apps/s_client.c

   1 /* apps/s_client.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111 /* ====================================================================
 112  * Copyright 2005 Nokia. All rights reserved.
 113  *
 114  * The portions of the attached software ("Contribution") is developed by
 115  * Nokia Corporation and is licensed pursuant to the OpenSSL open source
 116  * license.
 117  *
 118  * The Contribution, originally written by Mika Kousa and Pasi Eronen of
 119  * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
 120  * support (see RFC 4279) to OpenSSL.
 121  *
 122  * No patent licenses or other rights except those expressly stated in
 123  * the OpenSSL open source license shall be deemed granted or received
 124  * expressly, by implication, estoppel, or otherwise.
 125  *
 126  * No assurances are provided by Nokia that the Contribution does not
 127  * infringe the patent or other intellectual property rights of any third
 128  * party or that the license provides you with all the necessary rights
 129  * to make use of the Contribution.
 130  *
 131  * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
 132  * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
 133  * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
 134  * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
 135  * OTHERWISE.
 136  */
 137
 138 #include <assert.h>
 139 #include <ctype.h>
 140 #include <stdio.h>
 141 #include <stdlib.h>
 142 #include <string.h>
 143 #include <openssl/e_os2.h>
 144 #ifdef OPENSSL_NO_STDIO
 145 #define APPS_WIN16
 146 #endif
 147
 148 /* With IPv6, it looks like Digital has mixed up the proper order of
 149    recursive header file inclusion, resulting in the compiler complaining
 150    that u_int isn't defined, but only if _POSIX_C_SOURCE is defined, which
 151    is needed to have fileno() declared correctly...  So let's define u_int */
 152 #if defined(OPENSSL_SYS_VMS_DECC) && !defined(__U_INT)
 153 #define __U_INT
 154 typedef unsigned int u_int;
 155 #endif
 156
 157 #define USE_SOCKETS
 158 #include "apps.h"
 159 #include <openssl/x509.h>
 160 #include <openssl/ssl.h>
 161 #include <openssl/err.h>
 162 #include <openssl/pem.h>
 163 #include <openssl/rand.h>
 164 #include <openssl/ocsp.h>
 165 #include <openssl/bn.h>
 166 #ifndef OPENSSL_NO_SRP
 167 #include <openssl/srp.h>
 168 #endif
 169 #include "s_apps.h"
 170 #include "timeouts.h"
 171
 172 #if (defined(OPENSSL_SYS_VMS) && __VMS_VER < 70000000)
 173 /* FIONBIO used as a switch to enable ioctl, and that isn't in VMS < 7.0 */
 174 #undef FIONBIO
 175 #endif
 176
 177 #if defined(OPENSSL_SYS_BEOS_R5)
 178 #include <fcntl.h>
 179 #endif
 180
 181 #undef PROG
 182 #define PROG    s_client_main
 183
 184 /*#define SSL_HOST_NAME "www.netscape.com" */
 185 /*#define SSL_HOST_NAME "193.118.187.102" */
 186 #define SSL_HOST_NAME   "localhost"
 187
 188 /* no default cert. */
 189 /*#define TEST_CERT "client.pem" */
 190
 191 #undef BUFSIZZ
 192 #define BUFSIZZ 1024*8
 193
 194 extern int verify_depth;
 195 extern int verify_error;
 196 extern int verify_return_error;
 197 extern int verify_quiet;
 198
 199 #ifdef FIONBIO
 200 static int c_nbio=0;
 201 #endif
 202 static int c_Pause=0;
 203 static int c_debug=0;
 204 #ifndef OPENSSL_NO_TLSEXT
 205 static int c_tlsextdebug=0;
 206 static int c_status_req=0;
 207 #endif
 208 static int c_msg=0;
 209 static int c_showcerts=0;
 210
 211 static char *keymatexportlabel=NULL;
 212 static int keymatexportlen=20;
 213
 214 static void sc_usage(void);
 215 static void print_stuff(BIO *berr,SSL *con,int full);
 216 #ifndef OPENSSL_NO_TLSEXT
 217 static int ocsp_resp_cb(SSL *s, void *arg);
 218 #endif
 219 static BIO *bio_c_out=NULL;
 220 static BIO *bio_c_msg=NULL;
 221 static int c_quiet=0;
 222 static int c_ign_eof=0;
 223 static int c_brief=0;
 224
 225 #ifndef OPENSSL_NO_PSK
 226 /* Default PSK identity and key */
 227 static char *psk_identity="Client_identity";
 228 /*char *psk_key=NULL;  by default PSK is not used */
 229
 230 static unsigned int psk_client_cb(SSL *ssl, const char *hint, char *identity,
 231         unsigned int max_identity_len, unsigned char *psk,
 232         unsigned int max_psk_len)
 233         {
 234         unsigned int psk_len = 0;
 235         int ret;
 236         BIGNUM *bn=NULL;
 237
 238         if (c_debug)
 239                 BIO_printf(bio_c_out, "psk_client_cb\n");
 240         if (!hint)
 241                 {
 242                 /* no ServerKeyExchange message*/
 243                 if (c_debug)
 244                         BIO_printf(bio_c_out,"NULL received PSK identity hint, continuing anyway\n");
 245                 }
 246         else if (c_debug)
 247                 BIO_printf(bio_c_out, "Received PSK identity hint '%s'\n", hint);
 248
 249         /* lookup PSK identity and PSK key based on the given identity hint here */
 250         ret = BIO_snprintf(identity, max_identity_len, "%s", psk_identity);
 251         if (ret < 0 || (unsigned int)ret > max_identity_len)
 252                 goto out_err;
 253         if (c_debug)
 254                 BIO_printf(bio_c_out, "created identity '%s' len=%d\n", identity, ret);
 255         ret=BN_hex2bn(&bn, psk_key);
 256         if (!ret)
 257                 {
 258                 BIO_printf(bio_err,"Could not convert PSK key '%s' to BIGNUM\n", psk_key);
 259                 if (bn)
 260                         BN_free(bn);
 261                 return 0;
 262                 }
 263
 264         if ((unsigned int)BN_num_bytes(bn) > max_psk_len)
 265                 {
 266                 BIO_printf(bio_err,"psk buffer of callback is too small (%d) for key (%d)\n",
 267                         max_psk_len, BN_num_bytes(bn));
 268                 BN_free(bn);
 269                 return 0;
 270                 }
 271
 272         psk_len=BN_bn2bin(bn, psk);
 273         BN_free(bn);
 274         if (psk_len == 0)
 275                 goto out_err;
 276
 277         if (c_debug)
 278                 BIO_printf(bio_c_out, "created PSK len=%d\n", psk_len);
 279
 280         return psk_len;
 281  out_err:
 282         if (c_debug)
 283                 BIO_printf(bio_err, "Error in PSK client callback\n");
 284         return 0;
 285         }
 286 #endif
 287
 288 static void sc_usage(void)
 289         {
 290         BIO_printf(bio_err,"usage: s_client args\n");
 291         BIO_printf(bio_err,"\n");
 292         BIO_printf(bio_err," -host host     - use -connect instead\n");
 293         BIO_printf(bio_err," -port port     - use -connect instead\n");
 294         BIO_printf(bio_err," -connect host:port - who to connect to (default is %s:%s)\n",SSL_HOST_NAME,PORT_STR);
 295         BIO_printf(bio_err," -verify_host host - check peer certificate matches \"host\"\n");
 296         BIO_printf(bio_err," -verify_email email - check peer certificate matches \"email\"\n");
 297         BIO_printf(bio_err," -verify_ip ipaddr - check peer certificate matches \"ipaddr\"\n");
 298
 299         BIO_printf(bio_err," -verify arg   - turn on peer certificate verification\n");
 300         BIO_printf(bio_err," -verify_return_error - return verification errors\n");
 301         BIO_printf(bio_err," -cert arg     - certificate file to use, PEM format assumed\n");
 302         BIO_printf(bio_err," -certform arg - certificate format (PEM or DER) PEM default\n");
 303         BIO_printf(bio_err," -key arg      - Private key file to use, in cert file if\n");
 304         BIO_printf(bio_err,"                 not specified but cert file is.\n");
 305         BIO_printf(bio_err," -keyform arg  - key format (PEM or DER) PEM default\n");
 306         BIO_printf(bio_err," -pass arg     - private key file pass phrase source\n");
 307         BIO_printf(bio_err," -CApath arg   - PEM format directory of CA's\n");
 308         BIO_printf(bio_err," -CAfile arg   - PEM format file of CA's\n");
 309         BIO_printf(bio_err," -reconnect    - Drop and re-make the connection with the same Session-ID\n");
 310         BIO_printf(bio_err," -pause        - sleep(1) after each read(2) and write(2) system call\n");
 311         BIO_printf(bio_err," -prexit       - print session information even on connection failure\n");
 312         BIO_printf(bio_err," -showcerts    - show all certificates in the chain\n");
 313         BIO_printf(bio_err," -debug        - extra output\n");
 314 #ifdef WATT32
 315         BIO_printf(bio_err," -wdebug       - WATT-32 tcp debugging\n");
 316 #endif
 317         BIO_printf(bio_err," -msg          - Show protocol messages\n");
 318         BIO_printf(bio_err," -nbio_test    - more ssl protocol testing\n");
 319         BIO_printf(bio_err," -state        - print the 'ssl' states\n");
 320 #ifdef FIONBIO
 321         BIO_printf(bio_err," -nbio         - Run with non-blocking IO\n");
 322 #endif
 323         BIO_printf(bio_err," -crlf         - convert LF from terminal into CRLF\n");
 324         BIO_printf(bio_err," -quiet        - no s_client output\n");
 325         BIO_printf(bio_err," -ign_eof      - ignore input eof (default when -quiet)\n");
 326         BIO_printf(bio_err," -no_ign_eof   - don't ignore input eof\n");
 327 #ifndef OPENSSL_NO_PSK
 328         BIO_printf(bio_err," -psk_identity arg - PSK identity\n");
 329         BIO_printf(bio_err," -psk arg      - PSK in hex (without 0x)\n");
 330 # ifndef OPENSSL_NO_JPAKE
 331         BIO_printf(bio_err," -jpake arg    - JPAKE secret to use\n");
 332 # endif
 333 #endif
 334 #ifndef OPENSSL_NO_SRP
 335         BIO_printf(bio_err," -srpuser user     - SRP authentification for 'user'\n");
 336         BIO_printf(bio_err," -srppass arg      - password for 'user'\n");
 337         BIO_printf(bio_err," -srp_lateuser     - SRP username into second ClientHello message\n");
 338         BIO_printf(bio_err," -srp_moregroups   - Tolerate other than the known g N values.\n");
 339         BIO_printf(bio_err," -srp_strength int - minimal length in bits for N (default %d).\n",SRP_MINIMAL_N);
 340 #endif
 341         BIO_printf(bio_err," -ssl2         - just use SSLv2\n");
 342 #ifndef OPENSSL_NO_SSL3_METHOD
 343         BIO_printf(bio_err," -ssl3         - just use SSLv3\n");
 344 #endif
 345         BIO_printf(bio_err," -tls1_2       - just use TLSv1.2\n");
 346         BIO_printf(bio_err," -tls1_1       - just use TLSv1.1\n");
 347         BIO_printf(bio_err," -tls1         - just use TLSv1\n");
 348         BIO_printf(bio_err," -dtls1        - just use DTLSv1\n");
 349         BIO_printf(bio_err," -fallback_scsv - send TLS_FALLBACK_SCSV\n");
 350         BIO_printf(bio_err," -mtu          - set the link layer MTU\n");
 351         BIO_printf(bio_err," -no_tls1_2/-no_tls1_1/-no_tls1/-no_ssl3/-no_ssl2 - turn off that protocol\n");
 352         BIO_printf(bio_err," -bugs         - Switch on all SSL implementation bug workarounds\n");
 353         BIO_printf(bio_err," -serverpref   - Use server's cipher preferences (only SSLv2)\n");
 354         BIO_printf(bio_err," -cipher       - preferred cipher to use, use the 'openssl ciphers'\n");
 355         BIO_printf(bio_err,"                 command to see what is available\n");
 356         BIO_printf(bio_err," -starttls prot - use the STARTTLS command before starting TLS\n");
 357         BIO_printf(bio_err,"                 for those protocols that support it, where\n");
 358         BIO_printf(bio_err,"                 'prot' defines which one to assume.  Currently,\n");
 359         BIO_printf(bio_err,"                 only \"smtp\", \"pop3\", \"imap\", \"ftp\" and \"xmpp\"\n");
 360         BIO_printf(bio_err,"                 are supported.\n");
 361 #ifndef OPENSSL_NO_ENGINE
 362         BIO_printf(bio_err," -engine id    - Initialise and use the specified engine\n");
 363 #endif
 364         BIO_printf(bio_err," -rand file%cfile%c...\n", LIST_SEPARATOR_CHAR, LIST_SEPARATOR_CHAR);
 365         BIO_printf(bio_err," -sess_out arg - file to write SSL session to\n");
 366         BIO_printf(bio_err," -sess_in arg  - file to read SSL session from\n");
 367 #ifndef OPENSSL_NO_TLSEXT
 368         BIO_printf(bio_err," -servername host  - Set TLS extension servername in ClientHello\n");
 369         BIO_printf(bio_err," -tlsextdebug      - hex dump of all TLS extensions received\n");
 370         BIO_printf(bio_err," -status           - request certificate status from server\n");
 371         BIO_printf(bio_err," -no_ticket        - disable use of RFC4507bis session tickets\n");
 372         BIO_printf(bio_err," -serverinfo types - send empty ClientHello extensions (comma-separated numbers)\n");
 373 #endif
 374 # ifndef OPENSSL_NO_NEXTPROTONEG
 375         BIO_printf(bio_err," -nextprotoneg arg - enable NPN extension, considering named protocols supported (comma-separated list)\n");
 376 # endif
 377         BIO_printf(bio_err," -alpn arg         - enable ALPN extension, considering named protocols supported (comma-separated list)\n");
 378         BIO_printf(bio_err," -legacy_renegotiation - enable use of legacy renegotiation (dangerous)\n");
 379 #ifndef OPENSSL_NO_SRTP
 380         BIO_printf(bio_err," -use_srtp profiles - Offer SRTP key management with a colon-separated profile list\n");
 381 #endif
 382         BIO_printf(bio_err," -keymatexport label   - Export keying material using label\n");
 383         BIO_printf(bio_err," -keymatexportlen len  - Export len bytes of keying material (default 20)\n");
 384         }
 385
 386 #ifndef OPENSSL_NO_TLSEXT
 387
 388 /* This is a context that we pass to callbacks */
 389 typedef struct tlsextctx_st {
 390    BIO * biodebug;
 391    int ack;
 392 } tlsextctx;
 393
 394
 395 static int MS_CALLBACK ssl_servername_cb(SSL *s, int *ad, void *arg)
 396         {
 397         tlsextctx * p = (tlsextctx *) arg;
 398         const char * hn= SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
 399         if (SSL_get_servername_type(s) != -1)
 400                 p->ack = !SSL_session_reused(s) && hn != NULL;
 401         else
 402                 BIO_printf(bio_err,"Can't use SSL_get_servername\n");
 403
 404         return SSL_TLSEXT_ERR_OK;
 405         }
 406
 407 #ifndef OPENSSL_NO_SRP
 408
 409 /* This is a context that we pass to all callbacks */
 410 typedef struct srp_arg_st
 411         {
 412         char *srppassin;
 413         char *srplogin;
 414         int msg;   /* copy from c_msg */
 415         int debug; /* copy from c_debug */
 416         int amp;   /* allow more groups */
 417         int strength /* minimal size for N */ ;
 418         } SRP_ARG;
 419
 420 #define SRP_NUMBER_ITERATIONS_FOR_PRIME 64
 421
 422 static int srp_Verify_N_and_g(BIGNUM *N, BIGNUM *g)
 423         {
 424         BN_CTX *bn_ctx = BN_CTX_new();
 425         BIGNUM *p = BN_new();
 426         BIGNUM *r = BN_new();
 427         int ret =
 428                 g != NULL && N != NULL && bn_ctx != NULL && BN_is_odd(N) &&
 429                 BN_is_prime_ex(N, SRP_NUMBER_ITERATIONS_FOR_PRIME, bn_ctx, NULL) &&
 430                 p != NULL && BN_rshift1(p, N) &&
 431
 432                 /* p = (N-1)/2 */
 433                 BN_is_prime_ex(p, SRP_NUMBER_ITERATIONS_FOR_PRIME, bn_ctx, NULL) &&
 434                 r != NULL &&
 435
 436                 /* verify g^((N-1)/2) == -1 (mod N) */
 437                 BN_mod_exp(r, g, p, N, bn_ctx) &&
 438                 BN_add_word(r, 1) &&
 439                 BN_cmp(r, N) == 0;
 440
 441         if(r)
 442                 BN_free(r);
 443         if(p)
 444                 BN_free(p);
 445         if(bn_ctx)
 446                 BN_CTX_free(bn_ctx);
 447         return ret;
 448         }
 449
 450 /*-
 451  * This callback is used here for two purposes:
 452  * - extended debugging
 453  * - making some primality tests for unknown groups
 454  * The callback is only called for a non default group.
 455  *
 456  * An application does not need the call back at all if
 457  * only the stanard groups are used.  In real life situations,
 458  * client and server already share well known groups,
 459  * thus there is no need to verify them.
 460  * Furthermore, in case that a server actually proposes a group that
 461  * is not one of those defined in RFC 5054, it is more appropriate
 462  * to add the group to a static list and then compare since
 463  * primality tests are rather cpu consuming.
 464  */
 465
 466 static int MS_CALLBACK ssl_srp_verify_param_cb(SSL *s, void *arg)
 467         {
 468         SRP_ARG *srp_arg = (SRP_ARG *)arg;
 469         BIGNUM *N = NULL, *g = NULL;
 470         if (!(N = SSL_get_srp_N(s)) || !(g = SSL_get_srp_g(s)))
 471                 return 0;
 472         if (srp_arg->debug || srp_arg->msg || srp_arg->amp == 1)
 473                 {
 474                 BIO_printf(bio_err, "SRP parameters:\n");
 475                 BIO_printf(bio_err,"\tN="); BN_print(bio_err,N);
 476                 BIO_printf(bio_err,"\n\tg="); BN_print(bio_err,g);
 477                 BIO_printf(bio_err,"\n");
 478                 }
 479
 480         if (SRP_check_known_gN_param(g,N))
 481                 return 1;
 482
 483         if (srp_arg->amp == 1)
 484                 {
 485                 if (srp_arg->debug)
 486                         BIO_printf(bio_err, "SRP param N and g are not known params, going to check deeper.\n");
 487
 488 /* The srp_moregroups is a real debugging feature.
 489    Implementors should rather add the value to the known ones.
 490    The minimal size has already been tested.
 491 */
 492                 if (BN_num_bits(g) <= BN_BITS && srp_Verify_N_and_g(N,g))
 493                         return 1;
 494                 }
 495         BIO_printf(bio_err, "SRP param N and g rejected.\n");
 496         return 0;
 497         }
 498
 499 #define PWD_STRLEN 1024
 500
 501 static char * MS_CALLBACK ssl_give_srp_client_pwd_cb(SSL *s, void *arg)
 502         {
 503         SRP_ARG *srp_arg = (SRP_ARG *)arg;
 504         char *pass = (char *)OPENSSL_malloc(PWD_STRLEN+1);
 505         PW_CB_DATA cb_tmp;
 506         int l;
 507
 508         cb_tmp.password = (char *)srp_arg->srppassin;
 509         cb_tmp.prompt_info = "SRP user";
 510         if ((l = password_callback(pass, PWD_STRLEN, 0, &cb_tmp))<0)
 511                 {
 512                 BIO_printf (bio_err, "Can't read Password\n");
 513                 OPENSSL_free(pass);
 514                 return NULL;
 515                 }
 516         *(pass+l)= '\0';
 517
 518         return pass;
 519         }
 520
 521 #endif
 522 #ifndef OPENSSL_NO_SRTP
 523         char *srtp_profiles = NULL;
 524 #endif
 525
 526 # ifndef OPENSSL_NO_NEXTPROTONEG
 527 /* This the context that we pass to next_proto_cb */
 528 typedef struct tlsextnextprotoctx_st {
 529         unsigned char *data;
 530         unsigned short len;
 531         int status;
 532 } tlsextnextprotoctx;
 533
 534 static tlsextnextprotoctx next_proto;
 535
 536 static int next_proto_cb(SSL *s, unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *arg)
 537         {
 538         tlsextnextprotoctx *ctx = arg;
 539
 540         if (!c_quiet)
 541                 {
 542                 /* We can assume that |in| is syntactically valid. */
 543                 unsigned i;
 544                 BIO_printf(bio_c_out, "Protocols advertised by server: ");
 545                 for (i = 0; i < inlen; )
 546                         {
 547                         if (i)
 548                                 BIO_write(bio_c_out, ", ", 2);
 549                         BIO_write(bio_c_out, &in[i + 1], in[i]);
 550                         i += in[i] + 1;
 551                         }
 552                 BIO_write(bio_c_out, "\n", 1);
 553                 }
 554
 555         ctx->status = SSL_select_next_proto(out, outlen, in, inlen, ctx->data, ctx->len);
 556         return SSL_TLSEXT_ERR_OK;
 557         }
 558 # endif  /* ndef OPENSSL_NO_NEXTPROTONEG */
 559
 560 static int serverinfo_cli_parse_cb(SSL* s, unsigned int ext_type,
 561                                    const unsigned char* in, size_t inlen,
 562                                    int* al, void* arg)
 563         {
 564         char pem_name[100];
 565         unsigned char ext_buf[4 + 65536];
 566
 567         /* Reconstruct the type/len fields prior to extension data */
 568         ext_buf[0] = ext_type >> 8;
 569         ext_buf[1] = ext_type & 0xFF;
 570         ext_buf[2] = inlen >> 8;
 571         ext_buf[3] = inlen & 0xFF;
 572         memcpy(ext_buf+4, in, inlen);
 573
 574         BIO_snprintf(pem_name, sizeof(pem_name), "SERVERINFO FOR EXTENSION %d",
 575                      ext_type);
 576         PEM_write_bio(bio_c_out, pem_name, "", ext_buf, 4 + inlen);
 577         return 1;
 578         }
 579
 580 #endif
 581
 582 enum
 583 {
 584         PROTO_OFF       = 0,
 585         PROTO_SMTP,
 586         PROTO_POP3,
 587         PROTO_IMAP,
 588         PROTO_FTP,
 589         PROTO_XMPP
 590 };
 591
 592 int MAIN(int, char **);
 593
 594 int MAIN(int argc, char **argv)
 595         {
 596         int build_chain = 0;
 597         SSL *con=NULL;
 598 #ifndef OPENSSL_NO_KRB5
 599         KSSL_CTX *kctx;
 600 #endif
 601         int s,k,width,state=0;
 602         char *cbuf=NULL,*sbuf=NULL,*mbuf=NULL;
 603         int cbuf_len,cbuf_off;
 604         int sbuf_len,sbuf_off;
 605         fd_set readfds,writefds;
 606         short port=PORT;
 607         int full_log=1;
 608         char *host=SSL_HOST_NAME;
 609         char *cert_file=NULL,*key_file=NULL,*chain_file=NULL;
 610         int cert_format = FORMAT_PEM, key_format = FORMAT_PEM;
 611         char *passarg = NULL, *pass = NULL;
 612         X509 *cert = NULL;
 613         EVP_PKEY *key = NULL;
 614         STACK_OF(X509) *chain = NULL;
 615         char *CApath=NULL,*CAfile=NULL;
 616         char *chCApath=NULL,*chCAfile=NULL;
 617         char *vfyCApath=NULL,*vfyCAfile=NULL;
 618         int reconnect=0,badop=0,verify=SSL_VERIFY_NONE;
 619         int crlf=0;
 620         int write_tty,read_tty,write_ssl,read_ssl,tty_on,ssl_pending;
 621         SSL_CTX *ctx=NULL;
 622         int ret=1,in_init=1,i,nbio_test=0;
 623         int starttls_proto = PROTO_OFF;
 624         int prexit = 0;
 625         X509_VERIFY_PARAM *vpm = NULL;
 626         int badarg = 0;
 627         const SSL_METHOD *meth=NULL;
 628         int socket_type=SOCK_STREAM;
 629         BIO *sbio;
 630         char *inrand=NULL;
 631         int mbuf_len=0;
 632         struct timeval timeout, *timeoutp;
 633 #ifndef OPENSSL_NO_ENGINE
 634         char *engine_id=NULL;
 635         char *ssl_client_engine_id=NULL;
 636         ENGINE *ssl_client_engine=NULL;
 637 #endif
 638         ENGINE *e=NULL;
 639 #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE) || defined(OPENSSL_SYS_BEOS_R5)
 640         struct timeval tv;
 641 #if defined(OPENSSL_SYS_BEOS_R5)
 642         int stdin_set = 0;
 643 #endif
 644 #endif
 645 #ifndef OPENSSL_NO_TLSEXT
 646         char *servername = NULL;
 647         tlsextctx tlsextcbp =
 648         {NULL,0};
 649 # ifndef OPENSSL_NO_NEXTPROTONEG
 650         const char *next_proto_neg_in = NULL;
 651 # endif
 652         const char *alpn_in = NULL;
 653 # define MAX_SI_TYPES 100
 654         unsigned short serverinfo_types[MAX_SI_TYPES];
 655         int serverinfo_types_count = 0;
 656 #endif
 657         char *sess_in = NULL;
 658         char *sess_out = NULL;
 659         struct sockaddr peer;
 660         int peerlen = sizeof(peer);
 661         int fallback_scsv = 0;
 662         int enable_timeouts = 0 ;
 663         long socket_mtu = 0;
 664 #ifndef OPENSSL_NO_JPAKE
 665 static char *jpake_secret = NULL;
 666 #define no_jpake !jpake_secret
 667 #else
 668 #define no_jpake 1
 669 #endif
 670 #ifndef OPENSSL_NO_SRP
 671         char * srppass = NULL;
 672         int srp_lateuser = 0;
 673         SRP_ARG srp_arg = {NULL,NULL,0,0,0,1024};
 674 #endif
 675         SSL_EXCERT *exc = NULL;
 676
 677         SSL_CONF_CTX *cctx = NULL;
 678         STACK_OF(OPENSSL_STRING) *ssl_args = NULL;
 679
 680         char *crl_file = NULL;
 681         int crl_format = FORMAT_PEM;
 682         int crl_download = 0;
 683         STACK_OF(X509_CRL) *crls = NULL;
 684
 685         meth=SSLv23_client_method();
 686
 687         apps_startup();
 688         c_Pause=0;
 689         c_quiet=0;
 690         c_ign_eof=0;
 691         c_debug=0;
 692         c_msg=0;
 693         c_showcerts=0;
 694
 695         if (bio_err == NULL)
 696                 bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
 697
 698         if (!load_config(bio_err, NULL))
 699                 goto end;
 700
 701         cctx = SSL_CONF_CTX_new();
 702         if (!cctx)
 703                 goto end;
 704         SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_CLIENT);
 705         SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_CMDLINE);
 706
 707         if (    ((cbuf=OPENSSL_malloc(BUFSIZZ)) == NULL) ||
 708                 ((sbuf=OPENSSL_malloc(BUFSIZZ)) == NULL) ||
 709                 ((mbuf=OPENSSL_malloc(BUFSIZZ)) == NULL))
 710                 {
 711                 BIO_printf(bio_err,"out of memory\n");
 712                 goto end;
 713                 }
 714
 715         verify_depth=0;
 716         verify_error=X509_V_OK;
 717 #ifdef FIONBIO
 718         c_nbio=0;
 719 #endif
 720
 721         argc--;
 722         argv++;
 723         while (argc >= 1)
 724                 {
 725                 if      (strcmp(*argv,"-host") == 0)
 726                         {
 727                         if (--argc < 1) goto bad;
 728                         host= *(++argv);
 729                         }
 730                 else if (strcmp(*argv,"-port") == 0)
 731                         {
 732                         if (--argc < 1) goto bad;
 733                         port=atoi(*(++argv));
 734                         if (port == 0) goto bad;
 735                         }
 736                 else if (strcmp(*argv,"-connect") == 0)
 737                         {
 738                         if (--argc < 1) goto bad;
 739                         if (!extract_host_port(*(++argv),&host,NULL,&port))
 740                                 goto bad;
 741                         }
 742                 else if (strcmp(*argv,"-verify") == 0)
 743                         {
 744                         verify=SSL_VERIFY_PEER;
 745                         if (--argc < 1) goto bad;
 746                         verify_depth=atoi(*(++argv));
 747                         if (!c_quiet)
 748                                 BIO_printf(bio_err,"verify depth is %d\n",verify_depth);
 749                         }
 750                 else if (strcmp(*argv,"-cert") == 0)
 751                         {
 752                         if (--argc < 1) goto bad;
 753                         cert_file= *(++argv);
 754                         }
 755                 else if (strcmp(*argv,"-CRL") == 0)
 756                         {
 757                         if (--argc < 1) goto bad;
 758                         crl_file= *(++argv);
 759                         }
 760                 else if (strcmp(*argv,"-crl_download") == 0)
 761                         crl_download = 1;
 762                 else if (strcmp(*argv,"-sess_out") == 0)
 763                         {
 764                         if (--argc < 1) goto bad;
 765                         sess_out = *(++argv);
 766                         }
 767                 else if (strcmp(*argv,"-sess_in") == 0)
 768                         {
 769                         if (--argc < 1) goto bad;
 770                         sess_in = *(++argv);
 771                         }
 772                 else if (strcmp(*argv,"-certform") == 0)
 773                         {
 774                         if (--argc < 1) goto bad;
 775                         cert_format = str2fmt(*(++argv));
 776                         }
 777                 else if (strcmp(*argv,"-CRLform") == 0)
 778                         {
 779                         if (--argc < 1) goto bad;
 780                         crl_format = str2fmt(*(++argv));
 781                         }
 782                 else if (args_verify(&argv, &argc, &badarg, bio_err, &vpm))
 783                         {
 784                         if (badarg)
 785                                 goto bad;
 786                         continue;
 787                         }
 788                 else if (strcmp(*argv,"-verify_return_error") == 0)
 789                         verify_return_error = 1;
 790                 else if (strcmp(*argv,"-verify_quiet") == 0)
 791                         verify_quiet = 1;
 792                 else if (strcmp(*argv,"-brief") == 0)
 793                         {
 794                         c_brief = 1;
 795                         verify_quiet = 1;
 796                         c_quiet = 1;
 797                         }
 798                 else if (args_excert(&argv, &argc, &badarg, bio_err, &exc))
 799                         {
 800                         if (badarg)
 801                                 goto bad;
 802                         continue;
 803                         }
 804                 else if (args_ssl(&argv, &argc, cctx, &badarg, bio_err, &ssl_args))
 805                         {
 806                         if (badarg)
 807                                 goto bad;
 808                         continue;
 809                         }
 810                 else if (strcmp(*argv,"-prexit") == 0)
 811                         prexit=1;
 812                 else if (strcmp(*argv,"-crlf") == 0)
 813                         crlf=1;
 814                 else if (strcmp(*argv,"-quiet") == 0)
 815                         {
 816                         c_quiet=1;
 817                         c_ign_eof=1;
 818                         }
 819                 else if (strcmp(*argv,"-ign_eof") == 0)
 820                         c_ign_eof=1;
 821                 else if (strcmp(*argv,"-no_ign_eof") == 0)
 822                         c_ign_eof=0;
 823                 else if (strcmp(*argv,"-pause") == 0)
 824                         c_Pause=1;
 825                 else if (strcmp(*argv,"-debug") == 0)
 826                         c_debug=1;
 827 #ifndef OPENSSL_NO_TLSEXT
 828                 else if (strcmp(*argv,"-tlsextdebug") == 0)
 829                         c_tlsextdebug=1;
 830                 else if (strcmp(*argv,"-status") == 0)
 831                         c_status_req=1;
 832 #endif
 833 #ifdef WATT32
 834                 else if (strcmp(*argv,"-wdebug") == 0)
 835                         dbug_init();
 836 #endif
 837                 else if (strcmp(*argv,"-msg") == 0)
 838                         c_msg=1;
 839                 else if (strcmp(*argv,"-msgfile") == 0)
 840                         {
 841                         if (--argc < 1) goto bad;
 842                         bio_c_msg = BIO_new_file(*(++argv), "w");
 843                         }
 844 #ifndef OPENSSL_NO_SSL_TRACE
 845                 else if (strcmp(*argv,"-trace") == 0)
 846                         c_msg=2;
 847 #endif
 848                 else if (strcmp(*argv,"-showcerts") == 0)
 849                         c_showcerts=1;
 850                 else if (strcmp(*argv,"-nbio_test") == 0)
 851                         nbio_test=1;
 852                 else if (strcmp(*argv,"-state") == 0)
 853                         state=1;
 854 #ifndef OPENSSL_NO_PSK
 855                 else if (strcmp(*argv,"-psk_identity") == 0)
 856                         {
 857                         if (--argc < 1) goto bad;
 858                         psk_identity=*(++argv);
 859                         }
 860                 else if (strcmp(*argv,"-psk") == 0)
 861                         {
 862                         size_t j;
 863
 864                         if (--argc < 1) goto bad;
 865                         psk_key=*(++argv);
 866                         for (j = 0; j < strlen(psk_key); j++)
 867                                 {
 868                                 if (isxdigit((unsigned char)psk_key[j]))
 869                                         continue;
 870                                 BIO_printf(bio_err,"Not a hex number '%s'\n",*argv);
 871                                 goto bad;
 872                                 }
 873                         }
 874 #endif
 875 #ifndef OPENSSL_NO_SRP
 876                 else if (strcmp(*argv,"-srpuser") == 0)
 877                         {
 878                         if (--argc < 1) goto bad;
 879                         srp_arg.srplogin= *(++argv);
 880                         meth=TLSv1_client_method();
 881                         }
 882                 else if (strcmp(*argv,"-srppass") == 0)
 883                         {
 884                         if (--argc < 1) goto bad;
 885                         srppass= *(++argv);
 886                         meth=TLSv1_client_method();
 887                         }
 888                 else if (strcmp(*argv,"-srp_strength") == 0)
 889                         {
 890                         if (--argc < 1) goto bad;
 891                         srp_arg.strength=atoi(*(++argv));
 892                         BIO_printf(bio_err,"SRP minimal length for N is %d\n",srp_arg.strength);
 893                         meth=TLSv1_client_method();
 894                         }
 895                 else if (strcmp(*argv,"-srp_lateuser") == 0)
 896                         {
 897                         srp_lateuser= 1;
 898                         meth=TLSv1_client_method();
 899                         }
 900                 else if (strcmp(*argv,"-srp_moregroups") == 0)
 901                         {
 902                         srp_arg.amp=1;
 903                         meth=TLSv1_client_method();
 904                         }
 905 #endif
 906 #ifndef OPENSSL_NO_SSL2
 907                 else if (strcmp(*argv,"-ssl2") == 0)
 908                         meth=SSLv2_client_method();
 909 #endif
 910 #ifndef OPENSSL_NO_SSL3_METHOD
 911                 else if (strcmp(*argv,"-ssl3") == 0)
 912                         meth=SSLv3_client_method();
 913 #endif
 914 #ifndef OPENSSL_NO_TLS1
 915                 else if (strcmp(*argv,"-tls1_2") == 0)
 916                         meth=TLSv1_2_client_method();
 917                 else if (strcmp(*argv,"-tls1_1") == 0)
 918                         meth=TLSv1_1_client_method();
 919                 else if (strcmp(*argv,"-tls1") == 0)
 920                         meth=TLSv1_client_method();
 921 #endif
 922 #ifndef OPENSSL_NO_DTLS1
 923                 else if (strcmp(*argv,"-dtls") == 0)
 924                         {
 925                         meth=DTLS_client_method();
 926                         socket_type=SOCK_DGRAM;
 927                         }
 928                 else if (strcmp(*argv,"-dtls1") == 0)
 929                         {
 930                         meth=DTLSv1_client_method();
 931                         socket_type=SOCK_DGRAM;
 932                         }
 933                 else if (strcmp(*argv,"-dtls1_2") == 0)
 934                         {
 935                         meth=DTLSv1_2_client_method();
 936                         socket_type=SOCK_DGRAM;
 937                         }
 938                 else if (strcmp(*argv,"-timeout") == 0)
 939                         enable_timeouts=1;
 940                 else if (strcmp(*argv,"-mtu") == 0)
 941                         {
 942                         if (--argc < 1) goto bad;
 943                         socket_mtu = atol(*(++argv));
 944                         }
 945 #endif
 946                 else if (strcmp(*argv,"-fallback_scsv") == 0)
 947                         {
 948                         fallback_scsv = 1;
 949                         }
 950                 else if (strcmp(*argv,"-keyform") == 0)
 951                         {
 952                         if (--argc < 1) goto bad;
 953                         key_format = str2fmt(*(++argv));
 954                         }
 955                 else if (strcmp(*argv,"-pass") == 0)
 956                         {
 957                         if (--argc < 1) goto bad;
 958                         passarg = *(++argv);
 959                         }
 960                 else if (strcmp(*argv,"-cert_chain") == 0)
 961                         {
 962                         if (--argc < 1) goto bad;
 963                         chain_file= *(++argv);
 964                         }
 965                 else if (strcmp(*argv,"-key") == 0)
 966                         {
 967                         if (--argc < 1) goto bad;
 968                         key_file= *(++argv);
 969                         }
 970                 else if (strcmp(*argv,"-reconnect") == 0)
 971                         {
 972                         reconnect=5;
 973                         }
 974                 else if (strcmp(*argv,"-CApath") == 0)
 975                         {
 976                         if (--argc < 1) goto bad;
 977                         CApath= *(++argv);
 978                         }
 979                 else if (strcmp(*argv,"-chainCApath") == 0)
 980                         {
 981                         if (--argc < 1) goto bad;
 982                         chCApath= *(++argv);
 983                         }
 984                 else if (strcmp(*argv,"-verifyCApath") == 0)
 985                         {
 986                         if (--argc < 1) goto bad;
 987                         vfyCApath= *(++argv);
 988                         }
 989                 else if (strcmp(*argv,"-build_chain") == 0)
 990                         build_chain = 1;
 991                 else if (strcmp(*argv,"-CAfile") == 0)
 992                         {
 993                         if (--argc < 1) goto bad;
 994                         CAfile= *(++argv);
 995                         }
 996                 else if (strcmp(*argv,"-chainCAfile") == 0)
 997                         {
 998                         if (--argc < 1) goto bad;
 999                         chCAfile= *(++argv);
1000                         }
1001                 else if (strcmp(*argv,"-verifyCAfile") == 0)
1002                         {
1003                         if (--argc < 1) goto bad;
1004                         vfyCAfile= *(++argv);
1005                         }
1006 #ifndef OPENSSL_NO_TLSEXT
1007 # ifndef OPENSSL_NO_NEXTPROTONEG
1008                 else if (strcmp(*argv,"-nextprotoneg") == 0)
1009                         {
1010                         if (--argc < 1) goto bad;
1011                         next_proto_neg_in = *(++argv);
1012                         }
1013 # endif
1014                 else if (strcmp(*argv,"-alpn") == 0)
1015                         {
1016                         if (--argc < 1) goto bad;
1017                         alpn_in = *(++argv);
1018                         }
1019                 else if (strcmp(*argv,"-serverinfo") == 0)
1020                         {
1021                         char *c;
1022                         int start = 0;
1023                         int len;
1024
1025                         if (--argc < 1) goto bad;
1026                         c = *(++argv);
1027                         serverinfo_types_count = 0;
1028                         len = strlen(c);
1029                         for (i = 0; i <= len; ++i)
1030                                 {
1031                                 if (i == len || c[i] == ',')
1032                                         {
1033                                         serverinfo_types[serverinfo_types_count]
1034                                             = atoi(c+start);
1035                                         serverinfo_types_count++;
1036                                         start = i+1;
1037                                         }
1038                                 if (serverinfo_types_count == MAX_SI_TYPES)
1039                                         break;
1040                                 }
1041                         }
1042 #endif
1043 #ifdef FIONBIO
1044                 else if (strcmp(*argv,"-nbio") == 0)
1045                         { c_nbio=1; }
1046 #endif
1047                 else if (strcmp(*argv,"-starttls") == 0)
1048                         {
1049                         if (--argc < 1) goto bad;
1050                         ++argv;
1051                         if (strcmp(*argv,"smtp") == 0)
1052                                 starttls_proto = PROTO_SMTP;
1053                         else if (strcmp(*argv,"pop3") == 0)
1054                                 starttls_proto = PROTO_POP3;
1055                         else if (strcmp(*argv,"imap") == 0)
1056                                 starttls_proto = PROTO_IMAP;
1057                         else if (strcmp(*argv,"ftp") == 0)
1058                                 starttls_proto = PROTO_FTP;
1059                         else if (strcmp(*argv, "xmpp") == 0)
1060                                 starttls_proto = PROTO_XMPP;
1061                         else
1062                                 goto bad;
1063                         }
1064 #ifndef OPENSSL_NO_ENGINE
1065                 else if (strcmp(*argv,"-engine") == 0)
1066                         {
1067                         if (--argc < 1) goto bad;
1068                         engine_id = *(++argv);
1069                         }
1070                 else if (strcmp(*argv,"-ssl_client_engine") == 0)
1071                         {
1072                         if (--argc < 1) goto bad;
1073                         ssl_client_engine_id = *(++argv);
1074                         }
1075 #endif
1076                 else if (strcmp(*argv,"-rand") == 0)
1077                         {
1078                         if (--argc < 1) goto bad;
1079                         inrand= *(++argv);
1080                         }
1081 #ifndef OPENSSL_NO_TLSEXT
1082                 else if (strcmp(*argv,"-servername") == 0)
1083                         {
1084                         if (--argc < 1) goto bad;
1085                         servername= *(++argv);
1086                         /* meth=TLSv1_client_method(); */
1087                         }
1088 #endif
1089 #ifndef OPENSSL_NO_JPAKE
1090                 else if (strcmp(*argv,"-jpake") == 0)
1091                         {
1092                         if (--argc < 1) goto bad;
1093                         jpake_secret = *++argv;
1094                         }
1095 #endif
1096 #ifndef OPENSSL_NO_SRTP
1097                 else if (strcmp(*argv,"-use_srtp") == 0)
1098                         {
1099                         if (--argc < 1) goto bad;
1100                         srtp_profiles = *(++argv);
1101                         }
1102 #endif
1103                 else if (strcmp(*argv,"-keymatexport") == 0)
1104                         {
1105                         if (--argc < 1) goto bad;
1106                         keymatexportlabel= *(++argv);
1107                         }
1108                 else if (strcmp(*argv,"-keymatexportlen") == 0)
1109                         {
1110                         if (--argc < 1) goto bad;
1111                         keymatexportlen=atoi(*(++argv));
1112                         if (keymatexportlen == 0) goto bad;
1113                         }
1114                 else
1115                         {
1116                         BIO_printf(bio_err,"unknown option %s\n",*argv);
1117                         badop=1;
1118                         break;
1119                         }
1120                 argc--;
1121                 argv++;
1122                 }
1123         if (badop)
1124                 {
1125 bad:
1126                 sc_usage();
1127                 goto end;
1128                 }
1129
1130 #if !defined(OPENSSL_NO_JPAKE) && !defined(OPENSSL_NO_PSK)
1131         if (jpake_secret)
1132                 {
1133                 if (psk_key)
1134                         {
1135                         BIO_printf(bio_err,
1136                                    "Can't use JPAKE and PSK together\n");
1137                         goto end;
1138                         }
1139                 psk_identity = "JPAKE";
1140                 }
1141 #endif
1142
1143         OpenSSL_add_ssl_algorithms();
1144         SSL_load_error_strings();
1145
1146 #if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
1147         next_proto.status = -1;
1148         if (next_proto_neg_in)
1149                 {
1150                 next_proto.data = next_protos_parse(&next_proto.len, next_proto_neg_in);
1151                 if (next_proto.data == NULL)
1152                         {
1153                         BIO_printf(bio_err, "Error parsing -nextprotoneg argument\n");
1154                         goto end;
1155                         }
1156                 }
1157         else
1158                 next_proto.data = NULL;
1159 #endif
1160
1161 #ifndef OPENSSL_NO_ENGINE
1162         e = setup_engine(bio_err, engine_id, 1);
1163         if (ssl_client_engine_id)
1164                 {
1165                 ssl_client_engine = ENGINE_by_id(ssl_client_engine_id);
1166                 if (!ssl_client_engine)
1167                         {
1168                         BIO_printf(bio_err,
1169                                         "Error getting client auth engine\n");
1170                         goto end;
1171                         }
1172                 }
1173
1174 #endif
1175         if (!app_passwd(bio_err, passarg, NULL, &pass, NULL))
1176                 {
1177                 BIO_printf(bio_err, "Error getting password\n");
1178                 goto end;
1179                 }
1180
1181         if (key_file == NULL)
1182                 key_file = cert_file;
1183
1184
1185         if (key_file)
1186
1187                 {
1188
1189                 key = load_key(bio_err, key_file, key_format, 0, pass, e,
1190                                "client certificate private key file");
1191                 if (!key)
1192                         {
1193                         ERR_print_errors(bio_err);
1194                         goto end;
1195                         }
1196
1197                 }
1198
1199         if (cert_file)
1200
1201                 {
1202                 cert = load_cert(bio_err,cert_file,cert_format,
1203                                 NULL, e, "client certificate file");
1204
1205                 if (!cert)
1206                         {
1207                         ERR_print_errors(bio_err);
1208                         goto end;
1209                         }
1210                 }
1211
1212         if (chain_file)
1213                 {
1214                 chain = load_certs(bio_err, chain_file,FORMAT_PEM,
1215                                         NULL, e, "client certificate chain");
1216                 if (!chain)
1217                         goto end;
1218                 }
1219
1220         if (crl_file)
1221                 {
1222                 X509_CRL *crl;
1223                 crl = load_crl(crl_file, crl_format);
1224                 if (!crl)
1225                         {
1226                         BIO_puts(bio_err, "Error loading CRL\n");
1227                         ERR_print_errors(bio_err);
1228                         goto end;
1229                         }
1230                 crls = sk_X509_CRL_new_null();
1231                 if (!crls || !sk_X509_CRL_push(crls, crl))
1232                         {
1233                         BIO_puts(bio_err, "Error adding CRL\n");
1234                         ERR_print_errors(bio_err);
1235                         X509_CRL_free(crl);
1236                         goto end;
1237                         }
1238                 }
1239
1240         if (!load_excert(&exc, bio_err))
1241                 goto end;
1242
1243         if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL
1244                 && !RAND_status())
1245                 {
1246                 BIO_printf(bio_err,"warning, not much extra random data, consider using the -rand option\n");
1247                 }
1248         if (inrand != NULL)
1249                 BIO_printf(bio_err,"%ld semi-random bytes loaded\n",
1250                         app_RAND_load_files(inrand));
1251
1252         if (bio_c_out == NULL)
1253                 {
1254                 if (c_quiet && !c_debug)
1255                         {
1256                         bio_c_out=BIO_new(BIO_s_null());
1257                         if (c_msg && !bio_c_msg)
1258                                 bio_c_msg=BIO_new_fp(stdout,BIO_NOCLOSE);
1259                         }
1260                 else
1261                         {
1262                         if (bio_c_out == NULL)
1263                                 bio_c_out=BIO_new_fp(stdout,BIO_NOCLOSE);
1264                         }
1265                 }
1266
1267 #ifndef OPENSSL_NO_SRP
1268         if(!app_passwd(bio_err, srppass, NULL, &srp_arg.srppassin, NULL))
1269                 {
1270                 BIO_printf(bio_err, "Error getting password\n");
1271                 goto end;
1272                 }
1273 #endif
1274
1275         ctx=SSL_CTX_new(meth);
1276         if (ctx == NULL)
1277                 {
1278                 ERR_print_errors(bio_err);
1279                 goto end;
1280                 }
1281
1282         if (vpm)
1283                 SSL_CTX_set1_param(ctx, vpm);
1284
1285         if (!args_ssl_call(ctx, bio_err, cctx, ssl_args, 1, no_jpake))
1286                 {
1287                 ERR_print_errors(bio_err);
1288                 goto end;
1289                 }
1290
1291         if (!ssl_load_stores(ctx, vfyCApath, vfyCAfile, chCApath, chCAfile,
1292                                                 crls, crl_download))
1293                 {
1294                 BIO_printf(bio_err, "Error loading store locations\n");
1295                 ERR_print_errors(bio_err);
1296                 goto end;
1297                 }
1298
1299 #ifndef OPENSSL_NO_ENGINE
1300         if (ssl_client_engine)
1301                 {
1302                 if (!SSL_CTX_set_client_cert_engine(ctx, ssl_client_engine))
1303                         {
1304                         BIO_puts(bio_err, "Error setting client auth engine\n");
1305                         ERR_print_errors(bio_err);
1306                         ENGINE_free(ssl_client_engine);
1307                         goto end;
1308                         }
1309                 ENGINE_free(ssl_client_engine);
1310                 }
1311 #endif
1312
1313 #ifndef OPENSSL_NO_PSK
1314 #ifdef OPENSSL_NO_JPAKE
1315         if (psk_key != NULL)
1316 #else
1317         if (psk_key != NULL || jpake_secret)
1318 #endif
1319                 {
1320                 if (c_debug)
1321                         BIO_printf(bio_c_out, "PSK key given or JPAKE in use, setting client callback\n");
1322                 SSL_CTX_set_psk_client_callback(ctx, psk_client_cb);
1323                 }
1324 #endif
1325 #ifndef OPENSSL_NO_SRTP
1326         if (srtp_profiles != NULL)
1327                 SSL_CTX_set_tlsext_use_srtp(ctx, srtp_profiles);
1328 #endif
1329         if (exc) ssl_ctx_set_excert(ctx, exc);
1330         /* DTLS: partial reads end up discarding unread UDP bytes :-(
1331          * Setting read ahead solves this problem.
1332          */
1333         if (socket_type == SOCK_DGRAM) SSL_CTX_set_read_ahead(ctx, 1);
1334
1335 #if !defined(OPENSSL_NO_TLSEXT)
1336 # if !defined(OPENSSL_NO_NEXTPROTONEG)
1337         if (next_proto.data)
1338                 SSL_CTX_set_next_proto_select_cb(ctx, next_proto_cb, &next_proto);
1339 # endif
1340         if (alpn_in)
1341                 {
1342                 unsigned short alpn_len;
1343                 unsigned char *alpn = next_protos_parse(&alpn_len, alpn_in);
1344
1345                 if (alpn == NULL)
1346                         {
1347                         BIO_printf(bio_err, "Error parsing -alpn argument\n");
1348                         goto end;
1349                         }
1350                 SSL_CTX_set_alpn_protos(ctx, alpn, alpn_len);
1351                 OPENSSL_free(alpn);
1352                 }
1353 #endif
1354 #ifndef OPENSSL_NO_TLSEXT
1355                 for (i = 0; i < serverinfo_types_count; i++)
1356                         {
1357                         SSL_CTX_add_client_custom_ext(ctx,
1358                                                       serverinfo_types[i],
1359                                                       NULL, NULL, NULL,
1360                                                       serverinfo_cli_parse_cb,
1361                                                       NULL);
1362                         }
1363 #endif
1364
1365         if (state) SSL_CTX_set_info_callback(ctx,apps_ssl_info_callback);
1366 #if 0
1367         else
1368                 SSL_CTX_set_cipher_list(ctx,getenv("SSL_CIPHER"));
1369 #endif
1370
1371         SSL_CTX_set_verify(ctx,verify,verify_callback);
1372
1373         if ((!SSL_CTX_load_verify_locations(ctx,CAfile,CApath)) ||
1374                 (!SSL_CTX_set_default_verify_paths(ctx)))
1375                 {
1376                 /* BIO_printf(bio_err,"error setting default verify locations\n"); */
1377                 ERR_print_errors(bio_err);
1378                 /* goto end; */
1379                 }
1380
1381         ssl_ctx_add_crls(ctx, crls, crl_download);
1382         if (!set_cert_key_stuff(ctx,cert,key,chain,build_chain))
1383                 goto end;
1384
1385 #ifndef OPENSSL_NO_TLSEXT
1386         if (servername != NULL)
1387                 {
1388                 tlsextcbp.biodebug = bio_err;
1389                 SSL_CTX_set_tlsext_servername_callback(ctx, ssl_servername_cb);
1390                 SSL_CTX_set_tlsext_servername_arg(ctx, &tlsextcbp);
1391                 }
1392 #ifndef OPENSSL_NO_SRP
1393         if (srp_arg.srplogin)
1394                 {
1395                 if (!srp_lateuser && !SSL_CTX_set_srp_username(ctx, srp_arg.srplogin))
1396                         {
1397                         BIO_printf(bio_err,"Unable to set SRP username\n");
1398                         goto end;
1399                         }
1400                 srp_arg.msg = c_msg;
1401                 srp_arg.debug = c_debug ;
1402                 SSL_CTX_set_srp_cb_arg(ctx,&srp_arg);
1403                 SSL_CTX_set_srp_client_pwd_callback(ctx, ssl_give_srp_client_pwd_cb);
1404                 SSL_CTX_set_srp_strength(ctx, srp_arg.strength);
1405                 if (c_msg || c_debug || srp_arg.amp == 0)
1406                         SSL_CTX_set_srp_verify_param_callback(ctx, ssl_srp_verify_param_cb);
1407                 }
1408
1409 #endif
1410 #endif
1411
1412         con=SSL_new(ctx);
1413         if (sess_in)
1414                 {
1415                 SSL_SESSION *sess;
1416                 BIO *stmp = BIO_new_file(sess_in, "r");
1417                 if (!stmp)
1418                         {
1419                         BIO_printf(bio_err, "Can't open session file %s\n",
1420                                                 sess_in);
1421                         ERR_print_errors(bio_err);
1422                         goto end;
1423                         }
1424                 sess = PEM_read_bio_SSL_SESSION(stmp, NULL, 0, NULL);
1425                 BIO_free(stmp);
1426                 if (!sess)
1427                         {
1428                         BIO_printf(bio_err, "Can't open session file %s\n",
1429                                                 sess_in);
1430                         ERR_print_errors(bio_err);
1431                         goto end;
1432                         }
1433                 SSL_set_session(con, sess);
1434                 SSL_SESSION_free(sess);
1435                 }
1436
1437         if (fallback_scsv)
1438                 SSL_set_mode(con, SSL_MODE_SEND_FALLBACK_SCSV);
1439
1440 #ifndef OPENSSL_NO_TLSEXT
1441         if (servername != NULL)
1442                 {
1443                 if (!SSL_set_tlsext_host_name(con,servername))
1444                         {
1445                         BIO_printf(bio_err,"Unable to set TLS servername extension.\n");
1446                         ERR_print_errors(bio_err);
1447                         goto end;
1448                         }
1449                 }
1450 #endif
1451 #ifndef OPENSSL_NO_KRB5
1452         if (con  &&  (kctx = kssl_ctx_new()) != NULL)
1453                 {
1454                 SSL_set0_kssl_ctx(con, kctx);
1455                 kssl_ctx_setstring(kctx, KSSL_SERVER, host);
1456                 }
1457 #endif  /* OPENSSL_NO_KRB5  */
1458 /*      SSL_set_cipher_list(con,"RC4-MD5"); */
1459 #if 0
1460 #ifdef TLSEXT_TYPE_opaque_prf_input
1461         SSL_set_tlsext_opaque_prf_input(con, "Test client", 11);
1462 #endif
1463 #endif
1464
1465 re_start:
1466
1467         if (init_client(&s,host,port,socket_type) == 0)
1468                 {
1469                 BIO_printf(bio_err,"connect:errno=%d\n",get_last_socket_error());
1470                 SHUTDOWN(s);
1471                 goto end;
1472                 }
1473         BIO_printf(bio_c_out,"CONNECTED(%08X)\n",s);
1474
1475 #ifdef FIONBIO
1476         if (c_nbio)
1477                 {
1478                 unsigned long l=1;
1479                 BIO_printf(bio_c_out,"turning on non blocking io\n");
1480                 if (BIO_socket_ioctl(s,FIONBIO,&l) < 0)
1481                         {
1482                         ERR_print_errors(bio_err);
1483                         goto end;
1484                         }
1485                 }
1486 #endif
1487         if (c_Pause & 0x01) SSL_set_debug(con, 1);
1488
1489         if (socket_type == SOCK_DGRAM)
1490                 {
1491
1492                 sbio=BIO_new_dgram(s,BIO_NOCLOSE);
1493                 if (getsockname(s, &peer, (void *)&peerlen) < 0)
1494                         {
1495                         BIO_printf(bio_err, "getsockname:errno=%d\n",
1496                                 get_last_socket_error());
1497                         SHUTDOWN(s);
1498                         goto end;
1499                         }
1500
1501                 (void)BIO_ctrl_set_connected(sbio, 1, &peer);
1502
1503                 if (enable_timeouts)
1504                         {
1505                         timeout.tv_sec = 0;
1506                         timeout.tv_usec = DGRAM_RCV_TIMEOUT;
1507                         BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_RECV_TIMEOUT, 0, &timeout);
1508
1509                         timeout.tv_sec = 0;
1510                         timeout.tv_usec = DGRAM_SND_TIMEOUT;
1511                         BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_SEND_TIMEOUT, 0, &timeout);
1512                         }
1513
1514                 if (socket_mtu)
1515                         {
1516                         if(socket_mtu < DTLS_get_link_min_mtu(con))
1517                                 {
1518                                 BIO_printf(bio_err,"MTU too small. Must be at least %ld\n",
1519                                         DTLS_get_link_min_mtu(con));
1520                                 BIO_free(sbio);
1521                                 goto shut;
1522                                 }
1523                         SSL_set_options(con, SSL_OP_NO_QUERY_MTU);
1524                         if(!DTLS_set_link_mtu(con, socket_mtu))
1525                                 {
1526                                 BIO_printf(bio_err, "Failed to set MTU\n");
1527                                 BIO_free(sbio);
1528                                 goto shut;
1529                                 }
1530                         }
1531                 else
1532                         /* want to do MTU discovery */
1533                         BIO_ctrl(sbio, BIO_CTRL_DGRAM_MTU_DISCOVER, 0, NULL);
1534                 }
1535         else
1536                 sbio=BIO_new_socket(s,BIO_NOCLOSE);
1537
1538         if (nbio_test)
1539                 {
1540                 BIO *test;
1541
1542                 test=BIO_new(BIO_f_nbio_test());
1543                 sbio=BIO_push(test,sbio);
1544                 }
1545
1546         if (c_debug)
1547                 {
1548                 SSL_set_debug(con, 1);
1549                 BIO_set_callback(sbio,bio_dump_callback);
1550                 BIO_set_callback_arg(sbio,(char *)bio_c_out);
1551                 }
1552         if (c_msg)
1553                 {
1554 #ifndef OPENSSL_NO_SSL_TRACE
1555                 if (c_msg == 2)
1556                         SSL_set_msg_callback(con, SSL_trace);
1557                 else
1558 #endif
1559                         SSL_set_msg_callback(con, msg_cb);
1560                 SSL_set_msg_callback_arg(con, bio_c_msg ? bio_c_msg : bio_c_out);
1561                 }
1562 #ifndef OPENSSL_NO_TLSEXT
1563         if (c_tlsextdebug)
1564                 {
1565                 SSL_set_tlsext_debug_callback(con, tlsext_cb);
1566                 SSL_set_tlsext_debug_arg(con, bio_c_out);
1567                 }
1568         if (c_status_req)
1569                 {
1570                 SSL_set_tlsext_status_type(con, TLSEXT_STATUSTYPE_ocsp);
1571                 SSL_CTX_set_tlsext_status_cb(ctx, ocsp_resp_cb);
1572                 SSL_CTX_set_tlsext_status_arg(ctx, bio_c_out);
1573 #if 0
1574 {
1575 STACK_OF(OCSP_RESPID) *ids = sk_OCSP_RESPID_new_null();
1576 OCSP_RESPID *id = OCSP_RESPID_new();
1577 id->value.byKey = ASN1_OCTET_STRING_new();
1578 id->type = V_OCSP_RESPID_KEY;
1579 ASN1_STRING_set(id->value.byKey, "Hello World", -1);
1580 sk_OCSP_RESPID_push(ids, id);
1581 SSL_set_tlsext_status_ids(con, ids);
1582 }
1583 #endif
1584                 }
1585 #endif
1586 #ifndef OPENSSL_NO_JPAKE
1587         if (jpake_secret)
1588                 jpake_client_auth(bio_c_out, sbio, jpake_secret);
1589 #endif
1590
1591         SSL_set_bio(con,sbio,sbio);
1592         SSL_set_connect_state(con);
1593
1594         /* ok, lets connect */
1595         width=SSL_get_fd(con)+1;
1596
1597         read_tty=1;
1598         write_tty=0;
1599         tty_on=0;
1600         read_ssl=1;
1601         write_ssl=1;
1602
1603         cbuf_len=0;
1604         cbuf_off=0;
1605         sbuf_len=0;
1606         sbuf_off=0;
1607
1608         /* This is an ugly hack that does a lot of assumptions */
1609         /* We do have to handle multi-line responses which may come
1610            in a single packet or not. We therefore have to use
1611            BIO_gets() which does need a buffering BIO. So during
1612            the initial chitchat we do push a buffering BIO into the
1613            chain that is removed again later on to not disturb the
1614            rest of the s_client operation. */
1615         if (starttls_proto == PROTO_SMTP)
1616                 {
1617                 int foundit=0;
1618                 BIO *fbio = BIO_new(BIO_f_buffer());
1619                 BIO_push(fbio, sbio);
1620                 /* wait for multi-line response to end from SMTP */
1621                 do
1622                         {
1623                         mbuf_len = BIO_gets(fbio,mbuf,BUFSIZZ);
1624                         }
1625                 while (mbuf_len>3 && mbuf[3]=='-');
1626                 /* STARTTLS command requires EHLO... */
1627                 BIO_printf(fbio,"EHLO openssl.client.net\r\n");
1628                 (void)BIO_flush(fbio);
1629                 /* wait for multi-line response to end EHLO SMTP response */
1630                 do
1631                         {
1632                         mbuf_len = BIO_gets(fbio,mbuf,BUFSIZZ);
1633                         if (strstr(mbuf,"STARTTLS"))
1634                                 foundit=1;
1635                         }
1636                 while (mbuf_len>3 && mbuf[3]=='-');
1637                 (void)BIO_flush(fbio);
1638                 BIO_pop(fbio);
1639                 BIO_free(fbio);
1640                 if (!foundit)
1641                         BIO_printf(bio_err,
1642                                    "didn't found starttls in server response,"
1643                                    " try anyway...\n");
1644                 BIO_printf(sbio,"STARTTLS\r\n");
1645                 BIO_read(sbio,sbuf,BUFSIZZ);
1646                 }
1647         else if (starttls_proto == PROTO_POP3)
1648                 {
1649                 BIO_read(sbio,mbuf,BUFSIZZ);
1650                 BIO_printf(sbio,"STLS\r\n");
1651                 BIO_read(sbio,sbuf,BUFSIZZ);
1652                 }
1653         else if (starttls_proto == PROTO_IMAP)
1654                 {
1655                 int foundit=0;
1656                 BIO *fbio = BIO_new(BIO_f_buffer());
1657                 BIO_push(fbio, sbio);
1658                 BIO_gets(fbio,mbuf,BUFSIZZ);
1659                 /* STARTTLS command requires CAPABILITY... */
1660                 BIO_printf(fbio,". CAPABILITY\r\n");
1661                 (void)BIO_flush(fbio);
1662                 /* wait for multi-line CAPABILITY response */
1663                 do
1664                         {
1665                         mbuf_len = BIO_gets(fbio,mbuf,BUFSIZZ);
1666                         if (strstr(mbuf,"STARTTLS"))
1667                                 foundit=1;
1668                         }
1669                 while (mbuf_len>3 && mbuf[0]!='.');
1670                 (void)BIO_flush(fbio);
1671                 BIO_pop(fbio);
1672                 BIO_free(fbio);
1673                 if (!foundit)
1674                         BIO_printf(bio_err,
1675                                    "didn't found STARTTLS in server response,"
1676                                    " try anyway...\n");
1677                 BIO_printf(sbio,". STARTTLS\r\n");
1678                 BIO_read(sbio,sbuf,BUFSIZZ);
1679                 }
1680         else if (starttls_proto == PROTO_FTP)
1681                 {
1682                 BIO *fbio = BIO_new(BIO_f_buffer());
1683                 BIO_push(fbio, sbio);
1684                 /* wait for multi-line response to end from FTP */
1685                 do
1686                         {
1687                         mbuf_len = BIO_gets(fbio,mbuf,BUFSIZZ);
1688                         }
1689                 while (mbuf_len>3 && mbuf[3]=='-');
1690                 (void)BIO_flush(fbio);
1691                 BIO_pop(fbio);
1692                 BIO_free(fbio);
1693                 BIO_printf(sbio,"AUTH TLS\r\n");
1694                 BIO_read(sbio,sbuf,BUFSIZZ);
1695                 }
1696         if (starttls_proto == PROTO_XMPP)
1697                 {
1698                 int seen = 0;
1699                 BIO_printf(sbio,"<stream:stream "
1700                     "xmlns:stream='http://etherx.jabber.org/streams' "
1701                     "xmlns='jabber:client' to='%s' version='1.0'>", host);
1702                 seen = BIO_read(sbio,mbuf,BUFSIZZ);
1703                 mbuf[seen] = 0;
1704                 while (!strstr(mbuf, "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'"))
1705                         {
1706                         if (strstr(mbuf, "/stream:features>"))
1707                                 goto shut;
1708                         seen = BIO_read(sbio,mbuf,BUFSIZZ);
1709                         mbuf[seen] = 0;
1710                         }
1711                 BIO_printf(sbio, "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>");
1712                 seen = BIO_read(sbio,sbuf,BUFSIZZ);
1713                 sbuf[seen] = 0;
1714                 if (!strstr(sbuf, "<proceed"))
1715                         goto shut;
1716                 mbuf[0] = 0;
1717                 }
1718
1719         for (;;)
1720                 {
1721                 FD_ZERO(&readfds);
1722                 FD_ZERO(&writefds);
1723
1724                 if ((SSL_version(con) == DTLS1_VERSION) &&
1725                         DTLSv1_get_timeout(con, &timeout))
1726                         timeoutp = &timeout;
1727                 else
1728                         timeoutp = NULL;
1729
1730                 if (SSL_in_init(con) && !SSL_total_renegotiations(con))
1731                         {
1732                         in_init=1;
1733                         tty_on=0;
1734                         }
1735                 else
1736                         {
1737                         tty_on=1;
1738                         if (in_init)
1739                                 {
1740                                 in_init=0;
1741 #if 0 /* This test doesn't really work as intended (needs to be fixed) */
1742 #ifndef OPENSSL_NO_TLSEXT
1743                                 if (servername != NULL && !SSL_session_reused(con))
1744                                         {
1745                                         BIO_printf(bio_c_out,"Server did %sacknowledge servername extension.\n",tlsextcbp.ack?"":"not ");
1746                                         }
1747 #endif
1748 #endif
1749                                 if (sess_out)
1750                                         {
1751                                         BIO *stmp = BIO_new_file(sess_out, "w");
1752                                         if (stmp)
1753                                                 {
1754                                                 PEM_write_bio_SSL_SESSION(stmp, SSL_get_session(con));
1755                                                 BIO_free(stmp);
1756                                                 }
1757                                         else
1758                                                 BIO_printf(bio_err, "Error writing session file %s\n", sess_out);
1759                                         }
1760                                 if (c_brief)
1761                                         {
1762                                         BIO_puts(bio_err,
1763                                                 "CONNECTION ESTABLISHED\n");
1764                                         print_ssl_summary(bio_err, con);
1765                                         }
1766
1767                                 print_stuff(bio_c_out,con,full_log);
1768                                 if (full_log > 0) full_log--;
1769
1770                                 if (starttls_proto)
1771                                         {
1772                                         BIO_printf(bio_err,"%s",mbuf);
1773                                         /* We don't need to know any more */
1774                                         starttls_proto = PROTO_OFF;
1775                                         }
1776
1777                                 if (reconnect)
1778                                         {
1779                                         reconnect--;
1780                                         BIO_printf(bio_c_out,"drop connection and then reconnect\n");
1781                                         SSL_shutdown(con);
1782                                         SSL_set_connect_state(con);
1783                                         SHUTDOWN(SSL_get_fd(con));
1784                                         goto re_start;
1785                                         }
1786                                 }
1787                         }
1788
1789                 ssl_pending = read_ssl && SSL_pending(con);
1790
1791                 if (!ssl_pending)
1792                         {
1793 #if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_NETWARE) && !defined (OPENSSL_SYS_BEOS_R5)
1794                         if (tty_on)
1795                                 {
1796                                 if (read_tty)  openssl_fdset(fileno(stdin),&readfds);
1797                                 if (write_tty) openssl_fdset(fileno(stdout),&writefds);
1798                                 }
1799                         if (read_ssl)
1800                                 openssl_fdset(SSL_get_fd(con),&readfds);
1801                         if (write_ssl)
1802                                 openssl_fdset(SSL_get_fd(con),&writefds);
1803 #else
1804                         if(!tty_on || !write_tty) {
1805                                 if (read_ssl)
1806                                         openssl_fdset(SSL_get_fd(con),&readfds);
1807                                 if (write_ssl)
1808                                         openssl_fdset(SSL_get_fd(con),&writefds);
1809                         }
1810 #endif
1811 /*-                     printf("mode tty(%d %d%d) ssl(%d%d)\n",
1812                                 tty_on,read_tty,write_tty,read_ssl,write_ssl);*/
1813
1814                         /* Note: under VMS with SOCKETSHR the second parameter
1815                          * is currently of type (int *) whereas under other
1816                          * systems it is (void *) if you don't have a cast it
1817                          * will choke the compiler: if you do have a cast then
1818                          * you can either go for (int *) or (void *).
1819                          */
1820 #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)
1821                         /* Under Windows/DOS we make the assumption that we can
1822                          * always write to the tty: therefore if we need to
1823                          * write to the tty we just fall through. Otherwise
1824                          * we timeout the select every second and see if there
1825                          * are any keypresses. Note: this is a hack, in a proper
1826                          * Windows application we wouldn't do this.
1827                          */
1828                         i=0;
1829                         if(!write_tty) {
1830                                 if(read_tty) {
1831                                         tv.tv_sec = 1;
1832                                         tv.tv_usec = 0;
1833                                         i=select(width,(void *)&readfds,(void *)&writefds,
1834                                                  NULL,&tv);
1835 #if defined(OPENSSL_SYS_WINCE) || defined(OPENSSL_SYS_MSDOS)
1836                                         if(!i && (!_kbhit() || !read_tty) ) continue;
1837 #else
1838                                         if(!i && (!((_kbhit()) || (WAIT_OBJECT_0 == WaitForSingleObject(GetStdHandle(STD_INPUT_HANDLE), 0))) || !read_tty) ) continue;
1839 #endif
1840                                 } else  i=select(width,(void *)&readfds,(void *)&writefds,
1841                                          NULL,timeoutp);
1842                         }
1843 #elif defined(OPENSSL_SYS_NETWARE)
1844                         if(!write_tty) {
1845                                 if(read_tty) {
1846                                         tv.tv_sec = 1;
1847                                         tv.tv_usec = 0;
1848                                         i=select(width,(void *)&readfds,(void *)&writefds,
1849                                                 NULL,&tv);
1850                                 } else  i=select(width,(void *)&readfds,(void *)&writefds,
1851                                         NULL,timeoutp);
1852                         }
1853 #elif defined(OPENSSL_SYS_BEOS_R5)
1854                         /* Under BeOS-R5 the situation is similar to DOS */
1855                         i=0;
1856                         stdin_set = 0;
1857                         (void)fcntl(fileno(stdin), F_SETFL, O_NONBLOCK);
1858                         if(!write_tty) {
1859                                 if(read_tty) {
1860                                         tv.tv_sec = 1;
1861                                         tv.tv_usec = 0;
1862                                         i=select(width,(void *)&readfds,(void *)&writefds,
1863                                                  NULL,&tv);
1864                                         if (read(fileno(stdin), sbuf, 0) >= 0)
1865                                                 stdin_set = 1;
1866                                         if (!i && (stdin_set != 1 || !read_tty))
1867                                                 continue;
1868                                 } else  i=select(width,(void *)&readfds,(void *)&writefds,
1869                                          NULL,timeoutp);
1870                         }
1871                         (void)fcntl(fileno(stdin), F_SETFL, 0);
1872 #else
1873                         i=select(width,(void *)&readfds,(void *)&writefds,
1874                                  NULL,timeoutp);
1875 #endif
1876                         if ( i < 0)
1877                                 {
1878                                 BIO_printf(bio_err,"bad select %d\n",
1879                                 get_last_socket_error());
1880                                 goto shut;
1881                                 /* goto end; */
1882                                 }
1883                         }
1884
1885                 if ((SSL_version(con) == DTLS1_VERSION) && DTLSv1_handle_timeout(con) > 0)
1886                         {
1887                         BIO_printf(bio_err,"TIMEOUT occured\n");
1888                         }
1889
1890                 if (!ssl_pending && FD_ISSET(SSL_get_fd(con),&writefds))
1891                         {
1892                         k=SSL_write(con,&(cbuf[cbuf_off]),
1893                                 (unsigned int)cbuf_len);
1894                         switch (SSL_get_error(con,k))
1895                                 {
1896                         case SSL_ERROR_NONE:
1897                                 cbuf_off+=k;
1898                                 cbuf_len-=k;
1899                                 if (k <= 0) goto end;
1900                                 /* we have done a  write(con,NULL,0); */
1901                                 if (cbuf_len <= 0)
1902                                         {
1903                                         read_tty=1;
1904                                         write_ssl=0;
1905                                         }
1906                                 else /* if (cbuf_len > 0) */
1907                                         {
1908                                         read_tty=0;
1909                                         write_ssl=1;
1910                                         }
1911                                 break;
1912                         case SSL_ERROR_WANT_WRITE:
1913                                 BIO_printf(bio_c_out,"write W BLOCK\n");
1914                                 write_ssl=1;
1915                                 read_tty=0;
1916                                 break;
1917                         case SSL_ERROR_WANT_READ:
1918                                 BIO_printf(bio_c_out,"write R BLOCK\n");
1919                                 write_tty=0;
1920                                 read_ssl=1;
1921                                 write_ssl=0;
1922                                 break;
1923                         case SSL_ERROR_WANT_X509_LOOKUP:
1924                                 BIO_printf(bio_c_out,"write X BLOCK\n");
1925                                 break;
1926                         case SSL_ERROR_ZERO_RETURN:
1927                                 if (cbuf_len != 0)
1928                                         {
1929                                         BIO_printf(bio_c_out,"shutdown\n");
1930                                         ret = 0;
1931                                         goto shut;
1932                                         }
1933                                 else
1934                                         {
1935                                         read_tty=1;
1936                                         write_ssl=0;
1937                                         break;
1938                                         }
1939
1940                         case SSL_ERROR_SYSCALL:
1941                                 if ((k != 0) || (cbuf_len != 0))
1942                                         {
1943                                         BIO_printf(bio_err,"write:errno=%d\n",
1944                                                 get_last_socket_error());
1945                                         goto shut;
1946                                         }
1947                                 else
1948                                         {
1949                                         read_tty=1;
1950                                         write_ssl=0;
1951                                         }
1952                                 break;
1953                         case SSL_ERROR_SSL:
1954                                 ERR_print_errors(bio_err);
1955                                 goto shut;
1956                                 }
1957                         }
1958 #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE) || defined(OPENSSL_SYS_BEOS_R5)
1959                 /* Assume Windows/DOS/BeOS can always write */
1960                 else if (!ssl_pending && write_tty)
1961 #else
1962                 else if (!ssl_pending && FD_ISSET(fileno(stdout),&writefds))
1963 #endif
1964                         {
1965 #ifdef CHARSET_EBCDIC
1966                         ascii2ebcdic(&(sbuf[sbuf_off]),&(sbuf[sbuf_off]),sbuf_len);
1967 #endif
1968                         i=raw_write_stdout(&(sbuf[sbuf_off]),sbuf_len);
1969
1970                         if (i <= 0)
1971                                 {
1972                                 BIO_printf(bio_c_out,"DONE\n");
1973                                 ret = 0;
1974                                 goto shut;
1975                                 /* goto end; */
1976                                 }
1977
1978                         sbuf_len-=i;;
1979                         sbuf_off+=i;
1980                         if (sbuf_len <= 0)
1981                                 {
1982                                 read_ssl=1;
1983                                 write_tty=0;
1984                                 }
1985                         }
1986                 else if (ssl_pending || FD_ISSET(SSL_get_fd(con),&readfds))
1987                         {
1988 #ifdef RENEG
1989 { static int iiii; if (++iiii == 52) { SSL_renegotiate(con); iiii=0; } }
1990 #endif
1991 #if 1
1992                         k=SSL_read(con,sbuf,1024 /* BUFSIZZ */ );
1993 #else
1994 /* Demo for pending and peek :-) */
1995                         k=SSL_read(con,sbuf,16);
1996 { char zbuf[10240];
1997 printf("read=%d pending=%d peek=%d\n",k,SSL_pending(con),SSL_peek(con,zbuf,10240));
1998 }
1999 #endif
2000
2001                         switch (SSL_get_error(con,k))
2002                                 {
2003                         case SSL_ERROR_NONE:
2004                                 if (k <= 0)
2005                                         goto end;
2006                                 sbuf_off=0;
2007                                 sbuf_len=k;
2008
2009                                 read_ssl=0;
2010                                 write_tty=1;
2011                                 break;
2012                         case SSL_ERROR_WANT_WRITE:
2013                                 BIO_printf(bio_c_out,"read W BLOCK\n");
2014                                 write_ssl=1;
2015                                 read_tty=0;
2016                                 break;
2017                         case SSL_ERROR_WANT_READ:
2018                                 BIO_printf(bio_c_out,"read R BLOCK\n");
2019                                 write_tty=0;
2020                                 read_ssl=1;
2021                                 if ((read_tty == 0) && (write_ssl == 0))
2022                                         write_ssl=1;
2023                                 break;
2024                         case SSL_ERROR_WANT_X509_LOOKUP:
2025                                 BIO_printf(bio_c_out,"read X BLOCK\n");
2026                                 break;
2027                         case SSL_ERROR_SYSCALL:
2028                                 ret=get_last_socket_error();
2029                                 if (c_brief)
2030                                         BIO_puts(bio_err, "CONNECTION CLOSED BY SERVER\n");
2031                                 else
2032                                         BIO_printf(bio_err,"read:errno=%d\n",ret);
2033                                 goto shut;
2034                         case SSL_ERROR_ZERO_RETURN:
2035                                 BIO_printf(bio_c_out,"closed\n");
2036                                 ret=0;
2037                                 goto shut;
2038                         case SSL_ERROR_SSL:
2039                                 ERR_print_errors(bio_err);
2040                                 goto shut;
2041                                 /* break; */
2042                                 }
2043                         }
2044
2045 #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)
2046 #if defined(OPENSSL_SYS_WINCE) || defined(OPENSSL_SYS_MSDOS)
2047                 else if (_kbhit())
2048 #else
2049                 else if ((_kbhit()) || (WAIT_OBJECT_0 == WaitForSingleObject(GetStdHandle(STD_INPUT_HANDLE), 0)))
2050 #endif
2051 #elif defined (OPENSSL_SYS_NETWARE)
2052                 else if (_kbhit())
2053 #elif defined(OPENSSL_SYS_BEOS_R5)
2054                 else if (stdin_set)
2055 #else
2056                 else if (FD_ISSET(fileno(stdin),&readfds))
2057 #endif
2058                         {
2059                         if (crlf)
2060                                 {
2061                                 int j, lf_num;
2062
2063                                 i=raw_read_stdin(cbuf,BUFSIZZ/2);
2064                                 lf_num = 0;
2065                                 /* both loops are skipped when i <= 0 */
2066                                 for (j = 0; j < i; j++)
2067                                         if (cbuf[j] == '\n')
2068                                                 lf_num++;
2069                                 for (j = i-1; j >= 0; j--)
2070                                         {
2071                                         cbuf[j+lf_num] = cbuf[j];
2072                                         if (cbuf[j] == '\n')
2073                                                 {
2074                                                 lf_num--;
2075                                                 i++;
2076                                                 cbuf[j+lf_num] = '\r';
2077                                                 }
2078                                         }
2079                                 assert(lf_num == 0);
2080                                 }
2081                         else
2082                                 i=raw_read_stdin(cbuf,BUFSIZZ);
2083
2084                         if ((!c_ign_eof) && ((i <= 0) || (cbuf[0] == 'Q')))
2085                                 {
2086                                 BIO_printf(bio_err,"DONE\n");
2087                                 ret=0;
2088                                 goto shut;
2089                                 }
2090
2091                         if ((!c_ign_eof) && (cbuf[0] == 'R'))
2092                                 {
2093                                 BIO_printf(bio_err,"RENEGOTIATING\n");
2094                                 SSL_renegotiate(con);
2095                                 cbuf_len=0;
2096                                 }
2097 #ifndef OPENSSL_NO_HEARTBEATS
2098                         else if ((!c_ign_eof) && (cbuf[0] == 'B'))
2099                                 {
2100                                 BIO_printf(bio_err,"HEARTBEATING\n");
2101                                 SSL_heartbeat(con);
2102                                 cbuf_len=0;
2103                                 }
2104 #endif
2105                         else
2106                                 {
2107                                 cbuf_len=i;
2108                                 cbuf_off=0;
2109 #ifdef CHARSET_EBCDIC
2110                                 ebcdic2ascii(cbuf, cbuf, i);
2111 #endif
2112                                 }
2113
2114                         write_ssl=1;
2115                         read_tty=0;
2116                         }
2117                 }
2118
2119         ret=0;
2120 shut:
2121         if (in_init)
2122                 print_stuff(bio_c_out,con,full_log);
2123         SSL_shutdown(con);
2124         SHUTDOWN(SSL_get_fd(con));
2125 end:
2126         if (con != NULL)
2127                 {
2128                 if (prexit != 0)
2129                         print_stuff(bio_c_out,con,1);
2130                 SSL_free(con);
2131                 }
2132 #if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
2133         if (next_proto.data)
2134                 OPENSSL_free(next_proto.data);
2135 #endif
2136         if (ctx != NULL) SSL_CTX_free(ctx);
2137         if (cert)
2138                 X509_free(cert);
2139         if (crls)
2140                 sk_X509_CRL_pop_free(crls, X509_CRL_free);
2141         if (key)
2142                 EVP_PKEY_free(key);
2143         if (chain)
2144                 sk_X509_pop_free(chain, X509_free);
2145         if (pass)
2146                 OPENSSL_free(pass);
2147         if (vpm)
2148                 X509_VERIFY_PARAM_free(vpm);
2149         ssl_excert_free(exc);
2150         if (ssl_args)
2151                 sk_OPENSSL_STRING_free(ssl_args);
2152         if (cctx)
2153                 SSL_CONF_CTX_free(cctx);
2154 #ifndef OPENSSL_NO_JPAKE
2155         if (jpake_secret && psk_key)
2156                 OPENSSL_free(psk_key);
2157 #endif
2158         if (cbuf != NULL) { OPENSSL_cleanse(cbuf,BUFSIZZ); OPENSSL_free(cbuf); }
2159         if (sbuf != NULL) { OPENSSL_cleanse(sbuf,BUFSIZZ); OPENSSL_free(sbuf); }
2160         if (mbuf != NULL) { OPENSSL_cleanse(mbuf,BUFSIZZ); OPENSSL_free(mbuf); }
2161         if (bio_c_out != NULL)
2162                 {
2163                 BIO_free(bio_c_out);
2164                 bio_c_out=NULL;
2165                 }
2166         if (bio_c_msg != NULL)
2167                 {
2168                 BIO_free(bio_c_msg);
2169                 bio_c_msg=NULL;
2170                 }
2171         apps_shutdown();
2172         OPENSSL_EXIT(ret);
2173         }
2174
2175
2176 static void print_stuff(BIO *bio, SSL *s, int full)
2177         {
2178         X509 *peer=NULL;
2179         char *p;
2180         static const char *space="                ";
2181         char buf[BUFSIZ];
2182         STACK_OF(X509) *sk;
2183         STACK_OF(X509_NAME) *sk2;
2184         const SSL_CIPHER *c;
2185         X509_NAME *xn;
2186         int j,i;
2187 #ifndef OPENSSL_NO_COMP
2188         const COMP_METHOD *comp, *expansion;
2189 #endif
2190         unsigned char *exportedkeymat;
2191
2192         if (full)
2193                 {
2194                 int got_a_chain = 0;
2195
2196                 sk=SSL_get_peer_cert_chain(s);
2197                 if (sk != NULL)
2198                         {
2199                         got_a_chain = 1; /* we don't have it for SSL2 (yet) */
2200
2201                         BIO_printf(bio,"---\nCertificate chain\n");
2202                         for (i=0; i<sk_X509_num(sk); i++)
2203                                 {
2204                                 X509_NAME_oneline(X509_get_subject_name(
2205                                         sk_X509_value(sk,i)),buf,sizeof buf);
2206                                 BIO_printf(bio,"%2d s:%s\n",i,buf);
2207                                 X509_NAME_oneline(X509_get_issuer_name(
2208                                         sk_X509_value(sk,i)),buf,sizeof buf);
2209                                 BIO_printf(bio,"   i:%s\n",buf);
2210                                 if (c_showcerts)
2211                                         PEM_write_bio_X509(bio,sk_X509_value(sk,i));
2212                                 }
2213                         }
2214
2215                 BIO_printf(bio,"---\n");
2216                 peer=SSL_get_peer_certificate(s);
2217                 if (peer != NULL)
2218                         {
2219                         BIO_printf(bio,"Server certificate\n");
2220                         if (!(c_showcerts && got_a_chain)) /* Redundant if we showed the whole chain */
2221                                 PEM_write_bio_X509(bio,peer);
2222                         X509_NAME_oneline(X509_get_subject_name(peer),
2223                                 buf,sizeof buf);
2224                         BIO_printf(bio,"subject=%s\n",buf);
2225                         X509_NAME_oneline(X509_get_issuer_name(peer),
2226                                 buf,sizeof buf);
2227                         BIO_printf(bio,"issuer=%s\n",buf);
2228                         }
2229                 else
2230                         BIO_printf(bio,"no peer certificate available\n");
2231
2232                 sk2=SSL_get_client_CA_list(s);
2233                 if ((sk2 != NULL) && (sk_X509_NAME_num(sk2) > 0))
2234                         {
2235                         BIO_printf(bio,"---\nAcceptable client certificate CA names\n");
2236                         for (i=0; i<sk_X509_NAME_num(sk2); i++)
2237                                 {
2238                                 xn=sk_X509_NAME_value(sk2,i);
2239                                 X509_NAME_oneline(xn,buf,sizeof(buf));
2240                                 BIO_write(bio,buf,strlen(buf));
2241                                 BIO_write(bio,"\n",1);
2242                                 }
2243                         }
2244                 else
2245                         {
2246                         BIO_printf(bio,"---\nNo client certificate CA names sent\n");
2247                         }
2248                 p=SSL_get_shared_ciphers(s,buf,sizeof buf);
2249                 if (p != NULL)
2250                         {
2251                         /* This works only for SSL 2.  In later protocol
2252                          * versions, the client does not know what other
2253                          * ciphers (in addition to the one to be used
2254                          * in the current connection) the server supports. */
2255
2256                         BIO_printf(bio,"---\nCiphers common between both SSL endpoints:\n");
2257                         j=i=0;
2258                         while (*p)
2259                                 {
2260                                 if (*p == ':')
2261                                         {
2262                                         BIO_write(bio,space,15-j%25);
2263                                         i++;
2264                                         j=0;
2265                                         BIO_write(bio,((i%3)?" ":"\n"),1);
2266                                         }
2267                                 else
2268                                         {
2269                                         BIO_write(bio,p,1);
2270                                         j++;
2271                                         }
2272                                 p++;
2273                                 }
2274                         BIO_write(bio,"\n",1);
2275                         }
2276
2277                 ssl_print_sigalgs(bio, s);
2278                 ssl_print_tmp_key(bio, s);
2279
2280                 BIO_printf(bio,"---\nSSL handshake has read %ld bytes and written %ld bytes\n",
2281                         BIO_number_read(SSL_get_rbio(s)),
2282                         BIO_number_written(SSL_get_wbio(s)));
2283                 }
2284         BIO_printf(bio,(SSL_cache_hit(s)?"---\nReused, ":"---\nNew, "));
2285         c=SSL_get_current_cipher(s);
2286         BIO_printf(bio,"%s, Cipher is %s\n",
2287                 SSL_CIPHER_get_version(c),
2288                 SSL_CIPHER_get_name(c));
2289         if (peer != NULL) {
2290                 EVP_PKEY *pktmp;
2291                 pktmp = X509_get_pubkey(peer);
2292                 BIO_printf(bio,"Server public key is %d bit\n",
2293                                                          EVP_PKEY_bits(pktmp));
2294                 EVP_PKEY_free(pktmp);
2295         }
2296         BIO_printf(bio, "Secure Renegotiation IS%s supported\n",
2297                         SSL_get_secure_renegotiation_support(s) ? "" : " NOT");
2298 #ifndef OPENSSL_NO_COMP
2299         comp=SSL_get_current_compression(s);
2300         expansion=SSL_get_current_expansion(s);
2301         BIO_printf(bio,"Compression: %s\n",
2302                 comp ? SSL_COMP_get_name(comp) : "NONE");
2303         BIO_printf(bio,"Expansion: %s\n",
2304                 expansion ? SSL_COMP_get_name(expansion) : "NONE");
2305 #endif
2306
2307 #ifdef SSL_DEBUG
2308         {
2309         /* Print out local port of connection: useful for debugging */
2310         int sock;
2311         struct sockaddr_in ladd;
2312         socklen_t ladd_size = sizeof(ladd);
2313         sock = SSL_get_fd(s);
2314         getsockname(sock, (struct sockaddr *)&ladd, &ladd_size);
2315         BIO_printf(bio_c_out, "LOCAL PORT is %u\n", ntohs(ladd.sin_port));
2316         }
2317 #endif
2318
2319 #if !defined(OPENSSL_NO_TLSEXT)
2320 # if !defined(OPENSSL_NO_NEXTPROTONEG)
2321         if (next_proto.status != -1) {
2322                 const unsigned char *proto;
2323                 unsigned int proto_len;
2324                 SSL_get0_next_proto_negotiated(s, &proto, &proto_len);
2325                 BIO_printf(bio, "Next protocol: (%d) ", next_proto.status);
2326                 BIO_write(bio, proto, proto_len);
2327                 BIO_write(bio, "\n", 1);
2328         }
2329 # endif
2330         {
2331                 const unsigned char *proto;
2332                 unsigned int proto_len;
2333                 SSL_get0_alpn_selected(s, &proto, &proto_len);
2334                 if (proto_len > 0)
2335                         {
2336                         BIO_printf(bio, "ALPN protocol: ");
2337                         BIO_write(bio, proto, proto_len);
2338                         BIO_write(bio, "\n", 1);
2339                         }
2340                 else
2341                         BIO_printf(bio, "No ALPN negotiated\n");
2342         }
2343 #endif
2344
2345 #ifndef OPENSSL_NO_SRTP
2346         {
2347         SRTP_PROTECTION_PROFILE *srtp_profile=SSL_get_selected_srtp_profile(s);
2348
2349         if(srtp_profile)
2350                 BIO_printf(bio,"SRTP Extension negotiated, profile=%s\n",
2351                            srtp_profile->name);
2352         }
2353 #endif
2354
2355         SSL_SESSION_print(bio,SSL_get_session(s));
2356         if (keymatexportlabel != NULL)
2357                 {
2358                 BIO_printf(bio, "Keying material exporter:\n");
2359                 BIO_printf(bio, "    Label: '%s'\n", keymatexportlabel);
2360                 BIO_printf(bio, "    Length: %i bytes\n", keymatexportlen);
2361                 exportedkeymat = OPENSSL_malloc(keymatexportlen);
2362                 if (exportedkeymat != NULL)
2363                         {
2364                         if (!SSL_export_keying_material(s, exportedkeymat,
2365                                                         keymatexportlen,
2366                                                         keymatexportlabel,
2367                                                         strlen(keymatexportlabel),
2368                                                         NULL, 0, 0))
2369                                 {
2370                                 BIO_printf(bio, "    Error\n");
2371                                 }
2372                         else
2373                                 {
2374                                 BIO_printf(bio, "    Keying material: ");
2375                                 for (i=0; i<keymatexportlen; i++)
2376                                         BIO_printf(bio, "%02X",
2377                                                    exportedkeymat[i]);
2378                                 BIO_printf(bio, "\n");
2379                                 }
2380                         OPENSSL_free(exportedkeymat);
2381                         }
2382                 }
2383         BIO_printf(bio,"---\n");
2384         if (peer != NULL)
2385                 X509_free(peer);
2386         /* flush, or debugging output gets mixed with http response */
2387         (void)BIO_flush(bio);
2388         }
2389
2390 #ifndef OPENSSL_NO_TLSEXT
2391
2392 static int ocsp_resp_cb(SSL *s, void *arg)
2393         {
2394         const unsigned char *p;
2395         int len;
2396         OCSP_RESPONSE *rsp;
2397         len = SSL_get_tlsext_status_ocsp_resp(s, &p);
2398         BIO_puts(arg, "OCSP response: ");
2399         if (!p)
2400                 {
2401                 BIO_puts(arg, "no response sent\n");
2402                 return 1;
2403                 }
2404         rsp = d2i_OCSP_RESPONSE(NULL, &p, len);
2405         if (!rsp)
2406                 {
2407                 BIO_puts(arg, "response parse error\n");
2408                 BIO_dump_indent(arg, (char *)p, len, 4);
2409                 return 0;
2410                 }
2411         BIO_puts(arg, "\n======================================\n");
2412         OCSP_RESPONSE_print(arg, rsp, 0);
2413         BIO_puts(arg, "======================================\n");
2414         OCSP_RESPONSE_free(rsp);
2415         return 1;
2416         }
2417
2418 #endif