static const char *s_cert_file=TEST_CERT,*s_key_file=NULL, *s_chain_file=NULL;
#ifndef OPENSSL_NO_TLSEXT
static const char *s_cert_file2=TEST_CERT2,*s_key_file2=NULL;
-static char *curves=NULL;
#endif
static char *s_dcert_file=NULL,*s_dkey_file=NULL, *s_dchain_file=NULL;
#ifdef FIONBIO
static int www=0;
static BIO *bio_s_out=NULL;
+static BIO *bio_s_msg = NULL;
static int s_debug=0;
#ifndef OPENSSL_NO_TLSEXT
static int s_tlsextdebug=0;
s_key_file=NULL;
s_chain_file=NULL;
#ifndef OPENSSL_NO_TLSEXT
- curves=NULL;
s_cert_file2=TEST_CERT2;
s_key_file2=NULL;
ctx2=NULL;
#ifndef OPENSSL_NO_JPAKE
static char *jpake_secret = NULL;
+#define no_jpake !jpake_secret
+#else
+#define no_jpake 1
#endif
#ifndef OPENSSL_NO_SRP
static srpsrvparm srp_callback_parm;
int badarg = 0;
short port=PORT;
char *CApath=NULL,*CAfile=NULL;
+ char *chCApath=NULL,*chCAfile=NULL;
+ char *vfyCApath=NULL,*vfyCAfile=NULL;
unsigned char *context = NULL;
char *dhfile = NULL;
#ifndef OPENSSL_NO_ECDH
char *named_curve = NULL;
#endif
- int badop=0,bugs=0;
+ int badop=0;
int ret=1;
- int off=0;
+ int build_chain = 0;
int no_tmp_rsa=0,no_dhe=0,no_ecdhe=0,nocert=0;
int state=0;
const SSL_METHOD *meth=NULL;
char *srpuserseed = NULL;
char *srp_verifier_file = NULL;
#endif
+ SSL_EXCERT *exc = NULL;
+ SSL_CONF_CTX *cctx = NULL;
+ STACK_OF(OPENSSL_STRING) *ssl_args = NULL;
meth=SSLv23_server_method();
local_argc=argc;
if (!load_config(bio_err, NULL))
goto end;
+ cctx = SSL_CONF_CTX_new();
+ if (!cctx)
+ goto end;
+ SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_SERVER);
+ SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_CMDLINE);
+
verify_depth=0;
#ifdef FIONBIO
s_nbio=0;
if (--argc < 1) goto bad;
CApath= *(++argv);
}
+ else if (strcmp(*argv,"-chainCApath") == 0)
+ {
+ if (--argc < 1) goto bad;
+ chCApath= *(++argv);
+ }
+ else if (strcmp(*argv,"-verifyCApath") == 0)
+ {
+ if (--argc < 1) goto bad;
+ vfyCApath= *(++argv);
+ }
else if (strcmp(*argv,"-no_cache") == 0)
no_cache = 1;
else if (args_verify(&argv, &argc, &badarg, bio_err, &vpm))
goto bad;
continue;
}
+ else if (args_excert(&argv, &argc, &badarg, bio_err, &exc))
+ {
+ if (badarg)
+ goto bad;
+ continue;
+ }
+ else if (args_ssl(&argv, &argc, cctx, &badarg, bio_err, &ssl_args))
+ {
+ if (badarg)
+ goto bad;
+ continue;
+ }
else if (strcmp(*argv,"-verify_return_error") == 0)
verify_return_error = 1;
- else if (strcmp(*argv,"-serverpref") == 0)
- { off|=SSL_OP_CIPHER_SERVER_PREFERENCE; }
- else if (strcmp(*argv,"-legacy_renegotiation") == 0)
- off|=SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;
- else if (strcmp(*argv,"-cipher") == 0)
+ else if (strcmp(*argv,"-build_chain") == 0)
+ build_chain = 1;
+ else if (strcmp(*argv,"-CAfile") == 0)
{
if (--argc < 1) goto bad;
- cipher= *(++argv);
+ CAfile= *(++argv);
}
- else if (strcmp(*argv,"-CAfile") == 0)
+ else if (strcmp(*argv,"-chainCAfile") == 0)
{
if (--argc < 1) goto bad;
- CAfile= *(++argv);
+ chCAfile= *(++argv);
+ }
+ else if (strcmp(*argv,"-verifyCAfile") == 0)
+ {
+ if (--argc < 1) goto bad;
+ vfyCAfile= *(++argv);
}
#ifdef FIONBIO
else if (strcmp(*argv,"-nbio") == 0)
goto bad;
}
}
- else if (strcmp(*argv,"-curves") == 0)
+#endif
+ else if (strcmp(*argv,"-msg") == 0)
+ { s_msg=1; }
+ else if (strcmp(*argv,"-msgfile") == 0)
{
if (--argc < 1) goto bad;
- curves= *(++argv);
+ bio_s_msg = BIO_new_file(*(++argv), "w");
}
+#ifndef OPENSSL_NO_SSL_TRACE
+ else if (strcmp(*argv,"-trace") == 0)
+ { s_msg=2; }
#endif
- else if (strcmp(*argv,"-msg") == 0)
- { s_msg=1; }
else if (strcmp(*argv,"-hack") == 0)
{ hack=1; }
else if (strcmp(*argv,"-state") == 0)
{ s_crlf=1; }
else if (strcmp(*argv,"-quiet") == 0)
{ s_quiet=1; }
- else if (strcmp(*argv,"-bugs") == 0)
- { bugs=1; }
else if (strcmp(*argv,"-no_tmp_rsa") == 0)
{ no_tmp_rsa=1; }
else if (strcmp(*argv,"-no_dhe") == 0)
{ www=2; }
else if (strcmp(*argv,"-HTTP") == 0)
{ www=3; }
- else if (strcmp(*argv,"-no_ssl2") == 0)
- { off|=SSL_OP_NO_SSLv2; }
- else if (strcmp(*argv,"-no_ssl3") == 0)
- { off|=SSL_OP_NO_SSLv3; }
- else if (strcmp(*argv,"-no_tls1") == 0)
- { off|=SSL_OP_NO_TLSv1; }
- else if (strcmp(*argv,"-no_tls1_1") == 0)
- { off|=SSL_OP_NO_TLSv1_1; }
- else if (strcmp(*argv,"-no_tls1_2") == 0)
- { off|=SSL_OP_NO_TLSv1_2; }
- else if (strcmp(*argv,"-no_comp") == 0)
- { off|=SSL_OP_NO_COMPRESSION; }
-#ifndef OPENSSL_NO_TLSEXT
- else if (strcmp(*argv,"-no_ticket") == 0)
- { off|=SSL_OP_NO_TICKET; }
-#endif
#ifndef OPENSSL_NO_SSL2
else if (strcmp(*argv,"-ssl2") == 0)
{ meth=SSLv2_server_method(); }
goto end;
}
psk_identity = "JPAKE";
- if (cipher)
- {
- BIO_printf(bio_err, "JPAKE sets cipher to PSK\n");
- goto end;
- }
- cipher = "PSK";
}
-
#endif
SSL_load_error_strings();
s_key_file2 = s_cert_file2;
#endif
+ if (!load_excert(&exc, bio_err))
+ goto end;
+
if (nocert == 0)
{
s_key = load_key(bio_err, s_key_file, s_key_format, 0, pass, e,
if (s_quiet && !s_debug && !s_msg)
{
bio_s_out=BIO_new(BIO_s_null());
+ if (s_msg && !bio_s_msg)
+ bio_s_msg=BIO_new_fp(stdout,BIO_NOCLOSE);
}
else
{
BIO_printf(bio_err,"id_prefix '%s' set.\n", session_id_prefix);
}
SSL_CTX_set_quiet_shutdown(ctx,1);
- if (bugs) SSL_CTX_set_options(ctx,SSL_OP_ALL);
if (hack) SSL_CTX_set_options(ctx,SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG);
- SSL_CTX_set_options(ctx,off);
+ if (exc) ssl_ctx_set_excert(ctx, exc);
/* DTLS: partial reads end up discarding unread UDP bytes :-(
* Setting read ahead solves this problem.
*/
if (vpm)
SSL_CTX_set1_param(ctx, vpm);
+ if (!args_ssl_call(ctx, bio_err, cctx, ssl_args, no_ecdhe, no_jpake))
+ goto end;
+
+ if (!ssl_load_stores(ctx, vfyCApath, vfyCAfile, chCApath, chCAfile))
+ {
+ BIO_printf(bio_err, "Error loading store locations\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+
#ifndef OPENSSL_NO_TLSEXT
if (s_cert2)
{
BIO_printf(bio_err,"id_prefix '%s' set.\n", session_id_prefix);
}
SSL_CTX_set_quiet_shutdown(ctx2,1);
- if (bugs) SSL_CTX_set_options(ctx2,SSL_OP_ALL);
if (hack) SSL_CTX_set_options(ctx2,SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG);
- SSL_CTX_set_options(ctx2,off);
+ if (exc) ssl_ctx_set_excert(ctx2, exc);
/* DTLS: partial reads end up discarding unread UDP bytes :-(
* Setting read ahead solves this problem.
*/
}
if (vpm)
SSL_CTX_set1_param(ctx2, vpm);
+
+ if (!args_ssl_call(ctx2, bio_err, cctx, ssl_args, no_ecdhe, no_jpake))
+ goto end;
}
# ifndef OPENSSL_NO_NEXTPROTONEG
}
#endif
- if (!set_cert_key_stuff(ctx, s_cert, s_key, s_chain))
+ if (!set_cert_key_stuff(ctx, s_cert, s_key, s_chain, build_chain))
goto end;
#ifndef OPENSSL_NO_TLSEXT
if (s_authz_file != NULL && !SSL_CTX_use_authz_file(ctx, s_authz_file))
goto end;
#endif
#ifndef OPENSSL_NO_TLSEXT
- if (ctx2 && !set_cert_key_stuff(ctx2,s_cert2,s_key2, NULL))
+ if (ctx2 && !set_cert_key_stuff(ctx2,s_cert2,s_key2, NULL, build_chain))
goto end;
#endif
if (s_dcert != NULL)
{
- if (!set_cert_key_stuff(ctx, s_dcert, s_dkey, s_dchain))
+ if (!set_cert_key_stuff(ctx, s_dcert, s_dkey, s_dchain, build_chain))
goto end;
}
}
#endif
}
-#ifndef OPENSSL_NO_TLSEXT
- if (curves)
- {
- if(!SSL_CTX_set1_curves_list(ctx,curves))
- {
- BIO_printf(bio_err,"error setting curves list\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- if(ctx2 && !SSL_CTX_set1_curves_list(ctx2,curves))
- {
- BIO_printf(bio_err,"error setting curves list\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- }
-#endif
SSL_CTX_set_verify(ctx,s_server_verify,verify_callback);
SSL_CTX_set_session_id_context(ctx,(void*)&s_server_session_id_context,
sizeof s_server_session_id_context);
OPENSSL_free(pass);
if (dpass)
OPENSSL_free(dpass);
+ if (vpm)
+ X509_VERIFY_PARAM_free(vpm);
#ifndef OPENSSL_NO_TLSEXT
if (tlscstatp.host)
OPENSSL_free(tlscstatp.host);
EVP_PKEY_free(s_key2);
if (authz_in != NULL)
BIO_free(authz_in);
+#endif
+ ssl_excert_free(exc);
+ if (ssl_args)
+ sk_OPENSSL_STRING_free(ssl_args);
+ if (cctx)
+ SSL_CONF_CTX_free(cctx);
+#ifndef OPENSSL_NO_JPAKE
+ if (jpake_secret && psk_key)
+ OPENSSL_free(psk_key);
#endif
if (bio_s_out != NULL)
{
- BIO_free(bio_s_out);
+ BIO_free(bio_s_out);
bio_s_out=NULL;
}
+ if (bio_s_msg != NULL)
+ {
+ BIO_free(bio_s_msg);
+ bio_s_msg = NULL;
+ }
apps_shutdown();
OPENSSL_EXIT(ret);
}
}
if (s_msg)
{
- SSL_set_msg_callback(con, msg_cb);
- SSL_set_msg_callback_arg(con, bio_s_out);
+#ifndef OPENSSL_NO_SSL_TRACE
+ if (s_msg == 2)
+ SSL_set_msg_callback(con, SSL_trace);
+ else
+#endif
+ SSL_set_msg_callback(con, msg_cb);
+ SSL_set_msg_callback_arg(con, bio_s_msg ? bio_s_msg : bio_s_out);
}
#ifndef OPENSSL_NO_TLSEXT
if (s_tlsextdebug)
BIO_printf(bio_err,"verify error:%s\n",
X509_verify_cert_error_string(verify_error));
}
- else
- ERR_print_errors(bio_err);
+ /* Always print any error messages */
+ ERR_print_errors(bio_err);
return(0);
}
}
if (s_msg)
{
- SSL_set_msg_callback(con, msg_cb);
- SSL_set_msg_callback_arg(con, bio_s_out);
+#ifndef OPENSSL_NO_SSL_TRACE
+ if (s_msg == 2)
+ SSL_set_msg_callback(con, SSL_trace);
+ else
+#endif
+ SSL_set_msg_callback(con, msg_cb);
+ SSL_set_msg_callback_arg(con, bio_s_msg ? bio_s_msg : bio_s_out);
}
for (;;)
projects / openssl.git / blobdiff