Skip to content

Commit e88a5cf

Browse files
mattcaswellmattcaswell
committed
Disallow multiple protocol flags to s_server and s_client
We shouldn't allow both "-tls1" and "-tls1_2", or "-tls1" and "-no_tls1_2". The only time multiple flags are allowed is where they are all "-no_<prot>". This fixes Github Issue #1268 Reviewed-by: Rich Salz <[email protected]>
1 parent 23aec60 commit e88a5cf

4 files changed

Lines changed: 62 additions & 9 deletions

File tree

‎apps/s_apps.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -199,7 +199,8 @@ int load_excert(SSL_EXCERT **pexc, BIO *err);
199199
void print_ssl_summary(BIO *bio, SSL *s);
200200
#ifdef HEADER_SSL_H
201201
int args_ssl(char ***pargs, int *pargc, SSL_CONF_CTX *cctx,
202-
int *badarg, BIO *err, STACK_OF(OPENSSL_STRING) **pstr);
202+
int *badarg, BIO *err, STACK_OF(OPENSSL_STRING) **pstr,
203+
int *no_prot_opt);
203204
int args_ssl_call(SSL_CTX *ctx, BIO *err, SSL_CONF_CTX *cctx,
204205
STACK_OF(OPENSSL_STRING) *str, int no_ecdhe, int no_jpake);
205206
int ssl_ctx_add_crls(SSL_CTX *ctx, STACK_OF(X509_CRL) *crls,

‎apps/s_cb.c‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1507,11 +1507,18 @@ void print_ssl_summary(BIO *bio, SSL *s)
15071507
}
15081508

15091509
int args_ssl(char ***pargs, int *pargc, SSL_CONF_CTX *cctx,
1510-
int *badarg, BIO *err, STACK_OF(OPENSSL_STRING) **pstr)
1510+
int *badarg, BIO *err, STACK_OF(OPENSSL_STRING) **pstr,
1511+
int *no_prot_opt)
15111512
{
15121513
char *arg = **pargs, *argn = (*pargs)[1];
15131514
int rv;
15141515

1516+
if (strcmp(arg, "-no_ssl2") == 0 || strcmp(arg, "-no_ssl3") == 0
1517+
|| strcmp(arg, "-no_tls1") == 0 || strcmp(arg, "-no_tls1_1") == 0
1518+
|| strcmp(arg, "-no_tls1_2") == 0) {
1519+
*no_prot_opt = 1;
1520+
}
1521+
15151522
/* Attempt to run SSL configuration command */
15161523
rv = SSL_CONF_cmd_argv(cctx, pargc, pargs);
15171524
/* If parameter not recognised just return */

‎apps/s_client.c‎

Lines changed: 30 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -744,6 +744,7 @@ int MAIN(int argc, char **argv)
744744
int crl_format = FORMAT_PEM;
745745
int crl_download = 0;
746746
STACK_OF(X509_CRL) *crls = NULL;
747+
int prot_opt = 0, no_prot_opt = 0;
747748

748749
meth = SSLv23_client_method();
749750

@@ -847,7 +848,8 @@ int MAIN(int argc, char **argv)
847848
if (badarg)
848849
goto bad;
849850
continue;
850-
} else if (args_ssl(&argv, &argc, cctx, &badarg, bio_err, &ssl_args)) {
851+
} else if (args_ssl(&argv, &argc, cctx, &badarg, bio_err, &ssl_args,
852+
&no_prot_opt)) {
851853
if (badarg)
852854
goto bad;
853855
continue;
@@ -939,31 +941,42 @@ int MAIN(int argc, char **argv)
939941
}
940942
#endif
941943
#ifndef OPENSSL_NO_SSL2
942-
else if (strcmp(*argv, "-ssl2") == 0)
944+
else if (strcmp(*argv, "-ssl2") == 0) {
943945
meth = SSLv2_client_method();
946+
prot_opt++;
947+
}
944948
#endif
945949
#ifndef OPENSSL_NO_SSL3_METHOD
946-
else if (strcmp(*argv, "-ssl3") == 0)
950+
else if (strcmp(*argv, "-ssl3") == 0) {
947951
meth = SSLv3_client_method();
952+
prot_opt++;
953+
}
948954
#endif
949955
#ifndef OPENSSL_NO_TLS1
950-
else if (strcmp(*argv, "-tls1_2") == 0)
956+
else if (strcmp(*argv, "-tls1_2") == 0) {
951957
meth = TLSv1_2_client_method();
952-
else if (strcmp(*argv, "-tls1_1") == 0)
958+
prot_opt++;
959+
} else if (strcmp(*argv, "-tls1_1") == 0) {
953960
meth = TLSv1_1_client_method();
954-
else if (strcmp(*argv, "-tls1") == 0)
961+
prot_opt++;
962+
} else if (strcmp(*argv, "-tls1") == 0) {
955963
meth = TLSv1_client_method();
964+
prot_opt++;
965+
}
956966
#endif
957967
#ifndef OPENSSL_NO_DTLS1
958968
else if (strcmp(*argv, "-dtls") == 0) {
959969
meth = DTLS_client_method();
960970
socket_type = SOCK_DGRAM;
971+
prot_opt++;
961972
} else if (strcmp(*argv, "-dtls1") == 0) {
962973
meth = DTLSv1_client_method();
963974
socket_type = SOCK_DGRAM;
975+
prot_opt++;
964976
} else if (strcmp(*argv, "-dtls1_2") == 0) {
965977
meth = DTLSv1_2_client_method();
966978
socket_type = SOCK_DGRAM;
979+
prot_opt++;
967980
} else if (strcmp(*argv, "-timeout") == 0)
968981
enable_timeouts = 1;
969982
else if (strcmp(*argv, "-mtu") == 0) {
@@ -1146,6 +1159,17 @@ int MAIN(int argc, char **argv)
11461159
}
11471160
#endif
11481161
1162+
if (prot_opt > 1) {
1163+
BIO_printf(bio_err, "Cannot supply multiple protocol flags\n");
1164+
goto end;
1165+
}
1166+
1167+
if (prot_opt == 1 && no_prot_opt) {
1168+
BIO_printf(bio_err, "Cannot supply both a protocol flag and "
1169+
"\"-no_<prot>\"\n");
1170+
goto end;
1171+
}
1172+
11491173
OpenSSL_add_ssl_algorithms();
11501174
SSL_load_error_strings();
11511175

‎apps/s_server.c‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1137,6 +1137,7 @@ int MAIN(int argc, char *argv[])
11371137
int crl_format = FORMAT_PEM;
11381138
int crl_download = 0;
11391139
STACK_OF(X509_CRL) *crls = NULL;
1140+
int prot_opt = 0, no_prot_opt = 0;
11401141

11411142
meth = SSLv23_server_method();
11421143

@@ -1300,7 +1301,8 @@ int MAIN(int argc, char *argv[])
13001301
if (badarg)
13011302
goto bad;
13021303
continue;
1303-
} else if (args_ssl(&argv, &argc, cctx, &badarg, bio_err, &ssl_args)) {
1304+
} else if (args_ssl(&argv, &argc, cctx, &badarg, bio_err, &ssl_args,
1305+
&no_prot_opt)) {
13041306
if (badarg)
13051307
goto bad;
13061308
continue;
@@ -1444,32 +1446,40 @@ int MAIN(int argc, char *argv[])
14441446
else if (strcmp(*argv, "-ssl2") == 0) {
14451447
no_ecdhe = 1;
14461448
meth = SSLv2_server_method();
1449+
prot_opt++;
14471450
}
14481451
#endif
14491452
#ifndef OPENSSL_NO_SSL3_METHOD
14501453
else if (strcmp(*argv, "-ssl3") == 0) {
14511454
meth = SSLv3_server_method();
1455+
prot_opt++;
14521456
}
14531457
#endif
14541458
#ifndef OPENSSL_NO_TLS1
14551459
else if (strcmp(*argv, "-tls1") == 0) {
14561460
meth = TLSv1_server_method();
1461+
prot_opt++;
14571462
} else if (strcmp(*argv, "-tls1_1") == 0) {
14581463
meth = TLSv1_1_server_method();
1464+
prot_opt++;
14591465
} else if (strcmp(*argv, "-tls1_2") == 0) {
14601466
meth = TLSv1_2_server_method();
1467+
prot_opt++;
14611468
}
14621469
#endif
14631470
#ifndef OPENSSL_NO_DTLS1
14641471
else if (strcmp(*argv, "-dtls") == 0) {
14651472
meth = DTLS_server_method();
14661473
socket_type = SOCK_DGRAM;
1474+
prot_opt++;
14671475
} else if (strcmp(*argv, "-dtls1") == 0) {
14681476
meth = DTLSv1_server_method();
14691477
socket_type = SOCK_DGRAM;
1478+
prot_opt++;
14701479
} else if (strcmp(*argv, "-dtls1_2") == 0) {
14711480
meth = DTLSv1_2_server_method();
14721481
socket_type = SOCK_DGRAM;
1482+
prot_opt++;
14731483
} else if (strcmp(*argv, "-timeout") == 0)
14741484
enable_timeouts = 1;
14751485
else if (strcmp(*argv, "-mtu") == 0) {
@@ -1579,6 +1589,17 @@ int MAIN(int argc, char *argv[])
15791589
}
15801590
#endif
15811591

1592+
if (prot_opt > 1) {
1593+
BIO_printf(bio_err, "Cannot supply multiple protocol flags\n");
1594+
goto end;
1595+
}
1596+
1597+
if (prot_opt == 1 && no_prot_opt) {
1598+
BIO_printf(bio_err, "Cannot supply both a protocol flag and "
1599+
"\"-no_<prot>\"\n");
1600+
goto end;
1601+
}
1602+
15821603
SSL_load_error_strings();
15831604
OpenSSL_add_ssl_algorithms();
15841605

0 commit comments

Comments
 (0)