Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update.

Browse Source
This commit is contained in:
Hakase
2020-04-25 19:56:17 +09:00
parent 2015c00c43
commit 80ef640063
5977 changed files with 13451 additions and 5979 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/s_server.c
+38 -45
View File
@@ -1,5 +1,5 @@
/*
* Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
* Copyright 2005 Nokia. All rights reserved.
*
@@ -60,6 +60,12 @@ typedef unsigned int u_int;
#endif
#include "internal/sockets.h"
DEFINE_STACK_OF(X509_EXTENSION)
DEFINE_STACK_OF(X509_CRL)
DEFINE_STACK_OF(X509)
DEFINE_STACK_OF(SSL_CIPHER)
DEFINE_STACK_OF_STRING()
static int not_resumable_sess_cb(SSL *s, int is_forward_secure);
static int sv_body(int s, int stype, int prot, unsigned char *context);
static int www_body(int s, int stype, int prot, unsigned char *context);
@@ -802,31 +808,36 @@ const OPTIONS s_server_options[] = {
{"verify", OPT_VERIFY, 'n', "Turn on peer certificate verification"},
{"Verify", OPT_UPPER_V_VERIFY, 'n',
"Turn on peer certificate verification, must have a cert"},
{"cert", OPT_CERT, '<', "Certificate file to use; default is " TEST_CERT},
{"nameopt", OPT_NAMEOPT, 's', "Certificate subject/issuer name printing options"},
{"cert", OPT_CERT, '<', "Server certificate file to use; default is " TEST_CERT},
{"cert2", OPT_CERT2, '<',
"Certificate file to use for servername; default is" TEST_CERT2},
{"key2", OPT_KEY2, '<',
"-Private Key file to use for servername if not in -cert2"},
{"nameopt", OPT_NAMEOPT, 's', "Various certificate name options"},
{"certform", OPT_CERTFORM, 'F',
"Server certificate file format (PEM or DER) PEM default"},
{"cert_chain", OPT_CERT_CHAIN, '<',
"Server certificate chain file in PEM format"},
{"build_chain", OPT_BUILD_CHAIN, '-', "Build server certificate chain"},
{"serverinfo", OPT_SERVERINFO, 's',
"PEM serverinfo file for certificate"},
{"certform", OPT_CERTFORM, 'F',
"Certificate format (PEM or DER) PEM default"},
{"key", OPT_KEY, 's',
"Private Key if not in -cert; default is " TEST_CERT},
"Private key file to use; default is -cert file or else" TEST_CERT},
{"key2", OPT_KEY2, '<',
"-Private Key file to use for servername if not in -cert2"},
{"keyform", OPT_KEYFORM, 'f',
"Key format (PEM, DER or ENGINE) PEM default"},
{"pass", OPT_PASS, 's', "Private key file pass phrase source"},
{"dcert", OPT_DCERT, '<',
"Second certificate file to use (usually for DSA)"},
{"dhparam", OPT_DHPARAM, '<', "DH parameters file to use"},
"Second server certificate file to use (usually for DSA)"},
{"dcertform", OPT_DCERTFORM, 'F',
"Second certificate format (PEM or DER) PEM default"},
"Second server certificate file format (PEM or DER) PEM default"},
{"dcert_chain", OPT_DCERT_CHAIN, '<',
"second server certificate chain file in PEM format"},
{"dkey", OPT_DKEY, '<',
"Second private key file to use (usually for DSA)"},
{"dkeyform", OPT_DKEYFORM, 'F',
"Second key format (PEM, DER or ENGINE) PEM default"},
"Second key file format (PEM, DER or ENGINE) PEM default"},
{"dpass", OPT_DPASS, 's', "Second private key file pass phrase source"},
{"dhparam", OPT_DHPARAM, '<', "DH parameters file to use"},
{"servername", OPT_SERVERNAME, 's',
"Servername for HostName TLS extension"},
{"servername_fatal", OPT_SERVERNAME_FATAL, '-',
@@ -850,12 +861,17 @@ const OPTIONS s_server_options[] = {
{"keymatexportlen", OPT_KEYMATEXPORTLEN, 'p',
"Export len bytes of keying material (default 20)"},
{"CRL", OPT_CRL, '<', "CRL file to use"},
{"CRLform", OPT_CRLFORM, 'F', "CRL file format (PEM or DER); default PEM"},
{"crl_download", OPT_CRL_DOWNLOAD, '-',
"Download CRL from distribution points"},
"Download CRLs from distribution points in certificate CDP entries"},
{"chainCAfile", OPT_CHAINCAFILE, '<',
"CA file for certificate chain (PEM format)"},
{"chainCApath", OPT_CHAINCAPATH, '/',
"use dir as certificate store path to build CA certificate chain"},
{"chainCAstore", OPT_CHAINCASTORE, ':',
"use URI as certificate store to build CA certificate chain"},
{"verifyCAfile", OPT_VERIFYCAFILE, '<',
"CA file for certificate verification (PEM format)"},
{"verifyCApath", OPT_VERIFYCAPATH, '/',
"use dir as certificate store path to verify CA certificate"},
{"verifyCAstore", OPT_VERIFYCASTORE, ':',
@@ -863,13 +879,10 @@ const OPTIONS s_server_options[] = {
{"no_cache", OPT_NO_CACHE, '-', "Disable session cache"},
{"ext_cache", OPT_EXT_CACHE, '-',
"Disable internal cache, setup and use external cache"},
{"CRLform", OPT_CRLFORM, 'F', "CRL format (PEM or DER) PEM is default"},
{"verify_return_error", OPT_VERIFY_RET_ERROR, '-',
"Close connection on verification error"},
{"verify_quiet", OPT_VERIFY_QUIET, '-',
"No verify output except verify errors"},
{"verifyCAfile", OPT_VERIFYCAFILE, '<',
"CA file for certificate verification (PEM format)"},
{"ign_eof", OPT_IGN_EOF, '-', "ignore input eof (default when -quiet)"},
{"no_ign_eof", OPT_NO_IGN_EOF, '-', "Do not ignore input eof"},
@@ -990,13 +1003,6 @@ const OPTIONS s_server_options[] = {
OPT_R_OPTIONS,
OPT_S_OPTIONS,
OPT_V_OPTIONS,
{"cert_chain", OPT_CERT_CHAIN, '<',
"certificate chain file in PEM format"},
{"dcert_chain", OPT_DCERT_CHAIN, '<',
"second certificate chain file in PEM format"},
{"build_chain", OPT_BUILD_CHAIN, '-', "Build certificate chain"},
{"chainCAfile", OPT_CHAINCAFILE, '<',
"CA file for certificate chain (PEM format)"},
OPT_X_OPTIONS,
OPT_PROV_OPTIONS,
{NULL}
@@ -1244,7 +1250,7 @@ int s_server_main(int argc, char *argv[])
s_key_file = opt_arg();
break;
case OPT_KEYFORM:
if (!opt_format(opt_arg(), OPT_FMT_ANY, &s_key_format))
if (!opt_format(opt_arg(), OPT_FMT_PDE, &s_key_format))
goto opthelp;
break;
case OPT_PASS:
@@ -1266,7 +1272,7 @@ int s_server_main(int argc, char *argv[])
s_dcert_file = opt_arg();
break;
case OPT_DKEYFORM:
if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &s_dkey_format))
if (!opt_format(opt_arg(), OPT_FMT_PDE, &s_dkey_format))
goto opthelp;
break;
case OPT_DPASS:
@@ -1730,18 +1736,14 @@ int s_server_main(int argc, char *argv[])
if (nocert == 0) {
s_key = load_key(s_key_file, s_key_format, 0, pass, engine,
"server certificate private key file");
if (s_key == NULL) {
ERR_print_errors(bio_err);
if (s_key == NULL)
goto end;
}
s_cert = load_cert(s_cert_file, s_cert_format,
"server certificate file");
if (s_cert == NULL) {
ERR_print_errors(bio_err);
if (s_cert == NULL)
goto end;
}
if (s_chain_file != NULL) {
if (!load_certs(s_chain_file, &s_chain, FORMAT_PEM, NULL,
"server certificate chain"))
@@ -1751,18 +1753,14 @@ int s_server_main(int argc, char *argv[])
if (tlsextcbp.servername != NULL) {
s_key2 = load_key(s_key_file2, s_key_format, 0, pass, engine,
"second server certificate private key file");
if (s_key2 == NULL) {
ERR_print_errors(bio_err);
if (s_key2 == NULL)
goto end;
}
s_cert2 = load_cert(s_cert_file2, s_cert_format,
"second server certificate file");
if (s_cert2 == NULL) {
ERR_print_errors(bio_err);
if (s_cert2 == NULL)
goto end;
}
}
}
#if !defined(OPENSSL_NO_NEXTPROTONEG)
@@ -1781,12 +1779,9 @@ int s_server_main(int argc, char *argv[])
if (crl_file != NULL) {
X509_CRL *crl;
crl = load_crl(crl_file, crl_format);
if (crl == NULL) {
BIO_puts(bio_err, "Error loading CRL\n");
ERR_print_errors(bio_err);
crl = load_crl(crl_file, crl_format, "CRL");
if (crl == NULL)
goto end;
}
crls = sk_X509_CRL_new_null();
if (crls == NULL || !sk_X509_CRL_push(crls, crl)) {
BIO_puts(bio_err, "Error adding CRL\n");
@@ -1803,10 +1798,8 @@ int s_server_main(int argc, char *argv[])
s_dkey = load_key(s_dkey_file, s_dkey_format,
0, dpass, engine, "second certificate private key file");
if (s_dkey == NULL) {
ERR_print_errors(bio_err);
if (s_dkey == NULL)
goto end;
}
s_dcert = load_cert(s_dcert_file, s_dcert_format,
"second server certificate file");