ssl/ssltest.c

   1 /* ssl/ssltest.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111 /* ====================================================================
 112  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
 113  * ECC cipher suite support in OpenSSL originally developed by
 114  * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
 115  */
 116
 117 #define _BSD_SOURCE 1           /* Or gethostname won't be declared properly
 118                                    on Linux and GNU platforms. */
 119
 120 #include <assert.h>
 121 #include <errno.h>
 122 #include <limits.h>
 123 #include <stdio.h>
 124 #include <stdlib.h>
 125 #include <string.h>
 126 #include <time.h>
 127
 128 #define USE_SOCKETS
 129 #include "e_os.h"
 130
 131 #define _XOPEN_SOURCE 500       /* Or isascii won't be declared properly on
 132                                    VMS (at least with DECompHP C).  */
 133 #include <ctype.h>
 134
 135 #include <openssl/bio.h>
 136 #include <openssl/crypto.h>
 137 #include <openssl/evp.h>
 138 #include <openssl/x509.h>
 139 #include <openssl/x509v3.h>
 140 #include <openssl/ssl.h>
 141 #ifndef OPENSSL_NO_ENGINE
 142 #include <openssl/engine.h>
 143 #endif
 144 #include <openssl/err.h>
 145 #include <openssl/rand.h>
 146 #ifndef OPENSSL_NO_RSA
 147 #include <openssl/rsa.h>
 148 #endif
 149 #ifndef OPENSSL_NO_DSA
 150 #include <openssl/dsa.h>
 151 #endif
 152 #ifndef OPENSSL_NO_DH
 153 #include <openssl/dh.h>
 154 #endif
 155 #include <openssl/bn.h>
 156
 157 #define _XOPEN_SOURCE_EXTENDED  1 /* Or gethostname won't be declared properly
 158                                      on Compaq platforms (at least with DEC C).
 159                                      Do not try to put it earlier, or IPv6 includes
 160                                      get screwed...
 161                                   */
 162
 163 #ifdef OPENSSL_SYS_WINDOWS
 164 #include <winsock.h>
 165 #else
 166 #include OPENSSL_UNISTD
 167 #endif
 168
 169 #ifdef OPENSSL_SYS_VMS
 170 #  define TEST_SERVER_CERT "SYS$DISK:[-.APPS]SERVER.PEM"
 171 #  define TEST_CLIENT_CERT "SYS$DISK:[-.APPS]CLIENT.PEM"
 172 #elif defined(OPENSSL_SYS_WINCE)
 173 #  define TEST_SERVER_CERT "\\OpenSSL\\server.pem"
 174 #  define TEST_CLIENT_CERT "\\OpenSSL\\client.pem"
 175 #elif defined(OPENSSL_SYS_NETWARE)
 176 #  define TEST_SERVER_CERT "\\openssl\\apps\\server.pem"
 177 #  define TEST_CLIENT_CERT "\\openssl\\apps\\client.pem"
 178 #else
 179 #  define TEST_SERVER_CERT "../apps/server.pem"
 180 #  define TEST_CLIENT_CERT "../apps/client.pem"
 181 #endif
 182
 183 /* There is really no standard for this, so let's assign some tentative
 184    numbers.  In any case, these numbers are only for this test */
 185 #define COMP_RLE        255
 186 #define COMP_ZLIB       1
 187
 188 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
 189 #ifndef OPENSSL_NO_RSA
 190 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export,int keylength);
 191 static void free_tmp_rsa(void);
 192 #endif
 193 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg);
 194 #define APP_CALLBACK_STRING "Test Callback Argument"
 195 struct app_verify_arg
 196         {
 197         char *string;
 198         int app_verify;
 199         int allow_proxy_certs;
 200         char *proxy_auth;
 201         char *proxy_cond;
 202         };
 203
 204 #ifndef OPENSSL_NO_DH
 205 static DH *get_dh512(void);
 206 static DH *get_dh1024(void);
 207 static DH *get_dh1024dsa(void);
 208 #endif
 209
 210 static BIO *bio_err=NULL;
 211 static BIO *bio_stdout=NULL;
 212
 213 static char *cipher=NULL;
 214 static int verbose=0;
 215 static int debug=0;
 216 #if 0
 217 /* Not used yet. */
 218 #ifdef FIONBIO
 219 static int s_nbio=0;
 220 #endif
 221 #endif
 222
 223 static const char rnd_seed[] = "string to make the random number generator think it has entropy";
 224
 225 int doit_biopair(SSL *s_ssl,SSL *c_ssl,long bytes,clock_t *s_time,clock_t *c_time);
 226 int doit(SSL *s_ssl,SSL *c_ssl,long bytes);
 227 static int do_test_cipherlist(void);
 228 static void sv_usage(void)
 229         {
 230         fprintf(stderr,"usage: ssltest [args ...]\n");
 231         fprintf(stderr,"\n");
 232         fprintf(stderr," -server_auth  - check server certificate\n");
 233         fprintf(stderr," -client_auth  - do client authentication\n");
 234         fprintf(stderr," -proxy        - allow proxy certificates\n");
 235         fprintf(stderr," -proxy_auth <val> - set proxy policy rights\n");
 236         fprintf(stderr," -proxy_cond <val> - experssion to test proxy policy rights\n");
 237         fprintf(stderr," -v            - more output\n");
 238         fprintf(stderr," -d            - debug output\n");
 239         fprintf(stderr," -reuse        - use session-id reuse\n");
 240         fprintf(stderr," -num <val>    - number of connections to perform\n");
 241         fprintf(stderr," -bytes <val>  - number of bytes to swap between client/server\n");
 242 #ifndef OPENSSL_NO_DH
 243         fprintf(stderr," -dhe1024      - use 1024 bit key (safe prime) for DHE\n");
 244         fprintf(stderr," -dhe1024dsa   - use 1024 bit key (with 160-bit subprime) for DHE\n");
 245         fprintf(stderr," -no_dhe       - disable DHE\n");
 246 #endif
 247 #ifndef OPENSSL_NO_ECDH
 248         fprintf(stderr," -no_ecdhe     - disable ECDHE\n");
 249 #endif
 250 #ifndef OPENSSL_NO_SSL2
 251         fprintf(stderr," -ssl2         - use SSLv2\n");
 252 #endif
 253 #ifndef OPENSSL_NO_SSL3
 254         fprintf(stderr," -ssl3         - use SSLv3\n");
 255 #endif
 256 #ifndef OPENSSL_NO_TLS1
 257         fprintf(stderr," -tls1         - use TLSv1\n");
 258 #endif
 259         fprintf(stderr," -CApath arg   - PEM format directory of CA's\n");
 260         fprintf(stderr," -CAfile arg   - PEM format file of CA's\n");
 261         fprintf(stderr," -cert arg     - Server certificate file\n");
 262         fprintf(stderr," -key arg      - Server key file (default: same as -cert)\n");
 263         fprintf(stderr," -c_cert arg   - Client certificate file\n");
 264         fprintf(stderr," -c_key arg    - Client key file (default: same as -c_cert)\n");
 265         fprintf(stderr," -cipher arg   - The cipher list\n");
 266         fprintf(stderr," -bio_pair     - Use BIO pairs\n");
 267         fprintf(stderr," -f            - Test even cases that can't work\n");
 268         fprintf(stderr," -time         - measure processor time used by client and server\n");
 269         fprintf(stderr," -zlib         - use zlib compression\n");
 270         fprintf(stderr," -rle          - use rle compression\n");
 271 #ifndef OPENSSL_NO_ECDH
 272         fprintf(stderr," -named_curve arg  - Elliptic curve name to use for ephemeral ECDH keys.\n" \
 273                        "                 Use \"openssl ecparam -list_curves\" for all names\n"  \
 274                        "                 (default is sect163r2).\n");
 275 #endif
 276         fprintf(stderr," -test_cipherlist - verifies the order of the ssl cipher lists\n");
 277         }
 278
 279 static void print_details(SSL *c_ssl, const char *prefix)
 280         {
 281         SSL_CIPHER *ciph;
 282         X509 *cert;
 283
 284         ciph=SSL_get_current_cipher(c_ssl);
 285         BIO_printf(bio_stdout,"%s%s, cipher %s %s",
 286                 prefix,
 287                 SSL_get_version(c_ssl),
 288                 SSL_CIPHER_get_version(ciph),
 289                 SSL_CIPHER_get_name(ciph));
 290         cert=SSL_get_peer_certificate(c_ssl);
 291         if (cert != NULL)
 292                 {
 293                 EVP_PKEY *pkey = X509_get_pubkey(cert);
 294                 if (pkey != NULL)
 295                         {
 296                         if (0)
 297                                 ;
 298 #ifndef OPENSSL_NO_RSA
 299                         else if (pkey->type == EVP_PKEY_RSA && pkey->pkey.rsa != NULL
 300                                 && pkey->pkey.rsa->n != NULL)
 301                                 {
 302                                 BIO_printf(bio_stdout, ", %d bit RSA",
 303                                         BN_num_bits(pkey->pkey.rsa->n));
 304                                 }
 305 #endif
 306 #ifndef OPENSSL_NO_DSA
 307                         else if (pkey->type == EVP_PKEY_DSA && pkey->pkey.dsa != NULL
 308                                 && pkey->pkey.dsa->p != NULL)
 309                                 {
 310                                 BIO_printf(bio_stdout, ", %d bit DSA",
 311                                         BN_num_bits(pkey->pkey.dsa->p));
 312                                 }
 313 #endif
 314                         EVP_PKEY_free(pkey);
 315                         }
 316                 X509_free(cert);
 317                 }
 318         /* The SSL API does not allow us to look at temporary RSA/DH keys,
 319          * otherwise we should print their lengths too */
 320         BIO_printf(bio_stdout,"\n");
 321         }
 322
 323 static void lock_dbg_cb(int mode, int type, const char *file, int line)
 324         {
 325         static int modes[CRYPTO_NUM_LOCKS]; /* = {0, 0, ... } */
 326         const char *errstr = NULL;
 327         int rw;
 328
 329         rw = mode & (CRYPTO_READ|CRYPTO_WRITE);
 330         if (!((rw == CRYPTO_READ) || (rw == CRYPTO_WRITE)))
 331                 {
 332                 errstr = "invalid mode";
 333                 goto err;
 334                 }
 335
 336         if (type < 0 || type >= CRYPTO_NUM_LOCKS)
 337                 {
 338                 errstr = "type out of bounds";
 339                 goto err;
 340                 }
 341
 342         if (mode & CRYPTO_LOCK)
 343                 {
 344                 if (modes[type])
 345                         {
 346                         errstr = "already locked";
 347                         /* must not happen in a single-threaded program
 348                          * (would deadlock) */
 349                         goto err;
 350                         }
 351
 352                 modes[type] = rw;
 353                 }
 354         else if (mode & CRYPTO_UNLOCK)
 355                 {
 356                 if (!modes[type])
 357                         {
 358                         errstr = "not locked";
 359                         goto err;
 360                         }
 361
 362                 if (modes[type] != rw)
 363                         {
 364                         errstr = (rw == CRYPTO_READ) ?
 365                                 "CRYPTO_r_unlock on write lock" :
 366                                 "CRYPTO_w_unlock on read lock";
 367                         }
 368
 369                 modes[type] = 0;
 370                 }
 371         else
 372                 {
 373                 errstr = "invalid mode";
 374                 goto err;
 375                 }
 376
 377  err:
 378         if (errstr)
 379                 {
 380                 /* we cannot use bio_err here */
 381                 fprintf(stderr, "openssl (lock_dbg_cb): %s (mode=%d, type=%d) at %s:%d\n",
 382                         errstr, mode, type, file, line);
 383                 }
 384         }
 385
 386
 387 int main(int argc, char *argv[])
 388         {
 389         char *CApath=NULL,*CAfile=NULL;
 390         int badop=0;
 391         int bio_pair=0;
 392         int force=0;
 393         int tls1=0,ssl2=0,ssl3=0,ret=1;
 394         int client_auth=0;
 395         int server_auth=0,i;
 396         struct app_verify_arg app_verify_arg =
 397                 { APP_CALLBACK_STRING, 0, 0, NULL, NULL };
 398         char *server_cert=TEST_SERVER_CERT;
 399         char *server_key=NULL;
 400         char *client_cert=TEST_CLIENT_CERT;
 401         char *client_key=NULL;
 402 #ifndef OPENSSL_NO_ECDH
 403         char *named_curve = NULL;
 404 #endif
 405         SSL_CTX *s_ctx=NULL;
 406         SSL_CTX *c_ctx=NULL;
 407         const SSL_METHOD *meth=NULL;
 408         SSL *c_ssl,*s_ssl;
 409         int number=1,reuse=0;
 410         long bytes=256L;
 411 #ifndef OPENSSL_NO_DH
 412         DH *dh;
 413         int dhe1024 = 0, dhe1024dsa = 0;
 414 #endif
 415 #ifndef OPENSSL_NO_ECDH
 416         EC_KEY *ecdh = NULL;
 417 #endif
 418         int no_dhe = 0;
 419         int no_ecdhe = 0;
 420         int print_time = 0;
 421         clock_t s_time = 0, c_time = 0;
 422         int comp = 0;
 423         COMP_METHOD *cm = NULL;
 424         STACK_OF(SSL_COMP) *ssl_comp_methods = NULL;
 425         int test_cipherlist = 0;
 426
 427         verbose = 0;
 428         debug = 0;
 429         cipher = 0;
 430
 431         bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
 432
 433         CRYPTO_set_locking_callback(lock_dbg_cb);
 434
 435         /* enable memory leak checking unless explicitly disabled */
 436         if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) && (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off"))))
 437                 {
 438                 CRYPTO_malloc_debug_init();
 439                 CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
 440                 }
 441         else
 442                 {
 443                 /* OPENSSL_DEBUG_MEMORY=off */
 444                 CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0);
 445                 }
 446         CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
 447
 448         RAND_seed(rnd_seed, sizeof rnd_seed);
 449
 450         bio_stdout=BIO_new_fp(stdout,BIO_NOCLOSE);
 451
 452         argc--;
 453         argv++;
 454
 455         while (argc >= 1)
 456                 {
 457                 if      (strcmp(*argv,"-server_auth") == 0)
 458                         server_auth=1;
 459                 else if (strcmp(*argv,"-client_auth") == 0)
 460                         client_auth=1;
 461                 else if (strcmp(*argv,"-proxy_auth") == 0)
 462                         {
 463                         if (--argc < 1) goto bad;
 464                         app_verify_arg.proxy_auth= *(++argv);
 465                         }
 466                 else if (strcmp(*argv,"-proxy_cond") == 0)
 467                         {
 468                         if (--argc < 1) goto bad;
 469                         app_verify_arg.proxy_cond= *(++argv);
 470                         }
 471                 else if (strcmp(*argv,"-v") == 0)
 472                         verbose=1;
 473                 else if (strcmp(*argv,"-d") == 0)
 474                         debug=1;
 475                 else if (strcmp(*argv,"-reuse") == 0)
 476                         reuse=1;
 477                 else if (strcmp(*argv,"-dhe1024") == 0)
 478                         {
 479 #ifndef OPENSSL_NO_DH
 480                         dhe1024=1;
 481 #else
 482                         fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
 483 #endif
 484                         }
 485                 else if (strcmp(*argv,"-dhe1024dsa") == 0)
 486                         {
 487 #ifndef OPENSSL_NO_DH
 488                         dhe1024dsa=1;
 489 #else
 490                         fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
 491 #endif
 492                         }
 493                 else if (strcmp(*argv,"-no_dhe") == 0)
 494                         no_dhe=1;
 495                 else if (strcmp(*argv,"-no_ecdhe") == 0)
 496                         no_ecdhe=1;
 497                 else if (strcmp(*argv,"-ssl2") == 0)
 498                         ssl2=1;
 499                 else if (strcmp(*argv,"-tls1") == 0)
 500                         tls1=1;
 501                 else if (strcmp(*argv,"-ssl3") == 0)
 502                         ssl3=1;
 503                 else if (strncmp(*argv,"-num",4) == 0)
 504                         {
 505                         if (--argc < 1) goto bad;
 506                         number= atoi(*(++argv));
 507                         if (number == 0) number=1;
 508                         }
 509                 else if (strcmp(*argv,"-bytes") == 0)
 510                         {
 511                         if (--argc < 1) goto bad;
 512                         bytes= atol(*(++argv));
 513                         if (bytes == 0L) bytes=1L;
 514                         i=strlen(argv[0]);
 515                         if (argv[0][i-1] == 'k') bytes*=1024L;
 516                         if (argv[0][i-1] == 'm') bytes*=1024L*1024L;
 517                         }
 518                 else if (strcmp(*argv,"-cert") == 0)
 519                         {
 520                         if (--argc < 1) goto bad;
 521                         server_cert= *(++argv);
 522                         }
 523                 else if (strcmp(*argv,"-s_cert") == 0)
 524                         {
 525                         if (--argc < 1) goto bad;
 526                         server_cert= *(++argv);
 527                         }
 528                 else if (strcmp(*argv,"-key") == 0)
 529                         {
 530                         if (--argc < 1) goto bad;
 531                         server_key= *(++argv);
 532                         }
 533                 else if (strcmp(*argv,"-s_key") == 0)
 534                         {
 535                         if (--argc < 1) goto bad;
 536                         server_key= *(++argv);
 537                         }
 538                 else if (strcmp(*argv,"-c_cert") == 0)
 539                         {
 540                         if (--argc < 1) goto bad;
 541                         client_cert= *(++argv);
 542                         }
 543                 else if (strcmp(*argv,"-c_key") == 0)
 544                         {
 545                         if (--argc < 1) goto bad;
 546                         client_key= *(++argv);
 547                         }
 548                 else if (strcmp(*argv,"-cipher") == 0)
 549                         {
 550                         if (--argc < 1) goto bad;
 551                         cipher= *(++argv);
 552                         }
 553                 else if (strcmp(*argv,"-CApath") == 0)
 554                         {
 555                         if (--argc < 1) goto bad;
 556                         CApath= *(++argv);
 557                         }
 558                 else if (strcmp(*argv,"-CAfile") == 0)
 559                         {
 560                         if (--argc < 1) goto bad;
 561                         CAfile= *(++argv);
 562                         }
 563                 else if (strcmp(*argv,"-bio_pair") == 0)
 564                         {
 565                         bio_pair = 1;
 566                         }
 567                 else if (strcmp(*argv,"-f") == 0)
 568                         {
 569                         force = 1;
 570                         }
 571                 else if (strcmp(*argv,"-time") == 0)
 572                         {
 573                         print_time = 1;
 574                         }
 575                 else if (strcmp(*argv,"-zlib") == 0)
 576                         {
 577                         comp = COMP_ZLIB;
 578                         }
 579                 else if (strcmp(*argv,"-rle") == 0)
 580                         {
 581                         comp = COMP_RLE;
 582                         }
 583                 else if (strcmp(*argv,"-named_curve") == 0)
 584                         {
 585                         if (--argc < 1) goto bad;
 586 #ifndef OPENSSL_NO_ECDH
 587                         named_curve = *(++argv);
 588 #else
 589                         fprintf(stderr,"ignoring -named_curve, since I'm compiled without ECDH\n");
 590                         ++argv;
 591 #endif
 592                         }
 593                 else if (strcmp(*argv,"-app_verify") == 0)
 594                         {
 595                         app_verify_arg.app_verify = 1;
 596                         }
 597                 else if (strcmp(*argv,"-proxy") == 0)
 598                         {
 599                         app_verify_arg.allow_proxy_certs = 1;
 600                         }
 601                 else if (strcmp(*argv,"-test_cipherlist") == 0)
 602                         {
 603                         test_cipherlist = 1;
 604                         }
 605                 else
 606                         {
 607                         fprintf(stderr,"unknown option %s\n",*argv);
 608                         badop=1;
 609                         break;
 610                         }
 611                 argc--;
 612                 argv++;
 613                 }
 614         if (badop)
 615                 {
 616 bad:
 617                 sv_usage();
 618                 goto end;
 619                 }
 620
 621         if (test_cipherlist == 1)
 622                 {
 623                 /* ensure that the cipher list are correctly sorted and exit */
 624                 if (do_test_cipherlist() == 0)
 625                         EXIT(1);
 626                 ret = 0;
 627                 goto end;
 628                 }
 629
 630         if (!ssl2 && !ssl3 && !tls1 && number > 1 && !reuse && !force)
 631                 {
 632                 fprintf(stderr, "This case cannot work.  Use -f to perform "
 633                         "the test anyway (and\n-d to see what happens), "
 634                         "or add one of -ssl2, -ssl3, -tls1, -reuse\n"
 635                         "to avoid protocol mismatch.\n");
 636                 EXIT(1);
 637                 }
 638
 639         if (print_time)
 640                 {
 641                 if (!bio_pair)
 642                         {
 643                         fprintf(stderr, "Using BIO pair (-bio_pair)\n");
 644                         bio_pair = 1;
 645                         }
 646                 if (number < 50 && !force)
 647                         fprintf(stderr, "Warning: For accurate timings, use more connections (e.g. -num 1000)\n");
 648                 }
 649
 650 /*      if (cipher == NULL) cipher=getenv("SSL_CIPHER"); */
 651
 652         SSL_library_init();
 653         SSL_load_error_strings();
 654
 655         if (comp == COMP_ZLIB) cm = COMP_zlib();
 656         if (comp == COMP_RLE) cm = COMP_rle();
 657         if (cm != NULL)
 658                 {
 659                 if (cm->type != NID_undef)
 660                         {
 661                         if (SSL_COMP_add_compression_method(comp, cm) != 0)
 662                                 {
 663                                 fprintf(stderr,
 664                                         "Failed to add compression method\n");
 665                                 ERR_print_errors_fp(stderr);
 666                                 }
 667                         }
 668                 else
 669                         {
 670                         fprintf(stderr,
 671                                 "Warning: %s compression not supported\n",
 672                                 (comp == COMP_RLE ? "rle" :
 673                                         (comp == COMP_ZLIB ? "zlib" :
 674                                                 "unknown")));
 675                         ERR_print_errors_fp(stderr);
 676                         }
 677                 }
 678         ssl_comp_methods = SSL_COMP_get_compression_methods();
 679         fprintf(stderr, "Available compression methods:\n");
 680         {
 681         int j, n = sk_SSL_COMP_num(ssl_comp_methods);
 682         if (n == 0)
 683                 fprintf(stderr, "  NONE\n");
 684         else
 685                 for (j = 0; j < n; j++)
 686                         {
 687                         SSL_COMP *c = sk_SSL_COMP_value(ssl_comp_methods, j);
 688                         fprintf(stderr, "  %d: %s\n", c->id, c->name);
 689                         }
 690         }
 691
 692 #if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
 693         if (ssl2)
 694                 meth=SSLv2_method();
 695         else
 696         if (tls1)
 697                 meth=TLSv1_method();
 698         else
 699         if (ssl3)
 700                 meth=SSLv3_method();
 701         else
 702                 meth=SSLv23_method();
 703 #else
 704 #ifdef OPENSSL_NO_SSL2
 705         meth=SSLv3_method();
 706 #else
 707         meth=SSLv2_method();
 708 #endif
 709 #endif
 710
 711         c_ctx=SSL_CTX_new(meth);
 712         s_ctx=SSL_CTX_new(meth);
 713         if ((c_ctx == NULL) || (s_ctx == NULL))
 714                 {
 715                 ERR_print_errors(bio_err);
 716                 goto end;
 717                 }
 718
 719         if (cipher != NULL)
 720                 {
 721                 SSL_CTX_set_cipher_list(c_ctx,cipher);
 722                 SSL_CTX_set_cipher_list(s_ctx,cipher);
 723                 }
 724
 725 #ifndef OPENSSL_NO_DH
 726         if (!no_dhe)
 727                 {
 728                 if (dhe1024dsa)
 729                         {
 730                         /* use SSL_OP_SINGLE_DH_USE to avoid small subgroup attacks */
 731                         SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
 732                         dh=get_dh1024dsa();
 733                         }
 734                 else if (dhe1024)
 735                         dh=get_dh1024();
 736                 else
 737                         dh=get_dh512();
 738                 SSL_CTX_set_tmp_dh(s_ctx,dh);
 739                 DH_free(dh);
 740                 }
 741 #else
 742         (void)no_dhe;
 743 #endif
 744
 745 #ifndef OPENSSL_NO_ECDH
 746         if (!no_ecdhe)
 747                 {
 748                 int nid;
 749
 750                 if (named_curve != NULL)
 751                         {
 752                         nid = OBJ_sn2nid(named_curve);
 753                         if (nid == 0)
 754                         {
 755                                 BIO_printf(bio_err, "unknown curve name (%s)\n", named_curve);
 756                                 goto end;
 757                                 }
 758                         }
 759                 else
 760                         nid = NID_sect163r2;
 761
 762                 ecdh = EC_KEY_new_by_curve_name(nid);
 763                 if (ecdh == NULL)
 764                         {
 765                         BIO_printf(bio_err, "unable to create curve\n");
 766                         goto end;
 767                         }
 768
 769                 SSL_CTX_set_tmp_ecdh(s_ctx, ecdh);
 770                 SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_ECDH_USE);
 771                 EC_KEY_free(ecdh);
 772                 }
 773 #else
 774         (void)no_ecdhe;
 775 #endif
 776
 777 #ifndef OPENSSL_NO_RSA
 778         SSL_CTX_set_tmp_rsa_callback(s_ctx,tmp_rsa_cb);
 779 #endif
 780
 781         if (!SSL_CTX_use_certificate_file(s_ctx,server_cert,SSL_FILETYPE_PEM))
 782                 {
 783                 ERR_print_errors(bio_err);
 784                 }
 785         else if (!SSL_CTX_use_PrivateKey_file(s_ctx,
 786                 (server_key?server_key:server_cert), SSL_FILETYPE_PEM))
 787                 {
 788                 ERR_print_errors(bio_err);
 789                 goto end;
 790                 }
 791
 792         if (client_auth)
 793                 {
 794                 SSL_CTX_use_certificate_file(c_ctx,client_cert,
 795                         SSL_FILETYPE_PEM);
 796                 SSL_CTX_use_PrivateKey_file(c_ctx,
 797                         (client_key?client_key:client_cert),
 798                         SSL_FILETYPE_PEM);
 799                 }
 800
 801         if (    (!SSL_CTX_load_verify_locations(s_ctx,CAfile,CApath)) ||
 802                 (!SSL_CTX_set_default_verify_paths(s_ctx)) ||
 803                 (!SSL_CTX_load_verify_locations(c_ctx,CAfile,CApath)) ||
 804                 (!SSL_CTX_set_default_verify_paths(c_ctx)))
 805                 {
 806                 /* fprintf(stderr,"SSL_load_verify_locations\n"); */
 807                 ERR_print_errors(bio_err);
 808                 /* goto end; */
 809                 }
 810
 811         if (client_auth)
 812                 {
 813                 BIO_printf(bio_err,"client authentication\n");
 814                 SSL_CTX_set_verify(s_ctx,
 815                         SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
 816                         verify_callback);
 817                 SSL_CTX_set_cert_verify_callback(s_ctx, app_verify_callback, &app_verify_arg);
 818                 }
 819         if (server_auth)
 820                 {
 821                 BIO_printf(bio_err,"server authentication\n");
 822                 SSL_CTX_set_verify(c_ctx,SSL_VERIFY_PEER,
 823                         verify_callback);
 824                 SSL_CTX_set_cert_verify_callback(c_ctx, app_verify_callback, &app_verify_arg);
 825                 }
 826
 827         {
 828                 int session_id_context = 0;
 829                 SSL_CTX_set_session_id_context(s_ctx, (void *)&session_id_context, sizeof session_id_context);
 830         }
 831
 832         c_ssl=SSL_new(c_ctx);
 833         s_ssl=SSL_new(s_ctx);
 834
 835 #ifndef OPENSSL_NO_KRB5
 836         if (c_ssl  &&  c_ssl->kssl_ctx)
 837                 {
 838                 char    localhost[MAXHOSTNAMELEN+2];
 839
 840                 if (gethostname(localhost, sizeof localhost-1) == 0)
 841                         {
 842                         localhost[sizeof localhost-1]='\0';
 843                         if(strlen(localhost) == sizeof localhost-1)
 844                                 {
 845                                 BIO_printf(bio_err,"localhost name too long\n");
 846                                 goto end;
 847                                 }
 848                         kssl_ctx_setstring(c_ssl->kssl_ctx, KSSL_SERVER,
 849                                 localhost);
 850                         }
 851                 }
 852 #endif    /* OPENSSL_NO_KRB5  */
 853
 854         for (i=0; i<number; i++)
 855                 {
 856                 if (!reuse) SSL_set_session(c_ssl,NULL);
 857                 if (bio_pair)
 858                         ret=doit_biopair(s_ssl,c_ssl,bytes,&s_time,&c_time);
 859                 else
 860                         ret=doit(s_ssl,c_ssl,bytes);
 861                 }
 862
 863         if (!verbose)
 864                 {
 865                 print_details(c_ssl, "");
 866                 }
 867         if ((number > 1) || (bytes > 1L))
 868                 BIO_printf(bio_stdout, "%d handshakes of %ld bytes done\n",number,bytes);
 869         if (print_time)
 870                 {
 871 #ifdef CLOCKS_PER_SEC
 872                 /* "To determine the time in seconds, the value returned
 873                  * by the clock function should be divided by the value
 874                  * of the macro CLOCKS_PER_SEC."
 875                  *                                       -- ISO/IEC 9899 */
 876                 BIO_printf(bio_stdout, "Approximate total server time: %6.2f s\n"
 877                         "Approximate total client time: %6.2f s\n",
 878                         (double)s_time/CLOCKS_PER_SEC,
 879                         (double)c_time/CLOCKS_PER_SEC);
 880 #else
 881                 /* "`CLOCKS_PER_SEC' undeclared (first use this function)"
 882                  *                            -- cc on NeXTstep/OpenStep */
 883                 BIO_printf(bio_stdout,
 884                         "Approximate total server time: %6.2f units\n"
 885                         "Approximate total client time: %6.2f units\n",
 886                         (double)s_time,
 887                         (double)c_time);
 888 #endif
 889                 }
 890
 891         SSL_free(s_ssl);
 892         SSL_free(c_ssl);
 893
 894 end:
 895         if (s_ctx != NULL) SSL_CTX_free(s_ctx);
 896         if (c_ctx != NULL) SSL_CTX_free(c_ctx);
 897
 898         if (bio_stdout != NULL) BIO_free(bio_stdout);
 899
 900 #ifndef OPENSSL_NO_RSA
 901         free_tmp_rsa();
 902 #endif
 903 #ifndef OPENSSL_NO_ENGINE
 904         ENGINE_cleanup();
 905 #endif
 906         CRYPTO_cleanup_all_ex_data();
 907         ERR_free_strings();
 908         ERR_remove_state(0);
 909         EVP_cleanup();
 910         CRYPTO_mem_leaks(bio_err);
 911         if (bio_err != NULL) BIO_free(bio_err);
 912         EXIT(ret);
 913         return ret;
 914         }
 915
 916 int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count,
 917         clock_t *s_time, clock_t *c_time)
 918         {
 919         long cw_num = count, cr_num = count, sw_num = count, sr_num = count;
 920         BIO *s_ssl_bio = NULL, *c_ssl_bio = NULL;
 921         BIO *server = NULL, *server_io = NULL, *client = NULL, *client_io = NULL;
 922         int ret = 1;
 923
 924         size_t bufsiz = 256; /* small buffer for testing */
 925
 926         if (!BIO_new_bio_pair(&server, bufsiz, &server_io, bufsiz))
 927                 goto err;
 928         if (!BIO_new_bio_pair(&client, bufsiz, &client_io, bufsiz))
 929                 goto err;
 930
 931         s_ssl_bio = BIO_new(BIO_f_ssl());
 932         if (!s_ssl_bio)
 933                 goto err;
 934
 935         c_ssl_bio = BIO_new(BIO_f_ssl());
 936         if (!c_ssl_bio)
 937                 goto err;
 938
 939         SSL_set_connect_state(c_ssl);
 940         SSL_set_bio(c_ssl, client, client);
 941         (void)BIO_set_ssl(c_ssl_bio, c_ssl, BIO_NOCLOSE);
 942
 943         SSL_set_accept_state(s_ssl);
 944         SSL_set_bio(s_ssl, server, server);
 945         (void)BIO_set_ssl(s_ssl_bio, s_ssl, BIO_NOCLOSE);
 946
 947         do
 948                 {
 949                 /* c_ssl_bio:          SSL filter BIO
 950                  *
 951                  * client:             pseudo-I/O for SSL library
 952                  *
 953                  * client_io:          client's SSL communication; usually to be
 954                  *                     relayed over some I/O facility, but in this
 955                  *                     test program, we're the server, too:
 956                  *
 957                  * server_io:          server's SSL communication
 958                  *
 959                  * server:             pseudo-I/O for SSL library
 960                  *
 961                  * s_ssl_bio:          SSL filter BIO
 962                  *
 963                  * The client and the server each employ a "BIO pair":
 964                  * client + client_io, server + server_io.
 965                  * BIO pairs are symmetric.  A BIO pair behaves similar
 966                  * to a non-blocking socketpair (but both endpoints must
 967                  * be handled by the same thread).
 968                  * [Here we could connect client and server to the ends
 969                  * of a single BIO pair, but then this code would be less
 970                  * suitable as an example for BIO pairs in general.]
 971                  *
 972                  * Useful functions for querying the state of BIO pair endpoints:
 973                  *
 974                  * BIO_ctrl_pending(bio)              number of bytes we can read now
 975                  * BIO_ctrl_get_read_request(bio)     number of bytes needed to fulfil
 976                  *                                      other side's read attempt
 977                  * BIO_ctrl_get_write_guarantee(bio)   number of bytes we can write now
 978                  *
 979                  * ..._read_request is never more than ..._write_guarantee;
 980                  * it depends on the application which one you should use.
 981                  */
 982
 983                 /* We have non-blocking behaviour throughout this test program, but
 984                  * can be sure that there is *some* progress in each iteration; so
 985                  * we don't have to worry about ..._SHOULD_READ or ..._SHOULD_WRITE
 986                  * -- we just try everything in each iteration
 987                  */
 988
 989                         {
 990                         /* CLIENT */
 991
 992                         MS_STATIC char cbuf[1024*8];
 993                         int i, r;
 994                         clock_t c_clock = clock();
 995
 996                         memset(cbuf, 0, sizeof(cbuf));
 997
 998                         if (debug)
 999                                 if (SSL_in_init(c_ssl))
1000                                         printf("client waiting in SSL_connect - %s\n",
1001                                                 SSL_state_string_long(c_ssl));
1002
1003                         if (cw_num > 0)
1004                                 {
1005                                 /* Write to server. */
1006
1007                                 if (cw_num > (long)sizeof cbuf)
1008                                         i = sizeof cbuf;
1009                                 else
1010                                         i = (int)cw_num;
1011                                 r = BIO_write(c_ssl_bio, cbuf, i);
1012                                 if (r < 0)
1013                                         {
1014                                         if (!BIO_should_retry(c_ssl_bio))
1015                                                 {
1016                                                 fprintf(stderr,"ERROR in CLIENT\n");
1017                                                 goto err;
1018                                                 }
1019                                         /* BIO_should_retry(...) can just be ignored here.
1020                                          * The library expects us to call BIO_write with
1021                                          * the same arguments again, and that's what we will
1022                                          * do in the next iteration. */
1023                                         }
1024                                 else if (r == 0)
1025                                         {
1026                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1027                                         goto err;
1028                                         }
1029                                 else
1030                                         {
1031                                         if (debug)
1032                                                 printf("client wrote %d\n", r);
1033                                         cw_num -= r;
1034                                         }
1035                                 }
1036
1037                         if (cr_num > 0)
1038                                 {
1039                                 /* Read from server. */
1040
1041                                 r = BIO_read(c_ssl_bio, cbuf, sizeof(cbuf));
1042                                 if (r < 0)
1043                                         {
1044                                         if (!BIO_should_retry(c_ssl_bio))
1045                                                 {
1046                                                 fprintf(stderr,"ERROR in CLIENT\n");
1047                                                 goto err;
1048                                                 }
1049                                         /* Again, "BIO_should_retry" can be ignored. */
1050                                         }
1051                                 else if (r == 0)
1052                                         {
1053                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1054                                         goto err;
1055                                         }
1056                                 else
1057                                         {
1058                                         if (debug)
1059                                                 printf("client read %d\n", r);
1060                                         cr_num -= r;
1061                                         }
1062                                 }
1063
1064                         /* c_time and s_time increments will typically be very small
1065                          * (depending on machine speed and clock tick intervals),
1066                          * but sampling over a large number of connections should
1067                          * result in fairly accurate figures.  We cannot guarantee
1068                          * a lot, however -- if each connection lasts for exactly
1069                          * one clock tick, it will be counted only for the client
1070                          * or only for the server or even not at all.
1071                          */
1072                         *c_time += (clock() - c_clock);
1073                         }
1074
1075                         {
1076                         /* SERVER */
1077
1078                         MS_STATIC char sbuf[1024*8];
1079                         int i, r;
1080                         clock_t s_clock = clock();
1081
1082                         memset(sbuf, 0, sizeof(sbuf));
1083
1084                         if (debug)
1085                                 if (SSL_in_init(s_ssl))
1086                                         printf("server waiting in SSL_accept - %s\n",
1087                                                 SSL_state_string_long(s_ssl));
1088
1089                         if (sw_num > 0)
1090                                 {
1091                                 /* Write to client. */
1092
1093                                 if (sw_num > (long)sizeof sbuf)
1094                                         i = sizeof sbuf;
1095                                 else
1096                                         i = (int)sw_num;
1097                                 r = BIO_write(s_ssl_bio, sbuf, i);
1098                                 if (r < 0)
1099                                         {
1100                                         if (!BIO_should_retry(s_ssl_bio))
1101                                                 {
1102                                                 fprintf(stderr,"ERROR in SERVER\n");
1103                                                 goto err;
1104                                                 }
1105                                         /* Ignore "BIO_should_retry". */
1106                                         }
1107                                 else if (r == 0)
1108                                         {
1109                                         fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1110                                         goto err;
1111                                         }
1112                                 else
1113                                         {
1114                                         if (debug)
1115                                                 printf("server wrote %d\n", r);
1116                                         sw_num -= r;
1117                                         }
1118                                 }
1119
1120                         if (sr_num > 0)
1121                                 {
1122                                 /* Read from client. */
1123
1124                                 r = BIO_read(s_ssl_bio, sbuf, sizeof(sbuf));
1125                                 if (r < 0)
1126                                         {
1127                                         if (!BIO_should_retry(s_ssl_bio))
1128                                                 {
1129                                                 fprintf(stderr,"ERROR in SERVER\n");
1130                                                 goto err;
1131                                                 }
1132                                         /* blah, blah */
1133                                         }
1134                                 else if (r == 0)
1135                                         {
1136                                         fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1137                                         goto err;
1138                                         }
1139                                 else
1140                                         {
1141                                         if (debug)
1142                                                 printf("server read %d\n", r);
1143                                         sr_num -= r;
1144                                         }
1145                                 }
1146
1147                         *s_time += (clock() - s_clock);
1148                         }
1149
1150                         {
1151                         /* "I/O" BETWEEN CLIENT AND SERVER. */
1152
1153                         size_t r1, r2;
1154                         BIO *io1 = server_io, *io2 = client_io;
1155                         /* we use the non-copying interface for io1
1156                          * and the standard BIO_write/BIO_read interface for io2
1157                          */
1158
1159                         static int prev_progress = 1;
1160                         int progress = 0;
1161
1162                         /* io1 to io2 */
1163                         do
1164                                 {
1165                                 size_t num;
1166                                 int r;
1167
1168                                 r1 = BIO_ctrl_pending(io1);
1169                                 r2 = BIO_ctrl_get_write_guarantee(io2);
1170
1171                                 num = r1;
1172                                 if (r2 < num)
1173                                         num = r2;
1174                                 if (num)
1175                                         {
1176                                         char *dataptr;
1177
1178                                         if (INT_MAX < num) /* yeah, right */
1179                                                 num = INT_MAX;
1180
1181                                         r = BIO_nread(io1, &dataptr, (int)num);
1182                                         assert(r > 0);
1183                                         assert(r <= (int)num);
1184                                         /* possibly r < num (non-contiguous data) */
1185                                         num = r;
1186                                         r = BIO_write(io2, dataptr, (int)num);
1187                                         if (r != (int)num) /* can't happen */
1188                                                 {
1189                                                 fprintf(stderr, "ERROR: BIO_write could not write "
1190                                                         "BIO_ctrl_get_write_guarantee() bytes");
1191                                                 goto err;
1192                                                 }
1193                                         progress = 1;
1194
1195                                         if (debug)
1196                                                 printf((io1 == client_io) ?
1197                                                         "C->S relaying: %d bytes\n" :
1198                                                         "S->C relaying: %d bytes\n",
1199                                                         (int)num);
1200                                         }
1201                                 }
1202                         while (r1 && r2);
1203
1204                         /* io2 to io1 */
1205                         {
1206                                 size_t num;
1207                                 int r;
1208
1209                                 r1 = BIO_ctrl_pending(io2);
1210                                 r2 = BIO_ctrl_get_read_request(io1);
1211                                 /* here we could use ..._get_write_guarantee instead of
1212                                  * ..._get_read_request, but by using the latter
1213                                  * we test restartability of the SSL implementation
1214                                  * more thoroughly */
1215                                 num = r1;
1216                                 if (r2 < num)
1217                                         num = r2;
1218                                 if (num)
1219                                         {
1220                                         char *dataptr;
1221
1222                                         if (INT_MAX < num)
1223                                                 num = INT_MAX;
1224
1225                                         if (num > 1)
1226                                                 --num; /* test restartability even more thoroughly */
1227
1228                                         r = BIO_nwrite0(io1, &dataptr);
1229                                         assert(r > 0);
1230                                         if (r < (int)num)
1231                                                 num = r;
1232                                         r = BIO_read(io2, dataptr, (int)num);
1233                                         if (r != (int)num) /* can't happen */
1234                                                 {
1235                                                 fprintf(stderr, "ERROR: BIO_read could not read "
1236                                                         "BIO_ctrl_pending() bytes");
1237                                                 goto err;
1238                                                 }
1239                                         progress = 1;
1240                                         r = BIO_nwrite(io1, &dataptr, (int)num);
1241                                         if (r != (int)num) /* can't happen */
1242                                                 {
1243                                                 fprintf(stderr, "ERROR: BIO_nwrite() did not accept "
1244                                                         "BIO_nwrite0() bytes");
1245                                                 goto err;
1246                                                 }
1247
1248                                         if (debug)
1249                                                 printf((io2 == client_io) ?
1250                                                         "C->S relaying: %d bytes\n" :
1251                                                         "S->C relaying: %d bytes\n",
1252                                                         (int)num);
1253                                         }
1254                         } /* no loop, BIO_ctrl_get_read_request now returns 0 anyway */
1255
1256                         if (!progress && !prev_progress)
1257                                 if (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0)
1258                                         {
1259                                         fprintf(stderr, "ERROR: got stuck\n");
1260                                         if (strcmp("SSLv2", SSL_get_version(c_ssl)) == 0)
1261                                                 {
1262                                                 fprintf(stderr, "This can happen for SSL2 because "
1263                                                         "CLIENT-FINISHED and SERVER-VERIFY are written \n"
1264                                                         "concurrently ...");
1265                                                 if (strncmp("2SCF", SSL_state_string(c_ssl), 4) == 0
1266                                                         && strncmp("2SSV", SSL_state_string(s_ssl), 4) == 0)
1267                                                         {
1268                                                         fprintf(stderr, " ok.\n");
1269                                                         goto end;
1270                                                         }
1271                                                 }
1272                                         fprintf(stderr, " ERROR.\n");
1273                                         goto err;
1274                                         }
1275                         prev_progress = progress;
1276                         }
1277                 }
1278         while (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0);
1279
1280         if (verbose)
1281                 print_details(c_ssl, "DONE via BIO pair: ");
1282 end:
1283         ret = 0;
1284
1285  err:
1286         ERR_print_errors(bio_err);
1287
1288         if (server)
1289                 BIO_free(server);
1290         if (server_io)
1291                 BIO_free(server_io);
1292         if (client)
1293                 BIO_free(client);
1294         if (client_io)
1295                 BIO_free(client_io);
1296         if (s_ssl_bio)
1297                 BIO_free(s_ssl_bio);
1298         if (c_ssl_bio)
1299                 BIO_free(c_ssl_bio);
1300
1301         return ret;
1302         }
1303
1304
1305 #define W_READ  1
1306 #define W_WRITE 2
1307 #define C_DONE  1
1308 #define S_DONE  2
1309
1310 int doit(SSL *s_ssl, SSL *c_ssl, long count)
1311         {
1312         MS_STATIC char cbuf[1024*8],sbuf[1024*8];
1313         long cw_num=count,cr_num=count;
1314         long sw_num=count,sr_num=count;
1315         int ret=1;
1316         BIO *c_to_s=NULL;
1317         BIO *s_to_c=NULL;
1318         BIO *c_bio=NULL;
1319         BIO *s_bio=NULL;
1320         int c_r,c_w,s_r,s_w;
1321         int c_want,s_want;
1322         int i,j;
1323         int done=0;
1324         int c_write,s_write;
1325         int do_server=0,do_client=0;
1326
1327         memset(cbuf,0,sizeof(cbuf));
1328         memset(sbuf,0,sizeof(sbuf));
1329
1330         c_to_s=BIO_new(BIO_s_mem());
1331         s_to_c=BIO_new(BIO_s_mem());
1332         if ((s_to_c == NULL) || (c_to_s == NULL))
1333                 {
1334                 ERR_print_errors(bio_err);
1335                 goto err;
1336                 }
1337
1338         c_bio=BIO_new(BIO_f_ssl());
1339         s_bio=BIO_new(BIO_f_ssl());
1340         if ((c_bio == NULL) || (s_bio == NULL))
1341                 {
1342                 ERR_print_errors(bio_err);
1343                 goto err;
1344                 }
1345
1346         SSL_set_connect_state(c_ssl);
1347         SSL_set_bio(c_ssl,s_to_c,c_to_s);
1348         BIO_set_ssl(c_bio,c_ssl,BIO_NOCLOSE);
1349
1350         SSL_set_accept_state(s_ssl);
1351         SSL_set_bio(s_ssl,c_to_s,s_to_c);
1352         BIO_set_ssl(s_bio,s_ssl,BIO_NOCLOSE);
1353
1354         c_r=0; s_r=1;
1355         c_w=1; s_w=0;
1356         c_want=W_WRITE;
1357         s_want=0;
1358         c_write=1,s_write=0;
1359
1360         /* We can always do writes */
1361         for (;;)
1362                 {
1363                 do_server=0;
1364                 do_client=0;
1365
1366                 i=(int)BIO_pending(s_bio);
1367                 if ((i && s_r) || s_w) do_server=1;
1368
1369                 i=(int)BIO_pending(c_bio);
1370                 if ((i && c_r) || c_w) do_client=1;
1371
1372                 if (do_server && debug)
1373                         {
1374                         if (SSL_in_init(s_ssl))
1375                                 printf("server waiting in SSL_accept - %s\n",
1376                                         SSL_state_string_long(s_ssl));
1377 /*                      else if (s_write)
1378                                 printf("server:SSL_write()\n");
1379                         else
1380                                 printf("server:SSL_read()\n"); */
1381                         }
1382
1383                 if (do_client && debug)
1384                         {
1385                         if (SSL_in_init(c_ssl))
1386                                 printf("client waiting in SSL_connect - %s\n",
1387                                         SSL_state_string_long(c_ssl));
1388 /*                      else if (c_write)
1389                                 printf("client:SSL_write()\n");
1390                         else
1391                                 printf("client:SSL_read()\n"); */
1392                         }
1393
1394                 if (!do_client && !do_server)
1395                         {
1396                         fprintf(stdout,"ERROR IN STARTUP\n");
1397                         ERR_print_errors(bio_err);
1398                         break;
1399                         }
1400                 if (do_client && !(done & C_DONE))
1401                         {
1402                         if (c_write)
1403                                 {
1404                                 j = (cw_num > (long)sizeof(cbuf)) ?
1405                                         (int)sizeof(cbuf) : (int)cw_num;
1406                                 i=BIO_write(c_bio,cbuf,j);
1407                                 if (i < 0)
1408                                         {
1409                                         c_r=0;
1410                                         c_w=0;
1411                                         if (BIO_should_retry(c_bio))
1412                                                 {
1413                                                 if (BIO_should_read(c_bio))
1414                                                         c_r=1;
1415                                                 if (BIO_should_write(c_bio))
1416                                                         c_w=1;
1417                                                 }
1418                                         else
1419                                                 {
1420                                                 fprintf(stderr,"ERROR in CLIENT\n");
1421                                                 ERR_print_errors(bio_err);
1422                                                 goto err;
1423                                                 }
1424                                         }
1425                                 else if (i == 0)
1426                                         {
1427                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1428                                         goto err;
1429                                         }
1430                                 else
1431                                         {
1432                                         if (debug)
1433                                                 printf("client wrote %d\n",i);
1434                                         /* ok */
1435                                         s_r=1;
1436                                         c_write=0;
1437                                         cw_num-=i;
1438                                         }
1439                                 }
1440                         else
1441                                 {
1442                                 i=BIO_read(c_bio,cbuf,sizeof(cbuf));
1443                                 if (i < 0)
1444                                         {
1445                                         c_r=0;
1446                                         c_w=0;
1447                                         if (BIO_should_retry(c_bio))
1448                                                 {
1449                                                 if (BIO_should_read(c_bio))
1450                                                         c_r=1;
1451                                                 if (BIO_should_write(c_bio))
1452                                                         c_w=1;
1453                                                 }
1454                                         else
1455                                                 {
1456                                                 fprintf(stderr,"ERROR in CLIENT\n");
1457                                                 ERR_print_errors(bio_err);
1458                                                 goto err;
1459                                                 }
1460                                         }
1461                                 else if (i == 0)
1462                                         {
1463                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1464                                         goto err;
1465                                         }
1466                                 else
1467                                         {
1468                                         if (debug)
1469                                                 printf("client read %d\n",i);
1470                                         cr_num-=i;
1471                                         if (sw_num > 0)
1472                                                 {
1473                                                 s_write=1;
1474                                                 s_w=1;
1475                                                 }
1476                                         if (cr_num <= 0)
1477                                                 {
1478                                                 s_write=1;
1479                                                 s_w=1;
1480                                                 done=S_DONE|C_DONE;
1481                                                 }
1482                                         }
1483                                 }
1484                         }
1485
1486                 if (do_server && !(done & S_DONE))
1487                         {
1488                         if (!s_write)
1489                                 {
1490                                 i=BIO_read(s_bio,sbuf,sizeof(cbuf));
1491                                 if (i < 0)
1492                                         {
1493                                         s_r=0;
1494                                         s_w=0;
1495                                         if (BIO_should_retry(s_bio))
1496                                                 {
1497                                                 if (BIO_should_read(s_bio))
1498                                                         s_r=1;
1499                                                 if (BIO_should_write(s_bio))
1500                                                         s_w=1;
1501                                                 }
1502                                         else
1503                                                 {
1504                                                 fprintf(stderr,"ERROR in SERVER\n");
1505                                                 ERR_print_errors(bio_err);
1506                                                 goto err;
1507                                                 }
1508                                         }
1509                                 else if (i == 0)
1510                                         {
1511                                         ERR_print_errors(bio_err);
1512                                         fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_read\n");
1513                                         goto err;
1514                                         }
1515                                 else
1516                                         {
1517                                         if (debug)
1518                                                 printf("server read %d\n",i);
1519                                         sr_num-=i;
1520                                         if (cw_num > 0)
1521                                                 {
1522                                                 c_write=1;
1523                                                 c_w=1;
1524                                                 }
1525                                         if (sr_num <= 0)
1526                                                 {
1527                                                 s_write=1;
1528                                                 s_w=1;
1529                                                 c_write=0;
1530                                                 }
1531                                         }
1532                                 }
1533                         else
1534                                 {
1535                                 j = (sw_num > (long)sizeof(sbuf)) ?
1536                                         (int)sizeof(sbuf) : (int)sw_num;
1537                                 i=BIO_write(s_bio,sbuf,j);
1538                                 if (i < 0)
1539                                         {
1540                                         s_r=0;
1541                                         s_w=0;
1542                                         if (BIO_should_retry(s_bio))
1543                                                 {
1544                                                 if (BIO_should_read(s_bio))
1545                                                         s_r=1;
1546                                                 if (BIO_should_write(s_bio))
1547                                                         s_w=1;
1548                                                 }
1549                                         else
1550                                                 {
1551                                                 fprintf(stderr,"ERROR in SERVER\n");
1552                                                 ERR_print_errors(bio_err);
1553                                                 goto err;
1554                                                 }
1555                                         }
1556                                 else if (i == 0)
1557                                         {
1558                                         ERR_print_errors(bio_err);
1559                                         fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_write\n");
1560                                         goto err;
1561                                         }
1562                                 else
1563                                         {
1564                                         if (debug)
1565                                                 printf("server wrote %d\n",i);
1566                                         sw_num-=i;
1567                                         s_write=0;
1568                                         c_r=1;
1569                                         if (sw_num <= 0)
1570                                                 done|=S_DONE;
1571                                         }
1572                                 }
1573                         }
1574
1575                 if ((done & S_DONE) && (done & C_DONE)) break;
1576                 }
1577
1578         if (verbose)
1579                 print_details(c_ssl, "DONE: ");
1580         ret=0;
1581 err:
1582         /* We have to set the BIO's to NULL otherwise they will be
1583          * OPENSSL_free()ed twice.  Once when th s_ssl is SSL_free()ed and
1584          * again when c_ssl is SSL_free()ed.
1585          * This is a hack required because s_ssl and c_ssl are sharing the same
1586          * BIO structure and SSL_set_bio() and SSL_free() automatically
1587          * BIO_free non NULL entries.
1588          * You should not normally do this or be required to do this */
1589         if (s_ssl != NULL)
1590                 {
1591                 s_ssl->rbio=NULL;
1592                 s_ssl->wbio=NULL;
1593                 }
1594         if (c_ssl != NULL)
1595                 {
1596                 c_ssl->rbio=NULL;
1597                 c_ssl->wbio=NULL;
1598                 }
1599
1600         if (c_to_s != NULL) BIO_free(c_to_s);
1601         if (s_to_c != NULL) BIO_free(s_to_c);
1602         if (c_bio != NULL) BIO_free_all(c_bio);
1603         if (s_bio != NULL) BIO_free_all(s_bio);
1604         return(ret);
1605         }
1606
1607 static int get_proxy_auth_ex_data_idx(void)
1608         {
1609         static volatile int idx = -1;
1610         if (idx < 0)
1611                 {
1612                 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
1613                 if (idx < 0)
1614                         {
1615                         idx = X509_STORE_CTX_get_ex_new_index(0,
1616                                 "SSLtest for verify callback", NULL,NULL,NULL);
1617                         }
1618                 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
1619                 }
1620         return idx;
1621         }
1622
1623 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
1624         {
1625         char *s,buf[256];
1626
1627         s=X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),buf,
1628                             sizeof buf);
1629         if (s != NULL)
1630                 {
1631                 if (ok)
1632                         fprintf(stderr,"depth=%d %s\n",
1633                                 ctx->error_depth,buf);
1634                 else
1635                         {
1636                         fprintf(stderr,"depth=%d error=%d %s\n",
1637                                 ctx->error_depth,ctx->error,buf);
1638                         }
1639                 }
1640
1641         if (ok == 0)
1642                 {
1643                 fprintf(stderr,"Error string: %s\n",
1644                         X509_verify_cert_error_string(ctx->error));
1645                 switch (ctx->error)
1646                         {
1647                 case X509_V_ERR_CERT_NOT_YET_VALID:
1648                 case X509_V_ERR_CERT_HAS_EXPIRED:
1649                 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
1650                         fprintf(stderr,"  ... ignored.\n");
1651                         ok=1;
1652                         }
1653                 }
1654
1655         if (ok == 1)
1656                 {
1657                 X509 *xs = ctx->current_cert;
1658 #if 0
1659                 X509 *xi = ctx->current_issuer;
1660 #endif
1661
1662                 if (xs->ex_flags & EXFLAG_PROXY)
1663                         {
1664                         unsigned int *letters =
1665                                 X509_STORE_CTX_get_ex_data(ctx,
1666                                         get_proxy_auth_ex_data_idx());
1667
1668                         if (letters)
1669                                 {
1670                                 int found_any = 0;
1671                                 int i;
1672                                 PROXY_CERT_INFO_EXTENSION *pci =
1673                                         X509_get_ext_d2i(xs, NID_proxyCertInfo,
1674                                                 NULL, NULL);
1675
1676                                 switch (OBJ_obj2nid(pci->proxyPolicy->policyLanguage))
1677                                         {
1678                                 case NID_Independent:
1679                                         /* Completely meaningless in this
1680                                            program, as there's no way to
1681                                            grant explicit rights to a
1682                                            specific PrC.  Basically, using
1683                                            id-ppl-Independent is the perfect
1684                                            way to grant no rights at all. */
1685                                         fprintf(stderr, "  Independent proxy certificate");
1686                                         for (i = 0; i < 26; i++)
1687                                                 letters[i] = 0;
1688                                         break;
1689                                 case NID_id_ppl_inheritAll:
1690                                         /* This is basically a NOP, we
1691                                            simply let the current rights
1692                                            stand as they are. */
1693                                         fprintf(stderr, "  Proxy certificate inherits all");
1694                                         break;
1695                                 default:
1696                                         s = (char *)
1697                                                 pci->proxyPolicy->policy->data;
1698                                         i = pci->proxyPolicy->policy->length;
1699
1700                                         /* The algorithm works as follows:
1701                                            it is assumed that previous
1702                                            iterations or the initial granted
1703                                            rights has already set some elements
1704                                            of `letters'.  What we need to do is
1705                                            to clear those that weren't granted
1706                                            by the current PrC as well.  The
1707                                            easiest way to do this is to add 1
1708                                            to all the elements whose letters
1709                                            are given with the current policy.
1710                                            That way, all elements that are set
1711                                            by the current policy and were
1712                                            already set by earlier policies and
1713                                            through the original grant of rights
1714                                            will get the value 2 or higher.
1715                                            The last thing to do is to sweep
1716                                            through `letters' and keep the
1717                                            elements having the value 2 as set,
1718                                            and clear all the others. */
1719
1720                                         fprintf(stderr, "  Certificate proxy rights = %*.*s", i, i, s);
1721                                         while(i-- > 0)
1722                                                 {
1723                                                 int c = *s++;
1724                                                 if (isascii(c) && isalpha(c))
1725                                                         {
1726                                                         if (islower(c))
1727                                                                 c = toupper(c);
1728                                                         letters[c - 'A']++;
1729                                                         }
1730                                                 }
1731                                         for (i = 0; i < 26; i++)
1732                                                 if (letters[i] < 2)
1733                                                         letters[i] = 0;
1734                                                 else
1735                                                         letters[i] = 1;
1736                                         }
1737
1738                                 found_any = 0;
1739                                 fprintf(stderr,
1740                                         ", resulting proxy rights = ");
1741                                 for(i = 0; i < 26; i++)
1742                                         if (letters[i])
1743                                                 {
1744                                                 fprintf(stderr, "%c", i + 'A');
1745                                                 found_any = 1;
1746                                                 }
1747                                 if (!found_any)
1748                                         fprintf(stderr, "none");
1749                                 fprintf(stderr, "\n");
1750
1751                                 PROXY_CERT_INFO_EXTENSION_free(pci);
1752                                 }
1753                         }
1754                 }
1755
1756         return(ok);
1757         }
1758
1759 static void process_proxy_debug(int indent, const char *format, ...)
1760         {
1761         static const char indentation[] =
1762                 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"
1763                 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"; /* That's 80 > */
1764         char my_format[256];
1765         va_list args;
1766
1767         BIO_snprintf(my_format, sizeof(my_format), "%*.*s %s",
1768                 indent, indent, indentation, format);
1769
1770         va_start(args, format);
1771         vfprintf(stderr, my_format, args);
1772         va_end(args);
1773         }
1774 /* Priority levels:
1775    0    [!]var, ()
1776    1    & ^
1777    2    |
1778 */
1779 static int process_proxy_cond_adders(unsigned int letters[26],
1780         const char *cond, const char **cond_end, int *pos, int indent);
1781 static int process_proxy_cond_val(unsigned int letters[26],
1782         const char *cond, const char **cond_end, int *pos, int indent)
1783         {
1784         int c;
1785         int ok = 1;
1786         int negate = 0;
1787
1788         while(isspace((int)*cond))
1789                 {
1790                 cond++; (*pos)++;
1791                 }
1792         c = *cond;
1793
1794         if (debug)
1795                 process_proxy_debug(indent,
1796                         "Start process_proxy_cond_val at position %d: %s\n",
1797                         *pos, cond);
1798
1799         while(c == '!')
1800                 {
1801                 negate = !negate;
1802                 cond++; (*pos)++;
1803                 while(isspace((int)*cond))
1804                         {
1805                         cond++; (*pos)++;
1806                         }
1807                 c = *cond;
1808                 }
1809
1810         if (c == '(')
1811                 {
1812                 cond++; (*pos)++;
1813                 ok = process_proxy_cond_adders(letters, cond, cond_end, pos,
1814                         indent + 1);
1815                 cond = *cond_end;
1816                 if (ok < 0)
1817                         goto end;
1818                 while(isspace((int)*cond))
1819                         {
1820                         cond++; (*pos)++;
1821                         }
1822                 c = *cond;
1823                 if (c != ')')
1824                         {
1825                         fprintf(stderr,
1826                                 "Weird condition character in position %d: "
1827                                 "%c\n", *pos, c);
1828                         ok = -1;
1829                         goto end;
1830                         }
1831                 cond++; (*pos)++;
1832                 }
1833         else if (isascii(c) && isalpha(c))
1834                 {
1835                 if (islower(c))
1836                         c = toupper(c);
1837                 ok = letters[c - 'A'];
1838                 cond++; (*pos)++;
1839                 }
1840         else
1841                 {
1842                 fprintf(stderr,
1843                         "Weird condition character in position %d: "
1844                         "%c\n", *pos, c);
1845                 ok = -1;
1846                 goto end;
1847                 }
1848  end:
1849         *cond_end = cond;
1850         if (ok >= 0 && negate)
1851                 ok = !ok;
1852
1853         if (debug)
1854                 process_proxy_debug(indent,
1855                         "End process_proxy_cond_val at position %d: %s, returning %d\n",
1856                         *pos, cond, ok);
1857
1858         return ok;
1859         }
1860 static int process_proxy_cond_multipliers(unsigned int letters[26],
1861         const char *cond, const char **cond_end, int *pos, int indent)
1862         {
1863         int ok;
1864         char c;
1865
1866         if (debug)
1867                 process_proxy_debug(indent,
1868                         "Start process_proxy_cond_multipliers at position %d: %s\n",
1869                         *pos, cond);
1870
1871         ok = process_proxy_cond_val(letters, cond, cond_end, pos, indent + 1);
1872         cond = *cond_end;
1873         if (ok < 0)
1874                 goto end;
1875
1876         while(ok >= 0)
1877                 {
1878                 while(isspace((int)*cond))
1879                         {
1880                         cond++; (*pos)++;
1881                         }
1882                 c = *cond;
1883
1884                 switch(c)
1885                         {
1886                 case '&':
1887                 case '^':
1888                         {
1889                         int save_ok = ok;
1890
1891                         cond++; (*pos)++;
1892                         ok = process_proxy_cond_val(letters,
1893                                 cond, cond_end, pos, indent + 1);
1894                         cond = *cond_end;
1895                         if (ok < 0)
1896                                 break;
1897
1898                         switch(c)
1899                                 {
1900                         case '&':
1901                                 ok &= save_ok;
1902                                 break;
1903                         case '^':
1904                                 ok ^= save_ok;
1905                                 break;
1906                         default:
1907                                 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
1908                                         " STOPPING\n");
1909                                 EXIT(1);
1910                                 }
1911                         }
1912                         break;
1913                 default:
1914                         goto end;
1915                         }
1916                 }
1917  end:
1918         if (debug)
1919                 process_proxy_debug(indent,
1920                         "End process_proxy_cond_multipliers at position %d: %s, returning %d\n",
1921                         *pos, cond, ok);
1922
1923         *cond_end = cond;
1924         return ok;
1925         }
1926 static int process_proxy_cond_adders(unsigned int letters[26],
1927         const char *cond, const char **cond_end, int *pos, int indent)
1928         {
1929         int ok;
1930         char c;
1931
1932         if (debug)
1933                 process_proxy_debug(indent,
1934                         "Start process_proxy_cond_adders at position %d: %s\n",
1935                         *pos, cond);
1936
1937         ok = process_proxy_cond_multipliers(letters, cond, cond_end, pos,
1938                 indent + 1);
1939         cond = *cond_end;
1940         if (ok < 0)
1941                 goto end;
1942
1943         while(ok >= 0)
1944                 {
1945                 while(isspace((int)*cond))
1946                         {
1947                         cond++; (*pos)++;
1948                         }
1949                 c = *cond;
1950
1951                 switch(c)
1952                         {
1953                 case '|':
1954                         {
1955                         int save_ok = ok;
1956
1957                         cond++; (*pos)++;
1958                         ok = process_proxy_cond_multipliers(letters,
1959                                 cond, cond_end, pos, indent + 1);
1960                         cond = *cond_end;
1961                         if (ok < 0)
1962                                 break;
1963
1964                         switch(c)
1965                                 {
1966                         case '|':
1967                                 ok |= save_ok;
1968                                 break;
1969                         default:
1970                                 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
1971                                         " STOPPING\n");
1972                                 EXIT(1);
1973                                 }
1974                         }
1975                         break;
1976                 default:
1977                         goto end;
1978                         }
1979                 }
1980  end:
1981         if (debug)
1982                 process_proxy_debug(indent,
1983                         "End process_proxy_cond_adders at position %d: %s, returning %d\n",
1984                         *pos, cond, ok);
1985
1986         *cond_end = cond;
1987         return ok;
1988         }
1989
1990 static int process_proxy_cond(unsigned int letters[26],
1991         const char *cond, const char **cond_end)
1992         {
1993         int pos = 1;
1994         return process_proxy_cond_adders(letters, cond, cond_end, &pos, 1);
1995         }
1996
1997 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg)
1998         {
1999         int ok=1;
2000         struct app_verify_arg *cb_arg = arg;
2001         unsigned int letters[26]; /* only used with proxy_auth */
2002
2003         if (cb_arg->app_verify)
2004                 {
2005                 char *s = NULL,buf[256];
2006
2007                 fprintf(stderr, "In app_verify_callback, allowing cert. ");
2008                 fprintf(stderr, "Arg is: %s\n", cb_arg->string);
2009                 fprintf(stderr, "Finished printing do we have a context? 0x%p a cert? 0x%p\n",
2010                         (void *)ctx, (void *)ctx->cert);
2011                 if (ctx->cert)
2012                         s=X509_NAME_oneline(X509_get_subject_name(ctx->cert),buf,256);
2013                 if (s != NULL)
2014                         {
2015                         fprintf(stderr,"cert depth=%d %s\n",ctx->error_depth,buf);
2016                         }
2017                 return(1);
2018                 }
2019         if (cb_arg->proxy_auth)
2020                 {
2021                 int found_any = 0, i;
2022                 char *sp;
2023
2024                 for(i = 0; i < 26; i++)
2025                         letters[i] = 0;
2026                 for(sp = cb_arg->proxy_auth; *sp; sp++)
2027                         {
2028                         int c = *sp;
2029                         if (isascii(c) && isalpha(c))
2030                                 {
2031                                 if (islower(c))
2032                                         c = toupper(c);
2033                                 letters[c - 'A'] = 1;
2034                                 }
2035                         }
2036
2037                 fprintf(stderr,
2038                         "  Initial proxy rights = ");
2039                 for(i = 0; i < 26; i++)
2040                         if (letters[i])
2041                                 {
2042                                 fprintf(stderr, "%c", i + 'A');
2043                                 found_any = 1;
2044                                 }
2045                 if (!found_any)
2046                         fprintf(stderr, "none");
2047                 fprintf(stderr, "\n");
2048
2049                 X509_STORE_CTX_set_ex_data(ctx,
2050                         get_proxy_auth_ex_data_idx(),letters);
2051                 }
2052         if (cb_arg->allow_proxy_certs)
2053                 {
2054                 X509_STORE_CTX_set_flags(ctx, X509_V_FLAG_ALLOW_PROXY_CERTS);
2055                 }
2056
2057 #ifndef OPENSSL_NO_X509_VERIFY
2058 # ifdef OPENSSL_FIPS
2059         if(s->version == TLS1_VERSION)
2060                 FIPS_allow_md5(1);
2061 # endif
2062         ok = X509_verify_cert(ctx);
2063 # ifdef OPENSSL_FIPS
2064         if(s->version == TLS1_VERSION)
2065                 FIPS_allow_md5(0);
2066 # endif
2067 #endif
2068
2069         if (cb_arg->proxy_auth)
2070                 {
2071                 if (ok)
2072                         {
2073                         const char *cond_end = NULL;
2074
2075                         ok = process_proxy_cond(letters,
2076                                 cb_arg->proxy_cond, &cond_end);
2077
2078                         if (ok < 0)
2079                                 EXIT(3);
2080                         if (*cond_end)
2081                                 {
2082                                 fprintf(stderr, "Stopped processing condition before it's end.\n");
2083                                 ok = 0;
2084                                 }
2085                         if (!ok)
2086                                 fprintf(stderr, "Proxy rights check with condition '%s' proved invalid\n",
2087                                         cb_arg->proxy_cond);
2088                         else
2089                                 fprintf(stderr, "Proxy rights check with condition '%s' proved valid\n",
2090                                         cb_arg->proxy_cond);
2091                         }
2092                 }
2093         return(ok);
2094         }
2095
2096 #ifndef OPENSSL_NO_RSA
2097 static RSA *rsa_tmp=NULL;
2098
2099 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength)
2100         {
2101         BIGNUM *bn = NULL;
2102         if (rsa_tmp == NULL)
2103                 {
2104                 bn = BN_new();
2105                 rsa_tmp = RSA_new();
2106                 if(!bn || !rsa_tmp || !BN_set_word(bn, RSA_F4))
2107                         {
2108                         BIO_printf(bio_err, "Memory error...");
2109                         goto end;
2110                         }
2111                 BIO_printf(bio_err,"Generating temp (%d bit) RSA key...",keylength);
2112                 (void)BIO_flush(bio_err);
2113                 if(!RSA_generate_key_ex(rsa_tmp,keylength,bn,NULL))
2114                         {
2115                         BIO_printf(bio_err, "Error generating key.");
2116                         RSA_free(rsa_tmp);
2117                         rsa_tmp = NULL;
2118                         }
2119 end:
2120                 BIO_printf(bio_err,"\n");
2121                 (void)BIO_flush(bio_err);
2122                 }
2123         if(bn) BN_free(bn);
2124         return(rsa_tmp);
2125         }
2126
2127 static void free_tmp_rsa(void)
2128         {
2129         if (rsa_tmp != NULL)
2130                 {
2131                 RSA_free(rsa_tmp);
2132                 rsa_tmp = NULL;
2133                 }
2134         }
2135 #endif
2136
2137 #ifndef OPENSSL_NO_DH
2138 /* These DH parameters have been generated as follows:
2139  *    $ openssl dhparam -C -noout 512
2140  *    $ openssl dhparam -C -noout 1024
2141  *    $ openssl dhparam -C -noout -dsaparam 1024
2142  * (The third function has been renamed to avoid name conflicts.)
2143  */
2144 static DH *get_dh512()
2145         {
2146         static unsigned char dh512_p[]={
2147                 0xCB,0xC8,0xE1,0x86,0xD0,0x1F,0x94,0x17,0xA6,0x99,0xF0,0xC6,
2148                 0x1F,0x0D,0xAC,0xB6,0x25,0x3E,0x06,0x39,0xCA,0x72,0x04,0xB0,
2149                 0x6E,0xDA,0xC0,0x61,0xE6,0x7A,0x77,0x25,0xE8,0x3B,0xB9,0x5F,
2150                 0x9A,0xB6,0xB5,0xFE,0x99,0x0B,0xA1,0x93,0x4E,0x35,0x33,0xB8,
2151                 0xE1,0xF1,0x13,0x4F,0x59,0x1A,0xD2,0x57,0xC0,0x26,0x21,0x33,
2152                 0x02,0xC5,0xAE,0x23,
2153                 };
2154         static unsigned char dh512_g[]={
2155                 0x02,
2156                 };
2157         DH *dh;
2158
2159         if ((dh=DH_new()) == NULL) return(NULL);
2160         dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
2161         dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
2162         if ((dh->p == NULL) || (dh->g == NULL))
2163                 { DH_free(dh); return(NULL); }
2164         return(dh);
2165         }
2166
2167 static DH *get_dh1024()
2168         {
2169         static unsigned char dh1024_p[]={
2170                 0xF8,0x81,0x89,0x7D,0x14,0x24,0xC5,0xD1,0xE6,0xF7,0xBF,0x3A,
2171                 0xE4,0x90,0xF4,0xFC,0x73,0xFB,0x34,0xB5,0xFA,0x4C,0x56,0xA2,
2172                 0xEA,0xA7,0xE9,0xC0,0xC0,0xCE,0x89,0xE1,0xFA,0x63,0x3F,0xB0,
2173                 0x6B,0x32,0x66,0xF1,0xD1,0x7B,0xB0,0x00,0x8F,0xCA,0x87,0xC2,
2174                 0xAE,0x98,0x89,0x26,0x17,0xC2,0x05,0xD2,0xEC,0x08,0xD0,0x8C,
2175                 0xFF,0x17,0x52,0x8C,0xC5,0x07,0x93,0x03,0xB1,0xF6,0x2F,0xB8,
2176                 0x1C,0x52,0x47,0x27,0x1B,0xDB,0xD1,0x8D,0x9D,0x69,0x1D,0x52,
2177                 0x4B,0x32,0x81,0xAA,0x7F,0x00,0xC8,0xDC,0xE6,0xD9,0xCC,0xC1,
2178                 0x11,0x2D,0x37,0x34,0x6C,0xEA,0x02,0x97,0x4B,0x0E,0xBB,0xB1,
2179                 0x71,0x33,0x09,0x15,0xFD,0xDD,0x23,0x87,0x07,0x5E,0x89,0xAB,
2180                 0x6B,0x7C,0x5F,0xEC,0xA6,0x24,0xDC,0x53,
2181                 };
2182         static unsigned char dh1024_g[]={
2183                 0x02,
2184                 };
2185         DH *dh;
2186
2187         if ((dh=DH_new()) == NULL) return(NULL);
2188         dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2189         dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2190         if ((dh->p == NULL) || (dh->g == NULL))
2191                 { DH_free(dh); return(NULL); }
2192         return(dh);
2193         }
2194
2195 static DH *get_dh1024dsa()
2196         {
2197         static unsigned char dh1024_p[]={
2198                 0xC8,0x00,0xF7,0x08,0x07,0x89,0x4D,0x90,0x53,0xF3,0xD5,0x00,
2199                 0x21,0x1B,0xF7,0x31,0xA6,0xA2,0xDA,0x23,0x9A,0xC7,0x87,0x19,
2200                 0x3B,0x47,0xB6,0x8C,0x04,0x6F,0xFF,0xC6,0x9B,0xB8,0x65,0xD2,
2201                 0xC2,0x5F,0x31,0x83,0x4A,0xA7,0x5F,0x2F,0x88,0x38,0xB6,0x55,
2202                 0xCF,0xD9,0x87,0x6D,0x6F,0x9F,0xDA,0xAC,0xA6,0x48,0xAF,0xFC,
2203                 0x33,0x84,0x37,0x5B,0x82,0x4A,0x31,0x5D,0xE7,0xBD,0x52,0x97,
2204                 0xA1,0x77,0xBF,0x10,0x9E,0x37,0xEA,0x64,0xFA,0xCA,0x28,0x8D,
2205                 0x9D,0x3B,0xD2,0x6E,0x09,0x5C,0x68,0xC7,0x45,0x90,0xFD,0xBB,
2206                 0x70,0xC9,0x3A,0xBB,0xDF,0xD4,0x21,0x0F,0xC4,0x6A,0x3C,0xF6,
2207                 0x61,0xCF,0x3F,0xD6,0x13,0xF1,0x5F,0xBC,0xCF,0xBC,0x26,0x9E,
2208                 0xBC,0x0B,0xBD,0xAB,0x5D,0xC9,0x54,0x39,
2209                 };
2210         static unsigned char dh1024_g[]={
2211                 0x3B,0x40,0x86,0xE7,0xF3,0x6C,0xDE,0x67,0x1C,0xCC,0x80,0x05,
2212                 0x5A,0xDF,0xFE,0xBD,0x20,0x27,0x74,0x6C,0x24,0xC9,0x03,0xF3,
2213                 0xE1,0x8D,0xC3,0x7D,0x98,0x27,0x40,0x08,0xB8,0x8C,0x6A,0xE9,
2214                 0xBB,0x1A,0x3A,0xD6,0x86,0x83,0x5E,0x72,0x41,0xCE,0x85,0x3C,
2215                 0xD2,0xB3,0xFC,0x13,0xCE,0x37,0x81,0x9E,0x4C,0x1C,0x7B,0x65,
2216                 0xD3,0xE6,0xA6,0x00,0xF5,0x5A,0x95,0x43,0x5E,0x81,0xCF,0x60,
2217                 0xA2,0x23,0xFC,0x36,0xA7,0x5D,0x7A,0x4C,0x06,0x91,0x6E,0xF6,
2218                 0x57,0xEE,0x36,0xCB,0x06,0xEA,0xF5,0x3D,0x95,0x49,0xCB,0xA7,
2219                 0xDD,0x81,0xDF,0x80,0x09,0x4A,0x97,0x4D,0xA8,0x22,0x72,0xA1,
2220                 0x7F,0xC4,0x70,0x56,0x70,0xE8,0x20,0x10,0x18,0x8F,0x2E,0x60,
2221                 0x07,0xE7,0x68,0x1A,0x82,0x5D,0x32,0xA2,
2222                 };
2223         DH *dh;
2224
2225         if ((dh=DH_new()) == NULL) return(NULL);
2226         dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2227         dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2228         if ((dh->p == NULL) || (dh->g == NULL))
2229                 { DH_free(dh); return(NULL); }
2230         dh->length = 160;
2231         return(dh);
2232         }
2233
2234 static int do_test_cipherlist(void)
2235         {
2236         int i = 0;
2237         const SSL_METHOD *meth;
2238         SSL_CIPHER *ci, *tci = NULL;
2239
2240         fprintf(stderr, "testing SSLv2 cipher list order: ");
2241         meth = SSLv2_method();
2242         while ((ci = meth->get_cipher(i++)) != NULL)
2243                 {
2244                 if (tci != NULL)
2245                         if (ci->id >= tci->id)
2246                                 {
2247                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2248                                 return 0;
2249                                 }
2250                 tci = ci;
2251                 }
2252         fprintf(stderr, "ok\n");
2253
2254         fprintf(stderr, "testing SSLv3 cipher list order: ");
2255         meth = SSLv3_method();
2256         tci = NULL;
2257         while ((ci = meth->get_cipher(i++)) != NULL)
2258                 {
2259                 if (tci != NULL)
2260                         if (ci->id >= tci->id)
2261                                 {
2262                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2263                                 return 0;
2264                                 }
2265                 tci = ci;
2266                 }
2267         fprintf(stderr, "ok\n");
2268
2269         fprintf(stderr, "testing TLSv1 cipher list order: ");
2270         meth = TLSv1_method();
2271         tci = NULL;
2272         while ((ci = meth->get_cipher(i++)) != NULL)
2273                 {
2274                 if (tci != NULL)
2275                         if (ci->id >= tci->id)
2276                                 {
2277                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2278                                 return 0;
2279                                 }
2280                 tci = ci;
2281                 }
2282         fprintf(stderr, "ok\n");
2283
2284         return 1;
2285         }
2286 #endif