_ Git - BearSSL/blob - tools/server.c

   1 /*
   2  * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
   3  *
   4  * Permission is hereby granted, free of charge, to any person obtaining
   5  * a copy of this software and associated documentation files (the
   6  * "Software"), to deal in the Software without restriction, including
   7  * without limitation the rights to use, copy, modify, merge, publish,
   8  * distribute, sublicense, and/or sell copies of the Software, and to
   9  * permit persons to whom the Software is furnished to do so, subject to
  10  * the following conditions:
  11  *
  12  * The above copyright notice and this permission notice shall be
  13  * included in all copies or substantial portions of the Software.
  14  *
  15  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  16  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  17  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  18  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  19  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  20  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  21  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  22  * SOFTWARE.
  23  */
  24
  25 #include <stdio.h>
  26 #include <stdlib.h>
  27 #include <string.h>
  28 #include <stdint.h>
  29 #include <errno.h>
  30
  31 #include <sys/types.h>
  32 #include <sys/socket.h>
  33 #include <netdb.h>
  34 #include <netinet/in.h>
  35 #include <arpa/inet.h>
  36 #include <unistd.h>
  37 #include <fcntl.h>
  38
  39 #include "brssl.h"
  40 #include "bearssl.h"
  41
  42 static int
  43 host_bind(const char *host, const char *port, int verbose)
  44 {
  45         struct addrinfo hints, *si, *p;
  46         int fd;
  47         int err;
  48
  49         memset(&hints, 0, sizeof hints);
  50         hints.ai_family = PF_UNSPEC;
  51         hints.ai_socktype = SOCK_STREAM;
  52         err = getaddrinfo(host, port, &hints, &si);
  53         if (err != 0) {
  54                 fprintf(stderr, "ERROR: getaddrinfo(): %s\n",
  55                         gai_strerror(err));
  56                 return -1;
  57         }
  58         fd = -1;
  59         for (p = si; p != NULL; p = p->ai_next) {
  60                 struct sockaddr *sa;
  61                 struct sockaddr_in sa4;
  62                 struct sockaddr_in6 sa6;
  63                 size_t sa_len;
  64                 void *addr;
  65                 char tmp[INET6_ADDRSTRLEN + 50];
  66                 int opt;
  67
  68                 sa = (struct sockaddr *)p->ai_addr;
  69                 if (sa->sa_family == AF_INET) {
  70                         sa4 = *(struct sockaddr_in *)sa;
  71                         sa = (struct sockaddr *)&sa4;
  72                         sa_len = sizeof sa4;
  73                         addr = &sa4.sin_addr;
  74                         if (host == NULL) {
  75                                 sa4.sin_addr.s_addr = INADDR_ANY;
  76                         }
  77                 } else if (sa->sa_family == AF_INET6) {
  78                         sa6 = *(struct sockaddr_in6 *)sa;
  79                         sa = (struct sockaddr *)&sa6;
  80                         sa_len = sizeof sa6;
  81                         addr = &sa6.sin6_addr;
  82                         if (host == NULL) {
  83                                 sa6.sin6_addr = in6addr_any;
  84                         }
  85                 } else {
  86                         addr = NULL;
  87                         sa_len = p->ai_addrlen;
  88                 }
  89                 if (addr != NULL) {
  90                         if (!inet_ntop(p->ai_family, addr, tmp, sizeof tmp)) {
  91                                 strcpy(tmp, "<invalid>");
  92                         }
  93                 } else {
  94                         sprintf(tmp, "<unknown family: %d>",
  95                                 (int)sa->sa_family);
  96                 }
  97                 if (verbose) {
  98                         fprintf(stderr, "binding to: %s\n", tmp);
  99                 }
 100                 fd = socket(p->ai_family, p->ai_socktype, p->ai_protocol);
 101                 if (fd < 0) {
 102                         if (verbose) {
 103                                 perror("socket()");
 104                         }
 105                         continue;
 106                 }
 107                 opt = 1;
 108                 setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof opt);
 109                 opt = 0;
 110                 setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, &opt, sizeof opt);
 111                 if (bind(fd, sa, sa_len) < 0) {
 112                         if (verbose) {
 113                                 perror("bind()");
 114                         }
 115                         close(fd);
 116                         continue;
 117                 }
 118                 break;
 119         }
 120         if (p == NULL) {
 121                 freeaddrinfo(si);
 122                 fprintf(stderr, "ERROR: failed to bind\n");
 123                 return -1;
 124         }
 125         freeaddrinfo(si);
 126         if (listen(fd, 5) < 0) {
 127                 if (verbose) {
 128                         perror("listen()");
 129                 }
 130                 close(fd);
 131                 return -1;
 132         }
 133         if (verbose) {
 134                 fprintf(stderr, "bound.\n");
 135         }
 136         return fd;
 137 }
 138
 139 static int
 140 accept_client(int server_fd, int verbose)
 141 {
 142         int fd;
 143         struct sockaddr sa;
 144         socklen_t sa_len;
 145
 146         sa_len = sizeof sa;
 147         fd = accept(server_fd, &sa, &sa_len);
 148         if (fd < 0) {
 149                 if (verbose) {
 150                         perror("accept()");
 151                 }
 152                 return -1;
 153         }
 154         if (verbose) {
 155                 char tmp[INET6_ADDRSTRLEN + 50];
 156                 const char *name;
 157
 158                 name = NULL;
 159                 switch (sa.sa_family) {
 160                 case AF_INET:
 161                         name = inet_ntop(AF_INET,
 162                                 &((struct sockaddr_in *)&sa)->sin_addr,
 163                                 tmp, sizeof tmp);
 164                         break;
 165                 case AF_INET6:
 166                         name = inet_ntop(AF_INET6,
 167                                 &((struct sockaddr_in6 *)&sa)->sin6_addr,
 168                                 tmp, sizeof tmp);
 169                         break;
 170                 }
 171                 if (name == NULL) {
 172                         sprintf(tmp, "<unknown: %lu>",
 173                                 (unsigned long)sa.sa_family);
 174                         name = tmp;
 175                 }
 176                 fprintf(stderr, "accepting connection from: %s\n", name);
 177         }
 178
 179         /*
 180          * We make the socket non-blocking, since we are going to use
 181          * poll() to organise I/O.
 182          */
 183         fcntl(fd, F_SETFL, O_NONBLOCK);
 184         return fd;
 185 }
 186
 187 static void
 188 usage_server(void)
 189 {
 190         fprintf(stderr,
 191 "usage: brssl server [ options ]\n");
 192         fprintf(stderr,
 193 "options:\n");
 194         fprintf(stderr,
 195 "   -q              suppress verbose messages\n");
 196         fprintf(stderr,
 197 "   -trace          activate extra debug messages (dump of all packets)\n");
 198         fprintf(stderr,
 199 "   -b name         bind to a specific address or host name\n");
 200         fprintf(stderr,
 201 "   -p port         bind to a specific port (default: 4433)\n");
 202         fprintf(stderr,
 203 "   -mono           use monodirectional buffering\n");
 204         fprintf(stderr,
 205 "   -buf length     set the I/O buffer length (in bytes)\n");
 206         fprintf(stderr,
 207 "   -cache length   set the session cache storage length (in bytes)\n");
 208         fprintf(stderr,
 209 "   -cert fname     read certificate chain from file 'fname'\n");
 210         fprintf(stderr,
 211 "   -key fname      read private key from file 'fname'\n");
 212         fprintf(stderr,
 213 "   -list           list supported names (protocols, algorithms...)\n");
 214         fprintf(stderr,
 215 "   -vmin name      set minimum supported version (default: TLS-1.0)\n");
 216         fprintf(stderr,
 217 "   -vmax name      set maximum supported version (default: TLS-1.2)\n");
 218         fprintf(stderr,
 219 "   -cs names       set list of supported cipher suites (comma-separated)\n");
 220         fprintf(stderr,
 221 "   -hf names       add support for some hash functions (comma-separated)\n");
 222         fprintf(stderr,
 223 "   -serverpref     enforce server's preferences for cipher suites\n");
 224         exit(EXIT_FAILURE);
 225 }
 226
 227 typedef struct {
 228         const br_ssl_server_policy_class *vtable;
 229         int verbose;
 230         br_x509_certificate *chain;
 231         size_t chain_len;
 232         int cert_signer_algo;
 233         private_key *sk;
 234 } policy_context;
 235
 236 static int
 237 get_cert_signer_algo(br_x509_certificate *xc)
 238 {
 239         br_x509_decoder_context dc;
 240         int err;
 241
 242         br_x509_decoder_init(&dc, 0, 0);
 243         br_x509_decoder_push(&dc, xc->data, xc->data_len);
 244         err = br_x509_decoder_last_error(&dc);
 245         if (err != 0) {
 246                 return -err;
 247         } else {
 248                 return br_x509_decoder_get_signer_key_type(&dc);
 249         }
 250 }
 251
 252 static int
 253 sp_choose(const br_ssl_server_policy_class **pctx,
 254         const br_ssl_server_context *cc,
 255         br_ssl_server_choices *choices)
 256 {
 257         policy_context *pc;
 258         const br_suite_translated *st;
 259         size_t u, st_num;
 260         unsigned chashes;
 261         int hash_id;
 262
 263         pc = (policy_context *)pctx;
 264         st = br_ssl_server_get_client_suites(cc, &st_num);
 265         chashes = br_ssl_server_get_client_hashes(cc);
 266         for (hash_id = 6; hash_id >= 2; hash_id --) {
 267                 if ((chashes >> hash_id) & 1) {
 268                         break;
 269                 }
 270         }
 271         if (pc->verbose) {
 272                 fprintf(stderr, "Client parameters:\n");
 273                 fprintf(stderr, "   Maximum version:      ");
 274                 switch (cc->client_max_version) {
 275                 case BR_SSL30:
 276                         fprintf(stderr, "SSL 3.0");
 277                         break;
 278                 case BR_TLS10:
 279                         fprintf(stderr, "TLS 1.0");
 280                         break;
 281                 case BR_TLS11:
 282                         fprintf(stderr, "TLS 1.1");
 283                         break;
 284                 case BR_TLS12:
 285                         fprintf(stderr, "TLS 1.2");
 286                         break;
 287                 default:
 288                         fprintf(stderr, "unknown (0x%04X)",
 289                                 (unsigned)cc->client_max_version);
 290                         break;
 291                 }
 292                 fprintf(stderr, "\n");
 293                 fprintf(stderr, "   Compatible cipher suites:\n");
 294                 for (u = 0; u < st_num; u ++) {
 295                         char csn[80];
 296
 297                         get_suite_name_ext(st[u][0], csn, sizeof csn);
 298                         fprintf(stderr, "      %s\n", csn);
 299                 }
 300                 fprintf(stderr, "   Common hash functions:");
 301                 for (u = 2; u <= 6; u ++) {
 302                         if ((chashes >> u) & 1) {
 303                                 int z;
 304
 305                                 switch (u) {
 306                                 case 3: z = 224; break;
 307                                 case 4: z = 256; break;
 308                                 case 5: z = 384; break;
 309                                 case 6: z = 512; break;
 310                                 default:
 311                                         z = 1;
 312                                         break;
 313                                 }
 314                                 fprintf(stderr, " sha%d", z);
 315                         }
 316                 }
 317                 fprintf(stderr, "\n");
 318         }
 319         for (u = 0; u < st_num; u ++) {
 320                 unsigned tt;
 321
 322                 tt = st[u][1];
 323                 switch (tt >> 12) {
 324                 case BR_SSLKEYX_RSA:
 325                         if (pc->sk->key_type == BR_KEYTYPE_RSA) {
 326                                 choices->cipher_suite = st[u][0];
 327                                 goto choose_ok;
 328                         }
 329                         break;
 330                 case BR_SSLKEYX_ECDHE_RSA:
 331                         if (pc->sk->key_type == BR_KEYTYPE_RSA) {
 332                                 choices->cipher_suite = st[u][0];
 333                                 choices->hash_id = hash_id;
 334                                 goto choose_ok;
 335                         }
 336                         break;
 337                 case BR_SSLKEYX_ECDHE_ECDSA:
 338                         if (pc->sk->key_type == BR_KEYTYPE_EC) {
 339                                 choices->cipher_suite = st[u][0];
 340                                 choices->hash_id = hash_id;
 341                                 goto choose_ok;
 342                         }
 343                         break;
 344                 case BR_SSLKEYX_ECDH_RSA:
 345                         if (pc->sk->key_type == BR_KEYTYPE_EC
 346                                 && pc->cert_signer_algo == BR_KEYTYPE_RSA)
 347                         {
 348                                 choices->cipher_suite = st[u][0];
 349                                 goto choose_ok;
 350                         }
 351                         break;
 352                 case BR_SSLKEYX_ECDH_ECDSA:
 353                         if (pc->sk->key_type == BR_KEYTYPE_EC
 354                                 && pc->cert_signer_algo == BR_KEYTYPE_EC)
 355                         {
 356                                 choices->cipher_suite = st[u][0];
 357                                 goto choose_ok;
 358                         }
 359                         break;
 360                 }
 361         }
 362         return 0;
 363
 364 choose_ok:
 365         choices->chain = pc->chain;
 366         choices->chain_len = pc->chain_len;
 367         if (pc->verbose) {
 368                 char csn[80];
 369
 370                 get_suite_name_ext(choices->cipher_suite, csn, sizeof csn);
 371                 fprintf(stderr, "Using: %s\n", csn);
 372         }
 373         return 1;
 374 }
 375
 376 static uint32_t
 377 sp_do_keyx(const br_ssl_server_policy_class **pctx,
 378         unsigned char *data, size_t len)
 379 {
 380         policy_context *pc;
 381
 382         pc = (policy_context *)pctx;
 383         switch (pc->sk->key_type) {
 384         case BR_KEYTYPE_RSA:
 385                 return br_rsa_ssl_decrypt(
 386                         &br_rsa_i31_private, &pc->sk->key.rsa,
 387                         data, len);
 388         case BR_KEYTYPE_EC:
 389                 return br_ec_prime_i31.mul(data, len, pc->sk->key.ec.x,
 390                         pc->sk->key.ec.xlen, pc->sk->key.ec.curve);
 391         default:
 392                 fprintf(stderr, "ERROR: unknown private key type (%d)\n",
 393                         (int)pc->sk->key_type);
 394                 return 0;
 395         }
 396 }
 397
 398 /*
 399  * OID for hash functions in RSA signatures.
 400  */
 401 static const unsigned char HASH_OID_SHA1[] = {
 402         0x05, 0x2B, 0x0E, 0x03, 0x02, 0x1A
 403 };
 404
 405 static const unsigned char HASH_OID_SHA224[] = {
 406         0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04
 407 };
 408
 409 static const unsigned char HASH_OID_SHA256[] = {
 410         0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01
 411 };
 412
 413 static const unsigned char HASH_OID_SHA384[] = {
 414         0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02
 415 };
 416
 417 static const unsigned char HASH_OID_SHA512[] = {
 418         0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03
 419 };
 420
 421 static const unsigned char *HASH_OID[] = {
 422         HASH_OID_SHA1,
 423         HASH_OID_SHA224,
 424         HASH_OID_SHA256,
 425         HASH_OID_SHA384,
 426         HASH_OID_SHA512
 427 };
 428
 429 static const br_hash_class *
 430 get_hash_impl(int hash_id)
 431 {
 432         size_t u;
 433
 434         for (u = 0; hash_functions[u].name; u ++) {
 435                 const br_hash_class *hc;
 436                 int id;
 437
 438                 hc = hash_functions[u].hclass;
 439                 id = (hc->desc >> BR_HASHDESC_ID_OFF) & BR_HASHDESC_ID_MASK;
 440                 if (id == hash_id) {
 441                         return hc;
 442                 }
 443         }
 444         return NULL;
 445 }
 446
 447 static size_t
 448 sp_do_sign(const br_ssl_server_policy_class **pctx,
 449         int hash_id, size_t hv_len, unsigned char *data, size_t len)
 450 {
 451         policy_context *pc;
 452         unsigned char hv[64];
 453
 454         pc = (policy_context *)pctx;
 455         memcpy(hv, data, hv_len);
 456         switch (pc->sk->key_type) {
 457                 size_t sig_len;
 458                 uint32_t x;
 459                 const unsigned char *hash_oid;
 460                 const br_hash_class *hc;
 461
 462         case BR_KEYTYPE_RSA:
 463                 if (hash_id == 0) {
 464                         hash_oid = NULL;
 465                 } else if (hash_id >= 2 && hash_id <= 6) {
 466                         hash_oid = HASH_OID[hash_id - 2];
 467                 } else {
 468                         if (pc->verbose) {
 469                                 fprintf(stderr, "ERROR: cannot RSA-sign with"
 470                                         " unknown hash function: %d\n",
 471                                         hash_id);
 472                         }
 473                         return 0;
 474                 }
 475                 sig_len = (pc->sk->key.rsa.n_bitlen + 7) >> 3;
 476                 if (len < sig_len) {
 477                         if (pc->verbose) {
 478                                 fprintf(stderr, "ERROR: cannot RSA-sign,"
 479                                         " buffer is too small"
 480                                         " (sig=%lu, buf=%lu)\n",
 481                                         (unsigned long)sig_len,
 482                                         (unsigned long)len);
 483                         }
 484                         return 0;
 485                 }
 486                 x = br_rsa_i31_pkcs1_sign(hash_oid, hv, hv_len,
 487                         &pc->sk->key.rsa, data);
 488                 if (!x) {
 489                         if (pc->verbose) {
 490                                 fprintf(stderr, "ERROR: RSA-sign failure\n");
 491                         }
 492                         return 0;
 493                 }
 494                 return sig_len;
 495
 496         case BR_KEYTYPE_EC:
 497                 hc = get_hash_impl(hash_id);
 498                 if (hc == NULL) {
 499                         if (pc->verbose) {
 500                                 fprintf(stderr, "ERROR: cannot RSA-sign with"
 501                                         " unknown hash function: %d\n",
 502                                         hash_id);
 503                         }
 504                         return 0;
 505                 }
 506                 if (len < 139) {
 507                         if (pc->verbose) {
 508                                 fprintf(stderr, "ERROR: cannot ECDSA-sign"
 509                                         " (output buffer = %lu)\n",
 510                                         (unsigned long)len);
 511                         }
 512                         return 0;
 513                 }
 514                 sig_len = br_ecdsa_i31_sign_asn1(&br_ec_prime_i31,
 515                         hc, hv, &pc->sk->key.ec, data);
 516                 if (sig_len == 0) {
 517                         if (pc->verbose) {
 518                                 fprintf(stderr, "ERROR: ECDSA-sign failure\n");
 519                         }
 520                         return 0;
 521                 }
 522                 return sig_len;
 523
 524         default:
 525                 return 0;
 526         }
 527 }
 528
 529 static const br_ssl_server_policy_class policy_vtable = {
 530         sizeof(policy_context),
 531         sp_choose,
 532         sp_do_keyx,
 533         sp_do_sign
 534 };
 535
 536 /* see brssl.h */
 537 int
 538 do_server(int argc, char *argv[])
 539 {
 540         int retcode;
 541         int verbose;
 542         int trace;
 543         int i, bidi;
 544         const char *bind_name;
 545         const char *port;
 546         unsigned vmin, vmax;
 547         cipher_suite *suites;
 548         size_t num_suites;
 549         uint16_t *suite_ids;
 550         unsigned hfuns;
 551         br_x509_certificate *chain;
 552         size_t chain_len;
 553         int cert_signer_algo;
 554         private_key *sk;
 555         size_t u;
 556         br_ssl_server_context cc;
 557         policy_context pc;
 558         br_ssl_session_cache_lru lru;
 559         unsigned char *iobuf, *cache;
 560         size_t iobuf_len, cache_len;
 561         uint32_t flags;
 562         int server_fd, fd;
 563
 564         retcode = 0;
 565         verbose = 1;
 566         trace = 0;
 567         bind_name = NULL;
 568         port = NULL;
 569         bidi = 1;
 570         vmin = 0;
 571         vmax = 0;
 572         suites = NULL;
 573         num_suites = 0;
 574         hfuns = 0;
 575         suite_ids = NULL;
 576         chain = NULL;
 577         chain_len = 0;
 578         sk = NULL;
 579         iobuf = NULL;
 580         iobuf_len = 0;
 581         cache = NULL;
 582         cache_len = (size_t)-1;
 583         flags = 0;
 584         server_fd = -1;
 585         fd = -1;
 586         for (i = 0; i < argc; i ++) {
 587                 const char *arg;
 588
 589                 arg = argv[i];
 590                 if (arg[0] != '-') {
 591                         usage_server();
 592                         goto server_exit_error;
 593                 }
 594                 if (eqstr(arg, "-v") || eqstr(arg, "-verbose")) {
 595                         verbose = 1;
 596                 } else if (eqstr(arg, "-q") || eqstr(arg, "-quiet")) {
 597                         verbose = 0;
 598                 } else if (eqstr(arg, "-trace")) {
 599                         trace = 1;
 600                 } else if (eqstr(arg, "-b")) {
 601                         if (++ i >= argc) {
 602                                 fprintf(stderr,
 603                                         "ERROR: no argument for '-b'\n");
 604                                 usage_server();
 605                                 goto server_exit_error;
 606                         }
 607                         if (bind_name != NULL) {
 608                                 fprintf(stderr, "ERROR: duplicate bind host\n");
 609                                 usage_server();
 610                                 goto server_exit_error;
 611                         }
 612                         bind_name = argv[i];
 613                 } else if (eqstr(arg, "-p")) {
 614                         if (++ i >= argc) {
 615                                 fprintf(stderr,
 616                                         "ERROR: no argument for '-p'\n");
 617                                 usage_server();
 618                                 goto server_exit_error;
 619                         }
 620                         if (port != NULL) {
 621                                 fprintf(stderr, "ERROR: duplicate bind port\n");
 622                                 usage_server();
 623                                 goto server_exit_error;
 624                         }
 625                         port = argv[i];
 626                 } else if (eqstr(arg, "-mono")) {
 627                         bidi = 0;
 628                 } else if (eqstr(arg, "-buf")) {
 629                         if (++ i >= argc) {
 630                                 fprintf(stderr,
 631                                         "ERROR: no argument for '-buf'\n");
 632                                 usage_server();
 633                                 goto server_exit_error;
 634                         }
 635                         arg = argv[i];
 636                         if (iobuf_len != 0) {
 637                                 fprintf(stderr,
 638                                         "ERROR: duplicate I/O buffer length\n");
 639                                 usage_server();
 640                                 goto server_exit_error;
 641                         }
 642                         iobuf_len = parse_size(arg);
 643                         if (iobuf_len == (size_t)-1) {
 644                                 usage_server();
 645                                 goto server_exit_error;
 646                         }
 647                 } else if (eqstr(arg, "-cache")) {
 648                         if (++ i >= argc) {
 649                                 fprintf(stderr,
 650                                         "ERROR: no argument for '-cache'\n");
 651                                 usage_server();
 652                                 goto server_exit_error;
 653                         }
 654                         arg = argv[i];
 655                         if (cache_len != (size_t)-1) {
 656                                 fprintf(stderr, "ERROR: duplicate session"
 657                                         " cache length\n");
 658                                 usage_server();
 659                                 goto server_exit_error;
 660                         }
 661                         cache_len = parse_size(arg);
 662                         if (cache_len == (size_t)-1) {
 663                                 usage_server();
 664                                 goto server_exit_error;
 665                         }
 666                 } else if (eqstr(arg, "-cert")) {
 667                         if (++ i >= argc) {
 668                                 fprintf(stderr,
 669                                         "ERROR: no argument for '-cert'\n");
 670                                 usage_server();
 671                                 goto server_exit_error;
 672                         }
 673                         if (chain != NULL) {
 674                                 fprintf(stderr,
 675                                         "ERROR: duplicate certificate chain\n");
 676                                 usage_server();
 677                                 goto server_exit_error;
 678                         }
 679                         arg = argv[i];
 680                         chain = read_certificates(arg, &chain_len);
 681                         if (chain == NULL || chain_len == 0) {
 682                                 goto server_exit_error;
 683                         }
 684                 } else if (eqstr(arg, "-key")) {
 685                         if (++ i >= argc) {
 686                                 fprintf(stderr,
 687                                         "ERROR: no argument for '-key'\n");
 688                                 usage_server();
 689                                 goto server_exit_error;
 690                         }
 691                         if (sk != NULL) {
 692                                 fprintf(stderr,
 693                                         "ERROR: duplicate private key\n");
 694                                 usage_server();
 695                                 goto server_exit_error;
 696                         }
 697                         arg = argv[i];
 698                         sk = read_private_key(arg);
 699                         if (sk == NULL) {
 700                                 goto server_exit_error;
 701                         }
 702                 } else if (eqstr(arg, "-list")) {
 703                         list_names();
 704                         goto server_exit;
 705                 } else if (eqstr(arg, "-vmin")) {
 706                         if (++ i >= argc) {
 707                                 fprintf(stderr,
 708                                         "ERROR: no argument for '-vmin'\n");
 709                                 usage_server();
 710                                 goto server_exit_error;
 711                         }
 712                         arg = argv[i];
 713                         if (vmin != 0) {
 714                                 fprintf(stderr,
 715                                         "ERROR: duplicate minimum version\n");
 716                                 usage_server();
 717                                 goto server_exit_error;
 718                         }
 719                         vmin = parse_version(arg, strlen(arg));
 720                         if (vmin == 0) {
 721                                 fprintf(stderr,
 722                                         "ERROR: unrecognised version '%s'\n",
 723                                         arg);
 724                                 usage_server();
 725                                 goto server_exit_error;
 726                         }
 727                 } else if (eqstr(arg, "-vmax")) {
 728                         if (++ i >= argc) {
 729                                 fprintf(stderr,
 730                                         "ERROR: no argument for '-vmax'\n");
 731                                 usage_server();
 732                                 goto server_exit_error;
 733                         }
 734                         arg = argv[i];
 735                         if (vmax != 0) {
 736                                 fprintf(stderr,
 737                                         "ERROR: duplicate maximum version\n");
 738                                 usage_server();
 739                                 goto server_exit_error;
 740                         }
 741                         vmax = parse_version(arg, strlen(arg));
 742                         if (vmax == 0) {
 743                                 fprintf(stderr,
 744                                         "ERROR: unrecognised version '%s'\n",
 745                                         arg);
 746                                 usage_server();
 747                                 goto server_exit_error;
 748                         }
 749                 } else if (eqstr(arg, "-cs")) {
 750                         if (++ i >= argc) {
 751                                 fprintf(stderr,
 752                                         "ERROR: no argument for '-cs'\n");
 753                                 usage_server();
 754                                 goto server_exit_error;
 755                         }
 756                         arg = argv[i];
 757                         if (suites != NULL) {
 758                                 fprintf(stderr, "ERROR: duplicate list"
 759                                         " of cipher suites\n");
 760                                 usage_server();
 761                                 goto server_exit_error;
 762                         }
 763                         suites = parse_suites(arg, &num_suites);
 764                         if (suites == NULL) {
 765                                 usage_server();
 766                                 goto server_exit_error;
 767                         }
 768                 } else if (eqstr(arg, "-hf")) {
 769                         unsigned x;
 770
 771                         if (++ i >= argc) {
 772                                 fprintf(stderr,
 773                                         "ERROR: no argument for '-hf'\n");
 774                                 usage_server();
 775                                 goto server_exit_error;
 776                         }
 777                         arg = argv[i];
 778                         x = parse_hash_functions(arg);
 779                         if (x == 0) {
 780                                 usage_server();
 781                                 goto server_exit_error;
 782                         }
 783                         hfuns |= x;
 784                 } else if (eqstr(arg, "-serverpref")) {
 785                         flags |= BR_OPT_ENFORCE_SERVER_PREFERENCES;
 786                 } else {
 787                         fprintf(stderr, "ERROR: unknown option: '%s'\n", arg);
 788                         usage_server();
 789                         goto server_exit_error;
 790                 }
 791         }
 792         if (port == NULL) {
 793                 port = "4433";
 794         }
 795         if (vmin == 0) {
 796                 vmin = BR_TLS10;
 797         }
 798         if (vmax == 0) {
 799                 vmax = BR_TLS12;
 800         }
 801         if (vmax < vmin) {
 802                 fprintf(stderr, "ERROR: impossible minimum/maximum protocol"
 803                         " version combination\n");
 804                 usage_server();
 805                 goto server_exit_error;
 806         }
 807         if (suites == NULL) {
 808                 num_suites = 0;
 809
 810                 for (u = 0; cipher_suites[u].name; u ++) {
 811                         if ((cipher_suites[u].req & REQ_TLS12) == 0
 812                                 || vmax >= BR_TLS12)
 813                         {
 814                                 num_suites ++;
 815                         }
 816                 }
 817                 suites = xmalloc(num_suites * sizeof *suites);
 818                 num_suites = 0;
 819                 for (u = 0; cipher_suites[u].name; u ++) {
 820                         if ((cipher_suites[u].req & REQ_TLS12) == 0
 821                                 || vmax >= BR_TLS12)
 822                         {
 823                                 suites[num_suites ++] = cipher_suites[u];
 824                         }
 825                 }
 826         }
 827         if (hfuns == 0) {
 828                 hfuns = (unsigned)-1;
 829         }
 830         if (chain == NULL || chain_len == 0) {
 831                 fprintf(stderr, "ERROR: no certificate chain provided\n");
 832                 goto server_exit_error;
 833         }
 834         if (sk == NULL) {
 835                 fprintf(stderr, "ERROR: no private key provided\n");
 836                 goto server_exit_error;
 837         }
 838         switch (sk->key_type) {
 839                 int curve;
 840                 uint32_t supp;
 841
 842         case BR_KEYTYPE_RSA:
 843                 break;
 844         case BR_KEYTYPE_EC:
 845                 curve = sk->key.ec.curve;
 846                 supp = br_ec_prime_i31.supported_curves;
 847                 if (curve > 31 || !((supp >> curve) & 1)) {
 848                         fprintf(stderr, "ERROR: private key curve (%d)"
 849                                 " is not supported\n", curve);
 850                         goto server_exit_error;
 851                 }
 852                 break;
 853         default:
 854                 fprintf(stderr, "ERROR: unsupported private key type (%d)\n",
 855                         sk->key_type);
 856                 break;
 857         }
 858         cert_signer_algo = get_cert_signer_algo(chain);
 859         if (cert_signer_algo < 0) {
 860                 fprintf(stderr, "ERROR: server certificate cannot be"
 861                         " decoded (err=%d)\n", -cert_signer_algo);
 862                 goto server_exit_error;
 863         } else if (verbose) {
 864                 const char *csas;
 865
 866                 switch (cert_signer_algo) {
 867                 case BR_KEYTYPE_RSA: csas = "RSA"; break;
 868                 case BR_KEYTYPE_EC:  csas = "EC"; break;
 869                 default:
 870                         csas = "unknown";
 871                         break;
 872                 }
 873                 fprintf(stderr, "Issuing CA key type: %d (%s)\n",
 874                         cert_signer_algo, csas);
 875         }
 876         if (iobuf_len == 0) {
 877                 if (bidi) {
 878                         iobuf_len = BR_SSL_BUFSIZE_BIDI;
 879                 } else {
 880                         iobuf_len = BR_SSL_BUFSIZE_MONO;
 881                 }
 882         }
 883         iobuf = xmalloc(iobuf_len);
 884         if (cache_len == (size_t)-1) {
 885                 cache_len = 5000;
 886         }
 887         cache = xmalloc(cache_len);
 888
 889         /*
 890          * Compute implementation requirements and inject implementations.
 891          */
 892         suite_ids = xmalloc(num_suites * sizeof *suite_ids);
 893         br_ssl_server_zero(&cc);
 894         br_ssl_engine_set_versions(&cc.eng, vmin, vmax);
 895         br_ssl_server_set_all_flags(&cc, flags);
 896         if (vmin <= BR_TLS11) {
 897                 if (!(hfuns & (1 << br_md5_ID))) {
 898                         fprintf(stderr, "ERROR: TLS 1.0 and 1.1 need MD5\n");
 899                         goto server_exit_error;
 900                 }
 901                 if (!(hfuns & (1 << br_sha1_ID))) {
 902                         fprintf(stderr, "ERROR: TLS 1.0 and 1.1 need SHA-1\n");
 903                         goto server_exit_error;
 904                 }
 905         }
 906         for (u = 0; u < num_suites; u ++) {
 907                 unsigned req;
 908
 909                 req = suites[u].req;
 910                 suite_ids[u] = suites[u].suite;
 911                 if ((req & REQ_TLS12) != 0 && vmax < BR_TLS12) {
 912                         fprintf(stderr,
 913                                 "ERROR: cipher suite %s requires TLS 1.2\n",
 914                                 suites[u].name);
 915                         goto server_exit_error;
 916                 }
 917                 if ((req & REQ_SHA1) != 0 && !(hfuns & (1 << br_sha1_ID))) {
 918                         fprintf(stderr,
 919                                 "ERROR: cipher suite %s requires SHA-1\n",
 920                                 suites[u].name);
 921                         goto server_exit_error;
 922                 }
 923                 if ((req & REQ_SHA256) != 0 && !(hfuns & (1 << br_sha256_ID))) {
 924                         fprintf(stderr,
 925                                 "ERROR: cipher suite %s requires SHA-256\n",
 926                                 suites[u].name);
 927                         goto server_exit_error;
 928                 }
 929                 if ((req & REQ_SHA384) != 0 && !(hfuns & (1 << br_sha384_ID))) {
 930                         fprintf(stderr,
 931                                 "ERROR: cipher suite %s requires SHA-384\n",
 932                                 suites[u].name);
 933                         goto server_exit_error;
 934                 }
 935                 /* TODO: algorithm implementation selection */
 936                 if ((req & REQ_AESCBC) != 0) {
 937                         br_ssl_engine_set_aes_cbc(&cc.eng,
 938                                 &br_aes_ct_cbcenc_vtable,
 939                                 &br_aes_ct_cbcdec_vtable);
 940                         br_ssl_engine_set_cbc(&cc.eng,
 941                                 &br_sslrec_in_cbc_vtable,
 942                                 &br_sslrec_out_cbc_vtable);
 943                 }
 944                 if ((req & REQ_AESGCM) != 0) {
 945                         br_ssl_engine_set_aes_ctr(&cc.eng,
 946                                 &br_aes_ct_ctr_vtable);
 947                         br_ssl_engine_set_ghash(&cc.eng,
 948                                 &br_ghash_ctmul);
 949                         br_ssl_engine_set_gcm(&cc.eng,
 950                                 &br_sslrec_in_gcm_vtable,
 951                                 &br_sslrec_out_gcm_vtable);
 952                 }
 953                 if ((req & REQ_3DESCBC) != 0) {
 954                         br_ssl_engine_set_des_cbc(&cc.eng,
 955                                 &br_des_ct_cbcenc_vtable,
 956                                 &br_des_ct_cbcdec_vtable);
 957                         br_ssl_engine_set_cbc(&cc.eng,
 958                                 &br_sslrec_in_cbc_vtable,
 959                                 &br_sslrec_out_cbc_vtable);
 960                 }
 961                 if ((req & (REQ_ECDHE_RSA | REQ_ECDHE_ECDSA)) != 0) {
 962                         br_ssl_engine_set_ec(&cc.eng, &br_ec_prime_i31);
 963                 }
 964         }
 965         br_ssl_engine_set_suites(&cc.eng, suite_ids, num_suites);
 966
 967         for (u = 0; hash_functions[u].name; u ++) {
 968                 const br_hash_class *hc;
 969                 int id;
 970
 971                 hc = hash_functions[u].hclass;
 972                 id = (hc->desc >> BR_HASHDESC_ID_OFF) & BR_HASHDESC_ID_MASK;
 973                 if ((hfuns & ((unsigned)1 << id)) != 0) {
 974                         br_ssl_engine_set_hash(&cc.eng, id, hc);
 975                 }
 976         }
 977         if (vmin <= BR_TLS11) {
 978                 br_ssl_engine_set_prf10(&cc.eng, &br_tls10_prf);
 979         }
 980         if (vmax >= BR_TLS12) {
 981                 if ((hfuns & ((unsigned)1 << br_sha256_ID)) != 0) {
 982                         br_ssl_engine_set_prf_sha256(&cc.eng,
 983                                 &br_tls12_sha256_prf);
 984                 }
 985                 if ((hfuns & ((unsigned)1 << br_sha384_ID)) != 0) {
 986                         br_ssl_engine_set_prf_sha384(&cc.eng,
 987                                 &br_tls12_sha384_prf);
 988                 }
 989         }
 990
 991         br_ssl_session_cache_lru_init(&lru, cache, cache_len);
 992         br_ssl_server_set_cache(&cc, &lru.vtable);
 993
 994         pc.vtable = &policy_vtable;
 995         pc.verbose = verbose;
 996         pc.chain = chain;
 997         pc.chain_len = chain_len;
 998         pc.cert_signer_algo = cert_signer_algo;
 999         pc.sk = sk;
1000         br_ssl_server_set_policy(&cc, &pc.vtable);
1001
1002         br_ssl_engine_set_buffer(&cc.eng, iobuf, iobuf_len, bidi);
1003
1004         /*
1005          * Open the server socket.
1006          */
1007         server_fd = host_bind(bind_name, port, verbose);
1008         if (server_fd < 0) {
1009                 goto server_exit_error;
1010         }
1011
1012         /*
1013          * Process incoming clients, one at a time. Note that we do not
1014          * accept any client until the previous connection has finished:
1015          * this is voluntary, since the tool uses stdin/stdout for
1016          * application data, and thus cannot really run two connections
1017          * simultaneously.
1018          */
1019         for (;;) {
1020                 int x;
1021
1022                 fd = accept_client(server_fd, verbose);
1023                 if (fd < 0) {
1024                         goto server_exit_error;
1025                 }
1026                 br_ssl_server_reset(&cc);
1027                 x = run_ssl_engine(&cc.eng, fd,
1028                         (verbose ? RUN_ENGINE_VERBOSE : 0)
1029                         | (trace ? RUN_ENGINE_TRACE : 0));
1030                 close(fd);
1031                 fd = -1;
1032                 if (x < -1) {
1033                         goto server_exit_error;
1034                 }
1035         }
1036
1037         /*
1038          * Release allocated structures.
1039          */
1040 server_exit:
1041         xfree(suites);
1042         xfree(suite_ids);
1043         if (chain != NULL) {
1044                 for (u = 0; u < chain_len; u ++) {
1045                         xfree(chain[u].data);
1046                 }
1047                 xfree(chain);
1048         }
1049         free_private_key(sk);
1050         xfree(iobuf);
1051         xfree(cache);
1052         if (fd >= 0) {
1053                 close(fd);
1054         }
1055         return retcode;
1056
1057 server_exit_error:
1058         retcode = -1;
1059         goto server_exit;
1060 }