extern int verify_depth, verify_return_error, verify_quiet;
-static char *cipher=NULL;
static int s_server_verify=SSL_VERIFY_NONE;
static int s_server_session_id_context = 1; /* anything will do */
static const char *s_cert_file=TEST_CERT,*s_key_file=NULL, *s_chain_file=NULL;
#ifndef OPENSSL_NO_TLSEXT
static const char *s_cert_file2=TEST_CERT2,*s_key_file2=NULL;
-static char *curves=NULL;
-static char *sigalgs=NULL;
-static char *client_sigalgs=NULL;
#endif
static char *s_dcert_file=NULL,*s_dkey_file=NULL, *s_dchain_file=NULL;
#ifdef FIONBIO
static void s_server_init(void)
{
accept_socket=-1;
- cipher=NULL;
s_server_verify=SSL_VERIFY_NONE;
s_dcert_file=NULL;
s_dkey_file=NULL;
s_key_file=NULL;
s_chain_file=NULL;
#ifndef OPENSSL_NO_TLSEXT
- curves=NULL;
s_cert_file2=TEST_CERT2;
s_key_file2=NULL;
ctx2=NULL;
static srpsrvparm srp_callback_parm;
#endif
static char *srtp_profiles = NULL;
+static unsigned char *checkhost = NULL, *checkemail = NULL;
+static char *checkip = NULL;
+
int MAIN(int argc, char *argv[])
{
#ifndef OPENSSL_NO_ECDH
char *named_curve = NULL;
#endif
- int badop=0,bugs=0;
+ int badop=0;
int ret=1;
- int off=0;
- unsigned int cert_flags = 0;
int build_chain = 0;
int no_tmp_rsa=0,no_dhe=0,no_ecdhe=0,nocert=0;
int state=0;
STACK_OF(X509) *s_chain = NULL, *s_dchain = NULL;
EVP_PKEY *s_key = NULL, *s_dkey = NULL;
int no_cache = 0, ext_cache = 0;
- int rev = 0;
+ int rev = 0, naccept = -1;
#ifndef OPENSSL_NO_TLSEXT
EVP_PKEY *s_key2 = NULL;
X509 *s_cert2 = NULL;
char *srp_verifier_file = NULL;
#endif
SSL_EXCERT *exc = NULL;
-
- unsigned char *checkhost = NULL, *checkemail = NULL;
- char *checkip = NULL;
+ SSL_CONF_CTX *cctx = NULL;
+ STACK_OF(OPENSSL_STRING) *ssl_args = NULL;
meth=SSLv23_server_method();
if (!load_config(bio_err, NULL))
goto end;
+ cctx = SSL_CONF_CTX_new();
+ if (!cctx)
+ goto end;
+ SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_SERVER);
+
verify_depth=0;
#ifdef FIONBIO
s_nbio=0;
if (!extract_port(*(++argv),&port))
goto bad;
}
+ else if (strcmp(*argv,"-naccept") == 0)
+ {
+ if (--argc < 1) goto bad;
+ naccept = atol(*(++argv));
+ if (naccept <= 0)
+ {
+ BIO_printf(bio_err, "bad accept value %s\n",
+ *argv);
+ goto bad;
+ }
+ }
else if (strcmp(*argv,"-verify") == 0)
{
s_server_verify=SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE;
if (--argc < 1) goto bad;
dhfile = *(++argv);
}
-#ifndef OPENSSL_NO_ECDH
- else if (strcmp(*argv,"-named_curve") == 0)
- {
- if (--argc < 1) goto bad;
- named_curve = *(++argv);
- }
-#endif
else if (strcmp(*argv,"-dcertform") == 0)
{
if (--argc < 1) goto bad;
goto bad;
continue;
}
+ else if (args_ssl(&argv, &argc, cctx, &badarg, bio_err, &ssl_args))
+ {
+ if (badarg)
+ goto bad;
+ continue;
+ }
else if (strcmp(*argv,"-verify_return_error") == 0)
verify_return_error = 1;
else if (strcmp(*argv,"-verify_quiet") == 0)
verify_quiet = 1;
- else if (strcmp(*argv,"-serverpref") == 0)
- { off|=SSL_OP_CIPHER_SERVER_PREFERENCE; }
- else if (strcmp(*argv,"-legacy_renegotiation") == 0)
- off|=SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;
- else if (strcmp(*argv,"-cipher") == 0)
- {
- if (--argc < 1) goto bad;
- cipher= *(++argv);
- }
else if (strcmp(*argv,"-build_chain") == 0)
build_chain = 1;
else if (strcmp(*argv,"-CAfile") == 0)
goto bad;
}
}
- else if (strcmp(*argv,"-curves") == 0)
- {
- if (--argc < 1) goto bad;
- curves= *(++argv);
- }
- else if (strcmp(*argv,"-sigalgs") == 0)
- {
- if (--argc < 1) goto bad;
- sigalgs= *(++argv);
- }
- else if (strcmp(*argv,"-client_sigalgs") == 0)
- {
- if (--argc < 1) goto bad;
- client_sigalgs= *(++argv);
- }
#endif
else if (strcmp(*argv,"-checkhost") == 0)
{
s_brief=1;
verify_quiet=1;
}
- else if (strcmp(*argv,"-bugs") == 0)
- { bugs=1; }
else if (strcmp(*argv,"-no_tmp_rsa") == 0)
{ no_tmp_rsa=1; }
else if (strcmp(*argv,"-no_dhe") == 0)
{ www=2; }
else if (strcmp(*argv,"-HTTP") == 0)
{ www=3; }
- else if (strcmp(*argv,"-no_ssl2") == 0)
- { off|=SSL_OP_NO_SSLv2; }
- else if (strcmp(*argv,"-no_ssl3") == 0)
- { off|=SSL_OP_NO_SSLv3; }
- else if (strcmp(*argv,"-no_tls1") == 0)
- { off|=SSL_OP_NO_TLSv1; }
- else if (strcmp(*argv,"-no_tls1_1") == 0)
- { off|=SSL_OP_NO_TLSv1_1; }
- else if (strcmp(*argv,"-no_tls1_2") == 0)
- { off|=SSL_OP_NO_TLSv1_2; }
- else if (strcmp(*argv,"-no_comp") == 0)
- { off|=SSL_OP_NO_COMPRESSION; }
-#ifndef OPENSSL_NO_TLSEXT
- else if (strcmp(*argv,"-no_ticket") == 0)
- { off|=SSL_OP_NO_TICKET; }
-#endif
#ifndef OPENSSL_NO_SSL2
else if (strcmp(*argv,"-ssl2") == 0)
{ meth=SSLv2_server_method(); }
keymatexportlen=atoi(*(++argv));
if (keymatexportlen == 0) goto bad;
}
- else if (strcmp(*argv, "-cert_strict") == 0)
- cert_flags |= SSL_CERT_FLAG_TLS_STRICT;
#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
else if (strcmp(*argv, "-debug_broken_protocol") == 0)
cert_flags |= SSL_CERT_FLAG_BROKEN_PROTCOL;
BIO_printf(bio_err,"id_prefix '%s' set.\n", session_id_prefix);
}
SSL_CTX_set_quiet_shutdown(ctx,1);
- if (bugs) SSL_CTX_set_options(ctx,SSL_OP_ALL);
if (hack) SSL_CTX_set_options(ctx,SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG);
- SSL_CTX_set_options(ctx,off);
- if (cert_flags) SSL_CTX_set_cert_flags(ctx, cert_flags);
if (exc) ssl_ctx_set_excert(ctx, exc);
/* DTLS: partial reads end up discarding unread UDP bytes :-(
* Setting read ahead solves this problem.
if (vpm)
SSL_CTX_set1_param(ctx, vpm);
+ if (!args_ssl_call(ctx, bio_err, cctx, ssl_args))
+ goto end;
+
if (!ssl_load_stores(ctx, vfyCApath, vfyCAfile, chCApath, chCAfile))
{
BIO_printf(bio_err, "Error loading store locations\n");
BIO_printf(bio_err,"id_prefix '%s' set.\n", session_id_prefix);
}
SSL_CTX_set_quiet_shutdown(ctx2,1);
- if (bugs) SSL_CTX_set_options(ctx2,SSL_OP_ALL);
if (hack) SSL_CTX_set_options(ctx2,SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG);
- SSL_CTX_set_options(ctx2,off);
- if (cert_flags) SSL_CTX_set_cert_flags(ctx2, cert_flags);
if (exc) ssl_ctx_set_excert(ctx2, exc);
/* DTLS: partial reads end up discarding unread UDP bytes :-(
* Setting read ahead solves this problem.
}
if (vpm)
SSL_CTX_set1_param(ctx2, vpm);
+
+ if (!args_ssl_call(ctx2, bio_err, cctx, ssl_args))
+ goto end;
}
# ifndef OPENSSL_NO_NEXTPROTONEG
}
#endif
- if (cipher != NULL)
- {
- if(!SSL_CTX_set_cipher_list(ctx,cipher))
- {
- BIO_printf(bio_err,"error setting cipher list\n");
- ERR_print_errors(bio_err);
- goto end;
- }
-#ifndef OPENSSL_NO_TLSEXT
- if (ctx2 && !SSL_CTX_set_cipher_list(ctx2,cipher))
- {
- BIO_printf(bio_err,"error setting cipher list\n");
- ERR_print_errors(bio_err);
- goto end;
- }
-#endif
- }
-#ifndef OPENSSL_NO_TLSEXT
- if (curves)
- {
- if(!SSL_CTX_set1_curves_list(ctx,curves))
- {
- BIO_printf(bio_err,"error setting curves list\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- if(ctx2 && !SSL_CTX_set1_curves_list(ctx2,curves))
- {
- BIO_printf(bio_err,"error setting curves list\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- }
- if (sigalgs)
- {
- if(!SSL_CTX_set1_sigalgs_list(ctx,sigalgs))
- {
- BIO_printf(bio_err,"error setting signature algorithms\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- if(ctx2 && !SSL_CTX_set1_sigalgs_list(ctx2,sigalgs))
- {
- BIO_printf(bio_err,"error setting signature algorithms\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- }
- if (client_sigalgs)
- {
- if(!SSL_CTX_set1_client_sigalgs_list(ctx,client_sigalgs))
- {
- BIO_printf(bio_err,"error setting client signature algorithms\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- if(ctx2 && !SSL_CTX_set1_client_sigalgs_list(ctx2,client_sigalgs))
- {
- BIO_printf(bio_err,"error setting client signature algorithms\n");
- ERR_print_errors(bio_err);
- goto end;
- }
- }
-#endif
SSL_CTX_set_verify(ctx,s_server_verify,verify_callback);
SSL_CTX_set_session_id_context(ctx,(void*)&s_server_session_id_context,
sizeof s_server_session_id_context);
BIO_printf(bio_s_out,"ACCEPT\n");
(void)BIO_flush(bio_s_out);
if (rev)
- do_server(port,socket_type,&accept_socket,rev_body, context);
+ do_server(port,socket_type,&accept_socket,rev_body, context, naccept);
else if (www)
- do_server(port,socket_type,&accept_socket,www_body, context);
+ do_server(port,socket_type,&accept_socket,www_body, context, naccept);
else
- do_server(port,socket_type,&accept_socket,sv_body, context);
+ do_server(port,socket_type,&accept_socket,sv_body, context, naccept);
print_stats(bio_s_out,ctx);
ret=0;
end:
BIO_free(authz_in);
#endif
ssl_excert_free(exc);
+ if (ssl_args)
+ sk_OPENSSL_STRING_free(ssl_args);
+ if (cctx)
+ SSL_CONF_CTX_free(cctx);
if (bio_s_out != NULL)
{
BIO_free(bio_s_out);
projects / openssl.git / blobdiff