Provisional DTLS 1.2 support.

[openssl.git] / apps / s_server.c

diff --git a/apps/s_server.c b/apps/s_server.c
index dc0cc36fb0d04a959127e8ffe06ade33e5f6c164..3eaee82c787ea711826ef82a5a5016ef0627680f 100644 (file)
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -205,9 +205,9 @@ typedef unsigned int u_int;
 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength);
 #endif
 static int not_resumable_sess_cb(SSL *s, int is_forward_secure);
-static int sv_body(char *hostname, int s, unsigned char *context);
-static int www_body(char *hostname, int s, unsigned char *context);
-static int rev_body(char *hostname, int s, unsigned char *context);
+static int sv_body(char *hostname, int s, int stype, unsigned char *context);
+static int www_body(char *hostname, int s, int stype, unsigned char *context);
+static int rev_body(char *hostname, int s, int stype, unsigned char *context);
 static void close_accept_socket(void );
 static void sv_usage(void);
 static int init_ssl_connection(SSL *s);
@@ -533,6 +533,7 @@ static void sv_usage(void)
        BIO_printf(bio_err," -tls1_1       - Just talk TLSv1.1\n");
        BIO_printf(bio_err," -tls1         - Just talk TLSv1\n");
        BIO_printf(bio_err," -dtls1        - Just talk DTLSv1\n");
+       BIO_printf(bio_err," -dtls1_2      - Just talk DTLSv1.2\n");
        BIO_printf(bio_err," -timeout      - Enable timeouts\n");
        BIO_printf(bio_err," -mtu          - Set link layer MTU\n");
        BIO_printf(bio_err," -chain        - Read a certificate chain\n");
@@ -938,6 +939,9 @@ int MAIN(int, char **);
 
 #ifndef OPENSSL_NO_JPAKE
 static char *jpake_secret = NULL;
+#define no_jpake !jpake_secret
+#else
+#define no_jpake 1
 #endif
 #ifndef OPENSSL_NO_SRP
        static srpsrvparm srp_callback_parm;
@@ -995,6 +999,7 @@ int MAIN(int argc, char *argv[])
 
        char *crl_file = NULL;
        int crl_format = FORMAT_PEM;
+       int crl_download = 0;
        STACK_OF(X509_CRL) *crls = NULL;
 
        meth=SSLv23_server_method();
@@ -1080,6 +1085,8 @@ int MAIN(int argc, char *argv[])
                        if (--argc < 1) goto bad;
                        crl_file= *(++argv);
                        }
+               else if (strcmp(*argv,"-crl_download") == 0)
+                       crl_download = 1;
 #ifndef OPENSSL_NO_TLSEXT
                else if (strcmp(*argv,"-authz") == 0)
                        {
@@ -1360,6 +1367,11 @@ int MAIN(int argc, char *argv[])
                        meth=DTLSv1_server_method();
                        socket_type = SOCK_DGRAM;
                        }
+               else if (strcmp(*argv,"-dtls1_2") == 0)
+                       { 
+                       meth=DTLSv1_2_server_method();
+                       socket_type = SOCK_DGRAM;
+                       }
                else if (strcmp(*argv,"-timeout") == 0)
                        enable_timeouts = 1;
                else if (strcmp(*argv,"-mtu") == 0)
@@ -1462,14 +1474,7 @@ bad:
                        goto end;
                        }
                psk_identity = "JPAKE";
-               if (cipher)
-                       {
-                       BIO_printf(bio_err, "JPAKE sets cipher to PSK\n");
-                       goto end;
-                       }
-               cipher = "PSK";
                }
-
 #endif
 
        SSL_load_error_strings();
@@ -1716,11 +1721,11 @@ bad:
                SSL_CTX_set1_param(ctx, vpm);
 
        ssl_ctx_add_crls(ctx, crls, 0);
-
-       if (!args_ssl_call(ctx, bio_err, cctx, ssl_args, no_ecdhe))
+       if (!args_ssl_call(ctx, bio_err, cctx, ssl_args, no_ecdhe, no_jpake))
                goto end;
 
-       if (!ssl_load_stores(ctx, vfyCApath, vfyCAfile, chCApath, chCAfile, crls, 0))
+       if (!ssl_load_stores(ctx, vfyCApath, vfyCAfile, chCApath, chCAfile,
+                                               crls, crl_download))
                {
                BIO_printf(bio_err, "Error loading store locations\n");
                ERR_print_errors(bio_err);
@@ -1784,8 +1789,7 @@ bad:
                        SSL_CTX_set1_param(ctx2, vpm);
 
                ssl_ctx_add_crls(ctx2, crls, 0);
-
-               if (!args_ssl_call(ctx2, bio_err, cctx, ssl_args, no_ecdhe))
+               if (!args_ssl_call(ctx2, bio_err, cctx, ssl_args, no_ecdhe, no_jpake))
                        goto end;
                }
 
@@ -2029,9 +2033,13 @@ end:
                sk_OPENSSL_STRING_free(ssl_args);
        if (cctx)
                SSL_CONF_CTX_free(cctx);
+#ifndef OPENSSL_NO_JPAKE
+       if (jpake_secret && psk_key)
+               OPENSSL_free(psk_key);
+#endif
        if (bio_s_out != NULL)
                {
-        BIO_free(bio_s_out);
+               BIO_free(bio_s_out);
                bio_s_out=NULL;
                }
        if (bio_s_msg != NULL)
@@ -2068,7 +2076,7 @@ static void print_stats(BIO *bio, SSL_CTX *ssl_ctx)
                SSL_CTX_sess_get_cache_size(ssl_ctx));
        }
 
-static int sv_body(char *hostname, int s, unsigned char *context)
+static int sv_body(char *hostname, int s, int stype, unsigned char *context)
        {
        char *buf=NULL;
        fd_set readfds;
@@ -2138,7 +2146,7 @@ static int sv_body(char *hostname, int s, unsigned char *context)
 #endif
 #endif
 
-       if (SSL_version(con) == DTLS1_VERSION)
+       if (stype == SOCK_DGRAM)
                {
 
                sbio=BIO_new_dgram(s,BIO_NOCLOSE);
@@ -2679,7 +2687,7 @@ static int load_CA(SSL_CTX *ctx, char *file)
        }
 #endif
 
-static int www_body(char *hostname, int s, unsigned char *context)
+static int www_body(char *hostname, int s, int stype, unsigned char *context)
        {
        char *buf=NULL;
        int ret=1;
@@ -3113,7 +3121,7 @@ err:
        return(ret);
        }
 
-static int rev_body(char *hostname, int s, unsigned char *context)
+static int rev_body(char *hostname, int s, int stype, unsigned char *context)
        {
        char *buf=NULL;
        int i;