0af6b421179c96602633fc082f6541d3efcdcf65
[BearSSL] / server.c
1 /*
2 * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
3 *
4 * Permission is hereby granted, free of charge, to any person obtaining
5 * a copy of this software and associated documentation files (the
6 * "Software"), to deal in the Software without restriction, including
7 * without limitation the rights to use, copy, modify, merge, publish,
8 * distribute, sublicense, and/or sell copies of the Software, and to
9 * permit persons to whom the Software is furnished to do so, subject to
10 * the following conditions:
11 *
12 * The above copyright notice and this permission notice shall be
13 * included in all copies or substantial portions of the Software.
14 *
15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
16 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
17 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
18 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
19 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
20 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
21 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22 * SOFTWARE.
23 */
24
25 #include <stdio.h>
26 #include <stdlib.h>
27 #include <string.h>
28 #include <stdint.h>
29 #include <errno.h>
30
31 #include <sys/types.h>
32 #include <sys/socket.h>
33 #include <netdb.h>
34 #include <netinet/in.h>
35 #include <arpa/inet.h>
36 #include <unistd.h>
37 #include <fcntl.h>
38
39 #include "brssl.h"
40 #include "bearssl.h"
41
42 static int
43 host_bind(const char *host, const char *port, int verbose)
44 {
45 struct addrinfo hints, *si, *p;
46 int fd;
47 int err;
48
49 memset(&hints, 0, sizeof hints);
50 hints.ai_family = PF_UNSPEC;
51 hints.ai_socktype = SOCK_STREAM;
52 err = getaddrinfo(host, port, &hints, &si);
53 if (err != 0) {
54 fprintf(stderr, "ERROR: getaddrinfo(): %s\n",
55 gai_strerror(err));
56 return -1;
57 }
58 fd = -1;
59 for (p = si; p != NULL; p = p->ai_next) {
60 struct sockaddr *sa;
61 struct sockaddr_in sa4;
62 struct sockaddr_in6 sa6;
63 size_t sa_len;
64 void *addr;
65 char tmp[INET6_ADDRSTRLEN + 50];
66 int opt;
67
68 sa = (struct sockaddr *)p->ai_addr;
69 if (sa->sa_family == AF_INET) {
70 sa4 = *(struct sockaddr_in *)sa;
71 sa = (struct sockaddr *)&sa4;
72 sa_len = sizeof sa4;
73 addr = &sa4.sin_addr;
74 if (host == NULL) {
75 sa4.sin_addr.s_addr = INADDR_ANY;
76 }
77 } else if (sa->sa_family == AF_INET6) {
78 sa6 = *(struct sockaddr_in6 *)sa;
79 sa = (struct sockaddr *)&sa6;
80 sa_len = sizeof sa6;
81 addr = &sa6.sin6_addr;
82 if (host == NULL) {
83 sa6.sin6_addr = in6addr_any;
84 }
85 } else {
86 addr = NULL;
87 sa_len = p->ai_addrlen;
88 }
89 if (addr != NULL) {
90 inet_ntop(p->ai_family, addr, tmp, sizeof tmp);
91 } else {
92 sprintf(tmp, "<unknown family: %d>",
93 (int)sa->sa_family);
94 }
95 if (verbose) {
96 fprintf(stderr, "binding to: %s\n", tmp);
97 }
98 fd = socket(p->ai_family, p->ai_socktype, p->ai_protocol);
99 if (fd < 0) {
100 if (verbose) {
101 perror("socket()");
102 }
103 continue;
104 }
105 opt = 1;
106 setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof opt);
107 opt = 0;
108 setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, &opt, sizeof opt);
109 if (bind(fd, sa, sa_len) < 0) {
110 if (verbose) {
111 perror("bind()");
112 }
113 close(fd);
114 continue;
115 }
116 break;
117 }
118 if (p == NULL) {
119 freeaddrinfo(si);
120 fprintf(stderr, "ERROR: failed to bind\n");
121 return -1;
122 }
123 freeaddrinfo(si);
124 if (listen(fd, 5) < 0) {
125 if (verbose) {
126 perror("listen()");
127 }
128 close(fd);
129 return -1;
130 }
131 if (verbose) {
132 fprintf(stderr, "bound.\n");
133 }
134 return fd;
135 }
136
137 static int
138 accept_client(int server_fd, int verbose)
139 {
140 int fd;
141 struct sockaddr sa;
142 socklen_t sa_len;
143
144 sa_len = sizeof sa;
145 fd = accept(server_fd, &sa, &sa_len);
146 if (fd < 0) {
147 if (verbose) {
148 perror("accept()");
149 }
150 return -1;
151 }
152 if (verbose) {
153 char tmp[INET6_ADDRSTRLEN + 50];
154 const char *name;
155
156 name = NULL;
157 switch (sa.sa_family) {
158 case AF_INET:
159 name = inet_ntop(AF_INET,
160 &((struct sockaddr_in *)&sa)->sin_addr,
161 tmp, sizeof tmp);
162 break;
163 case AF_INET6:
164 name = inet_ntop(AF_INET6,
165 &((struct sockaddr_in6 *)&sa)->sin6_addr,
166 tmp, sizeof tmp);
167 break;
168 }
169 if (name == NULL) {
170 sprintf(tmp, "<unknown: %lu>",
171 (unsigned long)sa.sa_family);
172 name = tmp;
173 }
174 fprintf(stderr, "accepting connection from: %s\n", name);
175 }
176
177 /*
178 * We make the socket non-blocking, since we are going to use
179 * poll() to organise I/O.
180 */
181 fcntl(fd, F_SETFL, O_NONBLOCK);
182 return fd;
183 }
184
185 static void
186 usage_server(void)
187 {
188 fprintf(stderr,
189 "usage: brssl server [ options ]\n");
190 fprintf(stderr,
191 "options:\n");
192 fprintf(stderr,
193 " -q suppress verbose messages\n");
194 fprintf(stderr,
195 " -trace activate extra debug messages (dump of all packets)\n");
196 fprintf(stderr,
197 " -b name bind to a specific address or host name\n");
198 fprintf(stderr,
199 " -p port bind to a specific port (default: 4433)\n");
200 fprintf(stderr,
201 " -mono use monodirectional buffering\n");
202 fprintf(stderr,
203 " -buf length set the I/O buffer length (in bytes)\n");
204 fprintf(stderr,
205 " -cache length set the session cache storage length (in bytes)\n");
206 fprintf(stderr,
207 " -cert fname read certificate chain from file 'fname'\n");
208 fprintf(stderr,
209 " -key fname read private key from file 'fname'\n");
210 fprintf(stderr,
211 " -list list supported names (protocols, algorithms...)\n");
212 fprintf(stderr,
213 " -vmin name set minimum supported version (default: TLS-1.0)\n");
214 fprintf(stderr,
215 " -vmax name set maximum supported version (default: TLS-1.2)\n");
216 fprintf(stderr,
217 " -cs names set list of supported cipher suites (comma-separated)\n");
218 fprintf(stderr,
219 " -hf names add support for some hash functions (comma-separated)\n");
220 fprintf(stderr,
221 " -serverpref enforce server's preferences for cipher suites\n");
222 exit(EXIT_FAILURE);
223 }
224
225 typedef struct {
226 const br_ssl_server_policy_class *vtable;
227 int verbose;
228 br_x509_certificate *chain;
229 size_t chain_len;
230 int cert_signer_algo;
231 private_key *sk;
232 } policy_context;
233
234 static int
235 get_cert_signer_algo(br_x509_certificate *xc)
236 {
237 br_x509_decoder_context dc;
238 int err;
239
240 br_x509_decoder_init(&dc, 0, 0);
241 br_x509_decoder_push(&dc, xc->data, xc->data_len);
242 err = br_x509_decoder_last_error(&dc);
243 if (err != 0) {
244 return -err;
245 } else {
246 return br_x509_decoder_get_signer_key_type(&dc);
247 }
248 }
249
250 static int
251 sp_choose(const br_ssl_server_policy_class **pctx,
252 const br_ssl_server_context *cc,
253 br_ssl_server_choices *choices)
254 {
255 policy_context *pc;
256 const br_suite_translated *st;
257 size_t u, st_num;
258 unsigned chashes;
259 int hash_id;
260
261 pc = (policy_context *)pctx;
262 st = br_ssl_server_get_client_suites(cc, &st_num);
263 chashes = br_ssl_server_get_client_hashes(cc);
264 for (hash_id = 6; hash_id >= 2; hash_id --) {
265 if ((chashes >> hash_id) & 1) {
266 break;
267 }
268 }
269 if (pc->verbose) {
270 fprintf(stderr, "Client parameters:\n");
271 fprintf(stderr, " Maximum version: ");
272 switch (cc->client_max_version) {
273 case BR_SSL30:
274 fprintf(stderr, "SSL 3.0");
275 break;
276 case BR_TLS10:
277 fprintf(stderr, "TLS 1.0");
278 break;
279 case BR_TLS11:
280 fprintf(stderr, "TLS 1.1");
281 break;
282 case BR_TLS12:
283 fprintf(stderr, "TLS 1.2");
284 break;
285 default:
286 fprintf(stderr, "unknown (0x%04X)",
287 (unsigned)cc->client_max_version);
288 break;
289 }
290 fprintf(stderr, "\n");
291 fprintf(stderr, " Compatible cipher suites:\n");
292 for (u = 0; u < st_num; u ++) {
293 char csn[80];
294
295 get_suite_name_ext(st[u][0], csn, sizeof csn);
296 fprintf(stderr, " %s\n", csn);
297 }
298 fprintf(stderr, " Common hash functions:");
299 for (u = 2; u <= 6; u ++) {
300 if ((chashes >> u) & 1) {
301 int z;
302
303 switch (u) {
304 case 3: z = 224; break;
305 case 4: z = 256; break;
306 case 5: z = 384; break;
307 case 6: z = 512; break;
308 default:
309 z = 1;
310 break;
311 }
312 fprintf(stderr, " sha%d", z);
313 }
314 }
315 fprintf(stderr, "\n");
316 }
317 for (u = 0; u < st_num; u ++) {
318 unsigned tt;
319
320 tt = st[u][1];
321 switch (tt >> 12) {
322 case BR_SSLKEYX_RSA:
323 if (pc->sk->key_type == BR_KEYTYPE_RSA) {
324 choices->cipher_suite = st[u][0];
325 goto choose_ok;
326 }
327 break;
328 case BR_SSLKEYX_ECDHE_RSA:
329 if (pc->sk->key_type == BR_KEYTYPE_RSA) {
330 choices->cipher_suite = st[u][0];
331 choices->hash_id = hash_id;
332 goto choose_ok;
333 }
334 break;
335 case BR_SSLKEYX_ECDHE_ECDSA:
336 if (pc->sk->key_type == BR_KEYTYPE_EC) {
337 choices->cipher_suite = st[u][0];
338 choices->hash_id = hash_id;
339 goto choose_ok;
340 }
341 break;
342 case BR_SSLKEYX_ECDH_RSA:
343 if (pc->sk->key_type == BR_KEYTYPE_EC
344 && pc->cert_signer_algo == BR_KEYTYPE_RSA)
345 {
346 choices->cipher_suite = st[u][0];
347 goto choose_ok;
348 }
349 break;
350 case BR_SSLKEYX_ECDH_ECDSA:
351 if (pc->sk->key_type == BR_KEYTYPE_EC
352 && pc->cert_signer_algo == BR_KEYTYPE_EC)
353 {
354 choices->cipher_suite = st[u][0];
355 goto choose_ok;
356 }
357 break;
358 }
359 }
360 return 0;
361
362 choose_ok:
363 choices->chain = pc->chain;
364 choices->chain_len = pc->chain_len;
365 if (pc->verbose) {
366 char csn[80];
367
368 get_suite_name_ext(choices->cipher_suite, csn, sizeof csn);
369 fprintf(stderr, "Using: %s\n", csn);
370 }
371 return 1;
372 }
373
374 static uint32_t
375 sp_do_keyx(const br_ssl_server_policy_class **pctx,
376 unsigned char *data, size_t len)
377 {
378 policy_context *pc;
379
380 pc = (policy_context *)pctx;
381 switch (pc->sk->key_type) {
382 case BR_KEYTYPE_RSA:
383 return br_rsa_ssl_decrypt(
384 &br_rsa_i31_private, &pc->sk->key.rsa,
385 data, len);
386 case BR_KEYTYPE_EC:
387 return br_ec_prime_i31.mul(data, len, pc->sk->key.ec.x,
388 pc->sk->key.ec.xlen, pc->sk->key.ec.curve);
389 default:
390 fprintf(stderr, "ERROR: unknown private key type (%d)\n",
391 (int)pc->sk->key_type);
392 return 0;
393 }
394 }
395
396 /*
397 * OID for hash functions in RSA signatures.
398 */
399 static const unsigned char HASH_OID_SHA1[] = {
400 0x05, 0x2B, 0x0E, 0x03, 0x02, 0x1A
401 };
402
403 static const unsigned char HASH_OID_SHA224[] = {
404 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04
405 };
406
407 static const unsigned char HASH_OID_SHA256[] = {
408 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01
409 };
410
411 static const unsigned char HASH_OID_SHA384[] = {
412 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02
413 };
414
415 static const unsigned char HASH_OID_SHA512[] = {
416 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03
417 };
418
419 static const unsigned char *HASH_OID[] = {
420 HASH_OID_SHA1,
421 HASH_OID_SHA224,
422 HASH_OID_SHA256,
423 HASH_OID_SHA384,
424 HASH_OID_SHA512
425 };
426
427 static const br_hash_class *
428 get_hash_impl(int hash_id)
429 {
430 size_t u;
431
432 for (u = 0; hash_functions[u].name; u ++) {
433 const br_hash_class *hc;
434 int id;
435
436 hc = hash_functions[u].hclass;
437 id = (hc->desc >> BR_HASHDESC_ID_OFF) & BR_HASHDESC_ID_MASK;
438 if (id == hash_id) {
439 return hc;
440 }
441 }
442 return NULL;
443 }
444
445 static size_t
446 sp_do_sign(const br_ssl_server_policy_class **pctx,
447 int hash_id, size_t hv_len, unsigned char *data, size_t len)
448 {
449 policy_context *pc;
450 unsigned char hv[64];
451
452 pc = (policy_context *)pctx;
453 memcpy(hv, data, hv_len);
454 switch (pc->sk->key_type) {
455 size_t sig_len;
456 uint32_t x;
457 const unsigned char *hash_oid;
458 const br_hash_class *hc;
459
460 case BR_KEYTYPE_RSA:
461 if (hash_id == 0) {
462 hash_oid = NULL;
463 } else if (hash_id >= 2 && hash_id <= 6) {
464 hash_oid = HASH_OID[hash_id - 2];
465 } else {
466 if (pc->verbose) {
467 fprintf(stderr, "ERROR: cannot RSA-sign with"
468 " unknown hash function: %d\n",
469 hash_id);
470 }
471 return 0;
472 }
473 sig_len = (pc->sk->key.rsa.n_bitlen + 7) >> 3;
474 if (len < sig_len) {
475 if (pc->verbose) {
476 fprintf(stderr, "ERROR: cannot RSA-sign,"
477 " buffer is too small"
478 " (sig=%lu, buf=%lu)\n",
479 (unsigned long)sig_len,
480 (unsigned long)len);
481 }
482 return 0;
483 }
484 x = br_rsa_i31_pkcs1_sign(hash_oid, hv, hv_len,
485 &pc->sk->key.rsa, data);
486 if (!x) {
487 if (pc->verbose) {
488 fprintf(stderr, "ERROR: RSA-sign failure\n");
489 }
490 return 0;
491 }
492 return sig_len;
493
494 case BR_KEYTYPE_EC:
495 hc = get_hash_impl(hash_id);
496 if (hc == NULL) {
497 if (pc->verbose) {
498 fprintf(stderr, "ERROR: cannot RSA-sign with"
499 " unknown hash function: %d\n",
500 hash_id);
501 }
502 return 0;
503 }
504 if (len < 139) {
505 if (pc->verbose) {
506 fprintf(stderr, "ERROR: cannot ECDSA-sign"
507 " (output buffer = %lu)\n",
508 (unsigned long)len);
509 }
510 return 0;
511 }
512 sig_len = br_ecdsa_i31_sign_asn1(&br_ec_prime_i31,
513 hc, hv, &pc->sk->key.ec, data);
514 if (sig_len == 0) {
515 if (pc->verbose) {
516 fprintf(stderr, "ERROR: ECDSA-sign failure\n");
517 }
518 return 0;
519 }
520 return sig_len;
521
522 default:
523 return 0;
524 }
525 }
526
527 static const br_ssl_server_policy_class policy_vtable = {
528 sizeof(policy_context),
529 sp_choose,
530 sp_do_keyx,
531 sp_do_sign
532 };
533
534 /* see brssl.h */
535 int
536 do_server(int argc, char *argv[])
537 {
538 int retcode;
539 int verbose;
540 int trace;
541 int i, bidi;
542 const char *bind_name;
543 const char *port;
544 unsigned vmin, vmax;
545 cipher_suite *suites;
546 size_t num_suites;
547 uint16_t *suite_ids;
548 unsigned hfuns;
549 br_x509_certificate *chain;
550 size_t chain_len;
551 int cert_signer_algo;
552 private_key *sk;
553 size_t u;
554 br_ssl_server_context cc;
555 policy_context pc;
556 br_ssl_session_cache_lru lru;
557 unsigned char *iobuf, *cache;
558 size_t iobuf_len, cache_len;
559 uint32_t flags;
560 int server_fd, fd;
561
562 retcode = 0;
563 verbose = 1;
564 trace = 0;
565 bind_name = NULL;
566 port = NULL;
567 bidi = 1;
568 vmin = 0;
569 vmax = 0;
570 suites = NULL;
571 num_suites = 0;
572 hfuns = 0;
573 suite_ids = NULL;
574 chain = NULL;
575 chain_len = 0;
576 sk = NULL;
577 iobuf = NULL;
578 iobuf_len = 0;
579 cache = NULL;
580 cache_len = (size_t)-1;
581 flags = 0;
582 server_fd = -1;
583 fd = -1;
584 for (i = 0; i < argc; i ++) {
585 const char *arg;
586
587 arg = argv[i];
588 if (arg[0] != '-') {
589 usage_server();
590 goto server_exit_error;
591 }
592 if (eqstr(arg, "-v") || eqstr(arg, "-verbose")) {
593 verbose = 1;
594 } else if (eqstr(arg, "-q") || eqstr(arg, "-quiet")) {
595 verbose = 0;
596 } else if (eqstr(arg, "-trace")) {
597 trace = 1;
598 } else if (eqstr(arg, "-b")) {
599 if (++ i >= argc) {
600 fprintf(stderr,
601 "ERROR: no argument for '-b'\n");
602 usage_server();
603 goto server_exit_error;
604 }
605 if (bind_name != NULL) {
606 fprintf(stderr, "ERROR: duplicate bind host\n");
607 usage_server();
608 goto server_exit_error;
609 }
610 bind_name = argv[i];
611 } else if (eqstr(arg, "-p")) {
612 if (++ i >= argc) {
613 fprintf(stderr,
614 "ERROR: no argument for '-p'\n");
615 usage_server();
616 goto server_exit_error;
617 }
618 if (port != NULL) {
619 fprintf(stderr, "ERROR: duplicate bind port\n");
620 usage_server();
621 goto server_exit_error;
622 }
623 port = argv[i];
624 } else if (eqstr(arg, "-mono")) {
625 bidi = 0;
626 } else if (eqstr(arg, "-buf")) {
627 if (++ i >= argc) {
628 fprintf(stderr,
629 "ERROR: no argument for '-buf'\n");
630 usage_server();
631 goto server_exit_error;
632 }
633 arg = argv[i];
634 if (iobuf_len != 0) {
635 fprintf(stderr,
636 "ERROR: duplicate I/O buffer length\n");
637 usage_server();
638 goto server_exit_error;
639 }
640 iobuf_len = parse_size(arg);
641 if (iobuf_len == (size_t)-1) {
642 usage_server();
643 goto server_exit_error;
644 }
645 } else if (eqstr(arg, "-cache")) {
646 if (++ i >= argc) {
647 fprintf(stderr,
648 "ERROR: no argument for '-cache'\n");
649 usage_server();
650 goto server_exit_error;
651 }
652 arg = argv[i];
653 if (cache_len != (size_t)-1) {
654 fprintf(stderr, "ERROR: duplicate session"
655 " cache length\n");
656 usage_server();
657 goto server_exit_error;
658 }
659 cache_len = parse_size(arg);
660 if (cache_len == (size_t)-1) {
661 usage_server();
662 goto server_exit_error;
663 }
664 } else if (eqstr(arg, "-cert")) {
665 if (++ i >= argc) {
666 fprintf(stderr,
667 "ERROR: no argument for '-cert'\n");
668 usage_server();
669 goto server_exit_error;
670 }
671 if (chain != NULL) {
672 fprintf(stderr,
673 "ERROR: duplicate certificate chain\n");
674 usage_server();
675 goto server_exit_error;
676 }
677 arg = argv[i];
678 chain = read_certificates(arg, &chain_len);
679 if (chain == NULL || chain_len == 0) {
680 goto server_exit_error;
681 }
682 } else if (eqstr(arg, "-key")) {
683 if (++ i >= argc) {
684 fprintf(stderr,
685 "ERROR: no argument for '-key'\n");
686 usage_server();
687 goto server_exit_error;
688 }
689 if (sk != NULL) {
690 fprintf(stderr,
691 "ERROR: duplicate private key\n");
692 usage_server();
693 goto server_exit_error;
694 }
695 arg = argv[i];
696 sk = read_private_key(arg);
697 if (sk == NULL) {
698 goto server_exit_error;
699 }
700 } else if (eqstr(arg, "-list")) {
701 list_names();
702 goto server_exit;
703 } else if (eqstr(arg, "-vmin")) {
704 if (++ i >= argc) {
705 fprintf(stderr,
706 "ERROR: no argument for '-vmin'\n");
707 usage_server();
708 goto server_exit_error;
709 }
710 arg = argv[i];
711 if (vmin != 0) {
712 fprintf(stderr,
713 "ERROR: duplicate minimum version\n");
714 usage_server();
715 goto server_exit_error;
716 }
717 vmin = parse_version(arg, strlen(arg));
718 if (vmin == 0) {
719 fprintf(stderr,
720 "ERROR: unrecognised version '%s'\n",
721 arg);
722 usage_server();
723 goto server_exit_error;
724 }
725 } else if (eqstr(arg, "-vmax")) {
726 if (++ i >= argc) {
727 fprintf(stderr,
728 "ERROR: no argument for '-vmax'\n");
729 usage_server();
730 goto server_exit_error;
731 }
732 arg = argv[i];
733 if (vmax != 0) {
734 fprintf(stderr,
735 "ERROR: duplicate maximum version\n");
736 usage_server();
737 goto server_exit_error;
738 }
739 vmax = parse_version(arg, strlen(arg));
740 if (vmax == 0) {
741 fprintf(stderr,
742 "ERROR: unrecognised version '%s'\n",
743 arg);
744 usage_server();
745 goto server_exit_error;
746 }
747 } else if (eqstr(arg, "-cs")) {
748 if (++ i >= argc) {
749 fprintf(stderr,
750 "ERROR: no argument for '-cs'\n");
751 usage_server();
752 goto server_exit_error;
753 }
754 arg = argv[i];
755 if (suites != NULL) {
756 fprintf(stderr, "ERROR: duplicate list"
757 " of cipher suites\n");
758 usage_server();
759 goto server_exit_error;
760 }
761 suites = parse_suites(arg, &num_suites);
762 if (suites == NULL) {
763 usage_server();
764 goto server_exit_error;
765 }
766 } else if (eqstr(arg, "-hf")) {
767 unsigned x;
768
769 if (++ i >= argc) {
770 fprintf(stderr,
771 "ERROR: no argument for '-hf'\n");
772 usage_server();
773 goto server_exit_error;
774 }
775 arg = argv[i];
776 x = parse_hash_functions(arg);
777 if (x == 0) {
778 usage_server();
779 goto server_exit_error;
780 }
781 hfuns |= x;
782 } else if (eqstr(arg, "-serverpref")) {
783 flags |= BR_OPT_ENFORCE_SERVER_PREFERENCES;
784 } else {
785 fprintf(stderr, "ERROR: unknown option: '%s'\n", arg);
786 usage_server();
787 goto server_exit_error;
788 }
789 }
790 if (port == NULL) {
791 port = "4433";
792 }
793 if (vmin == 0) {
794 vmin = BR_TLS10;
795 }
796 if (vmax == 0) {
797 vmax = BR_TLS12;
798 }
799 if (vmax < vmin) {
800 fprintf(stderr, "ERROR: impossible minimum/maximum protocol"
801 " version combination\n");
802 usage_server();
803 goto server_exit_error;
804 }
805 if (suites == NULL) {
806 num_suites = 0;
807
808 for (u = 0; cipher_suites[u].name; u ++) {
809 if ((cipher_suites[u].req & REQ_TLS12) == 0
810 || vmax >= BR_TLS12)
811 {
812 num_suites ++;
813 }
814 }
815 suites = xmalloc(num_suites * sizeof *suites);
816 num_suites = 0;
817 for (u = 0; cipher_suites[u].name; u ++) {
818 if ((cipher_suites[u].req & REQ_TLS12) == 0
819 || vmax >= BR_TLS12)
820 {
821 suites[num_suites ++] = cipher_suites[u];
822 }
823 }
824 }
825 if (hfuns == 0) {
826 hfuns = (unsigned)-1;
827 }
828 if (chain == NULL || chain_len == 0) {
829 fprintf(stderr, "ERROR: no certificate chain provided\n");
830 goto server_exit_error;
831 }
832 if (sk == NULL) {
833 fprintf(stderr, "ERROR: no private key provided\n");
834 goto server_exit_error;
835 }
836 switch (sk->key_type) {
837 int curve;
838 uint32_t supp;
839
840 case BR_KEYTYPE_RSA:
841 break;
842 case BR_KEYTYPE_EC:
843 curve = sk->key.ec.curve;
844 supp = br_ec_prime_i31.supported_curves;
845 if (curve > 31 || !((supp >> curve) & 1)) {
846 fprintf(stderr, "ERROR: private key curve (%d)"
847 " is not supported\n", curve);
848 goto server_exit_error;
849 }
850 break;
851 default:
852 fprintf(stderr, "ERROR: unsupported private key type (%d)\n",
853 sk->key_type);
854 break;
855 }
856 cert_signer_algo = get_cert_signer_algo(chain);
857 if (cert_signer_algo < 0) {
858 fprintf(stderr, "ERROR: server certificate cannot be"
859 " decoded (err=%d)\n", -cert_signer_algo);
860 goto server_exit_error;
861 } else if (verbose) {
862 const char *csas;
863
864 switch (cert_signer_algo) {
865 case BR_KEYTYPE_RSA: csas = "RSA"; break;
866 case BR_KEYTYPE_EC: csas = "EC"; break;
867 default:
868 csas = "unknown";
869 break;
870 }
871 fprintf(stderr, "Issuing CA key type: %d (%s)\n",
872 cert_signer_algo, csas);
873 }
874 if (iobuf_len == 0) {
875 if (bidi) {
876 iobuf_len = BR_SSL_BUFSIZE_BIDI;
877 } else {
878 iobuf_len = BR_SSL_BUFSIZE_MONO;
879 }
880 }
881 iobuf = xmalloc(iobuf_len);
882 if (cache_len == (size_t)-1) {
883 cache_len = 5000;
884 }
885 cache = xmalloc(cache_len);
886
887 /*
888 * Compute implementation requirements and inject implementations.
889 */
890 suite_ids = xmalloc(num_suites * sizeof *suite_ids);
891 br_ssl_server_zero(&cc);
892 br_ssl_engine_set_versions(&cc.eng, vmin, vmax);
893 br_ssl_server_set_all_flags(&cc, flags);
894 if (vmin <= BR_TLS11) {
895 if (!(hfuns & (1 << br_md5_ID))) {
896 fprintf(stderr, "ERROR: TLS 1.0 and 1.1 need MD5\n");
897 goto server_exit_error;
898 }
899 if (!(hfuns & (1 << br_sha1_ID))) {
900 fprintf(stderr, "ERROR: TLS 1.0 and 1.1 need SHA-1\n");
901 goto server_exit_error;
902 }
903 }
904 for (u = 0; u < num_suites; u ++) {
905 unsigned req;
906
907 req = suites[u].req;
908 suite_ids[u] = suites[u].suite;
909 if ((req & REQ_TLS12) != 0 && vmax < BR_TLS12) {
910 fprintf(stderr,
911 "ERROR: cipher suite %s requires TLS 1.2\n",
912 suites[u].name);
913 goto server_exit_error;
914 }
915 if ((req & REQ_SHA1) != 0 && !(hfuns & (1 << br_sha1_ID))) {
916 fprintf(stderr,
917 "ERROR: cipher suite %s requires SHA-1\n",
918 suites[u].name);
919 goto server_exit_error;
920 }
921 if ((req & REQ_SHA256) != 0 && !(hfuns & (1 << br_sha256_ID))) {
922 fprintf(stderr,
923 "ERROR: cipher suite %s requires SHA-256\n",
924 suites[u].name);
925 goto server_exit_error;
926 }
927 if ((req & REQ_SHA384) != 0 && !(hfuns & (1 << br_sha384_ID))) {
928 fprintf(stderr,
929 "ERROR: cipher suite %s requires SHA-384\n",
930 suites[u].name);
931 goto server_exit_error;
932 }
933 /* TODO: algorithm implementation selection */
934 if ((req & REQ_AESCBC) != 0) {
935 br_ssl_engine_set_aes_cbc(&cc.eng,
936 &br_aes_ct_cbcenc_vtable,
937 &br_aes_ct_cbcdec_vtable);
938 br_ssl_engine_set_cbc(&cc.eng,
939 &br_sslrec_in_cbc_vtable,
940 &br_sslrec_out_cbc_vtable);
941 }
942 if ((req & REQ_AESGCM) != 0) {
943 br_ssl_engine_set_aes_ctr(&cc.eng,
944 &br_aes_ct_ctr_vtable);
945 br_ssl_engine_set_ghash(&cc.eng,
946 &br_ghash_ctmul);
947 br_ssl_engine_set_gcm(&cc.eng,
948 &br_sslrec_in_gcm_vtable,
949 &br_sslrec_out_gcm_vtable);
950 }
951 if ((req & REQ_3DESCBC) != 0) {
952 br_ssl_engine_set_des_cbc(&cc.eng,
953 &br_des_ct_cbcenc_vtable,
954 &br_des_ct_cbcdec_vtable);
955 br_ssl_engine_set_cbc(&cc.eng,
956 &br_sslrec_in_cbc_vtable,
957 &br_sslrec_out_cbc_vtable);
958 }
959 if ((req & (REQ_ECDHE_RSA | REQ_ECDHE_ECDSA)) != 0) {
960 br_ssl_engine_set_ec(&cc.eng, &br_ec_prime_i31);
961 }
962 }
963 br_ssl_engine_set_suites(&cc.eng, suite_ids, num_suites);
964
965 for (u = 0; hash_functions[u].name; u ++) {
966 const br_hash_class *hc;
967 int id;
968
969 hc = hash_functions[u].hclass;
970 id = (hc->desc >> BR_HASHDESC_ID_OFF) & BR_HASHDESC_ID_MASK;
971 if ((hfuns & ((unsigned)1 << id)) != 0) {
972 br_ssl_engine_set_hash(&cc.eng, id, hc);
973 }
974 }
975 if (vmin <= BR_TLS11) {
976 br_ssl_engine_set_prf10(&cc.eng, &br_tls10_prf);
977 }
978 if (vmax >= BR_TLS12) {
979 if ((hfuns & ((unsigned)1 << br_sha256_ID)) != 0) {
980 br_ssl_engine_set_prf_sha256(&cc.eng,
981 &br_tls12_sha256_prf);
982 }
983 if ((hfuns & ((unsigned)1 << br_sha384_ID)) != 0) {
984 br_ssl_engine_set_prf_sha384(&cc.eng,
985 &br_tls12_sha384_prf);
986 }
987 }
988
989 br_ssl_session_cache_lru_init(&lru, cache, cache_len);
990 br_ssl_server_set_cache(&cc, &lru.vtable);
991
992 pc.vtable = &policy_vtable;
993 pc.verbose = verbose;
994 pc.chain = chain;
995 pc.chain_len = chain_len;
996 pc.cert_signer_algo = cert_signer_algo;
997 pc.sk = sk;
998 br_ssl_server_set_policy(&cc, &pc.vtable);
999
1000 br_ssl_engine_set_buffer(&cc.eng, iobuf, iobuf_len, bidi);
1001
1002 /*
1003 * Open the server socket.
1004 */
1005 server_fd = host_bind(bind_name, port, verbose);
1006 if (server_fd < 0) {
1007 goto server_exit_error;
1008 }
1009
1010 /*
1011 * Process incoming clients, one at a time. Note that we do not
1012 * accept any client until the previous connection has finished:
1013 * this is voluntary, since the tool uses stdin/stdout for
1014 * application data, and thus cannot really run two connections
1015 * simultaneously.
1016 */
1017 for (;;) {
1018 int x;
1019
1020 fd = accept_client(server_fd, verbose);
1021 if (fd < 0) {
1022 goto server_exit_error;
1023 }
1024 br_ssl_server_reset(&cc);
1025 x = run_ssl_engine(&cc.eng, fd,
1026 (verbose ? RUN_ENGINE_VERBOSE : 0)
1027 | (trace ? RUN_ENGINE_TRACE : 0));
1028 close(fd);
1029 fd = -1;
1030 if (x < -1) {
1031 goto server_exit_error;
1032 }
1033 }
1034
1035 /*
1036 * Release allocated structures.
1037 */
1038 server_exit:
1039 xfree(suites);
1040 xfree(suite_ids);
1041 if (chain != NULL) {
1042 for (u = 0; u < chain_len; u ++) {
1043 xfree(chain[u].data);
1044 }
1045 xfree(chain);
1046 }
1047 free_private_key(sk);
1048 xfree(iobuf);
1049 xfree(cache);
1050 if (fd >= 0) {
1051 close(fd);
1052 }
1053 return retcode;
1054
1055 server_exit_error:
1056 retcode = -1;
1057 goto server_exit;
1058 }