RT 487. Mention that generated primes are "at least" B<bits> long.

[openssl.git] / apps / s_server.c

diff --git a/apps/s_server.c b/apps/s_server.c
index 9db57dff3c36733e1173f9b78d62f79826625785..f890aac5b593f361af2071486acbfc083291a667 100644 (file)
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -479,12 +479,15 @@ static void sv_usage(void)
        {
        BIO_printf(bio_err,"usage: s_server [args ...]\n");
        BIO_printf(bio_err,"\n");
-       BIO_printf(bio_err," -accept arg   - port to accept on (default is %d)\n",PORT);
+       BIO_printf(bio_err," -accept port  - TCP/IP port to accept on (default is %d)\n",PORT);
+       BIO_printf(bio_err," -unix path    - unix domain socket to accept on\n");
+       BIO_printf(bio_err," -unlink       - for -unix, unlink existing socket first\n");
        BIO_printf(bio_err," -context arg  - set session ID context\n");
        BIO_printf(bio_err," -verify arg   - turn on peer certificate verification\n");
        BIO_printf(bio_err," -Verify arg   - turn on peer certificate verification, must have a cert.\n");
        BIO_printf(bio_err," -cert arg     - certificate file to use\n");
        BIO_printf(bio_err,"                 (default is %s)\n",TEST_CERT);
+       BIO_printf(bio_err," -naccept arg  - terminate after 'arg' connections\n");
 #ifndef OPENSSL_NO_TLSEXT
        BIO_printf(bio_err," -serverinfo arg - PEM serverinfo file for certificate\n");
        BIO_printf(bio_err," -auth               - send and receive RFC 5878 TLS auth extensions and supplemental data\n");
@@ -523,6 +526,7 @@ static void sv_usage(void)
        BIO_printf(bio_err," -state        - Print the SSL states\n");
        BIO_printf(bio_err," -CApath arg   - PEM format directory of CA's\n");
        BIO_printf(bio_err," -CAfile arg   - PEM format file of CA's\n");
+       BIO_printf(bio_err," -trusted_first - Use locally trusted CA's first when building trust chain\n");
        BIO_printf(bio_err," -nocert       - Don't use any certificates (Anon-DH)\n");
        BIO_printf(bio_err," -cipher arg   - play with 'openssl ciphers' to see what goes here\n");
        BIO_printf(bio_err," -serverpref   - Use server's cipher preferences\n");
@@ -1007,6 +1011,9 @@ int MAIN(int argc, char *argv[])
        X509_VERIFY_PARAM *vpm = NULL;
        int badarg = 0;
        short port=PORT;
+       const char *unix_path=NULL;
+       int unlink_unix_path=0;
+       int (*server_cb)(char *hostname, int s, int stype, unsigned char *context);
        char *CApath=NULL,*CAfile=NULL;
        char *chCApath=NULL,*chCAfile=NULL;
        char *vfyCApath=NULL,*vfyCAfile=NULL;
@@ -1030,6 +1037,7 @@ int MAIN(int argc, char *argv[])
        EVP_PKEY *s_key = NULL, *s_dkey = NULL;
        int no_cache = 0, ext_cache = 0;
        int rev = 0, naccept = -1;
+       int sdebug = 0;
 #ifndef OPENSSL_NO_TLSEXT
        EVP_PKEY *s_key2 = NULL;
        X509 *s_cert2 = NULL;
@@ -1098,6 +1106,25 @@ int MAIN(int argc, char *argv[])
                        if (!extract_port(*(++argv),&port))
                                goto bad;
                        }
+               else if (strcmp(*argv,"-unix") == 0)
+                       {
+#ifdef NO_SYS_UN_H
+                       BIO_printf(bio_err, "unix domain sockets unsupported\n");
+                       goto bad;
+#else
+                       if (--argc < 1) goto bad;
+                       unix_path = *(++argv);
+#endif
+                       }
+               else if (strcmp(*argv,"-unlink") == 0)
+                       {
+#ifdef NO_SYS_UN_H
+                       BIO_printf(bio_err, "unix domain sockets unsupported\n");
+                       goto bad;
+#else
+                       unlink_unix_path = 1;
+#endif
+                       }
                else if (strcmp(*argv,"-naccept") == 0)
                        {
                        if (--argc < 1) goto bad;
@@ -1344,6 +1371,10 @@ int MAIN(int argc, char *argv[])
                else if (strcmp(*argv,"-trace") == 0)
                        { s_msg=2; }
 #endif
+               else if (strcmp(*argv,"-security_debug") == 0)
+                       { sdebug=1; }
+               else if (strcmp(*argv,"-security_debug_verbose") == 0)
+                       { sdebug=2; }
                else if (strcmp(*argv,"-hack") == 0)
                        { hack=1; }
                else if (strcmp(*argv,"-state") == 0)
@@ -1538,6 +1569,11 @@ bad:
                goto end;
                }
 
+       if (unix_path && (socket_type != SOCK_STREAM))
+               {
+               BIO_printf(bio_err, "Can't use unix sockets and datagrams together\n");
+                       goto end;
+               }
 #if !defined(OPENSSL_NO_JPAKE) && !defined(OPENSSL_NO_PSK)
        if (jpake_secret)
                {
@@ -1743,6 +1779,8 @@ bad:
                }
 
        ctx=SSL_CTX_new(meth);
+       if (sdebug)
+               ssl_ctx_security_debug(ctx, bio_err, sdebug);
        if (ctx == NULL)
                {
                ERR_print_errors(bio_err);
@@ -1832,6 +1870,9 @@ bad:
                {
                BIO_printf(bio_s_out,"Setting secondary ctx parameters\n");
 
+               if (sdebug)
+                       ssl_ctx_security_debug(ctx, bio_err, sdebug);
+
                if (session_id_prefix)
                        {
                        if(strlen(session_id_prefix) >= 32)
@@ -2095,11 +2136,19 @@ bad:
        BIO_printf(bio_s_out,"ACCEPT\n");
        (void)BIO_flush(bio_s_out);
        if (rev)
-               do_server(port,socket_type,&accept_socket,rev_body, context, naccept);
+               server_cb = rev_body;
        else if (www)
-               do_server(port,socket_type,&accept_socket,www_body, context, naccept);
+               server_cb = www_body;
+       else
+               server_cb = sv_body;
+       if (unix_path)
+               {
+               if (unlink_unix_path)
+                       unlink(unix_path);
+               do_server_unix(unix_path,&accept_socket,server_cb, context, naccept);
+               }
        else
-               do_server(port,socket_type,&accept_socket,sv_body, context, naccept);
+               do_server(port,socket_type,&accept_socket,server_cb, context, naccept);
        print_stats(bio_s_out,ctx);
        ret=0;
 end: