ssl/ssltest.c

   1 /* ssl/ssltest.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111 /* ====================================================================
 112  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
 113  * ECC cipher suite support in OpenSSL originally developed by
 114  * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
 115  */
 116 /* ====================================================================
 117  * Copyright 2005 Nokia. All rights reserved.
 118  *
 119  * The portions of the attached software ("Contribution") is developed by
 120  * Nokia Corporation and is licensed pursuant to the OpenSSL open source
 121  * license.
 122  *
 123  * The Contribution, originally written by Mika Kousa and Pasi Eronen of
 124  * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
 125  * support (see RFC 4279) to OpenSSL.
 126  *
 127  * No patent licenses or other rights except those expressly stated in
 128  * the OpenSSL open source license shall be deemed granted or received
 129  * expressly, by implication, estoppel, or otherwise.
 130  *
 131  * No assurances are provided by Nokia that the Contribution does not
 132  * infringe the patent or other intellectual property rights of any third
 133  * party or that the license provides you with all the necessary rights
 134  * to make use of the Contribution.
 135  *
 136  * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
 137  * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
 138  * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
 139  * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
 140  * OTHERWISE.
 141  */
 142
 143 #define _BSD_SOURCE 1           /* Or gethostname won't be declared properly
 144                                    on Linux and GNU platforms. */
 145
 146 #include <assert.h>
 147 #include <errno.h>
 148 #include <limits.h>
 149 #include <stdio.h>
 150 #include <stdlib.h>
 151 #include <string.h>
 152 #include <time.h>
 153
 154 #define USE_SOCKETS
 155 #include "e_os.h"
 156
 157 #ifdef OPENSSL_SYS_VMS
 158 #define _XOPEN_SOURCE 500       /* Or isascii won't be declared properly on
 159                                    VMS (at least with DECompHP C).  */
 160 #endif
 161
 162 #include <ctype.h>
 163
 164 #include <openssl/bio.h>
 165 #include <openssl/crypto.h>
 166 #include <openssl/evp.h>
 167 #include <openssl/x509.h>
 168 #include <openssl/x509v3.h>
 169 #include <openssl/ssl.h>
 170 #ifndef OPENSSL_NO_ENGINE
 171 #include <openssl/engine.h>
 172 #endif
 173 #include <openssl/err.h>
 174 #include <openssl/rand.h>
 175 #ifndef OPENSSL_NO_RSA
 176 #include <openssl/rsa.h>
 177 #endif
 178 #ifndef OPENSSL_NO_DSA
 179 #include <openssl/dsa.h>
 180 #endif
 181 #ifndef OPENSSL_NO_DH
 182 #include <openssl/dh.h>
 183 #endif
 184 #include <openssl/bn.h>
 185
 186 #define _XOPEN_SOURCE_EXTENDED  1 /* Or gethostname won't be declared properly
 187                                      on Compaq platforms (at least with DEC C).
 188                                      Do not try to put it earlier, or IPv6 includes
 189                                      get screwed...
 190                                   */
 191
 192 #ifdef OPENSSL_SYS_WINDOWS
 193 #include <winsock.h>
 194 #else
 195 #include OPENSSL_UNISTD
 196 #endif
 197
 198 #ifdef OPENSSL_SYS_VMS
 199 #  define TEST_SERVER_CERT "SYS$DISK:[-.APPS]SERVER.PEM"
 200 #  define TEST_CLIENT_CERT "SYS$DISK:[-.APPS]CLIENT.PEM"
 201 #elif defined(OPENSSL_SYS_WINCE)
 202 #  define TEST_SERVER_CERT "\\OpenSSL\\server.pem"
 203 #  define TEST_CLIENT_CERT "\\OpenSSL\\client.pem"
 204 #elif defined(OPENSSL_SYS_NETWARE)
 205 #  define TEST_SERVER_CERT "\\openssl\\apps\\server.pem"
 206 #  define TEST_CLIENT_CERT "\\openssl\\apps\\client.pem"
 207 #else
 208 #  define TEST_SERVER_CERT "../apps/server.pem"
 209 #  define TEST_CLIENT_CERT "../apps/client.pem"
 210 #endif
 211
 212 /* There is really no standard for this, so let's assign some tentative
 213    numbers.  In any case, these numbers are only for this test */
 214 #define COMP_RLE        255
 215 #define COMP_ZLIB       1
 216
 217 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
 218 #ifndef OPENSSL_NO_RSA
 219 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export,int keylength);
 220 static void free_tmp_rsa(void);
 221 #endif
 222 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg);
 223 #define APP_CALLBACK_STRING "Test Callback Argument"
 224 struct app_verify_arg
 225         {
 226         char *string;
 227         int app_verify;
 228         int allow_proxy_certs;
 229         char *proxy_auth;
 230         char *proxy_cond;
 231         };
 232
 233 #ifndef OPENSSL_NO_DH
 234 static DH *get_dh512(void);
 235 static DH *get_dh1024(void);
 236 static DH *get_dh1024dsa(void);
 237 #endif
 238
 239
 240 static char *psk_key=NULL; /* by default PSK is not used */
 241 #ifndef OPENSSL_NO_PSK
 242 static unsigned int psk_client_callback(SSL *ssl, const char *hint, char *identity,
 243         unsigned int max_identity_len, unsigned char *psk,
 244         unsigned int max_psk_len);
 245 static unsigned int psk_server_callback(SSL *ssl, const char *identity, unsigned char *psk,
 246         unsigned int max_psk_len);
 247 #endif
 248
 249 static BIO *bio_err=NULL;
 250 static BIO *bio_stdout=NULL;
 251
 252 static char *cipher=NULL;
 253 static int verbose=0;
 254 static int debug=0;
 255 #if 0
 256 /* Not used yet. */
 257 #ifdef FIONBIO
 258 static int s_nbio=0;
 259 #endif
 260 #endif
 261
 262 static const char rnd_seed[] = "string to make the random number generator think it has entropy";
 263
 264 int doit_biopair(SSL *s_ssl,SSL *c_ssl,long bytes,clock_t *s_time,clock_t *c_time);
 265 int doit(SSL *s_ssl,SSL *c_ssl,long bytes);
 266 static int do_test_cipherlist(void);
 267 static void sv_usage(void)
 268         {
 269         fprintf(stderr,"usage: ssltest [args ...]\n");
 270         fprintf(stderr,"\n");
 271         fprintf(stderr," -server_auth  - check server certificate\n");
 272         fprintf(stderr," -client_auth  - do client authentication\n");
 273         fprintf(stderr," -proxy        - allow proxy certificates\n");
 274         fprintf(stderr," -proxy_auth <val> - set proxy policy rights\n");
 275         fprintf(stderr," -proxy_cond <val> - experssion to test proxy policy rights\n");
 276         fprintf(stderr," -v            - more output\n");
 277         fprintf(stderr," -d            - debug output\n");
 278         fprintf(stderr," -reuse        - use session-id reuse\n");
 279         fprintf(stderr," -num <val>    - number of connections to perform\n");
 280         fprintf(stderr," -bytes <val>  - number of bytes to swap between client/server\n");
 281 #ifndef OPENSSL_NO_DH
 282         fprintf(stderr," -dhe1024      - use 1024 bit key (safe prime) for DHE\n");
 283         fprintf(stderr," -dhe1024dsa   - use 1024 bit key (with 160-bit subprime) for DHE\n");
 284         fprintf(stderr," -no_dhe       - disable DHE\n");
 285 #endif
 286 #ifndef OPENSSL_NO_ECDH
 287         fprintf(stderr," -no_ecdhe     - disable ECDHE\n");
 288 #endif
 289 #ifndef OPENSSL_NO_PSK
 290         fprintf(stderr," -psk arg      - PSK in hex (without 0x)\n");
 291 #endif
 292 #ifndef OPENSSL_NO_SSL2
 293         fprintf(stderr," -ssl2         - use SSLv2\n");
 294 #endif
 295 #ifndef OPENSSL_NO_SSL3
 296         fprintf(stderr," -ssl3         - use SSLv3\n");
 297 #endif
 298 #ifndef OPENSSL_NO_TLS1
 299         fprintf(stderr," -tls1         - use TLSv1\n");
 300 #endif
 301         fprintf(stderr," -CApath arg   - PEM format directory of CA's\n");
 302         fprintf(stderr," -CAfile arg   - PEM format file of CA's\n");
 303         fprintf(stderr," -cert arg     - Server certificate file\n");
 304         fprintf(stderr," -key arg      - Server key file (default: same as -cert)\n");
 305         fprintf(stderr," -c_cert arg   - Client certificate file\n");
 306         fprintf(stderr," -c_key arg    - Client key file (default: same as -c_cert)\n");
 307         fprintf(stderr," -cipher arg   - The cipher list\n");
 308         fprintf(stderr," -bio_pair     - Use BIO pairs\n");
 309         fprintf(stderr," -f            - Test even cases that can't work\n");
 310         fprintf(stderr," -time         - measure processor time used by client and server\n");
 311         fprintf(stderr," -zlib         - use zlib compression\n");
 312         fprintf(stderr," -rle          - use rle compression\n");
 313 #ifndef OPENSSL_NO_ECDH
 314         fprintf(stderr," -named_curve arg  - Elliptic curve name to use for ephemeral ECDH keys.\n" \
 315                        "                 Use \"openssl ecparam -list_curves\" for all names\n"  \
 316                        "                 (default is sect163r2).\n");
 317 #endif
 318         fprintf(stderr," -test_cipherlist - verifies the order of the ssl cipher lists\n");
 319         }
 320
 321 static void print_details(SSL *c_ssl, const char *prefix)
 322         {
 323         const SSL_CIPHER *ciph;
 324         X509 *cert;
 325
 326         ciph=SSL_get_current_cipher(c_ssl);
 327         BIO_printf(bio_stdout,"%s%s, cipher %s %s",
 328                 prefix,
 329                 SSL_get_version(c_ssl),
 330                 SSL_CIPHER_get_version(ciph),
 331                 SSL_CIPHER_get_name(ciph));
 332         cert=SSL_get_peer_certificate(c_ssl);
 333         if (cert != NULL)
 334                 {
 335                 EVP_PKEY *pkey = X509_get_pubkey(cert);
 336                 if (pkey != NULL)
 337                         {
 338                         if (0)
 339                                 ;
 340 #ifndef OPENSSL_NO_RSA
 341                         else if (pkey->type == EVP_PKEY_RSA && pkey->pkey.rsa != NULL
 342                                 && pkey->pkey.rsa->n != NULL)
 343                                 {
 344                                 BIO_printf(bio_stdout, ", %d bit RSA",
 345                                         BN_num_bits(pkey->pkey.rsa->n));
 346                                 }
 347 #endif
 348 #ifndef OPENSSL_NO_DSA
 349                         else if (pkey->type == EVP_PKEY_DSA && pkey->pkey.dsa != NULL
 350                                 && pkey->pkey.dsa->p != NULL)
 351                                 {
 352                                 BIO_printf(bio_stdout, ", %d bit DSA",
 353                                         BN_num_bits(pkey->pkey.dsa->p));
 354                                 }
 355 #endif
 356                         EVP_PKEY_free(pkey);
 357                         }
 358                 X509_free(cert);
 359                 }
 360         /* The SSL API does not allow us to look at temporary RSA/DH keys,
 361          * otherwise we should print their lengths too */
 362         BIO_printf(bio_stdout,"\n");
 363         }
 364
 365 static void lock_dbg_cb(int mode, int type, const char *file, int line)
 366         {
 367         static int modes[CRYPTO_NUM_LOCKS]; /* = {0, 0, ... } */
 368         const char *errstr = NULL;
 369         int rw;
 370
 371         rw = mode & (CRYPTO_READ|CRYPTO_WRITE);
 372         if (!((rw == CRYPTO_READ) || (rw == CRYPTO_WRITE)))
 373                 {
 374                 errstr = "invalid mode";
 375                 goto err;
 376                 }
 377
 378         if (type < 0 || type >= CRYPTO_NUM_LOCKS)
 379                 {
 380                 errstr = "type out of bounds";
 381                 goto err;
 382                 }
 383
 384         if (mode & CRYPTO_LOCK)
 385                 {
 386                 if (modes[type])
 387                         {
 388                         errstr = "already locked";
 389                         /* must not happen in a single-threaded program
 390                          * (would deadlock) */
 391                         goto err;
 392                         }
 393
 394                 modes[type] = rw;
 395                 }
 396         else if (mode & CRYPTO_UNLOCK)
 397                 {
 398                 if (!modes[type])
 399                         {
 400                         errstr = "not locked";
 401                         goto err;
 402                         }
 403
 404                 if (modes[type] != rw)
 405                         {
 406                         errstr = (rw == CRYPTO_READ) ?
 407                                 "CRYPTO_r_unlock on write lock" :
 408                                 "CRYPTO_w_unlock on read lock";
 409                         }
 410
 411                 modes[type] = 0;
 412                 }
 413         else
 414                 {
 415                 errstr = "invalid mode";
 416                 goto err;
 417                 }
 418
 419  err:
 420         if (errstr)
 421                 {
 422                 /* we cannot use bio_err here */
 423                 fprintf(stderr, "openssl (lock_dbg_cb): %s (mode=%d, type=%d) at %s:%d\n",
 424                         errstr, mode, type, file, line);
 425                 }
 426         }
 427
 428 #ifdef TLSEXT_TYPE_opaque_prf_input
 429 struct cb_info_st { void *input; size_t len; int ret; };
 430 struct cb_info_st co1 = { "C", 1, 1 }; /* try to negotiate oqaque PRF input */
 431 struct cb_info_st co2 = { "C", 1, 2 }; /* insist on oqaque PRF input */
 432 struct cb_info_st so1 = { "S", 1, 1 }; /* try to negotiate oqaque PRF input */
 433 struct cb_info_st so2 = { "S", 1, 2 }; /* insist on oqaque PRF input */
 434
 435 int opaque_prf_input_cb(SSL *ssl, void *peerinput, size_t len, void *arg_)
 436         {
 437         struct cb_info_st *arg = arg_;
 438
 439         if (arg == NULL)
 440                 return 1;
 441
 442         if (!SSL_set_tlsext_opaque_prf_input(ssl, arg->input, arg->len))
 443                 return 0;
 444         return arg->ret;
 445         }
 446 #endif
 447
 448 int main(int argc, char *argv[])
 449         {
 450         char *CApath=NULL,*CAfile=NULL;
 451         int badop=0;
 452         int bio_pair=0;
 453         int force=0;
 454         int tls1=0,ssl2=0,ssl3=0,ret=1;
 455         int client_auth=0;
 456         int server_auth=0,i;
 457         struct app_verify_arg app_verify_arg =
 458                 { APP_CALLBACK_STRING, 0, 0, NULL, NULL };
 459         char *server_cert=TEST_SERVER_CERT;
 460         char *server_key=NULL;
 461         char *client_cert=TEST_CLIENT_CERT;
 462         char *client_key=NULL;
 463 #ifndef OPENSSL_NO_ECDH
 464         char *named_curve = NULL;
 465 #endif
 466         SSL_CTX *s_ctx=NULL;
 467         SSL_CTX *c_ctx=NULL;
 468         const SSL_METHOD *meth=NULL;
 469         SSL *c_ssl,*s_ssl;
 470         int number=1,reuse=0;
 471         long bytes=256L;
 472 #ifndef OPENSSL_NO_DH
 473         DH *dh;
 474         int dhe1024 = 0, dhe1024dsa = 0;
 475 #endif
 476 #ifndef OPENSSL_NO_ECDH
 477         EC_KEY *ecdh = NULL;
 478 #endif
 479         int no_dhe = 0;
 480         int no_ecdhe = 0;
 481         int no_psk = 0;
 482         int print_time = 0;
 483         clock_t s_time = 0, c_time = 0;
 484         int comp = 0;
 485 #ifndef OPENSSL_NO_COMP
 486         COMP_METHOD *cm = NULL;
 487 #endif
 488         STACK_OF(SSL_COMP) *ssl_comp_methods = NULL;
 489         int test_cipherlist = 0;
 490
 491         verbose = 0;
 492         debug = 0;
 493         cipher = 0;
 494
 495         bio_err=BIO_new_fp(stderr,BIO_NOCLOSE|BIO_FP_TEXT);
 496
 497         CRYPTO_set_locking_callback(lock_dbg_cb);
 498
 499         /* enable memory leak checking unless explicitly disabled */
 500         if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) && (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off"))))
 501                 {
 502                 CRYPTO_malloc_debug_init();
 503                 CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
 504                 }
 505         else
 506                 {
 507                 /* OPENSSL_DEBUG_MEMORY=off */
 508                 CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0);
 509                 }
 510         CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
 511
 512         RAND_seed(rnd_seed, sizeof rnd_seed);
 513
 514         bio_stdout=BIO_new_fp(stdout,BIO_NOCLOSE|BIO_FP_TEXT);
 515
 516         argc--;
 517         argv++;
 518
 519         while (argc >= 1)
 520                 {
 521                 if      (strcmp(*argv,"-server_auth") == 0)
 522                         server_auth=1;
 523                 else if (strcmp(*argv,"-client_auth") == 0)
 524                         client_auth=1;
 525                 else if (strcmp(*argv,"-proxy_auth") == 0)
 526                         {
 527                         if (--argc < 1) goto bad;
 528                         app_verify_arg.proxy_auth= *(++argv);
 529                         }
 530                 else if (strcmp(*argv,"-proxy_cond") == 0)
 531                         {
 532                         if (--argc < 1) goto bad;
 533                         app_verify_arg.proxy_cond= *(++argv);
 534                         }
 535                 else if (strcmp(*argv,"-v") == 0)
 536                         verbose=1;
 537                 else if (strcmp(*argv,"-d") == 0)
 538                         debug=1;
 539                 else if (strcmp(*argv,"-reuse") == 0)
 540                         reuse=1;
 541                 else if (strcmp(*argv,"-dhe1024") == 0)
 542                         {
 543 #ifndef OPENSSL_NO_DH
 544                         dhe1024=1;
 545 #else
 546                         fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
 547 #endif
 548                         }
 549                 else if (strcmp(*argv,"-dhe1024dsa") == 0)
 550                         {
 551 #ifndef OPENSSL_NO_DH
 552                         dhe1024dsa=1;
 553 #else
 554                         fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
 555 #endif
 556                         }
 557                 else if (strcmp(*argv,"-no_dhe") == 0)
 558                         no_dhe=1;
 559                 else if (strcmp(*argv,"-no_ecdhe") == 0)
 560                         no_ecdhe=1;
 561                 else if (strcmp(*argv,"-psk") == 0)
 562                         {
 563                         if (--argc < 1) goto bad;
 564                         psk_key=*(++argv);
 565 #ifndef OPENSSL_NO_PSK
 566                         if (strspn(psk_key, "abcdefABCDEF1234567890") != strlen(psk_key))
 567                                 {
 568                                 BIO_printf(bio_err,"Not a hex number '%s'\n",*argv);
 569                                 goto bad;
 570                                 }
 571 #else
 572                         no_psk=1;
 573 #endif
 574                         }
 575                 else if (strcmp(*argv,"-ssl2") == 0)
 576                         ssl2=1;
 577                 else if (strcmp(*argv,"-tls1") == 0)
 578                         tls1=1;
 579                 else if (strcmp(*argv,"-ssl3") == 0)
 580                         ssl3=1;
 581                 else if (strncmp(*argv,"-num",4) == 0)
 582                         {
 583                         if (--argc < 1) goto bad;
 584                         number= atoi(*(++argv));
 585                         if (number == 0) number=1;
 586                         }
 587                 else if (strcmp(*argv,"-bytes") == 0)
 588                         {
 589                         if (--argc < 1) goto bad;
 590                         bytes= atol(*(++argv));
 591                         if (bytes == 0L) bytes=1L;
 592                         i=strlen(argv[0]);
 593                         if (argv[0][i-1] == 'k') bytes*=1024L;
 594                         if (argv[0][i-1] == 'm') bytes*=1024L*1024L;
 595                         }
 596                 else if (strcmp(*argv,"-cert") == 0)
 597                         {
 598                         if (--argc < 1) goto bad;
 599                         server_cert= *(++argv);
 600                         }
 601                 else if (strcmp(*argv,"-s_cert") == 0)
 602                         {
 603                         if (--argc < 1) goto bad;
 604                         server_cert= *(++argv);
 605                         }
 606                 else if (strcmp(*argv,"-key") == 0)
 607                         {
 608                         if (--argc < 1) goto bad;
 609                         server_key= *(++argv);
 610                         }
 611                 else if (strcmp(*argv,"-s_key") == 0)
 612                         {
 613                         if (--argc < 1) goto bad;
 614                         server_key= *(++argv);
 615                         }
 616                 else if (strcmp(*argv,"-c_cert") == 0)
 617                         {
 618                         if (--argc < 1) goto bad;
 619                         client_cert= *(++argv);
 620                         }
 621                 else if (strcmp(*argv,"-c_key") == 0)
 622                         {
 623                         if (--argc < 1) goto bad;
 624                         client_key= *(++argv);
 625                         }
 626                 else if (strcmp(*argv,"-cipher") == 0)
 627                         {
 628                         if (--argc < 1) goto bad;
 629                         cipher= *(++argv);
 630                         }
 631                 else if (strcmp(*argv,"-CApath") == 0)
 632                         {
 633                         if (--argc < 1) goto bad;
 634                         CApath= *(++argv);
 635                         }
 636                 else if (strcmp(*argv,"-CAfile") == 0)
 637                         {
 638                         if (--argc < 1) goto bad;
 639                         CAfile= *(++argv);
 640                         }
 641                 else if (strcmp(*argv,"-bio_pair") == 0)
 642                         {
 643                         bio_pair = 1;
 644                         }
 645                 else if (strcmp(*argv,"-f") == 0)
 646                         {
 647                         force = 1;
 648                         }
 649                 else if (strcmp(*argv,"-time") == 0)
 650                         {
 651                         print_time = 1;
 652                         }
 653                 else if (strcmp(*argv,"-zlib") == 0)
 654                         {
 655                         comp = COMP_ZLIB;
 656                         }
 657                 else if (strcmp(*argv,"-rle") == 0)
 658                         {
 659                         comp = COMP_RLE;
 660                         }
 661                 else if (strcmp(*argv,"-named_curve") == 0)
 662                         {
 663                         if (--argc < 1) goto bad;
 664 #ifndef OPENSSL_NO_ECDH
 665                         named_curve = *(++argv);
 666 #else
 667                         fprintf(stderr,"ignoring -named_curve, since I'm compiled without ECDH\n");
 668                         ++argv;
 669 #endif
 670                         }
 671                 else if (strcmp(*argv,"-app_verify") == 0)
 672                         {
 673                         app_verify_arg.app_verify = 1;
 674                         }
 675                 else if (strcmp(*argv,"-proxy") == 0)
 676                         {
 677                         app_verify_arg.allow_proxy_certs = 1;
 678                         }
 679                 else if (strcmp(*argv,"-test_cipherlist") == 0)
 680                         {
 681                         test_cipherlist = 1;
 682                         }
 683                 else
 684                         {
 685                         fprintf(stderr,"unknown option %s\n",*argv);
 686                         badop=1;
 687                         break;
 688                         }
 689                 argc--;
 690                 argv++;
 691                 }
 692         if (badop)
 693                 {
 694 bad:
 695                 sv_usage();
 696                 goto end;
 697                 }
 698
 699         if (test_cipherlist == 1)
 700                 {
 701                 /* ensure that the cipher list are correctly sorted and exit */
 702                 if (do_test_cipherlist() == 0)
 703                         EXIT(1);
 704                 ret = 0;
 705                 goto end;
 706                 }
 707
 708         if (!ssl2 && !ssl3 && !tls1 && number > 1 && !reuse && !force)
 709                 {
 710                 fprintf(stderr, "This case cannot work.  Use -f to perform "
 711                         "the test anyway (and\n-d to see what happens), "
 712                         "or add one of -ssl2, -ssl3, -tls1, -reuse\n"
 713                         "to avoid protocol mismatch.\n");
 714                 EXIT(1);
 715                 }
 716
 717         if (print_time)
 718                 {
 719                 if (!bio_pair)
 720                         {
 721                         fprintf(stderr, "Using BIO pair (-bio_pair)\n");
 722                         bio_pair = 1;
 723                         }
 724                 if (number < 50 && !force)
 725                         fprintf(stderr, "Warning: For accurate timings, use more connections (e.g. -num 1000)\n");
 726                 }
 727
 728 /*      if (cipher == NULL) cipher=getenv("SSL_CIPHER"); */
 729
 730         SSL_library_init();
 731         SSL_load_error_strings();
 732
 733 #ifndef OPENSSL_NO_COMP
 734         if (comp == COMP_ZLIB) cm = COMP_zlib();
 735         if (comp == COMP_RLE) cm = COMP_rle();
 736         if (cm != NULL)
 737                 {
 738                 if (cm->type != NID_undef)
 739                         {
 740                         if (SSL_COMP_add_compression_method(comp, cm) != 0)
 741                                 {
 742                                 fprintf(stderr,
 743                                         "Failed to add compression method\n");
 744                                 ERR_print_errors_fp(stderr);
 745                                 }
 746                         }
 747                 else
 748                         {
 749                         fprintf(stderr,
 750                                 "Warning: %s compression not supported\n",
 751                                 (comp == COMP_RLE ? "rle" :
 752                                         (comp == COMP_ZLIB ? "zlib" :
 753                                                 "unknown")));
 754                         ERR_print_errors_fp(stderr);
 755                         }
 756                 }
 757         ssl_comp_methods = SSL_COMP_get_compression_methods();
 758         fprintf(stderr, "Available compression methods:\n");
 759         {
 760         int j, n = sk_SSL_COMP_num(ssl_comp_methods);
 761         if (n == 0)
 762                 fprintf(stderr, "  NONE\n");
 763         else
 764                 for (j = 0; j < n; j++)
 765                         {
 766                         SSL_COMP *c = sk_SSL_COMP_value(ssl_comp_methods, j);
 767                         fprintf(stderr, "  %d: %s\n", c->id, c->name);
 768                         }
 769         }
 770 #endif
 771
 772 #if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
 773         if (ssl2)
 774                 meth=SSLv2_method();
 775         else
 776         if (tls1)
 777                 meth=TLSv1_method();
 778         else
 779         if (ssl3)
 780                 meth=SSLv3_method();
 781         else
 782                 meth=SSLv23_method();
 783 #else
 784 #ifdef OPENSSL_NO_SSL2
 785         if (tls1)
 786                 meth=TLSv1_method();
 787         else
 788         if (ssl3)
 789                 meth=SSLv3_method();
 790         else
 791                 meth=SSLv23_method();
 792 #else
 793         meth=SSLv2_method();
 794 #endif
 795 #endif
 796
 797         c_ctx=SSL_CTX_new(meth);
 798         s_ctx=SSL_CTX_new(meth);
 799         if ((c_ctx == NULL) || (s_ctx == NULL))
 800                 {
 801                 ERR_print_errors(bio_err);
 802                 goto end;
 803                 }
 804
 805         if (cipher != NULL)
 806                 {
 807                 SSL_CTX_set_cipher_list(c_ctx,cipher);
 808                 SSL_CTX_set_cipher_list(s_ctx,cipher);
 809                 }
 810
 811 #ifndef OPENSSL_NO_DH
 812         if (!no_dhe)
 813                 {
 814                 if (dhe1024dsa)
 815                         {
 816                         /* use SSL_OP_SINGLE_DH_USE to avoid small subgroup attacks */
 817                         SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
 818                         dh=get_dh1024dsa();
 819                         }
 820                 else if (dhe1024)
 821                         dh=get_dh1024();
 822                 else
 823                         dh=get_dh512();
 824                 SSL_CTX_set_tmp_dh(s_ctx,dh);
 825                 DH_free(dh);
 826                 }
 827 #else
 828         (void)no_dhe;
 829 #endif
 830
 831 #ifndef OPENSSL_NO_ECDH
 832         if (!no_ecdhe)
 833                 {
 834                 int nid;
 835
 836                 if (named_curve != NULL)
 837                         {
 838                         nid = OBJ_sn2nid(named_curve);
 839                         if (nid == 0)
 840                         {
 841                                 BIO_printf(bio_err, "unknown curve name (%s)\n", named_curve);
 842                                 goto end;
 843                                 }
 844                         }
 845                 else
 846                         nid = NID_sect163r2;
 847
 848                 ecdh = EC_KEY_new_by_curve_name(nid);
 849                 if (ecdh == NULL)
 850                         {
 851                         BIO_printf(bio_err, "unable to create curve\n");
 852                         goto end;
 853                         }
 854
 855                 SSL_CTX_set_tmp_ecdh(s_ctx, ecdh);
 856                 SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_ECDH_USE);
 857                 EC_KEY_free(ecdh);
 858                 }
 859 #else
 860         (void)no_ecdhe;
 861 #endif
 862
 863 #ifndef OPENSSL_NO_RSA
 864         SSL_CTX_set_tmp_rsa_callback(s_ctx,tmp_rsa_cb);
 865 #endif
 866
 867 #ifdef TLSEXT_TYPE_opaque_prf_input
 868         SSL_CTX_set_tlsext_opaque_prf_input_callback(c_ctx, opaque_prf_input_cb);
 869         SSL_CTX_set_tlsext_opaque_prf_input_callback(s_ctx, opaque_prf_input_cb);
 870         SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(c_ctx, &co1); /* or &co2 or NULL */
 871         SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(s_ctx, &so1); /* or &so2 or NULL */
 872 #endif
 873
 874         if (!SSL_CTX_use_certificate_file(s_ctx,server_cert,SSL_FILETYPE_PEM))
 875                 {
 876                 ERR_print_errors(bio_err);
 877                 }
 878         else if (!SSL_CTX_use_PrivateKey_file(s_ctx,
 879                 (server_key?server_key:server_cert), SSL_FILETYPE_PEM))
 880                 {
 881                 ERR_print_errors(bio_err);
 882                 goto end;
 883                 }
 884
 885         if (client_auth)
 886                 {
 887                 SSL_CTX_use_certificate_file(c_ctx,client_cert,
 888                         SSL_FILETYPE_PEM);
 889                 SSL_CTX_use_PrivateKey_file(c_ctx,
 890                         (client_key?client_key:client_cert),
 891                         SSL_FILETYPE_PEM);
 892                 }
 893
 894         if (    (!SSL_CTX_load_verify_locations(s_ctx,CAfile,CApath)) ||
 895                 (!SSL_CTX_set_default_verify_paths(s_ctx)) ||
 896                 (!SSL_CTX_load_verify_locations(c_ctx,CAfile,CApath)) ||
 897                 (!SSL_CTX_set_default_verify_paths(c_ctx)))
 898                 {
 899                 /* fprintf(stderr,"SSL_load_verify_locations\n"); */
 900                 ERR_print_errors(bio_err);
 901                 /* goto end; */
 902                 }
 903
 904         if (client_auth)
 905                 {
 906                 BIO_printf(bio_err,"client authentication\n");
 907                 SSL_CTX_set_verify(s_ctx,
 908                         SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
 909                         verify_callback);
 910                 SSL_CTX_set_cert_verify_callback(s_ctx, app_verify_callback, &app_verify_arg);
 911                 }
 912         if (server_auth)
 913                 {
 914                 BIO_printf(bio_err,"server authentication\n");
 915                 SSL_CTX_set_verify(c_ctx,SSL_VERIFY_PEER,
 916                         verify_callback);
 917                 SSL_CTX_set_cert_verify_callback(c_ctx, app_verify_callback, &app_verify_arg);
 918                 }
 919
 920         {
 921                 int session_id_context = 0;
 922                 SSL_CTX_set_session_id_context(s_ctx, (void *)&session_id_context, sizeof session_id_context);
 923         }
 924
 925         /* Use PSK only if PSK key is given */
 926         if (psk_key != NULL)
 927                 {
 928                 /* no_psk is used to avoid putting psk command to openssl tool */
 929                 if (no_psk)
 930                         {
 931                         /* if PSK is not compiled in and psk key is
 932                          * given, do nothing and exit successfully */
 933                         ret=0;
 934                         goto end;
 935                         }
 936 #ifndef OPENSSL_NO_PSK
 937                 SSL_CTX_set_psk_client_callback(c_ctx, psk_client_callback);
 938                 SSL_CTX_set_psk_server_callback(s_ctx, psk_server_callback);
 939                 if (debug)
 940                         BIO_printf(bio_err,"setting PSK identity hint to s_ctx\n");
 941                 if (!SSL_CTX_use_psk_identity_hint(s_ctx, "ctx server identity_hint"))
 942                         {
 943                         BIO_printf(bio_err,"error setting PSK identity hint to s_ctx\n");
 944                         ERR_print_errors(bio_err);
 945                         goto end;
 946                         }
 947 #endif
 948                 }
 949
 950         c_ssl=SSL_new(c_ctx);
 951         s_ssl=SSL_new(s_ctx);
 952
 953 #ifndef OPENSSL_NO_KRB5
 954         if (c_ssl  &&  c_ssl->kssl_ctx)
 955                 {
 956                 char    localhost[MAXHOSTNAMELEN+2];
 957
 958                 if (gethostname(localhost, sizeof localhost-1) == 0)
 959                         {
 960                         localhost[sizeof localhost-1]='\0';
 961                         if(strlen(localhost) == sizeof localhost-1)
 962                                 {
 963                                 BIO_printf(bio_err,"localhost name too long\n");
 964                                 goto end;
 965                                 }
 966                         kssl_ctx_setstring(c_ssl->kssl_ctx, KSSL_SERVER,
 967                                 localhost);
 968                         }
 969                 }
 970 #endif    /* OPENSSL_NO_KRB5  */
 971
 972         for (i=0; i<number; i++)
 973                 {
 974                 if (!reuse) SSL_set_session(c_ssl,NULL);
 975                 if (bio_pair)
 976                         ret=doit_biopair(s_ssl,c_ssl,bytes,&s_time,&c_time);
 977                 else
 978                         ret=doit(s_ssl,c_ssl,bytes);
 979                 }
 980
 981         if (!verbose)
 982                 {
 983                 print_details(c_ssl, "");
 984                 }
 985         if ((number > 1) || (bytes > 1L))
 986                 BIO_printf(bio_stdout, "%d handshakes of %ld bytes done\n",number,bytes);
 987         if (print_time)
 988                 {
 989 #ifdef CLOCKS_PER_SEC
 990                 /* "To determine the time in seconds, the value returned
 991                  * by the clock function should be divided by the value
 992                  * of the macro CLOCKS_PER_SEC."
 993                  *                                       -- ISO/IEC 9899 */
 994                 BIO_printf(bio_stdout, "Approximate total server time: %6.2f s\n"
 995                         "Approximate total client time: %6.2f s\n",
 996                         (double)s_time/CLOCKS_PER_SEC,
 997                         (double)c_time/CLOCKS_PER_SEC);
 998 #else
 999                 /* "`CLOCKS_PER_SEC' undeclared (first use this function)"
1000                  *                            -- cc on NeXTstep/OpenStep */
1001                 BIO_printf(bio_stdout,
1002                         "Approximate total server time: %6.2f units\n"
1003                         "Approximate total client time: %6.2f units\n",
1004                         (double)s_time,
1005                         (double)c_time);
1006 #endif
1007                 }
1008
1009         SSL_free(s_ssl);
1010         SSL_free(c_ssl);
1011
1012 end:
1013         if (s_ctx != NULL) SSL_CTX_free(s_ctx);
1014         if (c_ctx != NULL) SSL_CTX_free(c_ctx);
1015
1016         if (bio_stdout != NULL) BIO_free(bio_stdout);
1017
1018 #ifndef OPENSSL_NO_RSA
1019         free_tmp_rsa();
1020 #endif
1021 #ifndef OPENSSL_NO_ENGINE
1022         ENGINE_cleanup();
1023 #endif
1024         CRYPTO_cleanup_all_ex_data();
1025         ERR_free_strings();
1026         ERR_remove_thread_state(NULL);
1027         EVP_cleanup();
1028         CRYPTO_mem_leaks(bio_err);
1029         if (bio_err != NULL) BIO_free(bio_err);
1030         EXIT(ret);
1031         return ret;
1032         }
1033
1034 int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count,
1035         clock_t *s_time, clock_t *c_time)
1036         {
1037         long cw_num = count, cr_num = count, sw_num = count, sr_num = count;
1038         BIO *s_ssl_bio = NULL, *c_ssl_bio = NULL;
1039         BIO *server = NULL, *server_io = NULL, *client = NULL, *client_io = NULL;
1040         int ret = 1;
1041
1042         size_t bufsiz = 256; /* small buffer for testing */
1043
1044         if (!BIO_new_bio_pair(&server, bufsiz, &server_io, bufsiz))
1045                 goto err;
1046         if (!BIO_new_bio_pair(&client, bufsiz, &client_io, bufsiz))
1047                 goto err;
1048
1049         s_ssl_bio = BIO_new(BIO_f_ssl());
1050         if (!s_ssl_bio)
1051                 goto err;
1052
1053         c_ssl_bio = BIO_new(BIO_f_ssl());
1054         if (!c_ssl_bio)
1055                 goto err;
1056
1057         SSL_set_connect_state(c_ssl);
1058         SSL_set_bio(c_ssl, client, client);
1059         (void)BIO_set_ssl(c_ssl_bio, c_ssl, BIO_NOCLOSE);
1060
1061         SSL_set_accept_state(s_ssl);
1062         SSL_set_bio(s_ssl, server, server);
1063         (void)BIO_set_ssl(s_ssl_bio, s_ssl, BIO_NOCLOSE);
1064
1065         do
1066                 {
1067                 /* c_ssl_bio:          SSL filter BIO
1068                  *
1069                  * client:             pseudo-I/O for SSL library
1070                  *
1071                  * client_io:          client's SSL communication; usually to be
1072                  *                     relayed over some I/O facility, but in this
1073                  *                     test program, we're the server, too:
1074                  *
1075                  * server_io:          server's SSL communication
1076                  *
1077                  * server:             pseudo-I/O for SSL library
1078                  *
1079                  * s_ssl_bio:          SSL filter BIO
1080                  *
1081                  * The client and the server each employ a "BIO pair":
1082                  * client + client_io, server + server_io.
1083                  * BIO pairs are symmetric.  A BIO pair behaves similar
1084                  * to a non-blocking socketpair (but both endpoints must
1085                  * be handled by the same thread).
1086                  * [Here we could connect client and server to the ends
1087                  * of a single BIO pair, but then this code would be less
1088                  * suitable as an example for BIO pairs in general.]
1089                  *
1090                  * Useful functions for querying the state of BIO pair endpoints:
1091                  *
1092                  * BIO_ctrl_pending(bio)              number of bytes we can read now
1093                  * BIO_ctrl_get_read_request(bio)     number of bytes needed to fulfil
1094                  *                                      other side's read attempt
1095                  * BIO_ctrl_get_write_guarantee(bio)   number of bytes we can write now
1096                  *
1097                  * ..._read_request is never more than ..._write_guarantee;
1098                  * it depends on the application which one you should use.
1099                  */
1100
1101                 /* We have non-blocking behaviour throughout this test program, but
1102                  * can be sure that there is *some* progress in each iteration; so
1103                  * we don't have to worry about ..._SHOULD_READ or ..._SHOULD_WRITE
1104                  * -- we just try everything in each iteration
1105                  */
1106
1107                         {
1108                         /* CLIENT */
1109
1110                         MS_STATIC char cbuf[1024*8];
1111                         int i, r;
1112                         clock_t c_clock = clock();
1113
1114                         memset(cbuf, 0, sizeof(cbuf));
1115
1116                         if (debug)
1117                                 if (SSL_in_init(c_ssl))
1118                                         printf("client waiting in SSL_connect - %s\n",
1119                                                 SSL_state_string_long(c_ssl));
1120
1121                         if (cw_num > 0)
1122                                 {
1123                                 /* Write to server. */
1124
1125                                 if (cw_num > (long)sizeof cbuf)
1126                                         i = sizeof cbuf;
1127                                 else
1128                                         i = (int)cw_num;
1129                                 r = BIO_write(c_ssl_bio, cbuf, i);
1130                                 if (r < 0)
1131                                         {
1132                                         if (!BIO_should_retry(c_ssl_bio))
1133                                                 {
1134                                                 fprintf(stderr,"ERROR in CLIENT\n");
1135                                                 goto err;
1136                                                 }
1137                                         /* BIO_should_retry(...) can just be ignored here.
1138                                          * The library expects us to call BIO_write with
1139                                          * the same arguments again, and that's what we will
1140                                          * do in the next iteration. */
1141                                         }
1142                                 else if (r == 0)
1143                                         {
1144                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1145                                         goto err;
1146                                         }
1147                                 else
1148                                         {
1149                                         if (debug)
1150                                                 printf("client wrote %d\n", r);
1151                                         cw_num -= r;
1152                                         }
1153                                 }
1154
1155                         if (cr_num > 0)
1156                                 {
1157                                 /* Read from server. */
1158
1159                                 r = BIO_read(c_ssl_bio, cbuf, sizeof(cbuf));
1160                                 if (r < 0)
1161                                         {
1162                                         if (!BIO_should_retry(c_ssl_bio))
1163                                                 {
1164                                                 fprintf(stderr,"ERROR in CLIENT\n");
1165                                                 goto err;
1166                                                 }
1167                                         /* Again, "BIO_should_retry" can be ignored. */
1168                                         }
1169                                 else if (r == 0)
1170                                         {
1171                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1172                                         goto err;
1173                                         }
1174                                 else
1175                                         {
1176                                         if (debug)
1177                                                 printf("client read %d\n", r);
1178                                         cr_num -= r;
1179                                         }
1180                                 }
1181
1182                         /* c_time and s_time increments will typically be very small
1183                          * (depending on machine speed and clock tick intervals),
1184                          * but sampling over a large number of connections should
1185                          * result in fairly accurate figures.  We cannot guarantee
1186                          * a lot, however -- if each connection lasts for exactly
1187                          * one clock tick, it will be counted only for the client
1188                          * or only for the server or even not at all.
1189                          */
1190                         *c_time += (clock() - c_clock);
1191                         }
1192
1193                         {
1194                         /* SERVER */
1195
1196                         MS_STATIC char sbuf[1024*8];
1197                         int i, r;
1198                         clock_t s_clock = clock();
1199
1200                         memset(sbuf, 0, sizeof(sbuf));
1201
1202                         if (debug)
1203                                 if (SSL_in_init(s_ssl))
1204                                         printf("server waiting in SSL_accept - %s\n",
1205                                                 SSL_state_string_long(s_ssl));
1206
1207                         if (sw_num > 0)
1208                                 {
1209                                 /* Write to client. */
1210
1211                                 if (sw_num > (long)sizeof sbuf)
1212                                         i = sizeof sbuf;
1213                                 else
1214                                         i = (int)sw_num;
1215                                 r = BIO_write(s_ssl_bio, sbuf, i);
1216                                 if (r < 0)
1217                                         {
1218                                         if (!BIO_should_retry(s_ssl_bio))
1219                                                 {
1220                                                 fprintf(stderr,"ERROR in SERVER\n");
1221                                                 goto err;
1222                                                 }
1223                                         /* Ignore "BIO_should_retry". */
1224                                         }
1225                                 else if (r == 0)
1226                                         {
1227                                         fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1228                                         goto err;
1229                                         }
1230                                 else
1231                                         {
1232                                         if (debug)
1233                                                 printf("server wrote %d\n", r);
1234                                         sw_num -= r;
1235                                         }
1236                                 }
1237
1238                         if (sr_num > 0)
1239                                 {
1240                                 /* Read from client. */
1241
1242                                 r = BIO_read(s_ssl_bio, sbuf, sizeof(sbuf));
1243                                 if (r < 0)
1244                                         {
1245                                         if (!BIO_should_retry(s_ssl_bio))
1246                                                 {
1247                                                 fprintf(stderr,"ERROR in SERVER\n");
1248                                                 goto err;
1249                                                 }
1250                                         /* blah, blah */
1251                                         }
1252                                 else if (r == 0)
1253                                         {
1254                                         fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1255                                         goto err;
1256                                         }
1257                                 else
1258                                         {
1259                                         if (debug)
1260                                                 printf("server read %d\n", r);
1261                                         sr_num -= r;
1262                                         }
1263                                 }
1264
1265                         *s_time += (clock() - s_clock);
1266                         }
1267
1268                         {
1269                         /* "I/O" BETWEEN CLIENT AND SERVER. */
1270
1271                         size_t r1, r2;
1272                         BIO *io1 = server_io, *io2 = client_io;
1273                         /* we use the non-copying interface for io1
1274                          * and the standard BIO_write/BIO_read interface for io2
1275                          */
1276
1277                         static int prev_progress = 1;
1278                         int progress = 0;
1279
1280                         /* io1 to io2 */
1281                         do
1282                                 {
1283                                 size_t num;
1284                                 int r;
1285
1286                                 r1 = BIO_ctrl_pending(io1);
1287                                 r2 = BIO_ctrl_get_write_guarantee(io2);
1288
1289                                 num = r1;
1290                                 if (r2 < num)
1291                                         num = r2;
1292                                 if (num)
1293                                         {
1294                                         char *dataptr;
1295
1296                                         if (INT_MAX < num) /* yeah, right */
1297                                                 num = INT_MAX;
1298
1299                                         r = BIO_nread(io1, &dataptr, (int)num);
1300                                         assert(r > 0);
1301                                         assert(r <= (int)num);
1302                                         /* possibly r < num (non-contiguous data) */
1303                                         num = r;
1304                                         r = BIO_write(io2, dataptr, (int)num);
1305                                         if (r != (int)num) /* can't happen */
1306                                                 {
1307                                                 fprintf(stderr, "ERROR: BIO_write could not write "
1308                                                         "BIO_ctrl_get_write_guarantee() bytes");
1309                                                 goto err;
1310                                                 }
1311                                         progress = 1;
1312
1313                                         if (debug)
1314                                                 printf((io1 == client_io) ?
1315                                                         "C->S relaying: %d bytes\n" :
1316                                                         "S->C relaying: %d bytes\n",
1317                                                         (int)num);
1318                                         }
1319                                 }
1320                         while (r1 && r2);
1321
1322                         /* io2 to io1 */
1323                         {
1324                                 size_t num;
1325                                 int r;
1326
1327                                 r1 = BIO_ctrl_pending(io2);
1328                                 r2 = BIO_ctrl_get_read_request(io1);
1329                                 /* here we could use ..._get_write_guarantee instead of
1330                                  * ..._get_read_request, but by using the latter
1331                                  * we test restartability of the SSL implementation
1332                                  * more thoroughly */
1333                                 num = r1;
1334                                 if (r2 < num)
1335                                         num = r2;
1336                                 if (num)
1337                                         {
1338                                         char *dataptr;
1339
1340                                         if (INT_MAX < num)
1341                                                 num = INT_MAX;
1342
1343                                         if (num > 1)
1344                                                 --num; /* test restartability even more thoroughly */
1345
1346                                         r = BIO_nwrite0(io1, &dataptr);
1347                                         assert(r > 0);
1348                                         if (r < (int)num)
1349                                                 num = r;
1350                                         r = BIO_read(io2, dataptr, (int)num);
1351                                         if (r != (int)num) /* can't happen */
1352                                                 {
1353                                                 fprintf(stderr, "ERROR: BIO_read could not read "
1354                                                         "BIO_ctrl_pending() bytes");
1355                                                 goto err;
1356                                                 }
1357                                         progress = 1;
1358                                         r = BIO_nwrite(io1, &dataptr, (int)num);
1359                                         if (r != (int)num) /* can't happen */
1360                                                 {
1361                                                 fprintf(stderr, "ERROR: BIO_nwrite() did not accept "
1362                                                         "BIO_nwrite0() bytes");
1363                                                 goto err;
1364                                                 }
1365
1366                                         if (debug)
1367                                                 printf((io2 == client_io) ?
1368                                                         "C->S relaying: %d bytes\n" :
1369                                                         "S->C relaying: %d bytes\n",
1370                                                         (int)num);
1371                                         }
1372                         } /* no loop, BIO_ctrl_get_read_request now returns 0 anyway */
1373
1374                         if (!progress && !prev_progress)
1375                                 if (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0)
1376                                         {
1377                                         fprintf(stderr, "ERROR: got stuck\n");
1378                                         if (strcmp("SSLv2", SSL_get_version(c_ssl)) == 0)
1379                                                 {
1380                                                 fprintf(stderr, "This can happen for SSL2 because "
1381                                                         "CLIENT-FINISHED and SERVER-VERIFY are written \n"
1382                                                         "concurrently ...");
1383                                                 if (strncmp("2SCF", SSL_state_string(c_ssl), 4) == 0
1384                                                         && strncmp("2SSV", SSL_state_string(s_ssl), 4) == 0)
1385                                                         {
1386                                                         fprintf(stderr, " ok.\n");
1387                                                         goto end;
1388                                                         }
1389                                                 }
1390                                         fprintf(stderr, " ERROR.\n");
1391                                         goto err;
1392                                         }
1393                         prev_progress = progress;
1394                         }
1395                 }
1396         while (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0);
1397
1398         if (verbose)
1399                 print_details(c_ssl, "DONE via BIO pair: ");
1400 end:
1401         ret = 0;
1402
1403  err:
1404         ERR_print_errors(bio_err);
1405
1406         if (server)
1407                 BIO_free(server);
1408         if (server_io)
1409                 BIO_free(server_io);
1410         if (client)
1411                 BIO_free(client);
1412         if (client_io)
1413                 BIO_free(client_io);
1414         if (s_ssl_bio)
1415                 BIO_free(s_ssl_bio);
1416         if (c_ssl_bio)
1417                 BIO_free(c_ssl_bio);
1418
1419         return ret;
1420         }
1421
1422
1423 #define W_READ  1
1424 #define W_WRITE 2
1425 #define C_DONE  1
1426 #define S_DONE  2
1427
1428 int doit(SSL *s_ssl, SSL *c_ssl, long count)
1429         {
1430         MS_STATIC char cbuf[1024*8],sbuf[1024*8];
1431         long cw_num=count,cr_num=count;
1432         long sw_num=count,sr_num=count;
1433         int ret=1;
1434         BIO *c_to_s=NULL;
1435         BIO *s_to_c=NULL;
1436         BIO *c_bio=NULL;
1437         BIO *s_bio=NULL;
1438         int c_r,c_w,s_r,s_w;
1439         int i,j;
1440         int done=0;
1441         int c_write,s_write;
1442         int do_server=0,do_client=0;
1443
1444         memset(cbuf,0,sizeof(cbuf));
1445         memset(sbuf,0,sizeof(sbuf));
1446
1447         c_to_s=BIO_new(BIO_s_mem());
1448         s_to_c=BIO_new(BIO_s_mem());
1449         if ((s_to_c == NULL) || (c_to_s == NULL))
1450                 {
1451                 ERR_print_errors(bio_err);
1452                 goto err;
1453                 }
1454
1455         c_bio=BIO_new(BIO_f_ssl());
1456         s_bio=BIO_new(BIO_f_ssl());
1457         if ((c_bio == NULL) || (s_bio == NULL))
1458                 {
1459                 ERR_print_errors(bio_err);
1460                 goto err;
1461                 }
1462
1463         SSL_set_connect_state(c_ssl);
1464         SSL_set_bio(c_ssl,s_to_c,c_to_s);
1465         BIO_set_ssl(c_bio,c_ssl,BIO_NOCLOSE);
1466
1467         SSL_set_accept_state(s_ssl);
1468         SSL_set_bio(s_ssl,c_to_s,s_to_c);
1469         BIO_set_ssl(s_bio,s_ssl,BIO_NOCLOSE);
1470
1471         c_r=0; s_r=1;
1472         c_w=1; s_w=0;
1473         c_write=1,s_write=0;
1474
1475         /* We can always do writes */
1476         for (;;)
1477                 {
1478                 do_server=0;
1479                 do_client=0;
1480
1481                 i=(int)BIO_pending(s_bio);
1482                 if ((i && s_r) || s_w) do_server=1;
1483
1484                 i=(int)BIO_pending(c_bio);
1485                 if ((i && c_r) || c_w) do_client=1;
1486
1487                 if (do_server && debug)
1488                         {
1489                         if (SSL_in_init(s_ssl))
1490                                 printf("server waiting in SSL_accept - %s\n",
1491                                         SSL_state_string_long(s_ssl));
1492 /*                      else if (s_write)
1493                                 printf("server:SSL_write()\n");
1494                         else
1495                                 printf("server:SSL_read()\n"); */
1496                         }
1497
1498                 if (do_client && debug)
1499                         {
1500                         if (SSL_in_init(c_ssl))
1501                                 printf("client waiting in SSL_connect - %s\n",
1502                                         SSL_state_string_long(c_ssl));
1503 /*                      else if (c_write)
1504                                 printf("client:SSL_write()\n");
1505                         else
1506                                 printf("client:SSL_read()\n"); */
1507                         }
1508
1509                 if (!do_client && !do_server)
1510                         {
1511                         fprintf(stdout,"ERROR IN STARTUP\n");
1512                         ERR_print_errors(bio_err);
1513                         break;
1514                         }
1515                 if (do_client && !(done & C_DONE))
1516                         {
1517                         if (c_write)
1518                                 {
1519                                 j = (cw_num > (long)sizeof(cbuf)) ?
1520                                         (int)sizeof(cbuf) : (int)cw_num;
1521                                 i=BIO_write(c_bio,cbuf,j);
1522                                 if (i < 0)
1523                                         {
1524                                         c_r=0;
1525                                         c_w=0;
1526                                         if (BIO_should_retry(c_bio))
1527                                                 {
1528                                                 if (BIO_should_read(c_bio))
1529                                                         c_r=1;
1530                                                 if (BIO_should_write(c_bio))
1531                                                         c_w=1;
1532                                                 }
1533                                         else
1534                                                 {
1535                                                 fprintf(stderr,"ERROR in CLIENT\n");
1536                                                 ERR_print_errors(bio_err);
1537                                                 goto err;
1538                                                 }
1539                                         }
1540                                 else if (i == 0)
1541                                         {
1542                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1543                                         goto err;
1544                                         }
1545                                 else
1546                                         {
1547                                         if (debug)
1548                                                 printf("client wrote %d\n",i);
1549                                         /* ok */
1550                                         s_r=1;
1551                                         c_write=0;
1552                                         cw_num-=i;
1553                                         }
1554                                 }
1555                         else
1556                                 {
1557                                 i=BIO_read(c_bio,cbuf,sizeof(cbuf));
1558                                 if (i < 0)
1559                                         {
1560                                         c_r=0;
1561                                         c_w=0;
1562                                         if (BIO_should_retry(c_bio))
1563                                                 {
1564                                                 if (BIO_should_read(c_bio))
1565                                                         c_r=1;
1566                                                 if (BIO_should_write(c_bio))
1567                                                         c_w=1;
1568                                                 }
1569                                         else
1570                                                 {
1571                                                 fprintf(stderr,"ERROR in CLIENT\n");
1572                                                 ERR_print_errors(bio_err);
1573                                                 goto err;
1574                                                 }
1575                                         }
1576                                 else if (i == 0)
1577                                         {
1578                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1579                                         goto err;
1580                                         }
1581                                 else
1582                                         {
1583                                         if (debug)
1584                                                 printf("client read %d\n",i);
1585                                         cr_num-=i;
1586                                         if (sw_num > 0)
1587                                                 {
1588                                                 s_write=1;
1589                                                 s_w=1;
1590                                                 }
1591                                         if (cr_num <= 0)
1592                                                 {
1593                                                 s_write=1;
1594                                                 s_w=1;
1595                                                 done=S_DONE|C_DONE;
1596                                                 }
1597                                         }
1598                                 }
1599                         }
1600
1601                 if (do_server && !(done & S_DONE))
1602                         {
1603                         if (!s_write)
1604                                 {
1605                                 i=BIO_read(s_bio,sbuf,sizeof(cbuf));
1606                                 if (i < 0)
1607                                         {
1608                                         s_r=0;
1609                                         s_w=0;
1610                                         if (BIO_should_retry(s_bio))
1611                                                 {
1612                                                 if (BIO_should_read(s_bio))
1613                                                         s_r=1;
1614                                                 if (BIO_should_write(s_bio))
1615                                                         s_w=1;
1616                                                 }
1617                                         else
1618                                                 {
1619                                                 fprintf(stderr,"ERROR in SERVER\n");
1620                                                 ERR_print_errors(bio_err);
1621                                                 goto err;
1622                                                 }
1623                                         }
1624                                 else if (i == 0)
1625                                         {
1626                                         ERR_print_errors(bio_err);
1627                                         fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_read\n");
1628                                         goto err;
1629                                         }
1630                                 else
1631                                         {
1632                                         if (debug)
1633                                                 printf("server read %d\n",i);
1634                                         sr_num-=i;
1635                                         if (cw_num > 0)
1636                                                 {
1637                                                 c_write=1;
1638                                                 c_w=1;
1639                                                 }
1640                                         if (sr_num <= 0)
1641                                                 {
1642                                                 s_write=1;
1643                                                 s_w=1;
1644                                                 c_write=0;
1645                                                 }
1646                                         }
1647                                 }
1648                         else
1649                                 {
1650                                 j = (sw_num > (long)sizeof(sbuf)) ?
1651                                         (int)sizeof(sbuf) : (int)sw_num;
1652                                 i=BIO_write(s_bio,sbuf,j);
1653                                 if (i < 0)
1654                                         {
1655                                         s_r=0;
1656                                         s_w=0;
1657                                         if (BIO_should_retry(s_bio))
1658                                                 {
1659                                                 if (BIO_should_read(s_bio))
1660                                                         s_r=1;
1661                                                 if (BIO_should_write(s_bio))
1662                                                         s_w=1;
1663                                                 }
1664                                         else
1665                                                 {
1666                                                 fprintf(stderr,"ERROR in SERVER\n");
1667                                                 ERR_print_errors(bio_err);
1668                                                 goto err;
1669                                                 }
1670                                         }
1671                                 else if (i == 0)
1672                                         {
1673                                         ERR_print_errors(bio_err);
1674                                         fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_write\n");
1675                                         goto err;
1676                                         }
1677                                 else
1678                                         {
1679                                         if (debug)
1680                                                 printf("server wrote %d\n",i);
1681                                         sw_num-=i;
1682                                         s_write=0;
1683                                         c_r=1;
1684                                         if (sw_num <= 0)
1685                                                 done|=S_DONE;
1686                                         }
1687                                 }
1688                         }
1689
1690                 if ((done & S_DONE) && (done & C_DONE)) break;
1691                 }
1692
1693         if (verbose)
1694                 print_details(c_ssl, "DONE: ");
1695         ret=0;
1696 err:
1697         /* We have to set the BIO's to NULL otherwise they will be
1698          * OPENSSL_free()ed twice.  Once when th s_ssl is SSL_free()ed and
1699          * again when c_ssl is SSL_free()ed.
1700          * This is a hack required because s_ssl and c_ssl are sharing the same
1701          * BIO structure and SSL_set_bio() and SSL_free() automatically
1702          * BIO_free non NULL entries.
1703          * You should not normally do this or be required to do this */
1704         if (s_ssl != NULL)
1705                 {
1706                 s_ssl->rbio=NULL;
1707                 s_ssl->wbio=NULL;
1708                 }
1709         if (c_ssl != NULL)
1710                 {
1711                 c_ssl->rbio=NULL;
1712                 c_ssl->wbio=NULL;
1713                 }
1714
1715         if (c_to_s != NULL) BIO_free(c_to_s);
1716         if (s_to_c != NULL) BIO_free(s_to_c);
1717         if (c_bio != NULL) BIO_free_all(c_bio);
1718         if (s_bio != NULL) BIO_free_all(s_bio);
1719         return(ret);
1720         }
1721
1722 static int get_proxy_auth_ex_data_idx(void)
1723         {
1724         static volatile int idx = -1;
1725         if (idx < 0)
1726                 {
1727                 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
1728                 if (idx < 0)
1729                         {
1730                         idx = X509_STORE_CTX_get_ex_new_index(0,
1731                                 "SSLtest for verify callback", NULL,NULL,NULL);
1732                         }
1733                 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
1734                 }
1735         return idx;
1736         }
1737
1738 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
1739         {
1740         char *s,buf[256];
1741
1742         s=X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),buf,
1743                             sizeof buf);
1744         if (s != NULL)
1745                 {
1746                 if (ok)
1747                         fprintf(stderr,"depth=%d %s\n",
1748                                 ctx->error_depth,buf);
1749                 else
1750                         {
1751                         fprintf(stderr,"depth=%d error=%d %s\n",
1752                                 ctx->error_depth,ctx->error,buf);
1753                         }
1754                 }
1755
1756         if (ok == 0)
1757                 {
1758                 fprintf(stderr,"Error string: %s\n",
1759                         X509_verify_cert_error_string(ctx->error));
1760                 switch (ctx->error)
1761                         {
1762                 case X509_V_ERR_CERT_NOT_YET_VALID:
1763                 case X509_V_ERR_CERT_HAS_EXPIRED:
1764                 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
1765                         fprintf(stderr,"  ... ignored.\n");
1766                         ok=1;
1767                         }
1768                 }
1769
1770         if (ok == 1)
1771                 {
1772                 X509 *xs = ctx->current_cert;
1773 #if 0
1774                 X509 *xi = ctx->current_issuer;
1775 #endif
1776
1777                 if (xs->ex_flags & EXFLAG_PROXY)
1778                         {
1779                         unsigned int *letters =
1780                                 X509_STORE_CTX_get_ex_data(ctx,
1781                                         get_proxy_auth_ex_data_idx());
1782
1783                         if (letters)
1784                                 {
1785                                 int found_any = 0;
1786                                 int i;
1787                                 PROXY_CERT_INFO_EXTENSION *pci =
1788                                         X509_get_ext_d2i(xs, NID_proxyCertInfo,
1789                                                 NULL, NULL);
1790
1791                                 switch (OBJ_obj2nid(pci->proxyPolicy->policyLanguage))
1792                                         {
1793                                 case NID_Independent:
1794                                         /* Completely meaningless in this
1795                                            program, as there's no way to
1796                                            grant explicit rights to a
1797                                            specific PrC.  Basically, using
1798                                            id-ppl-Independent is the perfect
1799                                            way to grant no rights at all. */
1800                                         fprintf(stderr, "  Independent proxy certificate");
1801                                         for (i = 0; i < 26; i++)
1802                                                 letters[i] = 0;
1803                                         break;
1804                                 case NID_id_ppl_inheritAll:
1805                                         /* This is basically a NOP, we
1806                                            simply let the current rights
1807                                            stand as they are. */
1808                                         fprintf(stderr, "  Proxy certificate inherits all");
1809                                         break;
1810                                 default:
1811                                         s = (char *)
1812                                                 pci->proxyPolicy->policy->data;
1813                                         i = pci->proxyPolicy->policy->length;
1814
1815                                         /* The algorithm works as follows:
1816                                            it is assumed that previous
1817                                            iterations or the initial granted
1818                                            rights has already set some elements
1819                                            of `letters'.  What we need to do is
1820                                            to clear those that weren't granted
1821                                            by the current PrC as well.  The
1822                                            easiest way to do this is to add 1
1823                                            to all the elements whose letters
1824                                            are given with the current policy.
1825                                            That way, all elements that are set
1826                                            by the current policy and were
1827                                            already set by earlier policies and
1828                                            through the original grant of rights
1829                                            will get the value 2 or higher.
1830                                            The last thing to do is to sweep
1831                                            through `letters' and keep the
1832                                            elements having the value 2 as set,
1833                                            and clear all the others. */
1834
1835                                         fprintf(stderr, "  Certificate proxy rights = %*.*s", i, i, s);
1836                                         while(i-- > 0)
1837                                                 {
1838                                                 int c = *s++;
1839                                                 if (isascii(c) && isalpha(c))
1840                                                         {
1841                                                         if (islower(c))
1842                                                                 c = toupper(c);
1843                                                         letters[c - 'A']++;
1844                                                         }
1845                                                 }
1846                                         for (i = 0; i < 26; i++)
1847                                                 if (letters[i] < 2)
1848                                                         letters[i] = 0;
1849                                                 else
1850                                                         letters[i] = 1;
1851                                         }
1852
1853                                 found_any = 0;
1854                                 fprintf(stderr,
1855                                         ", resulting proxy rights = ");
1856                                 for(i = 0; i < 26; i++)
1857                                         if (letters[i])
1858                                                 {
1859                                                 fprintf(stderr, "%c", i + 'A');
1860                                                 found_any = 1;
1861                                                 }
1862                                 if (!found_any)
1863                                         fprintf(stderr, "none");
1864                                 fprintf(stderr, "\n");
1865
1866                                 PROXY_CERT_INFO_EXTENSION_free(pci);
1867                                 }
1868                         }
1869                 }
1870
1871         return(ok);
1872         }
1873
1874 static void process_proxy_debug(int indent, const char *format, ...)
1875         {
1876         static const char indentation[] =
1877                 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"
1878                 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"; /* That's 80 > */
1879         char my_format[256];
1880         va_list args;
1881
1882         BIO_snprintf(my_format, sizeof(my_format), "%*.*s %s",
1883                 indent, indent, indentation, format);
1884
1885         va_start(args, format);
1886         vfprintf(stderr, my_format, args);
1887         va_end(args);
1888         }
1889 /* Priority levels:
1890    0    [!]var, ()
1891    1    & ^
1892    2    |
1893 */
1894 static int process_proxy_cond_adders(unsigned int letters[26],
1895         const char *cond, const char **cond_end, int *pos, int indent);
1896 static int process_proxy_cond_val(unsigned int letters[26],
1897         const char *cond, const char **cond_end, int *pos, int indent)
1898         {
1899         int c;
1900         int ok = 1;
1901         int negate = 0;
1902
1903         while(isspace((int)*cond))
1904                 {
1905                 cond++; (*pos)++;
1906                 }
1907         c = *cond;
1908
1909         if (debug)
1910                 process_proxy_debug(indent,
1911                         "Start process_proxy_cond_val at position %d: %s\n",
1912                         *pos, cond);
1913
1914         while(c == '!')
1915                 {
1916                 negate = !negate;
1917                 cond++; (*pos)++;
1918                 while(isspace((int)*cond))
1919                         {
1920                         cond++; (*pos)++;
1921                         }
1922                 c = *cond;
1923                 }
1924
1925         if (c == '(')
1926                 {
1927                 cond++; (*pos)++;
1928                 ok = process_proxy_cond_adders(letters, cond, cond_end, pos,
1929                         indent + 1);
1930                 cond = *cond_end;
1931                 if (ok < 0)
1932                         goto end;
1933                 while(isspace((int)*cond))
1934                         {
1935                         cond++; (*pos)++;
1936                         }
1937                 c = *cond;
1938                 if (c != ')')
1939                         {
1940                         fprintf(stderr,
1941                                 "Weird condition character in position %d: "
1942                                 "%c\n", *pos, c);
1943                         ok = -1;
1944                         goto end;
1945                         }
1946                 cond++; (*pos)++;
1947                 }
1948         else if (isascii(c) && isalpha(c))
1949                 {
1950                 if (islower(c))
1951                         c = toupper(c);
1952                 ok = letters[c - 'A'];
1953                 cond++; (*pos)++;
1954                 }
1955         else
1956                 {
1957                 fprintf(stderr,
1958                         "Weird condition character in position %d: "
1959                         "%c\n", *pos, c);
1960                 ok = -1;
1961                 goto end;
1962                 }
1963  end:
1964         *cond_end = cond;
1965         if (ok >= 0 && negate)
1966                 ok = !ok;
1967
1968         if (debug)
1969                 process_proxy_debug(indent,
1970                         "End process_proxy_cond_val at position %d: %s, returning %d\n",
1971                         *pos, cond, ok);
1972
1973         return ok;
1974         }
1975 static int process_proxy_cond_multipliers(unsigned int letters[26],
1976         const char *cond, const char **cond_end, int *pos, int indent)
1977         {
1978         int ok;
1979         char c;
1980
1981         if (debug)
1982                 process_proxy_debug(indent,
1983                         "Start process_proxy_cond_multipliers at position %d: %s\n",
1984                         *pos, cond);
1985
1986         ok = process_proxy_cond_val(letters, cond, cond_end, pos, indent + 1);
1987         cond = *cond_end;
1988         if (ok < 0)
1989                 goto end;
1990
1991         while(ok >= 0)
1992                 {
1993                 while(isspace((int)*cond))
1994                         {
1995                         cond++; (*pos)++;
1996                         }
1997                 c = *cond;
1998
1999                 switch(c)
2000                         {
2001                 case '&':
2002                 case '^':
2003                         {
2004                         int save_ok = ok;
2005
2006                         cond++; (*pos)++;
2007                         ok = process_proxy_cond_val(letters,
2008                                 cond, cond_end, pos, indent + 1);
2009                         cond = *cond_end;
2010                         if (ok < 0)
2011                                 break;
2012
2013                         switch(c)
2014                                 {
2015                         case '&':
2016                                 ok &= save_ok;
2017                                 break;
2018                         case '^':
2019                                 ok ^= save_ok;
2020                                 break;
2021                         default:
2022                                 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
2023                                         " STOPPING\n");
2024                                 EXIT(1);
2025                                 }
2026                         }
2027                         break;
2028                 default:
2029                         goto end;
2030                         }
2031                 }
2032  end:
2033         if (debug)
2034                 process_proxy_debug(indent,
2035                         "End process_proxy_cond_multipliers at position %d: %s, returning %d\n",
2036                         *pos, cond, ok);
2037
2038         *cond_end = cond;
2039         return ok;
2040         }
2041 static int process_proxy_cond_adders(unsigned int letters[26],
2042         const char *cond, const char **cond_end, int *pos, int indent)
2043         {
2044         int ok;
2045         char c;
2046
2047         if (debug)
2048                 process_proxy_debug(indent,
2049                         "Start process_proxy_cond_adders at position %d: %s\n",
2050                         *pos, cond);
2051
2052         ok = process_proxy_cond_multipliers(letters, cond, cond_end, pos,
2053                 indent + 1);
2054         cond = *cond_end;
2055         if (ok < 0)
2056                 goto end;
2057
2058         while(ok >= 0)
2059                 {
2060                 while(isspace((int)*cond))
2061                         {
2062                         cond++; (*pos)++;
2063                         }
2064                 c = *cond;
2065
2066                 switch(c)
2067                         {
2068                 case '|':
2069                         {
2070                         int save_ok = ok;
2071
2072                         cond++; (*pos)++;
2073                         ok = process_proxy_cond_multipliers(letters,
2074                                 cond, cond_end, pos, indent + 1);
2075                         cond = *cond_end;
2076                         if (ok < 0)
2077                                 break;
2078
2079                         switch(c)
2080                                 {
2081                         case '|':
2082                                 ok |= save_ok;
2083                                 break;
2084                         default:
2085                                 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
2086                                         " STOPPING\n");
2087                                 EXIT(1);
2088                                 }
2089                         }
2090                         break;
2091                 default:
2092                         goto end;
2093                         }
2094                 }
2095  end:
2096         if (debug)
2097                 process_proxy_debug(indent,
2098                         "End process_proxy_cond_adders at position %d: %s, returning %d\n",
2099                         *pos, cond, ok);
2100
2101         *cond_end = cond;
2102         return ok;
2103         }
2104
2105 static int process_proxy_cond(unsigned int letters[26],
2106         const char *cond, const char **cond_end)
2107         {
2108         int pos = 1;
2109         return process_proxy_cond_adders(letters, cond, cond_end, &pos, 1);
2110         }
2111
2112 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg)
2113         {
2114         int ok=1;
2115         struct app_verify_arg *cb_arg = arg;
2116         unsigned int letters[26]; /* only used with proxy_auth */
2117
2118         if (cb_arg->app_verify)
2119                 {
2120                 char *s = NULL,buf[256];
2121
2122                 fprintf(stderr, "In app_verify_callback, allowing cert. ");
2123                 fprintf(stderr, "Arg is: %s\n", cb_arg->string);
2124                 fprintf(stderr, "Finished printing do we have a context? 0x%p a cert? 0x%p\n",
2125                         (void *)ctx, (void *)ctx->cert);
2126                 if (ctx->cert)
2127                         s=X509_NAME_oneline(X509_get_subject_name(ctx->cert),buf,256);
2128                 if (s != NULL)
2129                         {
2130                         fprintf(stderr,"cert depth=%d %s\n",ctx->error_depth,buf);
2131                         }
2132                 return(1);
2133                 }
2134         if (cb_arg->proxy_auth)
2135                 {
2136                 int found_any = 0, i;
2137                 char *sp;
2138
2139                 for(i = 0; i < 26; i++)
2140                         letters[i] = 0;
2141                 for(sp = cb_arg->proxy_auth; *sp; sp++)
2142                         {
2143                         int c = *sp;
2144                         if (isascii(c) && isalpha(c))
2145                                 {
2146                                 if (islower(c))
2147                                         c = toupper(c);
2148                                 letters[c - 'A'] = 1;
2149                                 }
2150                         }
2151
2152                 fprintf(stderr,
2153                         "  Initial proxy rights = ");
2154                 for(i = 0; i < 26; i++)
2155                         if (letters[i])
2156                                 {
2157                                 fprintf(stderr, "%c", i + 'A');
2158                                 found_any = 1;
2159                                 }
2160                 if (!found_any)
2161                         fprintf(stderr, "none");
2162                 fprintf(stderr, "\n");
2163
2164                 X509_STORE_CTX_set_ex_data(ctx,
2165                         get_proxy_auth_ex_data_idx(),letters);
2166                 }
2167         if (cb_arg->allow_proxy_certs)
2168                 {
2169                 X509_STORE_CTX_set_flags(ctx, X509_V_FLAG_ALLOW_PROXY_CERTS);
2170                 }
2171
2172 #ifndef OPENSSL_NO_X509_VERIFY
2173 # ifdef OPENSSL_FIPS
2174         if(s->version == TLS1_VERSION)
2175                 FIPS_allow_md5(1);
2176 # endif
2177         ok = X509_verify_cert(ctx);
2178 # ifdef OPENSSL_FIPS
2179         if(s->version == TLS1_VERSION)
2180                 FIPS_allow_md5(0);
2181 # endif
2182 #endif
2183
2184         if (cb_arg->proxy_auth)
2185                 {
2186                 if (ok > 0)
2187                         {
2188                         const char *cond_end = NULL;
2189
2190                         ok = process_proxy_cond(letters,
2191                                 cb_arg->proxy_cond, &cond_end);
2192
2193                         if (ok < 0)
2194                                 EXIT(3);
2195                         if (*cond_end)
2196                                 {
2197                                 fprintf(stderr, "Stopped processing condition before it's end.\n");
2198                                 ok = 0;
2199                                 }
2200                         if (!ok)
2201                                 fprintf(stderr, "Proxy rights check with condition '%s' proved invalid\n",
2202                                         cb_arg->proxy_cond);
2203                         else
2204                                 fprintf(stderr, "Proxy rights check with condition '%s' proved valid\n",
2205                                         cb_arg->proxy_cond);
2206                         }
2207                 }
2208         return(ok);
2209         }
2210
2211 #ifndef OPENSSL_NO_RSA
2212 static RSA *rsa_tmp=NULL;
2213
2214 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength)
2215         {
2216         BIGNUM *bn = NULL;
2217         if (rsa_tmp == NULL)
2218                 {
2219                 bn = BN_new();
2220                 rsa_tmp = RSA_new();
2221                 if(!bn || !rsa_tmp || !BN_set_word(bn, RSA_F4))
2222                         {
2223                         BIO_printf(bio_err, "Memory error...");
2224                         goto end;
2225                         }
2226                 BIO_printf(bio_err,"Generating temp (%d bit) RSA key...",keylength);
2227                 (void)BIO_flush(bio_err);
2228                 if(!RSA_generate_key_ex(rsa_tmp,keylength,bn,NULL))
2229                         {
2230                         BIO_printf(bio_err, "Error generating key.");
2231                         RSA_free(rsa_tmp);
2232                         rsa_tmp = NULL;
2233                         }
2234 end:
2235                 BIO_printf(bio_err,"\n");
2236                 (void)BIO_flush(bio_err);
2237                 }
2238         if(bn) BN_free(bn);
2239         return(rsa_tmp);
2240         }
2241
2242 static void free_tmp_rsa(void)
2243         {
2244         if (rsa_tmp != NULL)
2245                 {
2246                 RSA_free(rsa_tmp);
2247                 rsa_tmp = NULL;
2248                 }
2249         }
2250 #endif
2251
2252 #ifndef OPENSSL_NO_DH
2253 /* These DH parameters have been generated as follows:
2254  *    $ openssl dhparam -C -noout 512
2255  *    $ openssl dhparam -C -noout 1024
2256  *    $ openssl dhparam -C -noout -dsaparam 1024
2257  * (The third function has been renamed to avoid name conflicts.)
2258  */
2259 static DH *get_dh512()
2260         {
2261         static unsigned char dh512_p[]={
2262                 0xCB,0xC8,0xE1,0x86,0xD0,0x1F,0x94,0x17,0xA6,0x99,0xF0,0xC6,
2263                 0x1F,0x0D,0xAC,0xB6,0x25,0x3E,0x06,0x39,0xCA,0x72,0x04,0xB0,
2264                 0x6E,0xDA,0xC0,0x61,0xE6,0x7A,0x77,0x25,0xE8,0x3B,0xB9,0x5F,
2265                 0x9A,0xB6,0xB5,0xFE,0x99,0x0B,0xA1,0x93,0x4E,0x35,0x33,0xB8,
2266                 0xE1,0xF1,0x13,0x4F,0x59,0x1A,0xD2,0x57,0xC0,0x26,0x21,0x33,
2267                 0x02,0xC5,0xAE,0x23,
2268                 };
2269         static unsigned char dh512_g[]={
2270                 0x02,
2271                 };
2272         DH *dh;
2273
2274         if ((dh=DH_new()) == NULL) return(NULL);
2275         dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
2276         dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
2277         if ((dh->p == NULL) || (dh->g == NULL))
2278                 { DH_free(dh); return(NULL); }
2279         return(dh);
2280         }
2281
2282 static DH *get_dh1024()
2283         {
2284         static unsigned char dh1024_p[]={
2285                 0xF8,0x81,0x89,0x7D,0x14,0x24,0xC5,0xD1,0xE6,0xF7,0xBF,0x3A,
2286                 0xE4,0x90,0xF4,0xFC,0x73,0xFB,0x34,0xB5,0xFA,0x4C,0x56,0xA2,
2287                 0xEA,0xA7,0xE9,0xC0,0xC0,0xCE,0x89,0xE1,0xFA,0x63,0x3F,0xB0,
2288                 0x6B,0x32,0x66,0xF1,0xD1,0x7B,0xB0,0x00,0x8F,0xCA,0x87,0xC2,
2289                 0xAE,0x98,0x89,0x26,0x17,0xC2,0x05,0xD2,0xEC,0x08,0xD0,0x8C,
2290                 0xFF,0x17,0x52,0x8C,0xC5,0x07,0x93,0x03,0xB1,0xF6,0x2F,0xB8,
2291                 0x1C,0x52,0x47,0x27,0x1B,0xDB,0xD1,0x8D,0x9D,0x69,0x1D,0x52,
2292                 0x4B,0x32,0x81,0xAA,0x7F,0x00,0xC8,0xDC,0xE6,0xD9,0xCC,0xC1,
2293                 0x11,0x2D,0x37,0x34,0x6C,0xEA,0x02,0x97,0x4B,0x0E,0xBB,0xB1,
2294                 0x71,0x33,0x09,0x15,0xFD,0xDD,0x23,0x87,0x07,0x5E,0x89,0xAB,
2295                 0x6B,0x7C,0x5F,0xEC,0xA6,0x24,0xDC,0x53,
2296                 };
2297         static unsigned char dh1024_g[]={
2298                 0x02,
2299                 };
2300         DH *dh;
2301
2302         if ((dh=DH_new()) == NULL) return(NULL);
2303         dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2304         dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2305         if ((dh->p == NULL) || (dh->g == NULL))
2306                 { DH_free(dh); return(NULL); }
2307         return(dh);
2308         }
2309
2310 static DH *get_dh1024dsa()
2311         {
2312         static unsigned char dh1024_p[]={
2313                 0xC8,0x00,0xF7,0x08,0x07,0x89,0x4D,0x90,0x53,0xF3,0xD5,0x00,
2314                 0x21,0x1B,0xF7,0x31,0xA6,0xA2,0xDA,0x23,0x9A,0xC7,0x87,0x19,
2315                 0x3B,0x47,0xB6,0x8C,0x04,0x6F,0xFF,0xC6,0x9B,0xB8,0x65,0xD2,
2316                 0xC2,0x5F,0x31,0x83,0x4A,0xA7,0x5F,0x2F,0x88,0x38,0xB6,0x55,
2317                 0xCF,0xD9,0x87,0x6D,0x6F,0x9F,0xDA,0xAC,0xA6,0x48,0xAF,0xFC,
2318                 0x33,0x84,0x37,0x5B,0x82,0x4A,0x31,0x5D,0xE7,0xBD,0x52,0x97,
2319                 0xA1,0x77,0xBF,0x10,0x9E,0x37,0xEA,0x64,0xFA,0xCA,0x28,0x8D,
2320                 0x9D,0x3B,0xD2,0x6E,0x09,0x5C,0x68,0xC7,0x45,0x90,0xFD,0xBB,
2321                 0x70,0xC9,0x3A,0xBB,0xDF,0xD4,0x21,0x0F,0xC4,0x6A,0x3C,0xF6,
2322                 0x61,0xCF,0x3F,0xD6,0x13,0xF1,0x5F,0xBC,0xCF,0xBC,0x26,0x9E,
2323                 0xBC,0x0B,0xBD,0xAB,0x5D,0xC9,0x54,0x39,
2324                 };
2325         static unsigned char dh1024_g[]={
2326                 0x3B,0x40,0x86,0xE7,0xF3,0x6C,0xDE,0x67,0x1C,0xCC,0x80,0x05,
2327                 0x5A,0xDF,0xFE,0xBD,0x20,0x27,0x74,0x6C,0x24,0xC9,0x03,0xF3,
2328                 0xE1,0x8D,0xC3,0x7D,0x98,0x27,0x40,0x08,0xB8,0x8C,0x6A,0xE9,
2329                 0xBB,0x1A,0x3A,0xD6,0x86,0x83,0x5E,0x72,0x41,0xCE,0x85,0x3C,
2330                 0xD2,0xB3,0xFC,0x13,0xCE,0x37,0x81,0x9E,0x4C,0x1C,0x7B,0x65,
2331                 0xD3,0xE6,0xA6,0x00,0xF5,0x5A,0x95,0x43,0x5E,0x81,0xCF,0x60,
2332                 0xA2,0x23,0xFC,0x36,0xA7,0x5D,0x7A,0x4C,0x06,0x91,0x6E,0xF6,
2333                 0x57,0xEE,0x36,0xCB,0x06,0xEA,0xF5,0x3D,0x95,0x49,0xCB,0xA7,
2334                 0xDD,0x81,0xDF,0x80,0x09,0x4A,0x97,0x4D,0xA8,0x22,0x72,0xA1,
2335                 0x7F,0xC4,0x70,0x56,0x70,0xE8,0x20,0x10,0x18,0x8F,0x2E,0x60,
2336                 0x07,0xE7,0x68,0x1A,0x82,0x5D,0x32,0xA2,
2337                 };
2338         DH *dh;
2339
2340         if ((dh=DH_new()) == NULL) return(NULL);
2341         dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2342         dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2343         if ((dh->p == NULL) || (dh->g == NULL))
2344                 { DH_free(dh); return(NULL); }
2345         dh->length = 160;
2346         return(dh);
2347         }
2348 #endif
2349
2350 #ifndef OPENSSL_NO_PSK
2351 /* convert the PSK key (psk_key) in ascii to binary (psk) */
2352 static int psk_key2bn(const char *pskkey, unsigned char *psk,
2353         unsigned int max_psk_len)
2354         {
2355         int ret;
2356         BIGNUM *bn = NULL;
2357
2358         ret = BN_hex2bn(&bn, pskkey);
2359         if (!ret)
2360                 {
2361                 BIO_printf(bio_err,"Could not convert PSK key '%s' to BIGNUM\n", pskkey);
2362                 if (bn)
2363                         BN_free(bn);
2364                 return 0;
2365                 }
2366         if (BN_num_bytes(bn) > (int)max_psk_len)
2367                 {
2368                 BIO_printf(bio_err,"psk buffer of callback is too small (%d) for key (%d)\n",
2369                         max_psk_len, BN_num_bytes(bn));
2370                 BN_free(bn);
2371                 return 0;
2372                 }
2373         ret = BN_bn2bin(bn, psk);
2374         BN_free(bn);
2375         return ret;
2376         }
2377
2378 static unsigned int psk_client_callback(SSL *ssl, const char *hint, char *identity,
2379         unsigned int max_identity_len, unsigned char *psk,
2380         unsigned int max_psk_len)
2381         {
2382         int ret;
2383         unsigned int psk_len = 0;
2384
2385         ret = BIO_snprintf(identity, max_identity_len, "Client_identity");
2386         if (ret < 0)
2387                 goto out_err;
2388         if (debug)
2389                 fprintf(stderr, "client: created identity '%s' len=%d\n", identity, ret);
2390         ret = psk_key2bn(psk_key, psk, max_psk_len);
2391         if (ret < 0)
2392                 goto out_err;
2393         psk_len = ret;
2394 out_err:
2395         return psk_len;
2396         }
2397
2398 static unsigned int psk_server_callback(SSL *ssl, const char *identity,
2399         unsigned char *psk, unsigned int max_psk_len)
2400         {
2401         unsigned int psk_len=0;
2402
2403         if (strcmp(identity, "Client_identity") != 0)
2404                 {
2405                 BIO_printf(bio_err, "server: PSK error: client identity not found\n");
2406                 return 0;
2407                 }
2408         psk_len=psk_key2bn(psk_key, psk, max_psk_len);
2409         return psk_len;
2410         }
2411 #endif
2412
2413 static int do_test_cipherlist(void)
2414         {
2415         int i = 0;
2416         const SSL_METHOD *meth;
2417         const SSL_CIPHER *ci, *tci = NULL;
2418
2419 #ifndef OPENSSL_NO_SSL2
2420         fprintf(stderr, "testing SSLv2 cipher list order: ");
2421         meth = SSLv2_method();
2422         while ((ci = meth->get_cipher(i++)) != NULL)
2423                 {
2424                 if (tci != NULL)
2425                         if (ci->id >= tci->id)
2426                                 {
2427                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2428                                 return 0;
2429                                 }
2430                 tci = ci;
2431                 }
2432         fprintf(stderr, "ok\n");
2433 #endif
2434 #ifndef OPENSSL_NO_SSL3
2435         fprintf(stderr, "testing SSLv3 cipher list order: ");
2436         meth = SSLv3_method();
2437         tci = NULL;
2438         while ((ci = meth->get_cipher(i++)) != NULL)
2439                 {
2440                 if (tci != NULL)
2441                         if (ci->id >= tci->id)
2442                                 {
2443                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2444                                 return 0;
2445                                 }
2446                 tci = ci;
2447                 }
2448         fprintf(stderr, "ok\n");
2449 #endif
2450 #ifndef OPENSSL_NO_TLS1
2451         fprintf(stderr, "testing TLSv1 cipher list order: ");
2452         meth = TLSv1_method();
2453         tci = NULL;
2454         while ((ci = meth->get_cipher(i++)) != NULL)
2455                 {
2456                 if (tci != NULL)
2457                         if (ci->id >= tci->id)
2458                                 {
2459                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2460                                 return 0;
2461                                 }
2462                 tci = ci;
2463                 }
2464         fprintf(stderr, "ok\n");
2465 #endif
2466
2467         return 1;
2468         }