aboutsummaryrefslogtreecommitdiffstats
path: root/apps/s_server.c
Commit message (Collapse)AuthorAgeFilesLines
* Pack globals variables used to control apps/verify_callback()FdaSilvaYY2016-08-041-11/+10
| | | | | | | | | into a structure , to avoid any accident . Plus some few cleanups Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Typo and comment fixFdaSilvaYY2016-07-251-2/+2
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1301)
* Unused variable cleanupFdaSilvaYY2016-07-251-2/+0
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1301)
* Discard a dead optionFdaSilvaYY2016-07-251-8/+2
| | | | | | | Old inactive inherited code, a code relic for sure. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1301)
* Fix a few if(, for(, while( inside code.FdaSilvaYY2016-07-201-3/+3
| | | | | | | Fix some indentation at the same time Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1292)
* Disallow multiple protocol flags to s_server and s_clientMatt Caswell2016-07-081-1/+16
| | | | | | | | | We shouldn't allow both "-tls1" and "-tls1_2", or "-tls1" and "-no_tls1_2". The only time multiple flags are allowed is where they are all "-no_<prot>". This fixes Github Issue #1268 Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add a comment after some #endif at end of apps source code.FdaSilvaYY2016-06-181-1/+1
| | | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1168)
* Don't skip leading zeroes in PSK keys.Dr. Stephen Henson2016-06-121-19/+13
| | | | | | | | | Don't use BN_hex2bn() for PSK key conversion as the conversion to BN and back removes leading zeroes, use OPENSSL_hexstr2buf() instead. RT#4554 Reviewed-by: Matt Caswell <matt@openssl.org>
* Free a BIO_ADDR if DTLSv1_listen return <=0Matt Caswell2016-06-011-0/+2
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Don't leak X509_OBJECT in an error pathMatt Caswell2016-06-011-3/+3
| | | | | | Swap the ordering of some code to avoid a leak in an error path. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix s_client/s_server waiting for stdin on WindowsMatt Caswell2016-05-271-3/+3
| | | | | | | | | | | | | | On Windows we were using the function _kbhit() to determine whether there was input waiting in stdin for us to read. Actually all this does is work out whether there is a keyboard press event waiting to be processed in the input buffer. This only seems to work in a standard Windows console (not Msys console) and also doesn't work if you redirect the input from some other source (as we do in TLSProxy tests). This commit changes things to work differently depending on whether we are on the Windows console or not. RT#4255 Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix some s_server issues on WindowsMatt Caswell2016-05-271-1/+14
| | | | | | | | | | | | | | | | | In s_server we call BIO_sock_should_retry() to determine the state of the socket and work out whether we should retry an operation on it or not. However if you leave it too long to call this then other operations may have occurred in the meantime which affect the result. Therefore we should call it early and remember the result for when we need to use it. This fixes a test problem on Windows. Another issue with s_server on Windows is that some of output to stdout does not get displayed immediately. Apparently more liberal use of BIO_flush is required. RT#4255 Reviewed-by: Richard Levitte <levitte@openssl.org>
* Support -no-CAfile -no-CApath in ctx2Dr. Stephen Henson2016-05-231-2/+3
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Few cleanups in s_client, s_server apps.FdaSilvaYY2016-05-181-12/+6
| | | | | | | | | Discard useless static engine_id Add a const qualifier Fix some spelling Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* X509_STORE_CTX accessors.Rich Salz2016-05-171-2/+2
| | | | | | | Add some functions that were missing when a number of X509 objects became opaque (thanks, Roumen!) Reviewed-by: Richard Levitte <levitte@openssl.org>
* Copyright consolidation 01/10Rich Salz2016-05-171-107/+7
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Handle no async jobs in libsslMatt Caswell2016-05-051-0/+8
| | | | | | | | | | If the application has limited the size of the async pool using ASYNC_init_thread() then we could run out of jobs while trying to start a libssl io operation. However libssl was failing to handle this and treating it like a fatal error. It should not be fatal...we just need to retry when there are jobs available again. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix building with -DCHARSET_EBCDICMatt Caswell2016-04-291-39/+54
| | | | | | | Building with -DCHARSET_EBCDIC and using --strict-warnings resulted in lots of miscellaneous errors. This fixes it. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Make many X509_xxx types opaque.Rich Salz2016-04-151-12/+16
| | | | | | | | | Make X509_OBJECT, X509_STORE_CTX, X509_STORE, X509_LOOKUP, and X509_LOOKUP_METHOD opaque. Remove unused X509_CERT_FILE_CTX Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Fix no-ocspMatt Caswell2016-04-061-1/+8
| | | | | | Misc fixes for no-ocsp Reviewed-by: Rich Salz <rsalz@openssl.org>
* RT4660: BIO_METHODs should be const.David Benjamin2016-03-211-2/+2
| | | | | | | BIO_new, etc., don't need a non-const BIO_METHOD. This allows all the built-in method tables to live in .rodata. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix no-sockMatt Caswell2016-03-211-0/+4
| | | | | | Misc fixes for no-sock Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove Netware and OS/2Rich Salz2016-03-171-14/+5
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Use minimum and maximum protocol version instead of version fixed methodsKurt Roeckx2016-03-091-18/+25
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1824
* Fix cert leaks in s_serverFdaSilvaYY2016-03-081-3/+6
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* GH787: Fix ALPNTodd Short2016-03-081-4/+4
| | | | | | | | | | | | * Perform ALPN after the SNI callback; the SSL_CTX may change due to that processing * Add flags to indicate that we actually sent ALPN, to properly error out if unexpectedly received. * clean up ssl3_free() no need to explicitly clear when doing memset * document ALPN functions Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Fix s_server/s_client handling of the split_send_frag argumentMatt Caswell2016-03-071-2/+5
| | | | | | | Ensure that a value of 0 is correctly handled for the split_send_frag argument. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add documentation for new s_server/s_client optionsMatt Caswell2016-03-071-1/+1
| | | | | | Document the new split_send_frag, max_pipelines and read_buf options. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Ensure s_client and s_server work when read_ahead is setMatt Caswell2016-03-071-2/+2
| | | | | | | | | Previously s_client and s_server relied on using SSL_pending() which does not take into account read_ahead. For read pipelining to work, read_ahead gets set automatically. Therefore s_client and s_server have been converted to use SSL_has_pending() instead. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add an ability to set the SSL read buffer sizeMatt Caswell2016-03-071-2/+13
| | | | | | | | | This capability is required for read pipelining. We will only read in as many records as will fit in the read buffer (and the network can provide in one go). The bigger the buffer the more records we can process in parallel. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add pipeline support to s_server and s_clientMatt Caswell2016-03-071-1/+35
| | | | | | | | | Add the options min_send_frag and max_pipelines to s_server and s_client in order to control pipelining capabilities. This will only have an effect if a pipeline capable cipher is used (such as the one provided by the dasync engine). Reviewed-by: Tim Hudson <tjh@openssl.org>
* ISSUE 43: Add BIO_sock_shutdownRich Salz2016-03-071-3/+3
| | | | | | This replaces SHUTDOWN/SHUTDOWN2 with BIO_closesocket. Reviewed-by: Richard Levitte <levitte@openssl.org>
* GH764: s_server: trace option fall throughJ Mohan Rao Arisankala2016-02-291-2/+1
| | | | | | | | in s_server cmd: specifying -trace option, falls through and turn-on security_debug Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* using macro inside the case.J Mohan Rao Arisankala2016-02-271-2/+2
| | | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* fix build with no-srtpJ Mohan Rao Arisankala2016-02-271-1/+3
| | | | | | | | | - srtp_profiles variable is defined when building with SRTP, keeping the variable usage also under ifndef OPENSSL_NO_SRTP - alpn help option was kept under ifndef OPENSSL_NO_SRTP Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* RT2275: use BIO_sock_nbio()Rich Salz2016-02-271-23/+6
| | | | | | Now that BIO_sock_nbio is available, use it in the apps. Reviewed-by: Richard Levitte <levitte@openssl.org>
* CVE-2016-0798: avoid memory leak in SRPEmilia Kasper2016-02-251-16/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | The SRP user database lookup method SRP_VBASE_get_by_user had confusing memory management semantics; the returned pointer was sometimes newly allocated, and sometimes owned by the callee. The calling code has no way of distinguishing these two cases. Specifically, SRP servers that configure a secret seed to hide valid login information are vulnerable to a memory leak: an attacker connecting with an invalid username can cause a memory leak of around 300 bytes per connection. Servers that do not configure SRP, or configure SRP but do not configure a seed are not vulnerable. In Apache, the seed directive is known as SSLSRPUnknownUserSeed. To mitigate the memory leak, the seed handling in SRP_VBASE_get_by_user is now disabled even if the user has configured a seed. Applications are advised to migrate to SRP_VBASE_get1_by_user. However, note that OpenSSL makes no strong guarantees about the indistinguishability of valid and invalid logins. In particular, computations are currently not carried out in constant time. Reviewed-by: Rich Salz <rsalz@openssl.org>
* GH480: Don't break statements with CPP stuff.Flavio Medeiros2016-02-241-2/+1
| | | | | | | This is also RT 4137 Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Andy Polyakov <appro@openssl.org>
* Remove unused parameters from internal functionsRich Salz2016-02-221-19/+12
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove JPAKERich Salz2016-02-171-33/+4
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Make sure to use unsigned char for is*() functionsRichard Levitte2016-02-141-1/+1
| | | | | | | | | | | On some platforms, the implementation is such that a signed char triggers a warning when used with is*() functions. On others, the behavior is outright buggy when presented with a char that happens to get promoted to a negative integer. The safest thing is to cast the char that's used to an unsigned char. Reviewed-by: Andy Polyakov <appro@openssl.org>
* GH646: Update help for s_server command.A J Mohan Rao2016-02-091-33/+56
| | | | | | | | | | | | * added missing help option messages * ecdh_single option is removed as it is a no-op and not an option supported in earlier versions * ssl_ctx_security_debug() was invoked before ctx check for NULL * trusted_first option can be removed, as it is always enabled in 1.1. But not removed the option, require confirmation. Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Auto init/deinit libcryptoMatt Caswell2016-02-091-4/+0
| | | | | | | This builds on the previous commit to auto initialise/deinitialise libcrypto. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Deprecate undocumented SSL_cache_hit().Dr. Stephen Henson2016-02-081-2/+2
| | | | | | | Deprecate undocumented SSL_cache_hit(). Make SSL_session_reused() into a real function. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Make DTLSv1_listen a first class function and change its typeMatt Caswell2016-02-051-1/+1
| | | | | | | | | The DTLSv1_listen function exposed details of the underlying BIO abstraction and did not properly allow for IPv6. This commit changes the "peer" argument to be a BIO_ADDR and makes it a first class function (rather than a ctrl) to ensure proper type checking. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Refactoring BIO: Adapt s_client and s_serverRichard Levitte2016-02-031-37/+94
| | | | | | | | | | | | | | | | | | | s_socket.c gets brutally cleaned out and now consists of only two functions, one for client and the other for server. They both handle AF_INET, AF_INET6 and additionally AF_UNIX where supported. The rest is just easy adaptation. Both s_client and s_server get the new flags -4 and -6 to force the use of IPv4 or IPv6 only. Also, the default host "localhost" in s_client is removed. It's not certain that this host is set up for both IPv4 and IPv6. For example, Debian has "ip6-localhost" as the default hostname for [::1]. The better way is to default |host| to NULL and rely on BIO_lookup() to return a BIO_ADDRINFO with the appropriate loopback address for IPv4 or IPv6 as indicated by the |family| parameter. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Refactoring BIO: Adapt BIO_s_datagram and all that depends on itRichard Levitte2016-02-031-5/+9
| | | | | | | The control commands that previously took a struct sockaddr * have been changed to take a BIO_ADDR * instead. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* constify PACKETEmilia Kasper2016-02-011-1/+1
| | | | | | | | PACKET contents should be read-only. To achieve this, also - constify two user callbacks - constify BUF_reverse. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Refactor apps load_certs/load_crls to work incrementallyViktor Dukhovni2016-01-201-6/+4
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Support disabling any or all TLS or DTLS versionsViktor Dukhovni2016-01-191-28/+43
| | | | | | | | | | | | | | | Some users want to disable SSL 3.0/TLS 1.0/TLS 1.1, and enable just TLS 1.2. In the future they might want to disable TLS 1.2 and enable just TLS 1.3, ... This commit makes it possible to disable any or all of the TLS or DTLS protocols. It also considerably simplifies the SSL/TLS tests, by auto-generating the min/max version tests based on the set of supported protocols (425 explicitly written out tests got replaced by two loops that generate all 425 tests if all protocols are enabled, fewer otherwise). Reviewed-by: Richard Levitte <levitte@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-26 20:54:28 +0000