mischief/openbsd-src
1
0
Fork 0
mirror of https://github.com/openbsd/src.git synced 2025-01-10 06:47:55 -08:00
Code

A ressl server needs different configuration from a ressl client - provide

Browse Source 
a specific server configuration function and call this from
ressl_configure.
This commit is contained in:
jsing 2014-08-04 16:18:42 +00:00
parent cef70b1445
commit 324b29ae70
3 changed files with 41 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
lib/libressl/ressl.c
View File

@ -87,6 +87,9 @@ ressl_configure(struct ressl *ctx, struct ressl_config *config)
ctx->config = config;
if ((ctx->flags & RESSL_SERVER) != 0)
return (ressl_configure_server(ctx));
return (0);
}

1
lib/libressl/ressl_internal.h
View File

@ -56,6 +56,7 @@ struct ressl *ressl_server_conn(struct ressl *ctx);
int ressl_check_hostname(X509 *cert, const char *host);
int ressl_configure_keypair(struct ressl *ctx);
int ressl_configure_server(struct ressl *ctx);
int ressl_host_port(const char *hostport, char **host, char **port);
int ressl_set_error(struct ressl *ctx, char *fmt, ...);

37
lib/libressl/ressl_server.c
View File

@ -14,6 +14,9 @@
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
#include <openssl/ec.h>
#include <openssl/ssl.h>
#include "ressl_internal.h"
struct ressl *
@ -42,6 +45,40 @@ ressl_server_conn(struct ressl *ctx)
return (conn_ctx);
}
int
ressl_configure_server(struct ressl *ctx)
{
EC_KEY *ecdh_key;
/* XXX - add a configuration option to control versions. */
if ((ctx->ssl_ctx = SSL_CTX_new(SSLv23_server_method())) == NULL) {
ressl_set_error(ctx, "ssl context failure");
goto err;
}
if (ressl_configure_keypair(ctx) != 0)
goto err;
if (ctx->config->ciphers != NULL) {
if (SSL_CTX_set_cipher_list(ctx->ssl_ctx,
ctx->config->ciphers) != 1) {
ressl_set_error(ctx, "failed to set ciphers");
goto err;
}
}
if ((ecdh_key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1)) == NULL)
goto err;
SSL_CTX_set_tmp_ecdh(ctx->ssl_ctx, ecdh_key);
SSL_CTX_set_options(ctx->ssl_ctx, SSL_OP_SINGLE_ECDH_USE);
EC_KEY_free(ecdh_key);
return (0);
err:
return (-1);
}
int
ressl_listen(struct ressl *ctx, const char *host, const char *port, int af)
{