21e4d6e921a5ca88230b0d23277f2b46c2397875
[openssl.git] / ssl / ssl_lib.c
1 /*! \file ssl/ssl_lib.c
2  *  \brief Version independent SSL functions.
3  */
4 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
5  * All rights reserved.
6  *
7  * This package is an SSL implementation written
8  * by Eric Young (eay@cryptsoft.com).
9  * The implementation was written so as to conform with Netscapes SSL.
10  * 
11  * This library is free for commercial and non-commercial use as long as
12  * the following conditions are aheared to.  The following conditions
13  * apply to all code found in this distribution, be it the RC4, RSA,
14  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
15  * included with this distribution is covered by the same copyright terms
16  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
17  * 
18  * Copyright remains Eric Young's, and as such any Copyright notices in
19  * the code are not to be removed.
20  * If this package is used in a product, Eric Young should be given attribution
21  * as the author of the parts of the library used.
22  * This can be in the form of a textual message at program startup or
23  * in documentation (online or textual) provided with the package.
24  * 
25  * Redistribution and use in source and binary forms, with or without
26  * modification, are permitted provided that the following conditions
27  * are met:
28  * 1. Redistributions of source code must retain the copyright
29  *    notice, this list of conditions and the following disclaimer.
30  * 2. Redistributions in binary form must reproduce the above copyright
31  *    notice, this list of conditions and the following disclaimer in the
32  *    documentation and/or other materials provided with the distribution.
33  * 3. All advertising materials mentioning features or use of this software
34  *    must display the following acknowledgement:
35  *    "This product includes cryptographic software written by
36  *     Eric Young (eay@cryptsoft.com)"
37  *    The word 'cryptographic' can be left out if the rouines from the library
38  *    being used are not cryptographic related :-).
39  * 4. If you include any Windows specific code (or a derivative thereof) from 
40  *    the apps directory (application code) you must include an acknowledgement:
41  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
42  * 
43  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
44  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
45  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
46  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
47  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
48  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
49  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
50  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
51  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
52  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
53  * SUCH DAMAGE.
54  * 
55  * The licence and distribution terms for any publically available version or
56  * derivative of this code cannot be changed.  i.e. this code cannot simply be
57  * copied and put under another distribution licence
58  * [including the GNU Public Licence.]
59  */
60
61
62 #include <assert.h>
63 #include <stdio.h>
64 #include <openssl/objects.h>
65 #include <openssl/lhash.h>
66 #include <openssl/x509v3.h>
67 #include "ssl_locl.h"
68
69 const char *SSL_version_str=OPENSSL_VERSION_TEXT;
70
71 static STACK_OF(CRYPTO_EX_DATA_FUNCS) *ssl_meth=NULL;
72 static STACK_OF(CRYPTO_EX_DATA_FUNCS) *ssl_ctx_meth=NULL;
73 static int ssl_meth_num=0;
74 static int ssl_ctx_meth_num=0;
75
76 OPENSSL_GLOBAL SSL3_ENC_METHOD ssl3_undef_enc_method={
77         /* evil casts, but these functions are only called if there's a library bug */
78         (int (*)(SSL *,int))ssl_undefined_function,
79         (int (*)(SSL *, unsigned char *, int))ssl_undefined_function,
80         ssl_undefined_function,
81         (int (*)(SSL *, unsigned char *, unsigned char *, int))ssl_undefined_function,
82         (int (*)(SSL*, int))ssl_undefined_function,
83         (int (*)(SSL *, EVP_MD_CTX *, EVP_MD_CTX *, const char*, int, unsigned char *))ssl_undefined_function
84         };
85
86 int SSL_clear(SSL *s)
87         {
88         int state;
89
90         if (s->method == NULL)
91                 {
92                 SSLerr(SSL_F_SSL_CLEAR,SSL_R_NO_METHOD_SPECIFIED);
93                 return(0);
94                 }
95
96         s->error=0;
97         s->hit=0;
98         s->shutdown=0;
99
100 #if 0 /* Disabled since version 1.10 of this file (early return not
101        * needed because SSL_clear is not called when doing renegotiation) */
102         /* This is set if we are doing dynamic renegotiation so keep
103          * the old cipher.  It is sort of a SSL_clear_lite :-) */
104         if (s->new_session) return(1);
105 #else
106         if (s->new_session)
107                 {
108                 SSLerr(SSL_F_SSL_CLEAR,SSL_R_INTERNAL_ERROR);
109                 return 0;
110                 }
111 #endif
112
113         state=s->state; /* Keep to check if we throw away the session-id */
114         s->type=0;
115
116         s->state=SSL_ST_BEFORE|((s->server)?SSL_ST_ACCEPT:SSL_ST_CONNECT);
117
118         s->version=s->method->version;
119         s->client_version=s->version;
120         s->rwstate=SSL_NOTHING;
121         s->rstate=SSL_ST_READ_HEADER;
122 #if 0
123         s->read_ahead=s->ctx->read_ahead;
124 #endif
125
126         if (s->init_buf != NULL)
127                 {
128                 BUF_MEM_free(s->init_buf);
129                 s->init_buf=NULL;
130                 }
131
132         ssl_clear_cipher_ctx(s);
133
134         if (ssl_clear_bad_session(s))
135                 {
136                 SSL_SESSION_free(s->session);
137                 s->session=NULL;
138                 }
139
140         s->first_packet=0;
141
142 #if 1
143         /* Check to see if we were changed into a different method, if
144          * so, revert back if we are not doing session-id reuse. */
145         if ((s->session == NULL) && (s->method != s->ctx->method))
146                 {
147                 s->method->ssl_free(s);
148                 s->method=s->ctx->method;
149                 if (!s->method->ssl_new(s))
150                         return(0);
151                 }
152         else
153 #endif
154                 s->method->ssl_clear(s);
155         return(1);
156         }
157
158 /** Used to change an SSL_CTXs default SSL method type */
159 int SSL_CTX_set_ssl_version(SSL_CTX *ctx,SSL_METHOD *meth)
160         {
161         STACK_OF(SSL_CIPHER) *sk;
162
163         ctx->method=meth;
164
165         sk=ssl_create_cipher_list(ctx->method,&(ctx->cipher_list),
166                 &(ctx->cipher_list_by_id),SSL_DEFAULT_CIPHER_LIST);
167         if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0))
168                 {
169                 SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION,SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
170                 return(0);
171                 }
172         return(1);
173         }
174
175 SSL *SSL_new(SSL_CTX *ctx)
176         {
177         SSL *s;
178
179         if (ctx == NULL)
180                 {
181                 SSLerr(SSL_F_SSL_NEW,SSL_R_NULL_SSL_CTX);
182                 return(NULL);
183                 }
184         if (ctx->method == NULL)
185                 {
186                 SSLerr(SSL_F_SSL_NEW,SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION);
187                 return(NULL);
188                 }
189
190         s=(SSL *)OPENSSL_malloc(sizeof(SSL));
191         if (s == NULL) goto err;
192         memset(s,0,sizeof(SSL));
193
194 #ifndef OPENSSL_NO_KRB5
195         s->kssl_ctx = kssl_ctx_new();
196 #endif  /* OPENSSL_NO_KRB5 */
197
198         if (ctx->cert != NULL)
199                 {
200                 /* Earlier library versions used to copy the pointer to
201                  * the CERT, not its contents; only when setting new
202                  * parameters for the per-SSL copy, ssl_cert_new would be
203                  * called (and the direct reference to the per-SSL_CTX
204                  * settings would be lost, but those still were indirectly
205                  * accessed for various purposes, and for that reason they
206                  * used to be known as s->ctx->default_cert).
207                  * Now we don't look at the SSL_CTX's CERT after having
208                  * duplicated it once. */
209
210                 s->cert = ssl_cert_dup(ctx->cert);
211                 if (s->cert == NULL)
212                         goto err;
213                 }
214         else
215                 s->cert=NULL; /* Cannot really happen (see SSL_CTX_new) */
216         s->sid_ctx_length=ctx->sid_ctx_length;
217         memcpy(&s->sid_ctx,&ctx->sid_ctx,sizeof(s->sid_ctx));
218         s->verify_mode=ctx->verify_mode;
219         s->verify_depth=ctx->verify_depth;
220         s->verify_callback=ctx->default_verify_callback;
221         s->purpose = ctx->purpose;
222         s->trust = ctx->trust;
223         CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
224         s->ctx=ctx;
225
226         s->verify_result=X509_V_OK;
227
228         s->method=ctx->method;
229
230         if (!s->method->ssl_new(s))
231                 goto err;
232
233         s->quiet_shutdown=ctx->quiet_shutdown;
234         s->references=1;
235         s->server=(ctx->method->ssl_accept == ssl_undefined_function)?0:1;
236         s->options=ctx->options;
237         s->mode=ctx->mode;
238         s->read_ahead=ctx->read_ahead; /* used to happen in SSL_clear */
239         SSL_clear(s);
240
241         CRYPTO_new_ex_data(ssl_meth,s,&s->ex_data);
242
243         return(s);
244 err:
245         if (s != NULL)
246                 {
247                 if (s->cert != NULL)
248                         ssl_cert_free(s->cert);
249                 if (s->ctx != NULL)
250                         SSL_CTX_free(s->ctx); /* decrement reference count */
251                 OPENSSL_free(s);
252                 }
253         SSLerr(SSL_F_SSL_NEW,ERR_R_MALLOC_FAILURE);
254         return(NULL);
255         }
256
257 int SSL_CTX_set_session_id_context(SSL_CTX *ctx,const unsigned char *sid_ctx,
258                                    unsigned int sid_ctx_len)
259     {
260     if(sid_ctx_len > SSL_MAX_SID_CTX_LENGTH)
261         {
262         SSLerr(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT,SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
263         return 0;
264         }
265     ctx->sid_ctx_length=sid_ctx_len;
266     memcpy(ctx->sid_ctx,sid_ctx,sid_ctx_len);
267
268     return 1;
269     }
270
271 int SSL_set_session_id_context(SSL *ssl,const unsigned char *sid_ctx,
272                                unsigned int sid_ctx_len)
273     {
274     if(sid_ctx_len > SSL_MAX_SID_CTX_LENGTH)
275         {
276         SSLerr(SSL_F_SSL_SET_SESSION_ID_CONTEXT,SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
277         return 0;
278         }
279     ssl->sid_ctx_length=sid_ctx_len;
280     memcpy(ssl->sid_ctx,sid_ctx,sid_ctx_len);
281
282     return 1;
283     }
284
285 int SSL_CTX_set_purpose(SSL_CTX *s, int purpose)
286 {
287         if(X509_PURPOSE_get_by_id(purpose) == -1) {
288                 SSLerr(SSL_F_SSL_CTX_SET_PURPOSE, SSL_R_INVALID_PURPOSE);
289                 return 0;
290         }
291         s->purpose = purpose;
292         return 1;
293 }
294
295 int SSL_set_purpose(SSL *s, int purpose)
296 {
297         if(X509_PURPOSE_get_by_id(purpose) == -1) {
298                 SSLerr(SSL_F_SSL_SET_PURPOSE, SSL_R_INVALID_PURPOSE);
299                 return 0;
300         }
301         s->purpose = purpose;
302         return 1;
303 }
304         
305 int SSL_CTX_set_trust(SSL_CTX *s, int trust)
306 {
307         if(X509_TRUST_get_by_id(trust) == -1) {
308                 SSLerr(SSL_F_SSL_CTX_SET_TRUST, SSL_R_INVALID_TRUST);
309                 return 0;
310         }
311         s->trust = trust;
312         return 1;
313 }
314
315 int SSL_set_trust(SSL *s, int trust)
316 {
317         if(X509_TRUST_get_by_id(trust) == -1) {
318                 SSLerr(SSL_F_SSL_SET_TRUST, SSL_R_INVALID_TRUST);
319                 return 0;
320         }
321         s->trust = trust;
322         return 1;
323 }
324
325 void SSL_free(SSL *s)
326         {
327         int i;
328
329         if(s == NULL)
330             return;
331
332         i=CRYPTO_add(&s->references,-1,CRYPTO_LOCK_SSL);
333 #ifdef REF_PRINT
334         REF_PRINT("SSL",s);
335 #endif
336         if (i > 0) return;
337 #ifdef REF_CHECK
338         if (i < 0)
339                 {
340                 fprintf(stderr,"SSL_free, bad reference count\n");
341                 abort(); /* ok */
342                 }
343 #endif
344
345         CRYPTO_free_ex_data(ssl_meth,(char *)s,&s->ex_data);
346
347         if (s->bbio != NULL)
348                 {
349                 /* If the buffering BIO is in place, pop it off */
350                 if (s->bbio == s->wbio)
351                         {
352                         s->wbio=BIO_pop(s->wbio);
353                         }
354                 BIO_free(s->bbio);
355                 s->bbio=NULL;
356                 }
357         if (s->rbio != NULL)
358                 BIO_free_all(s->rbio);
359         if ((s->wbio != NULL) && (s->wbio != s->rbio))
360                 BIO_free_all(s->wbio);
361
362         if (s->init_buf != NULL) BUF_MEM_free(s->init_buf);
363
364         /* add extra stuff */
365         if (s->cipher_list != NULL) sk_SSL_CIPHER_free(s->cipher_list);
366         if (s->cipher_list_by_id != NULL) sk_SSL_CIPHER_free(s->cipher_list_by_id);
367
368         /* Make the next call work :-) */
369         if (s->session != NULL)
370                 {
371                 ssl_clear_bad_session(s);
372                 SSL_SESSION_free(s->session);
373                 }
374
375         ssl_clear_cipher_ctx(s);
376
377         if (s->cert != NULL) ssl_cert_free(s->cert);
378         /* Free up if allocated */
379
380         if (s->ctx) SSL_CTX_free(s->ctx);
381
382         if (s->client_CA != NULL)
383                 sk_X509_NAME_pop_free(s->client_CA,X509_NAME_free);
384
385         if (s->method != NULL) s->method->ssl_free(s);
386
387         OPENSSL_free(s);
388         }
389
390 void SSL_set_bio(SSL *s,BIO *rbio,BIO *wbio)
391         {
392         /* If the output buffering BIO is still in place, remove it
393          */
394         if (s->bbio != NULL)
395                 {
396                 if (s->wbio == s->bbio)
397                         {
398                         s->wbio=s->wbio->next_bio;
399                         s->bbio->next_bio=NULL;
400                         }
401                 }
402         if ((s->rbio != NULL) && (s->rbio != rbio))
403                 BIO_free_all(s->rbio);
404         if ((s->wbio != NULL) && (s->wbio != wbio) && (s->rbio != s->wbio))
405                 BIO_free_all(s->wbio);
406         s->rbio=rbio;
407         s->wbio=wbio;
408         }
409
410 BIO *SSL_get_rbio(SSL *s)
411         { return(s->rbio); }
412
413 BIO *SSL_get_wbio(SSL *s)
414         { return(s->wbio); }
415
416 int SSL_get_fd(SSL *s)
417         {
418         int ret= -1;
419         BIO *b,*r;
420
421         b=SSL_get_rbio(s);
422         r=BIO_find_type(b,BIO_TYPE_DESCRIPTOR);
423         if (r != NULL)
424                 BIO_get_fd(r,&ret);
425         return(ret);
426         }
427
428 #ifndef OPENSSL_NO_SOCK
429 int SSL_set_fd(SSL *s,int fd)
430         {
431         int ret=0;
432         BIO *bio=NULL;
433
434         bio=BIO_new(BIO_s_socket());
435
436         if (bio == NULL)
437                 {
438                 SSLerr(SSL_F_SSL_SET_FD,ERR_R_BUF_LIB);
439                 goto err;
440                 }
441         BIO_set_fd(bio,fd,BIO_NOCLOSE);
442         SSL_set_bio(s,bio,bio);
443         ret=1;
444 err:
445         return(ret);
446         }
447
448 int SSL_set_wfd(SSL *s,int fd)
449         {
450         int ret=0;
451         BIO *bio=NULL;
452
453         if ((s->rbio == NULL) || (BIO_method_type(s->rbio) != BIO_TYPE_SOCKET)
454                 || ((int)BIO_get_fd(s->rbio,NULL) != fd))
455                 {
456                 bio=BIO_new(BIO_s_socket());
457
458                 if (bio == NULL)
459                         { SSLerr(SSL_F_SSL_SET_WFD,ERR_R_BUF_LIB); goto err; }
460                 BIO_set_fd(bio,fd,BIO_NOCLOSE);
461                 SSL_set_bio(s,SSL_get_rbio(s),bio);
462                 }
463         else
464                 SSL_set_bio(s,SSL_get_rbio(s),SSL_get_rbio(s));
465         ret=1;
466 err:
467         return(ret);
468         }
469
470 int SSL_set_rfd(SSL *s,int fd)
471         {
472         int ret=0;
473         BIO *bio=NULL;
474
475         if ((s->wbio == NULL) || (BIO_method_type(s->wbio) != BIO_TYPE_SOCKET)
476                 || ((int)BIO_get_fd(s->wbio,NULL) != fd))
477                 {
478                 bio=BIO_new(BIO_s_socket());
479
480                 if (bio == NULL)
481                         {
482                         SSLerr(SSL_F_SSL_SET_RFD,ERR_R_BUF_LIB);
483                         goto err;
484                         }
485                 BIO_set_fd(bio,fd,BIO_NOCLOSE);
486                 SSL_set_bio(s,bio,SSL_get_wbio(s));
487                 }
488         else
489                 SSL_set_bio(s,SSL_get_wbio(s),SSL_get_wbio(s));
490         ret=1;
491 err:
492         return(ret);
493         }
494 #endif
495
496
497 /* return length of latest Finished message we sent, copy to 'buf' */
498 size_t SSL_get_finished(SSL *s, void *buf, size_t count)
499         {
500         size_t ret = 0;
501         
502         if (s->s3 != NULL)
503                 {
504                 ret = s->s3->tmp.finish_md_len;
505                 if (count > ret)
506                         count = ret;
507                 memcpy(buf, s->s3->tmp.finish_md, count);
508                 }
509         return ret;
510         }
511
512 /* return length of latest Finished message we expected, copy to 'buf' */
513 size_t SSL_get_peer_finished(SSL *s, void *buf, size_t count)
514         {
515         size_t ret = 0;
516         
517         if (s->s3 != NULL)
518                 {
519                 ret = s->s3->tmp.peer_finish_md_len;
520                 if (count > ret)
521                         count = ret;
522                 memcpy(buf, s->s3->tmp.peer_finish_md, count);
523                 }
524         return ret;
525         }
526
527
528 int SSL_get_verify_mode(SSL *s)
529         {
530         return(s->verify_mode);
531         }
532
533 int SSL_get_verify_depth(SSL *s)
534         {
535         return(s->verify_depth);
536         }
537
538 int (*SSL_get_verify_callback(SSL *s))(int,X509_STORE_CTX *)
539         {
540         return(s->verify_callback);
541         }
542
543 int SSL_CTX_get_verify_mode(SSL_CTX *ctx)
544         {
545         return(ctx->verify_mode);
546         }
547
548 int SSL_CTX_get_verify_depth(SSL_CTX *ctx)
549         {
550         return(ctx->verify_depth);
551         }
552
553 int (*SSL_CTX_get_verify_callback(SSL_CTX *ctx))(int,X509_STORE_CTX *)
554         {
555         return(ctx->default_verify_callback);
556         }
557
558 void SSL_set_verify(SSL *s,int mode,
559                     int (*callback)(int ok,X509_STORE_CTX *ctx))
560         {
561         s->verify_mode=mode;
562         if (callback != NULL)
563                 s->verify_callback=callback;
564         }
565
566 void SSL_set_verify_depth(SSL *s,int depth)
567         {
568         s->verify_depth=depth;
569         }
570
571 void SSL_set_read_ahead(SSL *s,int yes)
572         {
573         s->read_ahead=yes;
574         }
575
576 int SSL_get_read_ahead(SSL *s)
577         {
578         return(s->read_ahead);
579         }
580
581 int SSL_pending(SSL *s)
582         {
583         /* SSL_pending cannot work properly if read-ahead is enabled
584          * (SSL_[CTX_]ctrl(..., SSL_CTRL_SET_READ_AHEAD, 1, NULL)),
585          * and it is impossible to fix since SSL_pending cannot report
586          * errors that may be observed while scanning the new data.
587          * (Note that SSL_pending() is often used as a boolean value,
588          * so we'd better not return -1.)
589          */
590         return(s->method->ssl_pending(s));
591         }
592
593 X509 *SSL_get_peer_certificate(SSL *s)
594         {
595         X509 *r;
596         
597         if ((s == NULL) || (s->session == NULL))
598                 r=NULL;
599         else
600                 r=s->session->peer;
601
602         if (r == NULL) return(r);
603
604         CRYPTO_add(&r->references,1,CRYPTO_LOCK_X509);
605
606         return(r);
607         }
608
609 STACK_OF(X509) *SSL_get_peer_cert_chain(SSL *s)
610         {
611         STACK_OF(X509) *r;
612         
613         if ((s == NULL) || (s->session == NULL) || (s->session->sess_cert == NULL))
614                 r=NULL;
615         else
616                 r=s->session->sess_cert->cert_chain;
617
618         /* If we are a client, cert_chain includes the peer's own
619          * certificate; if we are a server, it does not. */
620         
621         return(r);
622         }
623
624 /* Now in theory, since the calling process own 't' it should be safe to
625  * modify.  We need to be able to read f without being hassled */
626 void SSL_copy_session_id(SSL *t,SSL *f)
627         {
628         CERT *tmp;
629
630         /* Do we need to to SSL locking? */
631         SSL_set_session(t,SSL_get_session(f));
632
633         /* what if we are setup as SSLv2 but want to talk SSLv3 or
634          * vice-versa */
635         if (t->method != f->method)
636                 {
637                 t->method->ssl_free(t); /* cleanup current */
638                 t->method=f->method;    /* change method */
639                 t->method->ssl_new(t);  /* setup new */
640                 }
641
642         tmp=t->cert;
643         if (f->cert != NULL)
644                 {
645                 CRYPTO_add(&f->cert->references,1,CRYPTO_LOCK_SSL_CERT);
646                 t->cert=f->cert;
647                 }
648         else
649                 t->cert=NULL;
650         if (tmp != NULL) ssl_cert_free(tmp);
651         SSL_set_session_id_context(t,f->sid_ctx,f->sid_ctx_length);
652         }
653
654 /* Fix this so it checks all the valid key/cert options */
655 int SSL_CTX_check_private_key(SSL_CTX *ctx)
656         {
657         if (    (ctx == NULL) ||
658                 (ctx->cert == NULL) ||
659                 (ctx->cert->key->x509 == NULL))
660                 {
661                 SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED);
662                 return(0);
663                 }
664         if      (ctx->cert->key->privatekey == NULL)
665                 {
666                 SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY,SSL_R_NO_PRIVATE_KEY_ASSIGNED);
667                 return(0);
668                 }
669         return(X509_check_private_key(ctx->cert->key->x509, ctx->cert->key->privatekey));
670         }
671
672 /* Fix this function so that it takes an optional type parameter */
673 int SSL_check_private_key(SSL *ssl)
674         {
675         if (ssl == NULL)
676                 {
677                 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,ERR_R_PASSED_NULL_PARAMETER);
678                 return(0);
679                 }
680         if (ssl->cert == NULL)
681                 {
682                 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED);
683                 return 0;
684                 }
685         if (ssl->cert->key->x509 == NULL)
686                 {
687                 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED);
688                 return(0);
689                 }
690         if (ssl->cert->key->privatekey == NULL)
691                 {
692                 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_PRIVATE_KEY_ASSIGNED);
693                 return(0);
694                 }
695         return(X509_check_private_key(ssl->cert->key->x509,
696                 ssl->cert->key->privatekey));
697         }
698
699 int SSL_accept(SSL *s)
700         {
701         if (s->handshake_func == 0)
702                 /* Not properly initialized yet */
703                 SSL_set_accept_state(s);
704
705         return(s->method->ssl_accept(s));
706         }
707
708 int SSL_connect(SSL *s)
709         {
710         if (s->handshake_func == 0)
711                 /* Not properly initialized yet */
712                 SSL_set_connect_state(s);
713
714         return(s->method->ssl_connect(s));
715         }
716
717 long SSL_get_default_timeout(SSL *s)
718         {
719         return(s->method->get_timeout());
720         }
721
722 int SSL_read(SSL *s,char *buf,int num)
723         {
724         if (s->handshake_func == 0)
725                 {
726                 SSLerr(SSL_F_SSL_READ, SSL_R_UNINITIALIZED);
727                 return -1;
728                 }
729
730         if (s->shutdown & SSL_RECEIVED_SHUTDOWN)
731                 {
732                 s->rwstate=SSL_NOTHING;
733                 return(0);
734                 }
735         return(s->method->ssl_read(s,buf,num));
736         }
737
738 int SSL_peek(SSL *s,char *buf,int num)
739         {
740         if (s->shutdown & SSL_RECEIVED_SHUTDOWN)
741                 {
742                 return(0);
743                 }
744         return(s->method->ssl_peek(s,buf,num));
745         }
746
747 int SSL_write(SSL *s,const char *buf,int num)
748         {
749         if (s->handshake_func == 0)
750                 {
751                 SSLerr(SSL_F_SSL_WRITE, SSL_R_UNINITIALIZED);
752                 return -1;
753                 }
754
755         if (s->shutdown & SSL_SENT_SHUTDOWN)
756                 {
757                 s->rwstate=SSL_NOTHING;
758                 SSLerr(SSL_F_SSL_WRITE,SSL_R_PROTOCOL_IS_SHUTDOWN);
759                 return(-1);
760                 }
761         return(s->method->ssl_write(s,buf,num));
762         }
763
764 int SSL_shutdown(SSL *s)
765         {
766         /* Note that this function behaves differently from what one might
767          * expect.  Return values are 0 for no success (yet),
768          * 1 for success; but calling it once is usually not enough,
769          * even if blocking I/O is used (see ssl3_shutdown).
770          */
771
772         if (s->handshake_func == 0)
773                 {
774                 SSLerr(SSL_F_SSL_SHUTDOWN, SSL_R_UNINITIALIZED);
775                 return -1;
776                 }
777
778         if ((s != NULL) && !SSL_in_init(s))
779                 return(s->method->ssl_shutdown(s));
780         else
781                 return(1);
782         }
783
784 int SSL_renegotiate(SSL *s)
785         {
786         s->new_session=1;
787         return(s->method->ssl_renegotiate(s));
788         }
789
790 long SSL_ctrl(SSL *s,int cmd,long larg,char *parg)
791         {
792         long l;
793
794         switch (cmd)
795                 {
796         case SSL_CTRL_GET_READ_AHEAD:
797                 return(s->read_ahead);
798         case SSL_CTRL_SET_READ_AHEAD:
799                 l=s->read_ahead;
800                 s->read_ahead=larg;
801                 return(l);
802         case SSL_CTRL_OPTIONS:
803                 return(s->options|=larg);
804         case SSL_CTRL_MODE:
805                 return(s->mode|=larg);
806         default:
807                 return(s->method->ssl_ctrl(s,cmd,larg,parg));
808                 }
809         }
810
811 long SSL_callback_ctrl(SSL *s, int cmd, void (*fp)())
812         {
813         switch(cmd)
814                 {
815         default:
816                 return(s->method->ssl_callback_ctrl(s,cmd,fp));
817                 }
818         }
819
820 struct lhash_st *SSL_CTX_sessions(SSL_CTX *ctx)
821         {
822         return ctx->sessions;
823         }
824
825 long SSL_CTX_ctrl(SSL_CTX *ctx,int cmd,long larg,char *parg)
826         {
827         long l;
828
829         switch (cmd)
830                 {
831         case SSL_CTRL_GET_READ_AHEAD:
832                 return(ctx->read_ahead);
833         case SSL_CTRL_SET_READ_AHEAD:
834                 l=ctx->read_ahead;
835                 ctx->read_ahead=larg;
836                 return(l);
837
838         case SSL_CTRL_SET_SESS_CACHE_SIZE:
839                 l=ctx->session_cache_size;
840                 ctx->session_cache_size=larg;
841                 return(l);
842         case SSL_CTRL_GET_SESS_CACHE_SIZE:
843                 return(ctx->session_cache_size);
844         case SSL_CTRL_SET_SESS_CACHE_MODE:
845                 l=ctx->session_cache_mode;
846                 ctx->session_cache_mode=larg;
847                 return(l);
848         case SSL_CTRL_GET_SESS_CACHE_MODE:
849                 return(ctx->session_cache_mode);
850
851         case SSL_CTRL_SESS_NUMBER:
852                 return(ctx->sessions->num_items);
853         case SSL_CTRL_SESS_CONNECT:
854                 return(ctx->stats.sess_connect);
855         case SSL_CTRL_SESS_CONNECT_GOOD:
856                 return(ctx->stats.sess_connect_good);
857         case SSL_CTRL_SESS_CONNECT_RENEGOTIATE:
858                 return(ctx->stats.sess_connect_renegotiate);
859         case SSL_CTRL_SESS_ACCEPT:
860                 return(ctx->stats.sess_accept);
861         case SSL_CTRL_SESS_ACCEPT_GOOD:
862                 return(ctx->stats.sess_accept_good);
863         case SSL_CTRL_SESS_ACCEPT_RENEGOTIATE:
864                 return(ctx->stats.sess_accept_renegotiate);
865         case SSL_CTRL_SESS_HIT:
866                 return(ctx->stats.sess_hit);
867         case SSL_CTRL_SESS_CB_HIT:
868                 return(ctx->stats.sess_cb_hit);
869         case SSL_CTRL_SESS_MISSES:
870                 return(ctx->stats.sess_miss);
871         case SSL_CTRL_SESS_TIMEOUTS:
872                 return(ctx->stats.sess_timeout);
873         case SSL_CTRL_SESS_CACHE_FULL:
874                 return(ctx->stats.sess_cache_full);
875         case SSL_CTRL_OPTIONS:
876                 return(ctx->options|=larg);
877         case SSL_CTRL_MODE:
878                 return(ctx->mode|=larg);
879         default:
880                 return(ctx->method->ssl_ctx_ctrl(ctx,cmd,larg,parg));
881                 }
882         }
883
884 long SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)())
885         {
886         switch(cmd)
887                 {
888         default:
889                 return(ctx->method->ssl_ctx_callback_ctrl(ctx,cmd,fp));
890                 }
891         }
892
893 int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b)
894         {
895         long l;
896
897         l=a->id-b->id;
898         if (l == 0L)
899                 return(0);
900         else
901                 return((l > 0)?1:-1);
902         }
903
904 int ssl_cipher_ptr_id_cmp(const SSL_CIPHER * const *ap,
905                         const SSL_CIPHER * const *bp)
906         {
907         long l;
908
909         l=(*ap)->id-(*bp)->id;
910         if (l == 0L)
911                 return(0);
912         else
913                 return((l > 0)?1:-1);
914         }
915
916 /** return a STACK of the ciphers available for the SSL and in order of
917  * preference */
918 STACK_OF(SSL_CIPHER) *SSL_get_ciphers(SSL *s)
919         {
920         if ((s != NULL) && (s->cipher_list != NULL))
921                 {
922                 return(s->cipher_list);
923                 }
924         else if ((s->ctx != NULL) &&
925                 (s->ctx->cipher_list != NULL))
926                 {
927                 return(s->ctx->cipher_list);
928                 }
929         return(NULL);
930         }
931
932 /** return a STACK of the ciphers available for the SSL and in order of
933  * algorithm id */
934 STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s)
935         {
936         if ((s != NULL) && (s->cipher_list_by_id != NULL))
937                 {
938                 return(s->cipher_list_by_id);
939                 }
940         else if ((s != NULL) && (s->ctx != NULL) &&
941                 (s->ctx->cipher_list_by_id != NULL))
942                 {
943                 return(s->ctx->cipher_list_by_id);
944                 }
945         return(NULL);
946         }
947
948 /** The old interface to get the same thing as SSL_get_ciphers() */
949 const char *SSL_get_cipher_list(SSL *s,int n)
950         {
951         SSL_CIPHER *c;
952         STACK_OF(SSL_CIPHER) *sk;
953
954         if (s == NULL) return(NULL);
955         sk=SSL_get_ciphers(s);
956         if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= n))
957                 return(NULL);
958         c=sk_SSL_CIPHER_value(sk,n);
959         if (c == NULL) return(NULL);
960         return(c->name);
961         }
962
963 /** specify the ciphers to be used by default by the SSL_CTX */
964 int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str)
965         {
966         STACK_OF(SSL_CIPHER) *sk;
967         
968         sk=ssl_create_cipher_list(ctx->method,&ctx->cipher_list,
969                 &ctx->cipher_list_by_id,str);
970 /* XXXX */
971         return((sk == NULL)?0:1);
972         }
973
974 /** specify the ciphers to be used by the SSL */
975 int SSL_set_cipher_list(SSL *s,const char *str)
976         {
977         STACK_OF(SSL_CIPHER) *sk;
978         
979         sk=ssl_create_cipher_list(s->ctx->method,&s->cipher_list,
980                 &s->cipher_list_by_id,str);
981 /* XXXX */
982         return((sk == NULL)?0:1);
983         }
984
985 /* works well for SSLv2, not so good for SSLv3 */
986 char *SSL_get_shared_ciphers(SSL *s,char *buf,int len)
987         {
988         char *p;
989         const char *cp;
990         STACK_OF(SSL_CIPHER) *sk;
991         SSL_CIPHER *c;
992         int i;
993
994         if ((s->session == NULL) || (s->session->ciphers == NULL) ||
995                 (len < 2))
996                 return(NULL);
997
998         p=buf;
999         sk=s->session->ciphers;
1000         for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
1001                 {
1002                 /* Decrement for either the ':' or a '\0' */
1003                 len--;
1004                 c=sk_SSL_CIPHER_value(sk,i);
1005                 for (cp=c->name; *cp; )
1006                         {
1007                         if (len-- == 0)
1008                                 {
1009                                 *p='\0';
1010                                 return(buf);
1011                                 }
1012                         else
1013                                 *(p++)= *(cp++);
1014                         }
1015                 *(p++)=':';
1016                 }
1017         p[-1]='\0';
1018         return(buf);
1019         }
1020
1021 int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_CIPHER) *sk,unsigned char *p)
1022         {
1023         int i,j=0;
1024         SSL_CIPHER *c;
1025         unsigned char *q;
1026
1027         if (sk == NULL) return(0);
1028         q=p;
1029
1030         for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
1031                 {
1032                 c=sk_SSL_CIPHER_value(sk,i);
1033                 j=ssl_put_cipher_by_char(s,c,p);
1034                 p+=j;
1035                 }
1036         return(p-q);
1037         }
1038
1039 STACK_OF(SSL_CIPHER) *ssl_bytes_to_cipher_list(SSL *s,unsigned char *p,int num,
1040                                                STACK_OF(SSL_CIPHER) **skp)
1041         {
1042         SSL_CIPHER *c;
1043         STACK_OF(SSL_CIPHER) *sk;
1044         int i,n;
1045
1046         n=ssl_put_cipher_by_char(s,NULL,NULL);
1047         if ((num%n) != 0)
1048                 {
1049                 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST);
1050                 return(NULL);
1051                 }
1052         if ((skp == NULL) || (*skp == NULL))
1053                 sk=sk_SSL_CIPHER_new_null(); /* change perhaps later */
1054         else
1055                 {
1056                 sk= *skp;
1057                 sk_SSL_CIPHER_zero(sk);
1058                 }
1059
1060         for (i=0; i<num; i+=n)
1061                 {
1062                 c=ssl_get_cipher_by_char(s,p);
1063                 p+=n;
1064                 if (c != NULL)
1065                         {
1066                         if (!sk_SSL_CIPHER_push(sk,c))
1067                                 {
1068                                 SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
1069                                 goto err;
1070                                 }
1071                         }
1072                 }
1073
1074         if (skp != NULL)
1075                 *skp=sk;
1076         return(sk);
1077 err:
1078         if ((skp == NULL) || (*skp == NULL))
1079                 sk_SSL_CIPHER_free(sk);
1080         return(NULL);
1081         }
1082
1083 unsigned long SSL_SESSION_hash(SSL_SESSION *a)
1084         {
1085         unsigned long l;
1086
1087         l=(unsigned long)
1088                 ((unsigned int) a->session_id[0]     )|
1089                 ((unsigned int) a->session_id[1]<< 8L)|
1090                 ((unsigned long)a->session_id[2]<<16L)|
1091                 ((unsigned long)a->session_id[3]<<24L);
1092         return(l);
1093         }
1094
1095 int SSL_SESSION_cmp(SSL_SESSION *a,SSL_SESSION *b)
1096         {
1097         if (a->ssl_version != b->ssl_version)
1098                 return(1);
1099         if (a->session_id_length != b->session_id_length)
1100                 return(1);
1101         return(memcmp(a->session_id,b->session_id,a->session_id_length));
1102         }
1103
1104 /* These wrapper functions should remain rather than redeclaring
1105  * SSL_SESSION_hash and SSL_SESSION_cmp for void* types and casting each
1106  * variable. The reason is that the functions aren't static, they're exposed via
1107  * ssl.h. */
1108 static IMPLEMENT_LHASH_HASH_FN(SSL_SESSION_hash, SSL_SESSION *)
1109 static IMPLEMENT_LHASH_COMP_FN(SSL_SESSION_cmp, SSL_SESSION *)
1110
1111 SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
1112         {
1113         SSL_CTX *ret=NULL;
1114         
1115         if (meth == NULL)
1116                 {
1117                 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_NULL_SSL_METHOD_PASSED);
1118                 return(NULL);
1119                 }
1120
1121         if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0)
1122                 {
1123                 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
1124                 goto err;
1125                 }
1126         ret=(SSL_CTX *)OPENSSL_malloc(sizeof(SSL_CTX));
1127         if (ret == NULL)
1128                 goto err;
1129
1130         memset(ret,0,sizeof(SSL_CTX));
1131
1132         ret->method=meth;
1133
1134         ret->cert_store=NULL;
1135         ret->session_cache_mode=SSL_SESS_CACHE_SERVER;
1136         ret->session_cache_size=SSL_SESSION_CACHE_MAX_SIZE_DEFAULT;
1137         ret->session_cache_head=NULL;
1138         ret->session_cache_tail=NULL;
1139
1140         /* We take the system default */
1141         ret->session_timeout=meth->get_timeout();
1142
1143         ret->new_session_cb=NULL;
1144         ret->remove_session_cb=NULL;
1145         ret->get_session_cb=NULL;
1146
1147         memset((char *)&ret->stats,0,sizeof(ret->stats));
1148
1149         ret->references=1;
1150         ret->quiet_shutdown=0;
1151
1152 /*      ret->cipher=NULL;*/
1153 /*      ret->s2->challenge=NULL;
1154         ret->master_key=NULL;
1155         ret->key_arg=NULL;
1156         ret->s2->conn_id=NULL; */
1157
1158         ret->info_callback=NULL;
1159
1160         ret->app_verify_callback=NULL;
1161         ret->app_verify_arg=NULL;
1162
1163         ret->read_ahead=0;
1164         ret->verify_mode=SSL_VERIFY_NONE;
1165         ret->verify_depth=-1; /* Don't impose a limit (but x509_lu.c does) */
1166         ret->default_verify_callback=NULL;
1167         if ((ret->cert=ssl_cert_new()) == NULL)
1168                 goto err;
1169
1170         ret->default_passwd_callback=NULL;
1171         ret->default_passwd_callback_userdata=NULL;
1172         ret->client_cert_cb=NULL;
1173
1174         ret->sessions=lh_new(LHASH_HASH_FN(SSL_SESSION_hash),
1175                         LHASH_COMP_FN(SSL_SESSION_cmp));
1176         if (ret->sessions == NULL) goto err;
1177         ret->cert_store=X509_STORE_new();
1178         if (ret->cert_store == NULL) goto err;
1179
1180         ssl_create_cipher_list(ret->method,
1181                 &ret->cipher_list,&ret->cipher_list_by_id,
1182                 SSL_DEFAULT_CIPHER_LIST);
1183         if (ret->cipher_list == NULL
1184             || sk_SSL_CIPHER_num(ret->cipher_list) <= 0)
1185                 {
1186                 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_LIBRARY_HAS_NO_CIPHERS);
1187                 goto err2;
1188                 }
1189
1190         if ((ret->rsa_md5=EVP_get_digestbyname("ssl2-md5")) == NULL)
1191                 {
1192                 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES);
1193                 goto err2;
1194                 }
1195         if ((ret->md5=EVP_get_digestbyname("ssl3-md5")) == NULL)
1196                 {
1197                 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES);
1198                 goto err2;
1199                 }
1200         if ((ret->sha1=EVP_get_digestbyname("ssl3-sha1")) == NULL)
1201                 {
1202                 SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES);
1203                 goto err2;
1204                 }
1205
1206         if ((ret->client_CA=sk_X509_NAME_new_null()) == NULL)
1207                 goto err;
1208
1209         CRYPTO_new_ex_data(ssl_ctx_meth,(char *)ret,&ret->ex_data);
1210
1211         ret->extra_certs=NULL;
1212         ret->comp_methods=SSL_COMP_get_compression_methods();
1213
1214         return(ret);
1215 err:
1216         SSLerr(SSL_F_SSL_CTX_NEW,ERR_R_MALLOC_FAILURE);
1217 err2:
1218         if (ret != NULL) SSL_CTX_free(ret);
1219         return(NULL);
1220         }
1221
1222 #if 0
1223 static void SSL_COMP_free(SSL_COMP *comp)
1224     { OPENSSL_free(comp); }
1225 #endif
1226
1227 void SSL_CTX_free(SSL_CTX *a)
1228         {
1229         int i;
1230
1231         if (a == NULL) return;
1232
1233         i=CRYPTO_add(&a->references,-1,CRYPTO_LOCK_SSL_CTX);
1234 #ifdef REF_PRINT
1235         REF_PRINT("SSL_CTX",a);
1236 #endif
1237         if (i > 0) return;
1238 #ifdef REF_CHECK
1239         if (i < 0)
1240                 {
1241                 fprintf(stderr,"SSL_CTX_free, bad reference count\n");
1242                 abort(); /* ok */
1243                 }
1244 #endif
1245         CRYPTO_free_ex_data(ssl_ctx_meth,(char *)a,&a->ex_data);
1246
1247         if (a->sessions != NULL)
1248                 {
1249                 SSL_CTX_flush_sessions(a,0);
1250                 lh_free(a->sessions);
1251                 }
1252         if (a->cert_store != NULL)
1253                 X509_STORE_free(a->cert_store);
1254         if (a->cipher_list != NULL)
1255                 sk_SSL_CIPHER_free(a->cipher_list);
1256         if (a->cipher_list_by_id != NULL)
1257                 sk_SSL_CIPHER_free(a->cipher_list_by_id);
1258         if (a->cert != NULL)
1259                 ssl_cert_free(a->cert);
1260         if (a->client_CA != NULL)
1261                 sk_X509_NAME_pop_free(a->client_CA,X509_NAME_free);
1262         if (a->extra_certs != NULL)
1263                 sk_X509_pop_free(a->extra_certs,X509_free);
1264 #if 0 /* This should never be done, since it removes a global database */
1265         if (a->comp_methods != NULL)
1266                 sk_SSL_COMP_pop_free(a->comp_methods,SSL_COMP_free);
1267 #else
1268         a->comp_methods = NULL;
1269 #endif
1270         OPENSSL_free(a);
1271         }
1272
1273 void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb)
1274         {
1275         ctx->default_passwd_callback=cb;
1276         }
1277
1278 void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx,void *u)
1279         {
1280         ctx->default_passwd_callback_userdata=u;
1281         }
1282
1283 void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx,int (*cb)(),char *arg)
1284         {
1285         /* now
1286          *     int (*cb)(X509_STORE_CTX *),
1287          * but should be
1288          *     int (*cb)(X509_STORE_CTX *, void *arg)
1289          */
1290         ctx->app_verify_callback=cb;
1291         ctx->app_verify_arg=arg; /* never used */
1292         }
1293
1294 void SSL_CTX_set_verify(SSL_CTX *ctx,int mode,int (*cb)(int, X509_STORE_CTX *))
1295         {
1296         ctx->verify_mode=mode;
1297         ctx->default_verify_callback=cb;
1298         /* This needs cleaning up EAY EAY EAY */
1299         X509_STORE_set_verify_cb_func(ctx->cert_store,cb);
1300         }
1301
1302 void SSL_CTX_set_verify_depth(SSL_CTX *ctx,int depth)
1303         {
1304         ctx->verify_depth=depth;
1305         }
1306
1307 void ssl_set_cert_masks(CERT *c, SSL_CIPHER *cipher)
1308         {
1309         CERT_PKEY *cpk;
1310         int rsa_enc,rsa_tmp,rsa_sign,dh_tmp,dh_rsa,dh_dsa,dsa_sign;
1311         int rsa_enc_export,dh_rsa_export,dh_dsa_export;
1312         int rsa_tmp_export,dh_tmp_export,kl;
1313         unsigned long mask,emask;
1314
1315         if (c == NULL) return;
1316
1317         kl=SSL_C_EXPORT_PKEYLENGTH(cipher);
1318
1319 #ifndef OPENSSL_NO_RSA
1320         rsa_tmp=(c->rsa_tmp != NULL || c->rsa_tmp_cb != NULL);
1321         rsa_tmp_export=(c->rsa_tmp_cb != NULL ||
1322                 (rsa_tmp && RSA_size(c->rsa_tmp)*8 <= kl));
1323 #else
1324         rsa_tmp=rsa_tmp_export=0;
1325 #endif
1326 #ifndef OPENSSL_NO_DH
1327         dh_tmp=(c->dh_tmp != NULL || c->dh_tmp_cb != NULL);
1328         dh_tmp_export=(c->dh_tmp_cb != NULL ||
1329                 (dh_tmp && DH_size(c->dh_tmp)*8 <= kl));
1330 #else
1331         dh_tmp=dh_tmp_export=0;
1332 #endif
1333
1334         cpk= &(c->pkeys[SSL_PKEY_RSA_ENC]);
1335         rsa_enc= (cpk->x509 != NULL && cpk->privatekey != NULL);
1336         rsa_enc_export=(rsa_enc && EVP_PKEY_size(cpk->privatekey)*8 <= kl);
1337         cpk= &(c->pkeys[SSL_PKEY_RSA_SIGN]);
1338         rsa_sign=(cpk->x509 != NULL && cpk->privatekey != NULL);
1339         cpk= &(c->pkeys[SSL_PKEY_DSA_SIGN]);
1340         dsa_sign=(cpk->x509 != NULL && cpk->privatekey != NULL);
1341         cpk= &(c->pkeys[SSL_PKEY_DH_RSA]);
1342         dh_rsa=  (cpk->x509 != NULL && cpk->privatekey != NULL);
1343         dh_rsa_export=(dh_rsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl);
1344         cpk= &(c->pkeys[SSL_PKEY_DH_DSA]);
1345 /* FIX THIS EAY EAY EAY */
1346         dh_dsa=  (cpk->x509 != NULL && cpk->privatekey != NULL);
1347         dh_dsa_export=(dh_dsa && EVP_PKEY_size(cpk->privatekey)*8 <= kl);
1348
1349         mask=0;
1350         emask=0;
1351
1352 #ifdef CIPHER_DEBUG
1353         printf("rt=%d rte=%d dht=%d re=%d ree=%d rs=%d ds=%d dhr=%d dhd=%d\n",
1354                 rsa_tmp,rsa_tmp_export,dh_tmp,
1355                 rsa_enc,rsa_enc_export,rsa_sign,dsa_sign,dh_rsa,dh_dsa);
1356 #endif
1357
1358         if (rsa_enc || (rsa_tmp && rsa_sign))
1359                 mask|=SSL_kRSA;
1360         if (rsa_enc_export || (rsa_tmp_export && (rsa_sign || rsa_enc)))
1361                 emask|=SSL_kRSA;
1362
1363 #if 0
1364         /* The match needs to be both kEDH and aRSA or aDSA, so don't worry */
1365         if (    (dh_tmp || dh_rsa || dh_dsa) && 
1366                 (rsa_enc || rsa_sign || dsa_sign))
1367                 mask|=SSL_kEDH;
1368         if ((dh_tmp_export || dh_rsa_export || dh_dsa_export) &&
1369                 (rsa_enc || rsa_sign || dsa_sign))
1370                 emask|=SSL_kEDH;
1371 #endif
1372
1373         if (dh_tmp_export) 
1374                 emask|=SSL_kEDH;
1375
1376         if (dh_tmp)
1377                 mask|=SSL_kEDH;
1378
1379         if (dh_rsa) mask|=SSL_kDHr;
1380         if (dh_rsa_export) emask|=SSL_kDHr;
1381
1382         if (dh_dsa) mask|=SSL_kDHd;
1383         if (dh_dsa_export) emask|=SSL_kDHd;
1384
1385         if (rsa_enc || rsa_sign)
1386                 {
1387                 mask|=SSL_aRSA;
1388                 emask|=SSL_aRSA;
1389                 }
1390
1391         if (dsa_sign)
1392                 {
1393                 mask|=SSL_aDSS;
1394                 emask|=SSL_aDSS;
1395                 }
1396
1397         mask|=SSL_aNULL;
1398         emask|=SSL_aNULL;
1399
1400 #ifndef OPENSSL_NO_KRB5
1401         mask|=SSL_kKRB5|SSL_aKRB5;
1402         emask|=SSL_kKRB5|SSL_aKRB5;
1403 #endif
1404
1405         c->mask=mask;
1406         c->export_mask=emask;
1407         c->valid=1;
1408         }
1409
1410 /* THIS NEEDS CLEANING UP */
1411 X509 *ssl_get_server_send_cert(SSL *s)
1412         {
1413         unsigned long alg,mask,kalg;
1414         CERT *c;
1415         int i,is_export;
1416
1417         c=s->cert;
1418         ssl_set_cert_masks(c, s->s3->tmp.new_cipher);
1419         alg=s->s3->tmp.new_cipher->algorithms;
1420         is_export=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
1421         mask=is_export?c->export_mask:c->mask;
1422         kalg=alg&(SSL_MKEY_MASK|SSL_AUTH_MASK);
1423
1424         if      (kalg & SSL_kDHr)
1425                 i=SSL_PKEY_DH_RSA;
1426         else if (kalg & SSL_kDHd)
1427                 i=SSL_PKEY_DH_DSA;
1428         else if (kalg & SSL_aDSS)
1429                 i=SSL_PKEY_DSA_SIGN;
1430         else if (kalg & SSL_aRSA)
1431                 {
1432                 if (c->pkeys[SSL_PKEY_RSA_ENC].x509 == NULL)
1433                         i=SSL_PKEY_RSA_SIGN;
1434                 else
1435                         i=SSL_PKEY_RSA_ENC;
1436                 }
1437         else if (kalg & SSL_aKRB5)
1438                 {
1439                 /* VRS something else here? */
1440                 return(NULL);
1441                 }
1442         else /* if (kalg & SSL_aNULL) */
1443                 {
1444                 SSLerr(SSL_F_SSL_GET_SERVER_SEND_CERT,SSL_R_INTERNAL_ERROR);
1445                 return(NULL);
1446                 }
1447         if (c->pkeys[i].x509 == NULL) return(NULL);
1448         return(c->pkeys[i].x509);
1449         }
1450
1451 EVP_PKEY *ssl_get_sign_pkey(SSL *s,SSL_CIPHER *cipher)
1452         {
1453         unsigned long alg;
1454         CERT *c;
1455
1456         alg=cipher->algorithms;
1457         c=s->cert;
1458
1459         if ((alg & SSL_aDSS) &&
1460                 (c->pkeys[SSL_PKEY_DSA_SIGN].privatekey != NULL))
1461                 return(c->pkeys[SSL_PKEY_DSA_SIGN].privatekey);
1462         else if (alg & SSL_aRSA)
1463                 {
1464                 if (c->pkeys[SSL_PKEY_RSA_SIGN].privatekey != NULL)
1465                         return(c->pkeys[SSL_PKEY_RSA_SIGN].privatekey);
1466                 else if (c->pkeys[SSL_PKEY_RSA_ENC].privatekey != NULL)
1467                         return(c->pkeys[SSL_PKEY_RSA_ENC].privatekey);
1468                 else
1469                         return(NULL);
1470                 }
1471         else /* if (alg & SSL_aNULL) */
1472                 {
1473                 SSLerr(SSL_F_SSL_GET_SIGN_PKEY,SSL_R_INTERNAL_ERROR);
1474                 return(NULL);
1475                 }
1476         }
1477
1478 void ssl_update_cache(SSL *s,int mode)
1479         {
1480         int i;
1481
1482         /* If the session_id_length is 0, we are not supposed to cache it,
1483          * and it would be rather hard to do anyway :-) */
1484         if (s->session->session_id_length == 0) return;
1485
1486         if ((s->ctx->session_cache_mode & mode)
1487                 && (!s->hit)
1488                 && SSL_CTX_add_session(s->ctx,s->session)
1489                 && (s->ctx->new_session_cb != NULL))
1490                 {
1491                 CRYPTO_add(&s->session->references,1,CRYPTO_LOCK_SSL_SESSION);
1492                 if (!s->ctx->new_session_cb(s,s->session))
1493                         SSL_SESSION_free(s->session);
1494                 }
1495
1496         /* auto flush every 255 connections */
1497         i=s->ctx->session_cache_mode;
1498         if ((!(i & SSL_SESS_CACHE_NO_AUTO_CLEAR)) &&
1499                 ((i & mode) == mode))
1500                 {
1501                 if (  (((mode & SSL_SESS_CACHE_CLIENT)
1502                         ?s->ctx->stats.sess_connect_good
1503                         :s->ctx->stats.sess_accept_good) & 0xff) == 0xff)
1504                         {
1505                         SSL_CTX_flush_sessions(s->ctx,time(NULL));
1506                         }
1507                 }
1508         }
1509
1510 SSL_METHOD *SSL_get_ssl_method(SSL *s)
1511         {
1512         return(s->method);
1513         }
1514
1515 int SSL_set_ssl_method(SSL *s,SSL_METHOD *meth)
1516         {
1517         int conn= -1;
1518         int ret=1;
1519
1520         if (s->method != meth)
1521                 {
1522                 if (s->handshake_func != NULL)
1523                         conn=(s->handshake_func == s->method->ssl_connect);
1524
1525                 if (s->method->version == meth->version)
1526                         s->method=meth;
1527                 else
1528                         {
1529                         s->method->ssl_free(s);
1530                         s->method=meth;
1531                         ret=s->method->ssl_new(s);
1532                         }
1533
1534                 if (conn == 1)
1535                         s->handshake_func=meth->ssl_connect;
1536                 else if (conn == 0)
1537                         s->handshake_func=meth->ssl_accept;
1538                 }
1539         return(ret);
1540         }
1541
1542 int SSL_get_error(SSL *s,int i)
1543         {
1544         int reason;
1545         unsigned long l;
1546         BIO *bio;
1547
1548         if (i > 0) return(SSL_ERROR_NONE);
1549
1550         /* Make things return SSL_ERROR_SYSCALL when doing SSL_do_handshake
1551          * etc, where we do encode the error */
1552         if ((l=ERR_peek_error()) != 0)
1553                 {
1554                 if (ERR_GET_LIB(l) == ERR_LIB_SYS)
1555                         return(SSL_ERROR_SYSCALL);
1556                 else
1557                         return(SSL_ERROR_SSL);
1558                 }
1559
1560         if ((i < 0) && SSL_want_read(s))
1561                 {
1562                 bio=SSL_get_rbio(s);
1563                 if (BIO_should_read(bio))
1564                         return(SSL_ERROR_WANT_READ);
1565                 else if (BIO_should_write(bio))
1566                         /* This one doesn't make too much sense ... We never try
1567                          * to write to the rbio, and an application program where
1568                          * rbio and wbio are separate couldn't even know what it
1569                          * should wait for.
1570                          * However if we ever set s->rwstate incorrectly
1571                          * (so that we have SSL_want_read(s) instead of
1572                          * SSL_want_write(s)) and rbio and wbio *are* the same,
1573                          * this test works around that bug; so it might be safer
1574                          * to keep it. */
1575                         return(SSL_ERROR_WANT_WRITE);
1576                 else if (BIO_should_io_special(bio))
1577                         {
1578                         reason=BIO_get_retry_reason(bio);
1579                         if (reason == BIO_RR_CONNECT)
1580                                 return(SSL_ERROR_WANT_CONNECT);
1581                         else if (reason == BIO_RR_ACCEPT)
1582                                 return(SSL_ERROR_WANT_ACCEPT);
1583                         else
1584                                 return(SSL_ERROR_SYSCALL); /* unknown */
1585                         }
1586                 }
1587
1588         if ((i < 0) && SSL_want_write(s))
1589                 {
1590                 bio=SSL_get_wbio(s);
1591                 if (BIO_should_write(bio))
1592                         return(SSL_ERROR_WANT_WRITE);
1593                 else if (BIO_should_read(bio))
1594                         /* See above (SSL_want_read(s) with BIO_should_write(bio)) */
1595                         return(SSL_ERROR_WANT_READ);
1596                 else if (BIO_should_io_special(bio))
1597                         {
1598                         reason=BIO_get_retry_reason(bio);
1599                         if (reason == BIO_RR_CONNECT)
1600                                 return(SSL_ERROR_WANT_CONNECT);
1601                         else if (reason == BIO_RR_ACCEPT)
1602                                 return(SSL_ERROR_WANT_ACCEPT);
1603                         else
1604                                 return(SSL_ERROR_SYSCALL);
1605                         }
1606                 }
1607         if ((i < 0) && SSL_want_x509_lookup(s))
1608                 {
1609                 return(SSL_ERROR_WANT_X509_LOOKUP);
1610                 }
1611
1612         if (i == 0)
1613                 {
1614                 if (s->version == SSL2_VERSION)
1615                         {
1616                         /* assume it is the socket being closed */
1617                         return(SSL_ERROR_ZERO_RETURN);
1618                         }
1619                 else
1620                         {
1621                         if ((s->shutdown & SSL_RECEIVED_SHUTDOWN) &&
1622                                 (s->s3->warn_alert == SSL_AD_CLOSE_NOTIFY))
1623                                 return(SSL_ERROR_ZERO_RETURN);
1624                         }
1625                 }
1626         return(SSL_ERROR_SYSCALL);
1627         }
1628
1629 int SSL_do_handshake(SSL *s)
1630         {
1631         int ret=1;
1632
1633         if (s->handshake_func == NULL)
1634                 {
1635                 SSLerr(SSL_F_SSL_DO_HANDSHAKE,SSL_R_CONNECTION_TYPE_NOT_SET);
1636                 return(-1);
1637                 }
1638
1639         s->method->ssl_renegotiate_check(s);
1640
1641         if (SSL_in_init(s) || SSL_in_before(s))
1642                 {
1643                 ret=s->handshake_func(s);
1644                 }
1645         return(ret);
1646         }
1647
1648 /* For the next 2 functions, SSL_clear() sets shutdown and so
1649  * one of these calls will reset it */
1650 void SSL_set_accept_state(SSL *s)
1651         {
1652         s->server=1;
1653         s->shutdown=0;
1654         s->state=SSL_ST_ACCEPT|SSL_ST_BEFORE;
1655         s->handshake_func=s->method->ssl_accept;
1656         /* clear the current cipher */
1657         ssl_clear_cipher_ctx(s);
1658         }
1659
1660 void SSL_set_connect_state(SSL *s)
1661         {
1662         s->server=0;
1663         s->shutdown=0;
1664         s->state=SSL_ST_CONNECT|SSL_ST_BEFORE;
1665         s->handshake_func=s->method->ssl_connect;
1666         /* clear the current cipher */
1667         ssl_clear_cipher_ctx(s);
1668         }
1669
1670 int ssl_undefined_function(SSL *s)
1671         {
1672         SSLerr(SSL_F_SSL_UNDEFINED_FUNCTION,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1673         return(0);
1674         }
1675
1676 SSL_METHOD *ssl_bad_method(int ver)
1677         {
1678         SSLerr(SSL_F_SSL_BAD_METHOD,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
1679         return(NULL);
1680         }
1681
1682 const char *SSL_get_version(SSL *s)
1683         {
1684         if (s->version == TLS1_VERSION)
1685                 return("TLSv1");
1686         else if (s->version == SSL3_VERSION)
1687                 return("SSLv3");
1688         else if (s->version == SSL2_VERSION)
1689                 return("SSLv2");
1690         else
1691                 return("unknown");
1692         }
1693
1694 SSL *SSL_dup(SSL *s)
1695         {
1696         STACK_OF(X509_NAME) *sk;
1697         X509_NAME *xn;
1698         SSL *ret;
1699         int i;
1700                  
1701         if ((ret=SSL_new(SSL_get_SSL_CTX(s))) == NULL)
1702             return(NULL);
1703                           
1704         if (s->session != NULL)
1705                 {
1706                 /* This copies session-id, SSL_METHOD, sid_ctx, and 'cert' */
1707                 SSL_copy_session_id(ret,s);
1708                 }
1709         else
1710                 {
1711                 /* No session has been established yet, so we have to expect
1712                  * that s->cert or ret->cert will be changed later --
1713                  * they should not both point to the same object,
1714                  * and thus we can't use SSL_copy_session_id. */
1715
1716                 ret->method = s->method;
1717                 ret->method->ssl_new(ret);
1718
1719                 if (s->cert != NULL)
1720                         {
1721                         if (ret->cert != NULL)
1722                                 {
1723                                 ssl_cert_free(ret->cert);
1724                                 }
1725                         ret->cert = ssl_cert_dup(s->cert);
1726                         if (ret->cert == NULL)
1727                                 goto err;
1728                         }
1729                                 
1730                 SSL_set_session_id_context(ret,
1731                         s->sid_ctx, s->sid_ctx_length);
1732                 }
1733
1734         SSL_set_read_ahead(ret,SSL_get_read_ahead(s));
1735         SSL_set_verify(ret,SSL_get_verify_mode(s),
1736                 SSL_get_verify_callback(s));
1737         SSL_set_verify_depth(ret,SSL_get_verify_depth(s));
1738
1739         SSL_set_info_callback(ret,SSL_get_info_callback(s));
1740         
1741         ret->debug=s->debug;
1742         ret->options=s->options;
1743
1744         /* copy app data, a little dangerous perhaps */
1745         if (!CRYPTO_dup_ex_data(ssl_meth,&ret->ex_data,&s->ex_data))
1746                 goto err;
1747
1748         /* setup rbio, and wbio */
1749         if (s->rbio != NULL)
1750                 {
1751                 if (!BIO_dup_state(s->rbio,(char *)&ret->rbio))
1752                         goto err;
1753                 }
1754         if (s->wbio != NULL)
1755                 {
1756                 if (s->wbio != s->rbio)
1757                         {
1758                         if (!BIO_dup_state(s->wbio,(char *)&ret->wbio))
1759                                 goto err;
1760                         }
1761                 else
1762                         ret->wbio=ret->rbio;
1763                 }
1764
1765         /* dup the cipher_list and cipher_list_by_id stacks */
1766         if (s->cipher_list != NULL)
1767                 {
1768                 if ((ret->cipher_list=sk_SSL_CIPHER_dup(s->cipher_list)) == NULL)
1769                         goto err;
1770                 }
1771         if (s->cipher_list_by_id != NULL)
1772                 if ((ret->cipher_list_by_id=sk_SSL_CIPHER_dup(s->cipher_list_by_id))
1773                         == NULL)
1774                         goto err;
1775
1776         /* Dup the client_CA list */
1777         if (s->client_CA != NULL)
1778                 {
1779                 if ((sk=sk_X509_NAME_dup(s->client_CA)) == NULL) goto err;
1780                 ret->client_CA=sk;
1781                 for (i=0; i<sk_X509_NAME_num(sk); i++)
1782                         {
1783                         xn=sk_X509_NAME_value(sk,i);
1784                         if (sk_X509_NAME_set(sk,i,X509_NAME_dup(xn)) == NULL)
1785                                 {
1786                                 X509_NAME_free(xn);
1787                                 goto err;
1788                                 }
1789                         }
1790                 }
1791
1792         ret->shutdown=s->shutdown;
1793         ret->state=s->state;
1794         ret->handshake_func=s->handshake_func;
1795         ret->server=s->server;
1796
1797         if (0)
1798                 {
1799 err:
1800                 if (ret != NULL) SSL_free(ret);
1801                 ret=NULL;
1802                 }
1803         return(ret);
1804         }
1805
1806 void ssl_clear_cipher_ctx(SSL *s)
1807         {
1808         if (s->enc_read_ctx != NULL)
1809                 {
1810                 EVP_CIPHER_CTX_cleanup(s->enc_read_ctx);
1811                 OPENSSL_free(s->enc_read_ctx);
1812                 s->enc_read_ctx=NULL;
1813                 }
1814         if (s->enc_write_ctx != NULL)
1815                 {
1816                 EVP_CIPHER_CTX_cleanup(s->enc_write_ctx);
1817                 OPENSSL_free(s->enc_write_ctx);
1818                 s->enc_write_ctx=NULL;
1819                 }
1820         if (s->expand != NULL)
1821                 {
1822                 COMP_CTX_free(s->expand);
1823                 s->expand=NULL;
1824                 }
1825         if (s->compress != NULL)
1826                 {
1827                 COMP_CTX_free(s->compress);
1828                 s->compress=NULL;
1829                 }
1830         }
1831
1832 /* Fix this function so that it takes an optional type parameter */
1833 X509 *SSL_get_certificate(SSL *s)
1834         {
1835         if (s->cert != NULL)
1836                 return(s->cert->key->x509);
1837         else
1838                 return(NULL);
1839         }
1840
1841 /* Fix this function so that it takes an optional type parameter */
1842 EVP_PKEY *SSL_get_privatekey(SSL *s)
1843         {
1844         if (s->cert != NULL)
1845                 return(s->cert->key->privatekey);
1846         else
1847                 return(NULL);
1848         }
1849
1850 SSL_CIPHER *SSL_get_current_cipher(SSL *s)
1851         {
1852         if ((s->session != NULL) && (s->session->cipher != NULL))
1853                 return(s->session->cipher);
1854         return(NULL);
1855         }
1856
1857 int ssl_init_wbio_buffer(SSL *s,int push)
1858         {
1859         BIO *bbio;
1860
1861         if (s->bbio == NULL)
1862                 {
1863                 bbio=BIO_new(BIO_f_buffer());
1864                 if (bbio == NULL) return(0);
1865                 s->bbio=bbio;
1866                 }
1867         else
1868                 {
1869                 bbio=s->bbio;
1870                 if (s->bbio == s->wbio)
1871                         s->wbio=BIO_pop(s->wbio);
1872                 }
1873         (void)BIO_reset(bbio);
1874 /*      if (!BIO_set_write_buffer_size(bbio,16*1024)) */
1875         if (!BIO_set_read_buffer_size(bbio,1))
1876                 {
1877                 SSLerr(SSL_F_SSL_INIT_WBIO_BUFFER,ERR_R_BUF_LIB);
1878                 return(0);
1879                 }
1880         if (push)
1881                 {
1882                 if (s->wbio != bbio)
1883                         s->wbio=BIO_push(bbio,s->wbio);
1884                 }
1885         else
1886                 {
1887                 if (s->wbio == bbio)
1888                         s->wbio=BIO_pop(bbio);
1889                 }
1890         return(1);
1891         }
1892
1893 void ssl_free_wbio_buffer(SSL *s)
1894         {
1895         if (s->bbio == NULL) return;
1896
1897         if (s->bbio == s->wbio)
1898                 {
1899                 /* remove buffering */
1900                 s->wbio=BIO_pop(s->wbio);
1901 #ifdef REF_CHECK /* not the usual REF_CHECK, but this avoids adding one more preprocessor symbol */
1902                 assert(s->wbio != NULL);
1903 #endif  
1904         }
1905         BIO_free(s->bbio);
1906         s->bbio=NULL;
1907         }
1908         
1909 void SSL_CTX_set_quiet_shutdown(SSL_CTX *ctx,int mode)
1910         {
1911         ctx->quiet_shutdown=mode;
1912         }
1913
1914 int SSL_CTX_get_quiet_shutdown(SSL_CTX *ctx)
1915         {
1916         return(ctx->quiet_shutdown);
1917         }
1918
1919 void SSL_set_quiet_shutdown(SSL *s,int mode)
1920         {
1921         s->quiet_shutdown=mode;
1922         }
1923
1924 int SSL_get_quiet_shutdown(SSL *s)
1925         {
1926         return(s->quiet_shutdown);
1927         }
1928
1929 void SSL_set_shutdown(SSL *s,int mode)
1930         {
1931         s->shutdown=mode;
1932         }
1933
1934 int SSL_get_shutdown(SSL *s)
1935         {
1936         return(s->shutdown);
1937         }
1938
1939 int SSL_version(SSL *s)
1940         {
1941         return(s->version);
1942         }
1943
1944 SSL_CTX *SSL_get_SSL_CTX(SSL *ssl)
1945         {
1946         return(ssl->ctx);
1947         }
1948
1949 #ifndef OPENSSL_NO_STDIO
1950 int SSL_CTX_set_default_verify_paths(SSL_CTX *ctx)
1951         {
1952         return(X509_STORE_set_default_paths(ctx->cert_store));
1953         }
1954
1955 int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile,
1956                 const char *CApath)
1957         {
1958         return(X509_STORE_load_locations(ctx->cert_store,CAfile,CApath));
1959         }
1960 #endif
1961
1962 void SSL_set_info_callback(SSL *ssl,void (*cb)())
1963         {
1964         ssl->info_callback=cb;
1965         }
1966
1967 void (*SSL_get_info_callback(SSL *ssl))(void)
1968         {
1969         return((void (*)())ssl->info_callback);
1970         }
1971
1972 int SSL_state(SSL *ssl)
1973         {
1974         return(ssl->state);
1975         }
1976
1977 void SSL_set_verify_result(SSL *ssl,long arg)
1978         {
1979         ssl->verify_result=arg;
1980         }
1981
1982 long SSL_get_verify_result(SSL *ssl)
1983         {
1984         return(ssl->verify_result);
1985         }
1986
1987 int SSL_get_ex_new_index(long argl,void *argp,CRYPTO_EX_new *new_func,
1988                          CRYPTO_EX_dup *dup_func,CRYPTO_EX_free *free_func)
1989         {
1990         ssl_meth_num++;
1991         return(CRYPTO_get_ex_new_index(ssl_meth_num-1,
1992                 &ssl_meth,argl,argp,new_func,dup_func,free_func));
1993         }
1994
1995 int SSL_set_ex_data(SSL *s,int idx,void *arg)
1996         {
1997         return(CRYPTO_set_ex_data(&s->ex_data,idx,arg));
1998         }
1999
2000 void *SSL_get_ex_data(SSL *s,int idx)
2001         {
2002         return(CRYPTO_get_ex_data(&s->ex_data,idx));
2003         }
2004
2005 int SSL_CTX_get_ex_new_index(long argl,void *argp,CRYPTO_EX_new *new_func,
2006                              CRYPTO_EX_dup *dup_func,CRYPTO_EX_free *free_func)
2007         {
2008         ssl_ctx_meth_num++;
2009         return(CRYPTO_get_ex_new_index(ssl_ctx_meth_num-1,
2010                 &ssl_ctx_meth,argl,argp,new_func,dup_func,free_func));
2011         }
2012
2013 int SSL_CTX_set_ex_data(SSL_CTX *s,int idx,void *arg)
2014         {
2015         return(CRYPTO_set_ex_data(&s->ex_data,idx,arg));
2016         }
2017
2018 void *SSL_CTX_get_ex_data(SSL_CTX *s,int idx)
2019         {
2020         return(CRYPTO_get_ex_data(&s->ex_data,idx));
2021         }
2022
2023 int ssl_ok(SSL *s)
2024         {
2025         return(1);
2026         }
2027
2028 X509_STORE *SSL_CTX_get_cert_store(SSL_CTX *ctx)
2029         {
2030         return(ctx->cert_store);
2031         }
2032
2033 void SSL_CTX_set_cert_store(SSL_CTX *ctx,X509_STORE *store)
2034         {
2035         if (ctx->cert_store != NULL)
2036                 X509_STORE_free(ctx->cert_store);
2037         ctx->cert_store=store;
2038         }
2039
2040 int SSL_want(SSL *s)
2041         {
2042         return(s->rwstate);
2043         }
2044
2045 /*!
2046  * \brief Set the callback for generating temporary RSA keys.
2047  * \param ctx the SSL context.
2048  * \param cb the callback
2049  */
2050
2051 #ifndef OPENSSL_NO_RSA
2052 void SSL_CTX_set_tmp_rsa_callback(SSL_CTX *ctx,RSA *(*cb)(SSL *ssl,
2053                                                           int is_export,
2054                                                           int keylength))
2055     {
2056     SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_RSA_CB,(void (*)())cb);
2057     }
2058
2059 void SSL_set_tmp_rsa_callback(SSL *ssl,RSA *(*cb)(SSL *ssl,
2060                                                   int is_export,
2061                                                   int keylength))
2062     {
2063     SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_RSA_CB,(void (*)())cb);
2064     }
2065 #endif
2066
2067 #ifdef DOXYGEN
2068 /*!
2069  * \brief The RSA temporary key callback function.
2070  * \param ssl the SSL session.
2071  * \param is_export \c TRUE if the temp RSA key is for an export ciphersuite.
2072  * \param keylength if \c is_export is \c TRUE, then \c keylength is the size
2073  * of the required key in bits.
2074  * \return the temporary RSA key.
2075  * \sa SSL_CTX_set_tmp_rsa_callback, SSL_set_tmp_rsa_callback
2076  */
2077
2078 RSA *cb(SSL *ssl,int is_export,int keylength)
2079     {}
2080 #endif
2081
2082 /*!
2083  * \brief Set the callback for generating temporary DH keys.
2084  * \param ctx the SSL context.
2085  * \param dh the callback
2086  */
2087
2088 #ifndef OPENSSL_NO_DH
2089 void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx,DH *(*dh)(SSL *ssl,int is_export,
2090                                                         int keylength))
2091     {
2092     SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TMP_DH_CB,(void (*)())dh);
2093     }
2094
2095 void SSL_set_tmp_dh_callback(SSL *ssl,DH *(*dh)(SSL *ssl,int is_export,
2096                                                 int keylength))
2097     {
2098     SSL_callback_ctrl(ssl,SSL_CTRL_SET_TMP_DH_CB,(void (*)())dh);
2099     }
2100 #endif
2101
2102 #if defined(_WINDLL) && defined(OPENSSL_SYS_WIN16)
2103 #include "../crypto/bio/bss_file.c"
2104 #endif
2105
2106 IMPLEMENT_STACK_OF(SSL_CIPHER)
2107 IMPLEMENT_STACK_OF(SSL_COMP)