Import of old SSLeay release: SSLeay 0.8.1b
[openssl.git] / apps / s_server.c
1 /* apps/s_server.c */
2 /* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com)
3  * All rights reserved.
4  *
5  * This package is an SSL implementation written
6  * by Eric Young (eay@cryptsoft.com).
7  * The implementation was written so as to conform with Netscapes SSL.
8  * 
9  * This library is free for commercial and non-commercial use as long as
10  * the following conditions are aheared to.  The following conditions
11  * apply to all code found in this distribution, be it the RC4, RSA,
12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
13  * included with this distribution is covered by the same copyright terms
14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15  * 
16  * Copyright remains Eric Young's, and as such any Copyright notices in
17  * the code are not to be removed.
18  * If this package is used in a product, Eric Young should be given attribution
19  * as the author of the parts of the library used.
20  * This can be in the form of a textual message at program startup or
21  * in documentation (online or textual) provided with the package.
22  * 
23  * Redistribution and use in source and binary forms, with or without
24  * modification, are permitted provided that the following conditions
25  * are met:
26  * 1. Redistributions of source code must retain the copyright
27  *    notice, this list of conditions and the following disclaimer.
28  * 2. Redistributions in binary form must reproduce the above copyright
29  *    notice, this list of conditions and the following disclaimer in the
30  *    documentation and/or other materials provided with the distribution.
31  * 3. All advertising materials mentioning features or use of this software
32  *    must display the following acknowledgement:
33  *    "This product includes cryptographic software written by
34  *     Eric Young (eay@cryptsoft.com)"
35  *    The word 'cryptographic' can be left out if the rouines from the library
36  *    being used are not cryptographic related :-).
37  * 4. If you include any Windows specific code (or a derivative thereof) from 
38  *    the apps directory (application code) you must include an acknowledgement:
39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40  * 
41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51  * SUCH DAMAGE.
52  * 
53  * The licence and distribution terms for any publically available version or
54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
55  * copied and put under another distribution licence
56  * [including the GNU Public Licence.]
57  */
58
59 #include <stdio.h>
60 #include <stdlib.h>
61 #include <string.h>
62 #include <sys/types.h>
63 #include <sys/stat.h>
64 #ifdef WIN16
65 #define APPS_WIN16
66 #endif
67 #include "lhash.h"
68 #include "bn.h"
69 #define USE_SOCKETS
70 #include "apps.h"
71 #include "err.h"
72 #include "pem.h"
73 #include "x509.h"
74 #include "ssl.h"
75 #include "s_apps.h"
76
77 #ifndef NOPROTO
78 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int export);
79 static int sv_body(char *hostname, int s);
80 static int www_body(char *hostname, int s);
81 static void close_accept_socket(void );
82 static void sv_usage(void);
83 static int init_ssl_connection(SSL *s);
84 static void print_stats(BIO *bp,SSL_CTX *ctx);
85 static DH *load_dh_param(void );
86 static DH *get_dh512(void);
87 #else
88 static RSA MS_CALLBACK *tmp_rsa_cb();
89 static int sv_body();
90 static int www_body();
91 static void close_accept_socket();
92 static void sv_usage();
93 static int init_ssl_connection();
94 static void print_stats();
95 static DH *load_dh_param();
96 static DH *get_dh512();
97 #endif
98
99
100 #ifndef S_ISDIR
101 #define S_ISDIR(a)      (((a) & _S_IFMT) == _S_IFDIR)
102 #endif
103
104 static unsigned char dh512_p[]={
105         0xDA,0x58,0x3C,0x16,0xD9,0x85,0x22,0x89,0xD0,0xE4,0xAF,0x75,
106         0x6F,0x4C,0xCA,0x92,0xDD,0x4B,0xE5,0x33,0xB8,0x04,0xFB,0x0F,
107         0xED,0x94,0xEF,0x9C,0x8A,0x44,0x03,0xED,0x57,0x46,0x50,0xD3,
108         0x69,0x99,0xDB,0x29,0xD7,0x76,0x27,0x6B,0xA2,0xD3,0xD4,0x12,
109         0xE2,0x18,0xF4,0xDD,0x1E,0x08,0x4C,0xF6,0xD8,0x00,0x3E,0x7C,
110         0x47,0x74,0xE8,0x33,
111         };
112 static unsigned char dh512_g[]={
113         0x02,
114         };
115
116 static DH *get_dh512()
117         {
118         DH *dh=NULL;
119
120 #ifndef NO_DH
121         if ((dh=DH_new()) == NULL) return(NULL);
122         dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
123         dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
124         if ((dh->p == NULL) || (dh->g == NULL))
125                 return(NULL);
126 #endif
127         return(dh);
128         }
129
130 /* static int load_CA(SSL_CTX *ctx, char *file);*/
131
132 #undef BUFSIZZ
133 #define BUFSIZZ 8*1024
134 static int accept_socket= -1;
135
136 #define TEST_CERT       "server.pem"
137 #undef PROG
138 #define PROG            s_server_main
139
140 #define DH_PARAM        "server.pem"
141
142 extern int verify_depth;
143
144 static char *cipher=NULL;
145 int verify=SSL_VERIFY_NONE;
146 char *s_cert_file=TEST_CERT,*s_key_file=NULL;
147 #ifdef FIONBIO
148 static int s_nbio=0;
149 #endif
150 static int s_nbio_test=0;
151 static SSL_CTX *ctx=NULL;
152 static int www=0;
153
154 static BIO *bio_s_out=NULL;
155 static int s_debug=0;
156 static int s_quiet=0;
157
158 static void sv_usage()
159         {
160         BIO_printf(bio_err,"usage: s_server [args ...]\n");
161         BIO_printf(bio_err,"\n");
162         BIO_printf(bio_err," -accpet arg   - port to accept on (default is %d\n",PORT);
163         BIO_printf(bio_err," -verify arg   - turn on peer certificate verification\n");
164         BIO_printf(bio_err," -Verify arg   - turn on peer certificate verification, must have a cert.\n");
165         BIO_printf(bio_err," -cert arg     - certificate file to use, PEM format assumed\n");
166         BIO_printf(bio_err,"                 (default is %s)\n",TEST_CERT);
167         BIO_printf(bio_err," -key arg      - RSA file to use, PEM format assumed, in cert file if\n");
168         BIO_printf(bio_err,"                 not specified (default is %s)\n",TEST_CERT);
169 #ifdef FIONBIO
170         BIO_printf(bio_err," -nbio         - Run with non-blocking IO\n");
171 #endif
172         BIO_printf(bio_err," -nbio_test    - test with the non-blocking test bio\n");
173         BIO_printf(bio_err," -debug        - Print more output\n");
174         BIO_printf(bio_err," -state        - Print the SSL states\n");
175         BIO_printf(bio_err," -CApath arg   - PEM format directory of CA's\n");
176         BIO_printf(bio_err," -CAfile arg   - PEM format file of CA's\n");
177         BIO_printf(bio_err," -nocert       - Don't use any certificates (Anon-DH)\n");
178         BIO_printf(bio_err," -cipher arg   - play with 'ssleay ciphers' to see what goes here\n");
179         BIO_printf(bio_err," -quiet        - No server output\n");
180         BIO_printf(bio_err," -no_tmp_rsa   - Do not generate a tmp RSA key\n");
181         BIO_printf(bio_err," -ssl2         - Just talk SSLv2\n");
182         BIO_printf(bio_err," -ssl3         - Just talk SSLv3\n");
183         BIO_printf(bio_err," -bugs         - Turn on SSL bug compatability\n");
184         BIO_printf(bio_err," -www          - Respond to a 'GET /' with a status page\n");
185         BIO_printf(bio_err," -WWW          - Returns requested page from to a 'GET <path> HTTP/1.0'\n");
186         }
187
188 static int local_argc;
189 static char **local_argv;
190 static int hack;
191
192 int MAIN(argc, argv)
193 int argc;
194 char *argv[];
195         {
196         short port=PORT;
197         char *CApath=NULL,*CAfile=NULL;
198         int badop=0,bugs=0;
199         int ret=1;
200         int no_tmp_rsa=0,nocert=0;
201         int state=0;
202         SSL_METHOD *meth=NULL;
203         DH *dh=NULL;
204
205 #if !defined(NO_SSL2) && !defined(NO_SSL3)
206         meth=SSLv23_server_method();
207 #elif !defined(NO_SSL3)
208         meth=SSLv3_server_method();
209 #elif !defined(NO_SSL2)
210         meth=SSLv2_server_method();
211 #endif
212
213         local_argc=argc;
214         local_argv=argv;
215
216         apps_startup();
217         s_quiet=0;
218         s_debug=0;
219
220         if (bio_err == NULL)
221                 bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
222
223         verify_depth=0;
224 #ifdef FIONBIO
225         s_nbio=0;
226 #endif
227         s_nbio_test=0;
228
229         argc--;
230         argv++;
231
232         while (argc >= 1)
233                 {
234                 if      ((strcmp(*argv,"-port") == 0) ||
235                          (strcmp(*argv,"-accept") == 0))
236                         {
237                         if (--argc < 1) goto bad;
238                         if (!extract_port(*(++argv),&port))
239                                 goto bad;
240                         }
241                 else if (strcmp(*argv,"-verify") == 0)
242                         {
243                         verify=SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE;
244                         if (--argc < 1) goto bad;
245                         verify_depth=atoi(*(++argv));
246                         BIO_printf(bio_err,"verify depth is %d\n",verify_depth);
247                         }
248                 else if (strcmp(*argv,"-Verify") == 0)
249                         {
250                         verify=SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT|
251                                 SSL_VERIFY_CLIENT_ONCE;
252                         if (--argc < 1) goto bad;
253                         verify_depth=atoi(*(++argv));
254                         BIO_printf(bio_err,"verify depth is %d, must return a certificate\n",verify_depth);
255                         }
256                 else if (strcmp(*argv,"-cert") == 0)
257                         {
258                         if (--argc < 1) goto bad;
259                         s_cert_file= *(++argv);
260                         }
261                 else if (strcmp(*argv,"-key") == 0)
262                         {
263                         if (--argc < 1) goto bad;
264                         s_key_file= *(++argv);
265                         }
266                 else if (strcmp(*argv,"-nocert") == 0)
267                         {
268                         nocert=1;
269                         }
270                 else if (strcmp(*argv,"-CApath") == 0)
271                         {
272                         if (--argc < 1) goto bad;
273                         CApath= *(++argv);
274                         }
275                 else if (strcmp(*argv,"-cipher") == 0)
276                         {
277                         if (--argc < 1) goto bad;
278                         cipher= *(++argv);
279                         }
280                 else if (strcmp(*argv,"-CAfile") == 0)
281                         {
282                         if (--argc < 1) goto bad;
283                         CAfile= *(++argv);
284                         }
285 #ifdef FIONBIO  
286                 else if (strcmp(*argv,"-nbio") == 0)
287                         { s_nbio=1; }
288 #endif
289                 else if (strcmp(*argv,"-nbio_test") == 0)
290                         {
291 #ifdef FIONBIO  
292                         s_nbio=1;
293 #endif
294                         s_nbio_test=1;
295                         }
296                 else if (strcmp(*argv,"-debug") == 0)
297                         { s_debug=1; }
298                 else if (strcmp(*argv,"-hack") == 0)
299                         { hack=1; }
300                 else if (strcmp(*argv,"-state") == 0)
301                         { state=1; }
302                 else if (strcmp(*argv,"-quiet") == 0)
303                         { s_quiet=1; }
304                 else if (strcmp(*argv,"-bugs") == 0)
305                         { bugs=1; }
306                 else if (strcmp(*argv,"-no_tmp_rsa") == 0)
307                         { no_tmp_rsa=1; }
308                 else if (strcmp(*argv,"-www") == 0)
309                         { www=1; }
310                 else if (strcmp(*argv,"-WWW") == 0)
311                         { www=2; }
312 #ifndef NO_SSL2
313                 else if (strcmp(*argv,"-ssl2") == 0)
314                         { meth=SSLv2_server_method(); }
315 #endif
316 #ifndef NO_SSL3
317                 else if (strcmp(*argv,"-ssl3") == 0)
318                         { meth=SSLv3_server_method(); }
319 #endif
320                 else
321                         {
322                         BIO_printf(bio_err,"unknown option %s\n",*argv);
323                         badop=1;
324                         break;
325                         }
326                 argc--;
327                 argv++;
328                 }
329         if (badop)
330                 {
331 bad:
332                 sv_usage();
333                 goto end;
334                 }
335
336         if (bio_s_out == NULL)
337                 {
338                 if (s_quiet && !s_debug)
339                         {
340                         bio_s_out=BIO_new(BIO_s_null());
341                         }
342                 else
343                         {
344                         if (bio_s_out == NULL)
345                                 bio_s_out=BIO_new_fp(stdout,BIO_NOCLOSE);
346                         }
347                 }
348
349 #if !defined(NO_RSA) || !defined(NO_DSA)
350         if (nocert)
351 #endif
352                 {
353                 s_cert_file=NULL;
354                 s_key_file=NULL;
355                 }
356
357         SSL_load_error_strings();
358         SSLeay_add_ssl_algorithms();
359
360         ctx=SSL_CTX_new(meth);
361         if (ctx == NULL)
362                 {
363                 ERR_print_errors(bio_err);
364                 goto end;
365                 }
366
367         if (bugs) SSL_CTX_set_options(ctx,SSL_OP_ALL);
368         if (hack) SSL_CTX_set_options(ctx,SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG);
369         if (hack) SSL_CTX_set_options(ctx,SSL_OP_NON_EXPORT_FIRST);
370
371         if (state) SSL_CTX_set_info_callback(ctx,apps_ssl_info_callback);
372
373 #if 0
374         if (cipher == NULL) cipher=getenv("SSL_CIPHER");
375 #endif
376
377 #if 0
378         if (s_cert_file == NULL)
379                 {
380                 BIO_printf(bio_err,"You must specify a certificate file for the server to use\n");
381                 goto end;
382                 }
383 #endif
384
385         if ((!SSL_CTX_load_verify_locations(ctx,CAfile,CApath)) ||
386                 (!SSL_CTX_set_default_verify_paths(ctx)))
387                 {
388                 BIO_printf(bio_err,"X509_load_verify_locations\n");
389                 ERR_print_errors(bio_err);
390                 goto end;
391                 }
392
393 #ifndef NO_DH
394         /* EAY EAY EAY evil hack */
395         dh=load_dh_param();
396         if (dh != NULL)
397                 {
398                 BIO_printf(bio_s_out,"Setting temp DH parameters\n");
399                 }
400         else
401                 {
402                 BIO_printf(bio_s_out,"Using default temp DH parameters\n");
403                 dh=get_dh512();
404                 }
405         BIO_flush(bio_s_out);
406
407         SSL_CTX_set_tmp_dh(ctx,dh);
408         DH_free(dh);
409 #endif
410         
411         if (!set_cert_stuff(ctx,s_cert_file,s_key_file))
412                 goto end;
413
414 #if 1
415         SSL_CTX_set_tmp_rsa_callback(ctx,tmp_rsa_cb);
416 #else
417         if (!no_tmp_rsa && SSL_CTX_need_tmp_RSA(ctx))
418                 {
419                 RSA *rsa;
420
421                 BIO_printf(bio_s_out,"Generating temp (512 bit) RSA key...");
422                 BIO_flush(bio_s_out);
423
424                 rsa=RSA_generate_key(512,RSA_F4,NULL);
425
426                 if (!SSL_CTX_set_tmp_rsa(ctx,rsa))
427                         {
428                         ERR_print_errors(bio_err);
429                         goto end;
430                         }
431                 RSA_free(rsa);
432                 BIO_printf(bio_s_out,"\n");
433                 }
434 #endif
435
436         if (cipher != NULL)
437                 SSL_CTX_set_cipher_list(ctx,cipher);
438         SSL_CTX_set_verify(ctx,verify,verify_callback);
439
440         SSL_CTX_set_client_CA_list(ctx,SSL_load_client_CA_file(s_cert_file));
441
442         BIO_printf(bio_s_out,"ACCEPT\n");
443         if (www)
444                 do_server(port,&accept_socket,www_body);
445         else
446                 do_server(port,&accept_socket,sv_body);
447         print_stats(bio_s_out,ctx);
448         ret=0;
449 end:
450         if (ctx != NULL) SSL_CTX_free(ctx);
451         if (bio_s_out != NULL)
452                 {
453                 BIO_free(bio_s_out);
454                 bio_s_out=NULL;
455                 }
456         EXIT(ret);
457         }
458
459 static void print_stats(bio,ssl_ctx)
460 BIO *bio;
461 SSL_CTX *ssl_ctx;
462         {
463         BIO_printf(bio,"%4ld items in the session cache\n",
464                 SSL_CTX_sess_number(ssl_ctx));
465         BIO_printf(bio,"%4d client connects (SSL_connect())\n",
466                 SSL_CTX_sess_connect(ssl_ctx));
467         BIO_printf(bio,"%4d client connects that finished\n",
468                 SSL_CTX_sess_connect_good(ssl_ctx));
469         BIO_printf(bio,"%4d server accepts (SSL_accept())\n",
470                 SSL_CTX_sess_accept(ssl_ctx));
471         BIO_printf(bio,"%4d server accepts that finished\n",
472                 SSL_CTX_sess_accept_good(ssl_ctx));
473         BIO_printf(bio,"%4d session cache hits\n",SSL_CTX_sess_hits(ssl_ctx));
474         BIO_printf(bio,"%4d session cache misses\n",SSL_CTX_sess_misses(ssl_ctx));
475         BIO_printf(bio,"%4d session cache timeouts\n",SSL_CTX_sess_timeouts(ssl_ctx));
476         BIO_printf(bio,"%4d callback cache hits\n",SSL_CTX_sess_cb_hits(ssl_ctx));
477         }
478
479 static int sv_body(hostname, s)
480 char *hostname;
481 int s;
482         {
483         char *buf=NULL;
484         fd_set readfds;
485         int ret=1,width;
486         int k,i;
487         unsigned long l;
488         SSL *con=NULL;
489         BIO *sbio;
490
491         if ((buf=Malloc(BUFSIZZ)) == NULL)
492                 {
493                 BIO_printf(bio_err,"out of memory\n");
494                 goto err;
495                 }
496 #ifdef FIONBIO  
497         if (s_nbio)
498                 {
499                 unsigned long sl=1;
500
501                 if (!s_quiet)
502                         BIO_printf(bio_err,"turning on non blocking io\n");
503                 socket_ioctl(s,FIONBIO,&sl);
504                 }
505 #endif
506
507         if (con == NULL)
508                 con=(SSL *)SSL_new(ctx);
509         SSL_clear(con);
510
511         sbio=BIO_new_socket(s,BIO_NOCLOSE);
512         if (s_nbio_test)
513                 {
514                 BIO *test;
515
516                 test=BIO_new(BIO_f_nbio_test());
517                 sbio=BIO_push(test,sbio);
518                 }
519         SSL_set_bio(con,sbio,sbio);
520         SSL_set_accept_state(con);
521         /* SSL_set_fd(con,s); */
522
523         if (s_debug)
524                 {
525                 con->debug=1;
526                 BIO_set_callback(SSL_get_rbio(con),bio_dump_cb);
527                 BIO_set_callback_arg(SSL_get_rbio(con),bio_s_out);
528                 }
529
530         width=s+1;
531         for (;;)
532                 {
533                 FD_ZERO(&readfds);
534 #ifndef WINDOWS
535                 FD_SET(fileno(stdin),&readfds);
536 #endif
537                 FD_SET(s,&readfds);
538                 i=select(width,&readfds,NULL,NULL,NULL);
539                 if (i <= 0) continue;
540                 if (FD_ISSET(fileno(stdin),&readfds))
541                         {
542                         i=read(fileno(stdin),buf,BUFSIZZ);
543                         if (!s_quiet)
544                                 {
545                                 if ((i <= 0) || (buf[0] == 'Q'))
546                                         {
547                                         BIO_printf(bio_s_out,"DONE\n");
548                                         SHUTDOWN(s);
549                                         close_accept_socket();
550                                         ret= -11;
551                                         goto err;
552                                         }
553                                 if ((i <= 0) || (buf[0] == 'q'))
554                                         {
555                                         BIO_printf(bio_s_out,"DONE\n");
556                                         SHUTDOWN(s);
557         /*                              close_accept_socket();
558                                         ret= -11;*/
559                                         goto err;
560                                         }
561                                 if (buf[0] == 'r')
562                                         {
563                                         SSL_renegotiate(con);
564                                         i=0; /*13; */
565                                         continue;
566                                         strcpy(buf,"server side RE-NEGOTIATE\n");
567                                         }
568                                 if (buf[0] == 'R')
569                                         {
570                                         SSL_set_verify(con,
571                                                 SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE,NULL);
572                                         SSL_renegotiate(con);
573                                         i=0; /* 13; */
574                                         continue;
575                                         strcpy(buf,"server side RE-NEGOTIATE asking for client cert\n");
576                                         }
577                                 if (buf[0] == 'P')
578                                         {
579                                         static char *str="Lets print some clear text\n";
580                                         BIO_write(SSL_get_wbio(con),str,strlen(str));
581                                         }
582                                 if (buf[0] == 'S')
583                                         {
584                                         print_stats(bio_s_out,SSL_get_SSL_CTX(con));
585                                         }
586                                 }
587                         l=k=0;
588                         for (;;)
589                                 {
590                                 /* should do a select for the write */
591                                 k=SSL_write(con,&(buf[l]),(unsigned int)i);
592                                 if (
593 #ifdef FIONBIO
594                                         s_nbio &&
595 #endif
596                                         BIO_sock_should_retry(k))
597                                         {
598                                         BIO_printf(bio_s_out,"Write BLOCK\n");
599                                         continue;
600                                         }
601                                 if (k <= 0)
602                                         {
603                                         ERR_print_errors(bio_err);
604                                         BIO_printf(bio_s_out,"DONE\n");
605                                         ret=1;
606                                         goto err;
607                                         }
608                                 l+=k;
609                                 i-=k;
610                                 if (i <= 0) break;
611                                 }
612                         }
613                 if (FD_ISSET(s,&readfds))
614                         {
615                         if (!SSL_is_init_finished(con))
616                                 {
617                                 i=init_ssl_connection(con);
618                                 
619                                 if (i < 0)
620                                         {
621                                         ret=0;
622                                         goto err;
623                                         }
624                                 else if (i == 0)
625                                         {
626                                         ret=1;
627                                         goto err;
628                                         }
629                                 }
630                         else
631                                 {
632                                 i=SSL_read(con,(char *)buf,BUFSIZZ);
633                                 if ((i <= 0) &&
634 #ifdef FIONBIO
635                                         s_nbio &&
636 #endif
637                                         BIO_sock_should_retry(i))
638                                         {
639                                         BIO_printf(bio_s_out,"Read BLOCK\n");
640                                         }
641                                 else if (i <= 0)
642                                         {
643                                         ERR_print_errors(bio_err);
644                                         BIO_printf(bio_s_out,"DONE\n");
645                                         ret=1;
646                                         goto err;
647                                         }
648                                 else
649                                         write(fileno(stdout),buf,
650                                                 (unsigned int)i);
651                                 }
652                         }
653                 }
654 err:
655         BIO_printf(bio_s_out,"shutting down SSL\n");
656 #if 1
657         SSL_set_shutdown(con,SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
658 #else
659         SSL_shutdown(con);
660 #endif
661         if (con != NULL) SSL_free(con);
662         BIO_printf(bio_s_out,"CONNECTION CLOSED\n");
663         if (buf != NULL)
664                 {
665                 memset(buf,0,BUFSIZZ);
666                 Free(buf);
667                 }
668         if (ret >= 0)
669                 BIO_printf(bio_s_out,"ACCEPT\n");
670         return(ret);
671         }
672
673 static void close_accept_socket()
674         {
675         BIO_printf(bio_err,"shutdown accept socket\n");
676         if (accept_socket >= 0)
677                 {
678                 SHUTDOWN2(accept_socket);
679                 }
680         }
681
682 static int init_ssl_connection(con)
683 SSL *con;
684         {
685         int i;
686         char *str;
687         X509 *peer;
688         int verify_error;
689         MS_STATIC char buf[BUFSIZ];
690
691         if ((i=SSL_accept(con)) <= 0)
692                 {
693                 if (BIO_sock_should_retry(i))
694                         {
695                         BIO_printf(bio_s_out,"DELAY\n");
696                         return(1);
697                         }
698
699                 BIO_printf(bio_err,"ERROR\n");
700                 verify_error=SSL_get_verify_result(con);
701                 if (verify_error != X509_V_OK)
702                         {
703                         BIO_printf(bio_err,"verify error:%s\n",
704                                 X509_verify_cert_error_string(verify_error));
705                         }
706                 else
707                         ERR_print_errors(bio_err);
708                 return(0);
709                 }
710
711         PEM_write_bio_SSL_SESSION(bio_s_out,SSL_get_session(con));
712
713         peer=SSL_get_peer_certificate(con);
714         if (peer != NULL)
715                 {
716                 BIO_printf(bio_s_out,"Client certificate\n");
717                 PEM_write_bio_X509(bio_s_out,peer);
718                 X509_NAME_oneline(X509_get_subject_name(peer),buf,BUFSIZ);
719                 BIO_printf(bio_s_out,"subject=%s\n",buf);
720                 X509_NAME_oneline(X509_get_issuer_name(peer),buf,BUFSIZ);
721                 BIO_printf(bio_s_out,"issuer=%s\n",buf);
722                 X509_free(peer);
723                 }
724
725         if (SSL_get_shared_ciphers(con,buf,BUFSIZ) != NULL)
726                 BIO_printf(bio_s_out,"Shared ciphers:%s\n",buf);
727         str=SSL_CIPHER_get_name(SSL_get_current_cipher(con));
728         BIO_printf(bio_s_out,"CIPHER is %s\n",(str != NULL)?str:"(NONE)");
729         if (con->hit) BIO_printf(bio_s_out,"Reused session-id\n");
730         return(1);
731         }
732
733 static DH *load_dh_param()
734         {
735         DH *ret=NULL;
736         BIO *bio;
737
738 #ifndef NO_DH
739         if ((bio=BIO_new_file(DH_PARAM,"r")) == NULL)
740                 goto err;
741         ret=PEM_read_bio_DHparams(bio,NULL,NULL);
742 err:
743         if (bio != NULL) BIO_free(bio);
744 #endif
745         return(ret);
746         }
747
748 #if 0
749 static int load_CA(ctx,file)
750 SSL_CTX *ctx;
751 char *file;
752         {
753         FILE *in;
754         X509 *x=NULL;
755
756         if ((in=fopen(file,"r")) == NULL)
757                 return(0);
758
759         for (;;)
760                 {
761                 if (PEM_read_X509(in,&x,NULL) == NULL)
762                         break;
763                 SSL_CTX_add_client_CA(ctx,x);
764                 }
765         if (x != NULL) X509_free(x);
766         fclose(in);
767         return(1);
768         }
769 #endif
770
771 static int www_body(hostname, s)
772 char *hostname;
773 int s;
774         {
775         char buf[1024];
776         int ret=1;
777         int i,j,k,blank,dot;
778         struct stat st_buf;
779         SSL *con;
780         SSL_CIPHER *c;
781         BIO *io,*ssl_bio,*sbio;
782
783         io=BIO_new(BIO_f_buffer());
784         ssl_bio=BIO_new(BIO_f_ssl());
785         if ((io == NULL) || (ssl_bio == NULL)) goto err;
786
787 #ifdef FIONBIO  
788         if (s_nbio)
789                 {
790                 unsigned int long sl=1;
791
792                 if (!s_quiet)
793                         BIO_printf(bio_err,"turning on non blocking io\n");
794                 socket_ioctl(s,FIONBIO,&sl);
795                 }
796 #endif
797
798         /* lets make the output buffer a reasonable size */
799         if (!BIO_set_write_buffer_size(io,16*1024)) goto err;
800
801         if ((con=(SSL *)SSL_new(ctx)) == NULL) goto err;
802
803         sbio=BIO_new_socket(s,BIO_NOCLOSE);
804         if (s_nbio_test)
805                 {
806                 BIO *test;
807
808                 test=BIO_new(BIO_f_nbio_test());
809                 sbio=BIO_push(test,sbio);
810                 }
811         SSL_set_bio(con,sbio,sbio);
812         SSL_set_accept_state(con);
813
814         /* SSL_set_fd(con,s); */
815         BIO_set_ssl(ssl_bio,con,BIO_CLOSE);
816         BIO_push(io,ssl_bio);
817
818         if (s_debug)
819                 {
820                 con->debug=1;
821                 BIO_set_callback(SSL_get_rbio(con),bio_dump_cb);
822                 BIO_set_callback_arg(SSL_get_rbio(con),bio_s_out);
823                 }
824
825         blank=0;
826         for (;;)
827                 {
828                 if (hack)
829                         {
830                         i=SSL_accept(con);
831
832                         switch (SSL_get_error(con,i))
833                                 {
834                         case SSL_ERROR_NONE:
835                                 break;
836                         case SSL_ERROR_WANT_WRITE:
837                         case SSL_ERROR_WANT_READ:
838                         case SSL_ERROR_WANT_X509_LOOKUP:
839                                 continue;
840                         case SSL_ERROR_SYSCALL:
841                         case SSL_ERROR_SSL:
842                         case SSL_ERROR_ZERO_RETURN:
843                                 ret=1;
844                                 goto err;
845                                 break;
846                                 }
847
848                         SSL_renegotiate(con);
849                         SSL_write(con,NULL,0);
850                         }
851
852                 i=BIO_gets(io,buf,sizeof(buf)-1);
853                 if (i < 0) /* error */
854                         {
855                         if (!BIO_should_retry(io))
856                                 {
857                                 if (!s_quiet)
858                                         ERR_print_errors(bio_err);
859                                 goto err;
860                                 }
861                         else
862                                 {
863                                 BIO_printf(bio_s_out,"read R BLOCK\n");
864 #ifndef MSDOS
865                                 sleep(1);
866 #endif
867                                 continue;
868                                 }
869                         }
870                 else if (i == 0) /* end of input */
871                         {
872                         ret=1;
873                         goto end;
874                         }
875
876                 /* else we have data */
877                 if (    ((www == 1) && (strncmp("GET ",buf,4) == 0)) ||
878                         ((www == 2) && (strncmp("GET stats ",buf,10) == 0)))
879                         {
880                         char *p;
881                         X509 *peer;
882                         STACK *sk;
883                         static char *space="                ";
884
885                         BIO_puts(io,"HTTP/1.0 200 ok\r\nContent-type: text/html\r\n\r\n");
886                         BIO_puts(io,"<pre>\n");
887 /*                      BIO_puts(io,SSLeay_version(SSLEAY_VERSION));*/
888                         BIO_puts(io,"\n");
889                         for (i=0; i<local_argc; i++)
890                                 {
891                                 BIO_puts(io,local_argv[i]);
892                                 BIO_write(io," ",1);
893                                 }
894                         BIO_puts(io,"\n");
895
896                         /* The following is evil and should not really
897                          * be done */
898                         BIO_printf(io,"Ciphers supported in s_server binary\n");
899                         sk=SSL_get_ciphers(con);
900                         j=sk_num(sk);
901                         for (i=0; i<j; i++)
902                                 {
903                                 c=(SSL_CIPHER *)sk_value(sk,i);
904                                 BIO_printf(io,"%s:%-25s",
905                                         SSL_CIPHER_get_version(c),
906                                         SSL_CIPHER_get_name(c));
907                                 if ((((i+1)%3) == 0) && (i+1 != j))
908                                         BIO_puts(io,"\n");
909                                 }
910                         BIO_puts(io,"\n");
911                         p=SSL_get_shared_ciphers(con,buf,sizeof(buf));
912                         if (p != NULL)
913                                 {
914                                 BIO_printf(io,"---\nCiphers common between both SSL end points:\n");
915                                 j=i=0;
916                                 while (*p)
917                                         {
918                                         if (*p == ':')
919                                                 {
920                                                 BIO_write(io,space,15-j);
921                                                 i++;
922                                                 j=0;
923                                                 BIO_write(io,((i%3)?" ":"\n"),1);
924                                                 }
925                                         else
926                                                 {
927                                                 BIO_write(io,p,1);
928                                                 j++;
929                                                 }
930                                         p++;
931                                         }
932                                 BIO_puts(io,"\n");
933                                 }
934                         BIO_printf(io,((con->hit)
935                                 ?"---\nReused, "
936                                 :"---\nNew, "));
937                         c=SSL_get_current_cipher(con);
938                         BIO_printf(io,"SSLv%d, Cipher is %s\n",
939                                 SSL_CIPHER_get_version(c),
940                                 SSL_CIPHER_get_name(c));
941                         SSL_SESSION_print(io,SSL_get_session(con));
942                         BIO_printf(io,"---\n");
943                         print_stats(io,SSL_get_SSL_CTX(con));
944                         BIO_printf(io,"---\n");
945                         peer=SSL_get_peer_certificate(con);
946                         if (peer != NULL)
947                                 {
948                                 BIO_printf(io,"Client certificate\n");
949                                 X509_print(io,peer);
950                                 PEM_write_bio_X509(io,peer);
951                                 }
952                         else
953                                 BIO_puts(io,"no client certificate available\n");
954                         break;
955                         }
956                 else if ((www == 2) && (strncmp("GET ",buf,4) == 0))
957                         {
958                         BIO *file;
959                         char *p,*e;
960                         static char *text="HTTP/1.0 200 ok\r\nContent-type: text/plain\r\n\r\n";
961
962                         /* skip the '/' */
963                         p= &(buf[5]);
964                         dot=0;
965                         for (e=p; *e != '\0'; e++)
966                                 {
967                                 if (e[0] == ' ') break;
968                                 if (    (e[0] == '.') &&
969                                         (strncmp(&(e[-1]),"/../",4) == 0))
970                                         dot=1;
971                                 }
972
973                         if (*e == '\0')
974                                 {
975                                 BIO_puts(io,text);
976                                 BIO_printf(io,"'%s' is an invalid file name\r\n",p);
977                                 break;
978                                 }
979                         *e='\0';
980
981                         if (dot)
982                                 {
983                                 BIO_puts(io,text);
984                                 BIO_printf(io,"'%s' contains '..' reference\r\n",p);
985                                 break;
986                                 }
987
988                         if (*p == '/')
989                                 {
990                                 BIO_puts(io,text);
991                                 BIO_printf(io,"'%s' is an invalid path\r\n",p);
992                                 break;
993                                 }
994
995                         /* append if a directory lookup */
996                         if (e[-1] == '/')
997                                 strcat(p,"index.html");
998
999                         /* if a directory, do the index thang */
1000                         if (stat(p,&st_buf) < 0)
1001                                 {
1002                                 BIO_puts(io,text);
1003                                 BIO_printf(io,"Error accessing '%s'\r\n",p);
1004                                 ERR_print_errors(io);
1005                                 break;
1006                                 }
1007                         if (S_ISDIR(st_buf.st_mode))
1008                                 {
1009                                 strcat(p,"/index.html");
1010                                 }
1011
1012                         if ((file=BIO_new_file(p,"r")) == NULL)
1013                                 {
1014                                 BIO_puts(io,text);
1015                                 BIO_printf(io,"Error opening '%s'\r\n",p);
1016                                 ERR_print_errors(io);
1017                                 break;
1018                                 }
1019
1020                         if (!s_quiet)
1021                                 BIO_printf(bio_err,"FILE:%s\n",p);
1022
1023                         i=strlen(p);
1024                         if (    ((i > 5) && (strcmp(&(p[i-5]),".html") == 0)) ||
1025                                 ((i > 4) && (strcmp(&(p[i-4]),".php") == 0)) ||
1026                                 ((i > 4) && (strcmp(&(p[i-4]),".htm") == 0)))
1027                                 BIO_puts(io,"HTTP/1.0 200 ok\r\nContent-type: text/html\r\n\r\n");
1028                         else
1029                                 BIO_puts(io,"HTTP/1.0 200 ok\r\nContent-type: text/plain\r\n\r\n");
1030                         /* send the file */
1031                         for (;;)
1032                                 {
1033                                 i=BIO_read(file,buf,1024);
1034                                 if (i <= 0) break;
1035
1036                                 for (j=0; j<i; )
1037                                         {
1038                                         k=BIO_write(io,&(buf[j]),i-j);
1039                                         if (k <= 0)
1040                                                 {
1041                                                 if (!BIO_should_retry(io))
1042                                                         break;
1043                                                 else
1044                                                         {
1045                                                         BIO_printf(bio_s_out,"rwrite W BLOCK\n");
1046                                                         }
1047                                                 }
1048                                         else
1049                                                 {
1050                                                 j+=k;
1051                                                 }
1052                                         }
1053                                 }
1054                         BIO_free(file);
1055                         break;
1056                         }
1057                 }
1058
1059         for (;;)
1060                 {
1061                 i=(int)BIO_flush(io);
1062                 if (i <= 0)
1063                         {
1064                         if (!BIO_should_retry(io))
1065                                 break;
1066                         }
1067                 else
1068                         break;
1069                 }
1070 end:
1071 #if 0
1072         /* make sure we re-use sessions */
1073         SSL_set_shutdown(con,SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
1074 #else
1075         /* This kills performace */
1076         SSL_shutdown(con);
1077 #endif
1078
1079 err:
1080
1081         if (ret >= 0)
1082                 BIO_printf(bio_s_out,"ACCEPT\n");
1083
1084         if (io != NULL) BIO_free_all(io);
1085 /*      if (ssl_bio != NULL) BIO_free(ssl_bio); */
1086         return(ret);
1087         }
1088
1089 static RSA MS_CALLBACK *tmp_rsa_cb(s,export)
1090 SSL *s;
1091 int export;
1092         {
1093         static RSA *rsa_tmp=NULL;
1094
1095         if (rsa_tmp == NULL)
1096                 {
1097                 if (!s_quiet)
1098                         {
1099                         BIO_printf(bio_err,"Generating temp (512 bit) RSA key...");
1100                         BIO_flush(bio_err);
1101                         }
1102 #ifndef NO_RSA
1103                 rsa_tmp=RSA_generate_key(512,RSA_F4,NULL);
1104 #endif
1105                 if (!s_quiet)
1106                         {
1107                         BIO_printf(bio_err,"\n");
1108                         BIO_flush(bio_err);
1109                         }
1110                 }
1111         return(rsa_tmp);
1112         }