Add the ability to configure recv_max_early_data via s_server

[openssl.git] / apps / s_server.c

diff --git a/apps/s_server.c b/apps/s_server.c
index b0d38e4849ff9149594b7b48316b254f660b1ca3..4e8a9e27bcc74c2fd6185546853679b278aedb5b 100644 (file)
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -212,6 +212,7 @@ static int psk_find_session_cb(SSL *ssl, const unsigned char *identity,
     cipher = SSL_CIPHER_find(ssl, tls13_aes128gcmsha256_id);
     if (cipher == NULL) {
         BIO_printf(bio_err, "Error finding suitable ciphersuite\n");
     cipher = SSL_CIPHER_find(ssl, tls13_aes128gcmsha256_id);
     if (cipher == NULL) {
         BIO_printf(bio_err, "Error finding suitable ciphersuite\n");

+        OPENSSL_free(key);

         return 0;
     }
 
         return 0;
     }
 


@@ -747,7 +748,8 @@ typedef enum OPTION_choice {
     OPT_ID_PREFIX, OPT_SERVERNAME, OPT_SERVERNAME_FATAL,
     OPT_CERT2, OPT_KEY2, OPT_NEXTPROTONEG, OPT_ALPN,
     OPT_SRTP_PROFILES, OPT_KEYMATEXPORT, OPT_KEYMATEXPORTLEN,
     OPT_ID_PREFIX, OPT_SERVERNAME, OPT_SERVERNAME_FATAL,
     OPT_CERT2, OPT_KEY2, OPT_NEXTPROTONEG, OPT_ALPN,
     OPT_SRTP_PROFILES, OPT_KEYMATEXPORT, OPT_KEYMATEXPORTLEN,

-    OPT_KEYLOG_FILE, OPT_MAX_EARLY, OPT_EARLY_DATA, OPT_S_NUM_TICKETS,
+    OPT_KEYLOG_FILE, OPT_MAX_EARLY, OPT_RECV_MAX_EARLY, OPT_EARLY_DATA,
+    OPT_S_NUM_TICKETS, OPT_ANTI_REPLAY, OPT_NO_ANTI_REPLAY,

     OPT_R_ENUM,
     OPT_S_ENUM,
     OPT_V_ENUM,
     OPT_R_ENUM,
     OPT_S_ENUM,
     OPT_V_ENUM,


@@ -953,10 +955,14 @@ const OPTIONS s_server_options[] = {
 #endif
     {"keylogfile", OPT_KEYLOG_FILE, '>', "Write TLS secrets to file"},
     {"max_early_data", OPT_MAX_EARLY, 'n',
 #endif
     {"keylogfile", OPT_KEYLOG_FILE, '>', "Write TLS secrets to file"},
     {"max_early_data", OPT_MAX_EARLY, 'n',

-     "The maximum number of bytes of early data"},
+     "The maximum number of bytes of early data as advertised in tickets"},
+    {"recv_max_early_data", OPT_RECV_MAX_EARLY, 'n',
+     "The maximum number of bytes of early data (hard limit)"},

     {"early_data", OPT_EARLY_DATA, '-', "Attempt to read early data"},
     {"num_tickets", OPT_S_NUM_TICKETS, 'n',
      "The number of TLSv1.3 session tickets that a server will automatically  issue" },
     {"early_data", OPT_EARLY_DATA, '-', "Attempt to read early data"},
     {"num_tickets", OPT_S_NUM_TICKETS, 'n',
      "The number of TLSv1.3 session tickets that a server will automatically  issue" },

+    {"anti_replay", OPT_ANTI_REPLAY, '-', "Switch on anti-replay protection (default)"},
+    {"no_anti_replay", OPT_NO_ANTI_REPLAY, '-', "Switch off anti-replay protection"},

     {NULL, OPT_EOF, 0, NULL}
 };
 
     {NULL, OPT_EOF, 0, NULL}
 };
 


@@ -1037,7 +1043,7 @@ int s_server_main(int argc, char *argv[])
     unsigned int split_send_fragment = 0, max_pipelines = 0;
     const char *s_serverinfo_file = NULL;
     const char *keylog_file = NULL;
     unsigned int split_send_fragment = 0, max_pipelines = 0;
     const char *s_serverinfo_file = NULL;
     const char *keylog_file = NULL;

-    int max_early_data = -1;
+    int max_early_data = -1, recv_max_early_data = -1;

     char *psksessf = NULL;
 
     /* Init of few remaining global variables */
     char *psksessf = NULL;
 
     /* Init of few remaining global variables */


@@ -1257,6 +1263,8 @@ int s_server_main(int argc, char *argv[])
             break;
         case OPT_S_CASES:
         case OPT_S_NUM_TICKETS:
             break;
         case OPT_S_CASES:
         case OPT_S_NUM_TICKETS:

+        case OPT_ANTI_REPLAY:
+        case OPT_NO_ANTI_REPLAY:

             if (ssl_args == NULL)
                 ssl_args = sk_OPENSSL_STRING_new_null();
             if (ssl_args == NULL
             if (ssl_args == NULL)
                 ssl_args = sk_OPENSSL_STRING_new_null();
             if (ssl_args == NULL


@@ -1564,6 +1572,13 @@ int s_server_main(int argc, char *argv[])
                 goto end;
             }
             break;
                 goto end;
             }
             break;

+        case OPT_RECV_MAX_EARLY:
+            recv_max_early_data = atoi(opt_arg());
+            if (recv_max_early_data < 0) {
+                BIO_printf(bio_err, "Invalid value for recv_max_early_data\n");
+                goto end;
+            }
+            break;

         case OPT_EARLY_DATA:
             early_data = 1;
             if (max_early_data == -1)
         case OPT_EARLY_DATA:
             early_data = 1;
             if (max_early_data == -1)


@@ -2104,6 +2119,8 @@ int s_server_main(int argc, char *argv[])
 
     if (max_early_data >= 0)
         SSL_CTX_set_max_early_data(ctx, max_early_data);
 
     if (max_early_data >= 0)
         SSL_CTX_set_max_early_data(ctx, max_early_data);

+    if (recv_max_early_data >= 0)
+        SSL_CTX_set_recv_max_early_data(ctx, recv_max_early_data);

 
     if (rev)
         server_cb = rev_body;
 
     if (rev)
         server_cb = rev_body;