X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=ssl%2Fssltest.c;h=45b211b4c6fab3a61a2c99b1065b66322205b2ba;hp=7d1249fd5cf01ae10c0eca750cea3c261809eac9;hb=66ecdf3bfb0320647b8e2ab9f93ffc3f231e54e8;hpb=3728974460717c4523d2d81508d8aeb87e7f61b8 diff --git a/ssl/ssltest.c b/ssl/ssltest.c index 7d1249fd5c..45b211b4c6 100644 --- a/ssl/ssltest.c +++ b/ssl/ssltest.c @@ -108,12 +108,14 @@ * Hudson (tjh@cryptsoft.com). * */ +/* ==================================================================== + * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. + * ECC cipher suite support in OpenSSL originally developed by + * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project. + */ -#define _XOPEN_SOURCE 600 /* Or gethostname won't be declared properly +#define _BSD_SOURCE 1 /* Or gethostname won't be declared properly on Linux and GNU platforms. */ -#define _XOPEN_SOURCE_EXTENDED /* Or gethostname won't be declared properly - on Compaq platforms (at least with DEC C). - */ #include #include @@ -123,6 +125,7 @@ #include #include +#define USE_SOCKETS #include "e_os.h" #include @@ -130,12 +133,20 @@ #include #include #include +#ifndef OPENSSL_NO_ENGINE #include +#endif #include #include + +#define _XOPEN_SOURCE_EXTENDED 1 /* Or gethostname won't be declared properly + on Compaq platforms (at least with DEC C). + Do not try to put it earlier, or IPv6 includes + get screwed... + */ + #ifdef OPENSSL_SYS_WINDOWS #include -#include "../crypto/bio/bss_file.c" #else #include OPENSSL_UNISTD #endif @@ -143,6 +154,9 @@ #ifdef OPENSSL_SYS_VMS # define TEST_SERVER_CERT "SYS$DISK:[-.APPS]SERVER.PEM" # define TEST_CLIENT_CERT "SYS$DISK:[-.APPS]CLIENT.PEM" +#elif defined(OPENSSL_SYS_WINCE) +# define TEST_SERVER_CERT "\\OpenSSL\\server.pem" +# define TEST_CLIENT_CERT "\\OpenSSL\\client.pem" #else # define TEST_SERVER_CERT "../apps/server.pem" # define TEST_CLIENT_CERT "../apps/client.pem" @@ -158,6 +172,10 @@ static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx); static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export,int keylength); static void free_tmp_rsa(void); #endif +static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg); +#define APP_CALLBACK "Test Callback Argument" +static char *app_verify_arg = APP_CALLBACK; + #ifndef OPENSSL_NO_DH static DH *get_dh512(void); static DH *get_dh1024(void); @@ -197,6 +215,9 @@ static void sv_usage(void) fprintf(stderr," -dhe1024dsa - use 1024 bit key (with 160-bit subprime) for DHE\n"); fprintf(stderr," -no_dhe - disable DHE\n"); #endif +#ifndef OPENSSL_NO_ECDH + fprintf(stderr," -no_ecdhe - disable ECDHE\n"); +#endif #ifndef OPENSSL_NO_SSL2 fprintf(stderr," -ssl2 - use SSLv2\n"); #endif @@ -217,7 +238,12 @@ static void sv_usage(void) fprintf(stderr," -f - Test even cases that can't work\n"); fprintf(stderr," -time - measure processor time used by client and server\n"); fprintf(stderr," -zlib - use zlib compression\n"); - fprintf(stderr," -time - use rle compression\n"); + fprintf(stderr," -rle - use rle compression\n"); +#ifndef OPENSSL_NO_ECDH + fprintf(stderr," -named_curve arg - Elliptic curve name to use for ephemeral ECDH keys.\n" \ + " Use \"openssl ecparam -list_curves\" for all names\n" \ + " (default is sect163r2).\n"); +#endif } static void print_details(SSL *c_ssl, const char *prefix) @@ -336,10 +362,12 @@ int main(int argc, char *argv[]) int tls1=0,ssl2=0,ssl3=0,ret=1; int client_auth=0; int server_auth=0,i; + int app_verify=0; char *server_cert=TEST_SERVER_CERT; char *server_key=NULL; char *client_cert=TEST_CLIENT_CERT; char *client_key=NULL; + char *named_curve = NULL; SSL_CTX *s_ctx=NULL; SSL_CTX *c_ctx=NULL; SSL_METHOD *meth=NULL; @@ -349,8 +377,12 @@ int main(int argc, char *argv[]) #ifndef OPENSSL_NO_DH DH *dh; int dhe1024 = 0, dhe1024dsa = 0; +#endif +#ifndef OPENSSL_NO_ECDH + EC_KEY *ecdh = NULL; #endif int no_dhe = 0; + int no_ecdhe = 0; int print_time = 0; clock_t s_time = 0, c_time = 0; int comp = 0; @@ -359,20 +391,26 @@ int main(int argc, char *argv[]) verbose = 0; debug = 0; cipher = 0; - + + bio_err=BIO_new_fp(stderr,BIO_NOCLOSE); + CRYPTO_set_locking_callback(lock_dbg_cb); /* enable memory leak checking unless explicitly disabled */ if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) && (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off")))) { CRYPTO_malloc_debug_init(); - CRYPTO_dbg_set_options(V_CRYPTO_MDEBUG_ALL); + CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL); + } + else + { + /* OPENSSL_DEBUG_MEMORY=off */ + CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0); } CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON); RAND_seed(rnd_seed, sizeof rnd_seed); - bio_err=BIO_new_fp(stderr,BIO_NOCLOSE); bio_stdout=BIO_new_fp(stdout,BIO_NOCLOSE); argc--; @@ -390,14 +428,26 @@ int main(int argc, char *argv[]) debug=1; else if (strcmp(*argv,"-reuse") == 0) reuse=1; -#ifndef OPENSSL_NO_DH else if (strcmp(*argv,"-dhe1024") == 0) + { +#ifndef OPENSSL_NO_DH dhe1024=1; +#else + fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n"); +#endif + } else if (strcmp(*argv,"-dhe1024dsa") == 0) + { +#ifndef OPENSSL_NO_DH dhe1024dsa=1; +#else + fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n"); #endif + } else if (strcmp(*argv,"-no_dhe") == 0) no_dhe=1; + else if (strcmp(*argv,"-no_ecdhe") == 0) + no_ecdhe=1; else if (strcmp(*argv,"-ssl2") == 0) ssl2=1; else if (strcmp(*argv,"-tls1") == 0) @@ -484,6 +534,20 @@ int main(int argc, char *argv[]) { comp = COMP_RLE; } + else if (strcmp(*argv,"-named_curve") == 0) + { + if (--argc < 1) goto bad; +#ifndef OPENSSL_NO_ECDH + named_curve = *(++argv); +#else + fprintf(stderr,"ignoring -named_curve, since I'm compiled without ECDH\n"); + ++argv; +#endif + } + else if (strcmp(*argv,"-app_verify") == 0) + { + app_verify = 1; + } else { fprintf(stderr,"unknown option %s\n",*argv); @@ -506,7 +570,7 @@ bad: "the test anyway (and\n-d to see what happens), " "or add one of -ssl2, -ssl3, -tls1, -reuse\n" "to avoid protocol mismatch.\n"); - exit(1); + EXIT(1); } if (print_time) @@ -595,6 +659,44 @@ bad: (void)no_dhe; #endif +#ifndef OPENSSL_NO_ECDH + if (!no_ecdhe) + { + ecdh = EC_KEY_new(); + if (ecdh != NULL) + { + if (named_curve) + { + int nid = OBJ_sn2nid(named_curve); + + if (nid == 0) + { + BIO_printf(bio_err, "unknown curve name (%s)\n", named_curve); + EC_KEY_free(ecdh); + goto end; + } + + ecdh->group = EC_GROUP_new_by_nid(nid); + if (ecdh->group == NULL) + { + BIO_printf(bio_err, "unable to create curve (%s)\n", named_curve); + EC_KEY_free(ecdh); + goto end; + } + } + + if (ecdh->group == NULL) + ecdh->group=EC_GROUP_new_by_nid(NID_sect163r2); + + SSL_CTX_set_tmp_ecdh(s_ctx, ecdh); + SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_ECDH_USE); + EC_KEY_free(ecdh); + } + } +#else + (void)no_ecdhe; +#endif + #ifndef OPENSSL_NO_RSA SSL_CTX_set_tmp_rsa_callback(s_ctx,tmp_rsa_cb); #endif @@ -635,12 +737,20 @@ bad: SSL_CTX_set_verify(s_ctx, SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT, verify_callback); + if (app_verify) + { + SSL_CTX_set_cert_verify_callback(s_ctx, app_verify_callback, app_verify_arg); + } } if (server_auth) { BIO_printf(bio_err,"server authentication\n"); SSL_CTX_set_verify(c_ctx,SSL_VERIFY_PEER, verify_callback); + if (app_verify) + { + SSL_CTX_set_cert_verify_callback(s_ctx, app_verify_callback, app_verify_arg); + } } { @@ -654,10 +764,16 @@ bad: #ifndef OPENSSL_NO_KRB5 if (c_ssl && c_ssl->kssl_ctx) { - char localhost[257]; + char localhost[MAXHOSTNAMELEN+2]; - if (gethostname(localhost, 256) == 0) + if (gethostname(localhost, sizeof localhost-1) == 0) { + localhost[sizeof localhost-1]='\0'; + if(strlen(localhost) == sizeof localhost-1) + { + BIO_printf(bio_err,"localhost name too long\n"); + goto end; + } kssl_ctx_setstring(c_ssl->kssl_ctx, KSSL_SERVER, localhost); } @@ -713,7 +829,10 @@ end: #ifndef OPENSSL_NO_RSA free_tmp_rsa(); #endif +#ifndef OPENSSL_NO_ENGINE ENGINE_cleanup(); +#endif + CRYPTO_cleanup_all_ex_data(); ERR_free_strings(); ERR_remove_state(0); EVP_cleanup(); @@ -802,6 +921,8 @@ int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count, int i, r; clock_t c_clock = clock(); + memset(cbuf, 0, sizeof(cbuf)); + if (debug) if (SSL_in_init(c_ssl)) printf("client waiting in SSL_connect - %s\n", @@ -886,6 +1007,8 @@ int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count, int i, r; clock_t s_clock = clock(); + memset(sbuf, 0, sizeof(sbuf)); + if (debug) if (SSL_in_init(s_ssl)) printf("server waiting in SSL_accept - %s\n", @@ -1030,10 +1153,10 @@ int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count, if (num > 1) --num; /* test restartability even more thoroughly */ - r = BIO_nwrite(io1, &dataptr, (int)num); + r = BIO_nwrite0(io1, &dataptr); assert(r > 0); - assert(r <= (int)num); - num = r; + if (r < (int)num) + num = r; r = BIO_read(io2, dataptr, (int)num); if (r != (int)num) /* can't happen */ { @@ -1042,6 +1165,13 @@ int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count, goto err; } progress = 1; + r = BIO_nwrite(io1, &dataptr, (int)num); + if (r != (int)num) /* can't happen */ + { + fprintf(stderr, "ERROR: BIO_nwrite() did not accept " + "BIO_nwrite0() bytes"); + goto err; + } if (debug) printf((io2 == client_io) ? @@ -1122,6 +1252,9 @@ int doit(SSL *s_ssl, SSL *c_ssl, long count) int c_write,s_write; int do_server=0,do_client=0; + memset(cbuf,0,sizeof(cbuf)); + memset(sbuf,0,sizeof(sbuf)); + c_to_s=BIO_new(BIO_s_mem()); s_to_c=BIO_new(BIO_s_mem()); if ((s_to_c == NULL) || (c_to_s == NULL)) @@ -1403,7 +1536,8 @@ static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx) { char *s,buf[256]; - s=X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),buf,256); + s=X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),buf, + sizeof buf); if (s != NULL) { if (ok) @@ -1427,6 +1561,25 @@ static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx) return(ok); } +static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg) + { + char *s = NULL,buf[256]; + int ok=1; + + fprintf(stderr, "In app_verify_callback, allowing cert. "); + fprintf(stderr, "Arg is: %s\n", (char *)arg); + fprintf(stderr, "Finished printing do we have a context? 0x%x a cert? 0x%x\n", + (unsigned int)ctx, (unsigned int)ctx->cert); + if (ctx->cert) + s=X509_NAME_oneline(X509_get_subject_name(ctx->cert),buf,256); + if (s != NULL) + { + fprintf(stderr,"cert depth=%d %s\n",ctx->error_depth,buf); + } + + return(ok); + } + #ifndef OPENSSL_NO_RSA static RSA *rsa_tmp=NULL; @@ -1434,9 +1587,21 @@ static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength) { if (rsa_tmp == NULL) { + rsa_tmp = RSA_new(); + if(!rsa_tmp) + { + BIO_printf(bio_err, "Memory error..."); + goto end; + } BIO_printf(bio_err,"Generating temp (%d bit) RSA key...",keylength); (void)BIO_flush(bio_err); - rsa_tmp=RSA_generate_key(keylength,RSA_F4,NULL,NULL); + if(!RSA_generate_key_ex(rsa_tmp,keylength,RSA_F4,NULL)) + { + BIO_printf(bio_err, "Error generating key.", keylength); + RSA_free(rsa_tmp); + rsa_tmp = NULL; + } +end: BIO_printf(bio_err,"\n"); (void)BIO_flush(bio_err); }