static int not_resumable_sess_cb(SSL *s, int is_forward_secure);
static int sv_body(char *hostname, int s, unsigned char *context);
static int www_body(char *hostname, int s, unsigned char *context);
+static int rev_body(char *hostname, int s, unsigned char *context);
static void close_accept_socket(void );
static void sv_usage(void);
static int init_ssl_connection(SSL *s);
unsigned int *id_len);
static void init_session_cache_ctx(SSL_CTX *sctx);
static void free_sessions(void);
-static int ssl_load_stores(SSL_CTX *sctx,
- const char *vfyCApath, const char *vfyCAfile,
- const char *chCApath, const char *chCAfile);
#ifndef OPENSSL_NO_DH
static DH *load_dh_param(const char *dhfile);
static DH *get_dh512(void);
#undef PROG
#define PROG s_server_main
-extern int verify_depth, verify_return_error;
+extern int verify_depth, verify_return_error, verify_quiet;
-static char *cipher=NULL;
static int s_server_verify=SSL_VERIFY_NONE;
static int s_server_session_id_context = 1; /* anything will do */
static const char *s_cert_file=TEST_CERT,*s_key_file=NULL, *s_chain_file=NULL;
#ifndef OPENSSL_NO_TLSEXT
static const char *s_cert_file2=TEST_CERT2,*s_key_file2=NULL;
-static char *curves=NULL;
-static char *sigalgs=NULL;
-static char *client_sigalgs=NULL;
#endif
static char *s_dcert_file=NULL,*s_dkey_file=NULL, *s_dchain_file=NULL;
#ifdef FIONBIO
static int no_resume_ephemeral = 0;
static int s_msg=0;
static int s_quiet=0;
+static int s_ign_eof=0;
+static int s_brief=0;
static char *keymatexportlabel=NULL;
static int keymatexportlen=20;
static void s_server_init(void)
{
accept_socket=-1;
- cipher=NULL;
s_server_verify=SSL_VERIFY_NONE;
s_dcert_file=NULL;
s_dkey_file=NULL;
s_key_file=NULL;
s_chain_file=NULL;
#ifndef OPENSSL_NO_TLSEXT
- curves=NULL;
s_cert_file2=TEST_CERT2;
s_key_file2=NULL;
ctx2=NULL;
s_debug=0;
s_msg=0;
s_quiet=0;
+ s_brief=0;
hack=0;
#ifndef OPENSSL_NO_ENGINE
engine_id=NULL;
BIO_printf(bio_err,"usage: s_server [args ...]\n");
BIO_printf(bio_err,"\n");
BIO_printf(bio_err," -accept arg - port to accept on (default is %d)\n",PORT);
+ BIO_printf(bio_err," -checkhost host - check peer certificate matches \"host\"\n");
+ BIO_printf(bio_err," -checkemail email - check peer certificate matches \"email\"\n");
+ BIO_printf(bio_err," -checkip ipaddr - check peer certificate matches \"ipaddr\"\n");
BIO_printf(bio_err," -context arg - set session ID context\n");
BIO_printf(bio_err," -verify arg - turn on peer certificate verification\n");
BIO_printf(bio_err," -Verify arg - turn on peer certificate verification, must have a cert.\n");
static srpsrvparm srp_callback_parm;
#endif
static char *srtp_profiles = NULL;
+static unsigned char *checkhost = NULL, *checkemail = NULL;
+static char *checkip = NULL;
+
int MAIN(int argc, char *argv[])
{
char *vfyCApath=NULL,*vfyCAfile=NULL;
unsigned char *context = NULL;
char *dhfile = NULL;
-#ifndef OPENSSL_NO_ECDH
- char *named_curve = NULL;
-#endif
- int badop=0,bugs=0;
+ int badop=0;
int ret=1;
- int off=0;
- unsigned int cert_flags = 0;
int build_chain = 0;
int no_tmp_rsa=0,no_dhe=0,no_ecdhe=0,nocert=0;
int state=0;
STACK_OF(X509) *s_chain = NULL, *s_dchain = NULL;
EVP_PKEY *s_key = NULL, *s_dkey = NULL;
int no_cache = 0, ext_cache = 0;
+ int rev = 0, naccept = -1;
#ifndef OPENSSL_NO_TLSEXT
EVP_PKEY *s_key2 = NULL;
X509 *s_cert2 = NULL;
char *srp_verifier_file = NULL;
#endif
SSL_EXCERT *exc = NULL;
+ SSL_CONF_CTX *cctx = NULL;
+ STACK_OF(OPENSSL_STRING) *ssl_args = NULL;
+
meth=SSLv23_server_method();
local_argc=argc;
if (!load_config(bio_err, NULL))
goto end;
+ cctx = SSL_CONF_CTX_new();
+ if (!cctx)
+ goto end;
+ SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_SERVER);
+ SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_CMDLINE);
+
verify_depth=0;
#ifdef FIONBIO
s_nbio=0;
if (!extract_port(*(++argv),&port))
goto bad;
}
+ else if (strcmp(*argv,"-naccept") == 0)
+ {
+ if (--argc < 1) goto bad;
+ naccept = atol(*(++argv));
+ if (naccept <= 0)
+ {
+ BIO_printf(bio_err, "bad accept value %s\n",
+ *argv);
+ goto bad;
+ }
+ }
else if (strcmp(*argv,"-verify") == 0)
{
s_server_verify=SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE;
if (--argc < 1) goto bad;
verify_depth=atoi(*(++argv));
- BIO_printf(bio_err,"verify depth is %d\n",verify_depth);
+ if (!s_quiet)
+ BIO_printf(bio_err,"verify depth is %d\n",verify_depth);
}
else if (strcmp(*argv,"-Verify") == 0)
{
SSL_VERIFY_CLIENT_ONCE;
if (--argc < 1) goto bad;
verify_depth=atoi(*(++argv));
- BIO_printf(bio_err,"verify depth is %d, must return a certificate\n",verify_depth);
+ if (!s_quiet)
+ BIO_printf(bio_err,"verify depth is %d, must return a certificate\n",verify_depth);
}
else if (strcmp(*argv,"-context") == 0)
{
if (--argc < 1) goto bad;
dhfile = *(++argv);
}
-#ifndef OPENSSL_NO_ECDH
- else if (strcmp(*argv,"-named_curve") == 0)
- {
- if (--argc < 1) goto bad;
- named_curve = *(++argv);
- }
-#endif
else if (strcmp(*argv,"-dcertform") == 0)
{
if (--argc < 1) goto bad;
goto bad;
continue;
}
- else if (strcmp(*argv,"-verify_return_error") == 0)
- verify_return_error = 1;
- else if (strcmp(*argv,"-serverpref") == 0)
- { off|=SSL_OP_CIPHER_SERVER_PREFERENCE; }
- else if (strcmp(*argv,"-legacy_renegotiation") == 0)
- off|=SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;
- else if (strcmp(*argv,"-cipher") == 0)
+ else if (args_ssl(&argv, &argc, cctx, &badarg, bio_err, &ssl_args))
{
- if (--argc < 1) goto bad;
- cipher= *(++argv);
+ if (badarg)
+ goto bad;
+ continue;
}
+ else if (strcmp(*argv,"-verify_return_error") == 0)
+ verify_return_error = 1;
+ else if (strcmp(*argv,"-verify_quiet") == 0)
+ verify_quiet = 1;
else if (strcmp(*argv,"-build_chain") == 0)
build_chain = 1;
else if (strcmp(*argv,"-CAfile") == 0)
#endif
s_nbio_test=1;
}
+ else if (strcmp(*argv,"-ign_eof") == 0)
+ s_ign_eof=1;
+ else if (strcmp(*argv,"-no_ign_eof") == 0)
+ s_ign_eof=0;
else if (strcmp(*argv,"-debug") == 0)
{ s_debug=1; }
#ifndef OPENSSL_NO_TLSEXT
goto bad;
}
}
- else if (strcmp(*argv,"-curves") == 0)
+#endif
+ else if (strcmp(*argv,"-checkhost") == 0)
{
if (--argc < 1) goto bad;
- curves= *(++argv);
+ checkhost=(unsigned char *)*(++argv);
}
- else if (strcmp(*argv,"-sigalgs") == 0)
+ else if (strcmp(*argv,"-checkemail") == 0)
{
if (--argc < 1) goto bad;
- sigalgs= *(++argv);
+ checkemail=(unsigned char *)*(++argv);
}
- else if (strcmp(*argv,"-client_sigalgs") == 0)
+ else if (strcmp(*argv,"-checkip") == 0)
{
if (--argc < 1) goto bad;
- client_sigalgs= *(++argv);
+ checkip=*(++argv);
}
-#endif
else if (strcmp(*argv,"-msg") == 0)
{ s_msg=1; }
else if (strcmp(*argv,"-msgfile") == 0)
{ s_crlf=1; }
else if (strcmp(*argv,"-quiet") == 0)
{ s_quiet=1; }
- else if (strcmp(*argv,"-bugs") == 0)
- { bugs=1; }
+ else if (strcmp(*argv,"-brief") == 0)
+ {
+ s_quiet=1;
+ s_brief=1;
+ verify_quiet=1;
+ }
else if (strcmp(*argv,"-no_tmp_rsa") == 0)
{ no_tmp_rsa=1; }
else if (strcmp(*argv,"-no_dhe") == 0)
meth = TLSv1_server_method();
}
#endif
+ else if (strcmp(*argv,"-rev") == 0)
+ { rev=1; }
else if (strcmp(*argv,"-www") == 0)
{ www=1; }
else if (strcmp(*argv,"-WWW") == 0)
{ www=2; }
else if (strcmp(*argv,"-HTTP") == 0)
{ www=3; }
- else if (strcmp(*argv,"-no_ssl2") == 0)
- { off|=SSL_OP_NO_SSLv2; }
- else if (strcmp(*argv,"-no_ssl3") == 0)
- { off|=SSL_OP_NO_SSLv3; }
- else if (strcmp(*argv,"-no_tls1") == 0)
- { off|=SSL_OP_NO_TLSv1; }
- else if (strcmp(*argv,"-no_tls1_1") == 0)
- { off|=SSL_OP_NO_TLSv1_1; }
- else if (strcmp(*argv,"-no_tls1_2") == 0)
- { off|=SSL_OP_NO_TLSv1_2; }
- else if (strcmp(*argv,"-no_comp") == 0)
- { off|=SSL_OP_NO_COMPRESSION; }
-#ifndef OPENSSL_NO_TLSEXT
- else if (strcmp(*argv,"-no_ticket") == 0)
- { off|=SSL_OP_NO_TICKET; }
-#endif
#ifndef OPENSSL_NO_SSL2
else if (strcmp(*argv,"-ssl2") == 0)
{ meth=SSLv2_server_method(); }
keymatexportlen=atoi(*(++argv));
if (keymatexportlen == 0) goto bad;
}
- else if (strcmp(*argv, "-cert_strict") == 0)
- cert_flags |= SSL_CERT_FLAG_TLS_STRICT;
-#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
- else if (strcmp(*argv, "-debug_broken_protocol") == 0)
- cert_flags |= SSL_CERT_FLAG_BROKEN_PROTCOL;
-#endif
else
{
BIO_printf(bio_err,"unknown option %s\n",*argv);
if (bio_s_out == NULL)
{
- if (s_quiet && !s_debug && !s_msg)
+ if (s_quiet && !s_debug)
{
bio_s_out=BIO_new(BIO_s_null());
+ if (s_msg && !bio_s_msg)
+ bio_s_msg=BIO_new_fp(stdout,BIO_NOCLOSE);
}
else
{
BIO_printf(bio_err,"id_prefix '%s' set.\n", session_id_prefix);
}
SSL_CTX_set_quiet_shutdown(ctx,1);
- if (bugs) SSL_CTX_set_options(ctx,SSL_OP_ALL);
if (hack) SSL_CTX_set_options(ctx,SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG);
- SSL_CTX_set_options(ctx,off);
- if (cert_flags) SSL_CTX_set_cert_flags(ctx, cert_flags);
if (exc) ssl_ctx_set_excert(ctx, exc);
/* DTLS: partial reads end up discarding unread UDP bytes :-(
* Setting read ahead solves this problem.
if (vpm)
SSL_CTX_set1_param(ctx, vpm);
+ if (!args_ssl_call(ctx, bio_err, cctx, ssl_args, no_ecdhe))
+ goto end;
+
if (!ssl_load_stores(ctx, vfyCApath, vfyCAfile, chCApath, chCAfile))
{
BIO_printf(bio_err, "Error loading store locations\n");
BIO_printf(bio_err,"id_prefix '%s' set.\n", session_id_prefix);
}
SSL_CTX_set_quiet_shutdown(ctx2,1);
- if (bugs) SSL_CTX_set_options(ctx2,SSL_OP_ALL);
if (hack) SSL_CTX_set_options(ctx2,SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG);
- SSL_CTX_set_options(ctx2,off);
- if (cert_flags) SSL_CTX_set_cert_flags(ctx2, cert_flags);
if (exc) ssl_ctx_set_excert(ctx2, exc);
/* DTLS: partial reads end up discarding unread UDP bytes :-(
* Setting read ahead solves this problem.
}
if (vpm)
SSL_CTX_set1_param(ctx2, vpm);
+
+ if (!args_ssl_call(ctx2, bio_err, cctx, ssl_args, no_ecdhe))
+ goto end;
}
# ifndef OPENSSL_NO_NEXTPROTONEG
}
#endif
-#ifndef OPENSSL_NO_ECDH
- if (!no_ecdhe)
- {
- EC_KEY *ecdh=NULL;
-
- if (named_curve && strcmp(named_curve, "auto"))
- {
- int nid = EC_curve_nist2nid(named_curve);
- if (nid == NID_undef)
- nid = OBJ_sn2nid(named_curve);
- if (nid == 0)
- {
- BIO_printf(bio_err, "unknown curve name (%s)\n",
- named_curve);
- goto end;
- }
- ecdh = EC_KEY_new_by_curve_name(nid);
- if (ecdh == NULL)
- {
- BIO_printf(bio_err, "unable to create curve (%s)\n",
- named_curve);
- goto end;
- }
- }
-
- if (ecdh != NULL)
- {
- BIO_printf(bio_s_out,"Setting temp ECDH parameters\n");
- }
- else if (named_curve)
- SSL_CTX_set_ecdh_auto(ctx, 1);
- else
- {
- BIO_printf(bio_s_out,"Using default temp ECDH parameters\n");
- ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
- if (ecdh == NULL)
- {
- BIO_printf(bio_err, "unable to create curve (nistp256)\n");
- goto end;
- }
- }
- (void)BIO_flush(bio_s_out);
-
- SSL_CTX_set_tmp_ecdh(ctx,ecdh);
-#ifndef OPENSSL_NO_TLSEXT
- if (ctx2)
- SSL_CTX_set_tmp_ecdh(ctx2,ecdh);
-#endif
- EC_KEY_free(ecdh);
- }
-#endif
-
if (!set_cert_key_stuff(ctx, s_cert, s_key, s_chain, build_chain))
goto end;
#ifndef OPENSSL_NO_TLSEXT
}
#endif
- if (cipher != NULL)
- {
- if(!SSL_CTX_set_cipher_list(ctx,cipher))
- {
- BIO_printf(bio_err,"error setting cipher list\n");
- ERR_print_errors(bio_err);
- goto end;
- }
-#ifndef OPENSSL_NO_TLSEXT
- if (ctx2 && !SSL_CTX_set_cipher_list(ctx2,cipher))
- {
- BIO_printf(bio_err,"error setting cipher list\n");
- ERR_print_errors(bio_err);
- goto end;
- }
-#endif
- }
-#ifndef OPENSSL_NO_TLSEXT
- if (curves)
- {
- if(!SSL_CTX_set1_curves_list(ctx,curves))
- {
- BIO_printf(bio_err,"error setting curves list\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- if(ctx2 && !SSL_CTX_set1_curves_list(ctx2,curves))
- {
- BIO_printf(bio_err,"error setting curves list\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- }
- if (sigalgs)
- {
- if(!SSL_CTX_set1_sigalgs_list(ctx,sigalgs))
- {
- BIO_printf(bio_err,"error setting signature algorithms\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- if(ctx2 && !SSL_CTX_set1_sigalgs_list(ctx2,sigalgs))
- {
- BIO_printf(bio_err,"error setting signature algorithms\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- }
- if (client_sigalgs)
- {
- if(!SSL_CTX_set1_client_sigalgs_list(ctx,client_sigalgs))
- {
- BIO_printf(bio_err,"error setting client signature algorithms\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- if(ctx2 && !SSL_CTX_set1_client_sigalgs_list(ctx2,client_sigalgs))
- {
- BIO_printf(bio_err,"error setting client signature algorithms\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- }
-#endif
SSL_CTX_set_verify(ctx,s_server_verify,verify_callback);
SSL_CTX_set_session_id_context(ctx,(void*)&s_server_session_id_context,
sizeof s_server_session_id_context);
BIO_printf(bio_s_out,"ACCEPT\n");
(void)BIO_flush(bio_s_out);
- if (www)
- do_server(port,socket_type,&accept_socket,www_body, context);
+ if (rev)
+ do_server(port,socket_type,&accept_socket,rev_body, context, naccept);
+ else if (www)
+ do_server(port,socket_type,&accept_socket,www_body, context, naccept);
else
- do_server(port,socket_type,&accept_socket,sv_body, context);
+ do_server(port,socket_type,&accept_socket,sv_body, context, naccept);
print_stats(bio_s_out,ctx);
ret=0;
end:
OPENSSL_free(pass);
if (dpass)
OPENSSL_free(dpass);
+ if (vpm)
+ X509_VERIFY_PARAM_free(vpm);
free_sessions();
#ifndef OPENSSL_NO_TLSEXT
if (tlscstatp.host)
BIO_free(authz_in);
#endif
ssl_excert_free(exc);
+ if (ssl_args)
+ sk_OPENSSL_STRING_free(ssl_args);
+ if (cctx)
+ SSL_CONF_CTX_free(cctx);
if (bio_s_out != NULL)
{
BIO_free(bio_s_out);
}
else
i=raw_read_stdin(buf,bufsize);
- if (!s_quiet)
+ if (!s_quiet && !s_brief)
{
if ((i <= 0) || (buf[0] == 'Q'))
{
return(0);
}
+ if (s_brief)
+ print_ssl_summary(bio_err, con);
+
+ print_ssl_cert_checks(bio_err, con, checkhost, checkemail, checkip);
+
PEM_write_bio_SSL_SESSION(bio_s_out,SSL_get_session(con));
peer=SSL_get_peer_certificate(con);
BIO_printf(bio_s_out,"Shared ciphers:%s\n",buf);
str=SSL_CIPHER_get_name(SSL_get_current_cipher(con));
ssl_print_sigalgs(bio_s_out, con);
- ssl_print_curves(bio_s_out, con);
+ ssl_print_point_formats(bio_s_out, con);
+ ssl_print_curves(bio_s_out, con, 0);
BIO_printf(bio_s_out,"CIPHER is %s\n",(str != NULL)?str:"(NONE)");
#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
BIO_puts(io,"\n");
}
ssl_print_sigalgs(io, con);
- ssl_print_curves(io, con);
+ ssl_print_curves(io, con, 0);
BIO_printf(io,(SSL_cache_hit(con)
?"---\nReused, "
:"---\nNew, "));
return(ret);
}
+static int rev_body(char *hostname, int s, unsigned char *context)
+ {
+ char *buf=NULL;
+ int i;
+ int ret=1;
+ SSL *con;
+ BIO *io,*ssl_bio,*sbio;
+#ifndef OPENSSL_NO_KRB5
+ KSSL_CTX *kctx;
+#endif
+
+ buf=OPENSSL_malloc(bufsize);
+ if (buf == NULL) return(0);
+ io=BIO_new(BIO_f_buffer());
+ ssl_bio=BIO_new(BIO_f_ssl());
+ if ((io == NULL) || (ssl_bio == NULL)) goto err;
+
+ /* lets make the output buffer a reasonable size */
+ if (!BIO_set_write_buffer_size(io,bufsize)) goto err;
+
+ if ((con=SSL_new(ctx)) == NULL) goto err;
+#ifndef OPENSSL_NO_TLSEXT
+ if (s_tlsextdebug)
+ {
+ SSL_set_tlsext_debug_callback(con, tlsext_cb);
+ SSL_set_tlsext_debug_arg(con, bio_s_out);
+ }
+#endif
+#ifndef OPENSSL_NO_KRB5
+ if ((kctx = kssl_ctx_new()) != NULL)
+ {
+ kssl_ctx_setstring(kctx, KSSL_SERVICE, KRB5SVC);
+ kssl_ctx_setstring(kctx, KSSL_KEYTAB, KRB5KEYTAB);
+ }
+#endif /* OPENSSL_NO_KRB5 */
+ if(context) SSL_set_session_id_context(con, context,
+ strlen((char *)context));
+
+ sbio=BIO_new_socket(s,BIO_NOCLOSE);
+ SSL_set_bio(con,sbio,sbio);
+ SSL_set_accept_state(con);
+
+ BIO_set_ssl(ssl_bio,con,BIO_CLOSE);
+ BIO_push(io,ssl_bio);
+#ifdef CHARSET_EBCDIC
+ io = BIO_push(BIO_new(BIO_f_ebcdic_filter()),io);
+#endif
+
+ if (s_debug)
+ {
+ SSL_set_debug(con, 1);
+ BIO_set_callback(SSL_get_rbio(con),bio_dump_callback);
+ BIO_set_callback_arg(SSL_get_rbio(con),(char *)bio_s_out);
+ }
+ if (s_msg)
+ {
+#ifndef OPENSSL_NO_SSL_TRACE
+ if (s_msg == 2)
+ SSL_set_msg_callback(con, SSL_trace);
+ else
+#endif
+ SSL_set_msg_callback(con, msg_cb);
+ SSL_set_msg_callback_arg(con, bio_s_msg ? bio_s_msg : bio_s_out);
+ }
+
+ for (;;)
+ {
+ i = BIO_do_handshake(io);
+ if (i > 0)
+ break;
+ if (!BIO_should_retry(io))
+ {
+ BIO_puts(bio_err, "CONNECTION FAILURE\n");
+ ERR_print_errors(bio_err);
+ goto end;
+ }
+ }
+ BIO_printf(bio_err, "CONNECTION ESTABLISHED\n");
+ print_ssl_summary(bio_err, con);
+
+ for (;;)
+ {
+ i=BIO_gets(io,buf,bufsize-1);
+ if (i < 0) /* error */
+ {
+ if (!BIO_should_retry(io))
+ {
+ if (!s_quiet)
+ ERR_print_errors(bio_err);
+ goto err;
+ }
+ else
+ {
+ BIO_printf(bio_s_out,"read R BLOCK\n");
+#if defined(OPENSSL_SYS_NETWARE)
+ delay(1000);
+#elif !defined(OPENSSL_SYS_MSDOS) && !defined(__DJGPP__)
+ sleep(1);
+#endif
+ continue;
+ }
+ }
+ else if (i == 0) /* end of input */
+ {
+ ret=1;
+ BIO_printf(bio_err, "CONNECTION CLOSED\n");
+ goto end;
+ }
+ else
+ {
+ char *p = buf + i - 1;
+ while(i && (*p == '\n' || *p == '\r'))
+ {
+ p--;
+ i--;
+ }
+ if (!s_ign_eof && i == 5 && !strncmp(buf, "CLOSE", 5))
+ {
+ ret = 1;
+ BIO_printf(bio_err, "CONNECTION CLOSED\n");
+ goto end;
+ }
+ BUF_reverse((unsigned char *)buf, NULL, i);
+ buf[i] = '\n';
+ BIO_write(io, buf, i + 1);
+ for (;;)
+ {
+ i = BIO_flush(io);
+ if (i > 0)
+ break;
+ if (!BIO_should_retry(io))
+ goto end;
+ }
+ }
+ }
+end:
+ /* make sure we re-use sessions */
+ SSL_set_shutdown(con,SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
+
+err:
+
+ if (buf != NULL) OPENSSL_free(buf);
+ if (io != NULL) BIO_free_all(io);
+ return(ret);
+ }
+
#ifndef OPENSSL_NO_RSA
static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength)
{
}
first = NULL;
}
-
-static int ssl_load_stores(SSL_CTX *sctx,
- const char *vfyCApath, const char *vfyCAfile,
- const char *chCApath, const char *chCAfile)
- {
- X509_STORE *vfy = NULL, *ch = NULL;
- int rv = 0;
- if (vfyCApath || vfyCAfile)
- {
- vfy = X509_STORE_new();
- if (!X509_STORE_load_locations(vfy, vfyCAfile, vfyCApath))
- goto err;
- SSL_CTX_set1_verify_cert_store(ctx, vfy);
- }
- if (chCApath || chCAfile)
- {
- ch = X509_STORE_new();
- if (!X509_STORE_load_locations(ch, chCAfile, chCApath))
- goto err;
- /*X509_STORE_set_verify_cb(ch, verify_callback);*/
- SSL_CTX_set1_chain_cert_store(ctx, ch);
- }
- rv = 1;
- err:
- if (vfy)
- X509_STORE_free(vfy);
- if (ch)
- X509_STORE_free(ch);
- return rv;
- }
-
-
-
-
-
-
-
-
-
projects / openssl.git / blobdiff