1
by Christoph Martin
Import upstream version 0.9.7d |
1 |
/* apps/s_server.c */
|
2 |
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
|
|
3 |
* All rights reserved.
|
|
4 |
*
|
|
5 |
* This package is an SSL implementation written
|
|
6 |
* by Eric Young (eay@cryptsoft.com).
|
|
7 |
* The implementation was written so as to conform with Netscapes SSL.
|
|
8 |
*
|
|
9 |
* This library is free for commercial and non-commercial use as long as
|
|
10 |
* the following conditions are aheared to. The following conditions
|
|
11 |
* apply to all code found in this distribution, be it the RC4, RSA,
|
|
12 |
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
|
|
13 |
* included with this distribution is covered by the same copyright terms
|
|
14 |
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
|
|
15 |
*
|
|
16 |
* Copyright remains Eric Young's, and as such any Copyright notices in
|
|
17 |
* the code are not to be removed.
|
|
18 |
* If this package is used in a product, Eric Young should be given attribution
|
|
19 |
* as the author of the parts of the library used.
|
|
20 |
* This can be in the form of a textual message at program startup or
|
|
21 |
* in documentation (online or textual) provided with the package.
|
|
22 |
*
|
|
23 |
* Redistribution and use in source and binary forms, with or without
|
|
24 |
* modification, are permitted provided that the following conditions
|
|
25 |
* are met:
|
|
26 |
* 1. Redistributions of source code must retain the copyright
|
|
27 |
* notice, this list of conditions and the following disclaimer.
|
|
28 |
* 2. Redistributions in binary form must reproduce the above copyright
|
|
29 |
* notice, this list of conditions and the following disclaimer in the
|
|
30 |
* documentation and/or other materials provided with the distribution.
|
|
31 |
* 3. All advertising materials mentioning features or use of this software
|
|
32 |
* must display the following acknowledgement:
|
|
33 |
* "This product includes cryptographic software written by
|
|
34 |
* Eric Young (eay@cryptsoft.com)"
|
|
35 |
* The word 'cryptographic' can be left out if the rouines from the library
|
|
36 |
* being used are not cryptographic related :-).
|
|
37 |
* 4. If you include any Windows specific code (or a derivative thereof) from
|
|
38 |
* the apps directory (application code) you must include an acknowledgement:
|
|
39 |
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
|
|
40 |
*
|
|
41 |
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
|
|
42 |
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
43 |
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
44 |
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
|
45 |
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
46 |
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
47 |
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
48 |
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
49 |
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
50 |
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
51 |
* SUCH DAMAGE.
|
|
52 |
*
|
|
53 |
* The licence and distribution terms for any publically available version or
|
|
54 |
* derivative of this code cannot be changed. i.e. this code cannot simply be
|
|
55 |
* copied and put under another distribution licence
|
|
56 |
* [including the GNU Public Licence.]
|
|
57 |
*/
|
|
58 |
/* ====================================================================
|
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
59 |
* Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved.
|
1
by Christoph Martin
Import upstream version 0.9.7d |
60 |
*
|
61 |
* Redistribution and use in source and binary forms, with or without
|
|
62 |
* modification, are permitted provided that the following conditions
|
|
63 |
* are met:
|
|
64 |
*
|
|
65 |
* 1. Redistributions of source code must retain the above copyright
|
|
66 |
* notice, this list of conditions and the following disclaimer.
|
|
67 |
*
|
|
68 |
* 2. Redistributions in binary form must reproduce the above copyright
|
|
69 |
* notice, this list of conditions and the following disclaimer in
|
|
70 |
* the documentation and/or other materials provided with the
|
|
71 |
* distribution.
|
|
72 |
*
|
|
73 |
* 3. All advertising materials mentioning features or use of this
|
|
74 |
* software must display the following acknowledgment:
|
|
75 |
* "This product includes software developed by the OpenSSL Project
|
|
76 |
* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
|
|
77 |
*
|
|
78 |
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
|
79 |
* endorse or promote products derived from this software without
|
|
80 |
* prior written permission. For written permission, please contact
|
|
81 |
* openssl-core@openssl.org.
|
|
82 |
*
|
|
83 |
* 5. Products derived from this software may not be called "OpenSSL"
|
|
84 |
* nor may "OpenSSL" appear in their names without prior written
|
|
85 |
* permission of the OpenSSL Project.
|
|
86 |
*
|
|
87 |
* 6. Redistributions of any form whatsoever must retain the following
|
|
88 |
* acknowledgment:
|
|
89 |
* "This product includes software developed by the OpenSSL Project
|
|
90 |
* for use in the OpenSSL Toolkit (http://www.openssl.org/)"
|
|
91 |
*
|
|
92 |
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
|
93 |
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
94 |
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
|
95 |
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
|
96 |
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
97 |
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
|
98 |
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
|
99 |
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
100 |
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
101 |
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
102 |
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
|
103 |
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
104 |
* ====================================================================
|
|
105 |
*
|
|
106 |
* This product includes cryptographic software written by Eric Young
|
|
107 |
* (eay@cryptsoft.com). This product includes software written by Tim
|
|
108 |
* Hudson (tjh@cryptsoft.com).
|
|
109 |
*
|
|
110 |
*/
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
111 |
/* ====================================================================
|
112 |
* Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
|
|
113 |
* ECC cipher suite support in OpenSSL originally developed by
|
|
114 |
* SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
|
|
115 |
*/
|
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
116 |
/* ====================================================================
|
117 |
* Copyright 2005 Nokia. All rights reserved.
|
|
118 |
*
|
|
119 |
* The portions of the attached software ("Contribution") is developed by
|
|
120 |
* Nokia Corporation and is licensed pursuant to the OpenSSL open source
|
|
121 |
* license.
|
|
122 |
*
|
|
123 |
* The Contribution, originally written by Mika Kousa and Pasi Eronen of
|
|
124 |
* Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
|
|
125 |
* support (see RFC 4279) to OpenSSL.
|
|
126 |
*
|
|
127 |
* No patent licenses or other rights except those expressly stated in
|
|
128 |
* the OpenSSL open source license shall be deemed granted or received
|
|
129 |
* expressly, by implication, estoppel, or otherwise.
|
|
130 |
*
|
|
131 |
* No assurances are provided by Nokia that the Contribution does not
|
|
132 |
* infringe the patent or other intellectual property rights of any third
|
|
133 |
* party or that the license provides you with all the necessary rights
|
|
134 |
* to make use of the Contribution.
|
|
135 |
*
|
|
136 |
* THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
|
|
137 |
* ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
|
|
138 |
* SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
|
|
139 |
* OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
|
|
140 |
* OTHERWISE.
|
|
141 |
*/
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
142 |
|
143 |
/* Until the key-gen callbacks are modified to use newer prototypes, we allow
|
|
144 |
* deprecated functions for openssl-internal code */
|
|
145 |
#ifdef OPENSSL_NO_DEPRECATED
|
|
146 |
#undef OPENSSL_NO_DEPRECATED
|
|
147 |
#endif
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
148 |
|
149 |
#include <assert.h> |
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
150 |
#include <ctype.h> |
1
by Christoph Martin
Import upstream version 0.9.7d |
151 |
#include <stdio.h> |
152 |
#include <stdlib.h> |
|
153 |
#include <string.h> |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
154 |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
155 |
#include <openssl/e_os2.h> |
156 |
#ifdef OPENSSL_NO_STDIO
|
|
157 |
#define APPS_WIN16
|
|
158 |
#endif
|
|
159 |
||
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
160 |
#if !defined(OPENSSL_SYS_NETWARE) /* conflicts with winsock2 stuff on netware */ |
161 |
#include <sys/types.h> |
|
162 |
#endif
|
|
163 |
||
1
by Christoph Martin
Import upstream version 0.9.7d |
164 |
/* With IPv6, it looks like Digital has mixed up the proper order of
|
165 |
recursive header file inclusion, resulting in the compiler complaining
|
|
166 |
that u_int isn't defined, but only if _POSIX_C_SOURCE is defined, which
|
|
167 |
is needed to have fileno() declared correctly... So let's define u_int */
|
|
168 |
#if defined(OPENSSL_SYS_VMS_DECC) && !defined(__U_INT)
|
|
169 |
#define __U_INT
|
|
170 |
typedef unsigned int u_int; |
|
171 |
#endif
|
|
172 |
||
173 |
#include <openssl/lhash.h> |
|
174 |
#include <openssl/bn.h> |
|
175 |
#define USE_SOCKETS
|
|
176 |
#include "apps.h" |
|
177 |
#include <openssl/err.h> |
|
178 |
#include <openssl/pem.h> |
|
179 |
#include <openssl/x509.h> |
|
180 |
#include <openssl/ssl.h> |
|
181 |
#include <openssl/rand.h> |
|
1.1.7
by Kurt Roeckx
Import upstream version 0.9.8k |
182 |
#include <openssl/ocsp.h> |
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
183 |
#ifndef OPENSSL_NO_DH
|
184 |
#include <openssl/dh.h> |
|
185 |
#endif
|
|
186 |
#ifndef OPENSSL_NO_RSA
|
|
187 |
#include <openssl/rsa.h> |
|
188 |
#endif
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
189 |
#include "s_apps.h" |
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
190 |
#include "timeouts.h" |
1
by Christoph Martin
Import upstream version 0.9.7d |
191 |
|
192 |
#if (defined(OPENSSL_SYS_VMS) && __VMS_VER < 70000000)
|
|
193 |
/* FIONBIO used as a switch to enable ioctl, and that isn't in VMS < 7.0 */
|
|
194 |
#undef FIONBIO
|
|
195 |
#endif
|
|
196 |
||
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
197 |
#if defined(OPENSSL_SYS_BEOS_R5)
|
198 |
#include <fcntl.h> |
|
199 |
#endif
|
|
200 |
||
1
by Christoph Martin
Import upstream version 0.9.7d |
201 |
#ifndef OPENSSL_NO_RSA
|
202 |
static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength); |
|
203 |
#endif
|
|
204 |
static int sv_body(char *hostname, int s, unsigned char *context); |
|
205 |
static int www_body(char *hostname, int s, unsigned char *context); |
|
206 |
static void close_accept_socket(void ); |
|
207 |
static void sv_usage(void); |
|
208 |
static int init_ssl_connection(SSL *s); |
|
209 |
static void print_stats(BIO *bp,SSL_CTX *ctx); |
|
210 |
static int generate_session_id(const SSL *ssl, unsigned char *id, |
|
211 |
unsigned int *id_len); |
|
212 |
#ifndef OPENSSL_NO_DH
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
213 |
static DH *load_dh_param(const char *dhfile); |
1
by Christoph Martin
Import upstream version 0.9.7d |
214 |
static DH *get_dh512(void); |
215 |
#endif
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
216 |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
217 |
#ifdef MONOLITH
|
218 |
static void s_server_init(void); |
|
219 |
#endif
|
|
220 |
||
221 |
#ifndef OPENSSL_NO_DH
|
|
222 |
static unsigned char dh512_p[]={ |
|
223 |
0xDA,0x58,0x3C,0x16,0xD9,0x85,0x22,0x89,0xD0,0xE4,0xAF,0x75, |
|
224 |
0x6F,0x4C,0xCA,0x92,0xDD,0x4B,0xE5,0x33,0xB8,0x04,0xFB,0x0F, |
|
225 |
0xED,0x94,0xEF,0x9C,0x8A,0x44,0x03,0xED,0x57,0x46,0x50,0xD3, |
|
226 |
0x69,0x99,0xDB,0x29,0xD7,0x76,0x27,0x6B,0xA2,0xD3,0xD4,0x12, |
|
227 |
0xE2,0x18,0xF4,0xDD,0x1E,0x08,0x4C,0xF6,0xD8,0x00,0x3E,0x7C, |
|
228 |
0x47,0x74,0xE8,0x33, |
|
229 |
};
|
|
230 |
static unsigned char dh512_g[]={ |
|
231 |
0x02, |
|
232 |
};
|
|
233 |
||
234 |
static DH *get_dh512(void) |
|
235 |
{
|
|
236 |
DH *dh=NULL; |
|
237 |
||
238 |
if ((dh=DH_new()) == NULL) return(NULL); |
|
239 |
dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL); |
|
240 |
dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL); |
|
241 |
if ((dh->p == NULL) || (dh->g == NULL)) |
|
242 |
return(NULL); |
|
243 |
return(dh); |
|
244 |
}
|
|
245 |
#endif
|
|
246 |
||
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
247 |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
248 |
/* static int load_CA(SSL_CTX *ctx, char *file);*/
|
249 |
||
250 |
#undef BUFSIZZ
|
|
251 |
#define BUFSIZZ 16*1024
|
|
252 |
static int bufsize=BUFSIZZ; |
|
253 |
static int accept_socket= -1; |
|
254 |
||
255 |
#define TEST_CERT "server.pem"
|
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
256 |
#ifndef OPENSSL_NO_TLSEXT
|
257 |
#define TEST_CERT2 "server2.pem"
|
|
258 |
#endif
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
259 |
#undef PROG
|
260 |
#define PROG s_server_main
|
|
261 |
||
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
262 |
extern int verify_depth, verify_return_error; |
1
by Christoph Martin
Import upstream version 0.9.7d |
263 |
|
264 |
static char *cipher=NULL; |
|
265 |
static int s_server_verify=SSL_VERIFY_NONE; |
|
266 |
static int s_server_session_id_context = 1; /* anything will do */ |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
267 |
static const char *s_cert_file=TEST_CERT,*s_key_file=NULL; |
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
268 |
#ifndef OPENSSL_NO_TLSEXT
|
269 |
static const char *s_cert_file2=TEST_CERT2,*s_key_file2=NULL; |
|
270 |
#endif
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
271 |
static char *s_dcert_file=NULL,*s_dkey_file=NULL; |
272 |
#ifdef FIONBIO
|
|
273 |
static int s_nbio=0; |
|
274 |
#endif
|
|
275 |
static int s_nbio_test=0; |
|
276 |
int s_crlf=0; |
|
277 |
static SSL_CTX *ctx=NULL; |
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
278 |
#ifndef OPENSSL_NO_TLSEXT
|
279 |
static SSL_CTX *ctx2=NULL; |
|
280 |
#endif
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
281 |
static int www=0; |
282 |
||
283 |
static BIO *bio_s_out=NULL; |
|
284 |
static int s_debug=0; |
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
285 |
#ifndef OPENSSL_NO_TLSEXT
|
286 |
static int s_tlsextdebug=0; |
|
1.1.7
by Kurt Roeckx
Import upstream version 0.9.8k |
287 |
static int s_tlsextstatus=0; |
288 |
static int cert_status_cb(SSL *s, void *arg); |
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
289 |
#endif
|
1
by Christoph Martin
Import upstream version 0.9.7d |
290 |
static int s_msg=0; |
291 |
static int s_quiet=0; |
|
292 |
||
293 |
static int hack=0; |
|
294 |
#ifndef OPENSSL_NO_ENGINE
|
|
295 |
static char *engine_id=NULL; |
|
296 |
#endif
|
|
297 |
static const char *session_id_prefix=NULL; |
|
298 |
||
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
299 |
static int enable_timeouts = 0; |
1.1.8
by Kurt Roeckx
Import upstream version 0.9.8m |
300 |
static long socket_mtu; |
301 |
#ifndef OPENSSL_NO_DTLS1
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
302 |
static int cert_chain = 0; |
1.1.8
by Kurt Roeckx
Import upstream version 0.9.8m |
303 |
#endif
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
304 |
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
305 |
#ifndef OPENSSL_NO_PSK
|
306 |
static char *psk_identity="Client_identity"; |
|
307 |
char *psk_key=NULL; /* by default PSK is not used */ |
|
308 |
||
309 |
static unsigned int psk_server_cb(SSL *ssl, const char *identity, |
|
310 |
unsigned char *psk, unsigned int max_psk_len) |
|
311 |
{
|
|
312 |
unsigned int psk_len = 0; |
|
313 |
int ret; |
|
314 |
BIGNUM *bn = NULL; |
|
315 |
||
316 |
if (s_debug) |
|
317 |
BIO_printf(bio_s_out,"psk_server_cb\n"); |
|
318 |
if (!identity) |
|
319 |
{
|
|
320 |
BIO_printf(bio_err,"Error: client did not send PSK identity\n"); |
|
321 |
goto out_err; |
|
322 |
}
|
|
323 |
if (s_debug) |
|
324 |
BIO_printf(bio_s_out,"identity_len=%d identity=%s\n", |
|
325 |
identity ? (int)strlen(identity) : 0, identity); |
|
326 |
||
327 |
/* here we could lookup the given identity e.g. from a database */
|
|
328 |
if (strcmp(identity, psk_identity) != 0) |
|
329 |
{
|
|
330 |
BIO_printf(bio_s_out, "PSK error: client identity not found" |
|
331 |
" (got '%s' expected '%s')\n", identity, |
|
332 |
psk_identity); |
|
333 |
goto out_err; |
|
334 |
}
|
|
335 |
if (s_debug) |
|
336 |
BIO_printf(bio_s_out, "PSK client identity found\n"); |
|
337 |
||
338 |
/* convert the PSK key to binary */
|
|
339 |
ret = BN_hex2bn(&bn, psk_key); |
|
340 |
if (!ret) |
|
341 |
{
|
|
342 |
BIO_printf(bio_err,"Could not convert PSK key '%s' to BIGNUM\n", psk_key); |
|
343 |
if (bn) |
|
344 |
BN_free(bn); |
|
345 |
return 0; |
|
346 |
}
|
|
347 |
if (BN_num_bytes(bn) > (int)max_psk_len) |
|
348 |
{
|
|
349 |
BIO_printf(bio_err,"psk buffer of callback is too small (%d) for key (%d)\n", |
|
350 |
max_psk_len, BN_num_bytes(bn)); |
|
351 |
BN_free(bn); |
|
352 |
return 0; |
|
353 |
}
|
|
354 |
||
355 |
ret = BN_bn2bin(bn, psk); |
|
356 |
BN_free(bn); |
|
357 |
||
358 |
if (ret < 0) |
|
359 |
goto out_err; |
|
360 |
psk_len = (unsigned int)ret; |
|
361 |
||
362 |
if (s_debug) |
|
363 |
BIO_printf(bio_s_out, "fetched PSK len=%d\n", psk_len); |
|
364 |
return psk_len; |
|
365 |
out_err: |
|
366 |
if (s_debug) |
|
367 |
BIO_printf(bio_err, "Error in PSK server callback\n"); |
|
368 |
return 0; |
|
369 |
}
|
|
370 |
#endif
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
371 |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
372 |
#ifdef MONOLITH
|
373 |
static void s_server_init(void) |
|
374 |
{
|
|
375 |
accept_socket=-1; |
|
376 |
cipher=NULL; |
|
377 |
s_server_verify=SSL_VERIFY_NONE; |
|
378 |
s_dcert_file=NULL; |
|
379 |
s_dkey_file=NULL; |
|
380 |
s_cert_file=TEST_CERT; |
|
381 |
s_key_file=NULL; |
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
382 |
#ifndef OPENSSL_NO_TLSEXT
|
383 |
s_cert_file2=TEST_CERT2; |
|
384 |
s_key_file2=NULL; |
|
385 |
ctx2=NULL; |
|
386 |
#endif
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
387 |
#ifdef FIONBIO
|
388 |
s_nbio=0; |
|
389 |
#endif
|
|
390 |
s_nbio_test=0; |
|
391 |
ctx=NULL; |
|
392 |
www=0; |
|
393 |
||
394 |
bio_s_out=NULL; |
|
395 |
s_debug=0; |
|
396 |
s_msg=0; |
|
397 |
s_quiet=0; |
|
398 |
hack=0; |
|
399 |
#ifndef OPENSSL_NO_ENGINE
|
|
400 |
engine_id=NULL; |
|
401 |
#endif
|
|
402 |
}
|
|
403 |
#endif
|
|
404 |
||
405 |
static void sv_usage(void) |
|
406 |
{
|
|
407 |
BIO_printf(bio_err,"usage: s_server [args ...]\n"); |
|
408 |
BIO_printf(bio_err,"\n"); |
|
409 |
BIO_printf(bio_err," -accept arg - port to accept on (default is %d)\n",PORT); |
|
410 |
BIO_printf(bio_err," -context arg - set session ID context\n"); |
|
411 |
BIO_printf(bio_err," -verify arg - turn on peer certificate verification\n"); |
|
412 |
BIO_printf(bio_err," -Verify arg - turn on peer certificate verification, must have a cert.\n"); |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
413 |
BIO_printf(bio_err," -cert arg - certificate file to use\n"); |
1
by Christoph Martin
Import upstream version 0.9.7d |
414 |
BIO_printf(bio_err," (default is %s)\n",TEST_CERT); |
1.1.7
by Kurt Roeckx
Import upstream version 0.9.8k |
415 |
BIO_printf(bio_err," -crl_check - check the peer certificate has not been revoked by its CA.\n" \ |
416 |
" The CRL(s) are appended to the certificate file\n"); |
|
417 |
BIO_printf(bio_err," -crl_check_all - check the peer certificate has not been revoked by its CA\n" \ |
|
418 |
" or any other CRL in the CA chain. CRL(s) are appened to the\n" \ |
|
419 |
" the certificate file.\n"); |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
420 |
BIO_printf(bio_err," -certform arg - certificate format (PEM or DER) PEM default\n"); |
421 |
BIO_printf(bio_err," -key arg - Private Key file to use, in cert file if\n"); |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
422 |
BIO_printf(bio_err," not specified (default is %s)\n",TEST_CERT); |
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
423 |
BIO_printf(bio_err," -keyform arg - key format (PEM, DER or ENGINE) PEM default\n"); |
424 |
BIO_printf(bio_err," -pass arg - private key file pass phrase source\n"); |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
425 |
BIO_printf(bio_err," -dcert arg - second certificate file to use (usually for DSA)\n"); |
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
426 |
BIO_printf(bio_err," -dcertform x - second certificate format (PEM or DER) PEM default\n"); |
1
by Christoph Martin
Import upstream version 0.9.7d |
427 |
BIO_printf(bio_err," -dkey arg - second private key file to use (usually for DSA)\n"); |
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
428 |
BIO_printf(bio_err," -dkeyform arg - second key format (PEM, DER or ENGINE) PEM default\n"); |
429 |
BIO_printf(bio_err," -dpass arg - second private key file pass phrase source\n"); |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
430 |
BIO_printf(bio_err," -dhparam arg - DH parameter file to use, in cert file if not specified\n"); |
431 |
BIO_printf(bio_err," or a default set of parameters is used\n"); |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
432 |
#ifndef OPENSSL_NO_ECDH
|
433 |
BIO_printf(bio_err," -named_curve arg - Elliptic curve name to use for ephemeral ECDH keys.\n" \ |
|
434 |
" Use \"openssl ecparam -list_curves\" for all names\n" \ |
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
435 |
" (default is nistp256).\n"); |
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
436 |
#endif
|
1
by Christoph Martin
Import upstream version 0.9.7d |
437 |
#ifdef FIONBIO
|
438 |
BIO_printf(bio_err," -nbio - Run with non-blocking IO\n"); |
|
439 |
#endif
|
|
440 |
BIO_printf(bio_err," -nbio_test - test with the non-blocking test bio\n"); |
|
441 |
BIO_printf(bio_err," -crlf - convert LF from terminal into CRLF\n"); |
|
442 |
BIO_printf(bio_err," -debug - Print more output\n"); |
|
443 |
BIO_printf(bio_err," -msg - Show protocol messages\n"); |
|
444 |
BIO_printf(bio_err," -state - Print the SSL states\n"); |
|
445 |
BIO_printf(bio_err," -CApath arg - PEM format directory of CA's\n"); |
|
446 |
BIO_printf(bio_err," -CAfile arg - PEM format file of CA's\n"); |
|
447 |
BIO_printf(bio_err," -nocert - Don't use any certificates (Anon-DH)\n"); |
|
448 |
BIO_printf(bio_err," -cipher arg - play with 'openssl ciphers' to see what goes here\n"); |
|
449 |
BIO_printf(bio_err," -serverpref - Use server's cipher preferences\n"); |
|
450 |
BIO_printf(bio_err," -quiet - No server output\n"); |
|
451 |
BIO_printf(bio_err," -no_tmp_rsa - Do not generate a tmp RSA key\n"); |
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
452 |
#ifndef OPENSSL_NO_PSK
|
453 |
BIO_printf(bio_err," -psk_hint arg - PSK identity hint to use\n"); |
|
454 |
BIO_printf(bio_err," -psk arg - PSK in hex (without 0x)\n"); |
|
455 |
# ifndef OPENSSL_NO_JPAKE
|
|
456 |
BIO_printf(bio_err," -jpake arg - JPAKE secret to use\n"); |
|
457 |
# endif
|
|
458 |
#endif
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
459 |
BIO_printf(bio_err," -ssl2 - Just talk SSLv2\n"); |
460 |
BIO_printf(bio_err," -ssl3 - Just talk SSLv3\n"); |
|
461 |
BIO_printf(bio_err," -tls1 - Just talk TLSv1\n"); |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
462 |
BIO_printf(bio_err," -dtls1 - Just talk DTLSv1\n"); |
463 |
BIO_printf(bio_err," -timeout - Enable timeouts\n"); |
|
1.1.8
by Kurt Roeckx
Import upstream version 0.9.8m |
464 |
BIO_printf(bio_err," -mtu - Set link layer MTU\n"); |
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
465 |
BIO_printf(bio_err," -chain - Read a certificate chain\n"); |
1
by Christoph Martin
Import upstream version 0.9.7d |
466 |
BIO_printf(bio_err," -no_ssl2 - Just disable SSLv2\n"); |
467 |
BIO_printf(bio_err," -no_ssl3 - Just disable SSLv3\n"); |
|
468 |
BIO_printf(bio_err," -no_tls1 - Just disable TLSv1\n"); |
|
469 |
#ifndef OPENSSL_NO_DH
|
|
470 |
BIO_printf(bio_err," -no_dhe - Disable ephemeral DH\n"); |
|
471 |
#endif
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
472 |
#ifndef OPENSSL_NO_ECDH
|
473 |
BIO_printf(bio_err," -no_ecdhe - Disable ephemeral ECDH\n"); |
|
474 |
#endif
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
475 |
BIO_printf(bio_err," -bugs - Turn on SSL bug compatibility\n"); |
476 |
BIO_printf(bio_err," -www - Respond to a 'GET /' with a status page\n"); |
|
477 |
BIO_printf(bio_err," -WWW - Respond to a 'GET /<path> HTTP/1.0' with file ./<path>\n"); |
|
478 |
BIO_printf(bio_err," -HTTP - Respond to a 'GET /<path> HTTP/1.0' with file ./<path>\n"); |
|
479 |
BIO_printf(bio_err," with the assumption it contains a complete HTTP response.\n"); |
|
480 |
#ifndef OPENSSL_NO_ENGINE
|
|
481 |
BIO_printf(bio_err," -engine id - Initialise and use the specified engine\n"); |
|
482 |
#endif
|
|
483 |
BIO_printf(bio_err," -id_prefix arg - Generate SSL/TLS session IDs prefixed by 'arg'\n"); |
|
484 |
BIO_printf(bio_err," -rand file%cfile%c...\n", LIST_SEPARATOR_CHAR, LIST_SEPARATOR_CHAR); |
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
485 |
#ifndef OPENSSL_NO_TLSEXT
|
486 |
BIO_printf(bio_err," -servername host - servername for HostName TLS extension\n"); |
|
487 |
BIO_printf(bio_err," -servername_fatal - on mismatch send fatal alert (default warning alert)\n"); |
|
488 |
BIO_printf(bio_err," -cert2 arg - certificate file to use for servername\n"); |
|
489 |
BIO_printf(bio_err," (default is %s)\n",TEST_CERT2); |
|
490 |
BIO_printf(bio_err," -key2 arg - Private Key file to use for servername, in cert file if\n"); |
|
491 |
BIO_printf(bio_err," not specified (default is %s)\n",TEST_CERT2); |
|
492 |
BIO_printf(bio_err," -tlsextdebug - hex dump of all TLS extensions received\n"); |
|
493 |
BIO_printf(bio_err," -no_ticket - disable use of RFC4507bis session tickets\n"); |
|
1.1.8
by Kurt Roeckx
Import upstream version 0.9.8m |
494 |
BIO_printf(bio_err," -legacy_renegotiation - enable use of legacy renegotiation (dangerous)\n"); |
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
495 |
#endif
|
1
by Christoph Martin
Import upstream version 0.9.7d |
496 |
}
|
497 |
||
498 |
static int local_argc=0; |
|
499 |
static char **local_argv; |
|
500 |
||
501 |
#ifdef CHARSET_EBCDIC
|
|
502 |
static int ebcdic_new(BIO *bi); |
|
503 |
static int ebcdic_free(BIO *a); |
|
504 |
static int ebcdic_read(BIO *b, char *out, int outl); |
|
505 |
static int ebcdic_write(BIO *b, const char *in, int inl); |
|
506 |
static long ebcdic_ctrl(BIO *b, int cmd, long num, void *ptr); |
|
507 |
static int ebcdic_gets(BIO *bp, char *buf, int size); |
|
508 |
static int ebcdic_puts(BIO *bp, const char *str); |
|
509 |
||
510 |
#define BIO_TYPE_EBCDIC_FILTER (18|0x0200)
|
|
511 |
static BIO_METHOD methods_ebcdic= |
|
512 |
{
|
|
513 |
BIO_TYPE_EBCDIC_FILTER, |
|
514 |
"EBCDIC/ASCII filter", |
|
515 |
ebcdic_write, |
|
516 |
ebcdic_read, |
|
517 |
ebcdic_puts, |
|
518 |
ebcdic_gets, |
|
519 |
ebcdic_ctrl, |
|
520 |
ebcdic_new, |
|
521 |
ebcdic_free, |
|
522 |
};
|
|
523 |
||
524 |
typedef struct |
|
525 |
{
|
|
526 |
size_t alloced; |
|
527 |
char buff[1]; |
|
528 |
} EBCDIC_OUTBUFF; |
|
529 |
||
530 |
BIO_METHOD *BIO_f_ebcdic_filter() |
|
531 |
{
|
|
532 |
return(&methods_ebcdic); |
|
533 |
}
|
|
534 |
||
535 |
static int ebcdic_new(BIO *bi) |
|
536 |
{
|
|
537 |
EBCDIC_OUTBUFF *wbuf; |
|
538 |
||
539 |
wbuf = (EBCDIC_OUTBUFF *)OPENSSL_malloc(sizeof(EBCDIC_OUTBUFF) + 1024); |
|
540 |
wbuf->alloced = 1024; |
|
541 |
wbuf->buff[0] = '\0'; |
|
542 |
||
543 |
bi->ptr=(char *)wbuf; |
|
544 |
bi->init=1; |
|
545 |
bi->flags=0; |
|
546 |
return(1); |
|
547 |
}
|
|
548 |
||
549 |
static int ebcdic_free(BIO *a) |
|
550 |
{
|
|
551 |
if (a == NULL) return(0); |
|
552 |
if (a->ptr != NULL) |
|
553 |
OPENSSL_free(a->ptr); |
|
554 |
a->ptr=NULL; |
|
555 |
a->init=0; |
|
556 |
a->flags=0; |
|
557 |
return(1); |
|
558 |
}
|
|
559 |
||
560 |
static int ebcdic_read(BIO *b, char *out, int outl) |
|
561 |
{
|
|
562 |
int ret=0; |
|
563 |
||
564 |
if (out == NULL || outl == 0) return(0); |
|
565 |
if (b->next_bio == NULL) return(0); |
|
566 |
||
567 |
ret=BIO_read(b->next_bio,out,outl); |
|
568 |
if (ret > 0) |
|
569 |
ascii2ebcdic(out,out,ret); |
|
570 |
return(ret); |
|
571 |
}
|
|
572 |
||
573 |
static int ebcdic_write(BIO *b, const char *in, int inl) |
|
574 |
{
|
|
575 |
EBCDIC_OUTBUFF *wbuf; |
|
576 |
int ret=0; |
|
577 |
int num; |
|
578 |
unsigned char n; |
|
579 |
||
580 |
if ((in == NULL) || (inl <= 0)) return(0); |
|
581 |
if (b->next_bio == NULL) return(0); |
|
582 |
||
583 |
wbuf=(EBCDIC_OUTBUFF *)b->ptr; |
|
584 |
||
585 |
if (inl > (num = wbuf->alloced)) |
|
586 |
{
|
|
587 |
num = num + num; /* double the size */ |
|
588 |
if (num < inl) |
|
589 |
num = inl; |
|
590 |
OPENSSL_free(wbuf); |
|
591 |
wbuf=(EBCDIC_OUTBUFF *)OPENSSL_malloc(sizeof(EBCDIC_OUTBUFF) + num); |
|
592 |
||
593 |
wbuf->alloced = num; |
|
594 |
wbuf->buff[0] = '\0'; |
|
595 |
||
596 |
b->ptr=(char *)wbuf; |
|
597 |
}
|
|
598 |
||
599 |
ebcdic2ascii(wbuf->buff, in, inl); |
|
600 |
||
601 |
ret=BIO_write(b->next_bio, wbuf->buff, inl); |
|
602 |
||
603 |
return(ret); |
|
604 |
}
|
|
605 |
||
606 |
static long ebcdic_ctrl(BIO *b, int cmd, long num, void *ptr) |
|
607 |
{
|
|
608 |
long ret; |
|
609 |
||
610 |
if (b->next_bio == NULL) return(0); |
|
611 |
switch (cmd) |
|
612 |
{
|
|
613 |
case BIO_CTRL_DUP: |
|
614 |
ret=0L; |
|
615 |
break; |
|
616 |
default: |
|
617 |
ret=BIO_ctrl(b->next_bio,cmd,num,ptr); |
|
618 |
break; |
|
619 |
}
|
|
620 |
return(ret); |
|
621 |
}
|
|
622 |
||
623 |
static int ebcdic_gets(BIO *bp, char *buf, int size) |
|
624 |
{
|
|
625 |
int i, ret=0; |
|
626 |
if (bp->next_bio == NULL) return(0); |
|
627 |
/* return(BIO_gets(bp->next_bio,buf,size));*/
|
|
628 |
for (i=0; i<size-1; ++i) |
|
629 |
{
|
|
630 |
ret = ebcdic_read(bp,&buf[i],1); |
|
631 |
if (ret <= 0) |
|
632 |
break; |
|
633 |
else if (buf[i] == '\n') |
|
634 |
{
|
|
635 |
++i; |
|
636 |
break; |
|
637 |
}
|
|
638 |
}
|
|
639 |
if (i < size) |
|
640 |
buf[i] = '\0'; |
|
641 |
return (ret < 0 && i == 0) ? ret : i; |
|
642 |
}
|
|
643 |
||
644 |
static int ebcdic_puts(BIO *bp, const char *str) |
|
645 |
{
|
|
646 |
if (bp->next_bio == NULL) return(0); |
|
647 |
return ebcdic_write(bp, str, strlen(str)); |
|
648 |
}
|
|
649 |
#endif
|
|
650 |
||
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
651 |
#ifndef OPENSSL_NO_TLSEXT
|
652 |
||
653 |
/* This is a context that we pass to callbacks */
|
|
654 |
typedef struct tlsextctx_st { |
|
655 |
char * servername; |
|
656 |
BIO * biodebug; |
|
657 |
int extension_error; |
|
658 |
} tlsextctx; |
|
659 |
||
660 |
||
661 |
static int MS_CALLBACK ssl_servername_cb(SSL *s, int *ad, void *arg) |
|
662 |
{
|
|
663 |
tlsextctx * p = (tlsextctx *) arg; |
|
664 |
const char * servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name); |
|
665 |
if (servername && p->biodebug) |
|
666 |
BIO_printf(p->biodebug,"Hostname in TLS extension: \"%s\"\n",servername); |
|
667 |
||
668 |
if (!p->servername) |
|
669 |
return SSL_TLSEXT_ERR_NOACK; |
|
670 |
||
671 |
if (servername) |
|
672 |
{
|
|
673 |
if (strcmp(servername,p->servername)) |
|
674 |
return p->extension_error; |
|
675 |
if (ctx2) |
|
676 |
{
|
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
677 |
BIO_printf(p->biodebug,"Switching server context.\n"); |
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
678 |
SSL_set_SSL_CTX(s,ctx2); |
679 |
}
|
|
680 |
}
|
|
681 |
return SSL_TLSEXT_ERR_OK; |
|
682 |
}
|
|
1.1.7
by Kurt Roeckx
Import upstream version 0.9.8k |
683 |
|
684 |
/* Structure passed to cert status callback */
|
|
685 |
||
686 |
typedef struct tlsextstatusctx_st { |
|
687 |
/* Default responder to use */
|
|
688 |
char *host, *path, *port; |
|
689 |
int use_ssl; |
|
690 |
int timeout; |
|
691 |
BIO *err; |
|
692 |
int verbose; |
|
693 |
} tlsextstatusctx; |
|
694 |
||
695 |
static tlsextstatusctx tlscstatp = {NULL, NULL, NULL, 0, -1, NULL, 0}; |
|
696 |
||
697 |
/* Certificate Status callback. This is called when a client includes a
|
|
698 |
* certificate status request extension.
|
|
699 |
*
|
|
700 |
* This is a simplified version. It examines certificates each time and
|
|
701 |
* makes one OCSP responder query for each request.
|
|
702 |
*
|
|
703 |
* A full version would store details such as the OCSP certificate IDs and
|
|
704 |
* minimise the number of OCSP responses by caching them until they were
|
|
705 |
* considered "expired".
|
|
706 |
*/
|
|
707 |
||
708 |
static int cert_status_cb(SSL *s, void *arg) |
|
709 |
{
|
|
710 |
tlsextstatusctx *srctx = arg; |
|
711 |
BIO *err = srctx->err; |
|
712 |
char *host, *port, *path; |
|
713 |
int use_ssl; |
|
714 |
unsigned char *rspder = NULL; |
|
715 |
int rspderlen; |
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
716 |
STACK_OF(OPENSSL_STRING) *aia = NULL; |
1.1.7
by Kurt Roeckx
Import upstream version 0.9.8k |
717 |
X509 *x = NULL; |
718 |
X509_STORE_CTX inctx; |
|
719 |
X509_OBJECT obj; |
|
720 |
OCSP_REQUEST *req = NULL; |
|
721 |
OCSP_RESPONSE *resp = NULL; |
|
722 |
OCSP_CERTID *id = NULL; |
|
723 |
STACK_OF(X509_EXTENSION) *exts; |
|
724 |
int ret = SSL_TLSEXT_ERR_NOACK; |
|
725 |
int i; |
|
726 |
#if 0
|
|
727 |
STACK_OF(OCSP_RESPID) *ids;
|
|
728 |
SSL_get_tlsext_status_ids(s, &ids);
|
|
729 |
BIO_printf(err, "cert_status: received %d ids\n", sk_OCSP_RESPID_num(ids));
|
|
730 |
#endif
|
|
731 |
if (srctx->verbose) |
|
732 |
BIO_puts(err, "cert_status: callback called\n"); |
|
733 |
/* Build up OCSP query from server certificate */
|
|
734 |
x = SSL_get_certificate(s); |
|
735 |
aia = X509_get1_ocsp(x); |
|
736 |
if (aia) |
|
737 |
{
|
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
738 |
if (!OCSP_parse_url(sk_OPENSSL_STRING_value(aia, 0), |
1.1.7
by Kurt Roeckx
Import upstream version 0.9.8k |
739 |
&host, &port, &path, &use_ssl)) |
740 |
{
|
|
741 |
BIO_puts(err, "cert_status: can't parse AIA URL\n"); |
|
742 |
goto err; |
|
743 |
}
|
|
744 |
if (srctx->verbose) |
|
745 |
BIO_printf(err, "cert_status: AIA URL: %s\n", |
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
746 |
sk_OPENSSL_STRING_value(aia, 0)); |
1.1.7
by Kurt Roeckx
Import upstream version 0.9.8k |
747 |
}
|
748 |
else
|
|
749 |
{
|
|
750 |
if (!srctx->host) |
|
751 |
{
|
|
752 |
BIO_puts(srctx->err, "cert_status: no AIA and no default responder URL\n"); |
|
753 |
goto done; |
|
754 |
}
|
|
755 |
host = srctx->host; |
|
756 |
path = srctx->path; |
|
757 |
port = srctx->port; |
|
758 |
use_ssl = srctx->use_ssl; |
|
759 |
}
|
|
760 |
||
761 |
if (!X509_STORE_CTX_init(&inctx, |
|
762 |
SSL_CTX_get_cert_store(SSL_get_SSL_CTX(s)), |
|
763 |
NULL, NULL)) |
|
764 |
goto err; |
|
765 |
if (X509_STORE_get_by_subject(&inctx,X509_LU_X509, |
|
766 |
X509_get_issuer_name(x),&obj) <= 0) |
|
767 |
{
|
|
768 |
BIO_puts(err, "cert_status: Can't retrieve issuer certificate.\n"); |
|
769 |
X509_STORE_CTX_cleanup(&inctx); |
|
770 |
goto done; |
|
771 |
}
|
|
772 |
req = OCSP_REQUEST_new(); |
|
773 |
if (!req) |
|
774 |
goto err; |
|
775 |
id = OCSP_cert_to_id(NULL, x, obj.data.x509); |
|
776 |
X509_free(obj.data.x509); |
|
777 |
X509_STORE_CTX_cleanup(&inctx); |
|
778 |
if (!id) |
|
779 |
goto err; |
|
780 |
if (!OCSP_request_add0_id(req, id)) |
|
781 |
goto err; |
|
782 |
id = NULL; |
|
783 |
/* Add any extensions to the request */
|
|
784 |
SSL_get_tlsext_status_exts(s, &exts); |
|
785 |
for (i = 0; i < sk_X509_EXTENSION_num(exts); i++) |
|
786 |
{
|
|
787 |
X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i); |
|
788 |
if (!OCSP_REQUEST_add_ext(req, ext, -1)) |
|
789 |
goto err; |
|
790 |
}
|
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
791 |
resp = process_responder(err, req, host, path, port, use_ssl, NULL, |
1.1.7
by Kurt Roeckx
Import upstream version 0.9.8k |
792 |
srctx->timeout); |
793 |
if (!resp) |
|
794 |
{
|
|
795 |
BIO_puts(err, "cert_status: error querying responder\n"); |
|
796 |
goto done; |
|
797 |
}
|
|
798 |
rspderlen = i2d_OCSP_RESPONSE(resp, &rspder); |
|
799 |
if (rspderlen <= 0) |
|
800 |
goto err; |
|
801 |
SSL_set_tlsext_status_ocsp_resp(s, rspder, rspderlen); |
|
802 |
if (srctx->verbose) |
|
803 |
{
|
|
804 |
BIO_puts(err, "cert_status: ocsp response sent:\n"); |
|
805 |
OCSP_RESPONSE_print(err, resp, 2); |
|
806 |
}
|
|
807 |
ret = SSL_TLSEXT_ERR_OK; |
|
808 |
done: |
|
809 |
if (ret != SSL_TLSEXT_ERR_OK) |
|
810 |
ERR_print_errors(err); |
|
811 |
if (aia) |
|
812 |
{
|
|
813 |
OPENSSL_free(host); |
|
814 |
OPENSSL_free(path); |
|
815 |
OPENSSL_free(port); |
|
816 |
X509_email_free(aia); |
|
817 |
}
|
|
818 |
if (id) |
|
819 |
OCSP_CERTID_free(id); |
|
820 |
if (req) |
|
821 |
OCSP_REQUEST_free(req); |
|
822 |
if (resp) |
|
823 |
OCSP_RESPONSE_free(resp); |
|
824 |
return ret; |
|
825 |
err: |
|
826 |
ret = SSL_TLSEXT_ERR_ALERT_FATAL; |
|
827 |
goto done; |
|
828 |
}
|
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
829 |
#endif
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
830 |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
831 |
int MAIN(int, char **); |
832 |
||
1.1.7
by Kurt Roeckx
Import upstream version 0.9.8k |
833 |
#ifndef OPENSSL_NO_JPAKE
|
834 |
static char *jpake_secret = NULL; |
|
835 |
#endif
|
|
836 |
||
1
by Christoph Martin
Import upstream version 0.9.7d |
837 |
int MAIN(int argc, char *argv[]) |
838 |
{
|
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
839 |
X509_VERIFY_PARAM *vpm = NULL; |
840 |
int badarg = 0; |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
841 |
short port=PORT; |
842 |
char *CApath=NULL,*CAfile=NULL; |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
843 |
unsigned char *context = NULL; |
1
by Christoph Martin
Import upstream version 0.9.7d |
844 |
char *dhfile = NULL; |
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
845 |
#ifndef OPENSSL_NO_ECDH
|
846 |
char *named_curve = NULL; |
|
847 |
#endif
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
848 |
int badop=0,bugs=0; |
849 |
int ret=1; |
|
850 |
int off=0; |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
851 |
int no_tmp_rsa=0,no_dhe=0,no_ecdhe=0,nocert=0; |
1
by Christoph Martin
Import upstream version 0.9.7d |
852 |
int state=0; |
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
853 |
const SSL_METHOD *meth=NULL; |
854 |
int socket_type=SOCK_STREAM; |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
855 |
ENGINE *e=NULL; |
856 |
char *inrand=NULL; |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
857 |
int s_cert_format = FORMAT_PEM, s_key_format = FORMAT_PEM; |
858 |
char *passarg = NULL, *pass = NULL; |
|
859 |
char *dpassarg = NULL, *dpass = NULL; |
|
860 |
int s_dcert_format = FORMAT_PEM, s_dkey_format = FORMAT_PEM; |
|
861 |
X509 *s_cert = NULL, *s_dcert = NULL; |
|
862 |
EVP_PKEY *s_key = NULL, *s_dkey = NULL; |
|
1.1.8
by Kurt Roeckx
Import upstream version 0.9.8m |
863 |
int no_cache = 0; |
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
864 |
#ifndef OPENSSL_NO_TLSEXT
|
865 |
EVP_PKEY *s_key2 = NULL; |
|
866 |
X509 *s_cert2 = NULL; |
|
867 |
#endif
|
|
868 |
#ifndef OPENSSL_NO_TLSEXT
|
|
869 |
tlsextctx tlsextcbp = {NULL, NULL, SSL_TLSEXT_ERR_ALERT_WARNING}; |
|
870 |
#endif
|
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
871 |
#ifndef OPENSSL_NO_PSK
|
872 |
/* by default do not send a PSK identity hint */
|
|
873 |
static char *psk_identity_hint=NULL; |
|
874 |
#endif
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
875 |
#if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
|
876 |
meth=SSLv23_server_method(); |
|
877 |
#elif !defined(OPENSSL_NO_SSL3)
|
|
878 |
meth=SSLv3_server_method(); |
|
879 |
#elif !defined(OPENSSL_NO_SSL2)
|
|
880 |
meth=SSLv2_server_method(); |
|
881 |
#endif
|
|
882 |
||
883 |
local_argc=argc; |
|
884 |
local_argv=argv; |
|
885 |
||
886 |
apps_startup(); |
|
887 |
#ifdef MONOLITH
|
|
888 |
s_server_init(); |
|
889 |
#endif
|
|
890 |
||
891 |
if (bio_err == NULL) |
|
892 |
bio_err=BIO_new_fp(stderr,BIO_NOCLOSE); |
|
893 |
||
894 |
if (!load_config(bio_err, NULL)) |
|
895 |
goto end; |
|
896 |
||
897 |
verify_depth=0; |
|
898 |
#ifdef FIONBIO
|
|
899 |
s_nbio=0; |
|
900 |
#endif
|
|
901 |
s_nbio_test=0; |
|
902 |
||
903 |
argc--; |
|
904 |
argv++; |
|
905 |
||
906 |
while (argc >= 1) |
|
907 |
{
|
|
908 |
if ((strcmp(*argv,"-port") == 0) || |
|
909 |
(strcmp(*argv,"-accept") == 0)) |
|
910 |
{
|
|
911 |
if (--argc < 1) goto bad; |
|
912 |
if (!extract_port(*(++argv),&port)) |
|
913 |
goto bad; |
|
914 |
}
|
|
915 |
else if (strcmp(*argv,"-verify") == 0) |
|
916 |
{
|
|
917 |
s_server_verify=SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE; |
|
918 |
if (--argc < 1) goto bad; |
|
919 |
verify_depth=atoi(*(++argv)); |
|
920 |
BIO_printf(bio_err,"verify depth is %d\n",verify_depth); |
|
921 |
}
|
|
922 |
else if (strcmp(*argv,"-Verify") == 0) |
|
923 |
{
|
|
924 |
s_server_verify=SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT| |
|
925 |
SSL_VERIFY_CLIENT_ONCE; |
|
926 |
if (--argc < 1) goto bad; |
|
927 |
verify_depth=atoi(*(++argv)); |
|
928 |
BIO_printf(bio_err,"verify depth is %d, must return a certificate\n",verify_depth); |
|
929 |
}
|
|
930 |
else if (strcmp(*argv,"-context") == 0) |
|
931 |
{
|
|
932 |
if (--argc < 1) goto bad; |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
933 |
context= (unsigned char *)*(++argv); |
1
by Christoph Martin
Import upstream version 0.9.7d |
934 |
}
|
935 |
else if (strcmp(*argv,"-cert") == 0) |
|
936 |
{
|
|
937 |
if (--argc < 1) goto bad; |
|
938 |
s_cert_file= *(++argv); |
|
939 |
}
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
940 |
else if (strcmp(*argv,"-certform") == 0) |
941 |
{
|
|
942 |
if (--argc < 1) goto bad; |
|
943 |
s_cert_format = str2fmt(*(++argv)); |
|
944 |
}
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
945 |
else if (strcmp(*argv,"-key") == 0) |
946 |
{
|
|
947 |
if (--argc < 1) goto bad; |
|
948 |
s_key_file= *(++argv); |
|
949 |
}
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
950 |
else if (strcmp(*argv,"-keyform") == 0) |
951 |
{
|
|
952 |
if (--argc < 1) goto bad; |
|
953 |
s_key_format = str2fmt(*(++argv)); |
|
954 |
}
|
|
955 |
else if (strcmp(*argv,"-pass") == 0) |
|
956 |
{
|
|
957 |
if (--argc < 1) goto bad; |
|
958 |
passarg = *(++argv); |
|
959 |
}
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
960 |
else if (strcmp(*argv,"-dhparam") == 0) |
961 |
{
|
|
962 |
if (--argc < 1) goto bad; |
|
963 |
dhfile = *(++argv); |
|
964 |
}
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
965 |
#ifndef OPENSSL_NO_ECDH
|
966 |
else if (strcmp(*argv,"-named_curve") == 0) |
|
967 |
{
|
|
968 |
if (--argc < 1) goto bad; |
|
969 |
named_curve = *(++argv); |
|
970 |
}
|
|
971 |
#endif
|
|
972 |
else if (strcmp(*argv,"-dcertform") == 0) |
|
973 |
{
|
|
974 |
if (--argc < 1) goto bad; |
|
975 |
s_dcert_format = str2fmt(*(++argv)); |
|
976 |
}
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
977 |
else if (strcmp(*argv,"-dcert") == 0) |
978 |
{
|
|
979 |
if (--argc < 1) goto bad; |
|
980 |
s_dcert_file= *(++argv); |
|
981 |
}
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
982 |
else if (strcmp(*argv,"-dkeyform") == 0) |
983 |
{
|
|
984 |
if (--argc < 1) goto bad; |
|
985 |
s_dkey_format = str2fmt(*(++argv)); |
|
986 |
}
|
|
987 |
else if (strcmp(*argv,"-dpass") == 0) |
|
988 |
{
|
|
989 |
if (--argc < 1) goto bad; |
|
990 |
dpassarg = *(++argv); |
|
991 |
}
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
992 |
else if (strcmp(*argv,"-dkey") == 0) |
993 |
{
|
|
994 |
if (--argc < 1) goto bad; |
|
995 |
s_dkey_file= *(++argv); |
|
996 |
}
|
|
997 |
else if (strcmp(*argv,"-nocert") == 0) |
|
998 |
{
|
|
999 |
nocert=1; |
|
1000 |
}
|
|
1001 |
else if (strcmp(*argv,"-CApath") == 0) |
|
1002 |
{
|
|
1003 |
if (--argc < 1) goto bad; |
|
1004 |
CApath= *(++argv); |
|
1005 |
}
|
|
1.1.8
by Kurt Roeckx
Import upstream version 0.9.8m |
1006 |
else if (strcmp(*argv,"-no_cache") == 0) |
1007 |
no_cache = 1; |
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1008 |
else if (args_verify(&argv, &argc, &badarg, bio_err, &vpm)) |
1009 |
{
|
|
1010 |
if (badarg) |
|
1011 |
goto bad; |
|
1012 |
continue; |
|
1013 |
}
|
|
1014 |
else if (strcmp(*argv,"-verify_return_error") == 0) |
|
1015 |
verify_return_error = 1; |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1016 |
else if (strcmp(*argv,"-serverpref") == 0) |
1017 |
{ off|=SSL_OP_CIPHER_SERVER_PREFERENCE; } |
|
1.1.8
by Kurt Roeckx
Import upstream version 0.9.8m |
1018 |
else if (strcmp(*argv,"-legacy_renegotiation") == 0) |
1019 |
off|=SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION; |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1020 |
else if (strcmp(*argv,"-cipher") == 0) |
1021 |
{
|
|
1022 |
if (--argc < 1) goto bad; |
|
1023 |
cipher= *(++argv); |
|
1024 |
}
|
|
1025 |
else if (strcmp(*argv,"-CAfile") == 0) |
|
1026 |
{
|
|
1027 |
if (--argc < 1) goto bad; |
|
1028 |
CAfile= *(++argv); |
|
1029 |
}
|
|
1030 |
#ifdef FIONBIO
|
|
1031 |
else if (strcmp(*argv,"-nbio") == 0) |
|
1032 |
{ s_nbio=1; } |
|
1033 |
#endif
|
|
1034 |
else if (strcmp(*argv,"-nbio_test") == 0) |
|
1035 |
{
|
|
1036 |
#ifdef FIONBIO
|
|
1037 |
s_nbio=1; |
|
1038 |
#endif
|
|
1039 |
s_nbio_test=1; |
|
1040 |
}
|
|
1041 |
else if (strcmp(*argv,"-debug") == 0) |
|
1042 |
{ s_debug=1; } |
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1043 |
#ifndef OPENSSL_NO_TLSEXT
|
1044 |
else if (strcmp(*argv,"-tlsextdebug") == 0) |
|
1045 |
s_tlsextdebug=1; |
|
1.1.7
by Kurt Roeckx
Import upstream version 0.9.8k |
1046 |
else if (strcmp(*argv,"-status") == 0) |
1047 |
s_tlsextstatus=1; |
|
1048 |
else if (strcmp(*argv,"-status_verbose") == 0) |
|
1049 |
{
|
|
1050 |
s_tlsextstatus=1; |
|
1051 |
tlscstatp.verbose = 1; |
|
1052 |
}
|
|
1053 |
else if (!strcmp(*argv, "-status_timeout")) |
|
1054 |
{
|
|
1055 |
s_tlsextstatus=1; |
|
1056 |
if (--argc < 1) goto bad; |
|
1057 |
tlscstatp.timeout = atoi(*(++argv)); |
|
1058 |
}
|
|
1059 |
else if (!strcmp(*argv, "-status_url")) |
|
1060 |
{
|
|
1061 |
s_tlsextstatus=1; |
|
1062 |
if (--argc < 1) goto bad; |
|
1063 |
if (!OCSP_parse_url(*(++argv), |
|
1064 |
&tlscstatp.host, |
|
1065 |
&tlscstatp.port, |
|
1066 |
&tlscstatp.path, |
|
1067 |
&tlscstatp.use_ssl)) |
|
1068 |
{
|
|
1069 |
BIO_printf(bio_err, "Error parsing URL\n"); |
|
1070 |
goto bad; |
|
1071 |
}
|
|
1072 |
}
|
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1073 |
#endif
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1074 |
else if (strcmp(*argv,"-msg") == 0) |
1075 |
{ s_msg=1; } |
|
1076 |
else if (strcmp(*argv,"-hack") == 0) |
|
1077 |
{ hack=1; } |
|
1078 |
else if (strcmp(*argv,"-state") == 0) |
|
1079 |
{ state=1; } |
|
1080 |
else if (strcmp(*argv,"-crlf") == 0) |
|
1081 |
{ s_crlf=1; } |
|
1082 |
else if (strcmp(*argv,"-quiet") == 0) |
|
1083 |
{ s_quiet=1; } |
|
1084 |
else if (strcmp(*argv,"-bugs") == 0) |
|
1085 |
{ bugs=1; } |
|
1086 |
else if (strcmp(*argv,"-no_tmp_rsa") == 0) |
|
1087 |
{ no_tmp_rsa=1; } |
|
1088 |
else if (strcmp(*argv,"-no_dhe") == 0) |
|
1089 |
{ no_dhe=1; } |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1090 |
else if (strcmp(*argv,"-no_ecdhe") == 0) |
1091 |
{ no_ecdhe=1; } |
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1092 |
#ifndef OPENSSL_NO_PSK
|
1093 |
else if (strcmp(*argv,"-psk_hint") == 0) |
|
1094 |
{
|
|
1095 |
if (--argc < 1) goto bad; |
|
1096 |
psk_identity_hint= *(++argv); |
|
1097 |
}
|
|
1098 |
else if (strcmp(*argv,"-psk") == 0) |
|
1099 |
{
|
|
1100 |
size_t i; |
|
1101 |
||
1102 |
if (--argc < 1) goto bad; |
|
1103 |
psk_key=*(++argv); |
|
1104 |
for (i=0; i<strlen(psk_key); i++) |
|
1105 |
{
|
|
1106 |
if (isxdigit((int)psk_key[i])) |
|
1107 |
continue; |
|
1108 |
BIO_printf(bio_err,"Not a hex number '%s'\n",*argv); |
|
1109 |
goto bad; |
|
1110 |
}
|
|
1111 |
}
|
|
1112 |
#endif
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1113 |
else if (strcmp(*argv,"-www") == 0) |
1114 |
{ www=1; } |
|
1115 |
else if (strcmp(*argv,"-WWW") == 0) |
|
1116 |
{ www=2; } |
|
1117 |
else if (strcmp(*argv,"-HTTP") == 0) |
|
1118 |
{ www=3; } |
|
1119 |
else if (strcmp(*argv,"-no_ssl2") == 0) |
|
1120 |
{ off|=SSL_OP_NO_SSLv2; } |
|
1121 |
else if (strcmp(*argv,"-no_ssl3") == 0) |
|
1122 |
{ off|=SSL_OP_NO_SSLv3; } |
|
1123 |
else if (strcmp(*argv,"-no_tls1") == 0) |
|
1124 |
{ off|=SSL_OP_NO_TLSv1; } |
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1125 |
else if (strcmp(*argv,"-no_comp") == 0) |
1126 |
{ off|=SSL_OP_NO_COMPRESSION; } |
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1127 |
#ifndef OPENSSL_NO_TLSEXT
|
1128 |
else if (strcmp(*argv,"-no_ticket") == 0) |
|
1129 |
{ off|=SSL_OP_NO_TICKET; } |
|
1130 |
#endif
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1131 |
#ifndef OPENSSL_NO_SSL2
|
1132 |
else if (strcmp(*argv,"-ssl2") == 0) |
|
1133 |
{ meth=SSLv2_server_method(); } |
|
1134 |
#endif
|
|
1135 |
#ifndef OPENSSL_NO_SSL3
|
|
1136 |
else if (strcmp(*argv,"-ssl3") == 0) |
|
1137 |
{ meth=SSLv3_server_method(); } |
|
1138 |
#endif
|
|
1139 |
#ifndef OPENSSL_NO_TLS1
|
|
1140 |
else if (strcmp(*argv,"-tls1") == 0) |
|
1141 |
{ meth=TLSv1_server_method(); } |
|
1142 |
#endif
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1143 |
#ifndef OPENSSL_NO_DTLS1
|
1144 |
else if (strcmp(*argv,"-dtls1") == 0) |
|
1145 |
{
|
|
1146 |
meth=DTLSv1_server_method(); |
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1147 |
socket_type = SOCK_DGRAM; |
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1148 |
}
|
1149 |
else if (strcmp(*argv,"-timeout") == 0) |
|
1150 |
enable_timeouts = 1; |
|
1151 |
else if (strcmp(*argv,"-mtu") == 0) |
|
1152 |
{
|
|
1153 |
if (--argc < 1) goto bad; |
|
1.1.8
by Kurt Roeckx
Import upstream version 0.9.8m |
1154 |
socket_mtu = atol(*(++argv)); |
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1155 |
}
|
1156 |
else if (strcmp(*argv, "-chain") == 0) |
|
1157 |
cert_chain = 1; |
|
1158 |
#endif
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1159 |
else if (strcmp(*argv, "-id_prefix") == 0) |
1160 |
{
|
|
1161 |
if (--argc < 1) goto bad; |
|
1162 |
session_id_prefix = *(++argv); |
|
1163 |
}
|
|
1164 |
#ifndef OPENSSL_NO_ENGINE
|
|
1165 |
else if (strcmp(*argv,"-engine") == 0) |
|
1166 |
{
|
|
1167 |
if (--argc < 1) goto bad; |
|
1168 |
engine_id= *(++argv); |
|
1169 |
}
|
|
1170 |
#endif
|
|
1171 |
else if (strcmp(*argv,"-rand") == 0) |
|
1172 |
{
|
|
1173 |
if (--argc < 1) goto bad; |
|
1174 |
inrand= *(++argv); |
|
1175 |
}
|
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1176 |
#ifndef OPENSSL_NO_TLSEXT
|
1177 |
else if (strcmp(*argv,"-servername") == 0) |
|
1178 |
{
|
|
1179 |
if (--argc < 1) goto bad; |
|
1180 |
tlsextcbp.servername= *(++argv); |
|
1181 |
}
|
|
1182 |
else if (strcmp(*argv,"-servername_fatal") == 0) |
|
1183 |
{ tlsextcbp.extension_error = SSL_TLSEXT_ERR_ALERT_FATAL; } |
|
1184 |
else if (strcmp(*argv,"-cert2") == 0) |
|
1185 |
{
|
|
1186 |
if (--argc < 1) goto bad; |
|
1187 |
s_cert_file2= *(++argv); |
|
1188 |
}
|
|
1189 |
else if (strcmp(*argv,"-key2") == 0) |
|
1190 |
{
|
|
1191 |
if (--argc < 1) goto bad; |
|
1192 |
s_key_file2= *(++argv); |
|
1193 |
}
|
|
1.1.7
by Kurt Roeckx
Import upstream version 0.9.8k |
1194 |
|
1195 |
#endif
|
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1196 |
#if !defined(OPENSSL_NO_JPAKE) && !defined(OPENSSL_NO_PSK)
|
1.1.7
by Kurt Roeckx
Import upstream version 0.9.8k |
1197 |
else if (strcmp(*argv,"-jpake") == 0) |
1198 |
{
|
|
1199 |
if (--argc < 1) goto bad; |
|
1200 |
jpake_secret = *(++argv); |
|
1201 |
}
|
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1202 |
#endif
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1203 |
else
|
1204 |
{
|
|
1205 |
BIO_printf(bio_err,"unknown option %s\n",*argv); |
|
1206 |
badop=1; |
|
1207 |
break; |
|
1208 |
}
|
|
1209 |
argc--; |
|
1210 |
argv++; |
|
1211 |
}
|
|
1212 |
if (badop) |
|
1213 |
{
|
|
1214 |
bad: |
|
1215 |
sv_usage(); |
|
1216 |
goto end; |
|
1217 |
}
|
|
1218 |
||
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1219 |
#if !defined(OPENSSL_NO_JPAKE) && !defined(OPENSSL_NO_PSK)
|
1220 |
if (jpake_secret) |
|
1221 |
{
|
|
1222 |
if (psk_key) |
|
1223 |
{
|
|
1224 |
BIO_printf(bio_err, |
|
1225 |
"Can't use JPAKE and PSK together\n"); |
|
1226 |
goto end; |
|
1227 |
}
|
|
1228 |
psk_identity = "JPAKE"; |
|
1229 |
if (cipher) |
|
1230 |
{
|
|
1231 |
BIO_printf(bio_err, "JPAKE sets cipher to PSK\n"); |
|
1232 |
goto end; |
|
1233 |
}
|
|
1234 |
cipher = "PSK"; |
|
1235 |
}
|
|
1236 |
||
1237 |
#endif
|
|
1238 |
||
1
by Christoph Martin
Import upstream version 0.9.7d |
1239 |
SSL_load_error_strings(); |
1240 |
OpenSSL_add_ssl_algorithms(); |
|
1241 |
||
1242 |
#ifndef OPENSSL_NO_ENGINE
|
|
1243 |
e = setup_engine(bio_err, engine_id, 1); |
|
1244 |
#endif
|
|
1245 |
||
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1246 |
if (!app_passwd(bio_err, passarg, dpassarg, &pass, &dpass)) |
1247 |
{
|
|
1248 |
BIO_printf(bio_err, "Error getting password\n"); |
|
1249 |
goto end; |
|
1250 |
}
|
|
1251 |
||
1252 |
||
1253 |
if (s_key_file == NULL) |
|
1254 |
s_key_file = s_cert_file; |
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1255 |
#ifndef OPENSSL_NO_TLSEXT
|
1256 |
if (s_key_file2 == NULL) |
|
1257 |
s_key_file2 = s_cert_file2; |
|
1258 |
#endif
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1259 |
|
1260 |
if (nocert == 0) |
|
1261 |
{
|
|
1262 |
s_key = load_key(bio_err, s_key_file, s_key_format, 0, pass, e, |
|
1263 |
"server certificate private key file"); |
|
1264 |
if (!s_key) |
|
1265 |
{
|
|
1266 |
ERR_print_errors(bio_err); |
|
1267 |
goto end; |
|
1268 |
}
|
|
1269 |
||
1270 |
s_cert = load_cert(bio_err,s_cert_file,s_cert_format, |
|
1271 |
NULL, e, "server certificate file"); |
|
1272 |
||
1273 |
if (!s_cert) |
|
1274 |
{
|
|
1275 |
ERR_print_errors(bio_err); |
|
1276 |
goto end; |
|
1277 |
}
|
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1278 |
|
1279 |
#ifndef OPENSSL_NO_TLSEXT
|
|
1280 |
if (tlsextcbp.servername) |
|
1281 |
{
|
|
1282 |
s_key2 = load_key(bio_err, s_key_file2, s_key_format, 0, pass, e, |
|
1283 |
"second server certificate private key file"); |
|
1284 |
if (!s_key2) |
|
1285 |
{
|
|
1286 |
ERR_print_errors(bio_err); |
|
1287 |
goto end; |
|
1288 |
}
|
|
1289 |
||
1290 |
s_cert2 = load_cert(bio_err,s_cert_file2,s_cert_format, |
|
1291 |
NULL, e, "second server certificate file"); |
|
1292 |
||
1293 |
if (!s_cert2) |
|
1294 |
{
|
|
1295 |
ERR_print_errors(bio_err); |
|
1296 |
goto end; |
|
1297 |
}
|
|
1298 |
}
|
|
1299 |
#endif
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1300 |
}
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1301 |
|
1302 |
||
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1303 |
if (s_dcert_file) |
1304 |
{
|
|
1305 |
||
1306 |
if (s_dkey_file == NULL) |
|
1307 |
s_dkey_file = s_dcert_file; |
|
1308 |
||
1309 |
s_dkey = load_key(bio_err, s_dkey_file, s_dkey_format, |
|
1310 |
0, dpass, e, |
|
1311 |
"second certificate private key file"); |
|
1312 |
if (!s_dkey) |
|
1313 |
{
|
|
1314 |
ERR_print_errors(bio_err); |
|
1315 |
goto end; |
|
1316 |
}
|
|
1317 |
||
1318 |
s_dcert = load_cert(bio_err,s_dcert_file,s_dcert_format, |
|
1319 |
NULL, e, "second server certificate file"); |
|
1320 |
||
1321 |
if (!s_dcert) |
|
1322 |
{
|
|
1323 |
ERR_print_errors(bio_err); |
|
1324 |
goto end; |
|
1325 |
}
|
|
1326 |
||
1327 |
}
|
|
1328 |
||
1
by Christoph Martin
Import upstream version 0.9.7d |
1329 |
if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL |
1330 |
&& !RAND_status()) |
|
1331 |
{
|
|
1332 |
BIO_printf(bio_err,"warning, not much extra random data, consider using the -rand option\n"); |
|
1333 |
}
|
|
1334 |
if (inrand != NULL) |
|
1335 |
BIO_printf(bio_err,"%ld semi-random bytes loaded\n", |
|
1336 |
app_RAND_load_files(inrand)); |
|
1337 |
||
1338 |
if (bio_s_out == NULL) |
|
1339 |
{
|
|
1340 |
if (s_quiet && !s_debug && !s_msg) |
|
1341 |
{
|
|
1342 |
bio_s_out=BIO_new(BIO_s_null()); |
|
1343 |
}
|
|
1344 |
else
|
|
1345 |
{
|
|
1346 |
if (bio_s_out == NULL) |
|
1347 |
bio_s_out=BIO_new_fp(stdout,BIO_NOCLOSE); |
|
1348 |
}
|
|
1349 |
}
|
|
1350 |
||
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1351 |
#if !defined(OPENSSL_NO_RSA) || !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_ECDSA)
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1352 |
if (nocert) |
1353 |
#endif
|
|
1354 |
{
|
|
1355 |
s_cert_file=NULL; |
|
1356 |
s_key_file=NULL; |
|
1357 |
s_dcert_file=NULL; |
|
1358 |
s_dkey_file=NULL; |
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1359 |
#ifndef OPENSSL_NO_TLSEXT
|
1360 |
s_cert_file2=NULL; |
|
1361 |
s_key_file2=NULL; |
|
1362 |
#endif
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1363 |
}
|
1364 |
||
1365 |
ctx=SSL_CTX_new(meth); |
|
1366 |
if (ctx == NULL) |
|
1367 |
{
|
|
1368 |
ERR_print_errors(bio_err); |
|
1369 |
goto end; |
|
1370 |
}
|
|
1371 |
if (session_id_prefix) |
|
1372 |
{
|
|
1373 |
if(strlen(session_id_prefix) >= 32) |
|
1374 |
BIO_printf(bio_err, |
|
1375 |
"warning: id_prefix is too long, only one new session will be possible\n"); |
|
1376 |
else if(strlen(session_id_prefix) >= 16) |
|
1377 |
BIO_printf(bio_err, |
|
1378 |
"warning: id_prefix is too long if you use SSLv2\n"); |
|
1379 |
if(!SSL_CTX_set_generate_session_id(ctx, generate_session_id)) |
|
1380 |
{
|
|
1381 |
BIO_printf(bio_err,"error setting 'id_prefix'\n"); |
|
1382 |
ERR_print_errors(bio_err); |
|
1383 |
goto end; |
|
1384 |
}
|
|
1385 |
BIO_printf(bio_err,"id_prefix '%s' set.\n", session_id_prefix); |
|
1386 |
}
|
|
1387 |
SSL_CTX_set_quiet_shutdown(ctx,1); |
|
1388 |
if (bugs) SSL_CTX_set_options(ctx,SSL_OP_ALL); |
|
1389 |
if (hack) SSL_CTX_set_options(ctx,SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG); |
|
1390 |
SSL_CTX_set_options(ctx,off); |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1391 |
/* DTLS: partial reads end up discarding unread UDP bytes :-(
|
1392 |
* Setting read ahead solves this problem.
|
|
1393 |
*/
|
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1394 |
if (socket_type == SOCK_DGRAM) SSL_CTX_set_read_ahead(ctx, 1); |
1
by Christoph Martin
Import upstream version 0.9.7d |
1395 |
|
1396 |
if (state) SSL_CTX_set_info_callback(ctx,apps_ssl_info_callback); |
|
1.1.8
by Kurt Roeckx
Import upstream version 0.9.8m |
1397 |
if (no_cache) |
1398 |
SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF); |
|
1399 |
else
|
|
1400 |
SSL_CTX_sess_set_cache_size(ctx,128); |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1401 |
|
1402 |
#if 0
|
|
1403 |
if (cipher == NULL) cipher=getenv("SSL_CIPHER");
|
|
1404 |
#endif
|
|
1405 |
||
1406 |
#if 0
|
|
1407 |
if (s_cert_file == NULL)
|
|
1408 |
{
|
|
1409 |
BIO_printf(bio_err,"You must specify a certificate file for the server to use\n");
|
|
1410 |
goto end;
|
|
1411 |
}
|
|
1412 |
#endif
|
|
1413 |
||
1414 |
if ((!SSL_CTX_load_verify_locations(ctx,CAfile,CApath)) || |
|
1415 |
(!SSL_CTX_set_default_verify_paths(ctx))) |
|
1416 |
{
|
|
1417 |
/* BIO_printf(bio_err,"X509_load_verify_locations\n"); */
|
|
1418 |
ERR_print_errors(bio_err); |
|
1419 |
/* goto end; */
|
|
1420 |
}
|
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1421 |
if (vpm) |
1422 |
SSL_CTX_set1_param(ctx, vpm); |
|
1423 |
||
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1424 |
#ifndef OPENSSL_NO_TLSEXT
|
1425 |
if (s_cert2) |
|
1426 |
{
|
|
1427 |
ctx2=SSL_CTX_new(meth); |
|
1428 |
if (ctx2 == NULL) |
|
1429 |
{
|
|
1430 |
ERR_print_errors(bio_err); |
|
1431 |
goto end; |
|
1432 |
}
|
|
1433 |
}
|
|
1434 |
||
1435 |
if (ctx2) |
|
1436 |
{
|
|
1437 |
BIO_printf(bio_s_out,"Setting secondary ctx parameters\n"); |
|
1438 |
||
1439 |
if (session_id_prefix) |
|
1440 |
{
|
|
1441 |
if(strlen(session_id_prefix) >= 32) |
|
1442 |
BIO_printf(bio_err, |
|
1443 |
"warning: id_prefix is too long, only one new session will be possible\n"); |
|
1444 |
else if(strlen(session_id_prefix) >= 16) |
|
1445 |
BIO_printf(bio_err, |
|
1446 |
"warning: id_prefix is too long if you use SSLv2\n"); |
|
1447 |
if(!SSL_CTX_set_generate_session_id(ctx2, generate_session_id)) |
|
1448 |
{
|
|
1449 |
BIO_printf(bio_err,"error setting 'id_prefix'\n"); |
|
1450 |
ERR_print_errors(bio_err); |
|
1451 |
goto end; |
|
1452 |
}
|
|
1453 |
BIO_printf(bio_err,"id_prefix '%s' set.\n", session_id_prefix); |
|
1454 |
}
|
|
1455 |
SSL_CTX_set_quiet_shutdown(ctx2,1); |
|
1456 |
if (bugs) SSL_CTX_set_options(ctx2,SSL_OP_ALL); |
|
1457 |
if (hack) SSL_CTX_set_options(ctx2,SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG); |
|
1458 |
SSL_CTX_set_options(ctx2,off); |
|
1459 |
/* DTLS: partial reads end up discarding unread UDP bytes :-(
|
|
1460 |
* Setting read ahead solves this problem.
|
|
1461 |
*/
|
|
1462 |
if (socket_type == SOCK_DGRAM) SSL_CTX_set_read_ahead(ctx2, 1); |
|
1463 |
||
1464 |
if (state) SSL_CTX_set_info_callback(ctx2,apps_ssl_info_callback); |
|
1465 |
||
1.1.8
by Kurt Roeckx
Import upstream version 0.9.8m |
1466 |
if (no_cache) |
1467 |
SSL_CTX_set_session_cache_mode(ctx2,SSL_SESS_CACHE_OFF); |
|
1468 |
else
|
|
1469 |
SSL_CTX_sess_set_cache_size(ctx2,128); |
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1470 |
|
1471 |
if ((!SSL_CTX_load_verify_locations(ctx2,CAfile,CApath)) || |
|
1472 |
(!SSL_CTX_set_default_verify_paths(ctx2))) |
|
1473 |
{
|
|
1474 |
ERR_print_errors(bio_err); |
|
1475 |
}
|
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1476 |
if (vpm) |
1477 |
SSL_CTX_set1_param(ctx2, vpm); |
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1478 |
}
|
1479 |
#endif
|
|
1480 |
||
1
by Christoph Martin
Import upstream version 0.9.7d |
1481 |
#ifndef OPENSSL_NO_DH
|
1482 |
if (!no_dhe) |
|
1483 |
{
|
|
1484 |
DH *dh=NULL; |
|
1485 |
||
1486 |
if (dhfile) |
|
1487 |
dh = load_dh_param(dhfile); |
|
1488 |
else if (s_cert_file) |
|
1489 |
dh = load_dh_param(s_cert_file); |
|
1490 |
||
1491 |
if (dh != NULL) |
|
1492 |
{
|
|
1493 |
BIO_printf(bio_s_out,"Setting temp DH parameters\n"); |
|
1494 |
}
|
|
1495 |
else
|
|
1496 |
{
|
|
1497 |
BIO_printf(bio_s_out,"Using default temp DH parameters\n"); |
|
1498 |
dh=get_dh512(); |
|
1499 |
}
|
|
1500 |
(void)BIO_flush(bio_s_out); |
|
1501 |
||
1502 |
SSL_CTX_set_tmp_dh(ctx,dh); |
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1503 |
#ifndef OPENSSL_NO_TLSEXT
|
1504 |
if (ctx2) |
|
1505 |
{
|
|
1506 |
if (!dhfile) |
|
1507 |
{
|
|
1508 |
DH *dh2=load_dh_param(s_cert_file2); |
|
1509 |
if (dh2 != NULL) |
|
1510 |
{
|
|
1511 |
BIO_printf(bio_s_out,"Setting temp DH parameters\n"); |
|
1512 |
(void)BIO_flush(bio_s_out); |
|
1513 |
||
1514 |
DH_free(dh); |
|
1515 |
dh = dh2; |
|
1516 |
}
|
|
1517 |
}
|
|
1518 |
SSL_CTX_set_tmp_dh(ctx2,dh); |
|
1519 |
}
|
|
1520 |
#endif
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1521 |
DH_free(dh); |
1522 |
}
|
|
1523 |
#endif
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1524 |
|
1525 |
#ifndef OPENSSL_NO_ECDH
|
|
1526 |
if (!no_ecdhe) |
|
1527 |
{
|
|
1528 |
EC_KEY *ecdh=NULL; |
|
1529 |
||
1530 |
if (named_curve) |
|
1531 |
{
|
|
1532 |
int nid = OBJ_sn2nid(named_curve); |
|
1533 |
||
1534 |
if (nid == 0) |
|
1535 |
{
|
|
1536 |
BIO_printf(bio_err, "unknown curve name (%s)\n", |
|
1537 |
named_curve); |
|
1538 |
goto end; |
|
1539 |
}
|
|
1540 |
ecdh = EC_KEY_new_by_curve_name(nid); |
|
1541 |
if (ecdh == NULL) |
|
1542 |
{
|
|
1543 |
BIO_printf(bio_err, "unable to create curve (%s)\n", |
|
1544 |
named_curve); |
|
1545 |
goto end; |
|
1546 |
}
|
|
1547 |
}
|
|
1548 |
||
1549 |
if (ecdh != NULL) |
|
1550 |
{
|
|
1551 |
BIO_printf(bio_s_out,"Setting temp ECDH parameters\n"); |
|
1552 |
}
|
|
1553 |
else
|
|
1554 |
{
|
|
1555 |
BIO_printf(bio_s_out,"Using default temp ECDH parameters\n"); |
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1556 |
ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); |
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1557 |
if (ecdh == NULL) |
1558 |
{
|
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1559 |
BIO_printf(bio_err, "unable to create curve (nistp256)\n"); |
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1560 |
goto end; |
1561 |
}
|
|
1562 |
}
|
|
1563 |
(void)BIO_flush(bio_s_out); |
|
1564 |
||
1565 |
SSL_CTX_set_tmp_ecdh(ctx,ecdh); |
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1566 |
#ifndef OPENSSL_NO_TLSEXT
|
1567 |
if (ctx2) |
|
1568 |
SSL_CTX_set_tmp_ecdh(ctx2,ecdh); |
|
1569 |
#endif
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1570 |
EC_KEY_free(ecdh); |
1571 |
}
|
|
1572 |
#endif
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1573 |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1574 |
if (!set_cert_key_stuff(ctx,s_cert,s_key)) |
1
by Christoph Martin
Import upstream version 0.9.7d |
1575 |
goto end; |
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1576 |
#ifndef OPENSSL_NO_TLSEXT
|
1577 |
if (ctx2 && !set_cert_key_stuff(ctx2,s_cert2,s_key2)) |
|
1578 |
goto end; |
|
1579 |
#endif
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1580 |
if (s_dcert != NULL) |
1
by Christoph Martin
Import upstream version 0.9.7d |
1581 |
{
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1582 |
if (!set_cert_key_stuff(ctx,s_dcert,s_dkey)) |
1
by Christoph Martin
Import upstream version 0.9.7d |
1583 |
goto end; |
1584 |
}
|
|
1585 |
||
1586 |
#ifndef OPENSSL_NO_RSA
|
|
1587 |
#if 1
|
|
1588 |
if (!no_tmp_rsa) |
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1589 |
{
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1590 |
SSL_CTX_set_tmp_rsa_callback(ctx,tmp_rsa_cb); |
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1591 |
#ifndef OPENSSL_NO_TLSEXT
|
1592 |
if (ctx2) |
|
1593 |
SSL_CTX_set_tmp_rsa_callback(ctx2,tmp_rsa_cb); |
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1594 |
#endif
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1595 |
}
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1596 |
#else
|
1597 |
if (!no_tmp_rsa && SSL_CTX_need_tmp_RSA(ctx)) |
|
1598 |
{
|
|
1599 |
RSA *rsa; |
|
1600 |
||
1601 |
BIO_printf(bio_s_out,"Generating temp (512 bit) RSA key..."); |
|
1602 |
BIO_flush(bio_s_out); |
|
1603 |
||
1604 |
rsa=RSA_generate_key(512,RSA_F4,NULL); |
|
1605 |
||
1606 |
if (!SSL_CTX_set_tmp_rsa(ctx,rsa)) |
|
1607 |
{
|
|
1608 |
ERR_print_errors(bio_err); |
|
1609 |
goto end; |
|
1610 |
}
|
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1611 |
#ifndef OPENSSL_NO_TLSEXT
|
1612 |
if (ctx2) |
|
1613 |
{
|
|
1614 |
if (!SSL_CTX_set_tmp_rsa(ctx2,rsa)) |
|
1615 |
{
|
|
1616 |
ERR_print_errors(bio_err); |
|
1617 |
goto end; |
|
1618 |
}
|
|
1619 |
}
|
|
1620 |
#endif
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1621 |
RSA_free(rsa); |
1622 |
BIO_printf(bio_s_out,"\n"); |
|
1623 |
}
|
|
1624 |
#endif
|
|
1625 |
#endif
|
|
1626 |
||
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1627 |
#ifndef OPENSSL_NO_PSK
|
1628 |
#ifdef OPENSSL_NO_JPAKE
|
|
1629 |
if (psk_key != NULL) |
|
1630 |
#else
|
|
1631 |
if (psk_key != NULL || jpake_secret) |
|
1632 |
#endif
|
|
1633 |
{
|
|
1634 |
if (s_debug) |
|
1635 |
BIO_printf(bio_s_out, "PSK key given or JPAKE in use, setting server callback\n"); |
|
1636 |
SSL_CTX_set_psk_server_callback(ctx, psk_server_cb); |
|
1637 |
}
|
|
1638 |
||
1639 |
if (!SSL_CTX_use_psk_identity_hint(ctx, psk_identity_hint)) |
|
1640 |
{
|
|
1641 |
BIO_printf(bio_err,"error setting PSK identity hint to context\n"); |
|
1642 |
ERR_print_errors(bio_err); |
|
1643 |
goto end; |
|
1644 |
}
|
|
1645 |
#endif
|
|
1646 |
||
1
by Christoph Martin
Import upstream version 0.9.7d |
1647 |
if (cipher != NULL) |
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1648 |
{
|
1649 |
if(!SSL_CTX_set_cipher_list(ctx,cipher)) |
|
1650 |
{
|
|
1651 |
BIO_printf(bio_err,"error setting cipher list\n"); |
|
1652 |
ERR_print_errors(bio_err); |
|
1653 |
goto end; |
|
1654 |
}
|
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1655 |
#ifndef OPENSSL_NO_TLSEXT
|
1656 |
if (ctx2 && !SSL_CTX_set_cipher_list(ctx2,cipher)) |
|
1657 |
{
|
|
1658 |
BIO_printf(bio_err,"error setting cipher list\n"); |
|
1659 |
ERR_print_errors(bio_err); |
|
1660 |
goto end; |
|
1661 |
}
|
|
1662 |
#endif
|
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1663 |
}
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1664 |
SSL_CTX_set_verify(ctx,s_server_verify,verify_callback); |
1665 |
SSL_CTX_set_session_id_context(ctx,(void*)&s_server_session_id_context, |
|
1666 |
sizeof s_server_session_id_context); |
|
1667 |
||
1.1.8
by Kurt Roeckx
Import upstream version 0.9.8m |
1668 |
/* Set DTLS cookie generation and verification callbacks */
|
1669 |
SSL_CTX_set_cookie_generate_cb(ctx, generate_cookie_callback); |
|
1670 |
SSL_CTX_set_cookie_verify_cb(ctx, verify_cookie_callback); |
|
1671 |
||
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1672 |
#ifndef OPENSSL_NO_TLSEXT
|
1673 |
if (ctx2) |
|
1674 |
{
|
|
1675 |
SSL_CTX_set_verify(ctx2,s_server_verify,verify_callback); |
|
1676 |
SSL_CTX_set_session_id_context(ctx2,(void*)&s_server_session_id_context, |
|
1677 |
sizeof s_server_session_id_context); |
|
1678 |
||
1679 |
tlsextcbp.biodebug = bio_s_out; |
|
1680 |
SSL_CTX_set_tlsext_servername_callback(ctx2, ssl_servername_cb); |
|
1681 |
SSL_CTX_set_tlsext_servername_arg(ctx2, &tlsextcbp); |
|
1682 |
SSL_CTX_set_tlsext_servername_callback(ctx, ssl_servername_cb); |
|
1683 |
SSL_CTX_set_tlsext_servername_arg(ctx, &tlsextcbp); |
|
1684 |
}
|
|
1685 |
#endif
|
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1686 |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1687 |
if (CAfile != NULL) |
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1688 |
{
|
1689 |
SSL_CTX_set_client_CA_list(ctx,SSL_load_client_CA_file(CAfile)); |
|
1690 |
#ifndef OPENSSL_NO_TLSEXT
|
|
1691 |
if (ctx2) |
|
1692 |
SSL_CTX_set_client_CA_list(ctx2,SSL_load_client_CA_file(CAfile)); |
|
1693 |
#endif
|
|
1694 |
}
|
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1695 |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1696 |
BIO_printf(bio_s_out,"ACCEPT\n"); |
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1697 |
(void)BIO_flush(bio_s_out); |
1
by Christoph Martin
Import upstream version 0.9.7d |
1698 |
if (www) |
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1699 |
do_server(port,socket_type,&accept_socket,www_body, context); |
1
by Christoph Martin
Import upstream version 0.9.7d |
1700 |
else
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1701 |
do_server(port,socket_type,&accept_socket,sv_body, context); |
1
by Christoph Martin
Import upstream version 0.9.7d |
1702 |
print_stats(bio_s_out,ctx); |
1703 |
ret=0; |
|
1704 |
end: |
|
1705 |
if (ctx != NULL) SSL_CTX_free(ctx); |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1706 |
if (s_cert) |
1707 |
X509_free(s_cert); |
|
1708 |
if (s_dcert) |
|
1709 |
X509_free(s_dcert); |
|
1710 |
if (s_key) |
|
1711 |
EVP_PKEY_free(s_key); |
|
1712 |
if (s_dkey) |
|
1713 |
EVP_PKEY_free(s_dkey); |
|
1714 |
if (pass) |
|
1715 |
OPENSSL_free(pass); |
|
1716 |
if (dpass) |
|
1717 |
OPENSSL_free(dpass); |
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1718 |
#ifndef OPENSSL_NO_TLSEXT
|
1719 |
if (ctx2 != NULL) SSL_CTX_free(ctx2); |
|
1720 |
if (s_cert2) |
|
1721 |
X509_free(s_cert2); |
|
1722 |
if (s_key2) |
|
1723 |
EVP_PKEY_free(s_key2); |
|
1724 |
#endif
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1725 |
if (bio_s_out != NULL) |
1726 |
{
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1727 |
BIO_free(bio_s_out); |
1
by Christoph Martin
Import upstream version 0.9.7d |
1728 |
bio_s_out=NULL; |
1729 |
}
|
|
1730 |
apps_shutdown(); |
|
1731 |
OPENSSL_EXIT(ret); |
|
1732 |
}
|
|
1733 |
||
1734 |
static void print_stats(BIO *bio, SSL_CTX *ssl_ctx) |
|
1735 |
{
|
|
1736 |
BIO_printf(bio,"%4ld items in the session cache\n", |
|
1737 |
SSL_CTX_sess_number(ssl_ctx)); |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1738 |
BIO_printf(bio,"%4ld client connects (SSL_connect())\n", |
1
by Christoph Martin
Import upstream version 0.9.7d |
1739 |
SSL_CTX_sess_connect(ssl_ctx)); |
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1740 |
BIO_printf(bio,"%4ld client renegotiates (SSL_connect())\n", |
1
by Christoph Martin
Import upstream version 0.9.7d |
1741 |
SSL_CTX_sess_connect_renegotiate(ssl_ctx)); |
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1742 |
BIO_printf(bio,"%4ld client connects that finished\n", |
1
by Christoph Martin
Import upstream version 0.9.7d |
1743 |
SSL_CTX_sess_connect_good(ssl_ctx)); |
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1744 |
BIO_printf(bio,"%4ld server accepts (SSL_accept())\n", |
1
by Christoph Martin
Import upstream version 0.9.7d |
1745 |
SSL_CTX_sess_accept(ssl_ctx)); |
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1746 |
BIO_printf(bio,"%4ld server renegotiates (SSL_accept())\n", |
1
by Christoph Martin
Import upstream version 0.9.7d |
1747 |
SSL_CTX_sess_accept_renegotiate(ssl_ctx)); |
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1748 |
BIO_printf(bio,"%4ld server accepts that finished\n", |
1
by Christoph Martin
Import upstream version 0.9.7d |
1749 |
SSL_CTX_sess_accept_good(ssl_ctx)); |
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1750 |
BIO_printf(bio,"%4ld session cache hits\n",SSL_CTX_sess_hits(ssl_ctx)); |
1751 |
BIO_printf(bio,"%4ld session cache misses\n",SSL_CTX_sess_misses(ssl_ctx)); |
|
1752 |
BIO_printf(bio,"%4ld session cache timeouts\n",SSL_CTX_sess_timeouts(ssl_ctx)); |
|
1753 |
BIO_printf(bio,"%4ld callback cache hits\n",SSL_CTX_sess_cb_hits(ssl_ctx)); |
|
1754 |
BIO_printf(bio,"%4ld cache full overflows (%ld allowed)\n", |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1755 |
SSL_CTX_sess_cache_full(ssl_ctx), |
1756 |
SSL_CTX_sess_get_cache_size(ssl_ctx)); |
|
1757 |
}
|
|
1758 |
||
1759 |
static int sv_body(char *hostname, int s, unsigned char *context) |
|
1760 |
{
|
|
1761 |
char *buf=NULL; |
|
1762 |
fd_set readfds; |
|
1763 |
int ret=1,width; |
|
1764 |
int k,i; |
|
1765 |
unsigned long l; |
|
1766 |
SSL *con=NULL; |
|
1767 |
BIO *sbio; |
|
1.1.8
by Kurt Roeckx
Import upstream version 0.9.8m |
1768 |
struct timeval timeout; |
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1769 |
#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE) || defined(OPENSSL_SYS_BEOS_R5)
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1770 |
struct timeval tv; |
1.1.8
by Kurt Roeckx
Import upstream version 0.9.8m |
1771 |
#else
|
1772 |
struct timeval *timeoutp; |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1773 |
#endif
|
1774 |
||
1775 |
if ((buf=OPENSSL_malloc(bufsize)) == NULL) |
|
1776 |
{
|
|
1777 |
BIO_printf(bio_err,"out of memory\n"); |
|
1778 |
goto err; |
|
1779 |
}
|
|
1780 |
#ifdef FIONBIO
|
|
1781 |
if (s_nbio) |
|
1782 |
{
|
|
1783 |
unsigned long sl=1; |
|
1784 |
||
1785 |
if (!s_quiet) |
|
1786 |
BIO_printf(bio_err,"turning on non blocking io\n"); |
|
1787 |
if (BIO_socket_ioctl(s,FIONBIO,&sl) < 0) |
|
1788 |
ERR_print_errors(bio_err); |
|
1789 |
}
|
|
1790 |
#endif
|
|
1791 |
||
1792 |
if (con == NULL) { |
|
1793 |
con=SSL_new(ctx); |
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1794 |
#ifndef OPENSSL_NO_TLSEXT
|
1795 |
if (s_tlsextdebug) |
|
1796 |
{
|
|
1797 |
SSL_set_tlsext_debug_callback(con, tlsext_cb); |
|
1798 |
SSL_set_tlsext_debug_arg(con, bio_s_out); |
|
1799 |
}
|
|
1.1.7
by Kurt Roeckx
Import upstream version 0.9.8k |
1800 |
if (s_tlsextstatus) |
1801 |
{
|
|
1802 |
SSL_CTX_set_tlsext_status_cb(ctx, cert_status_cb); |
|
1803 |
tlscstatp.err = bio_err; |
|
1804 |
SSL_CTX_set_tlsext_status_arg(ctx, &tlscstatp); |
|
1805 |
}
|
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1806 |
#endif
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1807 |
#ifndef OPENSSL_NO_KRB5
|
1808 |
if ((con->kssl_ctx = kssl_ctx_new()) != NULL) |
|
1809 |
{
|
|
1810 |
kssl_ctx_setstring(con->kssl_ctx, KSSL_SERVICE, |
|
1811 |
KRB5SVC); |
|
1812 |
kssl_ctx_setstring(con->kssl_ctx, KSSL_KEYTAB, |
|
1813 |
KRB5KEYTAB); |
|
1814 |
}
|
|
1815 |
#endif /* OPENSSL_NO_KRB5 */ |
|
1816 |
if(context) |
|
1817 |
SSL_set_session_id_context(con, context, |
|
1818 |
strlen((char *)context)); |
|
1819 |
}
|
|
1820 |
SSL_clear(con); |
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1821 |
#if 0
|
1822 |
#ifdef TLSEXT_TYPE_opaque_prf_input
|
|
1823 |
SSL_set_tlsext_opaque_prf_input(con, "Test server", 11);
|
|
1824 |
#endif
|
|
1825 |
#endif
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1826 |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1827 |
if (SSL_version(con) == DTLS1_VERSION) |
1828 |
{
|
|
1829 |
||
1830 |
sbio=BIO_new_dgram(s,BIO_NOCLOSE); |
|
1831 |
||
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1832 |
if (enable_timeouts) |
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1833 |
{
|
1834 |
timeout.tv_sec = 0; |
|
1835 |
timeout.tv_usec = DGRAM_RCV_TIMEOUT; |
|
1836 |
BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_RECV_TIMEOUT, 0, &timeout); |
|
1837 |
||
1838 |
timeout.tv_sec = 0; |
|
1839 |
timeout.tv_usec = DGRAM_SND_TIMEOUT; |
|
1840 |
BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_SEND_TIMEOUT, 0, &timeout); |
|
1841 |
}
|
|
1842 |
||
1.1.8
by Kurt Roeckx
Import upstream version 0.9.8m |
1843 |
if (socket_mtu > 28) |
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1844 |
{
|
1845 |
SSL_set_options(con, SSL_OP_NO_QUERY_MTU); |
|
1.1.8
by Kurt Roeckx
Import upstream version 0.9.8m |
1846 |
SSL_set_mtu(con, socket_mtu - 28); |
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1847 |
}
|
1848 |
else
|
|
1849 |
/* want to do MTU discovery */
|
|
1850 |
BIO_ctrl(sbio, BIO_CTRL_DGRAM_MTU_DISCOVER, 0, NULL); |
|
1851 |
||
1852 |
/* turn on cookie exchange */
|
|
1853 |
SSL_set_options(con, SSL_OP_COOKIE_EXCHANGE); |
|
1854 |
}
|
|
1855 |
else
|
|
1856 |
sbio=BIO_new_socket(s,BIO_NOCLOSE); |
|
1857 |
||
1
by Christoph Martin
Import upstream version 0.9.7d |
1858 |
if (s_nbio_test) |
1859 |
{
|
|
1860 |
BIO *test; |
|
1861 |
||
1862 |
test=BIO_new(BIO_f_nbio_test()); |
|
1863 |
sbio=BIO_push(test,sbio); |
|
1864 |
}
|
|
1.1.7
by Kurt Roeckx
Import upstream version 0.9.8k |
1865 |
#ifndef OPENSSL_NO_JPAKE
|
1866 |
if(jpake_secret) |
|
1867 |
jpake_server_auth(bio_s_out, sbio, jpake_secret); |
|
1868 |
#endif
|
|
1869 |
||
1
by Christoph Martin
Import upstream version 0.9.7d |
1870 |
SSL_set_bio(con,sbio,sbio); |
1871 |
SSL_set_accept_state(con); |
|
1872 |
/* SSL_set_fd(con,s); */
|
|
1873 |
||
1874 |
if (s_debug) |
|
1875 |
{
|
|
1876 |
con->debug=1; |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1877 |
BIO_set_callback(SSL_get_rbio(con),bio_dump_callback); |
1.1.5
by Kurt Roeckx
Import upstream version 0.9.8e |
1878 |
BIO_set_callback_arg(SSL_get_rbio(con),(char *)bio_s_out); |
1
by Christoph Martin
Import upstream version 0.9.7d |
1879 |
}
|
1880 |
if (s_msg) |
|
1881 |
{
|
|
1882 |
SSL_set_msg_callback(con, msg_cb); |
|
1883 |
SSL_set_msg_callback_arg(con, bio_s_out); |
|
1884 |
}
|
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
1885 |
#ifndef OPENSSL_NO_TLSEXT
|
1886 |
if (s_tlsextdebug) |
|
1887 |
{
|
|
1888 |
SSL_set_tlsext_debug_callback(con, tlsext_cb); |
|
1889 |
SSL_set_tlsext_debug_arg(con, bio_s_out); |
|
1890 |
}
|
|
1891 |
#endif
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1892 |
|
1893 |
width=s+1; |
|
1894 |
for (;;) |
|
1895 |
{
|
|
1896 |
int read_from_terminal; |
|
1897 |
int read_from_sslcon; |
|
1898 |
||
1899 |
read_from_terminal = 0; |
|
1900 |
read_from_sslcon = SSL_pending(con); |
|
1901 |
||
1902 |
if (!read_from_sslcon) |
|
1903 |
{
|
|
1904 |
FD_ZERO(&readfds); |
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1905 |
#if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_NETWARE) && !defined(OPENSSL_SYS_BEOS_R5)
|
1906 |
openssl_fdset(fileno(stdin),&readfds); |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1907 |
#endif
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1908 |
openssl_fdset(s,&readfds); |
1
by Christoph Martin
Import upstream version 0.9.7d |
1909 |
/* Note: under VMS with SOCKETSHR the second parameter is
|
1910 |
* currently of type (int *) whereas under other systems
|
|
1911 |
* it is (void *) if you don't have a cast it will choke
|
|
1912 |
* the compiler: if you do have a cast then you can either
|
|
1913 |
* go for (int *) or (void *).
|
|
1914 |
*/
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1915 |
#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE)
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1916 |
/* Under DOS (non-djgpp) and Windows we can't select on stdin: only
|
1917 |
* on sockets. As a workaround we timeout the select every
|
|
1918 |
* second and check for any keypress. In a proper Windows
|
|
1919 |
* application we wouldn't do this because it is inefficient.
|
|
1920 |
*/
|
|
1921 |
tv.tv_sec = 1; |
|
1922 |
tv.tv_usec = 0; |
|
1923 |
i=select(width,(void *)&readfds,NULL,NULL,&tv); |
|
1924 |
if((i < 0) || (!i && !_kbhit() ) )continue; |
|
1925 |
if(_kbhit()) |
|
1926 |
read_from_terminal = 1; |
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1927 |
#elif defined(OPENSSL_SYS_BEOS_R5)
|
1928 |
/* Under BeOS-R5 the situation is similar to DOS */
|
|
1929 |
tv.tv_sec = 1; |
|
1930 |
tv.tv_usec = 0; |
|
1931 |
(void)fcntl(fileno(stdin), F_SETFL, O_NONBLOCK); |
|
1932 |
i=select(width,(void *)&readfds,NULL,NULL,&tv); |
|
1933 |
if ((i < 0) || (!i && read(fileno(stdin), buf, 0) < 0)) |
|
1934 |
continue; |
|
1935 |
if (read(fileno(stdin), buf, 0) >= 0) |
|
1936 |
read_from_terminal = 1; |
|
1937 |
(void)fcntl(fileno(stdin), F_SETFL, 0); |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
1938 |
#else
|
1.1.8
by Kurt Roeckx
Import upstream version 0.9.8m |
1939 |
if ((SSL_version(con) == DTLS1_VERSION) && |
1940 |
DTLSv1_get_timeout(con, &timeout)) |
|
1941 |
timeoutp = &timeout; |
|
1942 |
else
|
|
1943 |
timeoutp = NULL; |
|
1944 |
||
1945 |
i=select(width,(void *)&readfds,NULL,NULL,timeoutp); |
|
1946 |
||
1947 |
if ((SSL_version(con) == DTLS1_VERSION) && DTLSv1_handle_timeout(con) > 0) |
|
1948 |
{
|
|
1949 |
BIO_printf(bio_err,"TIMEOUT occured\n"); |
|
1950 |
}
|
|
1951 |
||
1
by Christoph Martin
Import upstream version 0.9.7d |
1952 |
if (i <= 0) continue; |
1953 |
if (FD_ISSET(fileno(stdin),&readfds)) |
|
1954 |
read_from_terminal = 1; |
|
1955 |
#endif
|
|
1956 |
if (FD_ISSET(s,&readfds)) |
|
1957 |
read_from_sslcon = 1; |
|
1958 |
}
|
|
1959 |
if (read_from_terminal) |
|
1960 |
{
|
|
1961 |
if (s_crlf) |
|
1962 |
{
|
|
1963 |
int j, lf_num; |
|
1964 |
||
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1965 |
i=raw_read_stdin(buf, bufsize/2); |
1
by Christoph Martin
Import upstream version 0.9.7d |
1966 |
lf_num = 0; |
1967 |
/* both loops are skipped when i <= 0 */
|
|
1968 |
for (j = 0; j < i; j++) |
|
1969 |
if (buf[j] == '\n') |
|
1970 |
lf_num++; |
|
1971 |
for (j = i-1; j >= 0; j--) |
|
1972 |
{
|
|
1973 |
buf[j+lf_num] = buf[j]; |
|
1974 |
if (buf[j] == '\n') |
|
1975 |
{
|
|
1976 |
lf_num--; |
|
1977 |
i++; |
|
1978 |
buf[j+lf_num] = '\r'; |
|
1979 |
}
|
|
1980 |
}
|
|
1981 |
assert(lf_num == 0); |
|
1982 |
}
|
|
1983 |
else
|
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
1984 |
i=raw_read_stdin(buf,bufsize); |
1
by Christoph Martin
Import upstream version 0.9.7d |
1985 |
if (!s_quiet) |
1986 |
{
|
|
1987 |
if ((i <= 0) || (buf[0] == 'Q')) |
|
1988 |
{
|
|
1989 |
BIO_printf(bio_s_out,"DONE\n"); |
|
1990 |
SHUTDOWN(s); |
|
1991 |
close_accept_socket(); |
|
1992 |
ret= -11; |
|
1993 |
goto err; |
|
1994 |
}
|
|
1995 |
if ((i <= 0) || (buf[0] == 'q')) |
|
1996 |
{
|
|
1997 |
BIO_printf(bio_s_out,"DONE\n"); |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
1998 |
if (SSL_version(con) != DTLS1_VERSION) |
1999 |
SHUTDOWN(s); |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
2000 |
/* close_accept_socket();
|
2001 |
ret= -11;*/
|
|
2002 |
goto err; |
|
2003 |
}
|
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
2004 |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
2005 |
if ((buf[0] == 'r') && |
2006 |
((buf[1] == '\n') || (buf[1] == '\r'))) |
|
2007 |
{
|
|
2008 |
SSL_renegotiate(con); |
|
2009 |
i=SSL_do_handshake(con); |
|
2010 |
printf("SSL_do_handshake -> %d\n",i); |
|
2011 |
i=0; /*13; */ |
|
2012 |
continue; |
|
2013 |
/* strcpy(buf,"server side RE-NEGOTIATE\n"); */
|
|
2014 |
}
|
|
2015 |
if ((buf[0] == 'R') && |
|
2016 |
((buf[1] == '\n') || (buf[1] == '\r'))) |
|
2017 |
{
|
|
2018 |
SSL_set_verify(con, |
|
2019 |
SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE,NULL); |
|
2020 |
SSL_renegotiate(con); |
|
2021 |
i=SSL_do_handshake(con); |
|
2022 |
printf("SSL_do_handshake -> %d\n",i); |
|
2023 |
i=0; /* 13; */ |
|
2024 |
continue; |
|
2025 |
/* strcpy(buf,"server side RE-NEGOTIATE asking for client cert\n"); */
|
|
2026 |
}
|
|
2027 |
if (buf[0] == 'P') |
|
2028 |
{
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
2029 |
static const char *str="Lets print some clear text\n"; |
1
by Christoph Martin
Import upstream version 0.9.7d |
2030 |
BIO_write(SSL_get_wbio(con),str,strlen(str)); |
2031 |
}
|
|
2032 |
if (buf[0] == 'S') |
|
2033 |
{
|
|
2034 |
print_stats(bio_s_out,SSL_get_SSL_CTX(con)); |
|
2035 |
}
|
|
2036 |
}
|
|
2037 |
#ifdef CHARSET_EBCDIC
|
|
2038 |
ebcdic2ascii(buf,buf,i); |
|
2039 |
#endif
|
|
2040 |
l=k=0; |
|
2041 |
for (;;) |
|
2042 |
{
|
|
2043 |
/* should do a select for the write */
|
|
2044 |
#ifdef RENEG
|
|
2045 |
{ static count=0; if (++count == 100) { count=0; SSL_renegotiate(con); } } |
|
2046 |
#endif
|
|
2047 |
k=SSL_write(con,&(buf[l]),(unsigned int)i); |
|
2048 |
switch (SSL_get_error(con,k)) |
|
2049 |
{
|
|
2050 |
case SSL_ERROR_NONE: |
|
2051 |
break; |
|
2052 |
case SSL_ERROR_WANT_WRITE: |
|
2053 |
case SSL_ERROR_WANT_READ: |
|
2054 |
case SSL_ERROR_WANT_X509_LOOKUP: |
|
2055 |
BIO_printf(bio_s_out,"Write BLOCK\n"); |
|
2056 |
break; |
|
2057 |
case SSL_ERROR_SYSCALL: |
|
2058 |
case SSL_ERROR_SSL: |
|
2059 |
BIO_printf(bio_s_out,"ERROR\n"); |
|
2060 |
ERR_print_errors(bio_err); |
|
2061 |
ret=1; |
|
2062 |
goto err; |
|
2063 |
/* break; */
|
|
2064 |
case SSL_ERROR_ZERO_RETURN: |
|
2065 |
BIO_printf(bio_s_out,"DONE\n"); |
|
2066 |
ret=1; |
|
2067 |
goto err; |
|
2068 |
}
|
|
2069 |
l+=k; |
|
2070 |
i-=k; |
|
2071 |
if (i <= 0) break; |
|
2072 |
}
|
|
2073 |
}
|
|
2074 |
if (read_from_sslcon) |
|
2075 |
{
|
|
2076 |
if (!SSL_is_init_finished(con)) |
|
2077 |
{
|
|
2078 |
i=init_ssl_connection(con); |
|
2079 |
||
2080 |
if (i < 0) |
|
2081 |
{
|
|
2082 |
ret=0; |
|
2083 |
goto err; |
|
2084 |
}
|
|
2085 |
else if (i == 0) |
|
2086 |
{
|
|
2087 |
ret=1; |
|
2088 |
goto err; |
|
2089 |
}
|
|
2090 |
}
|
|
2091 |
else
|
|
2092 |
{
|
|
2093 |
again: |
|
2094 |
i=SSL_read(con,(char *)buf,bufsize); |
|
2095 |
switch (SSL_get_error(con,i)) |
|
2096 |
{
|
|
2097 |
case SSL_ERROR_NONE: |
|
2098 |
#ifdef CHARSET_EBCDIC
|
|
2099 |
ascii2ebcdic(buf,buf,i); |
|
2100 |
#endif
|
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
2101 |
raw_write_stdout(buf, |
1
by Christoph Martin
Import upstream version 0.9.7d |
2102 |
(unsigned int)i); |
2103 |
if (SSL_pending(con)) goto again; |
|
2104 |
break; |
|
2105 |
case SSL_ERROR_WANT_WRITE: |
|
2106 |
case SSL_ERROR_WANT_READ: |
|
2107 |
case SSL_ERROR_WANT_X509_LOOKUP: |
|
2108 |
BIO_printf(bio_s_out,"Read BLOCK\n"); |
|
2109 |
break; |
|
2110 |
case SSL_ERROR_SYSCALL: |
|
2111 |
case SSL_ERROR_SSL: |
|
2112 |
BIO_printf(bio_s_out,"ERROR\n"); |
|
2113 |
ERR_print_errors(bio_err); |
|
2114 |
ret=1; |
|
2115 |
goto err; |
|
2116 |
case SSL_ERROR_ZERO_RETURN: |
|
2117 |
BIO_printf(bio_s_out,"DONE\n"); |
|
2118 |
ret=1; |
|
2119 |
goto err; |
|
2120 |
}
|
|
2121 |
}
|
|
2122 |
}
|
|
2123 |
}
|
|
2124 |
err: |
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
2125 |
if (con != NULL) |
2126 |
{
|
|
2127 |
BIO_printf(bio_s_out,"shutting down SSL\n"); |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
2128 |
#if 1
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
2129 |
SSL_set_shutdown(con,SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN); |
1
by Christoph Martin
Import upstream version 0.9.7d |
2130 |
#else
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
2131 |
SSL_shutdown(con); |
1
by Christoph Martin
Import upstream version 0.9.7d |
2132 |
#endif
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
2133 |
SSL_free(con); |
2134 |
}
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
2135 |
BIO_printf(bio_s_out,"CONNECTION CLOSED\n"); |
2136 |
if (buf != NULL) |
|
2137 |
{
|
|
2138 |
OPENSSL_cleanse(buf,bufsize); |
|
2139 |
OPENSSL_free(buf); |
|
2140 |
}
|
|
2141 |
if (ret >= 0) |
|
2142 |
BIO_printf(bio_s_out,"ACCEPT\n"); |
|
2143 |
return(ret); |
|
2144 |
}
|
|
2145 |
||
2146 |
static void close_accept_socket(void) |
|
2147 |
{
|
|
2148 |
BIO_printf(bio_err,"shutdown accept socket\n"); |
|
2149 |
if (accept_socket >= 0) |
|
2150 |
{
|
|
2151 |
SHUTDOWN2(accept_socket); |
|
2152 |
}
|
|
2153 |
}
|
|
2154 |
||
2155 |
static int init_ssl_connection(SSL *con) |
|
2156 |
{
|
|
2157 |
int i; |
|
2158 |
const char *str; |
|
2159 |
X509 *peer; |
|
2160 |
long verify_error; |
|
2161 |
MS_STATIC char buf[BUFSIZ]; |
|
2162 |
||
2163 |
if ((i=SSL_accept(con)) <= 0) |
|
2164 |
{
|
|
2165 |
if (BIO_sock_should_retry(i)) |
|
2166 |
{
|
|
2167 |
BIO_printf(bio_s_out,"DELAY\n"); |
|
2168 |
return(1); |
|
2169 |
}
|
|
2170 |
||
2171 |
BIO_printf(bio_err,"ERROR\n"); |
|
2172 |
verify_error=SSL_get_verify_result(con); |
|
2173 |
if (verify_error != X509_V_OK) |
|
2174 |
{
|
|
2175 |
BIO_printf(bio_err,"verify error:%s\n", |
|
2176 |
X509_verify_cert_error_string(verify_error)); |
|
2177 |
}
|
|
2178 |
else
|
|
2179 |
ERR_print_errors(bio_err); |
|
2180 |
return(0); |
|
2181 |
}
|
|
2182 |
||
2183 |
PEM_write_bio_SSL_SESSION(bio_s_out,SSL_get_session(con)); |
|
2184 |
||
2185 |
peer=SSL_get_peer_certificate(con); |
|
2186 |
if (peer != NULL) |
|
2187 |
{
|
|
2188 |
BIO_printf(bio_s_out,"Client certificate\n"); |
|
2189 |
PEM_write_bio_X509(bio_s_out,peer); |
|
2190 |
X509_NAME_oneline(X509_get_subject_name(peer),buf,sizeof buf); |
|
2191 |
BIO_printf(bio_s_out,"subject=%s\n",buf); |
|
2192 |
X509_NAME_oneline(X509_get_issuer_name(peer),buf,sizeof buf); |
|
2193 |
BIO_printf(bio_s_out,"issuer=%s\n",buf); |
|
2194 |
X509_free(peer); |
|
2195 |
}
|
|
2196 |
||
2197 |
if (SSL_get_shared_ciphers(con,buf,sizeof buf) != NULL) |
|
2198 |
BIO_printf(bio_s_out,"Shared ciphers:%s\n",buf); |
|
2199 |
str=SSL_CIPHER_get_name(SSL_get_current_cipher(con)); |
|
2200 |
BIO_printf(bio_s_out,"CIPHER is %s\n",(str != NULL)?str:"(NONE)"); |
|
2201 |
if (con->hit) BIO_printf(bio_s_out,"Reused session-id\n"); |
|
2202 |
if (SSL_ctrl(con,SSL_CTRL_GET_FLAGS,0,NULL) & |
|
2203 |
TLS1_FLAGS_TLS_PADDING_BUG) |
|
2204 |
BIO_printf(bio_s_out,"Peer has incorrect TLSv1 block padding\n"); |
|
2205 |
#ifndef OPENSSL_NO_KRB5
|
|
2206 |
if (con->kssl_ctx->client_princ != NULL) |
|
2207 |
{
|
|
2208 |
BIO_printf(bio_s_out,"Kerberos peer principal is %s\n", |
|
2209 |
con->kssl_ctx->client_princ); |
|
2210 |
}
|
|
2211 |
#endif /* OPENSSL_NO_KRB5 */ |
|
1.1.8
by Kurt Roeckx
Import upstream version 0.9.8m |
2212 |
BIO_printf(bio_s_out, "Secure Renegotiation IS%s supported\n", |
2213 |
SSL_get_secure_renegotiation_support(con) ? "" : " NOT"); |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
2214 |
return(1); |
2215 |
}
|
|
2216 |
||
2217 |
#ifndef OPENSSL_NO_DH
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
2218 |
static DH *load_dh_param(const char *dhfile) |
1
by Christoph Martin
Import upstream version 0.9.7d |
2219 |
{
|
2220 |
DH *ret=NULL; |
|
2221 |
BIO *bio; |
|
2222 |
||
2223 |
if ((bio=BIO_new_file(dhfile,"r")) == NULL) |
|
2224 |
goto err; |
|
2225 |
ret=PEM_read_bio_DHparams(bio,NULL,NULL,NULL); |
|
2226 |
err: |
|
2227 |
if (bio != NULL) BIO_free(bio); |
|
2228 |
return(ret); |
|
2229 |
}
|
|
2230 |
#endif
|
|
2231 |
||
2232 |
#if 0
|
|
2233 |
static int load_CA(SSL_CTX *ctx, char *file)
|
|
2234 |
{
|
|
2235 |
FILE *in;
|
|
2236 |
X509 *x=NULL;
|
|
2237 |
||
2238 |
if ((in=fopen(file,"r")) == NULL)
|
|
2239 |
return(0);
|
|
2240 |
||
2241 |
for (;;)
|
|
2242 |
{
|
|
2243 |
if (PEM_read_X509(in,&x,NULL) == NULL)
|
|
2244 |
break;
|
|
2245 |
SSL_CTX_add_client_CA(ctx,x);
|
|
2246 |
}
|
|
2247 |
if (x != NULL) X509_free(x);
|
|
2248 |
fclose(in);
|
|
2249 |
return(1);
|
|
2250 |
}
|
|
2251 |
#endif
|
|
2252 |
||
2253 |
static int www_body(char *hostname, int s, unsigned char *context) |
|
2254 |
{
|
|
2255 |
char *buf=NULL; |
|
2256 |
int ret=1; |
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
2257 |
int i,j,k,dot; |
1
by Christoph Martin
Import upstream version 0.9.7d |
2258 |
SSL *con; |
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
2259 |
const SSL_CIPHER *c; |
1
by Christoph Martin
Import upstream version 0.9.7d |
2260 |
BIO *io,*ssl_bio,*sbio; |
2261 |
||
2262 |
buf=OPENSSL_malloc(bufsize); |
|
2263 |
if (buf == NULL) return(0); |
|
2264 |
io=BIO_new(BIO_f_buffer()); |
|
2265 |
ssl_bio=BIO_new(BIO_f_ssl()); |
|
2266 |
if ((io == NULL) || (ssl_bio == NULL)) goto err; |
|
2267 |
||
2268 |
#ifdef FIONBIO
|
|
2269 |
if (s_nbio) |
|
2270 |
{
|
|
2271 |
unsigned long sl=1; |
|
2272 |
||
2273 |
if (!s_quiet) |
|
2274 |
BIO_printf(bio_err,"turning on non blocking io\n"); |
|
2275 |
if (BIO_socket_ioctl(s,FIONBIO,&sl) < 0) |
|
2276 |
ERR_print_errors(bio_err); |
|
2277 |
}
|
|
2278 |
#endif
|
|
2279 |
||
2280 |
/* lets make the output buffer a reasonable size */
|
|
2281 |
if (!BIO_set_write_buffer_size(io,bufsize)) goto err; |
|
2282 |
||
2283 |
if ((con=SSL_new(ctx)) == NULL) goto err; |
|
1.1.6
by Matthias Klose
Import upstream version 0.9.8g |
2284 |
#ifndef OPENSSL_NO_TLSEXT
|
2285 |
if (s_tlsextdebug) |
|
2286 |
{
|
|
2287 |
SSL_set_tlsext_debug_callback(con, tlsext_cb); |
|
2288 |
SSL_set_tlsext_debug_arg(con, bio_s_out); |
|
2289 |
}
|
|
2290 |
#endif
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
2291 |
#ifndef OPENSSL_NO_KRB5
|
2292 |
if ((con->kssl_ctx = kssl_ctx_new()) != NULL) |
|
2293 |
{
|
|
2294 |
kssl_ctx_setstring(con->kssl_ctx, KSSL_SERVICE, KRB5SVC); |
|
2295 |
kssl_ctx_setstring(con->kssl_ctx, KSSL_KEYTAB, KRB5KEYTAB); |
|
2296 |
}
|
|
2297 |
#endif /* OPENSSL_NO_KRB5 */ |
|
2298 |
if(context) SSL_set_session_id_context(con, context, |
|
2299 |
strlen((char *)context)); |
|
2300 |
||
2301 |
sbio=BIO_new_socket(s,BIO_NOCLOSE); |
|
2302 |
if (s_nbio_test) |
|
2303 |
{
|
|
2304 |
BIO *test; |
|
2305 |
||
2306 |
test=BIO_new(BIO_f_nbio_test()); |
|
2307 |
sbio=BIO_push(test,sbio); |
|
2308 |
}
|
|
2309 |
SSL_set_bio(con,sbio,sbio); |
|
2310 |
SSL_set_accept_state(con); |
|
2311 |
||
2312 |
/* SSL_set_fd(con,s); */
|
|
2313 |
BIO_set_ssl(ssl_bio,con,BIO_CLOSE); |
|
2314 |
BIO_push(io,ssl_bio); |
|
2315 |
#ifdef CHARSET_EBCDIC
|
|
2316 |
io = BIO_push(BIO_new(BIO_f_ebcdic_filter()),io); |
|
2317 |
#endif
|
|
2318 |
||
2319 |
if (s_debug) |
|
2320 |
{
|
|
2321 |
con->debug=1; |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
2322 |
BIO_set_callback(SSL_get_rbio(con),bio_dump_callback); |
1.1.5
by Kurt Roeckx
Import upstream version 0.9.8e |
2323 |
BIO_set_callback_arg(SSL_get_rbio(con),(char *)bio_s_out); |
1
by Christoph Martin
Import upstream version 0.9.7d |
2324 |
}
|
2325 |
if (s_msg) |
|
2326 |
{
|
|
2327 |
SSL_set_msg_callback(con, msg_cb); |
|
2328 |
SSL_set_msg_callback_arg(con, bio_s_out); |
|
2329 |
}
|
|
2330 |
||
2331 |
for (;;) |
|
2332 |
{
|
|
2333 |
if (hack) |
|
2334 |
{
|
|
2335 |
i=SSL_accept(con); |
|
2336 |
||
2337 |
switch (SSL_get_error(con,i)) |
|
2338 |
{
|
|
2339 |
case SSL_ERROR_NONE: |
|
2340 |
break; |
|
2341 |
case SSL_ERROR_WANT_WRITE: |
|
2342 |
case SSL_ERROR_WANT_READ: |
|
2343 |
case SSL_ERROR_WANT_X509_LOOKUP: |
|
2344 |
continue; |
|
2345 |
case SSL_ERROR_SYSCALL: |
|
2346 |
case SSL_ERROR_SSL: |
|
2347 |
case SSL_ERROR_ZERO_RETURN: |
|
2348 |
ret=1; |
|
2349 |
goto err; |
|
2350 |
/* break; */
|
|
2351 |
}
|
|
2352 |
||
2353 |
SSL_renegotiate(con); |
|
2354 |
SSL_write(con,NULL,0); |
|
2355 |
}
|
|
2356 |
||
2357 |
i=BIO_gets(io,buf,bufsize-1); |
|
2358 |
if (i < 0) /* error */ |
|
2359 |
{
|
|
2360 |
if (!BIO_should_retry(io)) |
|
2361 |
{
|
|
2362 |
if (!s_quiet) |
|
2363 |
ERR_print_errors(bio_err); |
|
2364 |
goto err; |
|
2365 |
}
|
|
2366 |
else
|
|
2367 |
{
|
|
2368 |
BIO_printf(bio_s_out,"read R BLOCK\n"); |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
2369 |
#if defined(OPENSSL_SYS_NETWARE)
|
2370 |
delay(1000); |
|
2371 |
#elif !defined(OPENSSL_SYS_MSDOS) && !defined(__DJGPP__)
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
2372 |
sleep(1); |
2373 |
#endif
|
|
2374 |
continue; |
|
2375 |
}
|
|
2376 |
}
|
|
2377 |
else if (i == 0) /* end of input */ |
|
2378 |
{
|
|
2379 |
ret=1; |
|
2380 |
goto end; |
|
2381 |
}
|
|
2382 |
||
2383 |
/* else we have data */
|
|
2384 |
if ( ((www == 1) && (strncmp("GET ",buf,4) == 0)) || |
|
2385 |
((www == 2) && (strncmp("GET /stats ",buf,10) == 0))) |
|
2386 |
{
|
|
2387 |
char *p; |
|
2388 |
X509 *peer; |
|
2389 |
STACK_OF(SSL_CIPHER) *sk; |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
2390 |
static const char *space=" "; |
1
by Christoph Martin
Import upstream version 0.9.7d |
2391 |
|
2392 |
BIO_puts(io,"HTTP/1.0 200 ok\r\nContent-type: text/html\r\n\r\n"); |
|
2393 |
BIO_puts(io,"<HTML><BODY BGCOLOR=\"#ffffff\">\n"); |
|
2394 |
BIO_puts(io,"<pre>\n"); |
|
2395 |
/* BIO_puts(io,SSLeay_version(SSLEAY_VERSION));*/
|
|
2396 |
BIO_puts(io,"\n"); |
|
2397 |
for (i=0; i<local_argc; i++) |
|
2398 |
{
|
|
2399 |
BIO_puts(io,local_argv[i]); |
|
2400 |
BIO_write(io," ",1); |
|
2401 |
}
|
|
2402 |
BIO_puts(io,"\n"); |
|
2403 |
||
2404 |
/* The following is evil and should not really
|
|
2405 |
* be done */
|
|
2406 |
BIO_printf(io,"Ciphers supported in s_server binary\n"); |
|
2407 |
sk=SSL_get_ciphers(con); |
|
2408 |
j=sk_SSL_CIPHER_num(sk); |
|
2409 |
for (i=0; i<j; i++) |
|
2410 |
{
|
|
2411 |
c=sk_SSL_CIPHER_value(sk,i); |
|
2412 |
BIO_printf(io,"%-11s:%-25s", |
|
2413 |
SSL_CIPHER_get_version(c), |
|
2414 |
SSL_CIPHER_get_name(c)); |
|
2415 |
if ((((i+1)%2) == 0) && (i+1 != j)) |
|
2416 |
BIO_puts(io,"\n"); |
|
2417 |
}
|
|
2418 |
BIO_puts(io,"\n"); |
|
2419 |
p=SSL_get_shared_ciphers(con,buf,bufsize); |
|
2420 |
if (p != NULL) |
|
2421 |
{
|
|
2422 |
BIO_printf(io,"---\nCiphers common between both SSL end points:\n"); |
|
2423 |
j=i=0; |
|
2424 |
while (*p) |
|
2425 |
{
|
|
2426 |
if (*p == ':') |
|
2427 |
{
|
|
2428 |
BIO_write(io,space,26-j); |
|
2429 |
i++; |
|
2430 |
j=0; |
|
2431 |
BIO_write(io,((i%3)?" ":"\n"),1); |
|
2432 |
}
|
|
2433 |
else
|
|
2434 |
{
|
|
2435 |
BIO_write(io,p,1); |
|
2436 |
j++; |
|
2437 |
}
|
|
2438 |
p++; |
|
2439 |
}
|
|
2440 |
BIO_puts(io,"\n"); |
|
2441 |
}
|
|
2442 |
BIO_printf(io,((con->hit) |
|
2443 |
?"---\nReused, " |
|
2444 |
:"---\nNew, ")); |
|
2445 |
c=SSL_get_current_cipher(con); |
|
2446 |
BIO_printf(io,"%s, Cipher is %s\n", |
|
2447 |
SSL_CIPHER_get_version(c), |
|
2448 |
SSL_CIPHER_get_name(c)); |
|
2449 |
SSL_SESSION_print(io,SSL_get_session(con)); |
|
2450 |
BIO_printf(io,"---\n"); |
|
2451 |
print_stats(io,SSL_get_SSL_CTX(con)); |
|
2452 |
BIO_printf(io,"---\n"); |
|
2453 |
peer=SSL_get_peer_certificate(con); |
|
2454 |
if (peer != NULL) |
|
2455 |
{
|
|
2456 |
BIO_printf(io,"Client certificate\n"); |
|
2457 |
X509_print(io,peer); |
|
2458 |
PEM_write_bio_X509(io,peer); |
|
2459 |
}
|
|
2460 |
else
|
|
2461 |
BIO_puts(io,"no client certificate available\n"); |
|
2462 |
BIO_puts(io,"</BODY></HTML>\r\n\r\n"); |
|
2463 |
break; |
|
2464 |
}
|
|
2465 |
else if ((www == 2 || www == 3) |
|
2466 |
&& (strncmp("GET /",buf,5) == 0)) |
|
2467 |
{
|
|
2468 |
BIO *file; |
|
2469 |
char *p,*e; |
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
2470 |
static const char *text="HTTP/1.0 200 ok\r\nContent-type: text/plain\r\n\r\n"; |
1
by Christoph Martin
Import upstream version 0.9.7d |
2471 |
|
2472 |
/* skip the '/' */
|
|
2473 |
p= &(buf[5]); |
|
2474 |
||
2475 |
dot = 1; |
|
2476 |
for (e=p; *e != '\0'; e++) |
|
2477 |
{
|
|
2478 |
if (e[0] == ' ') |
|
2479 |
break; |
|
2480 |
||
2481 |
switch (dot) |
|
2482 |
{
|
|
2483 |
case 1: |
|
2484 |
dot = (e[0] == '.') ? 2 : 0; |
|
2485 |
break; |
|
2486 |
case 2: |
|
2487 |
dot = (e[0] == '.') ? 3 : 0; |
|
2488 |
break; |
|
2489 |
case 3: |
|
2490 |
dot = (e[0] == '/') ? -1 : 0; |
|
2491 |
break; |
|
2492 |
}
|
|
2493 |
if (dot == 0) |
|
2494 |
dot = (e[0] == '/') ? 1 : 0; |
|
2495 |
}
|
|
2496 |
dot = (dot == 3) || (dot == -1); /* filename contains ".." component */ |
|
2497 |
||
2498 |
if (*e == '\0') |
|
2499 |
{
|
|
2500 |
BIO_puts(io,text); |
|
2501 |
BIO_printf(io,"'%s' is an invalid file name\r\n",p); |
|
2502 |
break; |
|
2503 |
}
|
|
2504 |
*e='\0'; |
|
2505 |
||
2506 |
if (dot) |
|
2507 |
{
|
|
2508 |
BIO_puts(io,text); |
|
2509 |
BIO_printf(io,"'%s' contains '..' reference\r\n",p); |
|
2510 |
break; |
|
2511 |
}
|
|
2512 |
||
2513 |
if (*p == '/') |
|
2514 |
{
|
|
2515 |
BIO_puts(io,text); |
|
2516 |
BIO_printf(io,"'%s' is an invalid path\r\n",p); |
|
2517 |
break; |
|
2518 |
}
|
|
2519 |
||
2520 |
#if 0
|
|
2521 |
/* append if a directory lookup */
|
|
2522 |
if (e[-1] == '/')
|
|
2523 |
strcat(p,"index.html");
|
|
2524 |
#endif
|
|
2525 |
||
2526 |
/* if a directory, do the index thang */
|
|
1.1.11
by Kurt Roeckx
Import upstream version 1.0.0c |
2527 |
if (app_isdir(p)>0) |
1
by Christoph Martin
Import upstream version 0.9.7d |
2528 |
{
|
2529 |
#if 0 /* must check buffer size */ |
|
2530 |
strcat(p,"/index.html");
|
|
2531 |
#else
|
|
2532 |
BIO_puts(io,text); |
|
2533 |
BIO_printf(io,"'%s' is a directory\r\n",p); |
|
2534 |
break; |
|
2535 |
#endif
|
|
2536 |
}
|
|
2537 |
||
2538 |
if ((file=BIO_new_file(p,"r")) == NULL) |
|
2539 |
{
|
|
2540 |
BIO_puts(io,text); |
|
2541 |
BIO_printf(io,"Error opening '%s'\r\n",p); |
|
2542 |
ERR_print_errors(io); |
|
2543 |
break; |
|
2544 |
}
|
|
2545 |
||
2546 |
if (!s_quiet) |
|
2547 |
BIO_printf(bio_err,"FILE:%s\n",p); |
|
2548 |
||
2549 |
if (www == 2) |
|
2550 |
{
|
|
2551 |
i=strlen(p); |
|
2552 |
if ( ((i > 5) && (strcmp(&(p[i-5]),".html") == 0)) || |
|
2553 |
((i > 4) && (strcmp(&(p[i-4]),".php") == 0)) || |
|
2554 |
((i > 4) && (strcmp(&(p[i-4]),".htm") == 0))) |
|
2555 |
BIO_puts(io,"HTTP/1.0 200 ok\r\nContent-type: text/html\r\n\r\n"); |
|
2556 |
else
|
|
2557 |
BIO_puts(io,"HTTP/1.0 200 ok\r\nContent-type: text/plain\r\n\r\n"); |
|
2558 |
}
|
|
2559 |
/* send the file */
|
|
2560 |
for (;;) |
|
2561 |
{
|
|
2562 |
i=BIO_read(file,buf,bufsize); |
|
2563 |
if (i <= 0) break; |
|
2564 |
||
2565 |
#ifdef RENEG
|
|
2566 |
total_bytes+=i; |
|
2567 |
fprintf(stderr,"%d\n",i); |
|
2568 |
if (total_bytes > 3*1024) |
|
2569 |
{
|
|
2570 |
total_bytes=0; |
|
2571 |
fprintf(stderr,"RENEGOTIATE\n"); |
|
2572 |
SSL_renegotiate(con); |
|
2573 |
}
|
|
2574 |
#endif
|
|
2575 |
||
2576 |
for (j=0; j<i; ) |
|
2577 |
{
|
|
2578 |
#ifdef RENEG
|
|
2579 |
{ static count=0; if (++count == 13) { SSL_renegotiate(con); } } |
|
2580 |
#endif
|
|
2581 |
k=BIO_write(io,&(buf[j]),i-j); |
|
2582 |
if (k <= 0) |
|
2583 |
{
|
|
2584 |
if (!BIO_should_retry(io)) |
|
2585 |
goto write_error; |
|
2586 |
else
|
|
2587 |
{
|
|
2588 |
BIO_printf(bio_s_out,"rwrite W BLOCK\n"); |
|
2589 |
}
|
|
2590 |
}
|
|
2591 |
else
|
|
2592 |
{
|
|
2593 |
j+=k; |
|
2594 |
}
|
|
2595 |
}
|
|
2596 |
}
|
|
2597 |
write_error: |
|
2598 |
BIO_free(file); |
|
2599 |
break; |
|
2600 |
}
|
|
2601 |
}
|
|
2602 |
||
2603 |
for (;;) |
|
2604 |
{
|
|
2605 |
i=(int)BIO_flush(io); |
|
2606 |
if (i <= 0) |
|
2607 |
{
|
|
2608 |
if (!BIO_should_retry(io)) |
|
2609 |
break; |
|
2610 |
}
|
|
2611 |
else
|
|
2612 |
break; |
|
2613 |
}
|
|
2614 |
end: |
|
2615 |
#if 1
|
|
2616 |
/* make sure we re-use sessions */
|
|
2617 |
SSL_set_shutdown(con,SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN); |
|
2618 |
#else
|
|
2619 |
/* This kills performance */
|
|
2620 |
/* SSL_shutdown(con); A shutdown gets sent in the
|
|
2621 |
* BIO_free_all(io) procession */
|
|
2622 |
#endif
|
|
2623 |
||
2624 |
err: |
|
2625 |
||
2626 |
if (ret >= 0) |
|
2627 |
BIO_printf(bio_s_out,"ACCEPT\n"); |
|
2628 |
||
2629 |
if (buf != NULL) OPENSSL_free(buf); |
|
2630 |
if (io != NULL) BIO_free_all(io); |
|
2631 |
/* if (ssl_bio != NULL) BIO_free(ssl_bio);*/
|
|
2632 |
return(ret); |
|
2633 |
}
|
|
2634 |
||
2635 |
#ifndef OPENSSL_NO_RSA
|
|
2636 |
static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength) |
|
2637 |
{
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
2638 |
BIGNUM *bn = NULL; |
1
by Christoph Martin
Import upstream version 0.9.7d |
2639 |
static RSA *rsa_tmp=NULL; |
2640 |
||
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
2641 |
if (!rsa_tmp && ((bn = BN_new()) == NULL)) |
2642 |
BIO_printf(bio_err,"Allocation error in generating RSA key\n"); |
|
2643 |
if (!rsa_tmp && bn) |
|
1
by Christoph Martin
Import upstream version 0.9.7d |
2644 |
{
|
2645 |
if (!s_quiet) |
|
2646 |
{
|
|
2647 |
BIO_printf(bio_err,"Generating temp (%d bit) RSA key...",keylength); |
|
2648 |
(void)BIO_flush(bio_err); |
|
2649 |
}
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
2650 |
if(!BN_set_word(bn, RSA_F4) || ((rsa_tmp = RSA_new()) == NULL) || |
2651 |
!RSA_generate_key_ex(rsa_tmp, keylength, bn, NULL)) |
|
2652 |
{
|
|
2653 |
if(rsa_tmp) RSA_free(rsa_tmp); |
|
2654 |
rsa_tmp = NULL; |
|
2655 |
}
|
|
1
by Christoph Martin
Import upstream version 0.9.7d |
2656 |
if (!s_quiet) |
2657 |
{
|
|
2658 |
BIO_printf(bio_err,"\n"); |
|
2659 |
(void)BIO_flush(bio_err); |
|
2660 |
}
|
|
1.1.2
by Kurt Roeckx
Import upstream version 0.9.8a |
2661 |
BN_free(bn); |
1
by Christoph Martin
Import upstream version 0.9.7d |
2662 |
}
|
2663 |
return(rsa_tmp); |
|
2664 |
}
|
|
2665 |
#endif
|
|
2666 |
||
2667 |
#define MAX_SESSION_ID_ATTEMPTS 10
|
|
2668 |
static int generate_session_id(const SSL *ssl, unsigned char *id, |
|
2669 |
unsigned int *id_len) |
|
2670 |
{
|
|
2671 |
unsigned int count = 0; |
|
2672 |
do { |
|
2673 |
RAND_pseudo_bytes(id, *id_len); |
|
2674 |
/* Prefix the session_id with the required prefix. NB: If our
|
|
2675 |
* prefix is too long, clip it - but there will be worse effects
|
|
2676 |
* anyway, eg. the server could only possibly create 1 session
|
|
2677 |
* ID (ie. the prefix!) so all future session negotiations will
|
|
2678 |
* fail due to conflicts. */
|
|
2679 |
memcpy(id, session_id_prefix, |
|
2680 |
(strlen(session_id_prefix) < *id_len) ? |
|
2681 |
strlen(session_id_prefix) : *id_len); |
|
2682 |
}
|
|
2683 |
while(SSL_has_matching_session_id(ssl, id, *id_len) && |
|
2684 |
(++count < MAX_SESSION_ID_ATTEMPTS)); |
|
2685 |
if(count >= MAX_SESSION_ID_ATTEMPTS) |
|
2686 |
return 0; |
|
2687 |
return 1; |
|
2688 |
}
|