From: FdaSilvaYY Date: Thu, 6 Apr 2017 21:47:18 +0000 (+0200) Subject: Add a 'max_send_frag' option to configure maximum size of send fragments X-Git-Tag: OpenSSL_1_1_1-pre1~1637 X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=28e5ea88a8fe93aa6dd023a5abd54f01c1ad6450;p=oweals%2Fopenssl.git Add a 'max_send_frag' option to configure maximum size of send fragments Reviewed-by: Andy Polyakov Reviewed-by: Rich Salz Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/3141) --- diff --git a/apps/s_client.c b/apps/s_client.c index d018268fbf..d7a3a80e2b 100644 --- a/apps/s_client.c +++ b/apps/s_client.c @@ -540,13 +540,12 @@ typedef enum OPTION_choice { OPT_SSL3, OPT_SSL_CONFIG, OPT_TLS1_3, OPT_TLS1_2, OPT_TLS1_1, OPT_TLS1, OPT_DTLS, OPT_DTLS1, OPT_DTLS1_2, OPT_SCTP, OPT_TIMEOUT, OPT_MTU, OPT_KEYFORM, OPT_PASS, - OPT_CERT_CHAIN, OPT_CAPATH, OPT_NOCAPATH, OPT_CHAINCAPATH, - OPT_VERIFYCAPATH, + OPT_CERT_CHAIN, OPT_CAPATH, OPT_NOCAPATH, OPT_CHAINCAPATH, OPT_VERIFYCAPATH, OPT_KEY, OPT_RECONNECT, OPT_BUILD_CHAIN, OPT_CAFILE, OPT_NOCAFILE, OPT_CHAINCAFILE, OPT_VERIFYCAFILE, OPT_NEXTPROTONEG, OPT_ALPN, - OPT_SERVERINFO, OPT_STARTTLS, OPT_SERVERNAME, OPT_NOSERVERNAME, + OPT_SERVERINFO, OPT_STARTTLS, OPT_SERVERNAME, OPT_NOSERVERNAME, OPT_ASYNC, OPT_USE_SRTP, OPT_KEYMATEXPORT, OPT_KEYMATEXPORTLEN, OPT_SMTPHOST, - OPT_ASYNC, OPT_SPLIT_SEND_FRAG, OPT_MAX_PIPELINES, OPT_READ_BUF, + OPT_MAX_SEND_FRAG, OPT_SPLIT_SEND_FRAG, OPT_MAX_PIPELINES, OPT_READ_BUF, OPT_KEYLOG_FILE, OPT_EARLY_DATA, OPT_REQCAFILE, OPT_V_ENUM, OPT_X_ENUM, @@ -665,6 +664,7 @@ const OPTIONS s_client_options[] = { "Enable ALPN extension, considering named protocols supported (comma-separated list)"}, {"async", OPT_ASYNC, '-', "Support asynchronous operation"}, {"ssl_config", OPT_SSL_CONFIG, 's', "Use specified configuration file"}, + {"max_send_frag", OPT_MAX_SEND_FRAG, 'p', "Maximum Size of send frames "}, {"split_send_frag", OPT_SPLIT_SEND_FRAG, 'n', "Size used to split data for encrypt pipelines"}, {"max_pipelines", OPT_MAX_PIPELINES, 'n', @@ -895,8 +895,8 @@ int s_client_main(int argc, char **argv) #endif int min_version = 0, max_version = 0, prot_opt = 0, no_prot_opt = 0; int async = 0; - unsigned int split_send_fragment = 0; - unsigned int max_pipelines = 0; + unsigned int max_send_fragment = 0; + unsigned int split_send_fragment = 0, max_pipelines = 0; enum { use_inet, use_unix, use_unknown } connect_type = use_unknown; int count4or6 = 0; int c_nbio = 0, c_msg = 0, c_ign_eof = 0, c_brief = 0; @@ -1379,6 +1379,16 @@ int s_client_main(int argc, char **argv) case OPT_ASYNC: async = 1; break; + case OPT_MAX_SEND_FRAG: + max_send_fragment = atoi(opt_arg()); + if (max_send_fragment == 0) { + /* + * Not allowed - set to a deliberately bad value so we get an + * error message below + */ + max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH + 1; + } + break; case OPT_SPLIT_SEND_FRAG: split_send_fragment = atoi(opt_arg()); if (split_send_fragment == 0) { @@ -1476,6 +1486,10 @@ int s_client_main(int argc, char **argv) socket_type = SOCK_STREAM; } #endif + if (max_send_fragment > SSL3_RT_MAX_PLAIN_LENGTH) { + BIO_printf(bio_err, "Bad max send fragment size\n"); + goto end; + } if (split_send_fragment > SSL3_RT_MAX_PLAIN_LENGTH) { BIO_printf(bio_err, "Bad split send fragment size\n"); @@ -1608,6 +1622,10 @@ int s_client_main(int argc, char **argv) if (async) { SSL_CTX_set_mode(ctx, SSL_MODE_ASYNC); } + + if (max_send_fragment > 0) + SSL_CTX_set_max_send_fragment(ctx, max_send_fragment); + if (split_send_fragment > 0) { SSL_CTX_set_split_send_fragment(ctx, split_send_fragment); } diff --git a/apps/s_server.c b/apps/s_server.c index 46316630be..5faeb21a8b 100644 --- a/apps/s_server.c +++ b/apps/s_server.c @@ -717,7 +717,8 @@ typedef enum OPTION_choice { OPT_CRLF, OPT_QUIET, OPT_BRIEF, OPT_NO_DHE, OPT_NO_RESUME_EPHEMERAL, OPT_PSK_HINT, OPT_PSK, OPT_SRPVFILE, OPT_SRPUSERSEED, OPT_REV, OPT_WWW, OPT_UPPER_WWW, OPT_HTTP, OPT_ASYNC, - OPT_SSL_CONFIG, OPT_SPLIT_SEND_FRAG, OPT_MAX_PIPELINES, OPT_READ_BUF, + OPT_SSL_CONFIG, + OPT_MAX_SEND_FRAG, OPT_SPLIT_SEND_FRAG, OPT_MAX_PIPELINES, OPT_READ_BUF, OPT_SSL3, OPT_TLS1_3, OPT_TLS1_2, OPT_TLS1_1, OPT_TLS1, OPT_DTLS, OPT_DTLS1, OPT_DTLS1_2, OPT_SCTP, OPT_TIMEOUT, OPT_MTU, OPT_LISTEN, OPT_ID_PREFIX, OPT_RAND, OPT_SERVERNAME, OPT_SERVERNAME_FATAL, @@ -856,6 +857,7 @@ const OPTIONS s_server_options[] = { {"async", OPT_ASYNC, '-', "Operate in asynchronous mode"}, {"ssl_config", OPT_SSL_CONFIG, 's', "Configure SSL_CTX using the configuration 'val'"}, + {"max_send_frag", OPT_MAX_SEND_FRAG, 'p', "Maximum Size of send frames "}, {"split_send_frag", OPT_SPLIT_SEND_FRAG, 'n', "Size used to split data for encrypt pipelines"}, {"max_pipelines", OPT_MAX_PIPELINES, 'n', @@ -999,6 +1001,7 @@ int s_server_main(int argc, char *argv[]) int s_tlsextstatus = 0; #endif int no_resume_ephemeral = 0; + unsigned int max_send_fragment = 0; unsigned int split_send_fragment = 0, max_pipelines = 0; const char *s_serverinfo_file = NULL; const char *keylog_file = NULL; @@ -1497,6 +1500,16 @@ int s_server_main(int argc, char *argv[]) case OPT_ASYNC: async = 1; break; + case OPT_MAX_SEND_FRAG: + max_send_fragment = atoi(opt_arg()); + if (max_send_fragment == 0) { + /* + * Not allowed - set to a deliberately bad value so we get an + * error message below + */ + max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH + 1; + } + break; case OPT_SPLIT_SEND_FRAG: split_send_fragment = atoi(opt_arg()); if (split_send_fragment == 0) { @@ -1561,6 +1574,10 @@ int s_server_main(int argc, char *argv[]) socket_type = SOCK_STREAM; } #endif + if (max_send_fragment > SSL3_RT_MAX_PLAIN_LENGTH) { + BIO_printf(bio_err, "Bad max send fragment size\n"); + goto end; + } if (split_send_fragment > SSL3_RT_MAX_PLAIN_LENGTH) { BIO_printf(bio_err, "Bad split send fragment size\n"); @@ -1760,6 +1777,10 @@ int s_server_main(int argc, char *argv[]) if (async) { SSL_CTX_set_mode(ctx, SSL_MODE_ASYNC); } + + if (max_send_fragment > 0) + SSL_CTX_set_max_send_fragment(ctx, max_send_fragment); + if (split_send_fragment > 0) { SSL_CTX_set_split_send_fragment(ctx, split_send_fragment); } diff --git a/doc/man1/s_client.pod b/doc/man1/s_client.pod index 16538567bc..96df8a4101 100644 --- a/doc/man1/s_client.pod +++ b/doc/man1/s_client.pod @@ -86,6 +86,7 @@ B B [B<-sctp>] [B<-fallback_scsv>] [B<-async>] +[B<-max_send_frag>] [B<-split_send_frag>] [B<-max_pipelines>] [B<-read_buf>] @@ -416,6 +417,11 @@ asynchronously. This will only have an effect if an asynchronous capable engine is also used via the B<-engine> option. For test purposes the dummy async engine (dasync) can be used (if available). +=item B<-max_send_frag int> + +The maximum size of data fragment to send. +See L for further information. + =item B<-split_send_frag int> The size used to split data for encrypt pipelines. If more data is written in @@ -643,8 +649,9 @@ information whenever a session is renegotiated. =head1 SEE ALSO -L, -L, L, L +L, L, L, L, +L, L +L =head1 HISTORY diff --git a/doc/man1/s_server.pod b/doc/man1/s_server.pod index d2fbb84973..c3e763f4e0 100644 --- a/doc/man1/s_server.pod +++ b/doc/man1/s_server.pod @@ -86,6 +86,7 @@ B B [B<-sctp>] [B<-listen>] [B<-async>] +[B<-max_send_frag>] [B<-split_send_frag>] [B<-max_pipelines>] [B<-read_buf>] @@ -376,6 +377,11 @@ asynchronously. This will only have an effect if an asynchronous capable engine is also used via the B<-engine> option. For test purposes the dummy async engine (dasync) can be used (if available). +=item B<-max_send_frag int> + +The maximum size of data fragment to send. +See L for further information. + =item B<-split_send_frag int> The size used to split data for encrypt pipelines. If more data is written in @@ -638,8 +644,9 @@ unknown cipher suites a client says it supports. =head1 SEE ALSO -L, -L, L, L +L, L, L, L +L, L +L =head1 HISTORY