32ec41539b
This commit changes the way that we do server side protocol version negotiation. Previously we had a whole set of code that had an "up front" state machine dedicated to the negotiating the protocol version. This adds significant complexity to the state machine. Historically the justification for doing this was the support of SSLv2 which works quite differently to SSLv3+. However, we have now removed support for SSLv2 so there is little reason to maintain this complexity. The one slight difficulty is that, although we no longer support SSLv2, we do still support an SSLv3+ ClientHello in an SSLv2 backward compatible ClientHello format. This is generally only used by legacy clients. This commit adds support within the SSLv3 code for these legacy format ClientHellos. Server side version negotiation now works in much the same was as DTLS, i.e. we introduce the concept of TLS_ANY_VERSION. If s->version is set to that then when a ClientHello is received it will work out the most appropriate version to respond with. Also, SSLv23_method and SSLv23_server_method have been replaced with TLS_method and TLS_server_method respectively. The old SSLv23* names still exist as macros pointing at the new name, although they are deprecated. Subsequent commits will look at client side version negotiation, as well of removal of the old s23* code. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
106 lines
2.4 KiB
C
106 lines
2.4 KiB
C
/* NOCW */
|
|
/* demos/bio/saccept.c */
|
|
|
|
/*-
|
|
* A minimal program to serve an SSL connection.
|
|
* It uses blocking.
|
|
* saccept host:port
|
|
* host is the interface IP to use. If any interface, use *:port
|
|
* The default it *:4433
|
|
*
|
|
* cc -I../../include saccept.c -L../.. -lssl -lcrypto -ldl
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <signal.h>
|
|
#include <openssl/err.h>
|
|
#include <openssl/ssl.h>
|
|
|
|
#define CERT_FILE "server.pem"
|
|
|
|
BIO *in = NULL;
|
|
|
|
void close_up()
|
|
{
|
|
BIO_free(in);
|
|
}
|
|
|
|
int main(int argc, char *argv[])
|
|
{
|
|
char *port = NULL;
|
|
BIO *ssl_bio, *tmp;
|
|
SSL_CTX *ctx;
|
|
char buf[512];
|
|
int ret = 1, i;
|
|
|
|
if (argc <= 1)
|
|
port = "*:4433";
|
|
else
|
|
port = argv[1];
|
|
|
|
signal(SIGINT, close_up);
|
|
|
|
SSL_load_error_strings();
|
|
|
|
/* Add ciphers and message digests */
|
|
OpenSSL_add_ssl_algorithms();
|
|
|
|
ctx = SSL_CTX_new(TLS_server_method());
|
|
if (!SSL_CTX_use_certificate_file(ctx, CERT_FILE, SSL_FILETYPE_PEM))
|
|
goto err;
|
|
if (!SSL_CTX_use_PrivateKey_file(ctx, CERT_FILE, SSL_FILETYPE_PEM))
|
|
goto err;
|
|
if (!SSL_CTX_check_private_key(ctx))
|
|
goto err;
|
|
|
|
/* Setup server side SSL bio */
|
|
ssl_bio = BIO_new_ssl(ctx, 0);
|
|
|
|
if ((in = BIO_new_accept(port)) == NULL)
|
|
goto err;
|
|
|
|
/*
|
|
* This means that when a new connection is accepted on 'in', The ssl_bio
|
|
* will be 'duplicated' and have the new socket BIO push into it.
|
|
* Basically it means the SSL BIO will be automatically setup
|
|
*/
|
|
BIO_set_accept_bios(in, ssl_bio);
|
|
|
|
again:
|
|
/*
|
|
* The first call will setup the accept socket, and the second will get a
|
|
* socket. In this loop, the first actual accept will occur in the
|
|
* BIO_read() function.
|
|
*/
|
|
|
|
if (BIO_do_accept(in) <= 0)
|
|
goto err;
|
|
|
|
for (;;) {
|
|
i = BIO_read(in, buf, 512);
|
|
if (i == 0) {
|
|
/*
|
|
* If we have finished, remove the underlying BIO stack so the
|
|
* next time we call any function for this BIO, it will attempt
|
|
* to do an accept
|
|
*/
|
|
printf("Done\n");
|
|
tmp = BIO_pop(in);
|
|
BIO_free_all(tmp);
|
|
goto again;
|
|
}
|
|
if (i < 0)
|
|
goto err;
|
|
fwrite(buf, 1, i, stdout);
|
|
fflush(stdout);
|
|
}
|
|
|
|
ret = 0;
|
|
err:
|
|
if (ret) {
|
|
ERR_print_errors_fp(stderr);
|
|
}
|
|
BIO_free(in);
|
|
exit(ret);
|
|
return (!ret);
|
|
}
|