summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/regress/lib/libssl/interop/Makefile4
-rw-r--r--src/regress/lib/libssl/interop/Makefile.inc43
-rw-r--r--src/regress/lib/libssl/interop/README5
-rw-r--r--src/regress/lib/libssl/interop/cert/Makefile70
-rw-r--r--src/regress/lib/libssl/interop/client.c58
-rw-r--r--src/regress/lib/libssl/interop/libressl/Makefile9
-rw-r--r--src/regress/lib/libssl/interop/openssl/Makefile9
-rw-r--r--src/regress/lib/libssl/interop/openssl11/Makefile9
-rw-r--r--src/regress/lib/libssl/interop/server.c70
-rw-r--r--src/regress/lib/libssl/interop/util.c12
-rw-r--r--src/regress/lib/libssl/interop/util.h3
11 files changed, 244 insertions, 48 deletions
diff --git a/src/regress/lib/libssl/interop/Makefile b/src/regress/lib/libssl/interop/Makefile
index d89376aaf6..0226cae4ab 100644
--- a/src/regress/lib/libssl/interop/Makefile
+++ b/src/regress/lib/libssl/interop/Makefile
@@ -1,5 +1,5 @@
1# $OpenBSD: Makefile,v 1.2 2018/11/07 19:09:01 bluhm Exp $ 1# $OpenBSD: Makefile,v 1.3 2018/11/09 06:30:41 bluhm Exp $
2 2
3SUBDIR = libressl openssl openssl11 3SUBDIR = libressl openssl openssl11 cert
4 4
5.include <bsd.subdir.mk> 5.include <bsd.subdir.mk>
diff --git a/src/regress/lib/libssl/interop/Makefile.inc b/src/regress/lib/libssl/interop/Makefile.inc
index 1a1ef30ca6..9daae79e57 100644
--- a/src/regress/lib/libssl/interop/Makefile.inc
+++ b/src/regress/lib/libssl/interop/Makefile.inc
@@ -1,17 +1,15 @@
1# $OpenBSD: Makefile.inc,v 1.3 2018/11/07 20:46:28 bluhm Exp $ 1# $OpenBSD: Makefile.inc,v 1.4 2018/11/09 06:30:41 bluhm Exp $
2 2
3.PATH: ${.CURDIR}/.. 3.PATH: ${.CURDIR}/..
4 4
5SRCS_client = client.c util.c 5SRCS_client = client.c util.c
6SRCS_server = server.c util.c 6SRCS_server = server.c util.c
7WARNINGS = yes 7WARNINGS = yes
8REGRESS_TARGETS =
9 8
10# check that program is linked with correct libraries 9# check that program is linked with correct libraries
11 10
12.for p in ${PROGS} 11.for p in ${PROGS}
13CLEANFILES += ldd-$p.out 12CLEANFILES += ldd-$p.out
14REGRESS_TARGETS += run-ldd-$p
15ldd-$p.out: $p 13ldd-$p.out: $p
16 LD_LIBRARY_PATH=${LD_LIBRARY_PATH} ldd $p >$@ 14 LD_LIBRARY_PATH=${LD_LIBRARY_PATH} ldd $p >$@
17.endfor 15.endfor
@@ -19,12 +17,13 @@ ldd-$p.out: $p
19# run netcat server and connect with test client 17# run netcat server and connect with test client
20 18
21CLEANFILES += nc-client.out netcat-l.out netcat-l.fstat 19CLEANFILES += nc-client.out netcat-l.out netcat-l.fstat
22REGRESS_TARGETS += run-client
23nc-client.out run-client: client 127.0.0.1.crt 20nc-client.out run-client: client 127.0.0.1.crt
24 @echo '\n======== $@ ========' 21 @echo '\n======== $@ ========'
25 echo "greeting" | nc -l -c -C 127.0.0.1.crt -K 127.0.0.1.key \ 22 echo "greeting" | nc -l -c -C 127.0.0.1.crt -K 127.0.0.1.key \
26 127.0.0.1 0 >netcat-l.out & \ 23 127.0.0.1 0 >netcat-l.out & \
27 sleep 1; fstat -p $$! >netcat-l.fstat 24 for i in `jot 1000`; do fstat -p $$! >netcat-l.fstat; \
25 grep -q ' stream tcp .*:[1-9][0-9]*$$' netcat-l.fstat && exit 0; \
26 done; exit 1
28 LD_LIBRARY_PATH=${LD_LIBRARY_PATH} ./client \ 27 LD_LIBRARY_PATH=${LD_LIBRARY_PATH} ./client \
29 `sed -n 's/.* stream tcp .*:/127.0.0.1 /p' netcat-l.fstat` \ 28 `sed -n 's/.* stream tcp .*:/127.0.0.1 /p' netcat-l.fstat` \
30 >nc-client.out 29 >nc-client.out
@@ -38,12 +37,11 @@ nc-client.out run-client: client 127.0.0.1.crt
38# run test server and connect with netcat client 37# run test server and connect with netcat client
39 38
40CLEANFILES += nc-server.out netcat.out 39CLEANFILES += nc-server.out netcat.out
41REGRESS_TARGETS += run-server
42nc-server.out run-server: server 127.0.0.1.crt 40nc-server.out run-server: server 127.0.0.1.crt
43 @echo '\n======== $@ ========' 41 @echo '\n======== $@ ========'
44 LD_LIBRARY_PATH=${LD_LIBRARY_PATH} ./server 127.0.0.1 0 \ 42 LD_LIBRARY_PATH=${LD_LIBRARY_PATH} ./server 127.0.0.1 0 \
45 >nc-server.out 43 >nc-server.out
46 echo "hello" | nc -c -T noverify \ 44 echo "hello" | nc -c -R 127.0.0.1.crt \
47 `sed -n 's/listen sock: //p' nc-server.out` \ 45 `sed -n 's/listen sock: //p' nc-server.out` \
48 >netcat.out 46 >netcat.out
49 # check that the server child run successfully to the end 47 # check that the server child run successfully to the end
@@ -56,7 +54,6 @@ nc-server.out run-server: server 127.0.0.1.crt
56# run test server and with test client, self test the ssl library 54# run test server and with test client, self test the ssl library
57 55
58CLEANFILES += self-client.out self-server.out 56CLEANFILES += self-client.out self-server.out
59REGRESS_TARGETS += run-self
60self-client.out self-server.out run-self: client server 127.0.0.1.crt 57self-client.out self-server.out run-self: client server 127.0.0.1.crt
61 @echo '\n======== $@ ========' 58 @echo '\n======== $@ ========'
62 LD_LIBRARY_PATH=${LD_LIBRARY_PATH} ./server 127.0.0.1 0 \ 59 LD_LIBRARY_PATH=${LD_LIBRARY_PATH} ./server 127.0.0.1 0 \
@@ -73,23 +70,27 @@ self-client.out self-server.out run-self: client server 127.0.0.1.crt
73 # server must have read client hello 70 # server must have read client hello
74 grep -q '^<<< hello$$' self-server.out 71 grep -q '^<<< hello$$' self-server.out
75 72
76.for o in nc-client nc-server self-client self-server
77
78# check that client and server have used correct runtime library
79
80REGRESS_TARGETS += run-version-$o
81
82# check that client and server have used correct TLS protocol
83
84REGRESS_TARGETS += run-protocol-$o
85
86.endfor
87
88# create certificates for TLS 73# create certificates for TLS
89 74
90CLEANFILES += 127.0.0.1.crt 127.0.0.1.key 75CLEANFILES += 127.0.0.1.{crt,key} \
76 ca.{crt,key,srl} fake-ca.{crt,key} \
77 {client,server}.{req,crt,key}
91 78
92127.0.0.1.crt: 79127.0.0.1.crt:
93 openssl req -batch -new \ 80 openssl req -batch -new \
94 -subj /L=OpenBSD/O=tls-regress/OU=server/CN=127.0.0.1/ \ 81 -subj /L=OpenBSD/O=tls-regress/OU=server/CN=127.0.0.1/ \
95 -nodes -newkey rsa -keyout 127.0.0.1.key -x509 -out $@ 82 -nodes -newkey rsa -keyout 127.0.0.1.key -x509 -out $@
83
84ca.crt fake-ca.crt:
85 openssl req -batch -new \
86 -subj /L=OpenBSD/O=tls-regress/OU=ca/CN=root/ \
87 -nodes -newkey rsa -keyout ${@:R}.key -x509 -out $@
88
89client.req server.req:
90 openssl req -batch -new \
91 -subj /L=OpenBSD/O=tls-regress/OU=${@:R}/CN=localhost/ \
92 -nodes -newkey rsa -keyout ${@:R}.key -out $@
93
94client.crt server.crt: ca.crt ${@:R}.req
95 openssl x509 -CAcreateserial -CAkey ca.key -CA ca.crt \
96 -req -in ${@:R}.req -out $@
diff --git a/src/regress/lib/libssl/interop/README b/src/regress/lib/libssl/interop/README
index 1bd418c9cc..b53b47b878 100644
--- a/src/regress/lib/libssl/interop/README
+++ b/src/regress/lib/libssl/interop/README
@@ -12,3 +12,8 @@ that the highest available TLS version is selected. LibreSSL TLS
12Currently OpenSSL 1.0.2p and OpenSSL 1.1.1 from ports are used. As 12Currently OpenSSL 1.0.2p and OpenSSL 1.1.1 from ports are used. As
13soon as LibreSSL supports TLS 1.3, it should be used automatically 13soon as LibreSSL supports TLS 1.3, it should be used automatically
14when netcat is communicating with OpenSSL 1.1. 14when netcat is communicating with OpenSSL 1.1.
15
16The cert subdir is testing all combinations of certificate validation.
17Having the three libraries, client and server certificates, missing
18or invalid CA or certificates, and enforcing peer certificate results
19in 1944 test cases.
diff --git a/src/regress/lib/libssl/interop/cert/Makefile b/src/regress/lib/libssl/interop/cert/Makefile
new file mode 100644
index 0000000000..dabc0441f0
--- /dev/null
+++ b/src/regress/lib/libssl/interop/cert/Makefile
@@ -0,0 +1,70 @@
1# $OpenBSD: Makefile,v 1.1 2018/11/09 06:30:41 bluhm Exp $
2
3.if ! exists(/usr/local/bin/eopenssl) || ! exists(/usr/local/bin/eopenssl11)
4regress:
5 # install openssl-1.0.2p and openssl-1.1.1 from ports
6 @echo SKIPPED
7.endif
8
9CLEANFILES += client.out server.out
10
11.for cca in noca ca fakeca
12.for sca in noca ca fakeca
13.for ccert in nocert cert
14.for scert in nocert cert
15.for cv in noverify verify
16.for sv in noverify verify certverify
17
18# remember when certificate verification should fail
19.if (("${cv}" == verify && "${cca}" == ca && "${scert}" == cert) || \
20 "${cv}" == noverify) && \
21 (("${sv}" == verify && "${ccert}" == nocert) || \
22 ("${sv}" == verify && "${sca}" == ca && "${ccert}" == cert) || \
23 ("${sv}" == certverify && "${sca}" == ca && "${ccert}" == cert) || \
24 "${sv}" == noverify)
25FAIL_${cca}_${sca}_${ccert}_${scert}_${cv}_${sv} =
26.else
27FAIL_${cca}_${sca}_${ccert}_${scert}_${cv}_${sv} = !
28.endif
29
30.for clib in libressl openssl openssl11
31.for slib in libressl openssl openssl11
32
33REGRESS_TARGETS += \
34run-client-${clib}-${cca}-${ccert}-${cv}-server-${slib}-${sca}-${scert}-${sv}
35
36run-client-${clib}-${cca}-${ccert}-${cv}-server-${slib}-${sca}-${scert}-${sv}:\
37 127.0.0.1.crt ca.crt fake-ca.crt client.crt server.crt \
38 ../${clib}/client ../${slib}/server
39 @echo '\n======== $@ ========'
40 LD_LIBRARY_PATH=/usr/local/lib/e${slib} \
41 ../${slib}/server >server.out \
42 ${sca:S/^noca//:S/^fakeca/-C fake-ca.crt/:S/^ca/-C ca.crt/} \
43 ${scert:S/^nocert//:S/^cert/-c server.crt -k server.key/} \
44 ${sv:S/^noverify//:S/^verify/-v/:S/^certverify/-vv/} \
45 127.0.0.1 0
46 ${FAIL_${cca}_${sca}_${ccert}_${scert}_${cv}_${sv}} \
47 LD_LIBRARY_PATH=/usr/local/lib/e${clib} \
48 ../${clib}/client >client.out \
49 ${cca:S/^noca//:S/^fakeca/-C fake-ca.crt/:S/^ca/-C ca.crt/} \
50 ${ccert:S/^nocert//:S/^cert/-c server.crt -k server.key/} \
51 ${cv:S/^noverify//:S/^verify/-v/} \
52 `sed -n 's/listen sock: //p' server.out`
53.if empty(${FAIL_${cca}_${sca}_${ccert}_${scert}_${cv}_${sv}})
54 grep '^success$$' server.out
55 grep '^success$$' client.out
56.elif ! ("${sv}" == certverify && "${ccert}" == nocert) || \
57 ("${cv}" == verify && "${scert}" != cert)
58 grep '^verify: fail' client.out server.out
59.endif
60
61.endfor
62.endfor
63.endfor
64.endfor
65.endfor
66.endfor
67.endfor
68.endfor
69
70.include <bsd.regress.mk>
diff --git a/src/regress/lib/libssl/interop/client.c b/src/regress/lib/libssl/interop/client.c
index 60fb718fdb..c312d7ae8a 100644
--- a/src/regress/lib/libssl/interop/client.c
+++ b/src/regress/lib/libssl/interop/client.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: client.c,v 1.3 2018/11/07 19:09:01 bluhm Exp $ */ 1/* $OpenBSD: client.c,v 1.4 2018/11/09 06:30:41 bluhm Exp $ */
2/* 2/*
3 * Copyright (c) 2018 Alexander Bluhm <bluhm@openbsd.org> 3 * Copyright (c) 2018 Alexander Bluhm <bluhm@openbsd.org>
4 * 4 *
@@ -34,7 +34,8 @@ void __dead usage(void);
34void __dead 34void __dead
35usage(void) 35usage(void)
36{ 36{
37 fprintf(stderr, "usage: client host port"); 37 fprintf(stderr,
38 "usage: client [-c] [-C CA] [-c crt -k key] host port");
38 exit(2); 39 exit(2);
39} 40}
40 41
@@ -46,19 +47,42 @@ main(int argc, char *argv[])
46 SSL *ssl; 47 SSL *ssl;
47 BIO *bio; 48 BIO *bio;
48 SSL_SESSION *session; 49 SSL_SESSION *session;
49 int error; 50 int error, verify = 0;
50 char buf[256]; 51 char buf[256], ch;
52 char *ca = NULL, *crt = NULL, *key = NULL;
51 char *host_port, *host, *port; 53 char *host_port, *host, *port;
52 54
53 if (argc == 3) { 55 while ((ch = getopt(argc, argv, "C:c:k:v")) != -1) {
54 host = argv[1]; 56 switch (ch) {
55 port = argv[2]; 57 case 'C':
58 ca = optarg;
59 break;
60 case 'c':
61 crt = optarg;
62 break;
63 case 'k':
64 key = optarg;
65 break;
66 case 'v':
67 verify = 1;
68 break;
69 default:
70 usage();
71 }
72 }
73 argc -= optind;
74 argv += optind;
75 if (argc == 2) {
76 host = argv[0];
77 port = argv[1];
56 } else { 78 } else {
57 usage(); 79 usage();
58 } 80 }
59 if (asprintf(&host_port, strchr(host, ':') ? "[%s]:%s" : "%s:%s", 81 if (asprintf(&host_port, strchr(host, ':') ? "[%s]:%s" : "%s:%s",
60 host, port) == -1) 82 host, port) == -1)
61 err(1, "asprintf host port"); 83 err(1, "asprintf host port");
84 if ((crt == NULL && key != NULL) || (crt != NULL && key == NULL))
85 errx(1, "certificate and private key must be used together");
62 86
63 SSL_library_init(); 87 SSL_library_init();
64 SSL_load_error_strings(); 88 SSL_load_error_strings();
@@ -78,6 +102,26 @@ main(int argc, char *argv[])
78 if (ctx == NULL) 102 if (ctx == NULL)
79 err_ssl(1, "SSL_CTX_new"); 103 err_ssl(1, "SSL_CTX_new");
80 104
105 /* load client certificate */
106 if (crt != NULL) {
107 if (SSL_CTX_use_certificate_file(ctx, crt,
108 SSL_FILETYPE_PEM) <= 0)
109 err_ssl(1, "SSL_CTX_use_certificate_file");
110 if (SSL_CTX_use_PrivateKey_file(ctx, key,
111 SSL_FILETYPE_PEM) <= 0)
112 err_ssl(1, "SSL_CTX_use_PrivateKey_file");
113 if (SSL_CTX_check_private_key(ctx) <= 0)
114 err_ssl(1, "SSL_CTX_check_private_key");
115 }
116
117 /* verify server certificate */
118 if (ca != NULL) {
119 if (SSL_CTX_load_verify_locations(ctx, ca, NULL) <= 0)
120 err_ssl(1, "SSL_CTX_load_verify_locations");
121 }
122 SSL_CTX_set_verify(ctx, verify ? SSL_VERIFY_PEER : SSL_VERIFY_NONE,
123 verify_callback);
124
81 /* setup ssl and bio for socket operations */ 125 /* setup ssl and bio for socket operations */
82 ssl = SSL_new(ctx); 126 ssl = SSL_new(ctx);
83 if (ssl == NULL) 127 if (ssl == NULL)
diff --git a/src/regress/lib/libssl/interop/libressl/Makefile b/src/regress/lib/libssl/interop/libressl/Makefile
index 19557ffbc1..6923e12469 100644
--- a/src/regress/lib/libssl/interop/libressl/Makefile
+++ b/src/regress/lib/libssl/interop/libressl/Makefile
@@ -1,4 +1,4 @@
1# $OpenBSD: Makefile,v 1.3 2018/11/07 20:46:28 bluhm Exp $ 1# $OpenBSD: Makefile,v 1.4 2018/11/09 06:30:41 bluhm Exp $
2 2
3PROGS = client server 3PROGS = client server
4CPPFLAGS = 4CPPFLAGS =
@@ -6,6 +6,13 @@ LDFLAGS =
6LDADD = -lssl -lcrypto 6LDADD = -lssl -lcrypto
7DPADD = ${LIBSSL} ${LIBCRYPTO} 7DPADD = ${LIBSSL} ${LIBCRYPTO}
8LD_LIBRARY_PATH = 8LD_LIBRARY_PATH =
9REGRESS_TARGETS = run-self
10.for p in ${PROGS}
11REGRESS_TARGETS += run-ldd-$p run-$p
12.for x in nc self
13REGRESS_TARGETS += run-version-$x-$p run-protocol-$x-$p
14.endfor
15.endfor
9 16
10run-protocol-self-client run-protocol-self-server \ 17run-protocol-self-client run-protocol-self-server \
11run-protocol-nc-client run-protocol-nc-server: 18run-protocol-nc-client run-protocol-nc-server:
diff --git a/src/regress/lib/libssl/interop/openssl/Makefile b/src/regress/lib/libssl/interop/openssl/Makefile
index ad0c7288ca..5c51c029ce 100644
--- a/src/regress/lib/libssl/interop/openssl/Makefile
+++ b/src/regress/lib/libssl/interop/openssl/Makefile
@@ -1,4 +1,4 @@
1# $OpenBSD: Makefile,v 1.3 2018/11/07 20:46:28 bluhm Exp $ 1# $OpenBSD: Makefile,v 1.4 2018/11/09 06:30:41 bluhm Exp $
2 2
3.if ! exists(/usr/local/bin/eopenssl) 3.if ! exists(/usr/local/bin/eopenssl)
4regress: 4regress:
@@ -13,6 +13,13 @@ LDADD = -lssl -lcrypto
13DPADD = /usr/local/lib/eopenssl/libssl.a \ 13DPADD = /usr/local/lib/eopenssl/libssl.a \
14 /usr/local/lib/eopenssl/libcrypto.a 14 /usr/local/lib/eopenssl/libcrypto.a
15LD_LIBRARY_PATH = /usr/local/lib/eopenssl 15LD_LIBRARY_PATH = /usr/local/lib/eopenssl
16REGRESS_TARGETS = run-self
17.for p in ${PROGS}
18REGRESS_TARGETS += run-ldd-$p run-$p
19.for x in nc self
20REGRESS_TARGETS += run-version-$x-$p run-protocol-$x-$p
21.endfor
22.endfor
16 23
17.for p in ${PROGS} 24.for p in ${PROGS}
18run-ldd-$p: ldd-$p.out 25run-ldd-$p: ldd-$p.out
diff --git a/src/regress/lib/libssl/interop/openssl11/Makefile b/src/regress/lib/libssl/interop/openssl11/Makefile
index e7257a3976..ec6f6db7ec 100644
--- a/src/regress/lib/libssl/interop/openssl11/Makefile
+++ b/src/regress/lib/libssl/interop/openssl11/Makefile
@@ -1,4 +1,4 @@
1# $OpenBSD: Makefile,v 1.2 2018/11/07 20:46:28 bluhm Exp $ 1# $OpenBSD: Makefile,v 1.3 2018/11/09 06:30:41 bluhm Exp $
2 2
3.if ! exists(/usr/local/bin/eopenssl11) 3.if ! exists(/usr/local/bin/eopenssl11)
4regress: 4regress:
@@ -13,6 +13,13 @@ LDADD = -lssl -lcrypto
13DPADD = /usr/local/lib/eopenssl11/libssl.a \ 13DPADD = /usr/local/lib/eopenssl11/libssl.a \
14 /usr/local/lib/eopenssl11/libcrypto.a 14 /usr/local/lib/eopenssl11/libcrypto.a
15LD_LIBRARY_PATH = /usr/local/lib/eopenssl11 15LD_LIBRARY_PATH = /usr/local/lib/eopenssl11
16REGRESS_TARGETS = run-self
17.for p in ${PROGS}
18REGRESS_TARGETS += run-ldd-$p run-$p
19.for x in nc self
20REGRESS_TARGETS += run-version-$x-$p run-protocol-$x-$p
21.endfor
22.endfor
16 23
17run-protocol-nc-client run-protocol-nc-server: 24run-protocol-nc-client run-protocol-nc-server:
18 @echo '\n======== $@ ========' 25 @echo '\n======== $@ ========'
diff --git a/src/regress/lib/libssl/interop/server.c b/src/regress/lib/libssl/interop/server.c
index 0aece87583..6c0c720dfe 100644
--- a/src/regress/lib/libssl/interop/server.c
+++ b/src/regress/lib/libssl/interop/server.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: server.c,v 1.3 2018/11/07 19:09:01 bluhm Exp $ */ 1/* $OpenBSD: server.c,v 1.4 2018/11/09 06:30:41 bluhm Exp $ */
2/* 2/*
3 * Copyright (c) 2018 Alexander Bluhm <bluhm@openbsd.org> 3 * Copyright (c) 2018 Alexander Bluhm <bluhm@openbsd.org>
4 * 4 *
@@ -34,7 +34,8 @@ void __dead usage(void);
34void __dead 34void __dead
35usage(void) 35usage(void)
36{ 36{
37 fprintf(stderr, "usage: server [host port]"); 37 fprintf(stderr,
38 "usage: server [-vv] [-C CA] [-c crt -k key] [host port]");
38 exit(2); 39 exit(2);
39} 40}
40 41
@@ -46,22 +47,46 @@ main(int argc, char *argv[])
46 SSL *ssl; 47 SSL *ssl;
47 BIO *bio; 48 BIO *bio;
48 SSL_SESSION *session; 49 SSL_SESSION *session;
49 int error; 50 int error, verify = 0;
50 char buf[256]; 51 char buf[256], ch;
51 char *crt, *key, *host_port, *host = "127.0.0.1", *port = "0"; 52 char *ca = NULL, *crt = NULL, *key = NULL;
52 53 char *host_port, *host = "127.0.0.1", *port = "0";
53 if (argc == 3) { 54
54 host = argv[1]; 55 while ((ch = getopt(argc, argv, "C:c:k:v")) != -1) {
55 port = argv[2]; 56 switch (ch) {
56 } else if (argc != 1) { 57 case 'C':
58 ca = optarg;
59 break;
60 case 'c':
61 crt = optarg;
62 break;
63 case 'k':
64 key = optarg;
65 break;
66 case 'v':
67 /* use twice to force client cert */
68 verify++;
69 break;
70 default:
71 usage();
72 }
73 }
74 argc -= optind;
75 argv += optind;
76 if (argc == 2) {
77 host = argv[0];
78 port = argv[1];
79 } else if (argc != 0) {
57 usage(); 80 usage();
58 } 81 }
59 if (asprintf(&host_port, strchr(host, ':') ? "[%s]:%s" : "%s:%s", 82 if (asprintf(&host_port, strchr(host, ':') ? "[%s]:%s" : "%s:%s",
60 host, port) == -1) 83 host, port) == -1)
61 err(1, "asprintf host port"); 84 err(1, "asprintf host port");
62 if (asprintf(&crt, "%s.crt", host) == -1) 85 if ((crt == NULL && key != NULL) || (crt != NULL && key == NULL))
86 errx(1, "certificate and private key must be used together");
87 if (crt == NULL && asprintf(&crt, "%s.crt", host) == -1)
63 err(1, "asprintf crt"); 88 err(1, "asprintf crt");
64 if (asprintf(&key, "%s.key", host) == -1) 89 if (key == NULL && asprintf(&key, "%s.key", host) == -1)
65 err(1, "asprintf key"); 90 err(1, "asprintf key");
66 91
67 SSL_library_init(); 92 SSL_library_init();
@@ -94,6 +119,23 @@ main(int argc, char *argv[])
94 if (SSL_CTX_check_private_key(ctx) <= 0) 119 if (SSL_CTX_check_private_key(ctx) <= 0)
95 err_ssl(1, "SSL_CTX_check_private_key"); 120 err_ssl(1, "SSL_CTX_check_private_key");
96 121
122 /* request client certificate and verify it */
123 if (ca != NULL) {
124 STACK_OF(X509_NAME) *x509stack;
125
126 x509stack = SSL_load_client_CA_file(ca);
127 if (x509stack == NULL)
128 err_ssl(1, "SSL_load_client_CA_file");
129 SSL_CTX_set_client_CA_list(ctx, x509stack);
130 if (SSL_CTX_load_verify_locations(ctx, ca, NULL) <= 0)
131 err_ssl(1, "SSL_CTX_load_verify_locations");
132 }
133 SSL_CTX_set_verify(ctx,
134 verify == 0 ? SSL_VERIFY_NONE :
135 verify == 1 ? SSL_VERIFY_PEER :
136 SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
137 verify_callback);
138
97 /* setup ssl and bio for socket operations */ 139 /* setup ssl and bio for socket operations */
98 ssl = SSL_new(ctx); 140 ssl = SSL_new(ctx);
99 if (ssl == NULL) 141 if (ssl == NULL)
@@ -109,9 +151,11 @@ main(int argc, char *argv[])
109 printf("listen "); 151 printf("listen ");
110 print_sockname(bio); 152 print_sockname(bio);
111 153
112 /* fork to background and accept */ 154 /* fork to background, set timeout, and accept */
113 if (daemon(1, 1) == -1) 155 if (daemon(1, 1) == -1)
114 err(1, "daemon"); 156 err(1, "daemon");
157 if ((int)alarm(60) == -1)
158 err(1, "alarm");
115 if (BIO_do_accept(bio) <= 0) 159 if (BIO_do_accept(bio) <= 0)
116 err_ssl(1, "BIO_do_accept wait"); 160 err_ssl(1, "BIO_do_accept wait");
117 bio = BIO_pop(bio); 161 bio = BIO_pop(bio);
diff --git a/src/regress/lib/libssl/interop/util.c b/src/regress/lib/libssl/interop/util.c
index b012d73193..5190e81828 100644
--- a/src/regress/lib/libssl/interop/util.c
+++ b/src/regress/lib/libssl/interop/util.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: util.c,v 1.2 2018/11/07 06:29:26 bluhm Exp $ */ 1/* $OpenBSD: util.c,v 1.3 2018/11/09 06:30:41 bluhm Exp $ */
2/* 2/*
3 * Copyright (c) 2018 Alexander Bluhm <bluhm@openbsd.org> 3 * Copyright (c) 2018 Alexander Bluhm <bluhm@openbsd.org>
4 * 4 *
@@ -133,3 +133,13 @@ err_ssl(int eval, const char *fmt, ...)
133 verrx(eval, fmt, ap); 133 verrx(eval, fmt, ap);
134 va_end(ap); 134 va_end(ap);
135} 135}
136
137int
138verify_callback(int preverify_ok, X509_STORE_CTX *x509_ctx)
139{
140 printf("verify: %s\n", preverify_ok ? "pass" : "fail");
141 if (fflush(stdout) != 0)
142 err(1, "fflush stdout");
143
144 return preverify_ok;
145}
diff --git a/src/regress/lib/libssl/interop/util.h b/src/regress/lib/libssl/interop/util.h
index 78f7bb63b6..7414a037d7 100644
--- a/src/regress/lib/libssl/interop/util.h
+++ b/src/regress/lib/libssl/interop/util.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: util.h,v 1.2 2018/11/07 06:29:26 bluhm Exp $ */ 1/* $OpenBSD: util.h,v 1.3 2018/11/09 06:30:41 bluhm Exp $ */
2/* 2/*
3 * Copyright (c) 2018 Alexander Bluhm <bluhm@openbsd.org> 3 * Copyright (c) 2018 Alexander Bluhm <bluhm@openbsd.org>
4 * 4 *
@@ -20,3 +20,4 @@ void print_ciphers(STACK_OF(SSL_CIPHER) *);
20void print_sockname(BIO *); 20void print_sockname(BIO *);
21void print_peername(BIO *); 21void print_peername(BIO *);
22void err_ssl(int, const char *, ...); 22void err_ssl(int, const char *, ...);
23int verify_callback(int, X509_STORE_CTX *);
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-10-22 00:08:36 +0000