ssl/ssltest.c

   1 /* ssl/ssltest.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111 /* ====================================================================
 112  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
 113  * ECC cipher suite support in OpenSSL originally developed by
 114  * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
 115  */
 116 /* ====================================================================
 117  * Copyright 2005 Nokia. All rights reserved.
 118  *
 119  * The portions of the attached software ("Contribution") is developed by
 120  * Nokia Corporation and is licensed pursuant to the OpenSSL open source
 121  * license.
 122  *
 123  * The Contribution, originally written by Mika Kousa and Pasi Eronen of
 124  * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
 125  * support (see RFC 4279) to OpenSSL.
 126  *
 127  * No patent licenses or other rights except those expressly stated in
 128  * the OpenSSL open source license shall be deemed granted or received
 129  * expressly, by implication, estoppel, or otherwise.
 130  *
 131  * No assurances are provided by Nokia that the Contribution does not
 132  * infringe the patent or other intellectual property rights of any third
 133  * party or that the license provides you with all the necessary rights
 134  * to make use of the Contribution.
 135  *
 136  * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
 137  * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
 138  * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
 139  * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
 140  * OTHERWISE.
 141  */
 142
 143 /* Or gethostname won't be declared properly on Linux and GNU platforms. */
 144 #define _BSD_SOURCE 1
 145
 146 #include <assert.h>
 147 #include <errno.h>
 148 #include <limits.h>
 149 #include <stdio.h>
 150 #include <stdlib.h>
 151 #include <string.h>
 152 #include <time.h>
 153
 154 #define USE_SOCKETS
 155 #include "e_os.h"
 156
 157 #ifdef OPENSSL_SYS_VMS
 158 /* Or isascii won't be declared properly on VMS (at least with DECompHP C).  */
 159 #define _XOPEN_SOURCE 500
 160 #endif
 161
 162 #include <ctype.h>
 163
 164 #include <openssl/bio.h>
 165 #include <openssl/crypto.h>
 166 #include <openssl/evp.h>
 167 #include <openssl/x509.h>
 168 #include <openssl/x509v3.h>
 169 #include <openssl/ssl.h>
 170 #ifndef OPENSSL_NO_ENGINE
 171 #include <openssl/engine.h>
 172 #endif
 173 #include <openssl/err.h>
 174 #include <openssl/rand.h>
 175 #ifndef OPENSSL_NO_RSA
 176 #include <openssl/rsa.h>
 177 #endif
 178 #ifndef OPENSSL_NO_DSA
 179 #include <openssl/dsa.h>
 180 #endif
 181 #ifndef OPENSSL_NO_DH
 182 #include <openssl/dh.h>
 183 #endif
 184 #ifndef OPENSSL_NO_SRP
 185 #include <openssl/srp.h>
 186 #endif
 187 #include <openssl/bn.h>
 188
 189 /*
 190  * Or gethostname won't be declared properly
 191  * on Compaq platforms (at least with DEC C).
 192  * Do not try to put it earlier, or IPv6 includes
 193  * get screwed...
 194 */
 195 #define _XOPEN_SOURCE_EXTENDED  1
 196
 197 #ifdef OPENSSL_SYS_WINDOWS
 198 #include <winsock.h>
 199 #else
 200 #include OPENSSL_UNISTD
 201 #endif
 202
 203 #ifdef OPENSSL_SYS_VMS
 204 #  define TEST_SERVER_CERT "SYS$DISK:[-.APPS]SERVER.PEM"
 205 #  define TEST_CLIENT_CERT "SYS$DISK:[-.APPS]CLIENT.PEM"
 206 #elif defined(OPENSSL_SYS_WINCE)
 207 #  define TEST_SERVER_CERT "\\OpenSSL\\server.pem"
 208 #  define TEST_CLIENT_CERT "\\OpenSSL\\client.pem"
 209 #elif defined(OPENSSL_SYS_NETWARE)
 210 #  define TEST_SERVER_CERT "\\openssl\\apps\\server.pem"
 211 #  define TEST_CLIENT_CERT "\\openssl\\apps\\client.pem"
 212 #else
 213 #  define TEST_SERVER_CERT "../apps/server.pem"
 214 #  define TEST_CLIENT_CERT "../apps/client.pem"
 215 #endif
 216
 217 /* There is really no standard for this, so let's assign some tentative
 218    numbers.  In any case, these numbers are only for this test */
 219 #define COMP_RLE        255
 220 #define COMP_ZLIB       1
 221
 222 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
 223 #ifndef OPENSSL_NO_RSA
 224 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export,int keylength);
 225 static void free_tmp_rsa(void);
 226 #endif
 227 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg);
 228 #define APP_CALLBACK_STRING "Test Callback Argument"
 229 struct app_verify_arg
 230         {
 231         char *string;
 232         int app_verify;
 233         int allow_proxy_certs;
 234         char *proxy_auth;
 235         char *proxy_cond;
 236         };
 237
 238 #ifndef OPENSSL_NO_DH
 239 static DH *get_dh512(void);
 240 static DH *get_dh1024(void);
 241 static DH *get_dh1024dsa(void);
 242 #endif
 243
 244
 245 static char *psk_key=NULL; /* by default PSK is not used */
 246 #ifndef OPENSSL_NO_PSK
 247 static unsigned int psk_client_callback(SSL *ssl, const char *hint, char *identity,
 248         unsigned int max_identity_len, unsigned char *psk,
 249         unsigned int max_psk_len);
 250 static unsigned int psk_server_callback(SSL *ssl, const char *identity, unsigned char *psk,
 251         unsigned int max_psk_len);
 252 #endif
 253
 254 #ifndef OPENSSL_NO_SRP
 255 /* SRP client */
 256 /* This is a context that we pass to all callbacks */
 257 typedef struct srp_client_arg_st
 258         {
 259         char *srppassin;
 260         char *srplogin;
 261         } SRP_CLIENT_ARG;
 262
 263 #define PWD_STRLEN 1024
 264
 265 static char * MS_CALLBACK ssl_give_srp_client_pwd_cb(SSL *s, void *arg)
 266         {
 267         SRP_CLIENT_ARG *srp_client_arg = (SRP_CLIENT_ARG *)arg;
 268         return BUF_strdup((char *)srp_client_arg->srppassin);
 269         }
 270
 271 /* SRP server */
 272 /* This is a context that we pass to SRP server callbacks */
 273 typedef struct srp_server_arg_st
 274         {
 275         char *expected_user;
 276         char *pass;
 277         } SRP_SERVER_ARG;
 278
 279 static int MS_CALLBACK ssl_srp_server_param_cb(SSL *s, int *ad, void *arg)
 280         {
 281         SRP_SERVER_ARG * p = (SRP_SERVER_ARG *) arg;
 282
 283         if (strcmp(p->expected_user, SSL_get_srp_username(s)) != 0)
 284                 {
 285                 fprintf(stderr, "User %s doesn't exist\n", SSL_get_srp_username(s));
 286                 return SSL3_AL_FATAL;
 287                 }
 288         if (SSL_set_srp_server_param_pw(s,p->expected_user,p->pass,"1024")<0)
 289                 {
 290                 *ad = SSL_AD_INTERNAL_ERROR;
 291                 return SSL3_AL_FATAL;
 292                 }
 293         return SSL_ERROR_NONE;
 294         }
 295 #endif
 296
 297 static BIO *bio_err=NULL;
 298 static BIO *bio_stdout=NULL;
 299
 300 static char *cipher=NULL;
 301 static int verbose=0;
 302 static int debug=0;
 303 #if 0
 304 /* Not used yet. */
 305 #ifdef FIONBIO
 306 static int s_nbio=0;
 307 #endif
 308 #endif
 309
 310 static const char rnd_seed[] = "string to make the random number generator think it has entropy";
 311
 312 int doit_biopair(SSL *s_ssl,SSL *c_ssl,long bytes,clock_t *s_time,clock_t *c_time);
 313 int doit(SSL *s_ssl,SSL *c_ssl,long bytes);
 314 static int do_test_cipherlist(void);
 315 static void sv_usage(void)
 316         {
 317         fprintf(stderr,"usage: ssltest [args ...]\n");
 318         fprintf(stderr,"\n");
 319 #ifdef OPENSSL_FIPS
 320         fprintf(stderr,"-F             - run test in FIPS mode\n");
 321 #endif
 322         fprintf(stderr," -server_auth  - check server certificate\n");
 323         fprintf(stderr," -client_auth  - do client authentication\n");
 324         fprintf(stderr," -proxy        - allow proxy certificates\n");
 325         fprintf(stderr," -proxy_auth <val> - set proxy policy rights\n");
 326         fprintf(stderr," -proxy_cond <val> - experssion to test proxy policy rights\n");
 327         fprintf(stderr," -v            - more output\n");
 328         fprintf(stderr," -d            - debug output\n");
 329         fprintf(stderr," -reuse        - use session-id reuse\n");
 330         fprintf(stderr," -num <val>    - number of connections to perform\n");
 331         fprintf(stderr," -bytes <val>  - number of bytes to swap between client/server\n");
 332 #ifndef OPENSSL_NO_DH
 333         fprintf(stderr," -dhe1024      - use 1024 bit key (safe prime) for DHE\n");
 334         fprintf(stderr," -dhe1024dsa   - use 1024 bit key (with 160-bit subprime) for DHE\n");
 335         fprintf(stderr," -no_dhe       - disable DHE\n");
 336 #endif
 337 #ifndef OPENSSL_NO_ECDH
 338         fprintf(stderr," -no_ecdhe     - disable ECDHE\n");
 339 #endif
 340 #ifndef OPENSSL_NO_PSK
 341         fprintf(stderr," -psk arg      - PSK in hex (without 0x)\n");
 342 #endif
 343 #ifndef OPENSSL_NO_SRP
 344         fprintf(stderr," -srpuser user  - SRP username to use\n");
 345         fprintf(stderr," -srppass arg   - password for 'user'\n");
 346 #endif
 347 #ifndef OPENSSL_NO_SSL2
 348         fprintf(stderr," -ssl2         - use SSLv2\n");
 349 #endif
 350 #ifndef OPENSSL_NO_SSL3_METHOD
 351         fprintf(stderr," -ssl3         - use SSLv3\n");
 352 #endif
 353 #ifndef OPENSSL_NO_TLS1
 354         fprintf(stderr," -tls1         - use TLSv1\n");
 355 #endif
 356         fprintf(stderr," -CApath arg   - PEM format directory of CA's\n");
 357         fprintf(stderr," -CAfile arg   - PEM format file of CA's\n");
 358         fprintf(stderr," -cert arg     - Server certificate file\n");
 359         fprintf(stderr," -key arg      - Server key file (default: same as -cert)\n");
 360         fprintf(stderr," -c_cert arg   - Client certificate file\n");
 361         fprintf(stderr," -c_key arg    - Client key file (default: same as -c_cert)\n");
 362         fprintf(stderr," -cipher arg   - The cipher list\n");
 363         fprintf(stderr," -bio_pair     - Use BIO pairs\n");
 364         fprintf(stderr," -f            - Test even cases that can't work\n");
 365         fprintf(stderr," -time         - measure processor time used by client and server\n");
 366         fprintf(stderr," -zlib         - use zlib compression\n");
 367         fprintf(stderr," -rle          - use rle compression\n");
 368 #ifndef OPENSSL_NO_ECDH
 369         fprintf(stderr," -named_curve arg  - Elliptic curve name to use for ephemeral ECDH keys.\n" \
 370                        "                 Use \"openssl ecparam -list_curves\" for all names\n"  \
 371                        "                 (default is sect163r2).\n");
 372 #endif
 373         fprintf(stderr," -test_cipherlist - Verifies the order of the ssl cipher lists.\n"
 374                        "                    When this option is requested, the cipherlist\n"
 375                        "                    tests are run instead of handshake tests.\n");
 376         }
 377
 378 static void print_details(SSL *c_ssl, const char *prefix)
 379         {
 380         const SSL_CIPHER *ciph;
 381         X509 *cert;
 382
 383         ciph=SSL_get_current_cipher(c_ssl);
 384         BIO_printf(bio_stdout,"%s%s, cipher %s %s",
 385                 prefix,
 386                 SSL_get_version(c_ssl),
 387                 SSL_CIPHER_get_version(ciph),
 388                 SSL_CIPHER_get_name(ciph));
 389         cert=SSL_get_peer_certificate(c_ssl);
 390         if (cert != NULL)
 391                 {
 392                 EVP_PKEY *pkey = X509_get_pubkey(cert);
 393                 if (pkey != NULL)
 394                         {
 395                         if (0)
 396                                 ;
 397 #ifndef OPENSSL_NO_RSA
 398                         else if (pkey->type == EVP_PKEY_RSA && pkey->pkey.rsa != NULL
 399                                 && pkey->pkey.rsa->n != NULL)
 400                                 {
 401                                 BIO_printf(bio_stdout, ", %d bit RSA",
 402                                         BN_num_bits(pkey->pkey.rsa->n));
 403                                 }
 404 #endif
 405 #ifndef OPENSSL_NO_DSA
 406                         else if (pkey->type == EVP_PKEY_DSA && pkey->pkey.dsa != NULL
 407                                 && pkey->pkey.dsa->p != NULL)
 408                                 {
 409                                 BIO_printf(bio_stdout, ", %d bit DSA",
 410                                         BN_num_bits(pkey->pkey.dsa->p));
 411                                 }
 412 #endif
 413                         EVP_PKEY_free(pkey);
 414                         }
 415                 X509_free(cert);
 416                 }
 417         /* The SSL API does not allow us to look at temporary RSA/DH keys,
 418          * otherwise we should print their lengths too */
 419         BIO_printf(bio_stdout,"\n");
 420         }
 421
 422 static void lock_dbg_cb(int mode, int type, const char *file, int line)
 423         {
 424         static int modes[CRYPTO_NUM_LOCKS]; /* = {0, 0, ... } */
 425         const char *errstr = NULL;
 426         int rw;
 427
 428         rw = mode & (CRYPTO_READ|CRYPTO_WRITE);
 429         if (!((rw == CRYPTO_READ) || (rw == CRYPTO_WRITE)))
 430                 {
 431                 errstr = "invalid mode";
 432                 goto err;
 433                 }
 434
 435         if (type < 0 || type >= CRYPTO_NUM_LOCKS)
 436                 {
 437                 errstr = "type out of bounds";
 438                 goto err;
 439                 }
 440
 441         if (mode & CRYPTO_LOCK)
 442                 {
 443                 if (modes[type])
 444                         {
 445                         errstr = "already locked";
 446                         /* must not happen in a single-threaded program
 447                          * (would deadlock) */
 448                         goto err;
 449                         }
 450
 451                 modes[type] = rw;
 452                 }
 453         else if (mode & CRYPTO_UNLOCK)
 454                 {
 455                 if (!modes[type])
 456                         {
 457                         errstr = "not locked";
 458                         goto err;
 459                         }
 460
 461                 if (modes[type] != rw)
 462                         {
 463                         errstr = (rw == CRYPTO_READ) ?
 464                                 "CRYPTO_r_unlock on write lock" :
 465                                 "CRYPTO_w_unlock on read lock";
 466                         }
 467
 468                 modes[type] = 0;
 469                 }
 470         else
 471                 {
 472                 errstr = "invalid mode";
 473                 goto err;
 474                 }
 475
 476  err:
 477         if (errstr)
 478                 {
 479                 /* we cannot use bio_err here */
 480                 fprintf(stderr, "openssl (lock_dbg_cb): %s (mode=%d, type=%d) at %s:%d\n",
 481                         errstr, mode, type, file, line);
 482                 }
 483         }
 484
 485 #ifdef TLSEXT_TYPE_opaque_prf_input
 486 struct cb_info_st { void *input; size_t len; int ret; };
 487 struct cb_info_st co1 = { "C", 1, 1 }; /* try to negotiate oqaque PRF input */
 488 struct cb_info_st co2 = { "C", 1, 2 }; /* insist on oqaque PRF input */
 489 struct cb_info_st so1 = { "S", 1, 1 }; /* try to negotiate oqaque PRF input */
 490 struct cb_info_st so2 = { "S", 1, 2 }; /* insist on oqaque PRF input */
 491
 492 int opaque_prf_input_cb(SSL *ssl, void *peerinput, size_t len, void *arg_)
 493         {
 494         struct cb_info_st *arg = arg_;
 495
 496         if (arg == NULL)
 497                 return 1;
 498
 499         if (!SSL_set_tlsext_opaque_prf_input(ssl, arg->input, arg->len))
 500                 return 0;
 501         return arg->ret;
 502         }
 503 #endif
 504
 505 int main(int argc, char *argv[])
 506         {
 507         char *CApath=NULL,*CAfile=NULL;
 508         int badop=0;
 509         int bio_pair=0;
 510         int force=0;
 511         int tls1=0,ssl2=0,ssl3=0,ret=1;
 512         int client_auth=0;
 513         int server_auth=0,i;
 514         struct app_verify_arg app_verify_arg =
 515                 { APP_CALLBACK_STRING, 0, 0, NULL, NULL };
 516         char *server_cert=TEST_SERVER_CERT;
 517         char *server_key=NULL;
 518         char *client_cert=TEST_CLIENT_CERT;
 519         char *client_key=NULL;
 520 #ifndef OPENSSL_NO_ECDH
 521         char *named_curve = NULL;
 522 #endif
 523         SSL_CTX *s_ctx=NULL;
 524         SSL_CTX *c_ctx=NULL;
 525         const SSL_METHOD *meth=NULL;
 526         SSL *c_ssl,*s_ssl;
 527         int number=1,reuse=0;
 528         long bytes=256L;
 529 #ifndef OPENSSL_NO_DH
 530         DH *dh;
 531         int dhe1024 = 0, dhe1024dsa = 0;
 532 #endif
 533 #ifndef OPENSSL_NO_ECDH
 534         EC_KEY *ecdh = NULL;
 535 #endif
 536 #ifndef OPENSSL_NO_SRP
 537         /* client */
 538         SRP_CLIENT_ARG srp_client_arg = {NULL,NULL};
 539         /* server */
 540         SRP_SERVER_ARG srp_server_arg = {NULL,NULL};
 541 #endif
 542         int no_dhe = 0;
 543         int no_ecdhe = 0;
 544         int no_psk = 0;
 545         int print_time = 0;
 546         clock_t s_time = 0, c_time = 0;
 547         int comp = 0;
 548 #ifndef OPENSSL_NO_COMP
 549         COMP_METHOD *cm = NULL;
 550         STACK_OF(SSL_COMP) *ssl_comp_methods = NULL;
 551 #endif
 552         int test_cipherlist = 0;
 553 #ifdef OPENSSL_FIPS
 554         int fips_mode=0;
 555 #endif
 556         int no_protocol = 0;
 557
 558         verbose = 0;
 559         debug = 0;
 560         cipher = 0;
 561
 562         bio_err=BIO_new_fp(stderr,BIO_NOCLOSE|BIO_FP_TEXT);
 563
 564         CRYPTO_set_locking_callback(lock_dbg_cb);
 565
 566         /* enable memory leak checking unless explicitly disabled */
 567         if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) && (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off"))))
 568                 {
 569                 CRYPTO_malloc_debug_init();
 570                 CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
 571                 }
 572         else
 573                 {
 574                 /* OPENSSL_DEBUG_MEMORY=off */
 575                 CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0);
 576                 }
 577         CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
 578
 579         RAND_seed(rnd_seed, sizeof rnd_seed);
 580
 581         bio_stdout=BIO_new_fp(stdout,BIO_NOCLOSE|BIO_FP_TEXT);
 582
 583         argc--;
 584         argv++;
 585
 586         while (argc >= 1)
 587                 {
 588                 if(!strcmp(*argv,"-F"))
 589                         {
 590 #ifdef OPENSSL_FIPS
 591                         fips_mode=1;
 592 #else
 593                         fprintf(stderr,"not compiled with FIPS support, so exitting without running.\n");
 594                         EXIT(0);
 595 #endif
 596                         }
 597                 else if (strcmp(*argv,"-server_auth") == 0)
 598                         server_auth=1;
 599                 else if (strcmp(*argv,"-client_auth") == 0)
 600                         client_auth=1;
 601                 else if (strcmp(*argv,"-proxy_auth") == 0)
 602                         {
 603                         if (--argc < 1) goto bad;
 604                         app_verify_arg.proxy_auth= *(++argv);
 605                         }
 606                 else if (strcmp(*argv,"-proxy_cond") == 0)
 607                         {
 608                         if (--argc < 1) goto bad;
 609                         app_verify_arg.proxy_cond= *(++argv);
 610                         }
 611                 else if (strcmp(*argv,"-v") == 0)
 612                         verbose=1;
 613                 else if (strcmp(*argv,"-d") == 0)
 614                         debug=1;
 615                 else if (strcmp(*argv,"-reuse") == 0)
 616                         reuse=1;
 617                 else if (strcmp(*argv,"-dhe1024") == 0)
 618                         {
 619 #ifndef OPENSSL_NO_DH
 620                         dhe1024=1;
 621 #else
 622                         fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
 623 #endif
 624                         }
 625                 else if (strcmp(*argv,"-dhe1024dsa") == 0)
 626                         {
 627 #ifndef OPENSSL_NO_DH
 628                         dhe1024dsa=1;
 629 #else
 630                         fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
 631 #endif
 632                         }
 633                 else if (strcmp(*argv,"-no_dhe") == 0)
 634                         no_dhe=1;
 635                 else if (strcmp(*argv,"-no_ecdhe") == 0)
 636                         no_ecdhe=1;
 637                 else if (strcmp(*argv,"-psk") == 0)
 638                         {
 639                         if (--argc < 1) goto bad;
 640                         psk_key=*(++argv);
 641 #ifndef OPENSSL_NO_PSK
 642                         if (strspn(psk_key, "abcdefABCDEF1234567890") != strlen(psk_key))
 643                                 {
 644                                 BIO_printf(bio_err,"Not a hex number '%s'\n",*argv);
 645                                 goto bad;
 646                                 }
 647 #else
 648                         no_psk=1;
 649 #endif
 650                         }
 651 #ifndef OPENSSL_NO_SRP
 652                 else if (strcmp(*argv,"-srpuser") == 0)
 653                         {
 654                         if (--argc < 1) goto bad;
 655                         srp_server_arg.expected_user = srp_client_arg.srplogin= *(++argv);
 656                         tls1=1;
 657                         }
 658                 else if (strcmp(*argv,"-srppass") == 0)
 659                         {
 660                         if (--argc < 1) goto bad;
 661                         srp_server_arg.pass = srp_client_arg.srppassin= *(++argv);
 662                         tls1=1;
 663                         }
 664 #endif
 665                 else if (strcmp(*argv,"-ssl2") == 0)
 666                         {
 667 #ifdef OPENSSL_NO_SSL2
 668                         no_protocol = 1;
 669 #endif
 670                         ssl2 = 1;
 671                         }
 672                 else if (strcmp(*argv,"-tls1") == 0)
 673                         {
 674 #ifdef OPENSSL_NO_TLS1
 675                         no_protocol = 1;
 676 #endif
 677                         tls1 = 1;
 678                         }
 679                 else if (strcmp(*argv,"-ssl3") == 0)
 680                         {
 681 #ifdef OPENSSL_NO_SSL3_METHOD
 682                         no_protocol = 1;
 683 #endif
 684                         ssl3 = 1;
 685                         }
 686                 else if (strncmp(*argv,"-num",4) == 0)
 687                         {
 688                         if (--argc < 1) goto bad;
 689                         number= atoi(*(++argv));
 690                         if (number == 0) number=1;
 691                         }
 692                 else if (strcmp(*argv,"-bytes") == 0)
 693                         {
 694                         if (--argc < 1) goto bad;
 695                         bytes= atol(*(++argv));
 696                         if (bytes == 0L) bytes=1L;
 697                         i=strlen(argv[0]);
 698                         if (argv[0][i-1] == 'k') bytes*=1024L;
 699                         if (argv[0][i-1] == 'm') bytes*=1024L*1024L;
 700                         }
 701                 else if (strcmp(*argv,"-cert") == 0)
 702                         {
 703                         if (--argc < 1) goto bad;
 704                         server_cert= *(++argv);
 705                         }
 706                 else if (strcmp(*argv,"-s_cert") == 0)
 707                         {
 708                         if (--argc < 1) goto bad;
 709                         server_cert= *(++argv);
 710                         }
 711                 else if (strcmp(*argv,"-key") == 0)
 712                         {
 713                         if (--argc < 1) goto bad;
 714                         server_key= *(++argv);
 715                         }
 716                 else if (strcmp(*argv,"-s_key") == 0)
 717                         {
 718                         if (--argc < 1) goto bad;
 719                         server_key= *(++argv);
 720                         }
 721                 else if (strcmp(*argv,"-c_cert") == 0)
 722                         {
 723                         if (--argc < 1) goto bad;
 724                         client_cert= *(++argv);
 725                         }
 726                 else if (strcmp(*argv,"-c_key") == 0)
 727                         {
 728                         if (--argc < 1) goto bad;
 729                         client_key= *(++argv);
 730                         }
 731                 else if (strcmp(*argv,"-cipher") == 0)
 732                         {
 733                         if (--argc < 1) goto bad;
 734                         cipher= *(++argv);
 735                         }
 736                 else if (strcmp(*argv,"-CApath") == 0)
 737                         {
 738                         if (--argc < 1) goto bad;
 739                         CApath= *(++argv);
 740                         }
 741                 else if (strcmp(*argv,"-CAfile") == 0)
 742                         {
 743                         if (--argc < 1) goto bad;
 744                         CAfile= *(++argv);
 745                         }
 746                 else if (strcmp(*argv,"-bio_pair") == 0)
 747                         {
 748                         bio_pair = 1;
 749                         }
 750                 else if (strcmp(*argv,"-f") == 0)
 751                         {
 752                         force = 1;
 753                         }
 754                 else if (strcmp(*argv,"-time") == 0)
 755                         {
 756                         print_time = 1;
 757                         }
 758                 else if (strcmp(*argv,"-zlib") == 0)
 759                         {
 760                         comp = COMP_ZLIB;
 761                         }
 762                 else if (strcmp(*argv,"-rle") == 0)
 763                         {
 764                         comp = COMP_RLE;
 765                         }
 766                 else if (strcmp(*argv,"-named_curve") == 0)
 767                         {
 768                         if (--argc < 1) goto bad;
 769 #ifndef OPENSSL_NO_ECDH
 770                         named_curve = *(++argv);
 771 #else
 772                         fprintf(stderr,"ignoring -named_curve, since I'm compiled without ECDH\n");
 773                         ++argv;
 774 #endif
 775                         }
 776                 else if (strcmp(*argv,"-app_verify") == 0)
 777                         {
 778                         app_verify_arg.app_verify = 1;
 779                         }
 780                 else if (strcmp(*argv,"-proxy") == 0)
 781                         {
 782                         app_verify_arg.allow_proxy_certs = 1;
 783                         }
 784                 else if (strcmp(*argv,"-test_cipherlist") == 0)
 785                         {
 786                         test_cipherlist = 1;
 787                         }
 788                 else
 789                         {
 790                         fprintf(stderr,"unknown option %s\n",*argv);
 791                         badop=1;
 792                         break;
 793                         }
 794                 argc--;
 795                 argv++;
 796                 }
 797         if (badop)
 798                 {
 799 bad:
 800                 sv_usage();
 801                 goto end;
 802                 }
 803
 804         /*
 805          * test_cipherlist prevails over protocol switch: we test the cipherlist
 806          * for all enabled protocols.
 807          */
 808         if (test_cipherlist == 1)
 809                 {
 810                 /* ensure that the cipher list are correctly sorted and exit */
 811                 fprintf(stdout, "Testing cipherlist order only. Ignoring all "
 812                         "other options.\n");
 813                 if (do_test_cipherlist() == 0)
 814                         EXIT(1);
 815                 ret = 0;
 816                 goto end;
 817                 }
 818
 819         if (ssl2 + ssl3 + tls1 > 1)
 820                 {
 821                 fprintf(stderr, "At most one of -ssl2, -ssl3, or -tls1 should "
 822                         "be requested.\n");
 823                 EXIT(1);
 824                 }
 825
 826         /*
 827          * Testing was requested for a compiled-out protocol (e.g. SSLv2).
 828          * Ideally, we would error out, but the generic test wrapper can't know
 829          * when to expect failure. So we do nothing and return success.
 830          */
 831         if (no_protocol)
 832                 {
 833                 fprintf(stderr, "Testing was requested for a disabled protocol. "
 834                         "Skipping tests.\n");
 835                 ret = 0;
 836                 goto end;
 837                 }
 838
 839         if (!ssl2 && !ssl3 && !tls1 && number > 1 && !reuse && !force)
 840                 {
 841                 fprintf(stderr, "This case cannot work.  Use -f to perform "
 842                         "the test anyway (and\n-d to see what happens), "
 843                         "or add one of -ssl2, -ssl3, -tls1, -reuse\n"
 844                         "to avoid protocol mismatch.\n");
 845                 EXIT(1);
 846                 }
 847
 848 #ifdef OPENSSL_FIPS
 849         if(fips_mode)
 850                 {
 851                 if(!FIPS_mode_set(1))
 852                         {
 853                         ERR_load_crypto_strings();
 854                         ERR_print_errors(BIO_new_fp(stderr,BIO_NOCLOSE));
 855                         EXIT(1);
 856                         }
 857                 else
 858                         fprintf(stderr,"*** IN FIPS MODE ***\n");
 859                 }
 860 #endif
 861
 862         if (print_time)
 863                 {
 864                 if (!bio_pair)
 865                         {
 866                         fprintf(stderr, "Using BIO pair (-bio_pair)\n");
 867                         bio_pair = 1;
 868                         }
 869                 if (number < 50 && !force)
 870                         fprintf(stderr, "Warning: For accurate timings, use more connections (e.g. -num 1000)\n");
 871                 }
 872
 873 /*      if (cipher == NULL) cipher=getenv("SSL_CIPHER"); */
 874
 875         SSL_library_init();
 876         SSL_load_error_strings();
 877
 878 #ifndef OPENSSL_NO_COMP
 879         if (comp == COMP_ZLIB) cm = COMP_zlib();
 880         if (comp == COMP_RLE) cm = COMP_rle();
 881         if (cm != NULL)
 882                 {
 883                 if (cm->type != NID_undef)
 884                         {
 885                         if (SSL_COMP_add_compression_method(comp, cm) != 0)
 886                                 {
 887                                 fprintf(stderr,
 888                                         "Failed to add compression method\n");
 889                                 ERR_print_errors_fp(stderr);
 890                                 }
 891                         }
 892                 else
 893                         {
 894                         fprintf(stderr,
 895                                 "Warning: %s compression not supported\n",
 896                                 (comp == COMP_RLE ? "rle" :
 897                                         (comp == COMP_ZLIB ? "zlib" :
 898                                                 "unknown")));
 899                         ERR_print_errors_fp(stderr);
 900                         }
 901                 }
 902         ssl_comp_methods = SSL_COMP_get_compression_methods();
 903         fprintf(stderr, "Available compression methods:\n");
 904         {
 905         int j, n = sk_SSL_COMP_num(ssl_comp_methods);
 906         if (n == 0)
 907                 fprintf(stderr, "  NONE\n");
 908         else
 909                 for (j = 0; j < n; j++)
 910                         {
 911                         SSL_COMP *c = sk_SSL_COMP_value(ssl_comp_methods, j);
 912                         fprintf(stderr, "  %d: %s\n", c->id, c->name);
 913                         }
 914         }
 915 #endif
 916
 917 /* At this point, ssl2/ssl3/tls1 is only set if the protocol is available.
 918  * (Otherwise we exit early.)
 919  * However the compiler doesn't know this, so we ifdef. */
 920 #ifndef OPENSSL_NO_SSL2
 921         if (ssl2)
 922                 meth=SSLv2_method();
 923         else
 924 #endif
 925 #ifndef OPENSSL_NO_SSL3
 926         if (ssl3)
 927                 meth=SSLv3_method();
 928         else
 929 #endif
 930 #ifndef OPENSSL_NO_TLS1
 931         if (tls1)
 932                 meth=TLSv1_method();
 933         else
 934 #endif
 935         meth=SSLv23_method();
 936
 937         c_ctx=SSL_CTX_new(meth);
 938         s_ctx=SSL_CTX_new(meth);
 939         if ((c_ctx == NULL) || (s_ctx == NULL))
 940                 {
 941                 ERR_print_errors(bio_err);
 942                 goto end;
 943                 }
 944
 945         if (cipher != NULL)
 946                 {
 947                 SSL_CTX_set_cipher_list(c_ctx,cipher);
 948                 SSL_CTX_set_cipher_list(s_ctx,cipher);
 949                 }
 950
 951 #ifndef OPENSSL_NO_DH
 952         if (!no_dhe)
 953                 {
 954                 if (dhe1024dsa)
 955                         {
 956                         /* use SSL_OP_SINGLE_DH_USE to avoid small subgroup attacks */
 957                         SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
 958                         dh=get_dh1024dsa();
 959                         }
 960                 else if (dhe1024)
 961                         dh=get_dh1024();
 962                 else
 963                         dh=get_dh512();
 964                 SSL_CTX_set_tmp_dh(s_ctx,dh);
 965                 DH_free(dh);
 966                 }
 967 #else
 968         (void)no_dhe;
 969 #endif
 970
 971 #ifndef OPENSSL_NO_ECDH
 972         if (!no_ecdhe)
 973                 {
 974                 int nid;
 975
 976                 if (named_curve != NULL)
 977                         {
 978                         nid = OBJ_sn2nid(named_curve);
 979                         if (nid == 0)
 980                         {
 981                                 BIO_printf(bio_err, "unknown curve name (%s)\n", named_curve);
 982                                 goto end;
 983                                 }
 984                         }
 985                 else
 986 #ifdef OPENSSL_NO_EC2M
 987                         nid = NID_X9_62_prime256v1;
 988 #else
 989                         nid = NID_sect163r2;
 990 #endif
 991
 992                 ecdh = EC_KEY_new_by_curve_name(nid);
 993                 if (ecdh == NULL)
 994                         {
 995                         BIO_printf(bio_err, "unable to create curve\n");
 996                         goto end;
 997                         }
 998
 999                 SSL_CTX_set_tmp_ecdh(s_ctx, ecdh);
1000                 SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_ECDH_USE);
1001                 EC_KEY_free(ecdh);
1002                 }
1003 #else
1004         (void)no_ecdhe;
1005 #endif
1006
1007 #ifndef OPENSSL_NO_RSA
1008         SSL_CTX_set_tmp_rsa_callback(s_ctx,tmp_rsa_cb);
1009 #endif
1010
1011 #ifdef TLSEXT_TYPE_opaque_prf_input
1012         SSL_CTX_set_tlsext_opaque_prf_input_callback(c_ctx, opaque_prf_input_cb);
1013         SSL_CTX_set_tlsext_opaque_prf_input_callback(s_ctx, opaque_prf_input_cb);
1014         /* or &co2 or NULL */
1015         SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(c_ctx, &co1);
1016         /* or &so2 or NULL */
1017         SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(s_ctx, &so1);
1018 #endif
1019
1020         if (!SSL_CTX_use_certificate_file(s_ctx,server_cert,SSL_FILETYPE_PEM))
1021                 {
1022                 ERR_print_errors(bio_err);
1023                 }
1024         else if (!SSL_CTX_use_PrivateKey_file(s_ctx,
1025                 (server_key?server_key:server_cert), SSL_FILETYPE_PEM))
1026                 {
1027                 ERR_print_errors(bio_err);
1028                 goto end;
1029                 }
1030
1031         if (client_auth)
1032                 {
1033                 SSL_CTX_use_certificate_file(c_ctx,client_cert,
1034                         SSL_FILETYPE_PEM);
1035                 SSL_CTX_use_PrivateKey_file(c_ctx,
1036                         (client_key?client_key:client_cert),
1037                         SSL_FILETYPE_PEM);
1038                 }
1039
1040         if (    (!SSL_CTX_load_verify_locations(s_ctx,CAfile,CApath)) ||
1041                 (!SSL_CTX_set_default_verify_paths(s_ctx)) ||
1042                 (!SSL_CTX_load_verify_locations(c_ctx,CAfile,CApath)) ||
1043                 (!SSL_CTX_set_default_verify_paths(c_ctx)))
1044                 {
1045                 /* fprintf(stderr,"SSL_load_verify_locations\n"); */
1046                 ERR_print_errors(bio_err);
1047                 /* goto end; */
1048                 }
1049
1050         if (client_auth)
1051                 {
1052                 BIO_printf(bio_err,"client authentication\n");
1053                 SSL_CTX_set_verify(s_ctx,
1054                         SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
1055                         verify_callback);
1056                 SSL_CTX_set_cert_verify_callback(s_ctx, app_verify_callback, &app_verify_arg);
1057                 }
1058         if (server_auth)
1059                 {
1060                 BIO_printf(bio_err,"server authentication\n");
1061                 SSL_CTX_set_verify(c_ctx,SSL_VERIFY_PEER,
1062                         verify_callback);
1063                 SSL_CTX_set_cert_verify_callback(c_ctx, app_verify_callback, &app_verify_arg);
1064                 }
1065
1066         {
1067                 int session_id_context = 0;
1068                 SSL_CTX_set_session_id_context(s_ctx, (void *)&session_id_context, sizeof session_id_context);
1069         }
1070
1071         /* Use PSK only if PSK key is given */
1072         if (psk_key != NULL)
1073                 {
1074                 /* no_psk is used to avoid putting psk command to openssl tool */
1075                 if (no_psk)
1076                         {
1077                         /* if PSK is not compiled in and psk key is
1078                          * given, do nothing and exit successfully */
1079                         ret=0;
1080                         goto end;
1081                         }
1082 #ifndef OPENSSL_NO_PSK
1083                 SSL_CTX_set_psk_client_callback(c_ctx, psk_client_callback);
1084                 SSL_CTX_set_psk_server_callback(s_ctx, psk_server_callback);
1085                 if (debug)
1086                         BIO_printf(bio_err,"setting PSK identity hint to s_ctx\n");
1087                 if (!SSL_CTX_use_psk_identity_hint(s_ctx, "ctx server identity_hint"))
1088                         {
1089                         BIO_printf(bio_err,"error setting PSK identity hint to s_ctx\n");
1090                         ERR_print_errors(bio_err);
1091                         goto end;
1092                         }
1093 #endif
1094                 }
1095 #ifndef OPENSSL_NO_SRP
1096         if (srp_client_arg.srplogin)
1097                 {
1098                 if (!SSL_CTX_set_srp_username(c_ctx, srp_client_arg.srplogin))
1099                         {
1100                         BIO_printf(bio_err,"Unable to set SRP username\n");
1101                         goto end;
1102                         }
1103                 SSL_CTX_set_srp_cb_arg(c_ctx,&srp_client_arg);
1104                 SSL_CTX_set_srp_client_pwd_callback(c_ctx, ssl_give_srp_client_pwd_cb);
1105                 /*SSL_CTX_set_srp_strength(c_ctx, srp_client_arg.strength);*/
1106                 }
1107
1108         if (srp_server_arg.expected_user != NULL)
1109                 {
1110                 SSL_CTX_set_verify(s_ctx,SSL_VERIFY_NONE,verify_callback);
1111                 SSL_CTX_set_srp_cb_arg(s_ctx, &srp_server_arg);
1112                 SSL_CTX_set_srp_username_callback(s_ctx, ssl_srp_server_param_cb);
1113                 }
1114 #endif
1115
1116         c_ssl=SSL_new(c_ctx);
1117         s_ssl=SSL_new(s_ctx);
1118
1119 #ifndef OPENSSL_NO_KRB5
1120         if (c_ssl  &&  c_ssl->kssl_ctx)
1121                 {
1122                 char    localhost[MAXHOSTNAMELEN+2];
1123
1124                 if (gethostname(localhost, sizeof localhost-1) == 0)
1125                         {
1126                         localhost[sizeof localhost-1]='\0';
1127                         if(strlen(localhost) == sizeof localhost-1)
1128                                 {
1129                                 BIO_printf(bio_err,"localhost name too long\n");
1130                                 goto end;
1131                                 }
1132                         kssl_ctx_setstring(c_ssl->kssl_ctx, KSSL_SERVER,
1133                                 localhost);
1134                         }
1135                 }
1136 #endif    /* OPENSSL_NO_KRB5  */
1137
1138         for (i=0; i<number; i++)
1139                 {
1140                 if (!reuse) SSL_set_session(c_ssl,NULL);
1141                 if (bio_pair)
1142                         ret=doit_biopair(s_ssl,c_ssl,bytes,&s_time,&c_time);
1143                 else
1144                         ret=doit(s_ssl,c_ssl,bytes);
1145                 }
1146
1147         if (!verbose)
1148                 {
1149                 print_details(c_ssl, "");
1150                 }
1151         if ((number > 1) || (bytes > 1L))
1152                 BIO_printf(bio_stdout, "%d handshakes of %ld bytes done\n",number,bytes);
1153         if (print_time)
1154                 {
1155 #ifdef CLOCKS_PER_SEC
1156                 /* "To determine the time in seconds, the value returned
1157                  * by the clock function should be divided by the value
1158                  * of the macro CLOCKS_PER_SEC."
1159                  *                                       -- ISO/IEC 9899 */
1160                 BIO_printf(bio_stdout, "Approximate total server time: %6.2f s\n"
1161                         "Approximate total client time: %6.2f s\n",
1162                         (double)s_time/CLOCKS_PER_SEC,
1163                         (double)c_time/CLOCKS_PER_SEC);
1164 #else
1165                 /* "`CLOCKS_PER_SEC' undeclared (first use this function)"
1166                  *                            -- cc on NeXTstep/OpenStep */
1167                 BIO_printf(bio_stdout,
1168                         "Approximate total server time: %6.2f units\n"
1169                         "Approximate total client time: %6.2f units\n",
1170                         (double)s_time,
1171                         (double)c_time);
1172 #endif
1173                 }
1174
1175         SSL_free(s_ssl);
1176         SSL_free(c_ssl);
1177
1178 end:
1179         if (s_ctx != NULL) SSL_CTX_free(s_ctx);
1180         if (c_ctx != NULL) SSL_CTX_free(c_ctx);
1181
1182         if (bio_stdout != NULL) BIO_free(bio_stdout);
1183
1184 #ifndef OPENSSL_NO_RSA
1185         free_tmp_rsa();
1186 #endif
1187 #ifndef OPENSSL_NO_ENGINE
1188         ENGINE_cleanup();
1189 #endif
1190         CRYPTO_cleanup_all_ex_data();
1191         ERR_free_strings();
1192         ERR_remove_thread_state(NULL);
1193         EVP_cleanup();
1194         CRYPTO_mem_leaks(bio_err);
1195         if (bio_err != NULL) BIO_free(bio_err);
1196         EXIT(ret);
1197         return ret;
1198         }
1199
1200 int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count,
1201         clock_t *s_time, clock_t *c_time)
1202         {
1203         long cw_num = count, cr_num = count, sw_num = count, sr_num = count;
1204         BIO *s_ssl_bio = NULL, *c_ssl_bio = NULL;
1205         BIO *server = NULL, *server_io = NULL, *client = NULL, *client_io = NULL;
1206         int ret = 1;
1207
1208         size_t bufsiz = 256; /* small buffer for testing */
1209
1210         if (!BIO_new_bio_pair(&server, bufsiz, &server_io, bufsiz))
1211                 goto err;
1212         if (!BIO_new_bio_pair(&client, bufsiz, &client_io, bufsiz))
1213                 goto err;
1214
1215         s_ssl_bio = BIO_new(BIO_f_ssl());
1216         if (!s_ssl_bio)
1217                 goto err;
1218
1219         c_ssl_bio = BIO_new(BIO_f_ssl());
1220         if (!c_ssl_bio)
1221                 goto err;
1222
1223         SSL_set_connect_state(c_ssl);
1224         SSL_set_bio(c_ssl, client, client);
1225         (void)BIO_set_ssl(c_ssl_bio, c_ssl, BIO_NOCLOSE);
1226
1227         SSL_set_accept_state(s_ssl);
1228         SSL_set_bio(s_ssl, server, server);
1229         (void)BIO_set_ssl(s_ssl_bio, s_ssl, BIO_NOCLOSE);
1230
1231         do
1232                 {
1233                 /*-
1234                  * c_ssl_bio:          SSL filter BIO
1235                  *
1236                  * client:             pseudo-I/O for SSL library
1237                  *
1238                  * client_io:          client's SSL communication; usually to be
1239                  *                     relayed over some I/O facility, but in this
1240                  *                     test program, we're the server, too:
1241                  *
1242                  * server_io:          server's SSL communication
1243                  *
1244                  * server:             pseudo-I/O for SSL library
1245                  *
1246                  * s_ssl_bio:          SSL filter BIO
1247                  *
1248                  * The client and the server each employ a "BIO pair":
1249                  * client + client_io, server + server_io.
1250                  * BIO pairs are symmetric.  A BIO pair behaves similar
1251                  * to a non-blocking socketpair (but both endpoints must
1252                  * be handled by the same thread).
1253                  * [Here we could connect client and server to the ends
1254                  * of a single BIO pair, but then this code would be less
1255                  * suitable as an example for BIO pairs in general.]
1256                  *
1257                  * Useful functions for querying the state of BIO pair endpoints:
1258                  *
1259                  * BIO_ctrl_pending(bio)              number of bytes we can read now
1260                  * BIO_ctrl_get_read_request(bio)     number of bytes needed to fulfil
1261                  *                                      other side's read attempt
1262                  * BIO_ctrl_get_write_guarantee(bio)   number of bytes we can write now
1263                  *
1264                  * ..._read_request is never more than ..._write_guarantee;
1265                  * it depends on the application which one you should use.
1266                  */
1267
1268                 /* We have non-blocking behaviour throughout this test program, but
1269                  * can be sure that there is *some* progress in each iteration; so
1270                  * we don't have to worry about ..._SHOULD_READ or ..._SHOULD_WRITE
1271                  * -- we just try everything in each iteration
1272                  */
1273
1274                         {
1275                         /* CLIENT */
1276
1277                         MS_STATIC char cbuf[1024*8];
1278                         int i, r;
1279                         clock_t c_clock = clock();
1280
1281                         memset(cbuf, 0, sizeof(cbuf));
1282
1283                         if (debug)
1284                                 if (SSL_in_init(c_ssl))
1285                                         printf("client waiting in SSL_connect - %s\n",
1286                                                 SSL_state_string_long(c_ssl));
1287
1288                         if (cw_num > 0)
1289                                 {
1290                                 /* Write to server. */
1291
1292                                 if (cw_num > (long)sizeof cbuf)
1293                                         i = sizeof cbuf;
1294                                 else
1295                                         i = (int)cw_num;
1296                                 r = BIO_write(c_ssl_bio, cbuf, i);
1297                                 if (r < 0)
1298                                         {
1299                                         if (!BIO_should_retry(c_ssl_bio))
1300                                                 {
1301                                                 fprintf(stderr,"ERROR in CLIENT\n");
1302                                                 goto err;
1303                                                 }
1304                                         /* BIO_should_retry(...) can just be ignored here.
1305                                          * The library expects us to call BIO_write with
1306                                          * the same arguments again, and that's what we will
1307                                          * do in the next iteration. */
1308                                         }
1309                                 else if (r == 0)
1310                                         {
1311                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1312                                         goto err;
1313                                         }
1314                                 else
1315                                         {
1316                                         if (debug)
1317                                                 printf("client wrote %d\n", r);
1318                                         cw_num -= r;
1319                                         }
1320                                 }
1321
1322                         if (cr_num > 0)
1323                                 {
1324                                 /* Read from server. */
1325
1326                                 r = BIO_read(c_ssl_bio, cbuf, sizeof(cbuf));
1327                                 if (r < 0)
1328                                         {
1329                                         if (!BIO_should_retry(c_ssl_bio))
1330                                                 {
1331                                                 fprintf(stderr,"ERROR in CLIENT\n");
1332                                                 goto err;
1333                                                 }
1334                                         /* Again, "BIO_should_retry" can be ignored. */
1335                                         }
1336                                 else if (r == 0)
1337                                         {
1338                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1339                                         goto err;
1340                                         }
1341                                 else
1342                                         {
1343                                         if (debug)
1344                                                 printf("client read %d\n", r);
1345                                         cr_num -= r;
1346                                         }
1347                                 }
1348
1349                         /* c_time and s_time increments will typically be very small
1350                          * (depending on machine speed and clock tick intervals),
1351                          * but sampling over a large number of connections should
1352                          * result in fairly accurate figures.  We cannot guarantee
1353                          * a lot, however -- if each connection lasts for exactly
1354                          * one clock tick, it will be counted only for the client
1355                          * or only for the server or even not at all.
1356                          */
1357                         *c_time += (clock() - c_clock);
1358                         }
1359
1360                         {
1361                         /* SERVER */
1362
1363                         MS_STATIC char sbuf[1024*8];
1364                         int i, r;
1365                         clock_t s_clock = clock();
1366
1367                         memset(sbuf, 0, sizeof(sbuf));
1368
1369                         if (debug)
1370                                 if (SSL_in_init(s_ssl))
1371                                         printf("server waiting in SSL_accept - %s\n",
1372                                                 SSL_state_string_long(s_ssl));
1373
1374                         if (sw_num > 0)
1375                                 {
1376                                 /* Write to client. */
1377
1378                                 if (sw_num > (long)sizeof sbuf)
1379                                         i = sizeof sbuf;
1380                                 else
1381                                         i = (int)sw_num;
1382                                 r = BIO_write(s_ssl_bio, sbuf, i);
1383                                 if (r < 0)
1384                                         {
1385                                         if (!BIO_should_retry(s_ssl_bio))
1386                                                 {
1387                                                 fprintf(stderr,"ERROR in SERVER\n");
1388                                                 goto err;
1389                                                 }
1390                                         /* Ignore "BIO_should_retry". */
1391                                         }
1392                                 else if (r == 0)
1393                                         {
1394                                         fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1395                                         goto err;
1396                                         }
1397                                 else
1398                                         {
1399                                         if (debug)
1400                                                 printf("server wrote %d\n", r);
1401                                         sw_num -= r;
1402                                         }
1403                                 }
1404
1405                         if (sr_num > 0)
1406                                 {
1407                                 /* Read from client. */
1408
1409                                 r = BIO_read(s_ssl_bio, sbuf, sizeof(sbuf));
1410                                 if (r < 0)
1411                                         {
1412                                         if (!BIO_should_retry(s_ssl_bio))
1413                                                 {
1414                                                 fprintf(stderr,"ERROR in SERVER\n");
1415                                                 goto err;
1416                                                 }
1417                                         /* blah, blah */
1418                                         }
1419                                 else if (r == 0)
1420                                         {
1421                                         fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1422                                         goto err;
1423                                         }
1424                                 else
1425                                         {
1426                                         if (debug)
1427                                                 printf("server read %d\n", r);
1428                                         sr_num -= r;
1429                                         }
1430                                 }
1431
1432                         *s_time += (clock() - s_clock);
1433                         }
1434
1435                         {
1436                         /* "I/O" BETWEEN CLIENT AND SERVER. */
1437
1438                         size_t r1, r2;
1439                         BIO *io1 = server_io, *io2 = client_io;
1440                         /* we use the non-copying interface for io1
1441                          * and the standard BIO_write/BIO_read interface for io2
1442                          */
1443
1444                         static int prev_progress = 1;
1445                         int progress = 0;
1446
1447                         /* io1 to io2 */
1448                         do
1449                                 {
1450                                 size_t num;
1451                                 int r;
1452
1453                                 r1 = BIO_ctrl_pending(io1);
1454                                 r2 = BIO_ctrl_get_write_guarantee(io2);
1455
1456                                 num = r1;
1457                                 if (r2 < num)
1458                                         num = r2;
1459                                 if (num)
1460                                         {
1461                                         char *dataptr;
1462
1463                                         if (INT_MAX < num) /* yeah, right */
1464                                                 num = INT_MAX;
1465
1466                                         r = BIO_nread(io1, &dataptr, (int)num);
1467                                         assert(r > 0);
1468                                         assert(r <= (int)num);
1469                                         /* possibly r < num (non-contiguous data) */
1470                                         num = r;
1471                                         r = BIO_write(io2, dataptr, (int)num);
1472                                         if (r != (int)num) /* can't happen */
1473                                                 {
1474                                                 fprintf(stderr, "ERROR: BIO_write could not write "
1475                                                         "BIO_ctrl_get_write_guarantee() bytes");
1476                                                 goto err;
1477                                                 }
1478                                         progress = 1;
1479
1480                                         if (debug)
1481                                                 printf((io1 == client_io) ?
1482                                                         "C->S relaying: %d bytes\n" :
1483                                                         "S->C relaying: %d bytes\n",
1484                                                         (int)num);
1485                                         }
1486                                 }
1487                         while (r1 && r2);
1488
1489                         /* io2 to io1 */
1490                         {
1491                                 size_t num;
1492                                 int r;
1493
1494                                 r1 = BIO_ctrl_pending(io2);
1495                                 r2 = BIO_ctrl_get_read_request(io1);
1496                                 /* here we could use ..._get_write_guarantee instead of
1497                                  * ..._get_read_request, but by using the latter
1498                                  * we test restartability of the SSL implementation
1499                                  * more thoroughly */
1500                                 num = r1;
1501                                 if (r2 < num)
1502                                         num = r2;
1503                                 if (num)
1504                                         {
1505                                         char *dataptr;
1506
1507                                         if (INT_MAX < num)
1508                                                 num = INT_MAX;
1509
1510                                         if (num > 1)
1511                                                 --num; /* test restartability even more thoroughly */
1512
1513                                         r = BIO_nwrite0(io1, &dataptr);
1514                                         assert(r > 0);
1515                                         if (r < (int)num)
1516                                                 num = r;
1517                                         r = BIO_read(io2, dataptr, (int)num);
1518                                         if (r != (int)num) /* can't happen */
1519                                                 {
1520                                                 fprintf(stderr, "ERROR: BIO_read could not read "
1521                                                         "BIO_ctrl_pending() bytes");
1522                                                 goto err;
1523                                                 }
1524                                         progress = 1;
1525                                         r = BIO_nwrite(io1, &dataptr, (int)num);
1526                                         if (r != (int)num) /* can't happen */
1527                                                 {
1528                                                 fprintf(stderr, "ERROR: BIO_nwrite() did not accept "
1529                                                         "BIO_nwrite0() bytes");
1530                                                 goto err;
1531                                                 }
1532
1533                                         if (debug)
1534                                                 printf((io2 == client_io) ?
1535                                                         "C->S relaying: %d bytes\n" :
1536                                                         "S->C relaying: %d bytes\n",
1537                                                         (int)num);
1538                                         }
1539                         } /* no loop, BIO_ctrl_get_read_request now returns 0 anyway */
1540
1541                         if (!progress && !prev_progress)
1542                                 if (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0)
1543                                         {
1544                                         fprintf(stderr, "ERROR: got stuck\n");
1545                                         if (strcmp("SSLv2", SSL_get_version(c_ssl)) == 0)
1546                                                 {
1547                                                 fprintf(stderr, "This can happen for SSL2 because "
1548                                                         "CLIENT-FINISHED and SERVER-VERIFY are written \n"
1549                                                         "concurrently ...");
1550                                                 if (strncmp("2SCF", SSL_state_string(c_ssl), 4) == 0
1551                                                         && strncmp("2SSV", SSL_state_string(s_ssl), 4) == 0)
1552                                                         {
1553                                                         fprintf(stderr, " ok.\n");
1554                                                         goto end;
1555                                                         }
1556                                                 }
1557                                         fprintf(stderr, " ERROR.\n");
1558                                         goto err;
1559                                         }
1560                         prev_progress = progress;
1561                         }
1562                 }
1563         while (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0);
1564
1565         if (verbose)
1566                 print_details(c_ssl, "DONE via BIO pair: ");
1567 end:
1568         ret = 0;
1569
1570  err:
1571         ERR_print_errors(bio_err);
1572
1573         if (server)
1574                 BIO_free(server);
1575         if (server_io)
1576                 BIO_free(server_io);
1577         if (client)
1578                 BIO_free(client);
1579         if (client_io)
1580                 BIO_free(client_io);
1581         if (s_ssl_bio)
1582                 BIO_free(s_ssl_bio);
1583         if (c_ssl_bio)
1584                 BIO_free(c_ssl_bio);
1585
1586         return ret;
1587         }
1588
1589
1590 #define W_READ  1
1591 #define W_WRITE 2
1592 #define C_DONE  1
1593 #define S_DONE  2
1594
1595 int doit(SSL *s_ssl, SSL *c_ssl, long count)
1596         {
1597         MS_STATIC char cbuf[1024*8],sbuf[1024*8];
1598         long cw_num=count,cr_num=count;
1599         long sw_num=count,sr_num=count;
1600         int ret=1;
1601         BIO *c_to_s=NULL;
1602         BIO *s_to_c=NULL;
1603         BIO *c_bio=NULL;
1604         BIO *s_bio=NULL;
1605         int c_r,c_w,s_r,s_w;
1606         int i,j;
1607         int done=0;
1608         int c_write,s_write;
1609         int do_server=0,do_client=0;
1610
1611         memset(cbuf,0,sizeof(cbuf));
1612         memset(sbuf,0,sizeof(sbuf));
1613
1614         c_to_s=BIO_new(BIO_s_mem());
1615         s_to_c=BIO_new(BIO_s_mem());
1616         if ((s_to_c == NULL) || (c_to_s == NULL))
1617                 {
1618                 ERR_print_errors(bio_err);
1619                 goto err;
1620                 }
1621
1622         c_bio=BIO_new(BIO_f_ssl());
1623         s_bio=BIO_new(BIO_f_ssl());
1624         if ((c_bio == NULL) || (s_bio == NULL))
1625                 {
1626                 ERR_print_errors(bio_err);
1627                 goto err;
1628                 }
1629
1630         SSL_set_connect_state(c_ssl);
1631         SSL_set_bio(c_ssl,s_to_c,c_to_s);
1632         BIO_set_ssl(c_bio,c_ssl,BIO_NOCLOSE);
1633
1634         SSL_set_accept_state(s_ssl);
1635         SSL_set_bio(s_ssl,c_to_s,s_to_c);
1636         BIO_set_ssl(s_bio,s_ssl,BIO_NOCLOSE);
1637
1638         c_r=0; s_r=1;
1639         c_w=1; s_w=0;
1640         c_write=1,s_write=0;
1641
1642         /* We can always do writes */
1643         for (;;)
1644                 {
1645                 do_server=0;
1646                 do_client=0;
1647
1648                 i=(int)BIO_pending(s_bio);
1649                 if ((i && s_r) || s_w) do_server=1;
1650
1651                 i=(int)BIO_pending(c_bio);
1652                 if ((i && c_r) || c_w) do_client=1;
1653
1654                 if (do_server && debug)
1655                         {
1656                         if (SSL_in_init(s_ssl))
1657                                 printf("server waiting in SSL_accept - %s\n",
1658                                         SSL_state_string_long(s_ssl));
1659 /*-
1660                         else if (s_write)
1661                                 printf("server:SSL_write()\n");
1662                         else
1663                                 printf("server:SSL_read()\n"); */
1664                         }
1665
1666                 if (do_client && debug)
1667                         {
1668                         if (SSL_in_init(c_ssl))
1669                                 printf("client waiting in SSL_connect - %s\n",
1670                                         SSL_state_string_long(c_ssl));
1671 /*-
1672                         else if (c_write)
1673                                 printf("client:SSL_write()\n");
1674                         else
1675                                 printf("client:SSL_read()\n"); */
1676                         }
1677
1678                 if (!do_client && !do_server)
1679                         {
1680                         fprintf(stdout,"ERROR IN STARTUP\n");
1681                         ERR_print_errors(bio_err);
1682                         break;
1683                         }
1684                 if (do_client && !(done & C_DONE))
1685                         {
1686                         if (c_write)
1687                                 {
1688                                 j = (cw_num > (long)sizeof(cbuf)) ?
1689                                         (int)sizeof(cbuf) : (int)cw_num;
1690                                 i=BIO_write(c_bio,cbuf,j);
1691                                 if (i < 0)
1692                                         {
1693                                         c_r=0;
1694                                         c_w=0;
1695                                         if (BIO_should_retry(c_bio))
1696                                                 {
1697                                                 if (BIO_should_read(c_bio))
1698                                                         c_r=1;
1699                                                 if (BIO_should_write(c_bio))
1700                                                         c_w=1;
1701                                                 }
1702                                         else
1703                                                 {
1704                                                 fprintf(stderr,"ERROR in CLIENT\n");
1705                                                 ERR_print_errors(bio_err);
1706                                                 goto err;
1707                                                 }
1708                                         }
1709                                 else if (i == 0)
1710                                         {
1711                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1712                                         goto err;
1713                                         }
1714                                 else
1715                                         {
1716                                         if (debug)
1717                                                 printf("client wrote %d\n",i);
1718                                         /* ok */
1719                                         s_r=1;
1720                                         c_write=0;
1721                                         cw_num-=i;
1722                                         }
1723                                 }
1724                         else
1725                                 {
1726                                 i=BIO_read(c_bio,cbuf,sizeof(cbuf));
1727                                 if (i < 0)
1728                                         {
1729                                         c_r=0;
1730                                         c_w=0;
1731                                         if (BIO_should_retry(c_bio))
1732                                                 {
1733                                                 if (BIO_should_read(c_bio))
1734                                                         c_r=1;
1735                                                 if (BIO_should_write(c_bio))
1736                                                         c_w=1;
1737                                                 }
1738                                         else
1739                                                 {
1740                                                 fprintf(stderr,"ERROR in CLIENT\n");
1741                                                 ERR_print_errors(bio_err);
1742                                                 goto err;
1743                                                 }
1744                                         }
1745                                 else if (i == 0)
1746                                         {
1747                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1748                                         goto err;
1749                                         }
1750                                 else
1751                                         {
1752                                         if (debug)
1753                                                 printf("client read %d\n",i);
1754                                         cr_num-=i;
1755                                         if (sw_num > 0)
1756                                                 {
1757                                                 s_write=1;
1758                                                 s_w=1;
1759                                                 }
1760                                         if (cr_num <= 0)
1761                                                 {
1762                                                 s_write=1;
1763                                                 s_w=1;
1764                                                 done=S_DONE|C_DONE;
1765                                                 }
1766                                         }
1767                                 }
1768                         }
1769
1770                 if (do_server && !(done & S_DONE))
1771                         {
1772                         if (!s_write)
1773                                 {
1774                                 i=BIO_read(s_bio,sbuf,sizeof(cbuf));
1775                                 if (i < 0)
1776                                         {
1777                                         s_r=0;
1778                                         s_w=0;
1779                                         if (BIO_should_retry(s_bio))
1780                                                 {
1781                                                 if (BIO_should_read(s_bio))
1782                                                         s_r=1;
1783                                                 if (BIO_should_write(s_bio))
1784                                                         s_w=1;
1785                                                 }
1786                                         else
1787                                                 {
1788                                                 fprintf(stderr,"ERROR in SERVER\n");
1789                                                 ERR_print_errors(bio_err);
1790                                                 goto err;
1791                                                 }
1792                                         }
1793                                 else if (i == 0)
1794                                         {
1795                                         ERR_print_errors(bio_err);
1796                                         fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_read\n");
1797                                         goto err;
1798                                         }
1799                                 else
1800                                         {
1801                                         if (debug)
1802                                                 printf("server read %d\n",i);
1803                                         sr_num-=i;
1804                                         if (cw_num > 0)
1805                                                 {
1806                                                 c_write=1;
1807                                                 c_w=1;
1808                                                 }
1809                                         if (sr_num <= 0)
1810                                                 {
1811                                                 s_write=1;
1812                                                 s_w=1;
1813                                                 c_write=0;
1814                                                 }
1815                                         }
1816                                 }
1817                         else
1818                                 {
1819                                 j = (sw_num > (long)sizeof(sbuf)) ?
1820                                         (int)sizeof(sbuf) : (int)sw_num;
1821                                 i=BIO_write(s_bio,sbuf,j);
1822                                 if (i < 0)
1823                                         {
1824                                         s_r=0;
1825                                         s_w=0;
1826                                         if (BIO_should_retry(s_bio))
1827                                                 {
1828                                                 if (BIO_should_read(s_bio))
1829                                                         s_r=1;
1830                                                 if (BIO_should_write(s_bio))
1831                                                         s_w=1;
1832                                                 }
1833                                         else
1834                                                 {
1835                                                 fprintf(stderr,"ERROR in SERVER\n");
1836                                                 ERR_print_errors(bio_err);
1837                                                 goto err;
1838                                                 }
1839                                         }
1840                                 else if (i == 0)
1841                                         {
1842                                         ERR_print_errors(bio_err);
1843                                         fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_write\n");
1844                                         goto err;
1845                                         }
1846                                 else
1847                                         {
1848                                         if (debug)
1849                                                 printf("server wrote %d\n",i);
1850                                         sw_num-=i;
1851                                         s_write=0;
1852                                         c_r=1;
1853                                         if (sw_num <= 0)
1854                                                 done|=S_DONE;
1855                                         }
1856                                 }
1857                         }
1858
1859                 if ((done & S_DONE) && (done & C_DONE)) break;
1860                 }
1861
1862         if (verbose)
1863                 print_details(c_ssl, "DONE: ");
1864         ret=0;
1865 err:
1866         /* We have to set the BIO's to NULL otherwise they will be
1867          * OPENSSL_free()ed twice.  Once when th s_ssl is SSL_free()ed and
1868          * again when c_ssl is SSL_free()ed.
1869          * This is a hack required because s_ssl and c_ssl are sharing the same
1870          * BIO structure and SSL_set_bio() and SSL_free() automatically
1871          * BIO_free non NULL entries.
1872          * You should not normally do this or be required to do this */
1873         if (s_ssl != NULL)
1874                 {
1875                 s_ssl->rbio=NULL;
1876                 s_ssl->wbio=NULL;
1877                 }
1878         if (c_ssl != NULL)
1879                 {
1880                 c_ssl->rbio=NULL;
1881                 c_ssl->wbio=NULL;
1882                 }
1883
1884         if (c_to_s != NULL) BIO_free(c_to_s);
1885         if (s_to_c != NULL) BIO_free(s_to_c);
1886         if (c_bio != NULL) BIO_free_all(c_bio);
1887         if (s_bio != NULL) BIO_free_all(s_bio);
1888         return(ret);
1889         }
1890
1891 static int get_proxy_auth_ex_data_idx(void)
1892         {
1893         static volatile int idx = -1;
1894         if (idx < 0)
1895                 {
1896                 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
1897                 if (idx < 0)
1898                         {
1899                         idx = X509_STORE_CTX_get_ex_new_index(0,
1900                                 "SSLtest for verify callback", NULL,NULL,NULL);
1901                         }
1902                 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
1903                 }
1904         return idx;
1905         }
1906
1907 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
1908         {
1909         char *s,buf[256];
1910
1911         s=X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),buf,
1912                             sizeof buf);
1913         if (s != NULL)
1914                 {
1915                 if (ok)
1916                         fprintf(stderr,"depth=%d %s\n",
1917                                 ctx->error_depth,buf);
1918                 else
1919                         {
1920                         fprintf(stderr,"depth=%d error=%d %s\n",
1921                                 ctx->error_depth,ctx->error,buf);
1922                         }
1923                 }
1924
1925         if (ok == 0)
1926                 {
1927                 fprintf(stderr,"Error string: %s\n",
1928                         X509_verify_cert_error_string(ctx->error));
1929                 switch (ctx->error)
1930                         {
1931                 case X509_V_ERR_CERT_NOT_YET_VALID:
1932                 case X509_V_ERR_CERT_HAS_EXPIRED:
1933                 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
1934                         fprintf(stderr,"  ... ignored.\n");
1935                         ok=1;
1936                         }
1937                 }
1938
1939         if (ok == 1)
1940                 {
1941                 X509 *xs = ctx->current_cert;
1942 #if 0
1943                 X509 *xi = ctx->current_issuer;
1944 #endif
1945
1946                 if (xs->ex_flags & EXFLAG_PROXY)
1947                         {
1948                         unsigned int *letters =
1949                                 X509_STORE_CTX_get_ex_data(ctx,
1950                                         get_proxy_auth_ex_data_idx());
1951
1952                         if (letters)
1953                                 {
1954                                 int found_any = 0;
1955                                 int i;
1956                                 PROXY_CERT_INFO_EXTENSION *pci =
1957                                         X509_get_ext_d2i(xs, NID_proxyCertInfo,
1958                                                 NULL, NULL);
1959
1960                                 switch (OBJ_obj2nid(pci->proxyPolicy->policyLanguage))
1961                                         {
1962                                 case NID_Independent:
1963                                         /* Completely meaningless in this
1964                                            program, as there's no way to
1965                                            grant explicit rights to a
1966                                            specific PrC.  Basically, using
1967                                            id-ppl-Independent is the perfect
1968                                            way to grant no rights at all. */
1969                                         fprintf(stderr, "  Independent proxy certificate");
1970                                         for (i = 0; i < 26; i++)
1971                                                 letters[i] = 0;
1972                                         break;
1973                                 case NID_id_ppl_inheritAll:
1974                                         /* This is basically a NOP, we
1975                                            simply let the current rights
1976                                            stand as they are. */
1977                                         fprintf(stderr, "  Proxy certificate inherits all");
1978                                         break;
1979                                 default:
1980                                         s = (char *)
1981                                                 pci->proxyPolicy->policy->data;
1982                                         i = pci->proxyPolicy->policy->length;
1983
1984                                         /* The algorithm works as follows:
1985                                            it is assumed that previous
1986                                            iterations or the initial granted
1987                                            rights has already set some elements
1988                                            of `letters'.  What we need to do is
1989                                            to clear those that weren't granted
1990                                            by the current PrC as well.  The
1991                                            easiest way to do this is to add 1
1992                                            to all the elements whose letters
1993                                            are given with the current policy.
1994                                            That way, all elements that are set
1995                                            by the current policy and were
1996                                            already set by earlier policies and
1997                                            through the original grant of rights
1998                                            will get the value 2 or higher.
1999                                            The last thing to do is to sweep
2000                                            through `letters' and keep the
2001                                            elements having the value 2 as set,
2002                                            and clear all the others. */
2003
2004                                         fprintf(stderr, "  Certificate proxy rights = %*.*s", i, i, s);
2005                                         while(i-- > 0)
2006                                                 {
2007                                                 int c = *s++;
2008                                                 if (isascii(c) && isalpha(c))
2009                                                         {
2010                                                         if (islower(c))
2011                                                                 c = toupper(c);
2012                                                         letters[c - 'A']++;
2013                                                         }
2014                                                 }
2015                                         for (i = 0; i < 26; i++)
2016                                                 if (letters[i] < 2)
2017                                                         letters[i] = 0;
2018                                                 else
2019                                                         letters[i] = 1;
2020                                         }
2021
2022                                 found_any = 0;
2023                                 fprintf(stderr,
2024                                         ", resulting proxy rights = ");
2025                                 for(i = 0; i < 26; i++)
2026                                         if (letters[i])
2027                                                 {
2028                                                 fprintf(stderr, "%c", i + 'A');
2029                                                 found_any = 1;
2030                                                 }
2031                                 if (!found_any)
2032                                         fprintf(stderr, "none");
2033                                 fprintf(stderr, "\n");
2034
2035                                 PROXY_CERT_INFO_EXTENSION_free(pci);
2036                                 }
2037                         }
2038                 }
2039
2040         return(ok);
2041         }
2042
2043 static void process_proxy_debug(int indent, const char *format, ...)
2044         {
2045         /* That's 80 > */
2046         static const char indentation[] =
2047                 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"
2048                 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>";
2049         char my_format[256];
2050         va_list args;
2051
2052         BIO_snprintf(my_format, sizeof(my_format), "%*.*s %s",
2053                 indent, indent, indentation, format);
2054
2055         va_start(args, format);
2056         vfprintf(stderr, my_format, args);
2057         va_end(args);
2058         }
2059 /*-
2060  * Priority levels:
2061  *  0   [!]var, ()
2062  *  1   & ^
2063  *  2   |
2064  */
2065 static int process_proxy_cond_adders(unsigned int letters[26],
2066         const char *cond, const char **cond_end, int *pos, int indent);
2067 static int process_proxy_cond_val(unsigned int letters[26],
2068         const char *cond, const char **cond_end, int *pos, int indent)
2069         {
2070         int c;
2071         int ok = 1;
2072         int negate = 0;
2073
2074         while(isspace((int)*cond))
2075                 {
2076                 cond++; (*pos)++;
2077                 }
2078         c = *cond;
2079
2080         if (debug)
2081                 process_proxy_debug(indent,
2082                         "Start process_proxy_cond_val at position %d: %s\n",
2083                         *pos, cond);
2084
2085         while(c == '!')
2086                 {
2087                 negate = !negate;
2088                 cond++; (*pos)++;
2089                 while(isspace((int)*cond))
2090                         {
2091                         cond++; (*pos)++;
2092                         }
2093                 c = *cond;
2094                 }
2095
2096         if (c == '(')
2097                 {
2098                 cond++; (*pos)++;
2099                 ok = process_proxy_cond_adders(letters, cond, cond_end, pos,
2100                         indent + 1);
2101                 cond = *cond_end;
2102                 if (ok < 0)
2103                         goto end;
2104                 while(isspace((int)*cond))
2105                         {
2106                         cond++; (*pos)++;
2107                         }
2108                 c = *cond;
2109                 if (c != ')')
2110                         {
2111                         fprintf(stderr,
2112                                 "Weird condition character in position %d: "
2113                                 "%c\n", *pos, c);
2114                         ok = -1;
2115                         goto end;
2116                         }
2117                 cond++; (*pos)++;
2118                 }
2119         else if (isascii(c) && isalpha(c))
2120                 {
2121                 if (islower(c))
2122                         c = toupper(c);
2123                 ok = letters[c - 'A'];
2124                 cond++; (*pos)++;
2125                 }
2126         else
2127                 {
2128                 fprintf(stderr,
2129                         "Weird condition character in position %d: "
2130                         "%c\n", *pos, c);
2131                 ok = -1;
2132                 goto end;
2133                 }
2134  end:
2135         *cond_end = cond;
2136         if (ok >= 0 && negate)
2137                 ok = !ok;
2138
2139         if (debug)
2140                 process_proxy_debug(indent,
2141                         "End process_proxy_cond_val at position %d: %s, returning %d\n",
2142                         *pos, cond, ok);
2143
2144         return ok;
2145         }
2146 static int process_proxy_cond_multipliers(unsigned int letters[26],
2147         const char *cond, const char **cond_end, int *pos, int indent)
2148         {
2149         int ok;
2150         char c;
2151
2152         if (debug)
2153                 process_proxy_debug(indent,
2154                         "Start process_proxy_cond_multipliers at position %d: %s\n",
2155                         *pos, cond);
2156
2157         ok = process_proxy_cond_val(letters, cond, cond_end, pos, indent + 1);
2158         cond = *cond_end;
2159         if (ok < 0)
2160                 goto end;
2161
2162         while(ok >= 0)
2163                 {
2164                 while(isspace((int)*cond))
2165                         {
2166                         cond++; (*pos)++;
2167                         }
2168                 c = *cond;
2169
2170                 switch(c)
2171                         {
2172                 case '&':
2173                 case '^':
2174                         {
2175                         int save_ok = ok;
2176
2177                         cond++; (*pos)++;
2178                         ok = process_proxy_cond_val(letters,
2179                                 cond, cond_end, pos, indent + 1);
2180                         cond = *cond_end;
2181                         if (ok < 0)
2182                                 break;
2183
2184                         switch(c)
2185                                 {
2186                         case '&':
2187                                 ok &= save_ok;
2188                                 break;
2189                         case '^':
2190                                 ok ^= save_ok;
2191                                 break;
2192                         default:
2193                                 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
2194                                         " STOPPING\n");
2195                                 EXIT(1);
2196                                 }
2197                         }
2198                         break;
2199                 default:
2200                         goto end;
2201                         }
2202                 }
2203  end:
2204         if (debug)
2205                 process_proxy_debug(indent,
2206                         "End process_proxy_cond_multipliers at position %d: %s, returning %d\n",
2207                         *pos, cond, ok);
2208
2209         *cond_end = cond;
2210         return ok;
2211         }
2212 static int process_proxy_cond_adders(unsigned int letters[26],
2213         const char *cond, const char **cond_end, int *pos, int indent)
2214         {
2215         int ok;
2216         char c;
2217
2218         if (debug)
2219                 process_proxy_debug(indent,
2220                         "Start process_proxy_cond_adders at position %d: %s\n",
2221                         *pos, cond);
2222
2223         ok = process_proxy_cond_multipliers(letters, cond, cond_end, pos,
2224                 indent + 1);
2225         cond = *cond_end;
2226         if (ok < 0)
2227                 goto end;
2228
2229         while(ok >= 0)
2230                 {
2231                 while(isspace((int)*cond))
2232                         {
2233                         cond++; (*pos)++;
2234                         }
2235                 c = *cond;
2236
2237                 switch(c)
2238                         {
2239                 case '|':
2240                         {
2241                         int save_ok = ok;
2242
2243                         cond++; (*pos)++;
2244                         ok = process_proxy_cond_multipliers(letters,
2245                                 cond, cond_end, pos, indent + 1);
2246                         cond = *cond_end;
2247                         if (ok < 0)
2248                                 break;
2249
2250                         switch(c)
2251                                 {
2252                         case '|':
2253                                 ok |= save_ok;
2254                                 break;
2255                         default:
2256                                 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
2257                                         " STOPPING\n");
2258                                 EXIT(1);
2259                                 }
2260                         }
2261                         break;
2262                 default:
2263                         goto end;
2264                         }
2265                 }
2266  end:
2267         if (debug)
2268                 process_proxy_debug(indent,
2269                         "End process_proxy_cond_adders at position %d: %s, returning %d\n",
2270                         *pos, cond, ok);
2271
2272         *cond_end = cond;
2273         return ok;
2274         }
2275
2276 static int process_proxy_cond(unsigned int letters[26],
2277         const char *cond, const char **cond_end)
2278         {
2279         int pos = 1;
2280         return process_proxy_cond_adders(letters, cond, cond_end, &pos, 1);
2281         }
2282
2283 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg)
2284         {
2285         int ok=1;
2286         struct app_verify_arg *cb_arg = arg;
2287         unsigned int letters[26]; /* only used with proxy_auth */
2288
2289         if (cb_arg->app_verify)
2290                 {
2291                 char *s = NULL,buf[256];
2292
2293                 fprintf(stderr, "In app_verify_callback, allowing cert. ");
2294                 fprintf(stderr, "Arg is: %s\n", cb_arg->string);
2295                 fprintf(stderr, "Finished printing do we have a context? 0x%p a cert? 0x%p\n",
2296                         (void *)ctx, (void *)ctx->cert);
2297                 if (ctx->cert)
2298                         s=X509_NAME_oneline(X509_get_subject_name(ctx->cert),buf,256);
2299                 if (s != NULL)
2300                         {
2301                         fprintf(stderr,"cert depth=%d %s\n",ctx->error_depth,buf);
2302                         }
2303                 return(1);
2304                 }
2305         if (cb_arg->proxy_auth)
2306                 {
2307                 int found_any = 0, i;
2308                 char *sp;
2309
2310                 for(i = 0; i < 26; i++)
2311                         letters[i] = 0;
2312                 for(sp = cb_arg->proxy_auth; *sp; sp++)
2313                         {
2314                         int c = *sp;
2315                         if (isascii(c) && isalpha(c))
2316                                 {
2317                                 if (islower(c))
2318                                         c = toupper(c);
2319                                 letters[c - 'A'] = 1;
2320                                 }
2321                         }
2322
2323                 fprintf(stderr,
2324                         "  Initial proxy rights = ");
2325                 for(i = 0; i < 26; i++)
2326                         if (letters[i])
2327                                 {
2328                                 fprintf(stderr, "%c", i + 'A');
2329                                 found_any = 1;
2330                                 }
2331                 if (!found_any)
2332                         fprintf(stderr, "none");
2333                 fprintf(stderr, "\n");
2334
2335                 X509_STORE_CTX_set_ex_data(ctx,
2336                         get_proxy_auth_ex_data_idx(),letters);
2337                 }
2338         if (cb_arg->allow_proxy_certs)
2339                 {
2340                 X509_STORE_CTX_set_flags(ctx, X509_V_FLAG_ALLOW_PROXY_CERTS);
2341                 }
2342
2343 #ifndef OPENSSL_NO_X509_VERIFY
2344         ok = X509_verify_cert(ctx);
2345 #endif
2346
2347         if (cb_arg->proxy_auth)
2348                 {
2349                 if (ok > 0)
2350                         {
2351                         const char *cond_end = NULL;
2352
2353                         ok = process_proxy_cond(letters,
2354                                 cb_arg->proxy_cond, &cond_end);
2355
2356                         if (ok < 0)
2357                                 EXIT(3);
2358                         if (*cond_end)
2359                                 {
2360                                 fprintf(stderr, "Stopped processing condition before it's end.\n");
2361                                 ok = 0;
2362                                 }
2363                         if (!ok)
2364                                 fprintf(stderr, "Proxy rights check with condition '%s' proved invalid\n",
2365                                         cb_arg->proxy_cond);
2366                         else
2367                                 fprintf(stderr, "Proxy rights check with condition '%s' proved valid\n",
2368                                         cb_arg->proxy_cond);
2369                         }
2370                 }
2371         return(ok);
2372         }
2373
2374 #ifndef OPENSSL_NO_RSA
2375 static RSA *rsa_tmp=NULL;
2376
2377 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength)
2378         {
2379         BIGNUM *bn = NULL;
2380         if (rsa_tmp == NULL)
2381                 {
2382                 bn = BN_new();
2383                 rsa_tmp = RSA_new();
2384                 if(!bn || !rsa_tmp || !BN_set_word(bn, RSA_F4))
2385                         {
2386                         BIO_printf(bio_err, "Memory error...");
2387                         goto end;
2388                         }
2389                 BIO_printf(bio_err,"Generating temp (%d bit) RSA key...",keylength);
2390                 (void)BIO_flush(bio_err);
2391                 if(!RSA_generate_key_ex(rsa_tmp,keylength,bn,NULL))
2392                         {
2393                         BIO_printf(bio_err, "Error generating key.");
2394                         RSA_free(rsa_tmp);
2395                         rsa_tmp = NULL;
2396                         }
2397 end:
2398                 BIO_printf(bio_err,"\n");
2399                 (void)BIO_flush(bio_err);
2400                 }
2401         if(bn) BN_free(bn);
2402         return(rsa_tmp);
2403         }
2404
2405 static void free_tmp_rsa(void)
2406         {
2407         if (rsa_tmp != NULL)
2408                 {
2409                 RSA_free(rsa_tmp);
2410                 rsa_tmp = NULL;
2411                 }
2412         }
2413 #endif
2414
2415 #ifndef OPENSSL_NO_DH
2416 /*-
2417  * These DH parameters have been generated as follows:
2418  *    $ openssl dhparam -C -noout 512
2419  *    $ openssl dhparam -C -noout 1024
2420  *    $ openssl dhparam -C -noout -dsaparam 1024
2421  * (The third function has been renamed to avoid name conflicts.)
2422  */
2423 static DH *get_dh512()
2424         {
2425         static unsigned char dh512_p[]={
2426                 0xCB,0xC8,0xE1,0x86,0xD0,0x1F,0x94,0x17,0xA6,0x99,0xF0,0xC6,
2427                 0x1F,0x0D,0xAC,0xB6,0x25,0x3E,0x06,0x39,0xCA,0x72,0x04,0xB0,
2428                 0x6E,0xDA,0xC0,0x61,0xE6,0x7A,0x77,0x25,0xE8,0x3B,0xB9,0x5F,
2429                 0x9A,0xB6,0xB5,0xFE,0x99,0x0B,0xA1,0x93,0x4E,0x35,0x33,0xB8,
2430                 0xE1,0xF1,0x13,0x4F,0x59,0x1A,0xD2,0x57,0xC0,0x26,0x21,0x33,
2431                 0x02,0xC5,0xAE,0x23,
2432                 };
2433         static unsigned char dh512_g[]={
2434                 0x02,
2435                 };
2436         DH *dh;
2437
2438         if ((dh=DH_new()) == NULL) return(NULL);
2439         dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
2440         dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
2441         if ((dh->p == NULL) || (dh->g == NULL))
2442                 { DH_free(dh); return(NULL); }
2443         return(dh);
2444         }
2445
2446 static DH *get_dh1024()
2447         {
2448         static unsigned char dh1024_p[]={
2449                 0xF8,0x81,0x89,0x7D,0x14,0x24,0xC5,0xD1,0xE6,0xF7,0xBF,0x3A,
2450                 0xE4,0x90,0xF4,0xFC,0x73,0xFB,0x34,0xB5,0xFA,0x4C,0x56,0xA2,
2451                 0xEA,0xA7,0xE9,0xC0,0xC0,0xCE,0x89,0xE1,0xFA,0x63,0x3F,0xB0,
2452                 0x6B,0x32,0x66,0xF1,0xD1,0x7B,0xB0,0x00,0x8F,0xCA,0x87,0xC2,
2453                 0xAE,0x98,0x89,0x26,0x17,0xC2,0x05,0xD2,0xEC,0x08,0xD0,0x8C,
2454                 0xFF,0x17,0x52,0x8C,0xC5,0x07,0x93,0x03,0xB1,0xF6,0x2F,0xB8,
2455                 0x1C,0x52,0x47,0x27,0x1B,0xDB,0xD1,0x8D,0x9D,0x69,0x1D,0x52,
2456                 0x4B,0x32,0x81,0xAA,0x7F,0x00,0xC8,0xDC,0xE6,0xD9,0xCC,0xC1,
2457                 0x11,0x2D,0x37,0x34,0x6C,0xEA,0x02,0x97,0x4B,0x0E,0xBB,0xB1,
2458                 0x71,0x33,0x09,0x15,0xFD,0xDD,0x23,0x87,0x07,0x5E,0x89,0xAB,
2459                 0x6B,0x7C,0x5F,0xEC,0xA6,0x24,0xDC,0x53,
2460                 };
2461         static unsigned char dh1024_g[]={
2462                 0x02,
2463                 };
2464         DH *dh;
2465
2466         if ((dh=DH_new()) == NULL) return(NULL);
2467         dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2468         dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2469         if ((dh->p == NULL) || (dh->g == NULL))
2470                 { DH_free(dh); return(NULL); }
2471         return(dh);
2472         }
2473
2474 static DH *get_dh1024dsa()
2475         {
2476         static unsigned char dh1024_p[]={
2477                 0xC8,0x00,0xF7,0x08,0x07,0x89,0x4D,0x90,0x53,0xF3,0xD5,0x00,
2478                 0x21,0x1B,0xF7,0x31,0xA6,0xA2,0xDA,0x23,0x9A,0xC7,0x87,0x19,
2479                 0x3B,0x47,0xB6,0x8C,0x04,0x6F,0xFF,0xC6,0x9B,0xB8,0x65,0xD2,
2480                 0xC2,0x5F,0x31,0x83,0x4A,0xA7,0x5F,0x2F,0x88,0x38,0xB6,0x55,
2481                 0xCF,0xD9,0x87,0x6D,0x6F,0x9F,0xDA,0xAC,0xA6,0x48,0xAF,0xFC,
2482                 0x33,0x84,0x37,0x5B,0x82,0x4A,0x31,0x5D,0xE7,0xBD,0x52,0x97,
2483                 0xA1,0x77,0xBF,0x10,0x9E,0x37,0xEA,0x64,0xFA,0xCA,0x28,0x8D,
2484                 0x9D,0x3B,0xD2,0x6E,0x09,0x5C,0x68,0xC7,0x45,0x90,0xFD,0xBB,
2485                 0x70,0xC9,0x3A,0xBB,0xDF,0xD4,0x21,0x0F,0xC4,0x6A,0x3C,0xF6,
2486                 0x61,0xCF,0x3F,0xD6,0x13,0xF1,0x5F,0xBC,0xCF,0xBC,0x26,0x9E,
2487                 0xBC,0x0B,0xBD,0xAB,0x5D,0xC9,0x54,0x39,
2488                 };
2489         static unsigned char dh1024_g[]={
2490                 0x3B,0x40,0x86,0xE7,0xF3,0x6C,0xDE,0x67,0x1C,0xCC,0x80,0x05,
2491                 0x5A,0xDF,0xFE,0xBD,0x20,0x27,0x74,0x6C,0x24,0xC9,0x03,0xF3,
2492                 0xE1,0x8D,0xC3,0x7D,0x98,0x27,0x40,0x08,0xB8,0x8C,0x6A,0xE9,
2493                 0xBB,0x1A,0x3A,0xD6,0x86,0x83,0x5E,0x72,0x41,0xCE,0x85,0x3C,
2494                 0xD2,0xB3,0xFC,0x13,0xCE,0x37,0x81,0x9E,0x4C,0x1C,0x7B,0x65,
2495                 0xD3,0xE6,0xA6,0x00,0xF5,0x5A,0x95,0x43,0x5E,0x81,0xCF,0x60,
2496                 0xA2,0x23,0xFC,0x36,0xA7,0x5D,0x7A,0x4C,0x06,0x91,0x6E,0xF6,
2497                 0x57,0xEE,0x36,0xCB,0x06,0xEA,0xF5,0x3D,0x95,0x49,0xCB,0xA7,
2498                 0xDD,0x81,0xDF,0x80,0x09,0x4A,0x97,0x4D,0xA8,0x22,0x72,0xA1,
2499                 0x7F,0xC4,0x70,0x56,0x70,0xE8,0x20,0x10,0x18,0x8F,0x2E,0x60,
2500                 0x07,0xE7,0x68,0x1A,0x82,0x5D,0x32,0xA2,
2501                 };
2502         DH *dh;
2503
2504         if ((dh=DH_new()) == NULL) return(NULL);
2505         dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2506         dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2507         if ((dh->p == NULL) || (dh->g == NULL))
2508                 { DH_free(dh); return(NULL); }
2509         dh->length = 160;
2510         return(dh);
2511         }
2512 #endif
2513
2514 #ifndef OPENSSL_NO_PSK
2515 /* convert the PSK key (psk_key) in ascii to binary (psk) */
2516 static int psk_key2bn(const char *pskkey, unsigned char *psk,
2517         unsigned int max_psk_len)
2518         {
2519         int ret;
2520         BIGNUM *bn = NULL;
2521
2522         ret = BN_hex2bn(&bn, pskkey);
2523         if (!ret)
2524                 {
2525                 BIO_printf(bio_err,"Could not convert PSK key '%s' to BIGNUM\n", pskkey);
2526                 if (bn)
2527                         BN_free(bn);
2528                 return 0;
2529                 }
2530         if (BN_num_bytes(bn) > (int)max_psk_len)
2531                 {
2532                 BIO_printf(bio_err,"psk buffer of callback is too small (%d) for key (%d)\n",
2533                         max_psk_len, BN_num_bytes(bn));
2534                 BN_free(bn);
2535                 return 0;
2536                 }
2537         ret = BN_bn2bin(bn, psk);
2538         BN_free(bn);
2539         return ret;
2540         }
2541
2542 static unsigned int psk_client_callback(SSL *ssl, const char *hint, char *identity,
2543         unsigned int max_identity_len, unsigned char *psk,
2544         unsigned int max_psk_len)
2545         {
2546         int ret;
2547         unsigned int psk_len = 0;
2548
2549         ret = BIO_snprintf(identity, max_identity_len, "Client_identity");
2550         if (ret < 0)
2551                 goto out_err;
2552         if (debug)
2553                 fprintf(stderr, "client: created identity '%s' len=%d\n", identity, ret);
2554         ret = psk_key2bn(psk_key, psk, max_psk_len);
2555         if (ret < 0)
2556                 goto out_err;
2557         psk_len = ret;
2558 out_err:
2559         return psk_len;
2560         }
2561
2562 static unsigned int psk_server_callback(SSL *ssl, const char *identity,
2563         unsigned char *psk, unsigned int max_psk_len)
2564         {
2565         unsigned int psk_len=0;
2566
2567         if (strcmp(identity, "Client_identity") != 0)
2568                 {
2569                 BIO_printf(bio_err, "server: PSK error: client identity not found\n");
2570                 return 0;
2571                 }
2572         psk_len=psk_key2bn(psk_key, psk, max_psk_len);
2573         return psk_len;
2574         }
2575 #endif
2576
2577 static int do_test_cipherlist(void)
2578         {
2579         int i = 0;
2580         const SSL_METHOD *meth;
2581         const SSL_CIPHER *ci, *tci = NULL;
2582
2583 #ifndef OPENSSL_NO_SSL2
2584         fprintf(stderr, "testing SSLv2 cipher list order: ");
2585         meth = SSLv2_method();
2586         while ((ci = meth->get_cipher(i++)) != NULL)
2587                 {
2588                 if (tci != NULL)
2589                         if (ci->id >= tci->id)
2590                                 {
2591                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2592                                 return 0;
2593                                 }
2594                 tci = ci;
2595                 }
2596         fprintf(stderr, "ok\n");
2597 #endif
2598 #ifndef OPENSSL_NO_SSL3
2599         fprintf(stderr, "testing SSLv3 cipher list order: ");
2600         meth = SSLv3_method();
2601         tci = NULL;
2602         while ((ci = meth->get_cipher(i++)) != NULL)
2603                 {
2604                 if (tci != NULL)
2605                         if (ci->id >= tci->id)
2606                                 {
2607                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2608                                 return 0;
2609                                 }
2610                 tci = ci;
2611                 }
2612         fprintf(stderr, "ok\n");
2613 #endif
2614 #ifndef OPENSSL_NO_TLS1
2615         fprintf(stderr, "testing TLSv1 cipher list order: ");
2616         meth = TLSv1_method();
2617         tci = NULL;
2618         while ((ci = meth->get_cipher(i++)) != NULL)
2619                 {
2620                 if (tci != NULL)
2621                         if (ci->id >= tci->id)
2622                                 {
2623                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2624                                 return 0;
2625                                 }
2626                 tci = ci;
2627                 }
2628         fprintf(stderr, "ok\n");
2629 #endif
2630
2631         return 1;
2632         }