Add support for automatic ECDH temporary key parameter selection. When

[openssl.git] / apps / s_server.c

diff --git a/apps/s_server.c b/apps/s_server.c
index 4603cdafcd12a9c7dd9c59c6718713ed77ad279b..063a9f6c41026a573753a4b3a2beb9e73d7cf60a 100644 (file)
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -273,6 +273,7 @@ static int s_server_session_id_context = 1; /* anything will do */
 static const char *s_cert_file=TEST_CERT,*s_key_file=NULL;
 #ifndef OPENSSL_NO_TLSEXT
 static const char *s_cert_file2=TEST_CERT2,*s_key_file2=NULL;
+static char *curves=NULL;
 #endif
 static char *s_dcert_file=NULL,*s_dkey_file=NULL;
 #ifdef FIONBIO
@@ -437,6 +438,7 @@ static void s_server_init(void)
        s_cert_file=TEST_CERT;
        s_key_file=NULL;
 #ifndef OPENSSL_NO_TLSEXT
+       curves=NULL;
        s_cert_file2=TEST_CERT2;
        s_key_file2=NULL;
        ctx2=NULL;
@@ -980,17 +982,7 @@ int MAIN(int argc, char *argv[])
        char *srpuserseed = NULL;
        char *srp_verifier_file = NULL;
 #endif
-#if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
        meth=SSLv23_server_method();
-#elif !defined(OPENSSL_NO_SSL3)
-       meth=SSLv3_server_method();
-#elif !defined(OPENSSL_NO_SSL2)
-       meth=SSLv2_server_method();
-#elif !defined(OPENSSL_NO_TLS1)
-       meth=TLSv1_server_method();
-#else
-  /*  #error no SSL version enabled */
-#endif
 
        local_argc=argc;
        local_argv=argv;
@@ -1184,6 +1176,11 @@ int MAIN(int argc, char *argv[])
                                goto bad;
                                }
                        }
+               else if (strcmp(*argv,"-curves") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       curves= *(++argv);
+                       }
 #endif
                else if (strcmp(*argv,"-msg") == 0)
                        { s_msg=1; }
@@ -1716,10 +1713,11 @@ bad:
                {
                EC_KEY *ecdh=NULL;
 
-               if (named_curve)
+               if (named_curve && strcmp(named_curve, "auto"))
                        {
-                       int nid = OBJ_sn2nid(named_curve);
-
+                       int nid = EC_curve_nist2nid(named_curve);
+                       if (nid == NID_undef)
+                               nid = OBJ_sn2nid(named_curve);
                        if (nid == 0)
                                {
                                BIO_printf(bio_err, "unknown curve name (%s)\n", 
@@ -1739,6 +1737,8 @@ bad:
                        {
                        BIO_printf(bio_s_out,"Setting temp ECDH parameters\n");
                        }
+               else if (named_curve)
+                       SSL_CTX_set_ecdh_auto(ctx, 1);
                else
                        {
                        BIO_printf(bio_s_out,"Using default temp ECDH parameters\n");
@@ -1859,6 +1859,23 @@ bad:
                        }
 #endif
                }
+#ifndef OPENSSL_NO_TLSEXT
+       if (curves)
+               {
+               if(!SSL_CTX_set1_curves_list(ctx,curves))
+                       {
+                       BIO_printf(bio_err,"error setting curves list\n");
+                       ERR_print_errors(bio_err);
+                       goto end;
+                       }
+               if(ctx2 && !SSL_CTX_set1_curves_list(ctx2,curves))
+                       {
+                       BIO_printf(bio_err,"error setting curves list\n");
+                       ERR_print_errors(bio_err);
+                       goto end;
+                       }
+               }
+#endif
        SSL_CTX_set_verify(ctx,s_server_verify,verify_callback);
        SSL_CTX_set_session_id_context(ctx,(void*)&s_server_session_id_context,
                sizeof s_server_session_id_context);