aboutsummaryrefslogtreecommitdiffstats
path: root/apps/s_server.c
Commit message (Collapse)AuthorAgeFilesLines
* Add SSL_get[01]_peer_certificate()Todd Short2020-07-161-4/+2
| | | | | | | | | | | | Deprecate SSL_get_peer_certificte() and replace with SSL_get1_peer_certificate(). Add SSL_get0_peer_certificate. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/8730)
* Introducing option SSL_OP_IGNORE_UNEXPECTED_EOFDmitry Belyavskiy2020-05-191-2/+10
| | | | | | | | | | | | | | Partially fixes #11209. Before OpenSSL 3.0 in case when peer does not send close_notify, the behaviour was to set SSL_ERROR_SYSCALL error with errno 0. This behaviour has changed. The SSL_OP_IGNORE_UNEXPECTED_EOF restores the old behaviour for compatibility's sake. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11735)
* Add 'methods' parameter to setup_engine() in apps.c for individual method ↵David von Oheimb2020-05-151-1/+3
| | | | | | | | defaults Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/4277)
* Use OSSL_STORE for load_{,pub}key() and load_cert() in apps/lib/apps.cDr. David von Oheimb2020-05-151-9/+8
| | | | | | | | | | This also adds the more flexible and general load_key_cert_crl() as well as helper functions get_passwd(), cleanse(), and clear_free() to be used also in apps/cmp.c etc. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/11755)
* SSL_OP_DISABLE_TLSEXT_CA_NAMES option implementationNikolay Morozov2020-05-071-1/+11
| | | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11709)
* s_server normal shutdownDmitry Belyavskiy2020-05-061-5/+3
| | | | | | | Partially fixes #11209 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11734)
* Clean up the use of ERR_print_errors() in apps.c and in four appsDr. David von Oheimb2020-04-241-15/+5
| | | | | | | | | Also make sure that all error messages in apps.c consistently begin upper-case. Changed files: apps/lib/apps.c and apps/{req.c,s_client.c,s_server.c,x509.c} Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/4940)
* Add function load_csr(file,format,desc) to apps/lib/apps.cDavid von Oheimb2020-04-241-5/+2
| | | | | | | | | | | Make use of new load_csr() in 'ca', 'req', and 'x509' app Add '-inform' and '-certform' option to 'ca' app Add 'desc' parameter to load_crl() function defined in apps/lib/apps.c Allow 'desc' parameter to be NULL (gives option to suppress error output) Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/4940)
* In OpenSSL builds, declare STACK for datatypes ...Rich Salz2020-04-241-0/+6
| | | | | | | | | | | | | | | | | | | | | | ... and only *define* them in the source files that need them. Use DEFINE_OR_DECLARE which is set appropriately for internal builds and not non-deprecated builds. Deprecate stack-of-block Better documentation Move some ASN1 struct typedefs to types.h Update ParseC to handle this. Most of all, ParseC needed to be more consistent. The handlers are "recursive", in so far that they are called again and again until they terminate, which depends entirely on what the "massager" returns. There's a comment at the beginning of ParseC that explains how that works. {Richard Levtte} Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/10669)
* Update copyright yearMatt Caswell2020-04-231-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11616)
* Fix descriptions of credentials and verification options for various appsDr. David von Oheimb2020-04-201-24/+24
| | | | | | | | | | | | fix doc of s_client and s_server credentials and verification options fix doc of verification options also for s_time, x509, crl, req, ts, and verify correcting and extending texts regarding untrusted and trusted certs, making the order of options in the docs and help texts more consistent, etc. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11273)
* apps: support sendfile in s_server when ktls enabledTianjia Zhang2020-04-011-24/+83
| | | | | | | | | | | | | | When the -WWW or -HTTP option is specified, s_server can choose to use SSL_sendfile to transmit the file requested by client with KTLS is enabled, taking full advantage of the performance advantages of Kernel TLS, and adding the '-sendfile' command line parameter to control this behavior. Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11318)
* s_server: Properly indicate ALPN protocol mismatchTomas Mraz2020-03-271-1/+1
| | | | | | | | | | Return SSL_TLSEXT_ERR_ALERT_FATAL from alpn_select_cb so that an alert is sent to the client on ALPN protocol mismatch. Fixes: #2708 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11415)
* Use ctx2 instead ctx.Richard Könning2020-03-241-1/+1
| | | | | | | | CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/11372)
* s_server: warn about NO PSK identity hint in TLSv1.3EasySec2020-03-201-4/+10
| | | | | | | | | There is NO PSK identity hint in TLSv1.3 so output a warning message when inconsistent PSK / TLS options are mixed. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11322)
* cmdline app: add provider commandline options.Pauli2020-03-071-1/+7
| | | | | | | | | | Add a -provider option to allow providers to be loaded. This option can be specified multiple times. Add a -provider_path option to allow the path to providers to be specified. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11167)
* Generalize the HTTP client so far implemented mostly in crypto/ocsp/ocsp_ht.cDr. David von Oheimb2020-02-101-7/+6
| | | | | | | | | | | | | | | | The new client has become an independent libcrpyto module in crypto/http/ and * can handle any types of requests and responses (ASN.1-encoded and plain) * does not include potentially busy loops when waiting for responses but * makes use of a new timeout mechanism integrated with socket-based BIO * supports the use of HTTP proxies and TLS, including HTTPS over proxies * supports HTTP redirection via codes 301 and 302 for GET requests * returns more useful diagnostics in various error situations Also adapts - and strongly simplifies - hitherto uses of HTTP in crypto/ocsp/, crypto/x509/x_all.c, apps/lib/apps.c, and apps/{ocsp,s_client,s_server}.c Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/10667)
* commit a6efbe123af3d98b4d10d4fcdfe68dc5303212f8raniervf2019-11-161-4/+6
| | | | | | | | | | | Author: raniervf <ranier_gyn@hotmail.com> Date: Thu Nov 7 18:59:11 2019 -0300 Avoid calling strlen repeatedly in loops. Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10380)
* Add "sections" to -help outputRich Salz2019-11-081-69/+85
| | | | | | | | | | | | | Remove "Valid options" label, since all commands have sections (and [almost] always the first one is "General options"). Have "list --options" ignore section headers Reformat ts's additional help Add output section Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9953)
* Add -CAstore and similar to all openssl commands that have -CApathRichard Levitte2019-11-031-8/+34
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8442)
* Fix an s_server arbitrary file read issue on WindowsMatt Caswell2019-10-281-4/+10
| | | | | | | | | | | | | | | | | Running s_server in WWW mode on Windows can allow a client to read files outside the s_server directory by including backslashes in the name, e.g. GET /..\myfile.txt HTTP/1.0 There exists a check for this for Unix paths but it is not sufficient for Windows. Since s_server is a test tool no CVE is assigned. Thanks to Jobert Abma for reporting this. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10215)
* Cleanup hardcoded cipher suite codepoints in s_serverJohannes Bauer2019-10-281-3/+0
| | | | | | | | | | | The hardcoded code points for TLSv1.3 cipher suites are used in the TLS PSK server callback. However, they seem to have been refactored a while ago to use tls13_aes128gcmsha256_id, so these defines are not necessary within the s_server code anymore. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10243)
* Replace BUF_ string function calls with OPENSSL_ onesRich Salz2019-10-171-2/+2
| | | | | | | | Deprecate the BUF_ string macros Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10207)
* Get rid of using deprecated function isasciiDmitry Belyavskiy2019-08-191-1/+1
| | | | | | | | | Avoid using functions deprecated in some libcs (e.g. uClibc-ng). Fixes #9557 Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9628)
* Squashed commit of the following:Lorinczy Zsigmond2019-05-091-2/+11
| | | | | | | | | Add new option '-http_server_binmode' which allows the server to open and send binary files as well as text. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8811)
* apps: print Kernel receive side TLS in s_client and s_serverBoris Pismenny2019-04-011-0/+2
| | | | | | Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7848)
* Remove heartbeats completelyRichard Levitte2019-03-291-8/+0
| | | | | | | Fixes #4856 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1928)
* Fix end-point shared secret for DTLS/SCTPMichael Tuexen2019-02-011-1/+16
| | | | | | | | | | | | | When computing the end-point shared secret, don't take the terminating NULL character into account. Please note that this fix breaks interoperability with older versions of OpenSSL, which are not fixed. Fixes #7956 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7957)
* Fix error message for s_server -psk optionweinholtendian2019-01-311-1/+1
| | | | | | | | | | | | Previously if -psk was given a bad key it would print "Not a hex number 's_server'". CLA: Trivial Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/8113)
* apps: print Kernel TLS in s_client and s_serverBoris Pismenny2018-12-071-0/+4
| | | | | | | | | Signed-off-by: Boris Pismenny <borisp@mellanox.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5253)
* Following the license change, modify the boilerplates in apps/Richard Levitte2018-12-061-1/+1
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7765)
* openssl s_server: don't use sendto() with connected UDP socketMatthew Hodgson2018-11-211-0/+2
| | | | | | | | | | | | | | | | Fixes #7675 On macOS, if you call `connect()` on a UDP socket you cannot then call `sendto()` with a destination, otherwise it fails with Err#56 ('socket is already connected'). By calling `BIO_ctrl_set_connected()` on the wbio we can tell it that the socket has been connected and make it call `send()` rather than `sendto()`. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7676)
* Don't complain and fail about unknown TLSv1.3 PSK identities in s_serverMatt Caswell2018-10-191-3/+2
| | | | | | | | | | | An unknown PSK identity could be because its actually a session resumption attempt. Sessions resumptions and external PSKs are indistinguishable so the callbacks need to fail gracefully if they don't recognise the identity. Fixes #7433 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7434)
* Don't allow -early_data with other options where it doesn't workMatt Caswell2018-09-131-0/+5
| | | | | | | | | -early_data is not compatible with -www, -WWW, -HTTP or -rev. Fixes #7200 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7206)
* Free SSL object on an error pathMatt Caswell2018-08-301-2/+6
| | | | | | | | | Thanks to @fangang190 for reporting this Fixes #7061 Reviewed-by: Paul Yang <yang.yang@baishancloud.com> (Merged from https://github.com/openssl/openssl/pull/7065)
* Don't fail if the PSK identity doesn't matchMatt Caswell2018-07-061-2/+5
| | | | | | | | | | In 1.1.0 s_server if the PSK identity doesn't match what we have then a warning is printed and we continue the connection anyway. In 1.1.1, if TLSv1.3 is used and the identity doesn't match then we abort the connection. We should really be consistent with the old behaviour. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6659)
* Add the ability to configure recv_max_early_data via s_serverMatt Caswell2018-07-061-4/+15
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6655)
* Add the ability to configure anti-replay via SSL_CONFMatt Caswell2018-07-021-0/+5
| | | | | | | | This also adds the ability to control this through s_server Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6469)
* Free a variable on an error pathMatt Caswell2018-05-311-0/+1
| | | | | | | Issue found by Coverity. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6373)
* Enable SSL_MODE_AUTO_RETRY by defaultKurt Roeckx2018-05-221-0/+3
| | | | | | | | | | | | | Because TLS 1.3 sends more non-application data records some clients run into problems because they don't expect SSL_read() to return and set SSL_ERROR_WANT_READ after processing it. This can cause problems for clients that use blocking I/O and use select() to see if data is available. It can be cleared using SSL_CTX_clear_mode(). Reviewed-by: Matt Caswell <matt@openssl.org> GH: #6260
* Fix no-srtp build warningsTodd Short2018-05-201-0/+4
| | | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6255)
* Allow configuation of the number of TLSv1.3 session tickets via SSL_CONFMatt Caswell2018-05-171-1/+4
| | | | | | | | Also allows the apps to set it. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5227)
* Fix s_client and s_server so that they correctly handle the DTLS timerMatt Caswell2018-05-081-5/+2
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6170)
* apps/s_server.c: Avoid unused variable due to 'no-dtls'Richard Levitte2018-04-271-6/+4
| | | | | | | Fixes #6098 Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6104)
* openssl s_server: print the accepting address and socketRichard Levitte2018-04-041-8/+1
| | | | | | | | | | The line saying ACCEPT is extended with a space followed by the the address and port combination on which s_server accepts connections. The address is written in such a way that s_client should be able to accepts as argument for the '-connect' option. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5843)
* Unify s_client/s_server srtp profiles option handlingFdaSilvaYY2018-03-211-9/+2
| | | | | | | | | | | Add missing guards around STRP-related fields Remove two unneeded global variables: my 2'cents to #4679 Merge definition and instantiation of srpsrvparm global. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4908)
* s_client, s_server: do generic SSL configuration first, specialization afterRichard Levitte2018-03-191-4/+8
| | | | | | | | | | | | | | | | | | We did the SSL_CONF_cmd() pass last of all things that could affect the SSL ctx. However, the results of this, for example: -max_protocol TLSv1.3 -tls1_2 ... would mean that the protocol min got set to TLSv1.2 and the protocol max to TLSv1.3, when they should clearly both be TLSv1.2. However, if we see the SSL_CONF_cmd() switches as generic and those internal to s_client and s_server as specialisations, we get something that makes a little more sense. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5679)
* Introduce SSL_CTX_set_stateless_cookie_{generate,verify}_cbBenjamin Saunders2018-03-121-0/+4
| | | | | | | | | | These functions are similar to SSL_CTX_set_cookie_{generate,verify}_cb, but used for the application-controlled portion of TLS1.3 stateless handshake cookies rather than entire DTLSv1 cookies. Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5463)
* Tolerate TLSv1.3 PSKs that are a different size to the hash sizeMatt Caswell2018-03-091-7/+3
| | | | | | | | We also default to SHA256 as per the spec if we do not have an explicit digest defined. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5554)
* Do not set a nonzero default max_early_dataBenjamin Kaduk2018-02-281-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When early data support was first added, this seemed like a good idea, as it would allow applications to just add SSL_read_early_data() calls as needed and have things "Just Work". However, for applications that do not use TLS 1.3 early data, there is a negative side effect. Having a nonzero max_early_data in a SSL_CTX (and thus, SSL objects derived from it) means that when generating a session ticket, tls_construct_stoc_early_data() will indicate to the client that the server supports early data. This is true, in that the implementation of TLS 1.3 (i.e., OpenSSL) does support early data, but does not necessarily indicate that the server application supports early data, when the default value is nonzero. In this case a well-intentioned client would send early data along with its resumption attempt, which would then be ignored by the server application, a waste of network bandwidth. Since, in order to successfully use TLS 1.3 early data, the application must introduce calls to SSL_read_early_data(), it is not much additional burden to require that the application also calls SSL_{CTX_,}set_max_early_data() in order to enable the feature; doing so closes this scenario where early data packets would be sent on the wire but ignored. Update SSL_read_early_data.pod accordingly, and make s_server and our test programs into applications that are compliant with the new requirements on applications that use early data. Fixes #4725 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5483)
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-21 06:54:07 +0000