ssl/ssltest.c

   1 /* ssl/ssltest.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111 /* ====================================================================
 112  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
 113  * ECC cipher suite support in OpenSSL originally developed by
 114  * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
 115  */
 116 /* ====================================================================
 117  * Copyright 2005 Nokia. All rights reserved.
 118  *
 119  * The portions of the attached software ("Contribution") is developed by
 120  * Nokia Corporation and is licensed pursuant to the OpenSSL open source
 121  * license.
 122  *
 123  * The Contribution, originally written by Mika Kousa and Pasi Eronen of
 124  * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
 125  * support (see RFC 4279) to OpenSSL.
 126  *
 127  * No patent licenses or other rights except those expressly stated in
 128  * the OpenSSL open source license shall be deemed granted or received
 129  * expressly, by implication, estoppel, or otherwise.
 130  *
 131  * No assurances are provided by Nokia that the Contribution does not
 132  * infringe the patent or other intellectual property rights of any third
 133  * party or that the license provides you with all the necessary rights
 134  * to make use of the Contribution.
 135  *
 136  * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
 137  * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
 138  * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
 139  * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
 140  * OTHERWISE.
 141  */
 142
 143 #define _BSD_SOURCE 1           /* Or gethostname won't be declared properly
 144                                    on Linux and GNU platforms. */
 145
 146 #include <assert.h>
 147 #include <errno.h>
 148 #include <limits.h>
 149 #include <stdio.h>
 150 #include <stdlib.h>
 151 #include <string.h>
 152 #include <time.h>
 153
 154 #define USE_SOCKETS
 155 #include "e_os.h"
 156
 157 #ifdef OPENSSL_SYS_VMS
 158 #define _XOPEN_SOURCE 500       /* Or isascii won't be declared properly on
 159                                    VMS (at least with DECompHP C).  */
 160 #endif
 161
 162 #include <ctype.h>
 163
 164 #include <openssl/bio.h>
 165 #include <openssl/crypto.h>
 166 #include <openssl/evp.h>
 167 #include <openssl/x509.h>
 168 #include <openssl/x509v3.h>
 169 #include <openssl/ssl.h>
 170 #ifndef OPENSSL_NO_ENGINE
 171 #include <openssl/engine.h>
 172 #endif
 173 #include <openssl/err.h>
 174 #include <openssl/rand.h>
 175 #ifndef OPENSSL_NO_RSA
 176 #include <openssl/rsa.h>
 177 #endif
 178 #ifndef OPENSSL_NO_DSA
 179 #include <openssl/dsa.h>
 180 #endif
 181 #ifndef OPENSSL_NO_DH
 182 #include <openssl/dh.h>
 183 #endif
 184 #ifndef OPENSSL_NO_SRP
 185 #include <openssl/srp.h>
 186 #endif
 187 #include <openssl/bn.h>
 188
 189 #define _XOPEN_SOURCE_EXTENDED  1 /* Or gethostname won't be declared properly
 190                                      on Compaq platforms (at least with DEC C).
 191                                      Do not try to put it earlier, or IPv6 includes
 192                                      get screwed...
 193                                   */
 194
 195 #ifdef OPENSSL_SYS_WINDOWS
 196 #include <winsock.h>
 197 #else
 198 #include OPENSSL_UNISTD
 199 #endif
 200
 201 #ifdef OPENSSL_SYS_VMS
 202 #  define TEST_SERVER_CERT "SYS$DISK:[-.APPS]SERVER.PEM"
 203 #  define TEST_CLIENT_CERT "SYS$DISK:[-.APPS]CLIENT.PEM"
 204 #elif defined(OPENSSL_SYS_WINCE)
 205 #  define TEST_SERVER_CERT "\\OpenSSL\\server.pem"
 206 #  define TEST_CLIENT_CERT "\\OpenSSL\\client.pem"
 207 #elif defined(OPENSSL_SYS_NETWARE)
 208 #  define TEST_SERVER_CERT "\\openssl\\apps\\server.pem"
 209 #  define TEST_CLIENT_CERT "\\openssl\\apps\\client.pem"
 210 #else
 211 #  define TEST_SERVER_CERT "../apps/server.pem"
 212 #  define TEST_CLIENT_CERT "../apps/client.pem"
 213 #endif
 214
 215 /* There is really no standard for this, so let's assign some tentative
 216    numbers.  In any case, these numbers are only for this test */
 217 #define COMP_RLE        255
 218 #define COMP_ZLIB       1
 219
 220 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
 221 #ifndef OPENSSL_NO_RSA
 222 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export,int keylength);
 223 static void free_tmp_rsa(void);
 224 #endif
 225 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg);
 226 #define APP_CALLBACK_STRING "Test Callback Argument"
 227 struct app_verify_arg
 228         {
 229         char *string;
 230         int app_verify;
 231         int allow_proxy_certs;
 232         char *proxy_auth;
 233         char *proxy_cond;
 234         };
 235
 236 #ifndef OPENSSL_NO_DH
 237 static DH *get_dh512(void);
 238 static DH *get_dh1024(void);
 239 static DH *get_dh1024dsa(void);
 240 #endif
 241
 242
 243 static char *psk_key=NULL; /* by default PSK is not used */
 244 #ifndef OPENSSL_NO_PSK
 245 static unsigned int psk_client_callback(SSL *ssl, const char *hint, char *identity,
 246         unsigned int max_identity_len, unsigned char *psk,
 247         unsigned int max_psk_len);
 248 static unsigned int psk_server_callback(SSL *ssl, const char *identity, unsigned char *psk,
 249         unsigned int max_psk_len);
 250 #endif
 251
 252 #ifndef OPENSSL_NO_SRP
 253 /* SRP client */
 254 /* This is a context that we pass to all callbacks */
 255 typedef struct srp_client_arg_st
 256         {
 257         char *srppassin;
 258         char *srplogin;
 259         } SRP_CLIENT_ARG;
 260
 261 #define PWD_STRLEN 1024
 262
 263 static char * MS_CALLBACK ssl_give_srp_client_pwd_cb(SSL *s, void *arg)
 264         {
 265         SRP_CLIENT_ARG *srp_client_arg = (SRP_CLIENT_ARG *)arg;
 266         return BUF_strdup((char *)srp_client_arg->srppassin);
 267         }
 268
 269 /* SRP server */
 270 /* This is a context that we pass to SRP server callbacks */
 271 typedef struct srp_server_arg_st
 272         {
 273         char *expected_user;
 274         char *pass;
 275         } SRP_SERVER_ARG;
 276
 277 static int MS_CALLBACK ssl_srp_server_param_cb(SSL *s, int *ad, void *arg)
 278         {
 279         SRP_SERVER_ARG * p = (SRP_SERVER_ARG *) arg;
 280
 281         if (strcmp(p->expected_user, SSL_get_srp_username(s)) != 0)
 282                 {
 283                 fprintf(stderr, "User %s doesn't exist\n", SSL_get_srp_username(s));
 284                 return SSL3_AL_FATAL;
 285                 }
 286         if (SSL_set_srp_server_param_pw(s,p->expected_user,p->pass,"1024")<0)
 287                 {
 288                 *ad = SSL_AD_INTERNAL_ERROR;
 289                 return SSL3_AL_FATAL;
 290                 }
 291         return SSL_ERROR_NONE;
 292         }
 293 #endif
 294
 295 static BIO *bio_err=NULL;
 296 static BIO *bio_stdout=NULL;
 297
 298 #ifndef OPENSSL_NO_NPN
 299 /* Note that this code assumes that this is only a one element list: */
 300 static const char NEXT_PROTO_STRING[] = "\x09testproto";
 301 int npn_client = 0;
 302 int npn_server = 0;
 303 int npn_server_reject = 0;
 304
 305 static int cb_client_npn(SSL *s, unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg)
 306         {
 307         /* This callback only returns the protocol string, rather than a length
 308            prefixed set. We assume that NEXT_PROTO_STRING is a one element list and
 309            remove the first byte to chop off the length prefix. */
 310         *out = (unsigned char*) NEXT_PROTO_STRING + 1;
 311         *outlen = sizeof(NEXT_PROTO_STRING) - 2;
 312         return SSL_TLSEXT_ERR_OK;
 313         }
 314
 315 static int cb_server_npn(SSL *s, const unsigned char **data, unsigned int *len, void *arg)
 316         {
 317         *data = (const unsigned char *) NEXT_PROTO_STRING;
 318         *len = sizeof(NEXT_PROTO_STRING) - 1;
 319         return SSL_TLSEXT_ERR_OK;
 320         }
 321
 322 static int cb_server_rejects_npn(SSL *s, const unsigned char **data, unsigned int *len, void *arg)
 323         {
 324         return SSL_TLSEXT_ERR_NOACK;
 325         }
 326
 327 static int verify_npn(SSL *client, SSL *server)
 328         {
 329         const unsigned char *client_s;
 330         unsigned client_len;
 331         const unsigned char *server_s;
 332         unsigned server_len;
 333
 334         SSL_get0_next_proto_negotiated(client, &client_s, &client_len);
 335         SSL_get0_next_proto_negotiated(server, &server_s, &server_len);
 336
 337         if (client_len)
 338                 {
 339                 BIO_printf(bio_stdout, "Client NPN: ");
 340                 BIO_write(bio_stdout, client_s, client_len);
 341                 BIO_printf(bio_stdout, "\n");
 342                 }
 343
 344         if (server_len)
 345                 {
 346                 BIO_printf(bio_stdout, "Server NPN: ");
 347                 BIO_write(bio_stdout, server_s, server_len);
 348                 BIO_printf(bio_stdout, "\n");
 349                 }
 350
 351         /* If an NPN string was returned, it must be the protocol that we
 352          * expected to negotiate. */
 353         if (client_len && (client_len != sizeof(NEXT_PROTO_STRING) - 2 ||
 354                            memcmp(client_s, NEXT_PROTO_STRING + 1, client_len)))
 355                 return -1;
 356         if (server_len && (server_len != sizeof(NEXT_PROTO_STRING) - 2 ||
 357                            memcmp(server_s, NEXT_PROTO_STRING + 1, server_len)))
 358                 return -1;
 359
 360         if (!npn_client && client_len)
 361                 return -1;
 362         if (!npn_server && server_len)
 363                 return -1;
 364         if (npn_server_reject && server_len)
 365                 return -1;
 366         if (npn_client && npn_server && (!client_len || !server_len))
 367                 return -1;
 368
 369         return 0;
 370         }
 371 #endif
 372
 373 static char *cipher=NULL;
 374 static int verbose=0;
 375 static int debug=0;
 376 #if 0
 377 /* Not used yet. */
 378 #ifdef FIONBIO
 379 static int s_nbio=0;
 380 #endif
 381 #endif
 382
 383 static const char rnd_seed[] = "string to make the random number generator think it has entropy";
 384
 385 int doit_biopair(SSL *s_ssl,SSL *c_ssl,long bytes,clock_t *s_time,clock_t *c_time);
 386 int doit(SSL *s_ssl,SSL *c_ssl,long bytes);
 387 static int do_test_cipherlist(void);
 388 static void sv_usage(void)
 389         {
 390         fprintf(stderr,"usage: ssltest [args ...]\n");
 391         fprintf(stderr,"\n");
 392 #ifdef OPENSSL_FIPS
 393         fprintf(stderr,"-F             - run test in FIPS mode\n");
 394 #endif
 395         fprintf(stderr," -server_auth  - check server certificate\n");
 396         fprintf(stderr," -client_auth  - do client authentication\n");
 397         fprintf(stderr," -proxy        - allow proxy certificates\n");
 398         fprintf(stderr," -proxy_auth <val> - set proxy policy rights\n");
 399         fprintf(stderr," -proxy_cond <val> - experssion to test proxy policy rights\n");
 400         fprintf(stderr," -v            - more output\n");
 401         fprintf(stderr," -d            - debug output\n");
 402         fprintf(stderr," -reuse        - use session-id reuse\n");
 403         fprintf(stderr," -num <val>    - number of connections to perform\n");
 404         fprintf(stderr," -bytes <val>  - number of bytes to swap between client/server\n");
 405 #ifndef OPENSSL_NO_DH
 406         fprintf(stderr," -dhe1024      - use 1024 bit key (safe prime) for DHE\n");
 407         fprintf(stderr," -dhe1024dsa   - use 1024 bit key (with 160-bit subprime) for DHE\n");
 408         fprintf(stderr," -no_dhe       - disable DHE\n");
 409 #endif
 410 #ifndef OPENSSL_NO_ECDH
 411         fprintf(stderr," -no_ecdhe     - disable ECDHE\n");
 412 #endif
 413 #ifndef OPENSSL_NO_PSK
 414         fprintf(stderr," -psk arg      - PSK in hex (without 0x)\n");
 415 #endif
 416 #ifndef OPENSSL_NO_SRP
 417         fprintf(stderr," -srpuser user  - SRP username to use\n");
 418         fprintf(stderr," -srppass arg   - password for 'user'\n");
 419 #endif
 420 #ifndef OPENSSL_NO_SSL2
 421         fprintf(stderr," -ssl2         - use SSLv2\n");
 422 #endif
 423 #ifndef OPENSSL_NO_SSL3
 424         fprintf(stderr," -ssl3         - use SSLv3\n");
 425 #endif
 426 #ifndef OPENSSL_NO_TLS1
 427         fprintf(stderr," -tls1         - use TLSv1\n");
 428 #endif
 429         fprintf(stderr," -CApath arg   - PEM format directory of CA's\n");
 430         fprintf(stderr," -CAfile arg   - PEM format file of CA's\n");
 431         fprintf(stderr," -cert arg     - Server certificate file\n");
 432         fprintf(stderr," -key arg      - Server key file (default: same as -cert)\n");
 433         fprintf(stderr," -c_cert arg   - Client certificate file\n");
 434         fprintf(stderr," -c_key arg    - Client key file (default: same as -c_cert)\n");
 435         fprintf(stderr," -cipher arg   - The cipher list\n");
 436         fprintf(stderr," -bio_pair     - Use BIO pairs\n");
 437         fprintf(stderr," -f            - Test even cases that can't work\n");
 438         fprintf(stderr," -time         - measure processor time used by client and server\n");
 439         fprintf(stderr," -zlib         - use zlib compression\n");
 440         fprintf(stderr," -rle          - use rle compression\n");
 441 #ifndef OPENSSL_NO_ECDH
 442         fprintf(stderr," -named_curve arg  - Elliptic curve name to use for ephemeral ECDH keys.\n" \
 443                        "                 Use \"openssl ecparam -list_curves\" for all names\n"  \
 444                        "                 (default is sect163r2).\n");
 445 #endif
 446         fprintf(stderr," -test_cipherlist - verifies the order of the ssl cipher lists\n");
 447 #ifndef OPENSSL_NO_NPN
 448         fprintf(stderr," -npn_client - have client side offer NPN\n");
 449         fprintf(stderr," -npn_server - have server side offer NPN\n");
 450         fprintf(stderr," -npn_server_reject - have server reject NPN\n");
 451 #endif
 452         }
 453
 454 static void print_details(SSL *c_ssl, const char *prefix)
 455         {
 456         const SSL_CIPHER *ciph;
 457         X509 *cert;
 458
 459         ciph=SSL_get_current_cipher(c_ssl);
 460         BIO_printf(bio_stdout,"%s%s, cipher %s %s",
 461                 prefix,
 462                 SSL_get_version(c_ssl),
 463                 SSL_CIPHER_get_version(ciph),
 464                 SSL_CIPHER_get_name(ciph));
 465         cert=SSL_get_peer_certificate(c_ssl);
 466         if (cert != NULL)
 467                 {
 468                 EVP_PKEY *pkey = X509_get_pubkey(cert);
 469                 if (pkey != NULL)
 470                         {
 471                         if (0)
 472                                 ;
 473 #ifndef OPENSSL_NO_RSA
 474                         else if (pkey->type == EVP_PKEY_RSA && pkey->pkey.rsa != NULL
 475                                 && pkey->pkey.rsa->n != NULL)
 476                                 {
 477                                 BIO_printf(bio_stdout, ", %d bit RSA",
 478                                         BN_num_bits(pkey->pkey.rsa->n));
 479                                 }
 480 #endif
 481 #ifndef OPENSSL_NO_DSA
 482                         else if (pkey->type == EVP_PKEY_DSA && pkey->pkey.dsa != NULL
 483                                 && pkey->pkey.dsa->p != NULL)
 484                                 {
 485                                 BIO_printf(bio_stdout, ", %d bit DSA",
 486                                         BN_num_bits(pkey->pkey.dsa->p));
 487                                 }
 488 #endif
 489                         EVP_PKEY_free(pkey);
 490                         }
 491                 X509_free(cert);
 492                 }
 493         /* The SSL API does not allow us to look at temporary RSA/DH keys,
 494          * otherwise we should print their lengths too */
 495         BIO_printf(bio_stdout,"\n");
 496         }
 497
 498 static void lock_dbg_cb(int mode, int type, const char *file, int line)
 499         {
 500         static int modes[CRYPTO_NUM_LOCKS]; /* = {0, 0, ... } */
 501         const char *errstr = NULL;
 502         int rw;
 503
 504         rw = mode & (CRYPTO_READ|CRYPTO_WRITE);
 505         if (!((rw == CRYPTO_READ) || (rw == CRYPTO_WRITE)))
 506                 {
 507                 errstr = "invalid mode";
 508                 goto err;
 509                 }
 510
 511         if (type < 0 || type >= CRYPTO_NUM_LOCKS)
 512                 {
 513                 errstr = "type out of bounds";
 514                 goto err;
 515                 }
 516
 517         if (mode & CRYPTO_LOCK)
 518                 {
 519                 if (modes[type])
 520                         {
 521                         errstr = "already locked";
 522                         /* must not happen in a single-threaded program
 523                          * (would deadlock) */
 524                         goto err;
 525                         }
 526
 527                 modes[type] = rw;
 528                 }
 529         else if (mode & CRYPTO_UNLOCK)
 530                 {
 531                 if (!modes[type])
 532                         {
 533                         errstr = "not locked";
 534                         goto err;
 535                         }
 536
 537                 if (modes[type] != rw)
 538                         {
 539                         errstr = (rw == CRYPTO_READ) ?
 540                                 "CRYPTO_r_unlock on write lock" :
 541                                 "CRYPTO_w_unlock on read lock";
 542                         }
 543
 544                 modes[type] = 0;
 545                 }
 546         else
 547                 {
 548                 errstr = "invalid mode";
 549                 goto err;
 550                 }
 551
 552  err:
 553         if (errstr)
 554                 {
 555                 /* we cannot use bio_err here */
 556                 fprintf(stderr, "openssl (lock_dbg_cb): %s (mode=%d, type=%d) at %s:%d\n",
 557                         errstr, mode, type, file, line);
 558                 }
 559         }
 560
 561 #ifdef TLSEXT_TYPE_opaque_prf_input
 562 struct cb_info_st { void *input; size_t len; int ret; };
 563 struct cb_info_st co1 = { "C", 1, 1 }; /* try to negotiate oqaque PRF input */
 564 struct cb_info_st co2 = { "C", 1, 2 }; /* insist on oqaque PRF input */
 565 struct cb_info_st so1 = { "S", 1, 1 }; /* try to negotiate oqaque PRF input */
 566 struct cb_info_st so2 = { "S", 1, 2 }; /* insist on oqaque PRF input */
 567
 568 int opaque_prf_input_cb(SSL *ssl, void *peerinput, size_t len, void *arg_)
 569         {
 570         struct cb_info_st *arg = arg_;
 571
 572         if (arg == NULL)
 573                 return 1;
 574
 575         if (!SSL_set_tlsext_opaque_prf_input(ssl, arg->input, arg->len))
 576                 return 0;
 577         return arg->ret;
 578         }
 579 #endif
 580
 581 int main(int argc, char *argv[])
 582         {
 583         char *CApath=NULL,*CAfile=NULL;
 584         int badop=0;
 585         int bio_pair=0;
 586         int force=0;
 587         int tls1=0,ssl2=0,ssl3=0,ret=1;
 588         int client_auth=0;
 589         int server_auth=0,i;
 590         struct app_verify_arg app_verify_arg =
 591                 { APP_CALLBACK_STRING, 0, 0, NULL, NULL };
 592         char *server_cert=TEST_SERVER_CERT;
 593         char *server_key=NULL;
 594         char *client_cert=TEST_CLIENT_CERT;
 595         char *client_key=NULL;
 596 #ifndef OPENSSL_NO_ECDH
 597         char *named_curve = NULL;
 598 #endif
 599         SSL_CTX *s_ctx=NULL;
 600         SSL_CTX *c_ctx=NULL;
 601         const SSL_METHOD *meth=NULL;
 602         SSL *c_ssl,*s_ssl;
 603         int number=1,reuse=0;
 604         long bytes=256L;
 605 #ifndef OPENSSL_NO_DH
 606         DH *dh;
 607         int dhe1024 = 0, dhe1024dsa = 0;
 608 #endif
 609 #ifndef OPENSSL_NO_ECDH
 610         EC_KEY *ecdh = NULL;
 611 #endif
 612 #ifndef OPENSSL_NO_SRP
 613         /* client */
 614         SRP_CLIENT_ARG srp_client_arg = {NULL,NULL};
 615         /* server */
 616         SRP_SERVER_ARG srp_server_arg = {NULL,NULL};
 617 #endif
 618         int no_dhe = 0;
 619         int no_ecdhe = 0;
 620         int no_psk = 0;
 621         int print_time = 0;
 622         clock_t s_time = 0, c_time = 0;
 623         int comp = 0;
 624 #ifndef OPENSSL_NO_COMP
 625         COMP_METHOD *cm = NULL;
 626         STACK_OF(SSL_COMP) *ssl_comp_methods = NULL;
 627 #endif
 628         int test_cipherlist = 0;
 629 #ifdef OPENSSL_FIPS
 630         int fips_mode=0;
 631 #endif
 632
 633         verbose = 0;
 634         debug = 0;
 635         cipher = 0;
 636
 637         bio_err=BIO_new_fp(stderr,BIO_NOCLOSE|BIO_FP_TEXT);
 638
 639         CRYPTO_set_locking_callback(lock_dbg_cb);
 640
 641         /* enable memory leak checking unless explicitly disabled */
 642         if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) && (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off"))))
 643                 {
 644                 CRYPTO_malloc_debug_init();
 645                 CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
 646                 }
 647         else
 648                 {
 649                 /* OPENSSL_DEBUG_MEMORY=off */
 650                 CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0);
 651                 }
 652         CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
 653
 654         RAND_seed(rnd_seed, sizeof rnd_seed);
 655
 656         bio_stdout=BIO_new_fp(stdout,BIO_NOCLOSE|BIO_FP_TEXT);
 657
 658         argc--;
 659         argv++;
 660
 661         while (argc >= 1)
 662                 {
 663                 if(!strcmp(*argv,"-F"))
 664                         {
 665 #ifdef OPENSSL_FIPS
 666                         fips_mode=1;
 667 #else
 668                         fprintf(stderr,"not compiled with FIPS support, so exitting without running.\n");
 669                         EXIT(0);
 670 #endif
 671                         }
 672                 else if (strcmp(*argv,"-server_auth") == 0)
 673                         server_auth=1;
 674                 else if (strcmp(*argv,"-client_auth") == 0)
 675                         client_auth=1;
 676                 else if (strcmp(*argv,"-proxy_auth") == 0)
 677                         {
 678                         if (--argc < 1) goto bad;
 679                         app_verify_arg.proxy_auth= *(++argv);
 680                         }
 681                 else if (strcmp(*argv,"-proxy_cond") == 0)
 682                         {
 683                         if (--argc < 1) goto bad;
 684                         app_verify_arg.proxy_cond= *(++argv);
 685                         }
 686                 else if (strcmp(*argv,"-v") == 0)
 687                         verbose=1;
 688                 else if (strcmp(*argv,"-d") == 0)
 689                         debug=1;
 690                 else if (strcmp(*argv,"-reuse") == 0)
 691                         reuse=1;
 692                 else if (strcmp(*argv,"-dhe1024") == 0)
 693                         {
 694 #ifndef OPENSSL_NO_DH
 695                         dhe1024=1;
 696 #else
 697                         fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
 698 #endif
 699                         }
 700                 else if (strcmp(*argv,"-dhe1024dsa") == 0)
 701                         {
 702 #ifndef OPENSSL_NO_DH
 703                         dhe1024dsa=1;
 704 #else
 705                         fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
 706 #endif
 707                         }
 708                 else if (strcmp(*argv,"-no_dhe") == 0)
 709                         no_dhe=1;
 710                 else if (strcmp(*argv,"-no_ecdhe") == 0)
 711                         no_ecdhe=1;
 712                 else if (strcmp(*argv,"-psk") == 0)
 713                         {
 714                         if (--argc < 1) goto bad;
 715                         psk_key=*(++argv);
 716 #ifndef OPENSSL_NO_PSK
 717                         if (strspn(psk_key, "abcdefABCDEF1234567890") != strlen(psk_key))
 718                                 {
 719                                 BIO_printf(bio_err,"Not a hex number '%s'\n",*argv);
 720                                 goto bad;
 721                                 }
 722 #else
 723                         no_psk=1;
 724 #endif
 725                         }
 726 #ifndef OPENSSL_NO_SRP
 727                 else if (strcmp(*argv,"-srpuser") == 0)
 728                         {
 729                         if (--argc < 1) goto bad;
 730                         srp_server_arg.expected_user = srp_client_arg.srplogin= *(++argv);
 731                         tls1=1;
 732                         }
 733                 else if (strcmp(*argv,"-srppass") == 0)
 734                         {
 735                         if (--argc < 1) goto bad;
 736                         srp_server_arg.pass = srp_client_arg.srppassin= *(++argv);
 737                         tls1=1;
 738                         }
 739 #endif
 740                 else if (strcmp(*argv,"-ssl2") == 0)
 741                         ssl2=1;
 742                 else if (strcmp(*argv,"-tls1") == 0)
 743                         tls1=1;
 744                 else if (strcmp(*argv,"-ssl3") == 0)
 745                         ssl3=1;
 746                 else if (strncmp(*argv,"-num",4) == 0)
 747                         {
 748                         if (--argc < 1) goto bad;
 749                         number= atoi(*(++argv));
 750                         if (number == 0) number=1;
 751                         }
 752                 else if (strcmp(*argv,"-bytes") == 0)
 753                         {
 754                         if (--argc < 1) goto bad;
 755                         bytes= atol(*(++argv));
 756                         if (bytes == 0L) bytes=1L;
 757                         i=strlen(argv[0]);
 758                         if (argv[0][i-1] == 'k') bytes*=1024L;
 759                         if (argv[0][i-1] == 'm') bytes*=1024L*1024L;
 760                         }
 761                 else if (strcmp(*argv,"-cert") == 0)
 762                         {
 763                         if (--argc < 1) goto bad;
 764                         server_cert= *(++argv);
 765                         }
 766                 else if (strcmp(*argv,"-s_cert") == 0)
 767                         {
 768                         if (--argc < 1) goto bad;
 769                         server_cert= *(++argv);
 770                         }
 771                 else if (strcmp(*argv,"-key") == 0)
 772                         {
 773                         if (--argc < 1) goto bad;
 774                         server_key= *(++argv);
 775                         }
 776                 else if (strcmp(*argv,"-s_key") == 0)
 777                         {
 778                         if (--argc < 1) goto bad;
 779                         server_key= *(++argv);
 780                         }
 781                 else if (strcmp(*argv,"-c_cert") == 0)
 782                         {
 783                         if (--argc < 1) goto bad;
 784                         client_cert= *(++argv);
 785                         }
 786                 else if (strcmp(*argv,"-c_key") == 0)
 787                         {
 788                         if (--argc < 1) goto bad;
 789                         client_key= *(++argv);
 790                         }
 791                 else if (strcmp(*argv,"-cipher") == 0)
 792                         {
 793                         if (--argc < 1) goto bad;
 794                         cipher= *(++argv);
 795                         }
 796                 else if (strcmp(*argv,"-CApath") == 0)
 797                         {
 798                         if (--argc < 1) goto bad;
 799                         CApath= *(++argv);
 800                         }
 801                 else if (strcmp(*argv,"-CAfile") == 0)
 802                         {
 803                         if (--argc < 1) goto bad;
 804                         CAfile= *(++argv);
 805                         }
 806                 else if (strcmp(*argv,"-bio_pair") == 0)
 807                         {
 808                         bio_pair = 1;
 809                         }
 810                 else if (strcmp(*argv,"-f") == 0)
 811                         {
 812                         force = 1;
 813                         }
 814                 else if (strcmp(*argv,"-time") == 0)
 815                         {
 816                         print_time = 1;
 817                         }
 818                 else if (strcmp(*argv,"-zlib") == 0)
 819                         {
 820                         comp = COMP_ZLIB;
 821                         }
 822                 else if (strcmp(*argv,"-rle") == 0)
 823                         {
 824                         comp = COMP_RLE;
 825                         }
 826                 else if (strcmp(*argv,"-named_curve") == 0)
 827                         {
 828                         if (--argc < 1) goto bad;
 829 #ifndef OPENSSL_NO_ECDH
 830                         named_curve = *(++argv);
 831 #else
 832                         fprintf(stderr,"ignoring -named_curve, since I'm compiled without ECDH\n");
 833                         ++argv;
 834 #endif
 835                         }
 836                 else if (strcmp(*argv,"-app_verify") == 0)
 837                         {
 838                         app_verify_arg.app_verify = 1;
 839                         }
 840                 else if (strcmp(*argv,"-proxy") == 0)
 841                         {
 842                         app_verify_arg.allow_proxy_certs = 1;
 843                         }
 844                 else if (strcmp(*argv,"-test_cipherlist") == 0)
 845                         {
 846                         test_cipherlist = 1;
 847                         }
 848 #ifndef OPENSSL_NO_NPN
 849                 else if (strcmp(*argv,"-npn_client") == 0)
 850                         {
 851                         npn_client = 1;
 852                         }
 853                 else if (strcmp(*argv,"-npn_server") == 0)
 854                         {
 855                         npn_server = 1;
 856                         }
 857                 else if (strcmp(*argv,"-npn_server_reject") == 0)
 858                         {
 859                         npn_server_reject = 1;
 860                         }
 861 #endif
 862                 else
 863                         {
 864                         fprintf(stderr,"unknown option %s\n",*argv);
 865                         badop=1;
 866                         break;
 867                         }
 868                 argc--;
 869                 argv++;
 870                 }
 871         if (badop)
 872                 {
 873 bad:
 874                 sv_usage();
 875                 goto end;
 876                 }
 877
 878         if (test_cipherlist == 1)
 879                 {
 880                 /* ensure that the cipher list are correctly sorted and exit */
 881                 if (do_test_cipherlist() == 0)
 882                         EXIT(1);
 883                 ret = 0;
 884                 goto end;
 885                 }
 886
 887         if (!ssl2 && !ssl3 && !tls1 && number > 1 && !reuse && !force)
 888                 {
 889                 fprintf(stderr, "This case cannot work.  Use -f to perform "
 890                         "the test anyway (and\n-d to see what happens), "
 891                         "or add one of -ssl2, -ssl3, -tls1, -reuse\n"
 892                         "to avoid protocol mismatch.\n");
 893                 EXIT(1);
 894                 }
 895
 896 #ifdef OPENSSL_FIPS
 897         if(fips_mode)
 898                 {
 899                 if(!FIPS_mode_set(1))
 900                         {
 901                         ERR_load_crypto_strings();
 902                         ERR_print_errors(BIO_new_fp(stderr,BIO_NOCLOSE));
 903                         EXIT(1);
 904                         }
 905                 else
 906                         fprintf(stderr,"*** IN FIPS MODE ***\n");
 907                 }
 908 #endif
 909
 910         if (print_time)
 911                 {
 912                 if (!bio_pair)
 913                         {
 914                         fprintf(stderr, "Using BIO pair (-bio_pair)\n");
 915                         bio_pair = 1;
 916                         }
 917                 if (number < 50 && !force)
 918                         fprintf(stderr, "Warning: For accurate timings, use more connections (e.g. -num 1000)\n");
 919                 }
 920
 921 /*      if (cipher == NULL) cipher=getenv("SSL_CIPHER"); */
 922
 923         SSL_library_init();
 924         SSL_load_error_strings();
 925
 926 #ifndef OPENSSL_NO_COMP
 927         if (comp == COMP_ZLIB) cm = COMP_zlib();
 928         if (comp == COMP_RLE) cm = COMP_rle();
 929         if (cm != NULL)
 930                 {
 931                 if (cm->type != NID_undef)
 932                         {
 933                         if (SSL_COMP_add_compression_method(comp, cm) != 0)
 934                                 {
 935                                 fprintf(stderr,
 936                                         "Failed to add compression method\n");
 937                                 ERR_print_errors_fp(stderr);
 938                                 }
 939                         }
 940                 else
 941                         {
 942                         fprintf(stderr,
 943                                 "Warning: %s compression not supported\n",
 944                                 (comp == COMP_RLE ? "rle" :
 945                                         (comp == COMP_ZLIB ? "zlib" :
 946                                                 "unknown")));
 947                         ERR_print_errors_fp(stderr);
 948                         }
 949                 }
 950         ssl_comp_methods = SSL_COMP_get_compression_methods();
 951         fprintf(stderr, "Available compression methods:\n");
 952         {
 953         int j, n = sk_SSL_COMP_num(ssl_comp_methods);
 954         if (n == 0)
 955                 fprintf(stderr, "  NONE\n");
 956         else
 957                 for (j = 0; j < n; j++)
 958                         {
 959                         SSL_COMP *c = sk_SSL_COMP_value(ssl_comp_methods, j);
 960                         fprintf(stderr, "  %d: %s\n", c->id, c->name);
 961                         }
 962         }
 963 #endif
 964
 965 #if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
 966         if (ssl2)
 967                 meth=SSLv2_method();
 968         else
 969         if (tls1)
 970                 meth=TLSv1_method();
 971         else
 972         if (ssl3)
 973                 meth=SSLv3_method();
 974         else
 975                 meth=SSLv23_method();
 976 #else
 977 #ifdef OPENSSL_NO_SSL2
 978         meth=SSLv3_method();
 979 #else
 980         meth=SSLv2_method();
 981 #endif
 982 #endif
 983
 984         c_ctx=SSL_CTX_new(meth);
 985         s_ctx=SSL_CTX_new(meth);
 986         if ((c_ctx == NULL) || (s_ctx == NULL))
 987                 {
 988                 ERR_print_errors(bio_err);
 989                 goto end;
 990                 }
 991
 992         if (cipher != NULL)
 993                 {
 994                 SSL_CTX_set_cipher_list(c_ctx,cipher);
 995                 SSL_CTX_set_cipher_list(s_ctx,cipher);
 996                 }
 997
 998 #ifndef OPENSSL_NO_DH
 999         if (!no_dhe)
1000                 {
1001                 if (dhe1024dsa)
1002                         {
1003                         /* use SSL_OP_SINGLE_DH_USE to avoid small subgroup attacks */
1004                         SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
1005                         dh=get_dh1024dsa();
1006                         }
1007                 else if (dhe1024)
1008                         dh=get_dh1024();
1009                 else
1010                         dh=get_dh512();
1011                 SSL_CTX_set_tmp_dh(s_ctx,dh);
1012                 DH_free(dh);
1013                 }
1014 #else
1015         (void)no_dhe;
1016 #endif
1017
1018 #ifndef OPENSSL_NO_ECDH
1019         if (!no_ecdhe)
1020                 {
1021                 int nid;
1022
1023                 if (named_curve != NULL)
1024                         {
1025                         nid = OBJ_sn2nid(named_curve);
1026                         if (nid == 0)
1027                         {
1028                                 BIO_printf(bio_err, "unknown curve name (%s)\n", named_curve);
1029                                 goto end;
1030                                 }
1031                         }
1032                 else
1033 #ifdef OPENSSL_NO_EC2M
1034                         nid = NID_X9_62_prime256v1;
1035 #else
1036                         nid = NID_sect163r2;
1037 #endif
1038
1039                 ecdh = EC_KEY_new_by_curve_name(nid);
1040                 if (ecdh == NULL)
1041                         {
1042                         BIO_printf(bio_err, "unable to create curve\n");
1043                         goto end;
1044                         }
1045
1046                 SSL_CTX_set_tmp_ecdh(s_ctx, ecdh);
1047                 SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_ECDH_USE);
1048                 EC_KEY_free(ecdh);
1049                 }
1050 #else
1051         (void)no_ecdhe;
1052 #endif
1053
1054 #ifndef OPENSSL_NO_RSA
1055         SSL_CTX_set_tmp_rsa_callback(s_ctx,tmp_rsa_cb);
1056 #endif
1057
1058 #ifdef TLSEXT_TYPE_opaque_prf_input
1059         SSL_CTX_set_tlsext_opaque_prf_input_callback(c_ctx, opaque_prf_input_cb);
1060         SSL_CTX_set_tlsext_opaque_prf_input_callback(s_ctx, opaque_prf_input_cb);
1061         SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(c_ctx, &co1); /* or &co2 or NULL */
1062         SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(s_ctx, &so1); /* or &so2 or NULL */
1063 #endif
1064
1065         if (!SSL_CTX_use_certificate_file(s_ctx,server_cert,SSL_FILETYPE_PEM))
1066                 {
1067                 ERR_print_errors(bio_err);
1068                 }
1069         else if (!SSL_CTX_use_PrivateKey_file(s_ctx,
1070                 (server_key?server_key:server_cert), SSL_FILETYPE_PEM))
1071                 {
1072                 ERR_print_errors(bio_err);
1073                 goto end;
1074                 }
1075
1076         if (client_auth)
1077                 {
1078                 SSL_CTX_use_certificate_file(c_ctx,client_cert,
1079                         SSL_FILETYPE_PEM);
1080                 SSL_CTX_use_PrivateKey_file(c_ctx,
1081                         (client_key?client_key:client_cert),
1082                         SSL_FILETYPE_PEM);
1083                 }
1084
1085         if (    (!SSL_CTX_load_verify_locations(s_ctx,CAfile,CApath)) ||
1086                 (!SSL_CTX_set_default_verify_paths(s_ctx)) ||
1087                 (!SSL_CTX_load_verify_locations(c_ctx,CAfile,CApath)) ||
1088                 (!SSL_CTX_set_default_verify_paths(c_ctx)))
1089                 {
1090                 /* fprintf(stderr,"SSL_load_verify_locations\n"); */
1091                 ERR_print_errors(bio_err);
1092                 /* goto end; */
1093                 }
1094
1095         if (client_auth)
1096                 {
1097                 BIO_printf(bio_err,"client authentication\n");
1098                 SSL_CTX_set_verify(s_ctx,
1099                         SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
1100                         verify_callback);
1101                 SSL_CTX_set_cert_verify_callback(s_ctx, app_verify_callback, &app_verify_arg);
1102                 }
1103         if (server_auth)
1104                 {
1105                 BIO_printf(bio_err,"server authentication\n");
1106                 SSL_CTX_set_verify(c_ctx,SSL_VERIFY_PEER,
1107                         verify_callback);
1108                 SSL_CTX_set_cert_verify_callback(c_ctx, app_verify_callback, &app_verify_arg);
1109                 }
1110
1111         {
1112                 int session_id_context = 0;
1113                 SSL_CTX_set_session_id_context(s_ctx, (void *)&session_id_context, sizeof session_id_context);
1114         }
1115
1116         /* Use PSK only if PSK key is given */
1117         if (psk_key != NULL)
1118                 {
1119                 /* no_psk is used to avoid putting psk command to openssl tool */
1120                 if (no_psk)
1121                         {
1122                         /* if PSK is not compiled in and psk key is
1123                          * given, do nothing and exit successfully */
1124                         ret=0;
1125                         goto end;
1126                         }
1127 #ifndef OPENSSL_NO_PSK
1128                 SSL_CTX_set_psk_client_callback(c_ctx, psk_client_callback);
1129                 SSL_CTX_set_psk_server_callback(s_ctx, psk_server_callback);
1130                 if (debug)
1131                         BIO_printf(bio_err,"setting PSK identity hint to s_ctx\n");
1132                 if (!SSL_CTX_use_psk_identity_hint(s_ctx, "ctx server identity_hint"))
1133                         {
1134                         BIO_printf(bio_err,"error setting PSK identity hint to s_ctx\n");
1135                         ERR_print_errors(bio_err);
1136                         goto end;
1137                         }
1138 #endif
1139                 }
1140 #ifndef OPENSSL_NO_SRP
1141         if (srp_client_arg.srplogin)
1142                 {
1143                 if (!SSL_CTX_set_srp_username(c_ctx, srp_client_arg.srplogin))
1144                         {
1145                         BIO_printf(bio_err,"Unable to set SRP username\n");
1146                         goto end;
1147                         }
1148                 SSL_CTX_set_srp_cb_arg(c_ctx,&srp_client_arg);
1149                 SSL_CTX_set_srp_client_pwd_callback(c_ctx, ssl_give_srp_client_pwd_cb);
1150                 /*SSL_CTX_set_srp_strength(c_ctx, srp_client_arg.strength);*/
1151                 }
1152
1153         if (srp_server_arg.expected_user != NULL)
1154                 {
1155                 SSL_CTX_set_verify(s_ctx,SSL_VERIFY_NONE,verify_callback);
1156                 SSL_CTX_set_srp_cb_arg(s_ctx, &srp_server_arg);
1157                 SSL_CTX_set_srp_username_callback(s_ctx, ssl_srp_server_param_cb);
1158                 }
1159 #endif
1160
1161 #ifndef OPENSSL_NO_NPN
1162         if (npn_client)
1163                 {
1164                 SSL_CTX_set_next_proto_select_cb(c_ctx, cb_client_npn, NULL);
1165                 }
1166         if (npn_server)
1167                 {
1168                 if (npn_server_reject)
1169                         {
1170                         BIO_printf(bio_err, "Can't have both -npn_server and -npn_server_reject\n");
1171                         goto end;
1172                         }
1173                 SSL_CTX_set_next_protos_advertised_cb(s_ctx, cb_server_npn, NULL);
1174                 }
1175         if (npn_server_reject)
1176                 {
1177                 SSL_CTX_set_next_protos_advertised_cb(s_ctx, cb_server_rejects_npn, NULL);
1178                 }
1179 #endif
1180
1181         c_ssl=SSL_new(c_ctx);
1182         s_ssl=SSL_new(s_ctx);
1183
1184 #ifndef OPENSSL_NO_KRB5
1185         if (c_ssl  &&  c_ssl->kssl_ctx)
1186                 {
1187                 char    localhost[MAXHOSTNAMELEN+2];
1188
1189                 if (gethostname(localhost, sizeof localhost-1) == 0)
1190                         {
1191                         localhost[sizeof localhost-1]='\0';
1192                         if(strlen(localhost) == sizeof localhost-1)
1193                                 {
1194                                 BIO_printf(bio_err,"localhost name too long\n");
1195                                 goto end;
1196                                 }
1197                         kssl_ctx_setstring(c_ssl->kssl_ctx, KSSL_SERVER,
1198                                 localhost);
1199                         }
1200                 }
1201 #endif    /* OPENSSL_NO_KRB5  */
1202
1203         for (i=0; i<number; i++)
1204                 {
1205                 if (!reuse) SSL_set_session(c_ssl,NULL);
1206                 if (bio_pair)
1207                         ret=doit_biopair(s_ssl,c_ssl,bytes,&s_time,&c_time);
1208                 else
1209                         ret=doit(s_ssl,c_ssl,bytes);
1210                 }
1211
1212         if (!verbose)
1213                 {
1214                 print_details(c_ssl, "");
1215                 }
1216         if ((number > 1) || (bytes > 1L))
1217                 BIO_printf(bio_stdout, "%d handshakes of %ld bytes done\n",number,bytes);
1218         if (print_time)
1219                 {
1220 #ifdef CLOCKS_PER_SEC
1221                 /* "To determine the time in seconds, the value returned
1222                  * by the clock function should be divided by the value
1223                  * of the macro CLOCKS_PER_SEC."
1224                  *                                       -- ISO/IEC 9899 */
1225                 BIO_printf(bio_stdout, "Approximate total server time: %6.2f s\n"
1226                         "Approximate total client time: %6.2f s\n",
1227                         (double)s_time/CLOCKS_PER_SEC,
1228                         (double)c_time/CLOCKS_PER_SEC);
1229 #else
1230                 /* "`CLOCKS_PER_SEC' undeclared (first use this function)"
1231                  *                            -- cc on NeXTstep/OpenStep */
1232                 BIO_printf(bio_stdout,
1233                         "Approximate total server time: %6.2f units\n"
1234                         "Approximate total client time: %6.2f units\n",
1235                         (double)s_time,
1236                         (double)c_time);
1237 #endif
1238                 }
1239
1240         SSL_free(s_ssl);
1241         SSL_free(c_ssl);
1242
1243 end:
1244         if (s_ctx != NULL) SSL_CTX_free(s_ctx);
1245         if (c_ctx != NULL) SSL_CTX_free(c_ctx);
1246
1247         if (bio_stdout != NULL) BIO_free(bio_stdout);
1248
1249 #ifndef OPENSSL_NO_RSA
1250         free_tmp_rsa();
1251 #endif
1252 #ifndef OPENSSL_NO_ENGINE
1253         ENGINE_cleanup();
1254 #endif
1255         CRYPTO_cleanup_all_ex_data();
1256         ERR_free_strings();
1257         ERR_remove_thread_state(NULL);
1258         EVP_cleanup();
1259         CRYPTO_mem_leaks(bio_err);
1260         if (bio_err != NULL) BIO_free(bio_err);
1261         EXIT(ret);
1262         return ret;
1263         }
1264
1265 int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count,
1266         clock_t *s_time, clock_t *c_time)
1267         {
1268         long cw_num = count, cr_num = count, sw_num = count, sr_num = count;
1269         BIO *s_ssl_bio = NULL, *c_ssl_bio = NULL;
1270         BIO *server = NULL, *server_io = NULL, *client = NULL, *client_io = NULL;
1271         int ret = 1;
1272
1273         size_t bufsiz = 256; /* small buffer for testing */
1274
1275         if (!BIO_new_bio_pair(&server, bufsiz, &server_io, bufsiz))
1276                 goto err;
1277         if (!BIO_new_bio_pair(&client, bufsiz, &client_io, bufsiz))
1278                 goto err;
1279
1280         s_ssl_bio = BIO_new(BIO_f_ssl());
1281         if (!s_ssl_bio)
1282                 goto err;
1283
1284         c_ssl_bio = BIO_new(BIO_f_ssl());
1285         if (!c_ssl_bio)
1286                 goto err;
1287
1288         SSL_set_connect_state(c_ssl);
1289         SSL_set_bio(c_ssl, client, client);
1290         (void)BIO_set_ssl(c_ssl_bio, c_ssl, BIO_NOCLOSE);
1291
1292         SSL_set_accept_state(s_ssl);
1293         SSL_set_bio(s_ssl, server, server);
1294         (void)BIO_set_ssl(s_ssl_bio, s_ssl, BIO_NOCLOSE);
1295
1296         do
1297                 {
1298                 /* c_ssl_bio:          SSL filter BIO
1299                  *
1300                  * client:             pseudo-I/O for SSL library
1301                  *
1302                  * client_io:          client's SSL communication; usually to be
1303                  *                     relayed over some I/O facility, but in this
1304                  *                     test program, we're the server, too:
1305                  *
1306                  * server_io:          server's SSL communication
1307                  *
1308                  * server:             pseudo-I/O for SSL library
1309                  *
1310                  * s_ssl_bio:          SSL filter BIO
1311                  *
1312                  * The client and the server each employ a "BIO pair":
1313                  * client + client_io, server + server_io.
1314                  * BIO pairs are symmetric.  A BIO pair behaves similar
1315                  * to a non-blocking socketpair (but both endpoints must
1316                  * be handled by the same thread).
1317                  * [Here we could connect client and server to the ends
1318                  * of a single BIO pair, but then this code would be less
1319                  * suitable as an example for BIO pairs in general.]
1320                  *
1321                  * Useful functions for querying the state of BIO pair endpoints:
1322                  *
1323                  * BIO_ctrl_pending(bio)              number of bytes we can read now
1324                  * BIO_ctrl_get_read_request(bio)     number of bytes needed to fulfil
1325                  *                                      other side's read attempt
1326                  * BIO_ctrl_get_write_guarantee(bio)   number of bytes we can write now
1327                  *
1328                  * ..._read_request is never more than ..._write_guarantee;
1329                  * it depends on the application which one you should use.
1330                  */
1331
1332                 /* We have non-blocking behaviour throughout this test program, but
1333                  * can be sure that there is *some* progress in each iteration; so
1334                  * we don't have to worry about ..._SHOULD_READ or ..._SHOULD_WRITE
1335                  * -- we just try everything in each iteration
1336                  */
1337
1338                         {
1339                         /* CLIENT */
1340
1341                         MS_STATIC char cbuf[1024*8];
1342                         int i, r;
1343                         clock_t c_clock = clock();
1344
1345                         memset(cbuf, 0, sizeof(cbuf));
1346
1347                         if (debug)
1348                                 if (SSL_in_init(c_ssl))
1349                                         printf("client waiting in SSL_connect - %s\n",
1350                                                 SSL_state_string_long(c_ssl));
1351
1352                         if (cw_num > 0)
1353                                 {
1354                                 /* Write to server. */
1355
1356                                 if (cw_num > (long)sizeof cbuf)
1357                                         i = sizeof cbuf;
1358                                 else
1359                                         i = (int)cw_num;
1360                                 r = BIO_write(c_ssl_bio, cbuf, i);
1361                                 if (r < 0)
1362                                         {
1363                                         if (!BIO_should_retry(c_ssl_bio))
1364                                                 {
1365                                                 fprintf(stderr,"ERROR in CLIENT\n");
1366                                                 goto err;
1367                                                 }
1368                                         /* BIO_should_retry(...) can just be ignored here.
1369                                          * The library expects us to call BIO_write with
1370                                          * the same arguments again, and that's what we will
1371                                          * do in the next iteration. */
1372                                         }
1373                                 else if (r == 0)
1374                                         {
1375                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1376                                         goto err;
1377                                         }
1378                                 else
1379                                         {
1380                                         if (debug)
1381                                                 printf("client wrote %d\n", r);
1382                                         cw_num -= r;
1383                                         }
1384                                 }
1385
1386                         if (cr_num > 0)
1387                                 {
1388                                 /* Read from server. */
1389
1390                                 r = BIO_read(c_ssl_bio, cbuf, sizeof(cbuf));
1391                                 if (r < 0)
1392                                         {
1393                                         if (!BIO_should_retry(c_ssl_bio))
1394                                                 {
1395                                                 fprintf(stderr,"ERROR in CLIENT\n");
1396                                                 goto err;
1397                                                 }
1398                                         /* Again, "BIO_should_retry" can be ignored. */
1399                                         }
1400                                 else if (r == 0)
1401                                         {
1402                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1403                                         goto err;
1404                                         }
1405                                 else
1406                                         {
1407                                         if (debug)
1408                                                 printf("client read %d\n", r);
1409                                         cr_num -= r;
1410                                         }
1411                                 }
1412
1413                         /* c_time and s_time increments will typically be very small
1414                          * (depending on machine speed and clock tick intervals),
1415                          * but sampling over a large number of connections should
1416                          * result in fairly accurate figures.  We cannot guarantee
1417                          * a lot, however -- if each connection lasts for exactly
1418                          * one clock tick, it will be counted only for the client
1419                          * or only for the server or even not at all.
1420                          */
1421                         *c_time += (clock() - c_clock);
1422                         }
1423
1424                         {
1425                         /* SERVER */
1426
1427                         MS_STATIC char sbuf[1024*8];
1428                         int i, r;
1429                         clock_t s_clock = clock();
1430
1431                         memset(sbuf, 0, sizeof(sbuf));
1432
1433                         if (debug)
1434                                 if (SSL_in_init(s_ssl))
1435                                         printf("server waiting in SSL_accept - %s\n",
1436                                                 SSL_state_string_long(s_ssl));
1437
1438                         if (sw_num > 0)
1439                                 {
1440                                 /* Write to client. */
1441
1442                                 if (sw_num > (long)sizeof sbuf)
1443                                         i = sizeof sbuf;
1444                                 else
1445                                         i = (int)sw_num;
1446                                 r = BIO_write(s_ssl_bio, sbuf, i);
1447                                 if (r < 0)
1448                                         {
1449                                         if (!BIO_should_retry(s_ssl_bio))
1450                                                 {
1451                                                 fprintf(stderr,"ERROR in SERVER\n");
1452                                                 goto err;
1453                                                 }
1454                                         /* Ignore "BIO_should_retry". */
1455                                         }
1456                                 else if (r == 0)
1457                                         {
1458                                         fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1459                                         goto err;
1460                                         }
1461                                 else
1462                                         {
1463                                         if (debug)
1464                                                 printf("server wrote %d\n", r);
1465                                         sw_num -= r;
1466                                         }
1467                                 }
1468
1469                         if (sr_num > 0)
1470                                 {
1471                                 /* Read from client. */
1472
1473                                 r = BIO_read(s_ssl_bio, sbuf, sizeof(sbuf));
1474                                 if (r < 0)
1475                                         {
1476                                         if (!BIO_should_retry(s_ssl_bio))
1477                                                 {
1478                                                 fprintf(stderr,"ERROR in SERVER\n");
1479                                                 goto err;
1480                                                 }
1481                                         /* blah, blah */
1482                                         }
1483                                 else if (r == 0)
1484                                         {
1485                                         fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1486                                         goto err;
1487                                         }
1488                                 else
1489                                         {
1490                                         if (debug)
1491                                                 printf("server read %d\n", r);
1492                                         sr_num -= r;
1493                                         }
1494                                 }
1495
1496                         *s_time += (clock() - s_clock);
1497                         }
1498
1499                         {
1500                         /* "I/O" BETWEEN CLIENT AND SERVER. */
1501
1502                         size_t r1, r2;
1503                         BIO *io1 = server_io, *io2 = client_io;
1504                         /* we use the non-copying interface for io1
1505                          * and the standard BIO_write/BIO_read interface for io2
1506                          */
1507
1508                         static int prev_progress = 1;
1509                         int progress = 0;
1510
1511                         /* io1 to io2 */
1512                         do
1513                                 {
1514                                 size_t num;
1515                                 int r;
1516
1517                                 r1 = BIO_ctrl_pending(io1);
1518                                 r2 = BIO_ctrl_get_write_guarantee(io2);
1519
1520                                 num = r1;
1521                                 if (r2 < num)
1522                                         num = r2;
1523                                 if (num)
1524                                         {
1525                                         char *dataptr;
1526
1527                                         if (INT_MAX < num) /* yeah, right */
1528                                                 num = INT_MAX;
1529
1530                                         r = BIO_nread(io1, &dataptr, (int)num);
1531                                         assert(r > 0);
1532                                         assert(r <= (int)num);
1533                                         /* possibly r < num (non-contiguous data) */
1534                                         num = r;
1535                                         r = BIO_write(io2, dataptr, (int)num);
1536                                         if (r != (int)num) /* can't happen */
1537                                                 {
1538                                                 fprintf(stderr, "ERROR: BIO_write could not write "
1539                                                         "BIO_ctrl_get_write_guarantee() bytes");
1540                                                 goto err;
1541                                                 }
1542                                         progress = 1;
1543
1544                                         if (debug)
1545                                                 printf((io1 == client_io) ?
1546                                                         "C->S relaying: %d bytes\n" :
1547                                                         "S->C relaying: %d bytes\n",
1548                                                         (int)num);
1549                                         }
1550                                 }
1551                         while (r1 && r2);
1552
1553                         /* io2 to io1 */
1554                         {
1555                                 size_t num;
1556                                 int r;
1557
1558                                 r1 = BIO_ctrl_pending(io2);
1559                                 r2 = BIO_ctrl_get_read_request(io1);
1560                                 /* here we could use ..._get_write_guarantee instead of
1561                                  * ..._get_read_request, but by using the latter
1562                                  * we test restartability of the SSL implementation
1563                                  * more thoroughly */
1564                                 num = r1;
1565                                 if (r2 < num)
1566                                         num = r2;
1567                                 if (num)
1568                                         {
1569                                         char *dataptr;
1570
1571                                         if (INT_MAX < num)
1572                                                 num = INT_MAX;
1573
1574                                         if (num > 1)
1575                                                 --num; /* test restartability even more thoroughly */
1576
1577                                         r = BIO_nwrite0(io1, &dataptr);
1578                                         assert(r > 0);
1579                                         if (r < (int)num)
1580                                                 num = r;
1581                                         r = BIO_read(io2, dataptr, (int)num);
1582                                         if (r != (int)num) /* can't happen */
1583                                                 {
1584                                                 fprintf(stderr, "ERROR: BIO_read could not read "
1585                                                         "BIO_ctrl_pending() bytes");
1586                                                 goto err;
1587                                                 }
1588                                         progress = 1;
1589                                         r = BIO_nwrite(io1, &dataptr, (int)num);
1590                                         if (r != (int)num) /* can't happen */
1591                                                 {
1592                                                 fprintf(stderr, "ERROR: BIO_nwrite() did not accept "
1593                                                         "BIO_nwrite0() bytes");
1594                                                 goto err;
1595                                                 }
1596
1597                                         if (debug)
1598                                                 printf((io2 == client_io) ?
1599                                                         "C->S relaying: %d bytes\n" :
1600                                                         "S->C relaying: %d bytes\n",
1601                                                         (int)num);
1602                                         }
1603                         } /* no loop, BIO_ctrl_get_read_request now returns 0 anyway */
1604
1605                         if (!progress && !prev_progress)
1606                                 if (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0)
1607                                         {
1608                                         fprintf(stderr, "ERROR: got stuck\n");
1609                                         if (strcmp("SSLv2", SSL_get_version(c_ssl)) == 0)
1610                                                 {
1611                                                 fprintf(stderr, "This can happen for SSL2 because "
1612                                                         "CLIENT-FINISHED and SERVER-VERIFY are written \n"
1613                                                         "concurrently ...");
1614                                                 if (strncmp("2SCF", SSL_state_string(c_ssl), 4) == 0
1615                                                         && strncmp("2SSV", SSL_state_string(s_ssl), 4) == 0)
1616                                                         {
1617                                                         fprintf(stderr, " ok.\n");
1618                                                         goto end;
1619                                                         }
1620                                                 }
1621                                         fprintf(stderr, " ERROR.\n");
1622                                         goto err;
1623                                         }
1624                         prev_progress = progress;
1625                         }
1626                 }
1627         while (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0);
1628
1629         if (verbose)
1630                 print_details(c_ssl, "DONE via BIO pair: ");
1631 #ifndef OPENSSL_NO_NPN
1632         if (verify_npn(c_ssl, s_ssl) < 0)
1633                 {
1634                 ret = 1;
1635                 goto end;
1636                 }
1637 #endif
1638 end:
1639         ret = 0;
1640
1641  err:
1642         ERR_print_errors(bio_err);
1643
1644         if (server)
1645                 BIO_free(server);
1646         if (server_io)
1647                 BIO_free(server_io);
1648         if (client)
1649                 BIO_free(client);
1650         if (client_io)
1651                 BIO_free(client_io);
1652         if (s_ssl_bio)
1653                 BIO_free(s_ssl_bio);
1654         if (c_ssl_bio)
1655                 BIO_free(c_ssl_bio);
1656
1657         return ret;
1658         }
1659
1660
1661 #define W_READ  1
1662 #define W_WRITE 2
1663 #define C_DONE  1
1664 #define S_DONE  2
1665
1666 int doit(SSL *s_ssl, SSL *c_ssl, long count)
1667         {
1668         MS_STATIC char cbuf[1024*8],sbuf[1024*8];
1669         long cw_num=count,cr_num=count;
1670         long sw_num=count,sr_num=count;
1671         int ret=1;
1672         BIO *c_to_s=NULL;
1673         BIO *s_to_c=NULL;
1674         BIO *c_bio=NULL;
1675         BIO *s_bio=NULL;
1676         int c_r,c_w,s_r,s_w;
1677         int i,j;
1678         int done=0;
1679         int c_write,s_write;
1680         int do_server=0,do_client=0;
1681
1682         memset(cbuf,0,sizeof(cbuf));
1683         memset(sbuf,0,sizeof(sbuf));
1684
1685         c_to_s=BIO_new(BIO_s_mem());
1686         s_to_c=BIO_new(BIO_s_mem());
1687         if ((s_to_c == NULL) || (c_to_s == NULL))
1688                 {
1689                 ERR_print_errors(bio_err);
1690                 goto err;
1691                 }
1692
1693         c_bio=BIO_new(BIO_f_ssl());
1694         s_bio=BIO_new(BIO_f_ssl());
1695         if ((c_bio == NULL) || (s_bio == NULL))
1696                 {
1697                 ERR_print_errors(bio_err);
1698                 goto err;
1699                 }
1700
1701         SSL_set_connect_state(c_ssl);
1702         SSL_set_bio(c_ssl,s_to_c,c_to_s);
1703         BIO_set_ssl(c_bio,c_ssl,BIO_NOCLOSE);
1704
1705         SSL_set_accept_state(s_ssl);
1706         SSL_set_bio(s_ssl,c_to_s,s_to_c);
1707         BIO_set_ssl(s_bio,s_ssl,BIO_NOCLOSE);
1708
1709         c_r=0; s_r=1;
1710         c_w=1; s_w=0;
1711         c_write=1,s_write=0;
1712
1713         /* We can always do writes */
1714         for (;;)
1715                 {
1716                 do_server=0;
1717                 do_client=0;
1718
1719                 i=(int)BIO_pending(s_bio);
1720                 if ((i && s_r) || s_w) do_server=1;
1721
1722                 i=(int)BIO_pending(c_bio);
1723                 if ((i && c_r) || c_w) do_client=1;
1724
1725                 if (do_server && debug)
1726                         {
1727                         if (SSL_in_init(s_ssl))
1728                                 printf("server waiting in SSL_accept - %s\n",
1729                                         SSL_state_string_long(s_ssl));
1730 /*                      else if (s_write)
1731                                 printf("server:SSL_write()\n");
1732                         else
1733                                 printf("server:SSL_read()\n"); */
1734                         }
1735
1736                 if (do_client && debug)
1737                         {
1738                         if (SSL_in_init(c_ssl))
1739                                 printf("client waiting in SSL_connect - %s\n",
1740                                         SSL_state_string_long(c_ssl));
1741 /*                      else if (c_write)
1742                                 printf("client:SSL_write()\n");
1743                         else
1744                                 printf("client:SSL_read()\n"); */
1745                         }
1746
1747                 if (!do_client && !do_server)
1748                         {
1749                         fprintf(stdout,"ERROR IN STARTUP\n");
1750                         ERR_print_errors(bio_err);
1751                         break;
1752                         }
1753                 if (do_client && !(done & C_DONE))
1754                         {
1755                         if (c_write)
1756                                 {
1757                                 j = (cw_num > (long)sizeof(cbuf)) ?
1758                                         (int)sizeof(cbuf) : (int)cw_num;
1759                                 i=BIO_write(c_bio,cbuf,j);
1760                                 if (i < 0)
1761                                         {
1762                                         c_r=0;
1763                                         c_w=0;
1764                                         if (BIO_should_retry(c_bio))
1765                                                 {
1766                                                 if (BIO_should_read(c_bio))
1767                                                         c_r=1;
1768                                                 if (BIO_should_write(c_bio))
1769                                                         c_w=1;
1770                                                 }
1771                                         else
1772                                                 {
1773                                                 fprintf(stderr,"ERROR in CLIENT\n");
1774                                                 ERR_print_errors(bio_err);
1775                                                 goto err;
1776                                                 }
1777                                         }
1778                                 else if (i == 0)
1779                                         {
1780                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1781                                         goto err;
1782                                         }
1783                                 else
1784                                         {
1785                                         if (debug)
1786                                                 printf("client wrote %d\n",i);
1787                                         /* ok */
1788                                         s_r=1;
1789                                         c_write=0;
1790                                         cw_num-=i;
1791                                         }
1792                                 }
1793                         else
1794                                 {
1795                                 i=BIO_read(c_bio,cbuf,sizeof(cbuf));
1796                                 if (i < 0)
1797                                         {
1798                                         c_r=0;
1799                                         c_w=0;
1800                                         if (BIO_should_retry(c_bio))
1801                                                 {
1802                                                 if (BIO_should_read(c_bio))
1803                                                         c_r=1;
1804                                                 if (BIO_should_write(c_bio))
1805                                                         c_w=1;
1806                                                 }
1807                                         else
1808                                                 {
1809                                                 fprintf(stderr,"ERROR in CLIENT\n");
1810                                                 ERR_print_errors(bio_err);
1811                                                 goto err;
1812                                                 }
1813                                         }
1814                                 else if (i == 0)
1815                                         {
1816                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1817                                         goto err;
1818                                         }
1819                                 else
1820                                         {
1821                                         if (debug)
1822                                                 printf("client read %d\n",i);
1823                                         cr_num-=i;
1824                                         if (sw_num > 0)
1825                                                 {
1826                                                 s_write=1;
1827                                                 s_w=1;
1828                                                 }
1829                                         if (cr_num <= 0)
1830                                                 {
1831                                                 s_write=1;
1832                                                 s_w=1;
1833                                                 done=S_DONE|C_DONE;
1834                                                 }
1835                                         }
1836                                 }
1837                         }
1838
1839                 if (do_server && !(done & S_DONE))
1840                         {
1841                         if (!s_write)
1842                                 {
1843                                 i=BIO_read(s_bio,sbuf,sizeof(cbuf));
1844                                 if (i < 0)
1845                                         {
1846                                         s_r=0;
1847                                         s_w=0;
1848                                         if (BIO_should_retry(s_bio))
1849                                                 {
1850                                                 if (BIO_should_read(s_bio))
1851                                                         s_r=1;
1852                                                 if (BIO_should_write(s_bio))
1853                                                         s_w=1;
1854                                                 }
1855                                         else
1856                                                 {
1857                                                 fprintf(stderr,"ERROR in SERVER\n");
1858                                                 ERR_print_errors(bio_err);
1859                                                 goto err;
1860                                                 }
1861                                         }
1862                                 else if (i == 0)
1863                                         {
1864                                         ERR_print_errors(bio_err);
1865                                         fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_read\n");
1866                                         goto err;
1867                                         }
1868                                 else
1869                                         {
1870                                         if (debug)
1871                                                 printf("server read %d\n",i);
1872                                         sr_num-=i;
1873                                         if (cw_num > 0)
1874                                                 {
1875                                                 c_write=1;
1876                                                 c_w=1;
1877                                                 }
1878                                         if (sr_num <= 0)
1879                                                 {
1880                                                 s_write=1;
1881                                                 s_w=1;
1882                                                 c_write=0;
1883                                                 }
1884                                         }
1885                                 }
1886                         else
1887                                 {
1888                                 j = (sw_num > (long)sizeof(sbuf)) ?
1889                                         (int)sizeof(sbuf) : (int)sw_num;
1890                                 i=BIO_write(s_bio,sbuf,j);
1891                                 if (i < 0)
1892                                         {
1893                                         s_r=0;
1894                                         s_w=0;
1895                                         if (BIO_should_retry(s_bio))
1896                                                 {
1897                                                 if (BIO_should_read(s_bio))
1898                                                         s_r=1;
1899                                                 if (BIO_should_write(s_bio))
1900                                                         s_w=1;
1901                                                 }
1902                                         else
1903                                                 {
1904                                                 fprintf(stderr,"ERROR in SERVER\n");
1905                                                 ERR_print_errors(bio_err);
1906                                                 goto err;
1907                                                 }
1908                                         }
1909                                 else if (i == 0)
1910                                         {
1911                                         ERR_print_errors(bio_err);
1912                                         fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_write\n");
1913                                         goto err;
1914                                         }
1915                                 else
1916                                         {
1917                                         if (debug)
1918                                                 printf("server wrote %d\n",i);
1919                                         sw_num-=i;
1920                                         s_write=0;
1921                                         c_r=1;
1922                                         if (sw_num <= 0)
1923                                                 done|=S_DONE;
1924                                         }
1925                                 }
1926                         }
1927
1928                 if ((done & S_DONE) && (done & C_DONE)) break;
1929                 }
1930
1931         if (verbose)
1932                 print_details(c_ssl, "DONE: ");
1933 #ifndef OPENSSL_NO_NPN
1934         if (verify_npn(c_ssl, s_ssl) < 0)
1935                 {
1936                 ret = 1;
1937                 goto err;
1938                 }
1939 #endif
1940         ret=0;
1941 err:
1942         /* We have to set the BIO's to NULL otherwise they will be
1943          * OPENSSL_free()ed twice.  Once when th s_ssl is SSL_free()ed and
1944          * again when c_ssl is SSL_free()ed.
1945          * This is a hack required because s_ssl and c_ssl are sharing the same
1946          * BIO structure and SSL_set_bio() and SSL_free() automatically
1947          * BIO_free non NULL entries.
1948          * You should not normally do this or be required to do this */
1949         if (s_ssl != NULL)
1950                 {
1951                 s_ssl->rbio=NULL;
1952                 s_ssl->wbio=NULL;
1953                 }
1954         if (c_ssl != NULL)
1955                 {
1956                 c_ssl->rbio=NULL;
1957                 c_ssl->wbio=NULL;
1958                 }
1959
1960         if (c_to_s != NULL) BIO_free(c_to_s);
1961         if (s_to_c != NULL) BIO_free(s_to_c);
1962         if (c_bio != NULL) BIO_free_all(c_bio);
1963         if (s_bio != NULL) BIO_free_all(s_bio);
1964         return(ret);
1965         }
1966
1967 static int get_proxy_auth_ex_data_idx(void)
1968         {
1969         static volatile int idx = -1;
1970         if (idx < 0)
1971                 {
1972                 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
1973                 if (idx < 0)
1974                         {
1975                         idx = X509_STORE_CTX_get_ex_new_index(0,
1976                                 "SSLtest for verify callback", NULL,NULL,NULL);
1977                         }
1978                 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
1979                 }
1980         return idx;
1981         }
1982
1983 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
1984         {
1985         char *s,buf[256];
1986
1987         s=X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),buf,
1988                             sizeof buf);
1989         if (s != NULL)
1990                 {
1991                 if (ok)
1992                         fprintf(stderr,"depth=%d %s\n",
1993                                 ctx->error_depth,buf);
1994                 else
1995                         {
1996                         fprintf(stderr,"depth=%d error=%d %s\n",
1997                                 ctx->error_depth,ctx->error,buf);
1998                         }
1999                 }
2000
2001         if (ok == 0)
2002                 {
2003                 fprintf(stderr,"Error string: %s\n",
2004                         X509_verify_cert_error_string(ctx->error));
2005                 switch (ctx->error)
2006                         {
2007                 case X509_V_ERR_CERT_NOT_YET_VALID:
2008                 case X509_V_ERR_CERT_HAS_EXPIRED:
2009                 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
2010                         fprintf(stderr,"  ... ignored.\n");
2011                         ok=1;
2012                         }
2013                 }
2014
2015         if (ok == 1)
2016                 {
2017                 X509 *xs = ctx->current_cert;
2018 #if 0
2019                 X509 *xi = ctx->current_issuer;
2020 #endif
2021
2022                 if (xs->ex_flags & EXFLAG_PROXY)
2023                         {
2024                         unsigned int *letters =
2025                                 X509_STORE_CTX_get_ex_data(ctx,
2026                                         get_proxy_auth_ex_data_idx());
2027
2028                         if (letters)
2029                                 {
2030                                 int found_any = 0;
2031                                 int i;
2032                                 PROXY_CERT_INFO_EXTENSION *pci =
2033                                         X509_get_ext_d2i(xs, NID_proxyCertInfo,
2034                                                 NULL, NULL);
2035
2036                                 switch (OBJ_obj2nid(pci->proxyPolicy->policyLanguage))
2037                                         {
2038                                 case NID_Independent:
2039                                         /* Completely meaningless in this
2040                                            program, as there's no way to
2041                                            grant explicit rights to a
2042                                            specific PrC.  Basically, using
2043                                            id-ppl-Independent is the perfect
2044                                            way to grant no rights at all. */
2045                                         fprintf(stderr, "  Independent proxy certificate");
2046                                         for (i = 0; i < 26; i++)
2047                                                 letters[i] = 0;
2048                                         break;
2049                                 case NID_id_ppl_inheritAll:
2050                                         /* This is basically a NOP, we
2051                                            simply let the current rights
2052                                            stand as they are. */
2053                                         fprintf(stderr, "  Proxy certificate inherits all");
2054                                         break;
2055                                 default:
2056                                         s = (char *)
2057                                                 pci->proxyPolicy->policy->data;
2058                                         i = pci->proxyPolicy->policy->length;
2059
2060                                         /* The algorithm works as follows:
2061                                            it is assumed that previous
2062                                            iterations or the initial granted
2063                                            rights has already set some elements
2064                                            of `letters'.  What we need to do is
2065                                            to clear those that weren't granted
2066                                            by the current PrC as well.  The
2067                                            easiest way to do this is to add 1
2068                                            to all the elements whose letters
2069                                            are given with the current policy.
2070                                            That way, all elements that are set
2071                                            by the current policy and were
2072                                            already set by earlier policies and
2073                                            through the original grant of rights
2074                                            will get the value 2 or higher.
2075                                            The last thing to do is to sweep
2076                                            through `letters' and keep the
2077                                            elements having the value 2 as set,
2078                                            and clear all the others. */
2079
2080                                         fprintf(stderr, "  Certificate proxy rights = %*.*s", i, i, s);
2081                                         while(i-- > 0)
2082                                                 {
2083                                                 int c = *s++;
2084                                                 if (isascii(c) && isalpha(c))
2085                                                         {
2086                                                         if (islower(c))
2087                                                                 c = toupper(c);
2088                                                         letters[c - 'A']++;
2089                                                         }
2090                                                 }
2091                                         for (i = 0; i < 26; i++)
2092                                                 if (letters[i] < 2)
2093                                                         letters[i] = 0;
2094                                                 else
2095                                                         letters[i] = 1;
2096                                         }
2097
2098                                 found_any = 0;
2099                                 fprintf(stderr,
2100                                         ", resulting proxy rights = ");
2101                                 for(i = 0; i < 26; i++)
2102                                         if (letters[i])
2103                                                 {
2104                                                 fprintf(stderr, "%c", i + 'A');
2105                                                 found_any = 1;
2106                                                 }
2107                                 if (!found_any)
2108                                         fprintf(stderr, "none");
2109                                 fprintf(stderr, "\n");
2110
2111                                 PROXY_CERT_INFO_EXTENSION_free(pci);
2112                                 }
2113                         }
2114                 }
2115
2116         return(ok);
2117         }
2118
2119 static void process_proxy_debug(int indent, const char *format, ...)
2120         {
2121         static const char indentation[] =
2122                 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"
2123                 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"; /* That's 80 > */
2124         char my_format[256];
2125         va_list args;
2126
2127         BIO_snprintf(my_format, sizeof(my_format), "%*.*s %s",
2128                 indent, indent, indentation, format);
2129
2130         va_start(args, format);
2131         vfprintf(stderr, my_format, args);
2132         va_end(args);
2133         }
2134 /* Priority levels:
2135    0    [!]var, ()
2136    1    & ^
2137    2    |
2138 */
2139 static int process_proxy_cond_adders(unsigned int letters[26],
2140         const char *cond, const char **cond_end, int *pos, int indent);
2141 static int process_proxy_cond_val(unsigned int letters[26],
2142         const char *cond, const char **cond_end, int *pos, int indent)
2143         {
2144         int c;
2145         int ok = 1;
2146         int negate = 0;
2147
2148         while(isspace((int)*cond))
2149                 {
2150                 cond++; (*pos)++;
2151                 }
2152         c = *cond;
2153
2154         if (debug)
2155                 process_proxy_debug(indent,
2156                         "Start process_proxy_cond_val at position %d: %s\n",
2157                         *pos, cond);
2158
2159         while(c == '!')
2160                 {
2161                 negate = !negate;
2162                 cond++; (*pos)++;
2163                 while(isspace((int)*cond))
2164                         {
2165                         cond++; (*pos)++;
2166                         }
2167                 c = *cond;
2168                 }
2169
2170         if (c == '(')
2171                 {
2172                 cond++; (*pos)++;
2173                 ok = process_proxy_cond_adders(letters, cond, cond_end, pos,
2174                         indent + 1);
2175                 cond = *cond_end;
2176                 if (ok < 0)
2177                         goto end;
2178                 while(isspace((int)*cond))
2179                         {
2180                         cond++; (*pos)++;
2181                         }
2182                 c = *cond;
2183                 if (c != ')')
2184                         {
2185                         fprintf(stderr,
2186                                 "Weird condition character in position %d: "
2187                                 "%c\n", *pos, c);
2188                         ok = -1;
2189                         goto end;
2190                         }
2191                 cond++; (*pos)++;
2192                 }
2193         else if (isascii(c) && isalpha(c))
2194                 {
2195                 if (islower(c))
2196                         c = toupper(c);
2197                 ok = letters[c - 'A'];
2198                 cond++; (*pos)++;
2199                 }
2200         else
2201                 {
2202                 fprintf(stderr,
2203                         "Weird condition character in position %d: "
2204                         "%c\n", *pos, c);
2205                 ok = -1;
2206                 goto end;
2207                 }
2208  end:
2209         *cond_end = cond;
2210         if (ok >= 0 && negate)
2211                 ok = !ok;
2212
2213         if (debug)
2214                 process_proxy_debug(indent,
2215                         "End process_proxy_cond_val at position %d: %s, returning %d\n",
2216                         *pos, cond, ok);
2217
2218         return ok;
2219         }
2220 static int process_proxy_cond_multipliers(unsigned int letters[26],
2221         const char *cond, const char **cond_end, int *pos, int indent)
2222         {
2223         int ok;
2224         char c;
2225
2226         if (debug)
2227                 process_proxy_debug(indent,
2228                         "Start process_proxy_cond_multipliers at position %d: %s\n",
2229                         *pos, cond);
2230
2231         ok = process_proxy_cond_val(letters, cond, cond_end, pos, indent + 1);
2232         cond = *cond_end;
2233         if (ok < 0)
2234                 goto end;
2235
2236         while(ok >= 0)
2237                 {
2238                 while(isspace((int)*cond))
2239                         {
2240                         cond++; (*pos)++;
2241                         }
2242                 c = *cond;
2243
2244                 switch(c)
2245                         {
2246                 case '&':
2247                 case '^':
2248                         {
2249                         int save_ok = ok;
2250
2251                         cond++; (*pos)++;
2252                         ok = process_proxy_cond_val(letters,
2253                                 cond, cond_end, pos, indent + 1);
2254                         cond = *cond_end;
2255                         if (ok < 0)
2256                                 break;
2257
2258                         switch(c)
2259                                 {
2260                         case '&':
2261                                 ok &= save_ok;
2262                                 break;
2263                         case '^':
2264                                 ok ^= save_ok;
2265                                 break;
2266                         default:
2267                                 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
2268                                         " STOPPING\n");
2269                                 EXIT(1);
2270                                 }
2271                         }
2272                         break;
2273                 default:
2274                         goto end;
2275                         }
2276                 }
2277  end:
2278         if (debug)
2279                 process_proxy_debug(indent,
2280                         "End process_proxy_cond_multipliers at position %d: %s, returning %d\n",
2281                         *pos, cond, ok);
2282
2283         *cond_end = cond;
2284         return ok;
2285         }
2286 static int process_proxy_cond_adders(unsigned int letters[26],
2287         const char *cond, const char **cond_end, int *pos, int indent)
2288         {
2289         int ok;
2290         char c;
2291
2292         if (debug)
2293                 process_proxy_debug(indent,
2294                         "Start process_proxy_cond_adders at position %d: %s\n",
2295                         *pos, cond);
2296
2297         ok = process_proxy_cond_multipliers(letters, cond, cond_end, pos,
2298                 indent + 1);
2299         cond = *cond_end;
2300         if (ok < 0)
2301                 goto end;
2302
2303         while(ok >= 0)
2304                 {
2305                 while(isspace((int)*cond))
2306                         {
2307                         cond++; (*pos)++;
2308                         }
2309                 c = *cond;
2310
2311                 switch(c)
2312                         {
2313                 case '|':
2314                         {
2315                         int save_ok = ok;
2316
2317                         cond++; (*pos)++;
2318                         ok = process_proxy_cond_multipliers(letters,
2319                                 cond, cond_end, pos, indent + 1);
2320                         cond = *cond_end;
2321                         if (ok < 0)
2322                                 break;
2323
2324                         switch(c)
2325                                 {
2326                         case '|':
2327                                 ok |= save_ok;
2328                                 break;
2329                         default:
2330                                 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
2331                                         " STOPPING\n");
2332                                 EXIT(1);
2333                                 }
2334                         }
2335                         break;
2336                 default:
2337                         goto end;
2338                         }
2339                 }
2340  end:
2341         if (debug)
2342                 process_proxy_debug(indent,
2343                         "End process_proxy_cond_adders at position %d: %s, returning %d\n",
2344                         *pos, cond, ok);
2345
2346         *cond_end = cond;
2347         return ok;
2348         }
2349
2350 static int process_proxy_cond(unsigned int letters[26],
2351         const char *cond, const char **cond_end)
2352         {
2353         int pos = 1;
2354         return process_proxy_cond_adders(letters, cond, cond_end, &pos, 1);
2355         }
2356
2357 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg)
2358         {
2359         int ok=1;
2360         struct app_verify_arg *cb_arg = arg;
2361         unsigned int letters[26]; /* only used with proxy_auth */
2362
2363         if (cb_arg->app_verify)
2364                 {
2365                 char *s = NULL,buf[256];
2366
2367                 fprintf(stderr, "In app_verify_callback, allowing cert. ");
2368                 fprintf(stderr, "Arg is: %s\n", cb_arg->string);
2369                 fprintf(stderr, "Finished printing do we have a context? 0x%p a cert? 0x%p\n",
2370                         (void *)ctx, (void *)ctx->cert);
2371                 if (ctx->cert)
2372                         s=X509_NAME_oneline(X509_get_subject_name(ctx->cert),buf,256);
2373                 if (s != NULL)
2374                         {
2375                         fprintf(stderr,"cert depth=%d %s\n",ctx->error_depth,buf);
2376                         }
2377                 return(1);
2378                 }
2379         if (cb_arg->proxy_auth)
2380                 {
2381                 int found_any = 0, i;
2382                 char *sp;
2383
2384                 for(i = 0; i < 26; i++)
2385                         letters[i] = 0;
2386                 for(sp = cb_arg->proxy_auth; *sp; sp++)
2387                         {
2388                         int c = *sp;
2389                         if (isascii(c) && isalpha(c))
2390                                 {
2391                                 if (islower(c))
2392                                         c = toupper(c);
2393                                 letters[c - 'A'] = 1;
2394                                 }
2395                         }
2396
2397                 fprintf(stderr,
2398                         "  Initial proxy rights = ");
2399                 for(i = 0; i < 26; i++)
2400                         if (letters[i])
2401                                 {
2402                                 fprintf(stderr, "%c", i + 'A');
2403                                 found_any = 1;
2404                                 }
2405                 if (!found_any)
2406                         fprintf(stderr, "none");
2407                 fprintf(stderr, "\n");
2408
2409                 X509_STORE_CTX_set_ex_data(ctx,
2410                         get_proxy_auth_ex_data_idx(),letters);
2411                 }
2412         if (cb_arg->allow_proxy_certs)
2413                 {
2414                 X509_STORE_CTX_set_flags(ctx, X509_V_FLAG_ALLOW_PROXY_CERTS);
2415                 }
2416
2417 #ifndef OPENSSL_NO_X509_VERIFY
2418         ok = X509_verify_cert(ctx);
2419 #endif
2420
2421         if (cb_arg->proxy_auth)
2422                 {
2423                 if (ok > 0)
2424                         {
2425                         const char *cond_end = NULL;
2426
2427                         ok = process_proxy_cond(letters,
2428                                 cb_arg->proxy_cond, &cond_end);
2429
2430                         if (ok < 0)
2431                                 EXIT(3);
2432                         if (*cond_end)
2433                                 {
2434                                 fprintf(stderr, "Stopped processing condition before it's end.\n");
2435                                 ok = 0;
2436                                 }
2437                         if (!ok)
2438                                 fprintf(stderr, "Proxy rights check with condition '%s' proved invalid\n",
2439                                         cb_arg->proxy_cond);
2440                         else
2441                                 fprintf(stderr, "Proxy rights check with condition '%s' proved valid\n",
2442                                         cb_arg->proxy_cond);
2443                         }
2444                 }
2445         return(ok);
2446         }
2447
2448 #ifndef OPENSSL_NO_RSA
2449 static RSA *rsa_tmp=NULL;
2450
2451 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength)
2452         {
2453         BIGNUM *bn = NULL;
2454         if (rsa_tmp == NULL)
2455                 {
2456                 bn = BN_new();
2457                 rsa_tmp = RSA_new();
2458                 if(!bn || !rsa_tmp || !BN_set_word(bn, RSA_F4))
2459                         {
2460                         BIO_printf(bio_err, "Memory error...");
2461                         goto end;
2462                         }
2463                 BIO_printf(bio_err,"Generating temp (%d bit) RSA key...",keylength);
2464                 (void)BIO_flush(bio_err);
2465                 if(!RSA_generate_key_ex(rsa_tmp,keylength,bn,NULL))
2466                         {
2467                         BIO_printf(bio_err, "Error generating key.");
2468                         RSA_free(rsa_tmp);
2469                         rsa_tmp = NULL;
2470                         }
2471 end:
2472                 BIO_printf(bio_err,"\n");
2473                 (void)BIO_flush(bio_err);
2474                 }
2475         if(bn) BN_free(bn);
2476         return(rsa_tmp);
2477         }
2478
2479 static void free_tmp_rsa(void)
2480         {
2481         if (rsa_tmp != NULL)
2482                 {
2483                 RSA_free(rsa_tmp);
2484                 rsa_tmp = NULL;
2485                 }
2486         }
2487 #endif
2488
2489 #ifndef OPENSSL_NO_DH
2490 /* These DH parameters have been generated as follows:
2491  *    $ openssl dhparam -C -noout 512
2492  *    $ openssl dhparam -C -noout 1024
2493  *    $ openssl dhparam -C -noout -dsaparam 1024
2494  * (The third function has been renamed to avoid name conflicts.)
2495  */
2496 static DH *get_dh512()
2497         {
2498         static unsigned char dh512_p[]={
2499                 0xCB,0xC8,0xE1,0x86,0xD0,0x1F,0x94,0x17,0xA6,0x99,0xF0,0xC6,
2500                 0x1F,0x0D,0xAC,0xB6,0x25,0x3E,0x06,0x39,0xCA,0x72,0x04,0xB0,
2501                 0x6E,0xDA,0xC0,0x61,0xE6,0x7A,0x77,0x25,0xE8,0x3B,0xB9,0x5F,
2502                 0x9A,0xB6,0xB5,0xFE,0x99,0x0B,0xA1,0x93,0x4E,0x35,0x33,0xB8,
2503                 0xE1,0xF1,0x13,0x4F,0x59,0x1A,0xD2,0x57,0xC0,0x26,0x21,0x33,
2504                 0x02,0xC5,0xAE,0x23,
2505                 };
2506         static unsigned char dh512_g[]={
2507                 0x02,
2508                 };
2509         DH *dh;
2510
2511         if ((dh=DH_new()) == NULL) return(NULL);
2512         dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
2513         dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
2514         if ((dh->p == NULL) || (dh->g == NULL))
2515                 { DH_free(dh); return(NULL); }
2516         return(dh);
2517         }
2518
2519 static DH *get_dh1024()
2520         {
2521         static unsigned char dh1024_p[]={
2522                 0xF8,0x81,0x89,0x7D,0x14,0x24,0xC5,0xD1,0xE6,0xF7,0xBF,0x3A,
2523                 0xE4,0x90,0xF4,0xFC,0x73,0xFB,0x34,0xB5,0xFA,0x4C,0x56,0xA2,
2524                 0xEA,0xA7,0xE9,0xC0,0xC0,0xCE,0x89,0xE1,0xFA,0x63,0x3F,0xB0,
2525                 0x6B,0x32,0x66,0xF1,0xD1,0x7B,0xB0,0x00,0x8F,0xCA,0x87,0xC2,
2526                 0xAE,0x98,0x89,0x26,0x17,0xC2,0x05,0xD2,0xEC,0x08,0xD0,0x8C,
2527                 0xFF,0x17,0x52,0x8C,0xC5,0x07,0x93,0x03,0xB1,0xF6,0x2F,0xB8,
2528                 0x1C,0x52,0x47,0x27,0x1B,0xDB,0xD1,0x8D,0x9D,0x69,0x1D,0x52,
2529                 0x4B,0x32,0x81,0xAA,0x7F,0x00,0xC8,0xDC,0xE6,0xD9,0xCC,0xC1,
2530                 0x11,0x2D,0x37,0x34,0x6C,0xEA,0x02,0x97,0x4B,0x0E,0xBB,0xB1,
2531                 0x71,0x33,0x09,0x15,0xFD,0xDD,0x23,0x87,0x07,0x5E,0x89,0xAB,
2532                 0x6B,0x7C,0x5F,0xEC,0xA6,0x24,0xDC,0x53,
2533                 };
2534         static unsigned char dh1024_g[]={
2535                 0x02,
2536                 };
2537         DH *dh;
2538
2539         if ((dh=DH_new()) == NULL) return(NULL);
2540         dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2541         dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2542         if ((dh->p == NULL) || (dh->g == NULL))
2543                 { DH_free(dh); return(NULL); }
2544         return(dh);
2545         }
2546
2547 static DH *get_dh1024dsa()
2548         {
2549         static unsigned char dh1024_p[]={
2550                 0xC8,0x00,0xF7,0x08,0x07,0x89,0x4D,0x90,0x53,0xF3,0xD5,0x00,
2551                 0x21,0x1B,0xF7,0x31,0xA6,0xA2,0xDA,0x23,0x9A,0xC7,0x87,0x19,
2552                 0x3B,0x47,0xB6,0x8C,0x04,0x6F,0xFF,0xC6,0x9B,0xB8,0x65,0xD2,
2553                 0xC2,0x5F,0x31,0x83,0x4A,0xA7,0x5F,0x2F,0x88,0x38,0xB6,0x55,
2554                 0xCF,0xD9,0x87,0x6D,0x6F,0x9F,0xDA,0xAC,0xA6,0x48,0xAF,0xFC,
2555                 0x33,0x84,0x37,0x5B,0x82,0x4A,0x31,0x5D,0xE7,0xBD,0x52,0x97,
2556                 0xA1,0x77,0xBF,0x10,0x9E,0x37,0xEA,0x64,0xFA,0xCA,0x28,0x8D,
2557                 0x9D,0x3B,0xD2,0x6E,0x09,0x5C,0x68,0xC7,0x45,0x90,0xFD,0xBB,
2558                 0x70,0xC9,0x3A,0xBB,0xDF,0xD4,0x21,0x0F,0xC4,0x6A,0x3C,0xF6,
2559                 0x61,0xCF,0x3F,0xD6,0x13,0xF1,0x5F,0xBC,0xCF,0xBC,0x26,0x9E,
2560                 0xBC,0x0B,0xBD,0xAB,0x5D,0xC9,0x54,0x39,
2561                 };
2562         static unsigned char dh1024_g[]={
2563                 0x3B,0x40,0x86,0xE7,0xF3,0x6C,0xDE,0x67,0x1C,0xCC,0x80,0x05,
2564                 0x5A,0xDF,0xFE,0xBD,0x20,0x27,0x74,0x6C,0x24,0xC9,0x03,0xF3,
2565                 0xE1,0x8D,0xC3,0x7D,0x98,0x27,0x40,0x08,0xB8,0x8C,0x6A,0xE9,
2566                 0xBB,0x1A,0x3A,0xD6,0x86,0x83,0x5E,0x72,0x41,0xCE,0x85,0x3C,
2567                 0xD2,0xB3,0xFC,0x13,0xCE,0x37,0x81,0x9E,0x4C,0x1C,0x7B,0x65,
2568                 0xD3,0xE6,0xA6,0x00,0xF5,0x5A,0x95,0x43,0x5E,0x81,0xCF,0x60,
2569                 0xA2,0x23,0xFC,0x36,0xA7,0x5D,0x7A,0x4C,0x06,0x91,0x6E,0xF6,
2570                 0x57,0xEE,0x36,0xCB,0x06,0xEA,0xF5,0x3D,0x95,0x49,0xCB,0xA7,
2571                 0xDD,0x81,0xDF,0x80,0x09,0x4A,0x97,0x4D,0xA8,0x22,0x72,0xA1,
2572                 0x7F,0xC4,0x70,0x56,0x70,0xE8,0x20,0x10,0x18,0x8F,0x2E,0x60,
2573                 0x07,0xE7,0x68,0x1A,0x82,0x5D,0x32,0xA2,
2574                 };
2575         DH *dh;
2576
2577         if ((dh=DH_new()) == NULL) return(NULL);
2578         dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2579         dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2580         if ((dh->p == NULL) || (dh->g == NULL))
2581                 { DH_free(dh); return(NULL); }
2582         dh->length = 160;
2583         return(dh);
2584         }
2585 #endif
2586
2587 #ifndef OPENSSL_NO_PSK
2588 /* convert the PSK key (psk_key) in ascii to binary (psk) */
2589 static int psk_key2bn(const char *pskkey, unsigned char *psk,
2590         unsigned int max_psk_len)
2591         {
2592         int ret;
2593         BIGNUM *bn = NULL;
2594
2595         ret = BN_hex2bn(&bn, pskkey);
2596         if (!ret)
2597                 {
2598                 BIO_printf(bio_err,"Could not convert PSK key '%s' to BIGNUM\n", pskkey);
2599                 if (bn)
2600                         BN_free(bn);
2601                 return 0;
2602                 }
2603         if (BN_num_bytes(bn) > (int)max_psk_len)
2604                 {
2605                 BIO_printf(bio_err,"psk buffer of callback is too small (%d) for key (%d)\n",
2606                         max_psk_len, BN_num_bytes(bn));
2607                 BN_free(bn);
2608                 return 0;
2609                 }
2610         ret = BN_bn2bin(bn, psk);
2611         BN_free(bn);
2612         return ret;
2613         }
2614
2615 static unsigned int psk_client_callback(SSL *ssl, const char *hint, char *identity,
2616         unsigned int max_identity_len, unsigned char *psk,
2617         unsigned int max_psk_len)
2618         {
2619         int ret;
2620         unsigned int psk_len = 0;
2621
2622         ret = BIO_snprintf(identity, max_identity_len, "Client_identity");
2623         if (ret < 0)
2624                 goto out_err;
2625         if (debug)
2626                 fprintf(stderr, "client: created identity '%s' len=%d\n", identity, ret);
2627         ret = psk_key2bn(psk_key, psk, max_psk_len);
2628         if (ret < 0)
2629                 goto out_err;
2630         psk_len = ret;
2631 out_err:
2632         return psk_len;
2633         }
2634
2635 static unsigned int psk_server_callback(SSL *ssl, const char *identity,
2636         unsigned char *psk, unsigned int max_psk_len)
2637         {
2638         unsigned int psk_len=0;
2639
2640         if (strcmp(identity, "Client_identity") != 0)
2641                 {
2642                 BIO_printf(bio_err, "server: PSK error: client identity not found\n");
2643                 return 0;
2644                 }
2645         psk_len=psk_key2bn(psk_key, psk, max_psk_len);
2646         return psk_len;
2647         }
2648 #endif
2649
2650 static int do_test_cipherlist(void)
2651         {
2652         int i = 0;
2653         const SSL_METHOD *meth;
2654         const SSL_CIPHER *ci, *tci = NULL;
2655
2656 #ifndef OPENSSL_NO_SSL2
2657         fprintf(stderr, "testing SSLv2 cipher list order: ");
2658         meth = SSLv2_method();
2659         while ((ci = meth->get_cipher(i++)) != NULL)
2660                 {
2661                 if (tci != NULL)
2662                         if (ci->id >= tci->id)
2663                                 {
2664                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2665                                 return 0;
2666                                 }
2667                 tci = ci;
2668                 }
2669         fprintf(stderr, "ok\n");
2670 #endif
2671 #ifndef OPENSSL_NO_SSL3
2672         fprintf(stderr, "testing SSLv3 cipher list order: ");
2673         meth = SSLv3_method();
2674         tci = NULL;
2675         while ((ci = meth->get_cipher(i++)) != NULL)
2676                 {
2677                 if (tci != NULL)
2678                         if (ci->id >= tci->id)
2679                                 {
2680                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2681                                 return 0;
2682                                 }
2683                 tci = ci;
2684                 }
2685         fprintf(stderr, "ok\n");
2686 #endif
2687 #ifndef OPENSSL_NO_TLS1
2688         fprintf(stderr, "testing TLSv1 cipher list order: ");
2689         meth = TLSv1_method();
2690         tci = NULL;
2691         while ((ci = meth->get_cipher(i++)) != NULL)
2692                 {
2693                 if (tci != NULL)
2694                         if (ci->id >= tci->id)
2695                                 {
2696                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2697                                 return 0;
2698                                 }
2699                 tci = ci;
2700                 }
2701         fprintf(stderr, "ok\n");
2702 #endif
2703
2704         return 1;
2705         }