Remove all RFC5878 code.

[openssl.git] / apps / s_server.c

diff --git a/apps/s_server.c b/apps/s_server.c
index 8fd47c4c3f29145bec0e7f97cccde4bac63f3c57..456b34dae49e7e703896d94ce8eb855a57373d6e 100644 (file)
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -315,10 +315,9 @@ static int cert_chain = 0;
 #endif
 
 #ifndef OPENSSL_NO_TLSEXT
-static BIO *authz_in = NULL;
-static const char *s_authz_file = NULL;
 static BIO *serverinfo_in = NULL;
 static const char *s_serverinfo_file = NULL;
+
 #endif
 
 #ifndef OPENSSL_NO_PSK
@@ -482,10 +481,12 @@ static void sv_usage(void)
        BIO_printf(bio_err," -Verify arg   - turn on peer certificate verification, must have a cert.\n");
        BIO_printf(bio_err," -cert arg     - certificate file to use\n");
        BIO_printf(bio_err,"                 (default is %s)\n",TEST_CERT);
-       BIO_printf(bio_err," -authz arg   -  binary authz file for certificate\n");
 #ifndef OPENSSL_NO_TLSEXT
        BIO_printf(bio_err," -serverinfo arg - PEM serverinfo file for certificate\n");
+       BIO_printf(bio_err," -auth               - send and receive RFC 5878 TLS auth extensions and supplemental data\n");
+       BIO_printf(bio_err," -auth_require_reneg - Do not send TLS auth extensions until renegotiation\n");
 #endif
+       BIO_printf(bio_err," -no_resumption_on_reneg - set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION flag\n");
        BIO_printf(bio_err," -crl_check    - check the peer certificate has not been revoked by its CA.\n" \
                           "                 The CRL(s) are appended to the certificate file\n");
        BIO_printf(bio_err," -crl_check_all - check the peer certificate has not been revoked by its CA\n" \
@@ -1025,9 +1026,9 @@ int MAIN(int argc, char *argv[])
 # ifndef OPENSSL_NO_NEXTPROTONEG
        const char *next_proto_neg_in = NULL;
        tlsextnextprotoctx next_proto = { NULL, 0};
+# endif
        const char *alpn_in = NULL;
        tlsextalpnctx alpn_ctx = { NULL, 0};
-# endif
 #endif
 #ifndef OPENSSL_NO_PSK
        /* by default do not send a PSK identity hint */
@@ -1132,11 +1133,6 @@ int MAIN(int argc, char *argv[])
                else if (strcmp(*argv,"-crl_download") == 0)
                        crl_download = 1;
 #ifndef OPENSSL_NO_TLSEXT
-               else if (strcmp(*argv,"-authz") == 0)
-                       {
-                       if (--argc < 1) goto bad;
-                       s_authz_file = *(++argv);
-                       }
                else if (strcmp(*argv,"-serverinfo") == 0)
                        {
                        if (--argc < 1) goto bad;
@@ -1477,12 +1473,12 @@ int MAIN(int argc, char *argv[])
                        if (--argc < 1) goto bad;
                        next_proto_neg_in = *(++argv);
                        }
+# endif
                else if (strcmp(*argv,"-alpn") == 0)
                        {
                        if (--argc < 1) goto bad;
                        alpn_in = *(++argv);
                        }
-# endif
 #endif
 #if !defined(OPENSSL_NO_JPAKE) && !defined(OPENSSL_NO_PSK)
                else if (strcmp(*argv,"-jpake") == 0)
@@ -1921,8 +1917,6 @@ bad:
        if (!set_cert_key_stuff(ctx, s_cert, s_key, s_chain, build_chain))
                goto end;
 #ifndef OPENSSL_NO_TLSEXT
-       if (s_authz_file != NULL && !SSL_CTX_use_authz_file(ctx, s_authz_file))
-               goto end;
        if (s_serverinfo_file != NULL
            && !SSL_CTX_use_serverinfo_file(ctx, s_serverinfo_file))
                {
@@ -2097,12 +2091,12 @@ end:
                X509_free(s_cert2);
        if (s_key2)
                EVP_PKEY_free(s_key2);
-       if (authz_in != NULL)
-               BIO_free(authz_in);
        if (serverinfo_in != NULL)
                BIO_free(serverinfo_in);
+# ifndef OPENSSL_NO_NEXTPROTONEG
        if (next_proto.data)
                OPENSSL_free(next_proto.data);
+# endif
        if (alpn_ctx.data)
                OPENSSL_free(alpn_ctx.data);
 #endif
@@ -2608,6 +2602,15 @@ static int init_ssl_connection(SSL *con)
 
 
        i=SSL_accept(con);
+#ifdef CERT_CB_TEST_RETRY
+       {
+       while (i <= 0 && SSL_get_error(con,i) == SSL_ERROR_WANT_X509_LOOKUP && SSL_state(con) == SSL3_ST_SR_CLNT_HELLO_C) 
+               {
+               fprintf(stderr, "LOOKUP from certificate callback during accept\n");
+               i=SSL_accept(con);
+               }
+       }
+#endif
 #ifndef OPENSSL_NO_SRP
        while (i <= 0 &&  SSL_get_error(con,i) == SSL_ERROR_WANT_X509_LOOKUP) 
                {
@@ -2620,6 +2623,7 @@ static int init_ssl_connection(SSL *con)
                        i=SSL_accept(con);
                }
 #endif
+
        if (i <= 0)
                {
                if (BIO_sock_should_retry(i))
@@ -3483,3 +3487,4 @@ static void free_sessions(void)
                }
        first = NULL;
        }
+