X-Git-Url: https://git.openssl.org/gitweb/?a=blobdiff_plain;f=apps%2Fs_server.c;h=ebab7a2137a83136113276e17f1331c0cc258045;hb=51e5133d551b4c132f72fc2ff5bbe076f5a3e052;hp=d545546f29d0d3bf01a75850f6278ff4f7fad014;hpb=4bbd4ba66dec4ca35502b8fac0315b447fde4d7a;p=openssl.git diff --git a/apps/s_server.c b/apps/s_server.c index d545546f29..ebab7a2137 100644 --- a/apps/s_server.c +++ b/apps/s_server.c @@ -43,9 +43,14 @@ #include #include #include -#include +#if defined(_WIN32) +/* Included before async.h to avoid some warnings */ +# include +#endif #include +#include +#include #ifndef OPENSSL_NO_SOCK @@ -100,27 +105,14 @@ static void free_sessions(void); static DH *load_dh_param(const char *dhfile); #endif -static void s_server_init(void); - /* static int load_CA(SSL_CTX *ctx, char *file);*/ -#undef BUFSIZZ -#define BUFSIZZ 16*1024 -static int bufsize = BUFSIZZ; +static const int bufsize = 16 * 1024; static int accept_socket = -1; #define TEST_CERT "server.pem" #define TEST_CERT2 "server2.pem" -extern int verify_depth, verify_return_error, verify_quiet; - -static int s_server_verify = SSL_VERIFY_NONE; -static int s_server_session_id_context = 1; /* anything will do */ -static const char *s_cert_file = TEST_CERT, *s_key_file = - NULL, *s_chain_file = NULL; - -static const char *s_cert_file2 = TEST_CERT2, *s_key_file2 = NULL; -static char *s_dcert_file = NULL, *s_dkey_file = NULL, *s_dchain_file = NULL; static int s_nbio = 0; static int s_nbio_test = 0; static int s_crlf = 0; @@ -132,8 +124,6 @@ static BIO *bio_s_out = NULL; static BIO *bio_s_msg = NULL; static int s_debug = 0; static int s_tlsextdebug = 0; -static int s_tlsextstatus = 0; -static int no_resume_ephemeral = 0; static int s_msg = 0; static int s_quiet = 0; static int s_ign_eof = 0; @@ -143,21 +133,16 @@ static char *keymatexportlabel = NULL; static int keymatexportlen = 20; static int async = 0; -static unsigned int split_send_fragment = 0; -static unsigned int max_pipelines = 0; static const char *session_id_prefix = NULL; #ifndef OPENSSL_NO_DTLS static int enable_timeouts = 0; static long socket_mtu; -static int cert_chain = 0; + #endif static int dtlslisten = 0; -static BIO *serverinfo_in = NULL; -static const char *s_serverinfo_file = NULL; - #ifndef OPENSSL_NO_PSK static char *psk_identity = "Client_identity"; char *psk_key = NULL; /* by default PSK is not used */ @@ -261,7 +246,7 @@ static int ssl_srp_server_param_cb(SSL *s, int *ad, void *arg) p->login, p->user->info); ret = SSL_ERROR_NONE; -err: + err: SRP_user_pwd_free(p->user); p->user = NULL; p->login = NULL; @@ -270,34 +255,6 @@ err: #endif -static void s_server_init(void) -{ - accept_socket = -1; - verify_depth = 0; - s_server_verify = SSL_VERIFY_NONE; - s_dcert_file = NULL; - s_dkey_file = NULL; - s_dchain_file = NULL; - s_cert_file = TEST_CERT; - s_key_file = NULL; - s_chain_file = NULL; - s_cert_file2 = TEST_CERT2; - s_key_file2 = NULL; - ctx2 = NULL; - s_nbio = 0; - s_nbio_test = 0; - ctx = NULL; - www = 0; - bio_s_out = NULL; - s_debug = 0; - s_msg = 0; - s_quiet = 0; - s_brief = 0; - async = 0; - split_send_fragment = 0; - max_pipelines = 0; -} - static int local_argc = 0; static char **local_argv; @@ -323,8 +280,8 @@ static const BIO_METHOD *BIO_f_ebcdic_filter() { if (methods_ebcdic == NULL) { methods_ebcdic = BIO_meth_new(BIO_TYPE_EBCDIC_FILTER, - "EBCDIC/ASCII filter"); - if ( methods_ebcdic == NULL + "EBCDIC/ASCII filter"); + if (methods_ebcdic == NULL || !BIO_meth_set_write(methods_ebcdic, ebcdic_write) || !BIO_meth_set_read(methods_ebcdic, ebcdic_read) || !BIO_meth_set_puts(methods_ebcdic, ebcdic_puts) @@ -713,7 +670,7 @@ typedef enum OPTION_choice { OPT_SRPUSERSEED, OPT_REV, OPT_WWW, OPT_UPPER_WWW, OPT_HTTP, OPT_ASYNC, OPT_SSL_CONFIG, OPT_SPLIT_SEND_FRAG, OPT_MAX_PIPELINES, OPT_READ_BUF, OPT_SSL3, OPT_TLS1_2, OPT_TLS1_1, OPT_TLS1, OPT_DTLS, OPT_DTLS1, - OPT_DTLS1_2, OPT_TIMEOUT, OPT_MTU, OPT_CHAIN, OPT_LISTEN, + OPT_DTLS1_2, OPT_TIMEOUT, OPT_MTU, OPT_LISTEN, OPT_ID_PREFIX, OPT_RAND, OPT_SERVERNAME, OPT_SERVERNAME_FATAL, OPT_CERT2, OPT_KEY2, OPT_NEXTPROTONEG, OPT_ALPN, OPT_SRTP_PROFILES, OPT_KEYMATEXPORT, OPT_KEYMATEXPORTLEN, @@ -741,7 +698,7 @@ OPTIONS s_server_options[] = { {"Verify", OPT_UPPER_V_VERIFY, 'n', "Turn on peer certificate verification, must have a cert"}, {"cert", OPT_CERT, '<', "Certificate file to use; default is " TEST_CERT}, - {"naccept", OPT_NACCEPT, 'p', "Terminate after pnum connections"}, + {"naccept", OPT_NACCEPT, 'p', "Terminate after #num connections"}, {"serverinfo", OPT_SERVERINFO, 's', "PEM serverinfo file for certificate"}, {"certform", OPT_CERTFORM, 'F', @@ -789,7 +746,7 @@ OPTIONS s_server_options[] = { "-Private Key file to use for servername if not in -cert2"}, {"tlsextdebug", OPT_TLSEXTDEBUG, '-', "Hex dump of all TLS extensions received"}, - {"HTTP", OPT_HTTP, '-', "Like -WWW but ./path incluedes HTTP headers"}, + {"HTTP", OPT_HTTP, '-', "Like -WWW but ./path includes HTTP headers"}, {"id_prefix", OPT_ID_PREFIX, 's', "Generate SSL/TLS session IDs prefixed by arg"}, {"rand", OPT_RAND, 's', @@ -812,7 +769,7 @@ OPTIONS s_server_options[] = { {"no_cache", OPT_NO_CACHE, '-', "Disable session cache"}, {"ext_cache", OPT_EXT_CACHE, '-', "Disable internal cache, setup and use external cache"}, - {"CRLform", OPT_CRLFORM, 'F', "CRL format (PEM or DER) PEM is default" }, + {"CRLform", OPT_CRLFORM, 'F', "CRL format (PEM or DER) PEM is default"}, {"verify_return_error", OPT_VERIFY_RET_ERROR, '-', "Close connection on verification error"}, {"verify_quiet", OPT_VERIFY_QUIET, '-', @@ -839,12 +796,12 @@ OPTIONS s_server_options[] = { "Print output from SSL/TLS security framework"}, {"security_debug_verbose", OPT_SECURITY_DEBUG_VERBOSE, '-', "Print more output from SSL/TLS security framework"}, - {"brief", OPT_BRIEF, '-', \ + {"brief", OPT_BRIEF, '-', "Restrict output to brief summary of connection parameters"}, {"rev", OPT_REV, '-', "act as a simple test server which just sends back with the received text reversed"}, {"async", OPT_ASYNC, '-', "Operate in asynchronous mode"}, - {"ssl_config", OPT_SSL_CONFIG, 's', \ + {"ssl_config", OPT_SSL_CONFIG, 's', "Configure SSL_CTX using the configuration 'val'"}, {"split_send_frag", OPT_SPLIT_SEND_FRAG, 'n', "Size used to split data for encrypt pipelines"}, @@ -881,7 +838,6 @@ OPTIONS s_server_options[] = { {"dtls", OPT_DTLS, '-', "Use any DTLS version"}, {"timeout", OPT_TIMEOUT, '-', "Enable timeouts"}, {"mtu", OPT_MTU, 'p', "Set link layer MTU"}, - {"chain", OPT_CHAIN, '-', "Read a certificate chain"}, {"listen", OPT_LISTEN, '-', "Listen for a DTLS ClientHello with a cookie and then connect"}, #endif @@ -926,22 +882,17 @@ int s_server_main(int argc, char *argv[]) STACK_OF(X509_CRL) *crls = NULL; X509 *s_cert = NULL, *s_dcert = NULL; X509_VERIFY_PARAM *vpm = NULL; - char *CApath = NULL, *CAfile = NULL, *chCApath = NULL, *chCAfile = NULL; -#ifndef OPENSSL_NO_DH - char *dhfile = NULL; -#endif + const char *CApath = NULL, *CAfile = NULL, *chCApath = NULL, *chCAfile = NULL; char *dpassarg = NULL, *dpass = NULL, *inrand = NULL; char *passarg = NULL, *pass = NULL, *vfyCApath = NULL, *vfyCAfile = NULL; char *crl_file = NULL, *prog; -#ifndef OPENSSL_NO_PSK - char *p; -#endif #ifdef AF_UNIX int unlink_unix_path = 0; #endif do_server_cb server_cb; int vpmtouched = 0, build_chain = 0, no_cache = 0, ext_cache = 0; #ifndef OPENSSL_NO_DH + char *dhfile = NULL; int no_dhe = 0; #endif int nocert = 0, ret = 1; @@ -969,22 +920,42 @@ int s_server_main(int argc, char *argv[]) #ifndef OPENSSL_NO_PSK /* by default do not send a PSK identity hint */ static char *psk_identity_hint = NULL; + char *p; #endif #ifndef OPENSSL_NO_SRP char *srpuserseed = NULL; char *srp_verifier_file = NULL; #endif int min_version = 0, max_version = 0, prot_opt = 0, no_prot_opt = 0; - + int s_server_verify = SSL_VERIFY_NONE; + int s_server_session_id_context = 1; /* anything will do */ + const char *s_cert_file = TEST_CERT, *s_key_file = NULL, *s_chain_file = NULL; + const char *s_cert_file2 = TEST_CERT2, *s_key_file2 = NULL; + char *s_dcert_file = NULL, *s_dkey_file = NULL, *s_dchain_file = NULL; + int s_tlsextstatus = 0, no_resume_ephemeral = 0; + unsigned int split_send_fragment = 0, max_pipelines = 0; + const char *s_serverinfo_file = NULL; + + /* Init of few remaining global variables */ local_argc = argc; local_argv = argv; - s_server_init(); + ctx = ctx2 = NULL; + s_nbio = s_nbio_test = 0; + www = 0; + bio_s_out = NULL; + s_debug = 0; + s_msg = 0; + s_quiet = 0; + s_brief = 0; + async = 0; + cctx = SSL_CONF_CTX_new(); vpm = X509_VERIFY_PARAM_new(); if (cctx == NULL || vpm == NULL) goto end; - SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_SERVER | SSL_CONF_FLAG_CMDLINE); + SSL_CONF_CTX_set_flags(cctx, + SSL_CONF_FLAG_SERVER | SSL_CONF_FLAG_CMDLINE); prog = opt_init(argc, argv, s_server_options); while ((o = opt_next()) != OPT_EOF) { @@ -995,8 +966,8 @@ int s_server_main(int argc, char *argv[]) if (IS_NO_PROT_FLAG(o)) no_prot_opt++; if (prot_opt == 1 && no_prot_opt) { - BIO_printf(bio_err, "Cannot supply both a protocol flag and " - "\"-no_\"\n"); + BIO_printf(bio_err, + "Cannot supply both a protocol flag and '-no_'\n"); goto end; } switch (o) { @@ -1080,19 +1051,19 @@ int s_server_main(int argc, char *argv[]) break; case OPT_VERIFY: s_server_verify = SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE; - verify_depth = atoi(opt_arg()); + verify_args.depth = atoi(opt_arg()); if (!s_quiet) - BIO_printf(bio_err, "verify depth is %d\n", verify_depth); + BIO_printf(bio_err, "verify depth is %d\n", verify_args.depth); break; case OPT_UPPER_V_VERIFY: s_server_verify = SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT | SSL_VERIFY_CLIENT_ONCE; - verify_depth = atoi(opt_arg()); + verify_args.depth = atoi(opt_arg()); if (!s_quiet) BIO_printf(bio_err, "verify depth is %d, must return a certificate\n", - verify_depth); + verify_args.depth); break; case OPT_CONTEXT: context = (unsigned char *)opt_arg(); @@ -1196,10 +1167,10 @@ int s_server_main(int argc, char *argv[]) goto end; break; case OPT_VERIFY_RET_ERROR: - verify_return_error = 1; + verify_args.return_error = 1; break; case OPT_VERIFY_QUIET: - verify_quiet = 1; + verify_args.quiet = 1; break; case OPT_BUILD_CHAIN: build_chain = 1; @@ -1283,7 +1254,7 @@ int s_server_main(int argc, char *argv[]) s_quiet = 1; break; case OPT_BRIEF: - s_quiet = s_brief = verify_quiet = 1; + s_quiet = s_brief = verify_args.quiet = 1; break; case OPT_NO_DHE: #ifndef OPENSSL_NO_DH @@ -1383,11 +1354,6 @@ int s_server_main(int argc, char *argv[]) case OPT_MTU: #ifndef OPENSSL_NO_DTLS socket_mtu = atol(opt_arg()); -#endif - break; - case OPT_CHAIN: -#ifndef OPENSSL_NO_DTLS - cert_chain = 1; #endif break; case OPT_LISTEN: @@ -1648,8 +1614,8 @@ int s_server_main(int argc, char *argv[]) if (SSL_CTX_config(ctx, ssl_config) == 0) { BIO_printf(bio_err, "Error using configuration \"%s\"\n", ssl_config); - ERR_print_errors(bio_err); - goto end; + ERR_print_errors(bio_err); + goto end; } } if (SSL_CTX_set_min_proto_version(ctx, min_version) == 0) @@ -1694,7 +1660,6 @@ int s_server_main(int argc, char *argv[]) if (read_buf_len > 0) { SSL_CTX_set_default_read_buffer_len(ctx, read_buf_len); } - #ifndef OPENSSL_NO_SRTP if (srtp_profiles != NULL) { /* Returns 0 on success! */ @@ -1869,8 +1834,7 @@ int s_server_main(int argc, char *argv[]) #ifndef OPENSSL_NO_PSK if (psk_key != NULL) { if (s_debug) - BIO_printf(bio_s_out, - "PSK key given, setting server callback\n"); + BIO_printf(bio_s_out, "PSK key given, setting server callback\n"); SSL_CTX_set_psk_server_callback(ctx, psk_server_cb); } @@ -1883,8 +1847,8 @@ int s_server_main(int argc, char *argv[]) SSL_CTX_set_verify(ctx, s_server_verify, verify_callback); if (!SSL_CTX_set_session_id_context(ctx, - (void *)&s_server_session_id_context, - sizeof s_server_session_id_context)) { + (void *)&s_server_session_id_context, + sizeof s_server_session_id_context)) { BIO_printf(bio_err, "error setting session id context\n"); ERR_print_errors(bio_err); goto end; @@ -1983,7 +1947,6 @@ int s_server_main(int argc, char *argv[]) SSL_CTX_free(ctx2); X509_free(s_cert2); EVP_PKEY_free(s_key2); - BIO_free(serverinfo_in); #ifndef OPENSSL_NO_NEXTPROTONEG OPENSSL_free(next_proto.data); #endif @@ -2062,8 +2025,8 @@ static int sv_body(int s, int stype, unsigned char *context) } if (context - && !SSL_set_session_id_context(con, - context, strlen((char *)context))) { + && !SSL_set_session_id_context(con, + context, strlen((char *)context))) { BIO_printf(bio_err, "Error setting session id context\n"); ret = -1; goto err; @@ -2144,7 +2107,10 @@ static int sv_body(int s, int stype, unsigned char *context) SSL_set_tlsext_debug_arg(con, bio_s_out); } - width = s + 1; + if (fileno_stdin() > s) + width = fileno_stdin() + 1; + else + width = s + 1; for (;;) { int read_from_terminal; int read_from_sslcon; @@ -2156,7 +2122,7 @@ static int sv_body(int s, int stype, unsigned char *context) if (!read_from_sslcon) { FD_ZERO(&readfds); #if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_MSDOS) - openssl_fdset(fileno(stdin), &readfds); + openssl_fdset(fileno_stdin(), &readfds); #endif openssl_fdset(s, &readfds); /* @@ -2196,7 +2162,7 @@ static int sv_body(int s, int stype, unsigned char *context) if (i <= 0) continue; - if (FD_ISSET(fileno(stdin), &readfds)) + if (FD_ISSET(fileno_stdin(), &readfds)) read_from_terminal = 1; #endif if (FD_ISSET(s, &readfds)) @@ -2223,6 +2189,7 @@ static int sv_body(int s, int stype, unsigned char *context) assert(lf_num == 0); } else i = raw_read_stdin(buf, bufsize); + if (!s_quiet && !s_brief) { if ((i <= 0) || (buf[0] == 'Q')) { BIO_printf(bio_s_out, "DONE\n"); @@ -2289,12 +2256,10 @@ static int sv_body(int s, int stype, unsigned char *context) for (;;) { /* should do a select for the write */ #ifdef RENEG - { - static count = 0; - if (++count == 100) { - count = 0; - SSL_renegotiate(con); - } + static count = 0; + if (++count == 100) { + count = 0; + SSL_renegotiate(con); } #endif k = SSL_write(con, &(buf[l]), (unsigned int)i); @@ -2465,7 +2430,7 @@ static int init_ssl_connection(SSL *con) int retry = 0; #ifndef OPENSSL_NO_DTLS - if(dtlslisten) { + if (dtlslisten) { BIO_ADDR *client = NULL; if ((client = BIO_ADDR_new()) == NULL) { @@ -2478,11 +2443,11 @@ static int init_ssl_connection(SSL *con) int fd = -1; wbio = SSL_get_wbio(con); - if(wbio) { + if (wbio) { BIO_get_fd(wbio, &fd); } - if(!wbio || BIO_connect(fd, client, 0) == 0) { + if (!wbio || BIO_connect(fd, client, 0) == 0) { BIO_printf(bio_err, "ERROR - unable to connect\n"); BIO_ADDR_free(client); return 0; @@ -2503,10 +2468,11 @@ static int init_ssl_connection(SSL *con) retry = BIO_sock_should_retry(i); #ifdef CERT_CB_TEST_RETRY { - while (i <= 0 && SSL_get_error(con, i) == SSL_ERROR_WANT_X509_LOOKUP + while (i <= 0 + && SSL_get_error(con, i) == SSL_ERROR_WANT_X509_LOOKUP && SSL_get_state(con) == TLS_ST_SR_CLNT_HELLO) { BIO_printf(bio_err, - "LOOKUP from certificate callback during accept\n"); + "LOOKUP from certificate callback during accept\n"); i = SSL_accept(con); if (i <= 0) retry = BIO_sock_should_retry(i); @@ -2515,7 +2481,8 @@ static int init_ssl_connection(SSL *con) #endif #ifndef OPENSSL_NO_SRP - while (i <= 0 && SSL_get_error(con, i) == SSL_ERROR_WANT_X509_LOOKUP) { + while (i <= 0 + && SSL_get_error(con, i) == SSL_ERROR_WANT_X509_LOOKUP) { BIO_printf(bio_s_out, "LOOKUP during accept %s\n", srp_callback_parm.login); SRP_user_pwd_free(srp_callback_parm.user); @@ -2622,7 +2589,7 @@ static int init_ssl_connection(SSL *con) OPENSSL_free(exportedkeymat); } - (void)BIO_flush(bio_s_out); + (void)BIO_flush(bio_s_out); return (1); } @@ -2683,8 +2650,9 @@ static int www_body(int s, int stype, unsigned char *context) SSL_set_tlsext_debug_arg(con, bio_s_out); } - if (context && !SSL_set_session_id_context(con, context, - strlen((char *)context))) + if (context + && !SSL_set_session_id_context(con, context, + strlen((char *)context))) goto err; sbio = BIO_new_socket(s, BIO_NOCLOSE); @@ -2781,7 +2749,8 @@ static int www_body(int s, int stype, unsigned char *context) openssl_fdset(s, &readfds); i = select(width, (void *)&readfds, NULL, NULL, NULL); if (i <= 0 || !FD_ISSET(s, &readfds)) { - BIO_printf(bio_s_out, "Error waiting for client response\n"); + BIO_printf(bio_s_out, + "Error waiting for client response\n"); ERR_print_errors(bio_err); goto err; } @@ -2980,16 +2949,15 @@ static int www_body(int s, int stype, unsigned char *context) for (j = 0; j < i;) { #ifdef RENEG - { - static count = 0; - if (++count == 13) { - SSL_renegotiate(con); - } + static count = 0; + if (++count == 13) { + SSL_renegotiate(con); } #endif k = BIO_write(io, &(buf[j]), i - j); if (k <= 0) { - if (!BIO_should_retry(io) && !SSL_waiting_for_async(con)) + if (!BIO_should_retry(io) + && !SSL_waiting_for_async(con)) goto write_error; else { BIO_printf(bio_s_out, "rwrite W BLOCK\n"); @@ -3050,8 +3018,9 @@ static int rev_body(int s, int stype, unsigned char *context) SSL_set_tlsext_debug_callback(con, tlsext_cb); SSL_set_tlsext_debug_arg(con, bio_s_out); } - if (context && !SSL_set_session_id_context(con, context, - strlen((char *)context))) { + if (context + && !SSL_set_session_id_context(con, context, + strlen((char *)context))) { ERR_print_errors(bio_err); goto err; } @@ -3319,4 +3288,4 @@ static void free_sessions(void) first = NULL; } -#endif /* OPENSSL_NO_SOCK */ +#endif /* OPENSSL_NO_SOCK */