Fix protocol downgrade bug in case of fragmented packets

[openssl.git] / apps / openssl.c

diff --git a/apps/openssl.c b/apps/openssl.c
index dcfb796176c57c82ca4618d8add12735323ab7b6..71e1e48ece40579234bf4578c2d2b02b6fc40b3c 100644 (file)
--- a/apps/openssl.c
+++ b/apps/openssl.c
@@ -117,6 +117,7 @@
 #include "apps.h"
 #include <openssl/bio.h>
 #include <openssl/crypto.h>
+#include <openssl/rand.h>
 #include <openssl/lhash.h>
 #include <openssl/conf.h>
 #include <openssl/x509.h>
@@ -129,6 +130,9 @@
 #include "progs.h"
 #include "s_apps.h"
 #include <openssl/err.h>
+#ifdef OPENSSL_FIPS
+#include <openssl/fips.h>
+#endif
 
 /* The LHASH callbacks ("hash" & "cmp") have been replaced by functions with the
  * base prototypes (we cast each variable inside the function to the required
@@ -212,8 +216,13 @@ static void lock_dbg_cb(int mode, int type, const char *file, int line)
                }
        }
 
+#if defined( OPENSSL_SYS_VMS) && (__INITIAL_POINTER_SIZE == 64)
+# define ARGV _Argv
+#else
+# define ARGV Argv
+#endif
 
-int main(int Argc, char *Argv[])
+int main(int Argc, char *ARGV[])
        {
        ARGS arg;
 #define PROG_NAME_SIZE 39
@@ -227,7 +236,55 @@ int main(int Argc, char *Argv[])
        char **argv,*p;
        LHASH_OF(FUNCTION) *prog=NULL;
        long errline;
- 
+
+#if defined( OPENSSL_SYS_VMS) && (__INITIAL_POINTER_SIZE == 64)
+       /* 2011-03-22 SMS.
+        * If we have 32-bit pointers everywhere, then we're safe, and
+        * we bypass this mess, as on non-VMS systems.  (See ARGV,
+        * above.)
+        * Problem 1: Compaq/HP C before V7.3 always used 32-bit
+        * pointers for argv[].
+        * Fix 1: For a 32-bit argv[], when we're using 64-bit pointers
+        * everywhere else, we always allocate and use a 64-bit
+        * duplicate of argv[].
+        * Problem 2: Compaq/HP C V7.3 (Alpha, IA64) before ECO1 failed
+        * to NULL-terminate a 64-bit argv[].  (As this was written, the
+        * compiler ECO was available only on IA64.)
+        * Fix 2: Unless advised not to (VMS_TRUST_ARGV), we test a
+        * 64-bit argv[argc] for NULL, and, if necessary, use a
+        * (properly) NULL-terminated (64-bit) duplicate of argv[].
+        * The same code is used in either case to duplicate argv[].
+        * Some of these decisions could be handled in preprocessing,
+        * but the code tends to get even uglier, and the penalty for
+        * deciding at compile- or run-time is tiny.
+        */
+       char **Argv = NULL;
+       int free_Argv = 0;
+
+       if ((sizeof( _Argv) < 8)        /* 32-bit argv[]. */
+# if !defined( VMS_TRUST_ARGV)
+        || (_Argv[ Argc] != NULL)      /* Untrusted argv[argc] not NULL. */
+# endif
+               )
+               {
+               int i;
+               Argv = OPENSSL_malloc( (Argc+ 1)* sizeof( char *));
+               if (Argv == NULL)
+                       { ret = -1; goto end; }
+               for(i = 0; i < Argc; i++)
+                       Argv[i] = _Argv[i];
+               Argv[ Argc] = NULL;     /* Certain NULL termination. */
+               free_Argv = 1;
+               }
+       else
+               {
+               /* Use the known-good 32-bit argv[] (which needs the
+                * type cast to satisfy the compiler), or the trusted or
+                * tested-good 64-bit argv[] as-is. */
+               Argv = (char **)_Argv;
+               }
+#endif /* defined( OPENSSL_SYS_VMS) && (__INITIAL_POINTER_SIZE == 64) */
+
        arg.data=NULL;
        arg.count=0;
 
@@ -257,6 +314,19 @@ int main(int Argc, char *Argv[])
                CRYPTO_set_locking_callback(lock_dbg_cb);
                }
 
+       if(getenv("OPENSSL_FIPS")) {
+#ifdef OPENSSL_FIPS
+               if (!FIPS_mode_set(1)) {
+                       ERR_load_crypto_strings();
+                       ERR_print_errors(BIO_new_fp(stderr,BIO_NOCLOSE));
+                       EXIT(1);
+               }
+#else
+               fprintf(stderr, "FIPS mode not supported.\n");
+               EXIT(1);
+#endif
+               }
+
        apps_startup();
 
        /* Lets load up our environment a little */
@@ -272,9 +342,21 @@ int main(int Argc, char *Argv[])
        i=NCONF_load(config,p,&errline);
        if (i == 0)
                {
-               NCONF_free(config);
-               config = NULL;
-               ERR_clear_error();
+               if (ERR_GET_REASON(ERR_peek_last_error())
+                   == CONF_R_NO_SUCH_FILE)
+                       {
+                       BIO_printf(bio_err,
+                                  "WARNING: can't open config file: %s\n",p);
+                       ERR_clear_error();
+                       NCONF_free(config);
+                       config = NULL;
+                       }
+               else
+                       {
+                       ERR_print_errors(bio_err);
+                       NCONF_free(config);
+                       exit(1);
+                       }
                }
 
        prog=prog_init();
@@ -318,7 +400,8 @@ int main(int Argc, char *Argv[])
                        else    prompt="OpenSSL> ";
                        fputs(prompt,stdout);
                        fflush(stdout);
-                       fgets(p,n,stdin);
+                       if (!fgets(p,n,stdin))
+                               goto end;
                        if (p[0] == '\0') goto end;
                        i=strlen(p);
                        if (i <= 1) break;
@@ -360,6 +443,13 @@ end:
                BIO_free(bio_err);
                bio_err=NULL;
                }
+#if defined( OPENSSL_SYS_VMS) && (__INITIAL_POINTER_SIZE == 64)
+       /* Free any duplicate Argv[] storage. */
+       if (free_Argv)
+               {
+               OPENSSL_free(Argv);
+               }
+#endif
        OPENSSL_EXIT(ret);
        }
 
@@ -380,6 +470,21 @@ static int do_cmd(LHASH_OF(FUNCTION) *prog, int argc, char *argv[])
                { ret=0; goto end; }
        f.name=argv[0];
        fp=lh_FUNCTION_retrieve(prog,&f);
+       if (fp == NULL)
+               {
+               if (EVP_get_digestbyname(argv[0]))
+                       {
+                       f.type = FUNC_TYPE_MD;
+                       f.func = dgst_main;
+                       fp = &f;
+                       }
+               else if (EVP_get_cipherbyname(argv[0]))
+                       {
+                       f.type = FUNC_TYPE_CIPHER;
+                       f.func = enc_main;
+                       fp = &f;
+                       }
+               }
        if (fp != NULL)
                {
                ret=fp->func(argc,argv);
@@ -618,7 +723,7 @@ static LHASH_OF(FUNCTION) *prog_init(void)
                return(NULL);
 
        for (f=functions; f->name != NULL; f++)
-               lh_FUNCTION_insert(ret,f);
+               (void)lh_FUNCTION_insert(ret,f);
        return(ret);
        }