openbsd/src/usr.bin/openssl/s_server.c, branch OPENBSD_6_8_BASE A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE 2020-07-27T13:46:48+00:00 Wrap long lines s_server.c 2020-07-27T13:46:48+00:00 inoguchi 2020-07-27T13:46:48+00:00 urn:sha1:26491dfa878dc747ff69a43e8b041cc13c389172 Add function prototype and move sub functions to bottom 2020-07-27T13:06:13+00:00 inoguchi 2020-07-27T13:06:13+00:00 urn:sha1:4526c73922a269ee5bff5d741d80668a622fa9a2 Remove space between '*' and pointer variable in s_server.c 2020-07-27T12:29:51+00:00 inoguchi 2020-07-27T12:29:51+00:00 urn:sha1:f6ca84b2a3b90a14904068e893964e70473f698d Remove 's_' prefix from member of s_server_config struct 2020-07-27T12:19:51+00:00 inoguchi 2020-07-27T12:19:51+00:00 urn:sha1:6f93a88256bcf1aa9a87adcaed267f4563f214f5 Convert openssl(1) s_server option handling 2020-07-27T12:09:14+00:00 inoguchi 2020-07-27T12:09:14+00:00 urn:sha1:ea9c3c40ddf506e1d93ff50cdd69a631132b683e ok and comments from jsing@ While the second SSL_CTX in this code is only used on servername 2020-05-23T13:00:30+00:00 tb 2020-05-23T13:00:30+00:00 urn:sha1:3af5ecc52ab53ab12b55b8edb68f52096070099e callback, so its mode is not used to update the ssl's mode, it seems more appropriate to clear the SSL_MODE_AUTO_RETRY flag on it as well. ok jsing In ssl_lib.c revision 1.217, jsing enabled SSL_MODE_AUTO_RETRY by 2020-05-23T12:52:54+00:00 tb 2020-05-23T12:52:54+00:00 urn:sha1:7f32076794cf53c4cba481f25dd750539030b92b default. To avoid hanging on a blocking read, we need to clear the SSL_MODE_AUTO_RETRY flag in the s_client and the s_server. ok beck inoguchi jsing Avoid an out-of-bounds array access in the s_server. 2020-05-23T09:02:02+00:00 tb 2020-05-23T09:02:02+00:00 urn:sha1:3a6807ff60ba69ab956c1eef3a48039c55db0347 It can be triggered by sending a line to stdin while no connection is open and then connecting a client. The first SSL_write() fails, sends SSL_ERROR_WANT_* and then causes a segfault deep down in the tls stack when accessing &(buf[-1]). ok beck inoguchi Add -tls1_3 and -no_tls1_3 options to openssl(1) s_server 2020-05-13T10:18:03+00:00 inoguchi 2020-05-13T10:18:03+00:00 urn:sha1:c45558da5ba0f909a555e49d9ab1420bfafd4a99 - Add -tls1_3 and -no_tls1_3 to openssl(1) s_server - Stop using version pinned methods, instead setting the min and max protocol versions ok jsing@ tb@ Conditionalize sleep-before-retry in server code to only be done when 2020-05-10T16:55:28+00:00 beck 2020-05-10T16:55:28+00:00 urn:sha1:de23b97501f6e54572fa507f71060d59df83240e debug is on. otherwise, just retry. Fixes problems this creates in testing. ok jsing@ tb@