == 'Q')) { BIO_printf(bio_s_out, "DONE\n"); (void)BIO_flush(bio_s_out); - SHUTDOWN(s); + BIO_closesocket(s); close_accept_socket(); ret = -11; goto err; @@ -2255,7 +2228,7 @@ static int sv_body(int s, int stype, unsigned char *context) BIO_printf(bio_s_out, "DONE\n"); (void)BIO_flush(bio_s_out); if (SSL_version(con) != DTLS1_VERSION) - SHUTDOWN(s); + BIO_closesocket(s); /* * close_accept_socket(); ret= -11; */ @@ -2337,13 +2310,19 @@ static int sv_body(int s, int stype, unsigned char *context) break; case SSL_ERROR_WANT_ASYNC: BIO_printf(bio_s_out, "Write BLOCK (Async)\n"); + (void)BIO_flush(bio_s_out); wait_for_async(con); break; case SSL_ERROR_WANT_WRITE: case SSL_ERROR_WANT_READ: case SSL_ERROR_WANT_X509_LOOKUP: BIO_printf(bio_s_out, "Write BLOCK\n"); + (void)BIO_flush(bio_s_out); break; + case SSL_ERROR_WANT_ASYNC_JOB: + /* + * This shouldn't ever happen in s_server. Treat as an error + */ case SSL_ERROR_SYSCALL: case SSL_ERROR_SSL: BIO_printf(bio_s_out, "ERROR\n"); @@ -2407,17 +2386,24 @@ static int sv_body(int s, int stype, unsigned char *context) ascii2ebcdic(buf, buf, i); #endif raw_write_stdout(buf, (unsigned int)i); - if (SSL_pending(con)) + (void)BIO_flush(bio_s_out); + if (SSL_has_pending(con)) goto again; break; case SSL_ERROR_WANT_ASYNC: BIO_printf(bio_s_out, "Read BLOCK (Async)\n"); + (void)BIO_flush(bio_s_out); wait_for_async(con); break; case SSL_ERROR_WANT_WRITE: case SSL_ERROR_WANT_READ: BIO_printf(bio_s_out, "Read BLOCK\n"); + (void)BIO_flush(bio_s_out); break; + case SSL_ERROR_WANT_ASYNC_JOB: + /* + * This shouldn't ever happen in s_server. Treat as an error + */ case SSL_ERROR_SYSCALL: case SSL_ERROR_SSL: BIO_printf(bio_s_out, "ERROR\n"); @@ -2452,7 +2438,7 @@ static void close_accept_socket(void) { BIO_printf(bio_err, "shutdown accept socket\n"); if (accept_socket >= 0) { - SHUTDOWN2(accept_socket); + BIO_closesocket(accept_socket); } } @@ -2468,9 +2454,10 @@ static int init_ssl_connection(SSL *con) unsigned next_proto_neg_len; #endif unsigned char *exportedkeymat; + int retry = 0; #ifndef OPENSSL_NO_DTLS - if(dtlslisten) { + if (dtlslisten) { BIO_ADDR *client = NULL; if ((client = BIO_ADDR_new()) == NULL) { @@ -2483,11 +2470,11 @@ static int init_ssl_connection(SSL *con) int fd = -1; wbio = SSL_get_wbio(con); - if(wbio) { + if (wbio) { BIO_get_fd(wbio, &fd); } - if(!wbio || BIO_connect(fd, client, 0) == 0) { + if (!wbio || BIO_connect(fd, client, 0) == 0) { BIO_printf(bio_err, "ERROR - unable to connect\n"); BIO_ADDR_free(client); return 0; @@ -2495,6 +2482,8 @@ static int init_ssl_connection(SSL *con) BIO_ADDR_free(client); dtlslisten = 0; i = SSL_accept(con); + } else { + BIO_ADDR_free(client); } } else #endif @@ -2502,6 +2491,8 @@ static int init_ssl_connection(SSL *con) do { i = SSL_accept(con); + if (i <= 0) + retry = BIO_sock_should_retry(i); #ifdef CERT_CB_TEST_RETRY { while (i <= 0 && SSL_get_error(con, i) == SSL_ERROR_WANT_X509_LOOKUP @@ -2509,6 +2500,8 @@ static int init_ssl_connection(SSL *con) BIO_printf(bio_err, "LOOKUP from certificate callback during accept\n"); i = SSL_accept(con); + if (i <= 0) + retry = BIO_sock_should_retry(i); } } #endif @@ -2527,13 +2520,15 @@ static int init_ssl_connection(SSL *con) else BIO_printf(bio_s_out, "LOOKUP not successful\n"); i = SSL_accept(con); + if (i <= 0) + retry = BIO_sock_should_retry(i); } #endif } while (i < 0 && SSL_waiting_for_async(con)); if (i <= 0) { if ((dtlslisten && i == 0) - || (!dtlslisten && BIO_sock_should_retry(i))) { + || (!dtlslisten && retry)) { BIO_printf(bio_s_out, "DELAY\n"); return (1); } @@ -2564,6 +2559,7 @@ static int init_ssl_connection(SSL *con) X509_NAME_oneline(X509_get_issuer_name(peer), buf, sizeof buf); BIO_printf(bio_s_out, "issuer=%s\n", buf); X509_free(peer); + peer = NULL; } if (SSL_get_shared_ciphers(con, buf, sizeof buf) != NULL) @@ -2618,6 +2614,7 @@ static int init_ssl_connection(SSL *con) OPENSSL_free(exportedkeymat); } + (void)BIO_flush(bio_s_out); return (1); } @@ -2738,9 +2735,7 @@ static int www_body(int s, int stype, unsigned char *context) continue; } #endif -#if defined(OPENSSL_SYS_NETWARE) - delay(1000); -#elif !defined(OPENSSL_SYS_MSDOS) +#if !defined(OPENSSL_SYS_MSDOS) sleep(1); #endif continue; @@ -2754,7 +2749,7 @@ static int www_body(int s, int stype, unsigned char *context) if (((www == 1) && (strncmp("GET ", buf, 4) == 0)) || ((www == 2) && (strncmp("GET /stats ", buf, 11) == 0))) { char *p; - X509 *peer; + X509 *peer = NULL; STACK_OF(SSL_CIPHER) *sk; static const char *space = " "; @@ -2783,7 +2778,7 @@ static int www_body(int s, int stype, unsigned char *context) goto err; } /* - * We're not acutally expecting any data here and we ignore + * We're not actually expecting any data here and we ignore * any that is sent. This is just to force the handshake that * we're expecting to come from the client. If they haven't * sent one there's not much we can do. @@ -2795,7 +2790,7 @@ static int www_body(int s, int stype, unsigned char *context) "HTTP/1.0 200 ok\r\nContent-type: text/html\r\n\r\n"); BIO_puts(io, "\n"); BIO_puts(io, "
\n");
-/*                      BIO_puts(io,OpenSSL_version(OPENSSL_VERSION));*/
+            /* BIO_puts(io, OpenSSL_version(OPENSSL_VERSION)); */
             BIO_puts(io, "\n");
             for (i = 0; i < local_argc; i++) {
                 const char *myp;
@@ -2874,6 +2869,8 @@ static int www_body(int s, int stype, unsigned char *context)
                 BIO_printf(io, "Client certificate\n");
                 X509_print(io, peer);
                 PEM_write_bio_X509(io, peer);
+                X509_free(peer);
+                peer = NULL;
             } else
                 BIO_puts(io, "no client certificate available\n");
             BIO_puts(io, "\r\n\r\n");
@@ -3129,9 +3126,7 @@ static int rev_body(int s, int stype, unsigned char *context)
                     continue;
                 }
 #endif
-#if defined(OPENSSL_SYS_NETWARE)
-                delay(1000);
-#elif !defined(OPENSSL_SYS_MSDOS)
+#if !defined(OPENSSL_SYS_MSDOS)
                 sleep(1);
 #endif
                 continue;
@@ -3315,3 +3310,5 @@ static void free_sessions(void)
     }
     first = NULL;
 }
+
+#endif  /* OPENSSL_NO_SOCK */