ssl/ssltest.c

   1 /* ssl/ssltest.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111 /* ====================================================================
 112  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
 113  * ECC cipher suite support in OpenSSL originally developed by
 114  * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
 115  */
 116 /* ====================================================================
 117  * Copyright 2005 Nokia. All rights reserved.
 118  *
 119  * The portions of the attached software ("Contribution") is developed by
 120  * Nokia Corporation and is licensed pursuant to the OpenSSL open source
 121  * license.
 122  *
 123  * The Contribution, originally written by Mika Kousa and Pasi Eronen of
 124  * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
 125  * support (see RFC 4279) to OpenSSL.
 126  *
 127  * No patent licenses or other rights except those expressly stated in
 128  * the OpenSSL open source license shall be deemed granted or received
 129  * expressly, by implication, estoppel, or otherwise.
 130  *
 131  * No assurances are provided by Nokia that the Contribution does not
 132  * infringe the patent or other intellectual property rights of any third
 133  * party or that the license provides you with all the necessary rights
 134  * to make use of the Contribution.
 135  *
 136  * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
 137  * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
 138  * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
 139  * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
 140  * OTHERWISE.
 141  */
 142
 143 #define _BSD_SOURCE 1           /* Or gethostname won't be declared properly
 144                                    on Linux and GNU platforms. */
 145
 146 #include <assert.h>
 147 #include <errno.h>
 148 #include <limits.h>
 149 #include <stdio.h>
 150 #include <stdlib.h>
 151 #include <string.h>
 152 #include <time.h>
 153
 154 #define USE_SOCKETS
 155 #include "e_os.h"
 156
 157 #ifdef OPENSSL_SYS_VMS
 158 #define _XOPEN_SOURCE 500       /* Or isascii won't be declared properly on
 159                                    VMS (at least with DECompHP C).  */
 160 #endif
 161
 162 #include <ctype.h>
 163
 164 #include <openssl/bio.h>
 165 #include <openssl/crypto.h>
 166 #include <openssl/evp.h>
 167 #include <openssl/x509.h>
 168 #include <openssl/x509v3.h>
 169 #include <openssl/ssl.h>
 170 #ifndef OPENSSL_NO_ENGINE
 171 #include <openssl/engine.h>
 172 #endif
 173 #include <openssl/err.h>
 174 #include <openssl/rand.h>
 175 #ifndef OPENSSL_NO_RSA
 176 #include <openssl/rsa.h>
 177 #endif
 178 #ifndef OPENSSL_NO_DSA
 179 #include <openssl/dsa.h>
 180 #endif
 181 #ifndef OPENSSL_NO_DH
 182 #include <openssl/dh.h>
 183 #endif
 184 #ifndef OPENSSL_NO_SRP
 185 #include <openssl/srp.h>
 186 #endif
 187 #include <openssl/bn.h>
 188
 189 #define _XOPEN_SOURCE_EXTENDED  1 /* Or gethostname won't be declared properly
 190                                      on Compaq platforms (at least with DEC C).
 191                                      Do not try to put it earlier, or IPv6 includes
 192                                      get screwed...
 193                                   */
 194
 195 #ifdef OPENSSL_SYS_WINDOWS
 196 #include <winsock.h>
 197 #else
 198 #include OPENSSL_UNISTD
 199 #endif
 200
 201 #ifdef OPENSSL_SYS_VMS
 202 #  define TEST_SERVER_CERT "SYS$DISK:[-.APPS]SERVER.PEM"
 203 #  define TEST_CLIENT_CERT "SYS$DISK:[-.APPS]CLIENT.PEM"
 204 #elif defined(OPENSSL_SYS_WINCE)
 205 #  define TEST_SERVER_CERT "\\OpenSSL\\server.pem"
 206 #  define TEST_CLIENT_CERT "\\OpenSSL\\client.pem"
 207 #elif defined(OPENSSL_SYS_NETWARE)
 208 #  define TEST_SERVER_CERT "\\openssl\\apps\\server.pem"
 209 #  define TEST_CLIENT_CERT "\\openssl\\apps\\client.pem"
 210 #else
 211 #  define TEST_SERVER_CERT "../apps/server.pem"
 212 #  define TEST_CLIENT_CERT "../apps/client.pem"
 213 #endif
 214
 215 /* There is really no standard for this, so let's assign some tentative
 216    numbers.  In any case, these numbers are only for this test */
 217 #define COMP_RLE        255
 218 #define COMP_ZLIB       1
 219
 220 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
 221 #ifndef OPENSSL_NO_RSA
 222 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export,int keylength);
 223 static void free_tmp_rsa(void);
 224 #endif
 225 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg);
 226 #define APP_CALLBACK_STRING "Test Callback Argument"
 227 struct app_verify_arg
 228         {
 229         char *string;
 230         int app_verify;
 231         int allow_proxy_certs;
 232         char *proxy_auth;
 233         char *proxy_cond;
 234         };
 235
 236 #ifndef OPENSSL_NO_DH
 237 static DH *get_dh512(void);
 238 static DH *get_dh1024(void);
 239 static DH *get_dh1024dsa(void);
 240 #endif
 241
 242
 243 static char *psk_key=NULL; /* by default PSK is not used */
 244 #ifndef OPENSSL_NO_PSK
 245 static unsigned int psk_client_callback(SSL *ssl, const char *hint, char *identity,
 246         unsigned int max_identity_len, unsigned char *psk,
 247         unsigned int max_psk_len);
 248 static unsigned int psk_server_callback(SSL *ssl, const char *identity, unsigned char *psk,
 249         unsigned int max_psk_len);
 250 #endif
 251
 252 #ifndef OPENSSL_NO_SRP
 253 /* SRP client */
 254 /* This is a context that we pass to all callbacks */
 255 typedef struct srp_client_arg_st
 256         {
 257         char *srppassin;
 258         char *srplogin;
 259         } SRP_CLIENT_ARG;
 260
 261 #define PWD_STRLEN 1024
 262
 263 static char * MS_CALLBACK ssl_give_srp_client_pwd_cb(SSL *s, void *arg)
 264         {
 265         SRP_CLIENT_ARG *srp_client_arg = (SRP_CLIENT_ARG *)arg;
 266         return BUF_strdup((char *)srp_client_arg->srppassin);
 267         }
 268
 269 /* SRP server */
 270 /* This is a context that we pass to SRP server callbacks */
 271 typedef struct srp_server_arg_st
 272         {
 273         char *expected_user;
 274         char *pass;
 275         } SRP_SERVER_ARG;
 276
 277 static int MS_CALLBACK ssl_srp_server_param_cb(SSL *s, int *ad, void *arg)
 278         {
 279         SRP_SERVER_ARG * p = (SRP_SERVER_ARG *) arg;
 280
 281         if (strcmp(p->expected_user, SSL_get_srp_username(s)) != 0)
 282                 {
 283                 fprintf(stderr, "User %s doesn't exist\n", SSL_get_srp_username(s));
 284                 return SSL3_AL_FATAL;
 285                 }
 286         if (SSL_set_srp_server_param_pw(s,p->expected_user,p->pass,"1024")<0)
 287                 {
 288                 *ad = SSL_AD_INTERNAL_ERROR;
 289                 return SSL3_AL_FATAL;
 290                 }
 291         return SSL_ERROR_NONE;
 292         }
 293 #endif
 294
 295 static BIO *bio_err=NULL;
 296 static BIO *bio_stdout=NULL;
 297
 298 static char *cipher=NULL;
 299 static int verbose=0;
 300 static int debug=0;
 301 #if 0
 302 /* Not used yet. */
 303 #ifdef FIONBIO
 304 static int s_nbio=0;
 305 #endif
 306 #endif
 307
 308 static const char rnd_seed[] = "string to make the random number generator think it has entropy";
 309
 310 int doit_biopair(SSL *s_ssl,SSL *c_ssl,long bytes,clock_t *s_time,clock_t *c_time);
 311 int doit(SSL *s_ssl,SSL *c_ssl,long bytes);
 312 static int do_test_cipherlist(void);
 313 static void sv_usage(void)
 314         {
 315         fprintf(stderr,"usage: ssltest [args ...]\n");
 316         fprintf(stderr,"\n");
 317 #ifdef OPENSSL_FIPS
 318         fprintf(stderr,"-F             - run test in FIPS mode\n");
 319 #endif
 320         fprintf(stderr," -server_auth  - check server certificate\n");
 321         fprintf(stderr," -client_auth  - do client authentication\n");
 322         fprintf(stderr," -proxy        - allow proxy certificates\n");
 323         fprintf(stderr," -proxy_auth <val> - set proxy policy rights\n");
 324         fprintf(stderr," -proxy_cond <val> - experssion to test proxy policy rights\n");
 325         fprintf(stderr," -v            - more output\n");
 326         fprintf(stderr," -d            - debug output\n");
 327         fprintf(stderr," -reuse        - use session-id reuse\n");
 328         fprintf(stderr," -num <val>    - number of connections to perform\n");
 329         fprintf(stderr," -bytes <val>  - number of bytes to swap between client/server\n");
 330 #ifndef OPENSSL_NO_DH
 331         fprintf(stderr," -dhe1024      - use 1024 bit key (safe prime) for DHE\n");
 332         fprintf(stderr," -dhe1024dsa   - use 1024 bit key (with 160-bit subprime) for DHE\n");
 333         fprintf(stderr," -no_dhe       - disable DHE\n");
 334 #endif
 335 #ifndef OPENSSL_NO_ECDH
 336         fprintf(stderr," -no_ecdhe     - disable ECDHE\n");
 337 #endif
 338 #ifndef OPENSSL_NO_PSK
 339         fprintf(stderr," -psk arg      - PSK in hex (without 0x)\n");
 340 #endif
 341 #ifndef OPENSSL_NO_SRP
 342         fprintf(stderr," -srpuser user  - SRP username to use\n");
 343         fprintf(stderr," -srppass arg   - password for 'user'\n");
 344 #endif
 345 #ifndef OPENSSL_NO_SSL2
 346         fprintf(stderr," -ssl2         - use SSLv2\n");
 347 #endif
 348 #ifndef OPENSSL_NO_SSL3_METHOD
 349         fprintf(stderr," -ssl3         - use SSLv3\n");
 350 #endif
 351 #ifndef OPENSSL_NO_TLS1
 352         fprintf(stderr," -tls1         - use TLSv1\n");
 353 #endif
 354         fprintf(stderr," -CApath arg   - PEM format directory of CA's\n");
 355         fprintf(stderr," -CAfile arg   - PEM format file of CA's\n");
 356         fprintf(stderr," -cert arg     - Server certificate file\n");
 357         fprintf(stderr," -key arg      - Server key file (default: same as -cert)\n");
 358         fprintf(stderr," -c_cert arg   - Client certificate file\n");
 359         fprintf(stderr," -c_key arg    - Client key file (default: same as -c_cert)\n");
 360         fprintf(stderr," -cipher arg   - The cipher list\n");
 361         fprintf(stderr," -bio_pair     - Use BIO pairs\n");
 362         fprintf(stderr," -f            - Test even cases that can't work\n");
 363         fprintf(stderr," -time         - measure processor time used by client and server\n");
 364         fprintf(stderr," -zlib         - use zlib compression\n");
 365         fprintf(stderr," -rle          - use rle compression\n");
 366 #ifndef OPENSSL_NO_ECDH
 367         fprintf(stderr," -named_curve arg  - Elliptic curve name to use for ephemeral ECDH keys.\n" \
 368                        "                 Use \"openssl ecparam -list_curves\" for all names\n"  \
 369                        "                 (default is sect163r2).\n");
 370 #endif
 371         fprintf(stderr," -test_cipherlist - Verifies the order of the ssl cipher lists.\n"
 372                        "                    When this option is requested, the cipherlist\n"
 373                        "                    tests are run instead of handshake tests.\n");
 374         }
 375
 376 static void print_details(SSL *c_ssl, const char *prefix)
 377         {
 378         const SSL_CIPHER *ciph;
 379         X509 *cert;
 380
 381         ciph=SSL_get_current_cipher(c_ssl);
 382         BIO_printf(bio_stdout,"%s%s, cipher %s %s",
 383                 prefix,
 384                 SSL_get_version(c_ssl),
 385                 SSL_CIPHER_get_version(ciph),
 386                 SSL_CIPHER_get_name(ciph));
 387         cert=SSL_get_peer_certificate(c_ssl);
 388         if (cert != NULL)
 389                 {
 390                 EVP_PKEY *pkey = X509_get_pubkey(cert);
 391                 if (pkey != NULL)
 392                         {
 393                         if (0)
 394                                 ;
 395 #ifndef OPENSSL_NO_RSA
 396                         else if (pkey->type == EVP_PKEY_RSA && pkey->pkey.rsa != NULL
 397                                 && pkey->pkey.rsa->n != NULL)
 398                                 {
 399                                 BIO_printf(bio_stdout, ", %d bit RSA",
 400                                         BN_num_bits(pkey->pkey.rsa->n));
 401                                 }
 402 #endif
 403 #ifndef OPENSSL_NO_DSA
 404                         else if (pkey->type == EVP_PKEY_DSA && pkey->pkey.dsa != NULL
 405                                 && pkey->pkey.dsa->p != NULL)
 406                                 {
 407                                 BIO_printf(bio_stdout, ", %d bit DSA",
 408                                         BN_num_bits(pkey->pkey.dsa->p));
 409                                 }
 410 #endif
 411                         EVP_PKEY_free(pkey);
 412                         }
 413                 X509_free(cert);
 414                 }
 415         /* The SSL API does not allow us to look at temporary RSA/DH keys,
 416          * otherwise we should print their lengths too */
 417         BIO_printf(bio_stdout,"\n");
 418         }
 419
 420 static void lock_dbg_cb(int mode, int type, const char *file, int line)
 421         {
 422         static int modes[CRYPTO_NUM_LOCKS]; /* = {0, 0, ... } */
 423         const char *errstr = NULL;
 424         int rw;
 425
 426         rw = mode & (CRYPTO_READ|CRYPTO_WRITE);
 427         if (!((rw == CRYPTO_READ) || (rw == CRYPTO_WRITE)))
 428                 {
 429                 errstr = "invalid mode";
 430                 goto err;
 431                 }
 432
 433         if (type < 0 || type >= CRYPTO_NUM_LOCKS)
 434                 {
 435                 errstr = "type out of bounds";
 436                 goto err;
 437                 }
 438
 439         if (mode & CRYPTO_LOCK)
 440                 {
 441                 if (modes[type])
 442                         {
 443                         errstr = "already locked";
 444                         /* must not happen in a single-threaded program
 445                          * (would deadlock) */
 446                         goto err;
 447                         }
 448
 449                 modes[type] = rw;
 450                 }
 451         else if (mode & CRYPTO_UNLOCK)
 452                 {
 453                 if (!modes[type])
 454                         {
 455                         errstr = "not locked";
 456                         goto err;
 457                         }
 458
 459                 if (modes[type] != rw)
 460                         {
 461                         errstr = (rw == CRYPTO_READ) ?
 462                                 "CRYPTO_r_unlock on write lock" :
 463                                 "CRYPTO_w_unlock on read lock";
 464                         }
 465
 466                 modes[type] = 0;
 467                 }
 468         else
 469                 {
 470                 errstr = "invalid mode";
 471                 goto err;
 472                 }
 473
 474  err:
 475         if (errstr)
 476                 {
 477                 /* we cannot use bio_err here */
 478                 fprintf(stderr, "openssl (lock_dbg_cb): %s (mode=%d, type=%d) at %s:%d\n",
 479                         errstr, mode, type, file, line);
 480                 }
 481         }
 482
 483 #ifdef TLSEXT_TYPE_opaque_prf_input
 484 struct cb_info_st { void *input; size_t len; int ret; };
 485 struct cb_info_st co1 = { "C", 1, 1 }; /* try to negotiate oqaque PRF input */
 486 struct cb_info_st co2 = { "C", 1, 2 }; /* insist on oqaque PRF input */
 487 struct cb_info_st so1 = { "S", 1, 1 }; /* try to negotiate oqaque PRF input */
 488 struct cb_info_st so2 = { "S", 1, 2 }; /* insist on oqaque PRF input */
 489
 490 int opaque_prf_input_cb(SSL *ssl, void *peerinput, size_t len, void *arg_)
 491         {
 492         struct cb_info_st *arg = arg_;
 493
 494         if (arg == NULL)
 495                 return 1;
 496
 497         if (!SSL_set_tlsext_opaque_prf_input(ssl, arg->input, arg->len))
 498                 return 0;
 499         return arg->ret;
 500         }
 501 #endif
 502
 503 int main(int argc, char *argv[])
 504         {
 505         char *CApath=NULL,*CAfile=NULL;
 506         int badop=0;
 507         int bio_pair=0;
 508         int force=0;
 509         int tls1=0,ssl2=0,ssl3=0,ret=1;
 510         int client_auth=0;
 511         int server_auth=0,i;
 512         struct app_verify_arg app_verify_arg =
 513                 { APP_CALLBACK_STRING, 0, 0, NULL, NULL };
 514         char *server_cert=TEST_SERVER_CERT;
 515         char *server_key=NULL;
 516         char *client_cert=TEST_CLIENT_CERT;
 517         char *client_key=NULL;
 518 #ifndef OPENSSL_NO_ECDH
 519         char *named_curve = NULL;
 520 #endif
 521         SSL_CTX *s_ctx=NULL;
 522         SSL_CTX *c_ctx=NULL;
 523         const SSL_METHOD *meth=NULL;
 524         SSL *c_ssl,*s_ssl;
 525         int number=1,reuse=0;
 526         long bytes=256L;
 527 #ifndef OPENSSL_NO_DH
 528         DH *dh;
 529         int dhe1024 = 0, dhe1024dsa = 0;
 530 #endif
 531 #ifndef OPENSSL_NO_ECDH
 532         EC_KEY *ecdh = NULL;
 533 #endif
 534 #ifndef OPENSSL_NO_SRP
 535         /* client */
 536         SRP_CLIENT_ARG srp_client_arg = {NULL,NULL};
 537         /* server */
 538         SRP_SERVER_ARG srp_server_arg = {NULL,NULL};
 539 #endif
 540         int no_dhe = 0;
 541         int no_ecdhe = 0;
 542         int no_psk = 0;
 543         int print_time = 0;
 544         clock_t s_time = 0, c_time = 0;
 545         int comp = 0;
 546 #ifndef OPENSSL_NO_COMP
 547         COMP_METHOD *cm = NULL;
 548         STACK_OF(SSL_COMP) *ssl_comp_methods = NULL;
 549 #endif
 550         int test_cipherlist = 0;
 551 #ifdef OPENSSL_FIPS
 552         int fips_mode=0;
 553 #endif
 554         int no_protocol = 0;
 555
 556         verbose = 0;
 557         debug = 0;
 558         cipher = 0;
 559
 560         bio_err=BIO_new_fp(stderr,BIO_NOCLOSE|BIO_FP_TEXT);
 561
 562         CRYPTO_set_locking_callback(lock_dbg_cb);
 563
 564         /* enable memory leak checking unless explicitly disabled */
 565         if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) && (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off"))))
 566                 {
 567                 CRYPTO_malloc_debug_init();
 568                 CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
 569                 }
 570         else
 571                 {
 572                 /* OPENSSL_DEBUG_MEMORY=off */
 573                 CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0);
 574                 }
 575         CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
 576
 577         RAND_seed(rnd_seed, sizeof rnd_seed);
 578
 579         bio_stdout=BIO_new_fp(stdout,BIO_NOCLOSE|BIO_FP_TEXT);
 580
 581         argc--;
 582         argv++;
 583
 584         while (argc >= 1)
 585                 {
 586                 if(!strcmp(*argv,"-F"))
 587                         {
 588 #ifdef OPENSSL_FIPS
 589                         fips_mode=1;
 590 #else
 591                         fprintf(stderr,"not compiled with FIPS support, so exitting without running.\n");
 592                         EXIT(0);
 593 #endif
 594                         }
 595                 else if (strcmp(*argv,"-server_auth") == 0)
 596                         server_auth=1;
 597                 else if (strcmp(*argv,"-client_auth") == 0)
 598                         client_auth=1;
 599                 else if (strcmp(*argv,"-proxy_auth") == 0)
 600                         {
 601                         if (--argc < 1) goto bad;
 602                         app_verify_arg.proxy_auth= *(++argv);
 603                         }
 604                 else if (strcmp(*argv,"-proxy_cond") == 0)
 605                         {
 606                         if (--argc < 1) goto bad;
 607                         app_verify_arg.proxy_cond= *(++argv);
 608                         }
 609                 else if (strcmp(*argv,"-v") == 0)
 610                         verbose=1;
 611                 else if (strcmp(*argv,"-d") == 0)
 612                         debug=1;
 613                 else if (strcmp(*argv,"-reuse") == 0)
 614                         reuse=1;
 615                 else if (strcmp(*argv,"-dhe1024") == 0)
 616                         {
 617 #ifndef OPENSSL_NO_DH
 618                         dhe1024=1;
 619 #else
 620                         fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
 621 #endif
 622                         }
 623                 else if (strcmp(*argv,"-dhe1024dsa") == 0)
 624                         {
 625 #ifndef OPENSSL_NO_DH
 626                         dhe1024dsa=1;
 627 #else
 628                         fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
 629 #endif
 630                         }
 631                 else if (strcmp(*argv,"-no_dhe") == 0)
 632                         no_dhe=1;
 633                 else if (strcmp(*argv,"-no_ecdhe") == 0)
 634                         no_ecdhe=1;
 635                 else if (strcmp(*argv,"-psk") == 0)
 636                         {
 637                         if (--argc < 1) goto bad;
 638                         psk_key=*(++argv);
 639 #ifndef OPENSSL_NO_PSK
 640                         if (strspn(psk_key, "abcdefABCDEF1234567890") != strlen(psk_key))
 641                                 {
 642                                 BIO_printf(bio_err,"Not a hex number '%s'\n",*argv);
 643                                 goto bad;
 644                                 }
 645 #else
 646                         no_psk=1;
 647 #endif
 648                         }
 649 #ifndef OPENSSL_NO_SRP
 650                 else if (strcmp(*argv,"-srpuser") == 0)
 651                         {
 652                         if (--argc < 1) goto bad;
 653                         srp_server_arg.expected_user = srp_client_arg.srplogin= *(++argv);
 654                         tls1=1;
 655                         }
 656                 else if (strcmp(*argv,"-srppass") == 0)
 657                         {
 658                         if (--argc < 1) goto bad;
 659                         srp_server_arg.pass = srp_client_arg.srppassin= *(++argv);
 660                         tls1=1;
 661                         }
 662 #endif
 663                 else if (strcmp(*argv,"-ssl2") == 0)
 664                         {
 665 #ifdef OPENSSL_NO_SSL2
 666                         no_protocol = 1;
 667 #endif
 668                         ssl2 = 1;
 669                         }
 670                 else if (strcmp(*argv,"-tls1") == 0)
 671                         {
 672 #ifdef OPENSSL_NO_TLS1
 673                         no_protocol = 1;
 674 #endif
 675                         tls1 = 1;
 676                         }
 677                 else if (strcmp(*argv,"-ssl3") == 0)
 678                         {
 679 #ifdef OPENSSL_NO_SSL3_METHOD
 680                         no_protocol = 1;
 681 #endif
 682                         ssl3 = 1;
 683                         }
 684                 else if (strncmp(*argv,"-num",4) == 0)
 685                         {
 686                         if (--argc < 1) goto bad;
 687                         number= atoi(*(++argv));
 688                         if (number == 0) number=1;
 689                         }
 690                 else if (strcmp(*argv,"-bytes") == 0)
 691                         {
 692                         if (--argc < 1) goto bad;
 693                         bytes= atol(*(++argv));
 694                         if (bytes == 0L) bytes=1L;
 695                         i=strlen(argv[0]);
 696                         if (argv[0][i-1] == 'k') bytes*=1024L;
 697                         if (argv[0][i-1] == 'm') bytes*=1024L*1024L;
 698                         }
 699                 else if (strcmp(*argv,"-cert") == 0)
 700                         {
 701                         if (--argc < 1) goto bad;
 702                         server_cert= *(++argv);
 703                         }
 704                 else if (strcmp(*argv,"-s_cert") == 0)
 705                         {
 706                         if (--argc < 1) goto bad;
 707                         server_cert= *(++argv);
 708                         }
 709                 else if (strcmp(*argv,"-key") == 0)
 710                         {
 711                         if (--argc < 1) goto bad;
 712                         server_key= *(++argv);
 713                         }
 714                 else if (strcmp(*argv,"-s_key") == 0)
 715                         {
 716                         if (--argc < 1) goto bad;
 717                         server_key= *(++argv);
 718                         }
 719                 else if (strcmp(*argv,"-c_cert") == 0)
 720                         {
 721                         if (--argc < 1) goto bad;
 722                         client_cert= *(++argv);
 723                         }
 724                 else if (strcmp(*argv,"-c_key") == 0)
 725                         {
 726                         if (--argc < 1) goto bad;
 727                         client_key= *(++argv);
 728                         }
 729                 else if (strcmp(*argv,"-cipher") == 0)
 730                         {
 731                         if (--argc < 1) goto bad;
 732                         cipher= *(++argv);
 733                         }
 734                 else if (strcmp(*argv,"-CApath") == 0)
 735                         {
 736                         if (--argc < 1) goto bad;
 737                         CApath= *(++argv);
 738                         }
 739                 else if (strcmp(*argv,"-CAfile") == 0)
 740                         {
 741                         if (--argc < 1) goto bad;
 742                         CAfile= *(++argv);
 743                         }
 744                 else if (strcmp(*argv,"-bio_pair") == 0)
 745                         {
 746                         bio_pair = 1;
 747                         }
 748                 else if (strcmp(*argv,"-f") == 0)
 749                         {
 750                         force = 1;
 751                         }
 752                 else if (strcmp(*argv,"-time") == 0)
 753                         {
 754                         print_time = 1;
 755                         }
 756                 else if (strcmp(*argv,"-zlib") == 0)
 757                         {
 758                         comp = COMP_ZLIB;
 759                         }
 760                 else if (strcmp(*argv,"-rle") == 0)
 761                         {
 762                         comp = COMP_RLE;
 763                         }
 764                 else if (strcmp(*argv,"-named_curve") == 0)
 765                         {
 766                         if (--argc < 1) goto bad;
 767 #ifndef OPENSSL_NO_ECDH
 768                         named_curve = *(++argv);
 769 #else
 770                         fprintf(stderr,"ignoring -named_curve, since I'm compiled without ECDH\n");
 771                         ++argv;
 772 #endif
 773                         }
 774                 else if (strcmp(*argv,"-app_verify") == 0)
 775                         {
 776                         app_verify_arg.app_verify = 1;
 777                         }
 778                 else if (strcmp(*argv,"-proxy") == 0)
 779                         {
 780                         app_verify_arg.allow_proxy_certs = 1;
 781                         }
 782                 else if (strcmp(*argv,"-test_cipherlist") == 0)
 783                         {
 784                         test_cipherlist = 1;
 785                         }
 786                 else
 787                         {
 788                         fprintf(stderr,"unknown option %s\n",*argv);
 789                         badop=1;
 790                         break;
 791                         }
 792                 argc--;
 793                 argv++;
 794                 }
 795         if (badop)
 796                 {
 797 bad:
 798                 sv_usage();
 799                 goto end;
 800                 }
 801
 802         /*
 803          * test_cipherlist prevails over protocol switch: we test the cipherlist
 804          * for all enabled protocols.
 805          */
 806         if (test_cipherlist == 1)
 807                 {
 808                 /* ensure that the cipher list are correctly sorted and exit */
 809                 fprintf(stdout, "Testing cipherlist order only. Ignoring all "
 810                         "other options.\n");
 811                 if (do_test_cipherlist() == 0)
 812                         EXIT(1);
 813                 ret = 0;
 814                 goto end;
 815                 }
 816
 817         if (ssl2 + ssl3 + tls1 > 1)
 818                 {
 819                 fprintf(stderr, "At most one of -ssl2, -ssl3, or -tls1 should "
 820                         "be requested.\n");
 821                 EXIT(1);
 822                 }
 823
 824         /*
 825          * Testing was requested for a compiled-out protocol (e.g. SSLv2).
 826          * Ideally, we would error out, but the generic test wrapper can't know
 827          * when to expect failure. So we do nothing and return success.
 828          */
 829         if (no_protocol)
 830                 {
 831                 fprintf(stderr, "Testing was requested for a disabled protocol. "
 832                         "Skipping tests.\n");
 833                 ret = 0;
 834                 goto end;
 835                 }
 836
 837         if (!ssl2 && !ssl3 && !tls1 && number > 1 && !reuse && !force)
 838                 {
 839                 fprintf(stderr, "This case cannot work.  Use -f to perform "
 840                         "the test anyway (and\n-d to see what happens), "
 841                         "or add one of -ssl2, -ssl3, -tls1, -reuse\n"
 842                         "to avoid protocol mismatch.\n");
 843                 EXIT(1);
 844                 }
 845
 846 #ifdef OPENSSL_FIPS
 847         if(fips_mode)
 848                 {
 849                 if(!FIPS_mode_set(1))
 850                         {
 851                         ERR_load_crypto_strings();
 852                         ERR_print_errors(BIO_new_fp(stderr,BIO_NOCLOSE));
 853                         EXIT(1);
 854                         }
 855                 else
 856                         fprintf(stderr,"*** IN FIPS MODE ***\n");
 857                 }
 858 #endif
 859
 860         if (print_time)
 861                 {
 862                 if (!bio_pair)
 863                         {
 864                         fprintf(stderr, "Using BIO pair (-bio_pair)\n");
 865                         bio_pair = 1;
 866                         }
 867                 if (number < 50 && !force)
 868                         fprintf(stderr, "Warning: For accurate timings, use more connections (e.g. -num 1000)\n");
 869                 }
 870
 871 /*      if (cipher == NULL) cipher=getenv("SSL_CIPHER"); */
 872
 873         SSL_library_init();
 874         SSL_load_error_strings();
 875
 876 #ifndef OPENSSL_NO_COMP
 877         if (comp == COMP_ZLIB) cm = COMP_zlib();
 878         if (comp == COMP_RLE) cm = COMP_rle();
 879         if (cm != NULL)
 880                 {
 881                 if (cm->type != NID_undef)
 882                         {
 883                         if (SSL_COMP_add_compression_method(comp, cm) != 0)
 884                                 {
 885                                 fprintf(stderr,
 886                                         "Failed to add compression method\n");
 887                                 ERR_print_errors_fp(stderr);
 888                                 }
 889                         }
 890                 else
 891                         {
 892                         fprintf(stderr,
 893                                 "Warning: %s compression not supported\n",
 894                                 (comp == COMP_RLE ? "rle" :
 895                                         (comp == COMP_ZLIB ? "zlib" :
 896                                                 "unknown")));
 897                         ERR_print_errors_fp(stderr);
 898                         }
 899                 }
 900         ssl_comp_methods = SSL_COMP_get_compression_methods();
 901         fprintf(stderr, "Available compression methods:\n");
 902         {
 903         int j, n = sk_SSL_COMP_num(ssl_comp_methods);
 904         if (n == 0)
 905                 fprintf(stderr, "  NONE\n");
 906         else
 907                 for (j = 0; j < n; j++)
 908                         {
 909                         SSL_COMP *c = sk_SSL_COMP_value(ssl_comp_methods, j);
 910                         fprintf(stderr, "  %d: %s\n", c->id, c->name);
 911                         }
 912         }
 913 #endif
 914
 915 /* At this point, ssl2/ssl3/tls1 is only set if the protocol is available.
 916  * (Otherwise we exit early.)
 917  * However the compiler doesn't know this, so we ifdef. */
 918 #ifndef OPENSSL_NO_SSL2
 919         if (ssl2)
 920                 meth=SSLv2_method();
 921         else
 922 #endif
 923 #ifndef OPENSSL_NO_SSL3
 924         if (ssl3)
 925                 meth=SSLv3_method();
 926         else
 927 #endif
 928 #ifndef OPENSSL_NO_TLS1
 929         if (tls1)
 930                 meth=TLSv1_method();
 931         else
 932 #endif
 933         meth=SSLv23_method();
 934
 935         c_ctx=SSL_CTX_new(meth);
 936         s_ctx=SSL_CTX_new(meth);
 937         if ((c_ctx == NULL) || (s_ctx == NULL))
 938                 {
 939                 ERR_print_errors(bio_err);
 940                 goto end;
 941                 }
 942
 943         if (cipher != NULL)
 944                 {
 945                 SSL_CTX_set_cipher_list(c_ctx,cipher);
 946                 SSL_CTX_set_cipher_list(s_ctx,cipher);
 947                 }
 948
 949 #ifndef OPENSSL_NO_DH
 950         if (!no_dhe)
 951                 {
 952                 if (dhe1024dsa)
 953                         {
 954                         /* use SSL_OP_SINGLE_DH_USE to avoid small subgroup attacks */
 955                         SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
 956                         dh=get_dh1024dsa();
 957                         }
 958                 else if (dhe1024)
 959                         dh=get_dh1024();
 960                 else
 961                         dh=get_dh512();
 962                 SSL_CTX_set_tmp_dh(s_ctx,dh);
 963                 DH_free(dh);
 964                 }
 965 #else
 966         (void)no_dhe;
 967 #endif
 968
 969 #ifndef OPENSSL_NO_ECDH
 970         if (!no_ecdhe)
 971                 {
 972                 int nid;
 973
 974                 if (named_curve != NULL)
 975                         {
 976                         nid = OBJ_sn2nid(named_curve);
 977                         if (nid == 0)
 978                         {
 979                                 BIO_printf(bio_err, "unknown curve name (%s)\n", named_curve);
 980                                 goto end;
 981                                 }
 982                         }
 983                 else
 984 #ifdef OPENSSL_NO_EC2M
 985                         nid = NID_X9_62_prime256v1;
 986 #else
 987                         nid = NID_sect163r2;
 988 #endif
 989
 990                 ecdh = EC_KEY_new_by_curve_name(nid);
 991                 if (ecdh == NULL)
 992                         {
 993                         BIO_printf(bio_err, "unable to create curve\n");
 994                         goto end;
 995                         }
 996
 997                 SSL_CTX_set_tmp_ecdh(s_ctx, ecdh);
 998                 SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_ECDH_USE);
 999                 EC_KEY_free(ecdh);
1000                 }
1001 #else
1002         (void)no_ecdhe;
1003 #endif
1004
1005 #ifndef OPENSSL_NO_RSA
1006         SSL_CTX_set_tmp_rsa_callback(s_ctx,tmp_rsa_cb);
1007 #endif
1008
1009 #ifdef TLSEXT_TYPE_opaque_prf_input
1010         SSL_CTX_set_tlsext_opaque_prf_input_callback(c_ctx, opaque_prf_input_cb);
1011         SSL_CTX_set_tlsext_opaque_prf_input_callback(s_ctx, opaque_prf_input_cb);
1012         SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(c_ctx, &co1); /* or &co2 or NULL */
1013         SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(s_ctx, &so1); /* or &so2 or NULL */
1014 #endif
1015
1016         if (!SSL_CTX_use_certificate_file(s_ctx,server_cert,SSL_FILETYPE_PEM))
1017                 {
1018                 ERR_print_errors(bio_err);
1019                 }
1020         else if (!SSL_CTX_use_PrivateKey_file(s_ctx,
1021                 (server_key?server_key:server_cert), SSL_FILETYPE_PEM))
1022                 {
1023                 ERR_print_errors(bio_err);
1024                 goto end;
1025                 }
1026
1027         if (client_auth)
1028                 {
1029                 SSL_CTX_use_certificate_file(c_ctx,client_cert,
1030                         SSL_FILETYPE_PEM);
1031                 SSL_CTX_use_PrivateKey_file(c_ctx,
1032                         (client_key?client_key:client_cert),
1033                         SSL_FILETYPE_PEM);
1034                 }
1035
1036         if (    (!SSL_CTX_load_verify_locations(s_ctx,CAfile,CApath)) ||
1037                 (!SSL_CTX_set_default_verify_paths(s_ctx)) ||
1038                 (!SSL_CTX_load_verify_locations(c_ctx,CAfile,CApath)) ||
1039                 (!SSL_CTX_set_default_verify_paths(c_ctx)))
1040                 {
1041                 /* fprintf(stderr,"SSL_load_verify_locations\n"); */
1042                 ERR_print_errors(bio_err);
1043                 /* goto end; */
1044                 }
1045
1046         if (client_auth)
1047                 {
1048                 BIO_printf(bio_err,"client authentication\n");
1049                 SSL_CTX_set_verify(s_ctx,
1050                         SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
1051                         verify_callback);
1052                 SSL_CTX_set_cert_verify_callback(s_ctx, app_verify_callback, &app_verify_arg);
1053                 }
1054         if (server_auth)
1055                 {
1056                 BIO_printf(bio_err,"server authentication\n");
1057                 SSL_CTX_set_verify(c_ctx,SSL_VERIFY_PEER,
1058                         verify_callback);
1059                 SSL_CTX_set_cert_verify_callback(c_ctx, app_verify_callback, &app_verify_arg);
1060                 }
1061
1062         {
1063                 int session_id_context = 0;
1064                 SSL_CTX_set_session_id_context(s_ctx, (void *)&session_id_context, sizeof session_id_context);
1065         }
1066
1067         /* Use PSK only if PSK key is given */
1068         if (psk_key != NULL)
1069                 {
1070                 /* no_psk is used to avoid putting psk command to openssl tool */
1071                 if (no_psk)
1072                         {
1073                         /* if PSK is not compiled in and psk key is
1074                          * given, do nothing and exit successfully */
1075                         ret=0;
1076                         goto end;
1077                         }
1078 #ifndef OPENSSL_NO_PSK
1079                 SSL_CTX_set_psk_client_callback(c_ctx, psk_client_callback);
1080                 SSL_CTX_set_psk_server_callback(s_ctx, psk_server_callback);
1081                 if (debug)
1082                         BIO_printf(bio_err,"setting PSK identity hint to s_ctx\n");
1083                 if (!SSL_CTX_use_psk_identity_hint(s_ctx, "ctx server identity_hint"))
1084                         {
1085                         BIO_printf(bio_err,"error setting PSK identity hint to s_ctx\n");
1086                         ERR_print_errors(bio_err);
1087                         goto end;
1088                         }
1089 #endif
1090                 }
1091 #ifndef OPENSSL_NO_SRP
1092         if (srp_client_arg.srplogin)
1093                 {
1094                 if (!SSL_CTX_set_srp_username(c_ctx, srp_client_arg.srplogin))
1095                         {
1096                         BIO_printf(bio_err,"Unable to set SRP username\n");
1097                         goto end;
1098                         }
1099                 SSL_CTX_set_srp_cb_arg(c_ctx,&srp_client_arg);
1100                 SSL_CTX_set_srp_client_pwd_callback(c_ctx, ssl_give_srp_client_pwd_cb);
1101                 /*SSL_CTX_set_srp_strength(c_ctx, srp_client_arg.strength);*/
1102                 }
1103
1104         if (srp_server_arg.expected_user != NULL)
1105                 {
1106                 SSL_CTX_set_verify(s_ctx,SSL_VERIFY_NONE,verify_callback);
1107                 SSL_CTX_set_srp_cb_arg(s_ctx, &srp_server_arg);
1108                 SSL_CTX_set_srp_username_callback(s_ctx, ssl_srp_server_param_cb);
1109                 }
1110 #endif
1111
1112         c_ssl=SSL_new(c_ctx);
1113         s_ssl=SSL_new(s_ctx);
1114
1115 #ifndef OPENSSL_NO_KRB5
1116         if (c_ssl  &&  c_ssl->kssl_ctx)
1117                 {
1118                 char    localhost[MAXHOSTNAMELEN+2];
1119
1120                 if (gethostname(localhost, sizeof localhost-1) == 0)
1121                         {
1122                         localhost[sizeof localhost-1]='\0';
1123                         if(strlen(localhost) == sizeof localhost-1)
1124                                 {
1125                                 BIO_printf(bio_err,"localhost name too long\n");
1126                                 goto end;
1127                                 }
1128                         kssl_ctx_setstring(c_ssl->kssl_ctx, KSSL_SERVER,
1129                                 localhost);
1130                         }
1131                 }
1132 #endif    /* OPENSSL_NO_KRB5  */
1133
1134         for (i=0; i<number; i++)
1135                 {
1136                 if (!reuse) SSL_set_session(c_ssl,NULL);
1137                 if (bio_pair)
1138                         ret=doit_biopair(s_ssl,c_ssl,bytes,&s_time,&c_time);
1139                 else
1140                         ret=doit(s_ssl,c_ssl,bytes);
1141                 }
1142
1143         if (!verbose)
1144                 {
1145                 print_details(c_ssl, "");
1146                 }
1147         if ((number > 1) || (bytes > 1L))
1148                 BIO_printf(bio_stdout, "%d handshakes of %ld bytes done\n",number,bytes);
1149         if (print_time)
1150                 {
1151 #ifdef CLOCKS_PER_SEC
1152                 /* "To determine the time in seconds, the value returned
1153                  * by the clock function should be divided by the value
1154                  * of the macro CLOCKS_PER_SEC."
1155                  *                                       -- ISO/IEC 9899 */
1156                 BIO_printf(bio_stdout, "Approximate total server time: %6.2f s\n"
1157                         "Approximate total client time: %6.2f s\n",
1158                         (double)s_time/CLOCKS_PER_SEC,
1159                         (double)c_time/CLOCKS_PER_SEC);
1160 #else
1161                 /* "`CLOCKS_PER_SEC' undeclared (first use this function)"
1162                  *                            -- cc on NeXTstep/OpenStep */
1163                 BIO_printf(bio_stdout,
1164                         "Approximate total server time: %6.2f units\n"
1165                         "Approximate total client time: %6.2f units\n",
1166                         (double)s_time,
1167                         (double)c_time);
1168 #endif
1169                 }
1170
1171         SSL_free(s_ssl);
1172         SSL_free(c_ssl);
1173
1174 end:
1175         if (s_ctx != NULL) SSL_CTX_free(s_ctx);
1176         if (c_ctx != NULL) SSL_CTX_free(c_ctx);
1177
1178         if (bio_stdout != NULL) BIO_free(bio_stdout);
1179
1180 #ifndef OPENSSL_NO_RSA
1181         free_tmp_rsa();
1182 #endif
1183 #ifndef OPENSSL_NO_ENGINE
1184         ENGINE_cleanup();
1185 #endif
1186         CRYPTO_cleanup_all_ex_data();
1187         ERR_free_strings();
1188         ERR_remove_thread_state(NULL);
1189         EVP_cleanup();
1190         CRYPTO_mem_leaks(bio_err);
1191         if (bio_err != NULL) BIO_free(bio_err);
1192         EXIT(ret);
1193         return ret;
1194         }
1195
1196 int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count,
1197         clock_t *s_time, clock_t *c_time)
1198         {
1199         long cw_num = count, cr_num = count, sw_num = count, sr_num = count;
1200         BIO *s_ssl_bio = NULL, *c_ssl_bio = NULL;
1201         BIO *server = NULL, *server_io = NULL, *client = NULL, *client_io = NULL;
1202         int ret = 1;
1203
1204         size_t bufsiz = 256; /* small buffer for testing */
1205
1206         if (!BIO_new_bio_pair(&server, bufsiz, &server_io, bufsiz))
1207                 goto err;
1208         if (!BIO_new_bio_pair(&client, bufsiz, &client_io, bufsiz))
1209                 goto err;
1210
1211         s_ssl_bio = BIO_new(BIO_f_ssl());
1212         if (!s_ssl_bio)
1213                 goto err;
1214
1215         c_ssl_bio = BIO_new(BIO_f_ssl());
1216         if (!c_ssl_bio)
1217                 goto err;
1218
1219         SSL_set_connect_state(c_ssl);
1220         SSL_set_bio(c_ssl, client, client);
1221         (void)BIO_set_ssl(c_ssl_bio, c_ssl, BIO_NOCLOSE);
1222
1223         SSL_set_accept_state(s_ssl);
1224         SSL_set_bio(s_ssl, server, server);
1225         (void)BIO_set_ssl(s_ssl_bio, s_ssl, BIO_NOCLOSE);
1226
1227         do
1228                 {
1229                 /* c_ssl_bio:          SSL filter BIO
1230                  *
1231                  * client:             pseudo-I/O for SSL library
1232                  *
1233                  * client_io:          client's SSL communication; usually to be
1234                  *                     relayed over some I/O facility, but in this
1235                  *                     test program, we're the server, too:
1236                  *
1237                  * server_io:          server's SSL communication
1238                  *
1239                  * server:             pseudo-I/O for SSL library
1240                  *
1241                  * s_ssl_bio:          SSL filter BIO
1242                  *
1243                  * The client and the server each employ a "BIO pair":
1244                  * client + client_io, server + server_io.
1245                  * BIO pairs are symmetric.  A BIO pair behaves similar
1246                  * to a non-blocking socketpair (but both endpoints must
1247                  * be handled by the same thread).
1248                  * [Here we could connect client and server to the ends
1249                  * of a single BIO pair, but then this code would be less
1250                  * suitable as an example for BIO pairs in general.]
1251                  *
1252                  * Useful functions for querying the state of BIO pair endpoints:
1253                  *
1254                  * BIO_ctrl_pending(bio)              number of bytes we can read now
1255                  * BIO_ctrl_get_read_request(bio)     number of bytes needed to fulfil
1256                  *                                      other side's read attempt
1257                  * BIO_ctrl_get_write_guarantee(bio)   number of bytes we can write now
1258                  *
1259                  * ..._read_request is never more than ..._write_guarantee;
1260                  * it depends on the application which one you should use.
1261                  */
1262
1263                 /* We have non-blocking behaviour throughout this test program, but
1264                  * can be sure that there is *some* progress in each iteration; so
1265                  * we don't have to worry about ..._SHOULD_READ or ..._SHOULD_WRITE
1266                  * -- we just try everything in each iteration
1267                  */
1268
1269                         {
1270                         /* CLIENT */
1271
1272                         MS_STATIC char cbuf[1024*8];
1273                         int i, r;
1274                         clock_t c_clock = clock();
1275
1276                         memset(cbuf, 0, sizeof(cbuf));
1277
1278                         if (debug)
1279                                 if (SSL_in_init(c_ssl))
1280                                         printf("client waiting in SSL_connect - %s\n",
1281                                                 SSL_state_string_long(c_ssl));
1282
1283                         if (cw_num > 0)
1284                                 {
1285                                 /* Write to server. */
1286
1287                                 if (cw_num > (long)sizeof cbuf)
1288                                         i = sizeof cbuf;
1289                                 else
1290                                         i = (int)cw_num;
1291                                 r = BIO_write(c_ssl_bio, cbuf, i);
1292                                 if (r < 0)
1293                                         {
1294                                         if (!BIO_should_retry(c_ssl_bio))
1295                                                 {
1296                                                 fprintf(stderr,"ERROR in CLIENT\n");
1297                                                 goto err;
1298                                                 }
1299                                         /* BIO_should_retry(...) can just be ignored here.
1300                                          * The library expects us to call BIO_write with
1301                                          * the same arguments again, and that's what we will
1302                                          * do in the next iteration. */
1303                                         }
1304                                 else if (r == 0)
1305                                         {
1306                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1307                                         goto err;
1308                                         }
1309                                 else
1310                                         {
1311                                         if (debug)
1312                                                 printf("client wrote %d\n", r);
1313                                         cw_num -= r;
1314                                         }
1315                                 }
1316
1317                         if (cr_num > 0)
1318                                 {
1319                                 /* Read from server. */
1320
1321                                 r = BIO_read(c_ssl_bio, cbuf, sizeof(cbuf));
1322                                 if (r < 0)
1323                                         {
1324                                         if (!BIO_should_retry(c_ssl_bio))
1325                                                 {
1326                                                 fprintf(stderr,"ERROR in CLIENT\n");
1327                                                 goto err;
1328                                                 }
1329                                         /* Again, "BIO_should_retry" can be ignored. */
1330                                         }
1331                                 else if (r == 0)
1332                                         {
1333                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1334                                         goto err;
1335                                         }
1336                                 else
1337                                         {
1338                                         if (debug)
1339                                                 printf("client read %d\n", r);
1340                                         cr_num -= r;
1341                                         }
1342                                 }
1343
1344                         /* c_time and s_time increments will typically be very small
1345                          * (depending on machine speed and clock tick intervals),
1346                          * but sampling over a large number of connections should
1347                          * result in fairly accurate figures.  We cannot guarantee
1348                          * a lot, however -- if each connection lasts for exactly
1349                          * one clock tick, it will be counted only for the client
1350                          * or only for the server or even not at all.
1351                          */
1352                         *c_time += (clock() - c_clock);
1353                         }
1354
1355                         {
1356                         /* SERVER */
1357
1358                         MS_STATIC char sbuf[1024*8];
1359                         int i, r;
1360                         clock_t s_clock = clock();
1361
1362                         memset(sbuf, 0, sizeof(sbuf));
1363
1364                         if (debug)
1365                                 if (SSL_in_init(s_ssl))
1366                                         printf("server waiting in SSL_accept - %s\n",
1367                                                 SSL_state_string_long(s_ssl));
1368
1369                         if (sw_num > 0)
1370                                 {
1371                                 /* Write to client. */
1372
1373                                 if (sw_num > (long)sizeof sbuf)
1374                                         i = sizeof sbuf;
1375                                 else
1376                                         i = (int)sw_num;
1377                                 r = BIO_write(s_ssl_bio, sbuf, i);
1378                                 if (r < 0)
1379                                         {
1380                                         if (!BIO_should_retry(s_ssl_bio))
1381                                                 {
1382                                                 fprintf(stderr,"ERROR in SERVER\n");
1383                                                 goto err;
1384                                                 }
1385                                         /* Ignore "BIO_should_retry". */
1386                                         }
1387                                 else if (r == 0)
1388                                         {
1389                                         fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1390                                         goto err;
1391                                         }
1392                                 else
1393                                         {
1394                                         if (debug)
1395                                                 printf("server wrote %d\n", r);
1396                                         sw_num -= r;
1397                                         }
1398                                 }
1399
1400                         if (sr_num > 0)
1401                                 {
1402                                 /* Read from client. */
1403
1404                                 r = BIO_read(s_ssl_bio, sbuf, sizeof(sbuf));
1405                                 if (r < 0)
1406                                         {
1407                                         if (!BIO_should_retry(s_ssl_bio))
1408                                                 {
1409                                                 fprintf(stderr,"ERROR in SERVER\n");
1410                                                 goto err;
1411                                                 }
1412                                         /* blah, blah */
1413                                         }
1414                                 else if (r == 0)
1415                                         {
1416                                         fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1417                                         goto err;
1418                                         }
1419                                 else
1420                                         {
1421                                         if (debug)
1422                                                 printf("server read %d\n", r);
1423                                         sr_num -= r;
1424                                         }
1425                                 }
1426
1427                         *s_time += (clock() - s_clock);
1428                         }
1429
1430                         {
1431                         /* "I/O" BETWEEN CLIENT AND SERVER. */
1432
1433                         size_t r1, r2;
1434                         BIO *io1 = server_io, *io2 = client_io;
1435                         /* we use the non-copying interface for io1
1436                          * and the standard BIO_write/BIO_read interface for io2
1437                          */
1438
1439                         static int prev_progress = 1;
1440                         int progress = 0;
1441
1442                         /* io1 to io2 */
1443                         do
1444                                 {
1445                                 size_t num;
1446                                 int r;
1447
1448                                 r1 = BIO_ctrl_pending(io1);
1449                                 r2 = BIO_ctrl_get_write_guarantee(io2);
1450
1451                                 num = r1;
1452                                 if (r2 < num)
1453                                         num = r2;
1454                                 if (num)
1455                                         {
1456                                         char *dataptr;
1457
1458                                         if (INT_MAX < num) /* yeah, right */
1459                                                 num = INT_MAX;
1460
1461                                         r = BIO_nread(io1, &dataptr, (int)num);
1462                                         assert(r > 0);
1463                                         assert(r <= (int)num);
1464                                         /* possibly r < num (non-contiguous data) */
1465                                         num = r;
1466                                         r = BIO_write(io2, dataptr, (int)num);
1467                                         if (r != (int)num) /* can't happen */
1468                                                 {
1469                                                 fprintf(stderr, "ERROR: BIO_write could not write "
1470                                                         "BIO_ctrl_get_write_guarantee() bytes");
1471                                                 goto err;
1472                                                 }
1473                                         progress = 1;
1474
1475                                         if (debug)
1476                                                 printf((io1 == client_io) ?
1477                                                         "C->S relaying: %d bytes\n" :
1478                                                         "S->C relaying: %d bytes\n",
1479                                                         (int)num);
1480                                         }
1481                                 }
1482                         while (r1 && r2);
1483
1484                         /* io2 to io1 */
1485                         {
1486                                 size_t num;
1487                                 int r;
1488
1489                                 r1 = BIO_ctrl_pending(io2);
1490                                 r2 = BIO_ctrl_get_read_request(io1);
1491                                 /* here we could use ..._get_write_guarantee instead of
1492                                  * ..._get_read_request, but by using the latter
1493                                  * we test restartability of the SSL implementation
1494                                  * more thoroughly */
1495                                 num = r1;
1496                                 if (r2 < num)
1497                                         num = r2;
1498                                 if (num)
1499                                         {
1500                                         char *dataptr;
1501
1502                                         if (INT_MAX < num)
1503                                                 num = INT_MAX;
1504
1505                                         if (num > 1)
1506                                                 --num; /* test restartability even more thoroughly */
1507
1508                                         r = BIO_nwrite0(io1, &dataptr);
1509                                         assert(r > 0);
1510                                         if (r < (int)num)
1511                                                 num = r;
1512                                         r = BIO_read(io2, dataptr, (int)num);
1513                                         if (r != (int)num) /* can't happen */
1514                                                 {
1515                                                 fprintf(stderr, "ERROR: BIO_read could not read "
1516                                                         "BIO_ctrl_pending() bytes");
1517                                                 goto err;
1518                                                 }
1519                                         progress = 1;
1520                                         r = BIO_nwrite(io1, &dataptr, (int)num);
1521                                         if (r != (int)num) /* can't happen */
1522                                                 {
1523                                                 fprintf(stderr, "ERROR: BIO_nwrite() did not accept "
1524                                                         "BIO_nwrite0() bytes");
1525                                                 goto err;
1526                                                 }
1527
1528                                         if (debug)
1529                                                 printf((io2 == client_io) ?
1530                                                         "C->S relaying: %d bytes\n" :
1531                                                         "S->C relaying: %d bytes\n",
1532                                                         (int)num);
1533                                         }
1534                         } /* no loop, BIO_ctrl_get_read_request now returns 0 anyway */
1535
1536                         if (!progress && !prev_progress)
1537                                 if (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0)
1538                                         {
1539                                         fprintf(stderr, "ERROR: got stuck\n");
1540                                         if (strcmp("SSLv2", SSL_get_version(c_ssl)) == 0)
1541                                                 {
1542                                                 fprintf(stderr, "This can happen for SSL2 because "
1543                                                         "CLIENT-FINISHED and SERVER-VERIFY are written \n"
1544                                                         "concurrently ...");
1545                                                 if (strncmp("2SCF", SSL_state_string(c_ssl), 4) == 0
1546                                                         && strncmp("2SSV", SSL_state_string(s_ssl), 4) == 0)
1547                                                         {
1548                                                         fprintf(stderr, " ok.\n");
1549                                                         goto end;
1550                                                         }
1551                                                 }
1552                                         fprintf(stderr, " ERROR.\n");
1553                                         goto err;
1554                                         }
1555                         prev_progress = progress;
1556                         }
1557                 }
1558         while (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0);
1559
1560         if (verbose)
1561                 print_details(c_ssl, "DONE via BIO pair: ");
1562 end:
1563         ret = 0;
1564
1565  err:
1566         ERR_print_errors(bio_err);
1567
1568         if (server)
1569                 BIO_free(server);
1570         if (server_io)
1571                 BIO_free(server_io);
1572         if (client)
1573                 BIO_free(client);
1574         if (client_io)
1575                 BIO_free(client_io);
1576         if (s_ssl_bio)
1577                 BIO_free(s_ssl_bio);
1578         if (c_ssl_bio)
1579                 BIO_free(c_ssl_bio);
1580
1581         return ret;
1582         }
1583
1584
1585 #define W_READ  1
1586 #define W_WRITE 2
1587 #define C_DONE  1
1588 #define S_DONE  2
1589
1590 int doit(SSL *s_ssl, SSL *c_ssl, long count)
1591         {
1592         MS_STATIC char cbuf[1024*8],sbuf[1024*8];
1593         long cw_num=count,cr_num=count;
1594         long sw_num=count,sr_num=count;
1595         int ret=1;
1596         BIO *c_to_s=NULL;
1597         BIO *s_to_c=NULL;
1598         BIO *c_bio=NULL;
1599         BIO *s_bio=NULL;
1600         int c_r,c_w,s_r,s_w;
1601         int i,j;
1602         int done=0;
1603         int c_write,s_write;
1604         int do_server=0,do_client=0;
1605
1606         memset(cbuf,0,sizeof(cbuf));
1607         memset(sbuf,0,sizeof(sbuf));
1608
1609         c_to_s=BIO_new(BIO_s_mem());
1610         s_to_c=BIO_new(BIO_s_mem());
1611         if ((s_to_c == NULL) || (c_to_s == NULL))
1612                 {
1613                 ERR_print_errors(bio_err);
1614                 goto err;
1615                 }
1616
1617         c_bio=BIO_new(BIO_f_ssl());
1618         s_bio=BIO_new(BIO_f_ssl());
1619         if ((c_bio == NULL) || (s_bio == NULL))
1620                 {
1621                 ERR_print_errors(bio_err);
1622                 goto err;
1623                 }
1624
1625         SSL_set_connect_state(c_ssl);
1626         SSL_set_bio(c_ssl,s_to_c,c_to_s);
1627         BIO_set_ssl(c_bio,c_ssl,BIO_NOCLOSE);
1628
1629         SSL_set_accept_state(s_ssl);
1630         SSL_set_bio(s_ssl,c_to_s,s_to_c);
1631         BIO_set_ssl(s_bio,s_ssl,BIO_NOCLOSE);
1632
1633         c_r=0; s_r=1;
1634         c_w=1; s_w=0;
1635         c_write=1,s_write=0;
1636
1637         /* We can always do writes */
1638         for (;;)
1639                 {
1640                 do_server=0;
1641                 do_client=0;
1642
1643                 i=(int)BIO_pending(s_bio);
1644                 if ((i && s_r) || s_w) do_server=1;
1645
1646                 i=(int)BIO_pending(c_bio);
1647                 if ((i && c_r) || c_w) do_client=1;
1648
1649                 if (do_server && debug)
1650                         {
1651                         if (SSL_in_init(s_ssl))
1652                                 printf("server waiting in SSL_accept - %s\n",
1653                                         SSL_state_string_long(s_ssl));
1654 /*                      else if (s_write)
1655                                 printf("server:SSL_write()\n");
1656                         else
1657                                 printf("server:SSL_read()\n"); */
1658                         }
1659
1660                 if (do_client && debug)
1661                         {
1662                         if (SSL_in_init(c_ssl))
1663                                 printf("client waiting in SSL_connect - %s\n",
1664                                         SSL_state_string_long(c_ssl));
1665 /*                      else if (c_write)
1666                                 printf("client:SSL_write()\n");
1667                         else
1668                                 printf("client:SSL_read()\n"); */
1669                         }
1670
1671                 if (!do_client && !do_server)
1672                         {
1673                         fprintf(stdout,"ERROR IN STARTUP\n");
1674                         ERR_print_errors(bio_err);
1675                         break;
1676                         }
1677                 if (do_client && !(done & C_DONE))
1678                         {
1679                         if (c_write)
1680                                 {
1681                                 j = (cw_num > (long)sizeof(cbuf)) ?
1682                                         (int)sizeof(cbuf) : (int)cw_num;
1683                                 i=BIO_write(c_bio,cbuf,j);
1684                                 if (i < 0)
1685                                         {
1686                                         c_r=0;
1687                                         c_w=0;
1688                                         if (BIO_should_retry(c_bio))
1689                                                 {
1690                                                 if (BIO_should_read(c_bio))
1691                                                         c_r=1;
1692                                                 if (BIO_should_write(c_bio))
1693                                                         c_w=1;
1694                                                 }
1695                                         else
1696                                                 {
1697                                                 fprintf(stderr,"ERROR in CLIENT\n");
1698                                                 ERR_print_errors(bio_err);
1699                                                 goto err;
1700                                                 }
1701                                         }
1702                                 else if (i == 0)
1703                                         {
1704                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1705                                         goto err;
1706                                         }
1707                                 else
1708                                         {
1709                                         if (debug)
1710                                                 printf("client wrote %d\n",i);
1711                                         /* ok */
1712                                         s_r=1;
1713                                         c_write=0;
1714                                         cw_num-=i;
1715                                         }
1716                                 }
1717                         else
1718                                 {
1719                                 i=BIO_read(c_bio,cbuf,sizeof(cbuf));
1720                                 if (i < 0)
1721                                         {
1722                                         c_r=0;
1723                                         c_w=0;
1724                                         if (BIO_should_retry(c_bio))
1725                                                 {
1726                                                 if (BIO_should_read(c_bio))
1727                                                         c_r=1;
1728                                                 if (BIO_should_write(c_bio))
1729                                                         c_w=1;
1730                                                 }
1731                                         else
1732                                                 {
1733                                                 fprintf(stderr,"ERROR in CLIENT\n");
1734                                                 ERR_print_errors(bio_err);
1735                                                 goto err;
1736                                                 }
1737                                         }
1738                                 else if (i == 0)
1739                                         {
1740                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1741                                         goto err;
1742                                         }
1743                                 else
1744                                         {
1745                                         if (debug)
1746                                                 printf("client read %d\n",i);
1747                                         cr_num-=i;
1748                                         if (sw_num > 0)
1749                                                 {
1750                                                 s_write=1;
1751                                                 s_w=1;
1752                                                 }
1753                                         if (cr_num <= 0)
1754                                                 {
1755                                                 s_write=1;
1756                                                 s_w=1;
1757                                                 done=S_DONE|C_DONE;
1758                                                 }
1759                                         }
1760                                 }
1761                         }
1762
1763                 if (do_server && !(done & S_DONE))
1764                         {
1765                         if (!s_write)
1766                                 {
1767                                 i=BIO_read(s_bio,sbuf,sizeof(cbuf));
1768                                 if (i < 0)
1769                                         {
1770                                         s_r=0;
1771                                         s_w=0;
1772                                         if (BIO_should_retry(s_bio))
1773                                                 {
1774                                                 if (BIO_should_read(s_bio))
1775                                                         s_r=1;
1776                                                 if (BIO_should_write(s_bio))
1777                                                         s_w=1;
1778                                                 }
1779                                         else
1780                                                 {
1781                                                 fprintf(stderr,"ERROR in SERVER\n");
1782                                                 ERR_print_errors(bio_err);
1783                                                 goto err;
1784                                                 }
1785                                         }
1786                                 else if (i == 0)
1787                                         {
1788                                         ERR_print_errors(bio_err);
1789                                         fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_read\n");
1790                                         goto err;
1791                                         }
1792                                 else
1793                                         {
1794                                         if (debug)
1795                                                 printf("server read %d\n",i);
1796                                         sr_num-=i;
1797                                         if (cw_num > 0)
1798                                                 {
1799                                                 c_write=1;
1800                                                 c_w=1;
1801                                                 }
1802                                         if (sr_num <= 0)
1803                                                 {
1804                                                 s_write=1;
1805                                                 s_w=1;
1806                                                 c_write=0;
1807                                                 }
1808                                         }
1809                                 }
1810                         else
1811                                 {
1812                                 j = (sw_num > (long)sizeof(sbuf)) ?
1813                                         (int)sizeof(sbuf) : (int)sw_num;
1814                                 i=BIO_write(s_bio,sbuf,j);
1815                                 if (i < 0)
1816                                         {
1817                                         s_r=0;
1818                                         s_w=0;
1819                                         if (BIO_should_retry(s_bio))
1820                                                 {
1821                                                 if (BIO_should_read(s_bio))
1822                                                         s_r=1;
1823                                                 if (BIO_should_write(s_bio))
1824                                                         s_w=1;
1825                                                 }
1826                                         else
1827                                                 {
1828                                                 fprintf(stderr,"ERROR in SERVER\n");
1829                                                 ERR_print_errors(bio_err);
1830                                                 goto err;
1831                                                 }
1832                                         }
1833                                 else if (i == 0)
1834                                         {
1835                                         ERR_print_errors(bio_err);
1836                                         fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_write\n");
1837                                         goto err;
1838                                         }
1839                                 else
1840                                         {
1841                                         if (debug)
1842                                                 printf("server wrote %d\n",i);
1843                                         sw_num-=i;
1844                                         s_write=0;
1845                                         c_r=1;
1846                                         if (sw_num <= 0)
1847                                                 done|=S_DONE;
1848                                         }
1849                                 }
1850                         }
1851
1852                 if ((done & S_DONE) && (done & C_DONE)) break;
1853                 }
1854
1855         if (verbose)
1856                 print_details(c_ssl, "DONE: ");
1857         ret=0;
1858 err:
1859         /* We have to set the BIO's to NULL otherwise they will be
1860          * OPENSSL_free()ed twice.  Once when th s_ssl is SSL_free()ed and
1861          * again when c_ssl is SSL_free()ed.
1862          * This is a hack required because s_ssl and c_ssl are sharing the same
1863          * BIO structure and SSL_set_bio() and SSL_free() automatically
1864          * BIO_free non NULL entries.
1865          * You should not normally do this or be required to do this */
1866         if (s_ssl != NULL)
1867                 {
1868                 s_ssl->rbio=NULL;
1869                 s_ssl->wbio=NULL;
1870                 }
1871         if (c_ssl != NULL)
1872                 {
1873                 c_ssl->rbio=NULL;
1874                 c_ssl->wbio=NULL;
1875                 }
1876
1877         if (c_to_s != NULL) BIO_free(c_to_s);
1878         if (s_to_c != NULL) BIO_free(s_to_c);
1879         if (c_bio != NULL) BIO_free_all(c_bio);
1880         if (s_bio != NULL) BIO_free_all(s_bio);
1881         return(ret);
1882         }
1883
1884 static int get_proxy_auth_ex_data_idx(void)
1885         {
1886         static volatile int idx = -1;
1887         if (idx < 0)
1888                 {
1889                 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
1890                 if (idx < 0)
1891                         {
1892                         idx = X509_STORE_CTX_get_ex_new_index(0,
1893                                 "SSLtest for verify callback", NULL,NULL,NULL);
1894                         }
1895                 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
1896                 }
1897         return idx;
1898         }
1899
1900 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
1901         {
1902         char *s,buf[256];
1903
1904         s=X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),buf,
1905                             sizeof buf);
1906         if (s != NULL)
1907                 {
1908                 if (ok)
1909                         fprintf(stderr,"depth=%d %s\n",
1910                                 ctx->error_depth,buf);
1911                 else
1912                         {
1913                         fprintf(stderr,"depth=%d error=%d %s\n",
1914                                 ctx->error_depth,ctx->error,buf);
1915                         }
1916                 }
1917
1918         if (ok == 0)
1919                 {
1920                 fprintf(stderr,"Error string: %s\n",
1921                         X509_verify_cert_error_string(ctx->error));
1922                 switch (ctx->error)
1923                         {
1924                 case X509_V_ERR_CERT_NOT_YET_VALID:
1925                 case X509_V_ERR_CERT_HAS_EXPIRED:
1926                 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
1927                         fprintf(stderr,"  ... ignored.\n");
1928                         ok=1;
1929                         }
1930                 }
1931
1932         if (ok == 1)
1933                 {
1934                 X509 *xs = ctx->current_cert;
1935 #if 0
1936                 X509 *xi = ctx->current_issuer;
1937 #endif
1938
1939                 if (xs->ex_flags & EXFLAG_PROXY)
1940                         {
1941                         unsigned int *letters =
1942                                 X509_STORE_CTX_get_ex_data(ctx,
1943                                         get_proxy_auth_ex_data_idx());
1944
1945                         if (letters)
1946                                 {
1947                                 int found_any = 0;
1948                                 int i;
1949                                 PROXY_CERT_INFO_EXTENSION *pci =
1950                                         X509_get_ext_d2i(xs, NID_proxyCertInfo,
1951                                                 NULL, NULL);
1952
1953                                 switch (OBJ_obj2nid(pci->proxyPolicy->policyLanguage))
1954                                         {
1955                                 case NID_Independent:
1956                                         /* Completely meaningless in this
1957                                            program, as there's no way to
1958                                            grant explicit rights to a
1959                                            specific PrC.  Basically, using
1960                                            id-ppl-Independent is the perfect
1961                                            way to grant no rights at all. */
1962                                         fprintf(stderr, "  Independent proxy certificate");
1963                                         for (i = 0; i < 26; i++)
1964                                                 letters[i] = 0;
1965                                         break;
1966                                 case NID_id_ppl_inheritAll:
1967                                         /* This is basically a NOP, we
1968                                            simply let the current rights
1969                                            stand as they are. */
1970                                         fprintf(stderr, "  Proxy certificate inherits all");
1971                                         break;
1972                                 default:
1973                                         s = (char *)
1974                                                 pci->proxyPolicy->policy->data;
1975                                         i = pci->proxyPolicy->policy->length;
1976
1977                                         /* The algorithm works as follows:
1978                                            it is assumed that previous
1979                                            iterations or the initial granted
1980                                            rights has already set some elements
1981                                            of `letters'.  What we need to do is
1982                                            to clear those that weren't granted
1983                                            by the current PrC as well.  The
1984                                            easiest way to do this is to add 1
1985                                            to all the elements whose letters
1986                                            are given with the current policy.
1987                                            That way, all elements that are set
1988                                            by the current policy and were
1989                                            already set by earlier policies and
1990                                            through the original grant of rights
1991                                            will get the value 2 or higher.
1992                                            The last thing to do is to sweep
1993                                            through `letters' and keep the
1994                                            elements having the value 2 as set,
1995                                            and clear all the others. */
1996
1997                                         fprintf(stderr, "  Certificate proxy rights = %*.*s", i, i, s);
1998                                         while(i-- > 0)
1999                                                 {
2000                                                 int c = *s++;
2001                                                 if (isascii(c) && isalpha(c))
2002                                                         {
2003                                                         if (islower(c))
2004                                                                 c = toupper(c);
2005                                                         letters[c - 'A']++;
2006                                                         }
2007                                                 }
2008                                         for (i = 0; i < 26; i++)
2009                                                 if (letters[i] < 2)
2010                                                         letters[i] = 0;
2011                                                 else
2012                                                         letters[i] = 1;
2013                                         }
2014
2015                                 found_any = 0;
2016                                 fprintf(stderr,
2017                                         ", resulting proxy rights = ");
2018                                 for(i = 0; i < 26; i++)
2019                                         if (letters[i])
2020                                                 {
2021                                                 fprintf(stderr, "%c", i + 'A');
2022                                                 found_any = 1;
2023                                                 }
2024                                 if (!found_any)
2025                                         fprintf(stderr, "none");
2026                                 fprintf(stderr, "\n");
2027
2028                                 PROXY_CERT_INFO_EXTENSION_free(pci);
2029                                 }
2030                         }
2031                 }
2032
2033         return(ok);
2034         }
2035
2036 static void process_proxy_debug(int indent, const char *format, ...)
2037         {
2038         static const char indentation[] =
2039                 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"
2040                 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"; /* That's 80 > */
2041         char my_format[256];
2042         va_list args;
2043
2044         BIO_snprintf(my_format, sizeof(my_format), "%*.*s %s",
2045                 indent, indent, indentation, format);
2046
2047         va_start(args, format);
2048         vfprintf(stderr, my_format, args);
2049         va_end(args);
2050         }
2051 /* Priority levels:
2052    0    [!]var, ()
2053    1    & ^
2054    2    |
2055 */
2056 static int process_proxy_cond_adders(unsigned int letters[26],
2057         const char *cond, const char **cond_end, int *pos, int indent);
2058 static int process_proxy_cond_val(unsigned int letters[26],
2059         const char *cond, const char **cond_end, int *pos, int indent)
2060         {
2061         int c;
2062         int ok = 1;
2063         int negate = 0;
2064
2065         while(isspace((int)*cond))
2066                 {
2067                 cond++; (*pos)++;
2068                 }
2069         c = *cond;
2070
2071         if (debug)
2072                 process_proxy_debug(indent,
2073                         "Start process_proxy_cond_val at position %d: %s\n",
2074                         *pos, cond);
2075
2076         while(c == '!')
2077                 {
2078                 negate = !negate;
2079                 cond++; (*pos)++;
2080                 while(isspace((int)*cond))
2081                         {
2082                         cond++; (*pos)++;
2083                         }
2084                 c = *cond;
2085                 }
2086
2087         if (c == '(')
2088                 {
2089                 cond++; (*pos)++;
2090                 ok = process_proxy_cond_adders(letters, cond, cond_end, pos,
2091                         indent + 1);
2092                 cond = *cond_end;
2093                 if (ok < 0)
2094                         goto end;
2095                 while(isspace((int)*cond))
2096                         {
2097                         cond++; (*pos)++;
2098                         }
2099                 c = *cond;
2100                 if (c != ')')
2101                         {
2102                         fprintf(stderr,
2103                                 "Weird condition character in position %d: "
2104                                 "%c\n", *pos, c);
2105                         ok = -1;
2106                         goto end;
2107                         }
2108                 cond++; (*pos)++;
2109                 }
2110         else if (isascii(c) && isalpha(c))
2111                 {
2112                 if (islower(c))
2113                         c = toupper(c);
2114                 ok = letters[c - 'A'];
2115                 cond++; (*pos)++;
2116                 }
2117         else
2118                 {
2119                 fprintf(stderr,
2120                         "Weird condition character in position %d: "
2121                         "%c\n", *pos, c);
2122                 ok = -1;
2123                 goto end;
2124                 }
2125  end:
2126         *cond_end = cond;
2127         if (ok >= 0 && negate)
2128                 ok = !ok;
2129
2130         if (debug)
2131                 process_proxy_debug(indent,
2132                         "End process_proxy_cond_val at position %d: %s, returning %d\n",
2133                         *pos, cond, ok);
2134
2135         return ok;
2136         }
2137 static int process_proxy_cond_multipliers(unsigned int letters[26],
2138         const char *cond, const char **cond_end, int *pos, int indent)
2139         {
2140         int ok;
2141         char c;
2142
2143         if (debug)
2144                 process_proxy_debug(indent,
2145                         "Start process_proxy_cond_multipliers at position %d: %s\n",
2146                         *pos, cond);
2147
2148         ok = process_proxy_cond_val(letters, cond, cond_end, pos, indent + 1);
2149         cond = *cond_end;
2150         if (ok < 0)
2151                 goto end;
2152
2153         while(ok >= 0)
2154                 {
2155                 while(isspace((int)*cond))
2156                         {
2157                         cond++; (*pos)++;
2158                         }
2159                 c = *cond;
2160
2161                 switch(c)
2162                         {
2163                 case '&':
2164                 case '^':
2165                         {
2166                         int save_ok = ok;
2167
2168                         cond++; (*pos)++;
2169                         ok = process_proxy_cond_val(letters,
2170                                 cond, cond_end, pos, indent + 1);
2171                         cond = *cond_end;
2172                         if (ok < 0)
2173                                 break;
2174
2175                         switch(c)
2176                                 {
2177                         case '&':
2178                                 ok &= save_ok;
2179                                 break;
2180                         case '^':
2181                                 ok ^= save_ok;
2182                                 break;
2183                         default:
2184                                 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
2185                                         " STOPPING\n");
2186                                 EXIT(1);
2187                                 }
2188                         }
2189                         break;
2190                 default:
2191                         goto end;
2192                         }
2193                 }
2194  end:
2195         if (debug)
2196                 process_proxy_debug(indent,
2197                         "End process_proxy_cond_multipliers at position %d: %s, returning %d\n",
2198                         *pos, cond, ok);
2199
2200         *cond_end = cond;
2201         return ok;
2202         }
2203 static int process_proxy_cond_adders(unsigned int letters[26],
2204         const char *cond, const char **cond_end, int *pos, int indent)
2205         {
2206         int ok;
2207         char c;
2208
2209         if (debug)
2210                 process_proxy_debug(indent,
2211                         "Start process_proxy_cond_adders at position %d: %s\n",
2212                         *pos, cond);
2213
2214         ok = process_proxy_cond_multipliers(letters, cond, cond_end, pos,
2215                 indent + 1);
2216         cond = *cond_end;
2217         if (ok < 0)
2218                 goto end;
2219
2220         while(ok >= 0)
2221                 {
2222                 while(isspace((int)*cond))
2223                         {
2224                         cond++; (*pos)++;
2225                         }
2226                 c = *cond;
2227
2228                 switch(c)
2229                         {
2230                 case '|':
2231                         {
2232                         int save_ok = ok;
2233
2234                         cond++; (*pos)++;
2235                         ok = process_proxy_cond_multipliers(letters,
2236                                 cond, cond_end, pos, indent + 1);
2237                         cond = *cond_end;
2238                         if (ok < 0)
2239                                 break;
2240
2241                         switch(c)
2242                                 {
2243                         case '|':
2244                                 ok |= save_ok;
2245                                 break;
2246                         default:
2247                                 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
2248                                         " STOPPING\n");
2249                                 EXIT(1);
2250                                 }
2251                         }
2252                         break;
2253                 default:
2254                         goto end;
2255                         }
2256                 }
2257  end:
2258         if (debug)
2259                 process_proxy_debug(indent,
2260                         "End process_proxy_cond_adders at position %d: %s, returning %d\n",
2261                         *pos, cond, ok);
2262
2263         *cond_end = cond;
2264         return ok;
2265         }
2266
2267 static int process_proxy_cond(unsigned int letters[26],
2268         const char *cond, const char **cond_end)
2269         {
2270         int pos = 1;
2271         return process_proxy_cond_adders(letters, cond, cond_end, &pos, 1);
2272         }
2273
2274 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg)
2275         {
2276         int ok=1;
2277         struct app_verify_arg *cb_arg = arg;
2278         unsigned int letters[26]; /* only used with proxy_auth */
2279
2280         if (cb_arg->app_verify)
2281                 {
2282                 char *s = NULL,buf[256];
2283
2284                 fprintf(stderr, "In app_verify_callback, allowing cert. ");
2285                 fprintf(stderr, "Arg is: %s\n", cb_arg->string);
2286                 fprintf(stderr, "Finished printing do we have a context? 0x%p a cert? 0x%p\n",
2287                         (void *)ctx, (void *)ctx->cert);
2288                 if (ctx->cert)
2289                         s=X509_NAME_oneline(X509_get_subject_name(ctx->cert),buf,256);
2290                 if (s != NULL)
2291                         {
2292                         fprintf(stderr,"cert depth=%d %s\n",ctx->error_depth,buf);
2293                         }
2294                 return(1);
2295                 }
2296         if (cb_arg->proxy_auth)
2297                 {
2298                 int found_any = 0, i;
2299                 char *sp;
2300
2301                 for(i = 0; i < 26; i++)
2302                         letters[i] = 0;
2303                 for(sp = cb_arg->proxy_auth; *sp; sp++)
2304                         {
2305                         int c = *sp;
2306                         if (isascii(c) && isalpha(c))
2307                                 {
2308                                 if (islower(c))
2309                                         c = toupper(c);
2310                                 letters[c - 'A'] = 1;
2311                                 }
2312                         }
2313
2314                 fprintf(stderr,
2315                         "  Initial proxy rights = ");
2316                 for(i = 0; i < 26; i++)
2317                         if (letters[i])
2318                                 {
2319                                 fprintf(stderr, "%c", i + 'A');
2320                                 found_any = 1;
2321                                 }
2322                 if (!found_any)
2323                         fprintf(stderr, "none");
2324                 fprintf(stderr, "\n");
2325
2326                 X509_STORE_CTX_set_ex_data(ctx,
2327                         get_proxy_auth_ex_data_idx(),letters);
2328                 }
2329         if (cb_arg->allow_proxy_certs)
2330                 {
2331                 X509_STORE_CTX_set_flags(ctx, X509_V_FLAG_ALLOW_PROXY_CERTS);
2332                 }
2333
2334 #ifndef OPENSSL_NO_X509_VERIFY
2335         ok = X509_verify_cert(ctx);
2336 #endif
2337
2338         if (cb_arg->proxy_auth)
2339                 {
2340                 if (ok > 0)
2341                         {
2342                         const char *cond_end = NULL;
2343
2344                         ok = process_proxy_cond(letters,
2345                                 cb_arg->proxy_cond, &cond_end);
2346
2347                         if (ok < 0)
2348                                 EXIT(3);
2349                         if (*cond_end)
2350                                 {
2351                                 fprintf(stderr, "Stopped processing condition before it's end.\n");
2352                                 ok = 0;
2353                                 }
2354                         if (!ok)
2355                                 fprintf(stderr, "Proxy rights check with condition '%s' proved invalid\n",
2356                                         cb_arg->proxy_cond);
2357                         else
2358                                 fprintf(stderr, "Proxy rights check with condition '%s' proved valid\n",
2359                                         cb_arg->proxy_cond);
2360                         }
2361                 }
2362         return(ok);
2363         }
2364
2365 #ifndef OPENSSL_NO_RSA
2366 static RSA *rsa_tmp=NULL;
2367
2368 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength)
2369         {
2370         BIGNUM *bn = NULL;
2371         if (rsa_tmp == NULL)
2372                 {
2373                 bn = BN_new();
2374                 rsa_tmp = RSA_new();
2375                 if(!bn || !rsa_tmp || !BN_set_word(bn, RSA_F4))
2376                         {
2377                         BIO_printf(bio_err, "Memory error...");
2378                         goto end;
2379                         }
2380                 BIO_printf(bio_err,"Generating temp (%d bit) RSA key...",keylength);
2381                 (void)BIO_flush(bio_err);
2382                 if(!RSA_generate_key_ex(rsa_tmp,keylength,bn,NULL))
2383                         {
2384                         BIO_printf(bio_err, "Error generating key.");
2385                         RSA_free(rsa_tmp);
2386                         rsa_tmp = NULL;
2387                         }
2388 end:
2389                 BIO_printf(bio_err,"\n");
2390                 (void)BIO_flush(bio_err);
2391                 }
2392         if(bn) BN_free(bn);
2393         return(rsa_tmp);
2394         }
2395
2396 static void free_tmp_rsa(void)
2397         {
2398         if (rsa_tmp != NULL)
2399                 {
2400                 RSA_free(rsa_tmp);
2401                 rsa_tmp = NULL;
2402                 }
2403         }
2404 #endif
2405
2406 #ifndef OPENSSL_NO_DH
2407 /* These DH parameters have been generated as follows:
2408  *    $ openssl dhparam -C -noout 512
2409  *    $ openssl dhparam -C -noout 1024
2410  *    $ openssl dhparam -C -noout -dsaparam 1024
2411  * (The third function has been renamed to avoid name conflicts.)
2412  */
2413 static DH *get_dh512()
2414         {
2415         static unsigned char dh512_p[]={
2416                 0xCB,0xC8,0xE1,0x86,0xD0,0x1F,0x94,0x17,0xA6,0x99,0xF0,0xC6,
2417                 0x1F,0x0D,0xAC,0xB6,0x25,0x3E,0x06,0x39,0xCA,0x72,0x04,0xB0,
2418                 0x6E,0xDA,0xC0,0x61,0xE6,0x7A,0x77,0x25,0xE8,0x3B,0xB9,0x5F,
2419                 0x9A,0xB6,0xB5,0xFE,0x99,0x0B,0xA1,0x93,0x4E,0x35,0x33,0xB8,
2420                 0xE1,0xF1,0x13,0x4F,0x59,0x1A,0xD2,0x57,0xC0,0x26,0x21,0x33,
2421                 0x02,0xC5,0xAE,0x23,
2422                 };
2423         static unsigned char dh512_g[]={
2424                 0x02,
2425                 };
2426         DH *dh;
2427
2428         if ((dh=DH_new()) == NULL) return(NULL);
2429         dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
2430         dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
2431         if ((dh->p == NULL) || (dh->g == NULL))
2432                 { DH_free(dh); return(NULL); }
2433         return(dh);
2434         }
2435
2436 static DH *get_dh1024()
2437         {
2438         static unsigned char dh1024_p[]={
2439                 0xF8,0x81,0x89,0x7D,0x14,0x24,0xC5,0xD1,0xE6,0xF7,0xBF,0x3A,
2440                 0xE4,0x90,0xF4,0xFC,0x73,0xFB,0x34,0xB5,0xFA,0x4C,0x56,0xA2,
2441                 0xEA,0xA7,0xE9,0xC0,0xC0,0xCE,0x89,0xE1,0xFA,0x63,0x3F,0xB0,
2442                 0x6B,0x32,0x66,0xF1,0xD1,0x7B,0xB0,0x00,0x8F,0xCA,0x87,0xC2,
2443                 0xAE,0x98,0x89,0x26,0x17,0xC2,0x05,0xD2,0xEC,0x08,0xD0,0x8C,
2444                 0xFF,0x17,0x52,0x8C,0xC5,0x07,0x93,0x03,0xB1,0xF6,0x2F,0xB8,
2445                 0x1C,0x52,0x47,0x27,0x1B,0xDB,0xD1,0x8D,0x9D,0x69,0x1D,0x52,
2446                 0x4B,0x32,0x81,0xAA,0x7F,0x00,0xC8,0xDC,0xE6,0xD9,0xCC,0xC1,
2447                 0x11,0x2D,0x37,0x34,0x6C,0xEA,0x02,0x97,0x4B,0x0E,0xBB,0xB1,
2448                 0x71,0x33,0x09,0x15,0xFD,0xDD,0x23,0x87,0x07,0x5E,0x89,0xAB,
2449                 0x6B,0x7C,0x5F,0xEC,0xA6,0x24,0xDC,0x53,
2450                 };
2451         static unsigned char dh1024_g[]={
2452                 0x02,
2453                 };
2454         DH *dh;
2455
2456         if ((dh=DH_new()) == NULL) return(NULL);
2457         dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2458         dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2459         if ((dh->p == NULL) || (dh->g == NULL))
2460                 { DH_free(dh); return(NULL); }
2461         return(dh);
2462         }
2463
2464 static DH *get_dh1024dsa()
2465         {
2466         static unsigned char dh1024_p[]={
2467                 0xC8,0x00,0xF7,0x08,0x07,0x89,0x4D,0x90,0x53,0xF3,0xD5,0x00,
2468                 0x21,0x1B,0xF7,0x31,0xA6,0xA2,0xDA,0x23,0x9A,0xC7,0x87,0x19,
2469                 0x3B,0x47,0xB6,0x8C,0x04,0x6F,0xFF,0xC6,0x9B,0xB8,0x65,0xD2,
2470                 0xC2,0x5F,0x31,0x83,0x4A,0xA7,0x5F,0x2F,0x88,0x38,0xB6,0x55,
2471                 0xCF,0xD9,0x87,0x6D,0x6F,0x9F,0xDA,0xAC,0xA6,0x48,0xAF,0xFC,
2472                 0x33,0x84,0x37,0x5B,0x82,0x4A,0x31,0x5D,0xE7,0xBD,0x52,0x97,
2473                 0xA1,0x77,0xBF,0x10,0x9E,0x37,0xEA,0x64,0xFA,0xCA,0x28,0x8D,
2474                 0x9D,0x3B,0xD2,0x6E,0x09,0x5C,0x68,0xC7,0x45,0x90,0xFD,0xBB,
2475                 0x70,0xC9,0x3A,0xBB,0xDF,0xD4,0x21,0x0F,0xC4,0x6A,0x3C,0xF6,
2476                 0x61,0xCF,0x3F,0xD6,0x13,0xF1,0x5F,0xBC,0xCF,0xBC,0x26,0x9E,
2477                 0xBC,0x0B,0xBD,0xAB,0x5D,0xC9,0x54,0x39,
2478                 };
2479         static unsigned char dh1024_g[]={
2480                 0x3B,0x40,0x86,0xE7,0xF3,0x6C,0xDE,0x67,0x1C,0xCC,0x80,0x05,
2481                 0x5A,0xDF,0xFE,0xBD,0x20,0x27,0x74,0x6C,0x24,0xC9,0x03,0xF3,
2482                 0xE1,0x8D,0xC3,0x7D,0x98,0x27,0x40,0x08,0xB8,0x8C,0x6A,0xE9,
2483                 0xBB,0x1A,0x3A,0xD6,0x86,0x83,0x5E,0x72,0x41,0xCE,0x85,0x3C,
2484                 0xD2,0xB3,0xFC,0x13,0xCE,0x37,0x81,0x9E,0x4C,0x1C,0x7B,0x65,
2485                 0xD3,0xE6,0xA6,0x00,0xF5,0x5A,0x95,0x43,0x5E,0x81,0xCF,0x60,
2486                 0xA2,0x23,0xFC,0x36,0xA7,0x5D,0x7A,0x4C,0x06,0x91,0x6E,0xF6,
2487                 0x57,0xEE,0x36,0xCB,0x06,0xEA,0xF5,0x3D,0x95,0x49,0xCB,0xA7,
2488                 0xDD,0x81,0xDF,0x80,0x09,0x4A,0x97,0x4D,0xA8,0x22,0x72,0xA1,
2489                 0x7F,0xC4,0x70,0x56,0x70,0xE8,0x20,0x10,0x18,0x8F,0x2E,0x60,
2490                 0x07,0xE7,0x68,0x1A,0x82,0x5D,0x32,0xA2,
2491                 };
2492         DH *dh;
2493
2494         if ((dh=DH_new()) == NULL) return(NULL);
2495         dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2496         dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2497         if ((dh->p == NULL) || (dh->g == NULL))
2498                 { DH_free(dh); return(NULL); }
2499         dh->length = 160;
2500         return(dh);
2501         }
2502 #endif
2503
2504 #ifndef OPENSSL_NO_PSK
2505 /* convert the PSK key (psk_key) in ascii to binary (psk) */
2506 static int psk_key2bn(const char *pskkey, unsigned char *psk,
2507         unsigned int max_psk_len)
2508         {
2509         int ret;
2510         BIGNUM *bn = NULL;
2511
2512         ret = BN_hex2bn(&bn, pskkey);
2513         if (!ret)
2514                 {
2515                 BIO_printf(bio_err,"Could not convert PSK key '%s' to BIGNUM\n", pskkey);
2516                 if (bn)
2517                         BN_free(bn);
2518                 return 0;
2519                 }
2520         if (BN_num_bytes(bn) > (int)max_psk_len)
2521                 {
2522                 BIO_printf(bio_err,"psk buffer of callback is too small (%d) for key (%d)\n",
2523                         max_psk_len, BN_num_bytes(bn));
2524                 BN_free(bn);
2525                 return 0;
2526                 }
2527         ret = BN_bn2bin(bn, psk);
2528         BN_free(bn);
2529         return ret;
2530         }
2531
2532 static unsigned int psk_client_callback(SSL *ssl, const char *hint, char *identity,
2533         unsigned int max_identity_len, unsigned char *psk,
2534         unsigned int max_psk_len)
2535         {
2536         int ret;
2537         unsigned int psk_len = 0;
2538
2539         ret = BIO_snprintf(identity, max_identity_len, "Client_identity");
2540         if (ret < 0)
2541                 goto out_err;
2542         if (debug)
2543                 fprintf(stderr, "client: created identity '%s' len=%d\n", identity, ret);
2544         ret = psk_key2bn(psk_key, psk, max_psk_len);
2545         if (ret < 0)
2546                 goto out_err;
2547         psk_len = ret;
2548 out_err:
2549         return psk_len;
2550         }
2551
2552 static unsigned int psk_server_callback(SSL *ssl, const char *identity,
2553         unsigned char *psk, unsigned int max_psk_len)
2554         {
2555         unsigned int psk_len=0;
2556
2557         if (strcmp(identity, "Client_identity") != 0)
2558                 {
2559                 BIO_printf(bio_err, "server: PSK error: client identity not found\n");
2560                 return 0;
2561                 }
2562         psk_len=psk_key2bn(psk_key, psk, max_psk_len);
2563         return psk_len;
2564         }
2565 #endif
2566
2567 static int do_test_cipherlist(void)
2568         {
2569         int i = 0;
2570         const SSL_METHOD *meth;
2571         const SSL_CIPHER *ci, *tci = NULL;
2572
2573 #ifndef OPENSSL_NO_SSL2
2574         fprintf(stderr, "testing SSLv2 cipher list order: ");
2575         meth = SSLv2_method();
2576         while ((ci = meth->get_cipher(i++)) != NULL)
2577                 {
2578                 if (tci != NULL)
2579                         if (ci->id >= tci->id)
2580                                 {
2581                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2582                                 return 0;
2583                                 }
2584                 tci = ci;
2585                 }
2586         fprintf(stderr, "ok\n");
2587 #endif
2588 #ifndef OPENSSL_NO_SSL3
2589         fprintf(stderr, "testing SSLv3 cipher list order: ");
2590         meth = SSLv3_method();
2591         tci = NULL;
2592         while ((ci = meth->get_cipher(i++)) != NULL)
2593                 {
2594                 if (tci != NULL)
2595                         if (ci->id >= tci->id)
2596                                 {
2597                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2598                                 return 0;
2599                                 }
2600                 tci = ci;
2601                 }
2602         fprintf(stderr, "ok\n");
2603 #endif
2604 #ifndef OPENSSL_NO_TLS1
2605         fprintf(stderr, "testing TLSv1 cipher list order: ");
2606         meth = TLSv1_method();
2607         tci = NULL;
2608         while ((ci = meth->get_cipher(i++)) != NULL)
2609                 {
2610                 if (tci != NULL)
2611                         if (ci->id >= tci->id)
2612                                 {
2613                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2614                                 return 0;
2615                                 }
2616                 tci = ci;
2617                 }
2618         fprintf(stderr, "ok\n");
2619 #endif
2620
2621         return 1;
2622         }