ssl/ssltest.c

   1 /* ssl/ssltest.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111 /* ====================================================================
 112  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
 113  * ECC cipher suite support in OpenSSL originally developed by
 114  * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
 115  */
 116 /* ====================================================================
 117  * Copyright 2005 Nokia. All rights reserved.
 118  *
 119  * The portions of the attached software ("Contribution") is developed by
 120  * Nokia Corporation and is licensed pursuant to the OpenSSL open source
 121  * license.
 122  *
 123  * The Contribution, originally written by Mika Kousa and Pasi Eronen of
 124  * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
 125  * support (see RFC 4279) to OpenSSL.
 126  *
 127  * No patent licenses or other rights except those expressly stated in
 128  * the OpenSSL open source license shall be deemed granted or received
 129  * expressly, by implication, estoppel, or otherwise.
 130  *
 131  * No assurances are provided by Nokia that the Contribution does not
 132  * infringe the patent or other intellectual property rights of any third
 133  * party or that the license provides you with all the necessary rights
 134  * to make use of the Contribution.
 135  *
 136  * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
 137  * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
 138  * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
 139  * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
 140  * OTHERWISE.
 141  */
 142
 143 #define _BSD_SOURCE 1           /* Or gethostname won't be declared properly
 144                                    on Linux and GNU platforms. */
 145
 146 #include <assert.h>
 147 #include <errno.h>
 148 #include <limits.h>
 149 #include <stdio.h>
 150 #include <stdlib.h>
 151 #include <string.h>
 152 #include <time.h>
 153
 154 #define USE_SOCKETS
 155 #include "e_os.h"
 156
 157 #ifdef OPENSSL_SYS_VMS
 158 #define _XOPEN_SOURCE 500       /* Or isascii won't be declared properly on
 159                                    VMS (at least with DECompHP C).  */
 160 #endif
 161
 162 #include <ctype.h>
 163
 164 #include <openssl/bio.h>
 165 #include <openssl/crypto.h>
 166 #include <openssl/evp.h>
 167 #include <openssl/x509.h>
 168 #include <openssl/x509v3.h>
 169 #include <openssl/ssl.h>
 170 #ifndef OPENSSL_NO_ENGINE
 171 #include <openssl/engine.h>
 172 #endif
 173 #include <openssl/err.h>
 174 #include <openssl/rand.h>
 175 #ifndef OPENSSL_NO_RSA
 176 #include <openssl/rsa.h>
 177 #endif
 178 #ifndef OPENSSL_NO_DSA
 179 #include <openssl/dsa.h>
 180 #endif
 181 #ifndef OPENSSL_NO_DH
 182 #include <openssl/dh.h>
 183 #endif
 184 #ifndef OPENSSL_NO_SRP
 185 #include <openssl/srp.h>
 186 #endif
 187 #include <openssl/bn.h>
 188
 189 #define _XOPEN_SOURCE_EXTENDED  1 /* Or gethostname won't be declared properly
 190                                      on Compaq platforms (at least with DEC C).
 191                                      Do not try to put it earlier, or IPv6 includes
 192                                      get screwed...
 193                                   */
 194
 195 #ifdef OPENSSL_SYS_WINDOWS
 196 #include <winsock.h>
 197 #else
 198 #include OPENSSL_UNISTD
 199 #endif
 200
 201 #ifdef OPENSSL_SYS_VMS
 202 #  define TEST_SERVER_CERT "SYS$DISK:[-.APPS]SERVER.PEM"
 203 #  define TEST_CLIENT_CERT "SYS$DISK:[-.APPS]CLIENT.PEM"
 204 #elif defined(OPENSSL_SYS_WINCE)
 205 #  define TEST_SERVER_CERT "\\OpenSSL\\server.pem"
 206 #  define TEST_CLIENT_CERT "\\OpenSSL\\client.pem"
 207 #elif defined(OPENSSL_SYS_NETWARE)
 208 #  define TEST_SERVER_CERT "\\openssl\\apps\\server.pem"
 209 #  define TEST_CLIENT_CERT "\\openssl\\apps\\client.pem"
 210 #else
 211 #  define TEST_SERVER_CERT "../apps/server.pem"
 212 #  define TEST_CLIENT_CERT "../apps/client.pem"
 213 #endif
 214
 215 /* There is really no standard for this, so let's assign some tentative
 216    numbers.  In any case, these numbers are only for this test */
 217 #define COMP_RLE        255
 218 #define COMP_ZLIB       1
 219
 220 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
 221 #ifndef OPENSSL_NO_RSA
 222 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export,int keylength);
 223 static void free_tmp_rsa(void);
 224 #endif
 225 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg);
 226 #define APP_CALLBACK_STRING "Test Callback Argument"
 227 struct app_verify_arg
 228         {
 229         char *string;
 230         int app_verify;
 231         int allow_proxy_certs;
 232         char *proxy_auth;
 233         char *proxy_cond;
 234         };
 235
 236 #ifndef OPENSSL_NO_DH
 237 static DH *get_dh512(void);
 238 static DH *get_dh1024(void);
 239 static DH *get_dh1024dsa(void);
 240 #endif
 241
 242
 243 static char *psk_key=NULL; /* by default PSK is not used */
 244 #ifndef OPENSSL_NO_PSK
 245 static unsigned int psk_client_callback(SSL *ssl, const char *hint, char *identity,
 246         unsigned int max_identity_len, unsigned char *psk,
 247         unsigned int max_psk_len);
 248 static unsigned int psk_server_callback(SSL *ssl, const char *identity, unsigned char *psk,
 249         unsigned int max_psk_len);
 250 #endif
 251
 252 #ifndef OPENSSL_NO_SRP
 253 /* SRP client */
 254 /* This is a context that we pass to all callbacks */
 255 typedef struct srp_client_arg_st
 256         {
 257         char *srppassin;
 258         char *srplogin;
 259         } SRP_CLIENT_ARG;
 260
 261 #define PWD_STRLEN 1024
 262
 263 static char * MS_CALLBACK ssl_give_srp_client_pwd_cb(SSL *s, void *arg)
 264         {
 265         SRP_CLIENT_ARG *srp_client_arg = (SRP_CLIENT_ARG *)arg;
 266         return BUF_strdup((char *)srp_client_arg->srppassin);
 267         }
 268
 269 static char * MS_CALLBACK missing_srp_username_callback(SSL *s, void *arg)
 270         {
 271         SRP_CLIENT_ARG *srp_client_arg = (SRP_CLIENT_ARG *)arg;
 272         return BUF_strdup(srp_client_arg->srplogin);
 273         }
 274
 275 /* SRP server */
 276 /* This is a context that we pass to SRP server callbacks */
 277 typedef struct srp_server_arg_st
 278         {
 279         char *expected_user;
 280         char *pass;
 281         } SRP_SERVER_ARG;
 282
 283 static int MS_CALLBACK ssl_srp_server_param_cb(SSL *s, int *ad, void *arg)
 284         {
 285         SRP_SERVER_ARG * p = (SRP_SERVER_ARG *) arg;
 286
 287         if (strcmp(p->expected_user, SSL_get_srp_username(s)) != 0)
 288                 {
 289                 fprintf(stderr, "User %s doesn't exist\n", SSL_get_srp_username(s));
 290                 return SSL3_AL_FATAL;
 291                 }
 292         if (SSL_set_srp_server_param_pw(s,p->expected_user,p->pass,"1024")<0)
 293                 {
 294                 *ad = SSL_AD_INTERNAL_ERROR;
 295                 return SSL3_AL_FATAL;
 296                 }
 297         return SSL_ERROR_NONE;
 298         }
 299 #endif
 300
 301 static BIO *bio_err=NULL;
 302 static BIO *bio_stdout=NULL;
 303
 304 static char *cipher=NULL;
 305 static int verbose=0;
 306 static int debug=0;
 307 #if 0
 308 /* Not used yet. */
 309 #ifdef FIONBIO
 310 static int s_nbio=0;
 311 #endif
 312 #endif
 313
 314 static const char rnd_seed[] = "string to make the random number generator think it has entropy";
 315
 316 int doit_biopair(SSL *s_ssl,SSL *c_ssl,long bytes,clock_t *s_time,clock_t *c_time);
 317 int doit(SSL *s_ssl,SSL *c_ssl,long bytes);
 318 static int do_test_cipherlist(void);
 319 static void sv_usage(void)
 320         {
 321         fprintf(stderr,"usage: ssltest [args ...]\n");
 322         fprintf(stderr,"\n");
 323 #ifdef OPENSSL_FIPS
 324         fprintf(stderr,"-F             - run test in FIPS mode\n");
 325 #endif
 326         fprintf(stderr," -server_auth  - check server certificate\n");
 327         fprintf(stderr," -client_auth  - do client authentication\n");
 328         fprintf(stderr," -proxy        - allow proxy certificates\n");
 329         fprintf(stderr," -proxy_auth <val> - set proxy policy rights\n");
 330         fprintf(stderr," -proxy_cond <val> - experssion to test proxy policy rights\n");
 331         fprintf(stderr," -v            - more output\n");
 332         fprintf(stderr," -d            - debug output\n");
 333         fprintf(stderr," -reuse        - use session-id reuse\n");
 334         fprintf(stderr," -num <val>    - number of connections to perform\n");
 335         fprintf(stderr," -bytes <val>  - number of bytes to swap between client/server\n");
 336 #ifndef OPENSSL_NO_DH
 337         fprintf(stderr," -dhe1024      - use 1024 bit key (safe prime) for DHE\n");
 338         fprintf(stderr," -dhe1024dsa   - use 1024 bit key (with 160-bit subprime) for DHE\n");
 339         fprintf(stderr," -no_dhe       - disable DHE\n");
 340 #endif
 341 #ifndef OPENSSL_NO_ECDH
 342         fprintf(stderr," -no_ecdhe     - disable ECDHE\n");
 343 #endif
 344 #ifndef OPENSSL_NO_PSK
 345         fprintf(stderr," -psk arg      - PSK in hex (without 0x)\n");
 346 #endif
 347 #ifndef OPENSSL_NO_SRP
 348         fprintf(stderr," -srpuser user  - SRP username to use\n");
 349         fprintf(stderr," -srppass arg   - password for 'user'\n");
 350 #endif
 351 #ifndef OPENSSL_NO_SSL2
 352         fprintf(stderr," -ssl2         - use SSLv2\n");
 353 #endif
 354 #ifndef OPENSSL_NO_SSL3
 355         fprintf(stderr," -ssl3         - use SSLv3\n");
 356 #endif
 357 #ifndef OPENSSL_NO_TLS1
 358         fprintf(stderr," -tls1         - use TLSv1\n");
 359 #endif
 360         fprintf(stderr," -CApath arg   - PEM format directory of CA's\n");
 361         fprintf(stderr," -CAfile arg   - PEM format file of CA's\n");
 362         fprintf(stderr," -cert arg     - Server certificate file\n");
 363         fprintf(stderr," -key arg      - Server key file (default: same as -cert)\n");
 364         fprintf(stderr," -c_cert arg   - Client certificate file\n");
 365         fprintf(stderr," -c_key arg    - Client key file (default: same as -c_cert)\n");
 366         fprintf(stderr," -cipher arg   - The cipher list\n");
 367         fprintf(stderr," -bio_pair     - Use BIO pairs\n");
 368         fprintf(stderr," -f            - Test even cases that can't work\n");
 369         fprintf(stderr," -time         - measure processor time used by client and server\n");
 370         fprintf(stderr," -zlib         - use zlib compression\n");
 371         fprintf(stderr," -rle          - use rle compression\n");
 372 #ifndef OPENSSL_NO_ECDH
 373         fprintf(stderr," -named_curve arg  - Elliptic curve name to use for ephemeral ECDH keys.\n" \
 374                        "                 Use \"openssl ecparam -list_curves\" for all names\n"  \
 375                        "                 (default is sect163r2).\n");
 376 #endif
 377         fprintf(stderr," -test_cipherlist - verifies the order of the ssl cipher lists\n");
 378         }
 379
 380 static void print_details(SSL *c_ssl, const char *prefix)
 381         {
 382         const SSL_CIPHER *ciph;
 383         X509 *cert;
 384
 385         ciph=SSL_get_current_cipher(c_ssl);
 386         BIO_printf(bio_stdout,"%s%s, cipher %s %s",
 387                 prefix,
 388                 SSL_get_version(c_ssl),
 389                 SSL_CIPHER_get_version(ciph),
 390                 SSL_CIPHER_get_name(ciph));
 391         cert=SSL_get_peer_certificate(c_ssl);
 392         if (cert != NULL)
 393                 {
 394                 EVP_PKEY *pkey = X509_get_pubkey(cert);
 395                 if (pkey != NULL)
 396                         {
 397                         if (0)
 398                                 ;
 399 #ifndef OPENSSL_NO_RSA
 400                         else if (pkey->type == EVP_PKEY_RSA && pkey->pkey.rsa != NULL
 401                                 && pkey->pkey.rsa->n != NULL)
 402                                 {
 403                                 BIO_printf(bio_stdout, ", %d bit RSA",
 404                                         BN_num_bits(pkey->pkey.rsa->n));
 405                                 }
 406 #endif
 407 #ifndef OPENSSL_NO_DSA
 408                         else if (pkey->type == EVP_PKEY_DSA && pkey->pkey.dsa != NULL
 409                                 && pkey->pkey.dsa->p != NULL)
 410                                 {
 411                                 BIO_printf(bio_stdout, ", %d bit DSA",
 412                                         BN_num_bits(pkey->pkey.dsa->p));
 413                                 }
 414 #endif
 415                         EVP_PKEY_free(pkey);
 416                         }
 417                 X509_free(cert);
 418                 }
 419         /* The SSL API does not allow us to look at temporary RSA/DH keys,
 420          * otherwise we should print their lengths too */
 421         BIO_printf(bio_stdout,"\n");
 422         }
 423
 424 static void lock_dbg_cb(int mode, int type, const char *file, int line)
 425         {
 426         static int modes[CRYPTO_NUM_LOCKS]; /* = {0, 0, ... } */
 427         const char *errstr = NULL;
 428         int rw;
 429
 430         rw = mode & (CRYPTO_READ|CRYPTO_WRITE);
 431         if (!((rw == CRYPTO_READ) || (rw == CRYPTO_WRITE)))
 432                 {
 433                 errstr = "invalid mode";
 434                 goto err;
 435                 }
 436
 437         if (type < 0 || type >= CRYPTO_NUM_LOCKS)
 438                 {
 439                 errstr = "type out of bounds";
 440                 goto err;
 441                 }
 442
 443         if (mode & CRYPTO_LOCK)
 444                 {
 445                 if (modes[type])
 446                         {
 447                         errstr = "already locked";
 448                         /* must not happen in a single-threaded program
 449                          * (would deadlock) */
 450                         goto err;
 451                         }
 452
 453                 modes[type] = rw;
 454                 }
 455         else if (mode & CRYPTO_UNLOCK)
 456                 {
 457                 if (!modes[type])
 458                         {
 459                         errstr = "not locked";
 460                         goto err;
 461                         }
 462
 463                 if (modes[type] != rw)
 464                         {
 465                         errstr = (rw == CRYPTO_READ) ?
 466                                 "CRYPTO_r_unlock on write lock" :
 467                                 "CRYPTO_w_unlock on read lock";
 468                         }
 469
 470                 modes[type] = 0;
 471                 }
 472         else
 473                 {
 474                 errstr = "invalid mode";
 475                 goto err;
 476                 }
 477
 478  err:
 479         if (errstr)
 480                 {
 481                 /* we cannot use bio_err here */
 482                 fprintf(stderr, "openssl (lock_dbg_cb): %s (mode=%d, type=%d) at %s:%d\n",
 483                         errstr, mode, type, file, line);
 484                 }
 485         }
 486
 487 #ifdef TLSEXT_TYPE_opaque_prf_input
 488 struct cb_info_st { void *input; size_t len; int ret; };
 489 struct cb_info_st co1 = { "C", 1, 1 }; /* try to negotiate oqaque PRF input */
 490 struct cb_info_st co2 = { "C", 1, 2 }; /* insist on oqaque PRF input */
 491 struct cb_info_st so1 = { "S", 1, 1 }; /* try to negotiate oqaque PRF input */
 492 struct cb_info_st so2 = { "S", 1, 2 }; /* insist on oqaque PRF input */
 493
 494 int opaque_prf_input_cb(SSL *ssl, void *peerinput, size_t len, void *arg_)
 495         {
 496         struct cb_info_st *arg = arg_;
 497
 498         if (arg == NULL)
 499                 return 1;
 500
 501         if (!SSL_set_tlsext_opaque_prf_input(ssl, arg->input, arg->len))
 502                 return 0;
 503         return arg->ret;
 504         }
 505 #endif
 506
 507 int main(int argc, char *argv[])
 508         {
 509         char *CApath=NULL,*CAfile=NULL;
 510         int badop=0;
 511         int bio_pair=0;
 512         int force=0;
 513         int tls1=0,ssl2=0,ssl3=0,ret=1;
 514         int client_auth=0;
 515         int server_auth=0,i;
 516         struct app_verify_arg app_verify_arg =
 517                 { APP_CALLBACK_STRING, 0, 0, NULL, NULL };
 518         char *server_cert=TEST_SERVER_CERT;
 519         char *server_key=NULL;
 520         char *client_cert=TEST_CLIENT_CERT;
 521         char *client_key=NULL;
 522 #ifndef OPENSSL_NO_ECDH
 523         char *named_curve = NULL;
 524 #endif
 525         SSL_CTX *s_ctx=NULL;
 526         SSL_CTX *c_ctx=NULL;
 527         const SSL_METHOD *meth=NULL;
 528         SSL *c_ssl,*s_ssl;
 529         int number=1,reuse=0;
 530         long bytes=256L;
 531 #ifndef OPENSSL_NO_DH
 532         DH *dh;
 533         int dhe1024 = 0, dhe1024dsa = 0;
 534 #endif
 535 #ifndef OPENSSL_NO_ECDH
 536         EC_KEY *ecdh = NULL;
 537 #endif
 538 #ifndef OPENSSL_NO_SRP
 539         /* client */
 540         int srp_lateuser = 0;
 541         SRP_CLIENT_ARG srp_client_arg = {NULL,NULL};
 542         /* server */
 543         SRP_SERVER_ARG srp_server_arg = {NULL,NULL};
 544 #endif
 545         int no_dhe = 0;
 546         int no_ecdhe = 0;
 547         int no_psk = 0;
 548         int print_time = 0;
 549         clock_t s_time = 0, c_time = 0;
 550         int comp = 0;
 551 #ifndef OPENSSL_NO_COMP
 552         COMP_METHOD *cm = NULL;
 553 #endif
 554         STACK_OF(SSL_COMP) *ssl_comp_methods = NULL;
 555         int test_cipherlist = 0;
 556 #ifdef OPENSSL_FIPS
 557         int fips_mode=0;
 558 #endif
 559
 560         verbose = 0;
 561         debug = 0;
 562         cipher = 0;
 563
 564         bio_err=BIO_new_fp(stderr,BIO_NOCLOSE|BIO_FP_TEXT);
 565
 566         CRYPTO_set_locking_callback(lock_dbg_cb);
 567
 568         /* enable memory leak checking unless explicitly disabled */
 569         if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) && (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off"))))
 570                 {
 571                 CRYPTO_malloc_debug_init();
 572                 CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
 573                 }
 574         else
 575                 {
 576                 /* OPENSSL_DEBUG_MEMORY=off */
 577                 CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0);
 578                 }
 579         CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
 580
 581         RAND_seed(rnd_seed, sizeof rnd_seed);
 582
 583         bio_stdout=BIO_new_fp(stdout,BIO_NOCLOSE|BIO_FP_TEXT);
 584
 585         argc--;
 586         argv++;
 587
 588         while (argc >= 1)
 589                 {
 590                 if(!strcmp(*argv,"-F"))
 591                         {
 592 #ifdef OPENSSL_FIPS
 593                         fips_mode=1;
 594 #else
 595                         fprintf(stderr,"not compiled with FIPS support, so exitting without running.\n");
 596                         EXIT(0);
 597 #endif
 598                         }
 599                 else if (strcmp(*argv,"-server_auth") == 0)
 600                         server_auth=1;
 601                 else if (strcmp(*argv,"-client_auth") == 0)
 602                         client_auth=1;
 603                 else if (strcmp(*argv,"-proxy_auth") == 0)
 604                         {
 605                         if (--argc < 1) goto bad;
 606                         app_verify_arg.proxy_auth= *(++argv);
 607                         }
 608                 else if (strcmp(*argv,"-proxy_cond") == 0)
 609                         {
 610                         if (--argc < 1) goto bad;
 611                         app_verify_arg.proxy_cond= *(++argv);
 612                         }
 613                 else if (strcmp(*argv,"-v") == 0)
 614                         verbose=1;
 615                 else if (strcmp(*argv,"-d") == 0)
 616                         debug=1;
 617                 else if (strcmp(*argv,"-reuse") == 0)
 618                         reuse=1;
 619                 else if (strcmp(*argv,"-dhe1024") == 0)
 620                         {
 621 #ifndef OPENSSL_NO_DH
 622                         dhe1024=1;
 623 #else
 624                         fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
 625 #endif
 626                         }
 627                 else if (strcmp(*argv,"-dhe1024dsa") == 0)
 628                         {
 629 #ifndef OPENSSL_NO_DH
 630                         dhe1024dsa=1;
 631 #else
 632                         fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
 633 #endif
 634                         }
 635                 else if (strcmp(*argv,"-no_dhe") == 0)
 636                         no_dhe=1;
 637                 else if (strcmp(*argv,"-no_ecdhe") == 0)
 638                         no_ecdhe=1;
 639                 else if (strcmp(*argv,"-psk") == 0)
 640                         {
 641                         if (--argc < 1) goto bad;
 642                         psk_key=*(++argv);
 643 #ifndef OPENSSL_NO_PSK
 644                         if (strspn(psk_key, "abcdefABCDEF1234567890") != strlen(psk_key))
 645                                 {
 646                                 BIO_printf(bio_err,"Not a hex number '%s'\n",*argv);
 647                                 goto bad;
 648                                 }
 649 #else
 650                         no_psk=1;
 651 #endif
 652                         }
 653 #ifndef OPENSSL_NO_SRP
 654                 else if (strcmp(*argv,"-srpuser") == 0)
 655                         {
 656                         if (--argc < 1) goto bad;
 657                         srp_server_arg.expected_user = srp_client_arg.srplogin= *(++argv);
 658                         tls1=1;
 659                         }
 660                 else if (strcmp(*argv,"-srppass") == 0)
 661                         {
 662                         if (--argc < 1) goto bad;
 663                         srp_server_arg.pass = srp_client_arg.srppassin= *(++argv);
 664                         tls1=1;
 665                         }
 666 #endif
 667                 else if (strcmp(*argv,"-ssl2") == 0)
 668                         ssl2=1;
 669                 else if (strcmp(*argv,"-tls1") == 0)
 670                         tls1=1;
 671                 else if (strcmp(*argv,"-ssl3") == 0)
 672                         ssl3=1;
 673                 else if (strncmp(*argv,"-num",4) == 0)
 674                         {
 675                         if (--argc < 1) goto bad;
 676                         number= atoi(*(++argv));
 677                         if (number == 0) number=1;
 678                         }
 679                 else if (strcmp(*argv,"-bytes") == 0)
 680                         {
 681                         if (--argc < 1) goto bad;
 682                         bytes= atol(*(++argv));
 683                         if (bytes == 0L) bytes=1L;
 684                         i=strlen(argv[0]);
 685                         if (argv[0][i-1] == 'k') bytes*=1024L;
 686                         if (argv[0][i-1] == 'm') bytes*=1024L*1024L;
 687                         }
 688                 else if (strcmp(*argv,"-cert") == 0)
 689                         {
 690                         if (--argc < 1) goto bad;
 691                         server_cert= *(++argv);
 692                         }
 693                 else if (strcmp(*argv,"-s_cert") == 0)
 694                         {
 695                         if (--argc < 1) goto bad;
 696                         server_cert= *(++argv);
 697                         }
 698                 else if (strcmp(*argv,"-key") == 0)
 699                         {
 700                         if (--argc < 1) goto bad;
 701                         server_key= *(++argv);
 702                         }
 703                 else if (strcmp(*argv,"-s_key") == 0)
 704                         {
 705                         if (--argc < 1) goto bad;
 706                         server_key= *(++argv);
 707                         }
 708                 else if (strcmp(*argv,"-c_cert") == 0)
 709                         {
 710                         if (--argc < 1) goto bad;
 711                         client_cert= *(++argv);
 712                         }
 713                 else if (strcmp(*argv,"-c_key") == 0)
 714                         {
 715                         if (--argc < 1) goto bad;
 716                         client_key= *(++argv);
 717                         }
 718                 else if (strcmp(*argv,"-cipher") == 0)
 719                         {
 720                         if (--argc < 1) goto bad;
 721                         cipher= *(++argv);
 722                         }
 723                 else if (strcmp(*argv,"-CApath") == 0)
 724                         {
 725                         if (--argc < 1) goto bad;
 726                         CApath= *(++argv);
 727                         }
 728                 else if (strcmp(*argv,"-CAfile") == 0)
 729                         {
 730                         if (--argc < 1) goto bad;
 731                         CAfile= *(++argv);
 732                         }
 733                 else if (strcmp(*argv,"-bio_pair") == 0)
 734                         {
 735                         bio_pair = 1;
 736                         }
 737                 else if (strcmp(*argv,"-f") == 0)
 738                         {
 739                         force = 1;
 740                         }
 741                 else if (strcmp(*argv,"-time") == 0)
 742                         {
 743                         print_time = 1;
 744                         }
 745                 else if (strcmp(*argv,"-zlib") == 0)
 746                         {
 747                         comp = COMP_ZLIB;
 748                         }
 749                 else if (strcmp(*argv,"-rle") == 0)
 750                         {
 751                         comp = COMP_RLE;
 752                         }
 753                 else if (strcmp(*argv,"-named_curve") == 0)
 754                         {
 755                         if (--argc < 1) goto bad;
 756 #ifndef OPENSSL_NO_ECDH
 757                         named_curve = *(++argv);
 758 #else
 759                         fprintf(stderr,"ignoring -named_curve, since I'm compiled without ECDH\n");
 760                         ++argv;
 761 #endif
 762                         }
 763                 else if (strcmp(*argv,"-app_verify") == 0)
 764                         {
 765                         app_verify_arg.app_verify = 1;
 766                         }
 767                 else if (strcmp(*argv,"-proxy") == 0)
 768                         {
 769                         app_verify_arg.allow_proxy_certs = 1;
 770                         }
 771                 else if (strcmp(*argv,"-test_cipherlist") == 0)
 772                         {
 773                         test_cipherlist = 1;
 774                         }
 775                 else
 776                         {
 777                         fprintf(stderr,"unknown option %s\n",*argv);
 778                         badop=1;
 779                         break;
 780                         }
 781                 argc--;
 782                 argv++;
 783                 }
 784         if (badop)
 785                 {
 786 bad:
 787                 sv_usage();
 788                 goto end;
 789                 }
 790
 791         if (test_cipherlist == 1)
 792                 {
 793                 /* ensure that the cipher list are correctly sorted and exit */
 794                 if (do_test_cipherlist() == 0)
 795                         EXIT(1);
 796                 ret = 0;
 797                 goto end;
 798                 }
 799
 800         if (!ssl2 && !ssl3 && !tls1 && number > 1 && !reuse && !force)
 801                 {
 802                 fprintf(stderr, "This case cannot work.  Use -f to perform "
 803                         "the test anyway (and\n-d to see what happens), "
 804                         "or add one of -ssl2, -ssl3, -tls1, -reuse\n"
 805                         "to avoid protocol mismatch.\n");
 806                 EXIT(1);
 807                 }
 808
 809 #ifdef OPENSSL_FIPS
 810         if(fips_mode)
 811                 {
 812                 if(!FIPS_mode_set(1))
 813                         {
 814                         ERR_load_crypto_strings();
 815                         ERR_print_errors(BIO_new_fp(stderr,BIO_NOCLOSE));
 816                         EXIT(1);
 817                         }
 818                 else
 819                         fprintf(stderr,"*** IN FIPS MODE ***\n");
 820                 }
 821 #endif
 822
 823         if (print_time)
 824                 {
 825                 if (!bio_pair)
 826                         {
 827                         fprintf(stderr, "Using BIO pair (-bio_pair)\n");
 828                         bio_pair = 1;
 829                         }
 830                 if (number < 50 && !force)
 831                         fprintf(stderr, "Warning: For accurate timings, use more connections (e.g. -num 1000)\n");
 832                 }
 833
 834 /*      if (cipher == NULL) cipher=getenv("SSL_CIPHER"); */
 835
 836         SSL_library_init();
 837         SSL_load_error_strings();
 838
 839 #ifndef OPENSSL_NO_COMP
 840         if (comp == COMP_ZLIB) cm = COMP_zlib();
 841         if (comp == COMP_RLE) cm = COMP_rle();
 842         if (cm != NULL)
 843                 {
 844                 if (cm->type != NID_undef)
 845                         {
 846                         if (SSL_COMP_add_compression_method(comp, cm) != 0)
 847                                 {
 848                                 fprintf(stderr,
 849                                         "Failed to add compression method\n");
 850                                 ERR_print_errors_fp(stderr);
 851                                 }
 852                         }
 853                 else
 854                         {
 855                         fprintf(stderr,
 856                                 "Warning: %s compression not supported\n",
 857                                 (comp == COMP_RLE ? "rle" :
 858                                         (comp == COMP_ZLIB ? "zlib" :
 859                                                 "unknown")));
 860                         ERR_print_errors_fp(stderr);
 861                         }
 862                 }
 863         ssl_comp_methods = SSL_COMP_get_compression_methods();
 864         fprintf(stderr, "Available compression methods:\n");
 865         {
 866         int j, n = sk_SSL_COMP_num(ssl_comp_methods);
 867         if (n == 0)
 868                 fprintf(stderr, "  NONE\n");
 869         else
 870                 for (j = 0; j < n; j++)
 871                         {
 872                         SSL_COMP *c = sk_SSL_COMP_value(ssl_comp_methods, j);
 873                         fprintf(stderr, "  %d: %s\n", c->id, c->name);
 874                         }
 875         }
 876 #endif
 877
 878 #if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
 879         if (ssl2)
 880                 meth=SSLv2_method();
 881         else
 882         if (tls1)
 883                 meth=TLSv1_method();
 884         else
 885         if (ssl3)
 886                 meth=SSLv3_method();
 887         else
 888                 meth=SSLv23_method();
 889 #else
 890 #ifdef OPENSSL_NO_SSL2
 891         meth=SSLv3_method();
 892 #else
 893         meth=SSLv2_method();
 894 #endif
 895 #endif
 896
 897         c_ctx=SSL_CTX_new(meth);
 898         s_ctx=SSL_CTX_new(meth);
 899         if ((c_ctx == NULL) || (s_ctx == NULL))
 900                 {
 901                 ERR_print_errors(bio_err);
 902                 goto end;
 903                 }
 904
 905         if (cipher != NULL)
 906                 {
 907                 SSL_CTX_set_cipher_list(c_ctx,cipher);
 908                 SSL_CTX_set_cipher_list(s_ctx,cipher);
 909                 }
 910
 911 #ifndef OPENSSL_NO_DH
 912         if (!no_dhe)
 913                 {
 914                 if (dhe1024dsa)
 915                         {
 916                         /* use SSL_OP_SINGLE_DH_USE to avoid small subgroup attacks */
 917                         SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
 918                         dh=get_dh1024dsa();
 919                         }
 920                 else if (dhe1024)
 921                         dh=get_dh1024();
 922                 else
 923                         dh=get_dh512();
 924                 SSL_CTX_set_tmp_dh(s_ctx,dh);
 925                 DH_free(dh);
 926                 }
 927 #else
 928         (void)no_dhe;
 929 #endif
 930
 931 #ifndef OPENSSL_NO_ECDH
 932         if (!no_ecdhe)
 933                 {
 934                 int nid;
 935
 936                 if (named_curve != NULL)
 937                         {
 938                         nid = OBJ_sn2nid(named_curve);
 939                         if (nid == 0)
 940                         {
 941                                 BIO_printf(bio_err, "unknown curve name (%s)\n", named_curve);
 942                                 goto end;
 943                                 }
 944                         }
 945                 else
 946 #ifdef OPENSSL_NO_EC2M
 947                         nid = NID_X9_62_prime256v1;
 948 #else
 949                         nid = NID_sect163r2;
 950 #endif
 951
 952                 ecdh = EC_KEY_new_by_curve_name(nid);
 953                 if (ecdh == NULL)
 954                         {
 955                         BIO_printf(bio_err, "unable to create curve\n");
 956                         goto end;
 957                         }
 958
 959                 SSL_CTX_set_tmp_ecdh(s_ctx, ecdh);
 960                 SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_ECDH_USE);
 961                 EC_KEY_free(ecdh);
 962                 }
 963 #else
 964         (void)no_ecdhe;
 965 #endif
 966
 967 #ifndef OPENSSL_NO_RSA
 968         SSL_CTX_set_tmp_rsa_callback(s_ctx,tmp_rsa_cb);
 969 #endif
 970
 971 #ifdef TLSEXT_TYPE_opaque_prf_input
 972         SSL_CTX_set_tlsext_opaque_prf_input_callback(c_ctx, opaque_prf_input_cb);
 973         SSL_CTX_set_tlsext_opaque_prf_input_callback(s_ctx, opaque_prf_input_cb);
 974         SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(c_ctx, &co1); /* or &co2 or NULL */
 975         SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(s_ctx, &so1); /* or &so2 or NULL */
 976 #endif
 977
 978         if (!SSL_CTX_use_certificate_file(s_ctx,server_cert,SSL_FILETYPE_PEM))
 979                 {
 980                 ERR_print_errors(bio_err);
 981                 }
 982         else if (!SSL_CTX_use_PrivateKey_file(s_ctx,
 983                 (server_key?server_key:server_cert), SSL_FILETYPE_PEM))
 984                 {
 985                 ERR_print_errors(bio_err);
 986                 goto end;
 987                 }
 988
 989         if (client_auth)
 990                 {
 991                 SSL_CTX_use_certificate_file(c_ctx,client_cert,
 992                         SSL_FILETYPE_PEM);
 993                 SSL_CTX_use_PrivateKey_file(c_ctx,
 994                         (client_key?client_key:client_cert),
 995                         SSL_FILETYPE_PEM);
 996                 }
 997
 998         if (    (!SSL_CTX_load_verify_locations(s_ctx,CAfile,CApath)) ||
 999                 (!SSL_CTX_set_default_verify_paths(s_ctx)) ||
1000                 (!SSL_CTX_load_verify_locations(c_ctx,CAfile,CApath)) ||
1001                 (!SSL_CTX_set_default_verify_paths(c_ctx)))
1002                 {
1003                 /* fprintf(stderr,"SSL_load_verify_locations\n"); */
1004                 ERR_print_errors(bio_err);
1005                 /* goto end; */
1006                 }
1007
1008         if (client_auth)
1009                 {
1010                 BIO_printf(bio_err,"client authentication\n");
1011                 SSL_CTX_set_verify(s_ctx,
1012                         SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
1013                         verify_callback);
1014                 SSL_CTX_set_cert_verify_callback(s_ctx, app_verify_callback, &app_verify_arg);
1015                 }
1016         if (server_auth)
1017                 {
1018                 BIO_printf(bio_err,"server authentication\n");
1019                 SSL_CTX_set_verify(c_ctx,SSL_VERIFY_PEER,
1020                         verify_callback);
1021                 SSL_CTX_set_cert_verify_callback(c_ctx, app_verify_callback, &app_verify_arg);
1022                 }
1023
1024         {
1025                 int session_id_context = 0;
1026                 SSL_CTX_set_session_id_context(s_ctx, (void *)&session_id_context, sizeof session_id_context);
1027         }
1028
1029         /* Use PSK only if PSK key is given */
1030         if (psk_key != NULL)
1031                 {
1032                 /* no_psk is used to avoid putting psk command to openssl tool */
1033                 if (no_psk)
1034                         {
1035                         /* if PSK is not compiled in and psk key is
1036                          * given, do nothing and exit successfully */
1037                         ret=0;
1038                         goto end;
1039                         }
1040 #ifndef OPENSSL_NO_PSK
1041                 SSL_CTX_set_psk_client_callback(c_ctx, psk_client_callback);
1042                 SSL_CTX_set_psk_server_callback(s_ctx, psk_server_callback);
1043                 if (debug)
1044                         BIO_printf(bio_err,"setting PSK identity hint to s_ctx\n");
1045                 if (!SSL_CTX_use_psk_identity_hint(s_ctx, "ctx server identity_hint"))
1046                         {
1047                         BIO_printf(bio_err,"error setting PSK identity hint to s_ctx\n");
1048                         ERR_print_errors(bio_err);
1049                         goto end;
1050                         }
1051 #endif
1052                 }
1053 #ifndef OPENSSL_NO_SRP
1054         if (srp_client_arg.srplogin)
1055                 {
1056                 if (srp_lateuser)
1057                         SSL_CTX_set_srp_missing_srp_username_callback(c_ctx,missing_srp_username_callback);
1058                 else if (!SSL_CTX_set_srp_username(c_ctx, srp_client_arg.srplogin))
1059                         {
1060                         BIO_printf(bio_err,"Unable to set SRP username\n");
1061                         goto end;
1062                         }
1063                 SSL_CTX_set_srp_cb_arg(c_ctx,&srp_client_arg);
1064                 SSL_CTX_set_srp_client_pwd_callback(c_ctx, ssl_give_srp_client_pwd_cb);
1065                 /*SSL_CTX_set_srp_strength(c_ctx, srp_client_arg.strength);*/
1066                 }
1067
1068         if (srp_server_arg.expected_user != NULL)
1069                 {
1070                 SSL_CTX_set_verify(s_ctx,SSL_VERIFY_NONE,verify_callback);
1071                 SSL_CTX_set_srp_cb_arg(s_ctx, &srp_server_arg);
1072                 SSL_CTX_set_srp_username_callback(s_ctx, ssl_srp_server_param_cb);
1073                 }
1074 #endif
1075
1076         c_ssl=SSL_new(c_ctx);
1077         s_ssl=SSL_new(s_ctx);
1078
1079 #ifndef OPENSSL_NO_KRB5
1080         if (c_ssl  &&  c_ssl->kssl_ctx)
1081                 {
1082                 char    localhost[MAXHOSTNAMELEN+2];
1083
1084                 if (gethostname(localhost, sizeof localhost-1) == 0)
1085                         {
1086                         localhost[sizeof localhost-1]='\0';
1087                         if(strlen(localhost) == sizeof localhost-1)
1088                                 {
1089                                 BIO_printf(bio_err,"localhost name too long\n");
1090                                 goto end;
1091                                 }
1092                         kssl_ctx_setstring(c_ssl->kssl_ctx, KSSL_SERVER,
1093                                 localhost);
1094                         }
1095                 }
1096 #endif    /* OPENSSL_NO_KRB5  */
1097
1098         for (i=0; i<number; i++)
1099                 {
1100                 if (!reuse) SSL_set_session(c_ssl,NULL);
1101                 if (bio_pair)
1102                         ret=doit_biopair(s_ssl,c_ssl,bytes,&s_time,&c_time);
1103                 else
1104                         ret=doit(s_ssl,c_ssl,bytes);
1105                 }
1106
1107         if (!verbose)
1108                 {
1109                 print_details(c_ssl, "");
1110                 }
1111         if ((number > 1) || (bytes > 1L))
1112                 BIO_printf(bio_stdout, "%d handshakes of %ld bytes done\n",number,bytes);
1113         if (print_time)
1114                 {
1115 #ifdef CLOCKS_PER_SEC
1116                 /* "To determine the time in seconds, the value returned
1117                  * by the clock function should be divided by the value
1118                  * of the macro CLOCKS_PER_SEC."
1119                  *                                       -- ISO/IEC 9899 */
1120                 BIO_printf(bio_stdout, "Approximate total server time: %6.2f s\n"
1121                         "Approximate total client time: %6.2f s\n",
1122                         (double)s_time/CLOCKS_PER_SEC,
1123                         (double)c_time/CLOCKS_PER_SEC);
1124 #else
1125                 /* "`CLOCKS_PER_SEC' undeclared (first use this function)"
1126                  *                            -- cc on NeXTstep/OpenStep */
1127                 BIO_printf(bio_stdout,
1128                         "Approximate total server time: %6.2f units\n"
1129                         "Approximate total client time: %6.2f units\n",
1130                         (double)s_time,
1131                         (double)c_time);
1132 #endif
1133                 }
1134
1135         SSL_free(s_ssl);
1136         SSL_free(c_ssl);
1137
1138 end:
1139         if (s_ctx != NULL) SSL_CTX_free(s_ctx);
1140         if (c_ctx != NULL) SSL_CTX_free(c_ctx);
1141
1142         if (bio_stdout != NULL) BIO_free(bio_stdout);
1143
1144 #ifndef OPENSSL_NO_RSA
1145         free_tmp_rsa();
1146 #endif
1147 #ifndef OPENSSL_NO_ENGINE
1148         ENGINE_cleanup();
1149 #endif
1150         CRYPTO_cleanup_all_ex_data();
1151         ERR_free_strings();
1152         ERR_remove_thread_state(NULL);
1153         EVP_cleanup();
1154         CRYPTO_mem_leaks(bio_err);
1155         if (bio_err != NULL) BIO_free(bio_err);
1156         EXIT(ret);
1157         return ret;
1158         }
1159
1160 int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count,
1161         clock_t *s_time, clock_t *c_time)
1162         {
1163         long cw_num = count, cr_num = count, sw_num = count, sr_num = count;
1164         BIO *s_ssl_bio = NULL, *c_ssl_bio = NULL;
1165         BIO *server = NULL, *server_io = NULL, *client = NULL, *client_io = NULL;
1166         int ret = 1;
1167
1168         size_t bufsiz = 256; /* small buffer for testing */
1169
1170         if (!BIO_new_bio_pair(&server, bufsiz, &server_io, bufsiz))
1171                 goto err;
1172         if (!BIO_new_bio_pair(&client, bufsiz, &client_io, bufsiz))
1173                 goto err;
1174
1175         s_ssl_bio = BIO_new(BIO_f_ssl());
1176         if (!s_ssl_bio)
1177                 goto err;
1178
1179         c_ssl_bio = BIO_new(BIO_f_ssl());
1180         if (!c_ssl_bio)
1181                 goto err;
1182
1183         SSL_set_connect_state(c_ssl);
1184         SSL_set_bio(c_ssl, client, client);
1185         (void)BIO_set_ssl(c_ssl_bio, c_ssl, BIO_NOCLOSE);
1186
1187         SSL_set_accept_state(s_ssl);
1188         SSL_set_bio(s_ssl, server, server);
1189         (void)BIO_set_ssl(s_ssl_bio, s_ssl, BIO_NOCLOSE);
1190
1191         do
1192                 {
1193                 /* c_ssl_bio:          SSL filter BIO
1194                  *
1195                  * client:             pseudo-I/O for SSL library
1196                  *
1197                  * client_io:          client's SSL communication; usually to be
1198                  *                     relayed over some I/O facility, but in this
1199                  *                     test program, we're the server, too:
1200                  *
1201                  * server_io:          server's SSL communication
1202                  *
1203                  * server:             pseudo-I/O for SSL library
1204                  *
1205                  * s_ssl_bio:          SSL filter BIO
1206                  *
1207                  * The client and the server each employ a "BIO pair":
1208                  * client + client_io, server + server_io.
1209                  * BIO pairs are symmetric.  A BIO pair behaves similar
1210                  * to a non-blocking socketpair (but both endpoints must
1211                  * be handled by the same thread).
1212                  * [Here we could connect client and server to the ends
1213                  * of a single BIO pair, but then this code would be less
1214                  * suitable as an example for BIO pairs in general.]
1215                  *
1216                  * Useful functions for querying the state of BIO pair endpoints:
1217                  *
1218                  * BIO_ctrl_pending(bio)              number of bytes we can read now
1219                  * BIO_ctrl_get_read_request(bio)     number of bytes needed to fulfil
1220                  *                                      other side's read attempt
1221                  * BIO_ctrl_get_write_guarantee(bio)   number of bytes we can write now
1222                  *
1223                  * ..._read_request is never more than ..._write_guarantee;
1224                  * it depends on the application which one you should use.
1225                  */
1226
1227                 /* We have non-blocking behaviour throughout this test program, but
1228                  * can be sure that there is *some* progress in each iteration; so
1229                  * we don't have to worry about ..._SHOULD_READ or ..._SHOULD_WRITE
1230                  * -- we just try everything in each iteration
1231                  */
1232
1233                         {
1234                         /* CLIENT */
1235
1236                         MS_STATIC char cbuf[1024*8];
1237                         int i, r;
1238                         clock_t c_clock = clock();
1239
1240                         memset(cbuf, 0, sizeof(cbuf));
1241
1242                         if (debug)
1243                                 if (SSL_in_init(c_ssl))
1244                                         printf("client waiting in SSL_connect - %s\n",
1245                                                 SSL_state_string_long(c_ssl));
1246
1247                         if (cw_num > 0)
1248                                 {
1249                                 /* Write to server. */
1250
1251                                 if (cw_num > (long)sizeof cbuf)
1252                                         i = sizeof cbuf;
1253                                 else
1254                                         i = (int)cw_num;
1255                                 r = BIO_write(c_ssl_bio, cbuf, i);
1256                                 if (r < 0)
1257                                         {
1258                                         if (!BIO_should_retry(c_ssl_bio))
1259                                                 {
1260                                                 fprintf(stderr,"ERROR in CLIENT\n");
1261                                                 goto err;
1262                                                 }
1263                                         /* BIO_should_retry(...) can just be ignored here.
1264                                          * The library expects us to call BIO_write with
1265                                          * the same arguments again, and that's what we will
1266                                          * do in the next iteration. */
1267                                         }
1268                                 else if (r == 0)
1269                                         {
1270                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1271                                         goto err;
1272                                         }
1273                                 else
1274                                         {
1275                                         if (debug)
1276                                                 printf("client wrote %d\n", r);
1277                                         cw_num -= r;
1278                                         }
1279                                 }
1280
1281                         if (cr_num > 0)
1282                                 {
1283                                 /* Read from server. */
1284
1285                                 r = BIO_read(c_ssl_bio, cbuf, sizeof(cbuf));
1286                                 if (r < 0)
1287                                         {
1288                                         if (!BIO_should_retry(c_ssl_bio))
1289                                                 {
1290                                                 fprintf(stderr,"ERROR in CLIENT\n");
1291                                                 goto err;
1292                                                 }
1293                                         /* Again, "BIO_should_retry" can be ignored. */
1294                                         }
1295                                 else if (r == 0)
1296                                         {
1297                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1298                                         goto err;
1299                                         }
1300                                 else
1301                                         {
1302                                         if (debug)
1303                                                 printf("client read %d\n", r);
1304                                         cr_num -= r;
1305                                         }
1306                                 }
1307
1308                         /* c_time and s_time increments will typically be very small
1309                          * (depending on machine speed and clock tick intervals),
1310                          * but sampling over a large number of connections should
1311                          * result in fairly accurate figures.  We cannot guarantee
1312                          * a lot, however -- if each connection lasts for exactly
1313                          * one clock tick, it will be counted only for the client
1314                          * or only for the server or even not at all.
1315                          */
1316                         *c_time += (clock() - c_clock);
1317                         }
1318
1319                         {
1320                         /* SERVER */
1321
1322                         MS_STATIC char sbuf[1024*8];
1323                         int i, r;
1324                         clock_t s_clock = clock();
1325
1326                         memset(sbuf, 0, sizeof(sbuf));
1327
1328                         if (debug)
1329                                 if (SSL_in_init(s_ssl))
1330                                         printf("server waiting in SSL_accept - %s\n",
1331                                                 SSL_state_string_long(s_ssl));
1332
1333                         if (sw_num > 0)
1334                                 {
1335                                 /* Write to client. */
1336
1337                                 if (sw_num > (long)sizeof sbuf)
1338                                         i = sizeof sbuf;
1339                                 else
1340                                         i = (int)sw_num;
1341                                 r = BIO_write(s_ssl_bio, sbuf, i);
1342                                 if (r < 0)
1343                                         {
1344                                         if (!BIO_should_retry(s_ssl_bio))
1345                                                 {
1346                                                 fprintf(stderr,"ERROR in SERVER\n");
1347                                                 goto err;
1348                                                 }
1349                                         /* Ignore "BIO_should_retry". */
1350                                         }
1351                                 else if (r == 0)
1352                                         {
1353                                         fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1354                                         goto err;
1355                                         }
1356                                 else
1357                                         {
1358                                         if (debug)
1359                                                 printf("server wrote %d\n", r);
1360                                         sw_num -= r;
1361                                         }
1362                                 }
1363
1364                         if (sr_num > 0)
1365                                 {
1366                                 /* Read from client. */
1367
1368                                 r = BIO_read(s_ssl_bio, sbuf, sizeof(sbuf));
1369                                 if (r < 0)
1370                                         {
1371                                         if (!BIO_should_retry(s_ssl_bio))
1372                                                 {
1373                                                 fprintf(stderr,"ERROR in SERVER\n");
1374                                                 goto err;
1375                                                 }
1376                                         /* blah, blah */
1377                                         }
1378                                 else if (r == 0)
1379                                         {
1380                                         fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1381                                         goto err;
1382                                         }
1383                                 else
1384                                         {
1385                                         if (debug)
1386                                                 printf("server read %d\n", r);
1387                                         sr_num -= r;
1388                                         }
1389                                 }
1390
1391                         *s_time += (clock() - s_clock);
1392                         }
1393
1394                         {
1395                         /* "I/O" BETWEEN CLIENT AND SERVER. */
1396
1397                         size_t r1, r2;
1398                         BIO *io1 = server_io, *io2 = client_io;
1399                         /* we use the non-copying interface for io1
1400                          * and the standard BIO_write/BIO_read interface for io2
1401                          */
1402
1403                         static int prev_progress = 1;
1404                         int progress = 0;
1405
1406                         /* io1 to io2 */
1407                         do
1408                                 {
1409                                 size_t num;
1410                                 int r;
1411
1412                                 r1 = BIO_ctrl_pending(io1);
1413                                 r2 = BIO_ctrl_get_write_guarantee(io2);
1414
1415                                 num = r1;
1416                                 if (r2 < num)
1417                                         num = r2;
1418                                 if (num)
1419                                         {
1420                                         char *dataptr;
1421
1422                                         if (INT_MAX < num) /* yeah, right */
1423                                                 num = INT_MAX;
1424
1425                                         r = BIO_nread(io1, &dataptr, (int)num);
1426                                         assert(r > 0);
1427                                         assert(r <= (int)num);
1428                                         /* possibly r < num (non-contiguous data) */
1429                                         num = r;
1430                                         r = BIO_write(io2, dataptr, (int)num);
1431                                         if (r != (int)num) /* can't happen */
1432                                                 {
1433                                                 fprintf(stderr, "ERROR: BIO_write could not write "
1434                                                         "BIO_ctrl_get_write_guarantee() bytes");
1435                                                 goto err;
1436                                                 }
1437                                         progress = 1;
1438
1439                                         if (debug)
1440                                                 printf((io1 == client_io) ?
1441                                                         "C->S relaying: %d bytes\n" :
1442                                                         "S->C relaying: %d bytes\n",
1443                                                         (int)num);
1444                                         }
1445                                 }
1446                         while (r1 && r2);
1447
1448                         /* io2 to io1 */
1449                         {
1450                                 size_t num;
1451                                 int r;
1452
1453                                 r1 = BIO_ctrl_pending(io2);
1454                                 r2 = BIO_ctrl_get_read_request(io1);
1455                                 /* here we could use ..._get_write_guarantee instead of
1456                                  * ..._get_read_request, but by using the latter
1457                                  * we test restartability of the SSL implementation
1458                                  * more thoroughly */
1459                                 num = r1;
1460                                 if (r2 < num)
1461                                         num = r2;
1462                                 if (num)
1463                                         {
1464                                         char *dataptr;
1465
1466                                         if (INT_MAX < num)
1467                                                 num = INT_MAX;
1468
1469                                         if (num > 1)
1470                                                 --num; /* test restartability even more thoroughly */
1471
1472                                         r = BIO_nwrite0(io1, &dataptr);
1473                                         assert(r > 0);
1474                                         if (r < (int)num)
1475                                                 num = r;
1476                                         r = BIO_read(io2, dataptr, (int)num);
1477                                         if (r != (int)num) /* can't happen */
1478                                                 {
1479                                                 fprintf(stderr, "ERROR: BIO_read could not read "
1480                                                         "BIO_ctrl_pending() bytes");
1481                                                 goto err;
1482                                                 }
1483                                         progress = 1;
1484                                         r = BIO_nwrite(io1, &dataptr, (int)num);
1485                                         if (r != (int)num) /* can't happen */
1486                                                 {
1487                                                 fprintf(stderr, "ERROR: BIO_nwrite() did not accept "
1488                                                         "BIO_nwrite0() bytes");
1489                                                 goto err;
1490                                                 }
1491
1492                                         if (debug)
1493                                                 printf((io2 == client_io) ?
1494                                                         "C->S relaying: %d bytes\n" :
1495                                                         "S->C relaying: %d bytes\n",
1496                                                         (int)num);
1497                                         }
1498                         } /* no loop, BIO_ctrl_get_read_request now returns 0 anyway */
1499
1500                         if (!progress && !prev_progress)
1501                                 if (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0)
1502                                         {
1503                                         fprintf(stderr, "ERROR: got stuck\n");
1504                                         if (strcmp("SSLv2", SSL_get_version(c_ssl)) == 0)
1505                                                 {
1506                                                 fprintf(stderr, "This can happen for SSL2 because "
1507                                                         "CLIENT-FINISHED and SERVER-VERIFY are written \n"
1508                                                         "concurrently ...");
1509                                                 if (strncmp("2SCF", SSL_state_string(c_ssl), 4) == 0
1510                                                         && strncmp("2SSV", SSL_state_string(s_ssl), 4) == 0)
1511                                                         {
1512                                                         fprintf(stderr, " ok.\n");
1513                                                         goto end;
1514                                                         }
1515                                                 }
1516                                         fprintf(stderr, " ERROR.\n");
1517                                         goto err;
1518                                         }
1519                         prev_progress = progress;
1520                         }
1521                 }
1522         while (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0);
1523
1524         if (verbose)
1525                 print_details(c_ssl, "DONE via BIO pair: ");
1526 end:
1527         ret = 0;
1528
1529  err:
1530         ERR_print_errors(bio_err);
1531
1532         if (server)
1533                 BIO_free(server);
1534         if (server_io)
1535                 BIO_free(server_io);
1536         if (client)
1537                 BIO_free(client);
1538         if (client_io)
1539                 BIO_free(client_io);
1540         if (s_ssl_bio)
1541                 BIO_free(s_ssl_bio);
1542         if (c_ssl_bio)
1543                 BIO_free(c_ssl_bio);
1544
1545         return ret;
1546         }
1547
1548
1549 #define W_READ  1
1550 #define W_WRITE 2
1551 #define C_DONE  1
1552 #define S_DONE  2
1553
1554 int doit(SSL *s_ssl, SSL *c_ssl, long count)
1555         {
1556         MS_STATIC char cbuf[1024*8],sbuf[1024*8];
1557         long cw_num=count,cr_num=count;
1558         long sw_num=count,sr_num=count;
1559         int ret=1;
1560         BIO *c_to_s=NULL;
1561         BIO *s_to_c=NULL;
1562         BIO *c_bio=NULL;
1563         BIO *s_bio=NULL;
1564         int c_r,c_w,s_r,s_w;
1565         int i,j;
1566         int done=0;
1567         int c_write,s_write;
1568         int do_server=0,do_client=0;
1569
1570         memset(cbuf,0,sizeof(cbuf));
1571         memset(sbuf,0,sizeof(sbuf));
1572
1573         c_to_s=BIO_new(BIO_s_mem());
1574         s_to_c=BIO_new(BIO_s_mem());
1575         if ((s_to_c == NULL) || (c_to_s == NULL))
1576                 {
1577                 ERR_print_errors(bio_err);
1578                 goto err;
1579                 }
1580
1581         c_bio=BIO_new(BIO_f_ssl());
1582         s_bio=BIO_new(BIO_f_ssl());
1583         if ((c_bio == NULL) || (s_bio == NULL))
1584                 {
1585                 ERR_print_errors(bio_err);
1586                 goto err;
1587                 }
1588
1589         SSL_set_connect_state(c_ssl);
1590         SSL_set_bio(c_ssl,s_to_c,c_to_s);
1591         BIO_set_ssl(c_bio,c_ssl,BIO_NOCLOSE);
1592
1593         SSL_set_accept_state(s_ssl);
1594         SSL_set_bio(s_ssl,c_to_s,s_to_c);
1595         BIO_set_ssl(s_bio,s_ssl,BIO_NOCLOSE);
1596
1597         c_r=0; s_r=1;
1598         c_w=1; s_w=0;
1599         c_write=1,s_write=0;
1600
1601         /* We can always do writes */
1602         for (;;)
1603                 {
1604                 do_server=0;
1605                 do_client=0;
1606
1607                 i=(int)BIO_pending(s_bio);
1608                 if ((i && s_r) || s_w) do_server=1;
1609
1610                 i=(int)BIO_pending(c_bio);
1611                 if ((i && c_r) || c_w) do_client=1;
1612
1613                 if (do_server && debug)
1614                         {
1615                         if (SSL_in_init(s_ssl))
1616                                 printf("server waiting in SSL_accept - %s\n",
1617                                         SSL_state_string_long(s_ssl));
1618 /*                      else if (s_write)
1619                                 printf("server:SSL_write()\n");
1620                         else
1621                                 printf("server:SSL_read()\n"); */
1622                         }
1623
1624                 if (do_client && debug)
1625                         {
1626                         if (SSL_in_init(c_ssl))
1627                                 printf("client waiting in SSL_connect - %s\n",
1628                                         SSL_state_string_long(c_ssl));
1629 /*                      else if (c_write)
1630                                 printf("client:SSL_write()\n");
1631                         else
1632                                 printf("client:SSL_read()\n"); */
1633                         }
1634
1635                 if (!do_client && !do_server)
1636                         {
1637                         fprintf(stdout,"ERROR IN STARTUP\n");
1638                         ERR_print_errors(bio_err);
1639                         break;
1640                         }
1641                 if (do_client && !(done & C_DONE))
1642                         {
1643                         if (c_write)
1644                                 {
1645                                 j = (cw_num > (long)sizeof(cbuf)) ?
1646                                         (int)sizeof(cbuf) : (int)cw_num;
1647                                 i=BIO_write(c_bio,cbuf,j);
1648                                 if (i < 0)
1649                                         {
1650                                         c_r=0;
1651                                         c_w=0;
1652                                         if (BIO_should_retry(c_bio))
1653                                                 {
1654                                                 if (BIO_should_read(c_bio))
1655                                                         c_r=1;
1656                                                 if (BIO_should_write(c_bio))
1657                                                         c_w=1;
1658                                                 }
1659                                         else
1660                                                 {
1661                                                 fprintf(stderr,"ERROR in CLIENT\n");
1662                                                 ERR_print_errors(bio_err);
1663                                                 goto err;
1664                                                 }
1665                                         }
1666                                 else if (i == 0)
1667                                         {
1668                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1669                                         goto err;
1670                                         }
1671                                 else
1672                                         {
1673                                         if (debug)
1674                                                 printf("client wrote %d\n",i);
1675                                         /* ok */
1676                                         s_r=1;
1677                                         c_write=0;
1678                                         cw_num-=i;
1679                                         }
1680                                 }
1681                         else
1682                                 {
1683                                 i=BIO_read(c_bio,cbuf,sizeof(cbuf));
1684                                 if (i < 0)
1685                                         {
1686                                         c_r=0;
1687                                         c_w=0;
1688                                         if (BIO_should_retry(c_bio))
1689                                                 {
1690                                                 if (BIO_should_read(c_bio))
1691                                                         c_r=1;
1692                                                 if (BIO_should_write(c_bio))
1693                                                         c_w=1;
1694                                                 }
1695                                         else
1696                                                 {
1697                                                 fprintf(stderr,"ERROR in CLIENT\n");
1698                                                 ERR_print_errors(bio_err);
1699                                                 goto err;
1700                                                 }
1701                                         }
1702                                 else if (i == 0)
1703                                         {
1704                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1705                                         goto err;
1706                                         }
1707                                 else
1708                                         {
1709                                         if (debug)
1710                                                 printf("client read %d\n",i);
1711                                         cr_num-=i;
1712                                         if (sw_num > 0)
1713                                                 {
1714                                                 s_write=1;
1715                                                 s_w=1;
1716                                                 }
1717                                         if (cr_num <= 0)
1718                                                 {
1719                                                 s_write=1;
1720                                                 s_w=1;
1721                                                 done=S_DONE|C_DONE;
1722                                                 }
1723                                         }
1724                                 }
1725                         }
1726
1727                 if (do_server && !(done & S_DONE))
1728                         {
1729                         if (!s_write)
1730                                 {
1731                                 i=BIO_read(s_bio,sbuf,sizeof(cbuf));
1732                                 if (i < 0)
1733                                         {
1734                                         s_r=0;
1735                                         s_w=0;
1736                                         if (BIO_should_retry(s_bio))
1737                                                 {
1738                                                 if (BIO_should_read(s_bio))
1739                                                         s_r=1;
1740                                                 if (BIO_should_write(s_bio))
1741                                                         s_w=1;
1742                                                 }
1743                                         else
1744                                                 {
1745                                                 fprintf(stderr,"ERROR in SERVER\n");
1746                                                 ERR_print_errors(bio_err);
1747                                                 goto err;
1748                                                 }
1749                                         }
1750                                 else if (i == 0)
1751                                         {
1752                                         ERR_print_errors(bio_err);
1753                                         fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_read\n");
1754                                         goto err;
1755                                         }
1756                                 else
1757                                         {
1758                                         if (debug)
1759                                                 printf("server read %d\n",i);
1760                                         sr_num-=i;
1761                                         if (cw_num > 0)
1762                                                 {
1763                                                 c_write=1;
1764                                                 c_w=1;
1765                                                 }
1766                                         if (sr_num <= 0)
1767                                                 {
1768                                                 s_write=1;
1769                                                 s_w=1;
1770                                                 c_write=0;
1771                                                 }
1772                                         }
1773                                 }
1774                         else
1775                                 {
1776                                 j = (sw_num > (long)sizeof(sbuf)) ?
1777                                         (int)sizeof(sbuf) : (int)sw_num;
1778                                 i=BIO_write(s_bio,sbuf,j);
1779                                 if (i < 0)
1780                                         {
1781                                         s_r=0;
1782                                         s_w=0;
1783                                         if (BIO_should_retry(s_bio))
1784                                                 {
1785                                                 if (BIO_should_read(s_bio))
1786                                                         s_r=1;
1787                                                 if (BIO_should_write(s_bio))
1788                                                         s_w=1;
1789                                                 }
1790                                         else
1791                                                 {
1792                                                 fprintf(stderr,"ERROR in SERVER\n");
1793                                                 ERR_print_errors(bio_err);
1794                                                 goto err;
1795                                                 }
1796                                         }
1797                                 else if (i == 0)
1798                                         {
1799                                         ERR_print_errors(bio_err);
1800                                         fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_write\n");
1801                                         goto err;
1802                                         }
1803                                 else
1804                                         {
1805                                         if (debug)
1806                                                 printf("server wrote %d\n",i);
1807                                         sw_num-=i;
1808                                         s_write=0;
1809                                         c_r=1;
1810                                         if (sw_num <= 0)
1811                                                 done|=S_DONE;
1812                                         }
1813                                 }
1814                         }
1815
1816                 if ((done & S_DONE) && (done & C_DONE)) break;
1817                 }
1818
1819         if (verbose)
1820                 print_details(c_ssl, "DONE: ");
1821         ret=0;
1822 err:
1823         /* We have to set the BIO's to NULL otherwise they will be
1824          * OPENSSL_free()ed twice.  Once when th s_ssl is SSL_free()ed and
1825          * again when c_ssl is SSL_free()ed.
1826          * This is a hack required because s_ssl and c_ssl are sharing the same
1827          * BIO structure and SSL_set_bio() and SSL_free() automatically
1828          * BIO_free non NULL entries.
1829          * You should not normally do this or be required to do this */
1830         if (s_ssl != NULL)
1831                 {
1832                 s_ssl->rbio=NULL;
1833                 s_ssl->wbio=NULL;
1834                 }
1835         if (c_ssl != NULL)
1836                 {
1837                 c_ssl->rbio=NULL;
1838                 c_ssl->wbio=NULL;
1839                 }
1840
1841         if (c_to_s != NULL) BIO_free(c_to_s);
1842         if (s_to_c != NULL) BIO_free(s_to_c);
1843         if (c_bio != NULL) BIO_free_all(c_bio);
1844         if (s_bio != NULL) BIO_free_all(s_bio);
1845         return(ret);
1846         }
1847
1848 static int get_proxy_auth_ex_data_idx(void)
1849         {
1850         static volatile int idx = -1;
1851         if (idx < 0)
1852                 {
1853                 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
1854                 if (idx < 0)
1855                         {
1856                         idx = X509_STORE_CTX_get_ex_new_index(0,
1857                                 "SSLtest for verify callback", NULL,NULL,NULL);
1858                         }
1859                 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
1860                 }
1861         return idx;
1862         }
1863
1864 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
1865         {
1866         char *s,buf[256];
1867
1868         s=X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),buf,
1869                             sizeof buf);
1870         if (s != NULL)
1871                 {
1872                 if (ok)
1873                         fprintf(stderr,"depth=%d %s\n",
1874                                 ctx->error_depth,buf);
1875                 else
1876                         {
1877                         fprintf(stderr,"depth=%d error=%d %s\n",
1878                                 ctx->error_depth,ctx->error,buf);
1879                         }
1880                 }
1881
1882         if (ok == 0)
1883                 {
1884                 fprintf(stderr,"Error string: %s\n",
1885                         X509_verify_cert_error_string(ctx->error));
1886                 switch (ctx->error)
1887                         {
1888                 case X509_V_ERR_CERT_NOT_YET_VALID:
1889                 case X509_V_ERR_CERT_HAS_EXPIRED:
1890                 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
1891                         fprintf(stderr,"  ... ignored.\n");
1892                         ok=1;
1893                         }
1894                 }
1895
1896         if (ok == 1)
1897                 {
1898                 X509 *xs = ctx->current_cert;
1899 #if 0
1900                 X509 *xi = ctx->current_issuer;
1901 #endif
1902
1903                 if (xs->ex_flags & EXFLAG_PROXY)
1904                         {
1905                         unsigned int *letters =
1906                                 X509_STORE_CTX_get_ex_data(ctx,
1907                                         get_proxy_auth_ex_data_idx());
1908
1909                         if (letters)
1910                                 {
1911                                 int found_any = 0;
1912                                 int i;
1913                                 PROXY_CERT_INFO_EXTENSION *pci =
1914                                         X509_get_ext_d2i(xs, NID_proxyCertInfo,
1915                                                 NULL, NULL);
1916
1917                                 switch (OBJ_obj2nid(pci->proxyPolicy->policyLanguage))
1918                                         {
1919                                 case NID_Independent:
1920                                         /* Completely meaningless in this
1921                                            program, as there's no way to
1922                                            grant explicit rights to a
1923                                            specific PrC.  Basically, using
1924                                            id-ppl-Independent is the perfect
1925                                            way to grant no rights at all. */
1926                                         fprintf(stderr, "  Independent proxy certificate");
1927                                         for (i = 0; i < 26; i++)
1928                                                 letters[i] = 0;
1929                                         break;
1930                                 case NID_id_ppl_inheritAll:
1931                                         /* This is basically a NOP, we
1932                                            simply let the current rights
1933                                            stand as they are. */
1934                                         fprintf(stderr, "  Proxy certificate inherits all");
1935                                         break;
1936                                 default:
1937                                         s = (char *)
1938                                                 pci->proxyPolicy->policy->data;
1939                                         i = pci->proxyPolicy->policy->length;
1940
1941                                         /* The algorithm works as follows:
1942                                            it is assumed that previous
1943                                            iterations or the initial granted
1944                                            rights has already set some elements
1945                                            of `letters'.  What we need to do is
1946                                            to clear those that weren't granted
1947                                            by the current PrC as well.  The
1948                                            easiest way to do this is to add 1
1949                                            to all the elements whose letters
1950                                            are given with the current policy.
1951                                            That way, all elements that are set
1952                                            by the current policy and were
1953                                            already set by earlier policies and
1954                                            through the original grant of rights
1955                                            will get the value 2 or higher.
1956                                            The last thing to do is to sweep
1957                                            through `letters' and keep the
1958                                            elements having the value 2 as set,
1959                                            and clear all the others. */
1960
1961                                         fprintf(stderr, "  Certificate proxy rights = %*.*s", i, i, s);
1962                                         while(i-- > 0)
1963                                                 {
1964                                                 int c = *s++;
1965                                                 if (isascii(c) && isalpha(c))
1966                                                         {
1967                                                         if (islower(c))
1968                                                                 c = toupper(c);
1969                                                         letters[c - 'A']++;
1970                                                         }
1971                                                 }
1972                                         for (i = 0; i < 26; i++)
1973                                                 if (letters[i] < 2)
1974                                                         letters[i] = 0;
1975                                                 else
1976                                                         letters[i] = 1;
1977                                         }
1978
1979                                 found_any = 0;
1980                                 fprintf(stderr,
1981                                         ", resulting proxy rights = ");
1982                                 for(i = 0; i < 26; i++)
1983                                         if (letters[i])
1984                                                 {
1985                                                 fprintf(stderr, "%c", i + 'A');
1986                                                 found_any = 1;
1987                                                 }
1988                                 if (!found_any)
1989                                         fprintf(stderr, "none");
1990                                 fprintf(stderr, "\n");
1991
1992                                 PROXY_CERT_INFO_EXTENSION_free(pci);
1993                                 }
1994                         }
1995                 }
1996
1997         return(ok);
1998         }
1999
2000 static void process_proxy_debug(int indent, const char *format, ...)
2001         {
2002         static const char indentation[] =
2003                 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"
2004                 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"; /* That's 80 > */
2005         char my_format[256];
2006         va_list args;
2007
2008         BIO_snprintf(my_format, sizeof(my_format), "%*.*s %s",
2009                 indent, indent, indentation, format);
2010
2011         va_start(args, format);
2012         vfprintf(stderr, my_format, args);
2013         va_end(args);
2014         }
2015 /* Priority levels:
2016    0    [!]var, ()
2017    1    & ^
2018    2    |
2019 */
2020 static int process_proxy_cond_adders(unsigned int letters[26],
2021         const char *cond, const char **cond_end, int *pos, int indent);
2022 static int process_proxy_cond_val(unsigned int letters[26],
2023         const char *cond, const char **cond_end, int *pos, int indent)
2024         {
2025         int c;
2026         int ok = 1;
2027         int negate = 0;
2028
2029         while(isspace((int)*cond))
2030                 {
2031                 cond++; (*pos)++;
2032                 }
2033         c = *cond;
2034
2035         if (debug)
2036                 process_proxy_debug(indent,
2037                         "Start process_proxy_cond_val at position %d: %s\n",
2038                         *pos, cond);
2039
2040         while(c == '!')
2041                 {
2042                 negate = !negate;
2043                 cond++; (*pos)++;
2044                 while(isspace((int)*cond))
2045                         {
2046                         cond++; (*pos)++;
2047                         }
2048                 c = *cond;
2049                 }
2050
2051         if (c == '(')
2052                 {
2053                 cond++; (*pos)++;
2054                 ok = process_proxy_cond_adders(letters, cond, cond_end, pos,
2055                         indent + 1);
2056                 cond = *cond_end;
2057                 if (ok < 0)
2058                         goto end;
2059                 while(isspace((int)*cond))
2060                         {
2061                         cond++; (*pos)++;
2062                         }
2063                 c = *cond;
2064                 if (c != ')')
2065                         {
2066                         fprintf(stderr,
2067                                 "Weird condition character in position %d: "
2068                                 "%c\n", *pos, c);
2069                         ok = -1;
2070                         goto end;
2071                         }
2072                 cond++; (*pos)++;
2073                 }
2074         else if (isascii(c) && isalpha(c))
2075                 {
2076                 if (islower(c))
2077                         c = toupper(c);
2078                 ok = letters[c - 'A'];
2079                 cond++; (*pos)++;
2080                 }
2081         else
2082                 {
2083                 fprintf(stderr,
2084                         "Weird condition character in position %d: "
2085                         "%c\n", *pos, c);
2086                 ok = -1;
2087                 goto end;
2088                 }
2089  end:
2090         *cond_end = cond;
2091         if (ok >= 0 && negate)
2092                 ok = !ok;
2093
2094         if (debug)
2095                 process_proxy_debug(indent,
2096                         "End process_proxy_cond_val at position %d: %s, returning %d\n",
2097                         *pos, cond, ok);
2098
2099         return ok;
2100         }
2101 static int process_proxy_cond_multipliers(unsigned int letters[26],
2102         const char *cond, const char **cond_end, int *pos, int indent)
2103         {
2104         int ok;
2105         char c;
2106
2107         if (debug)
2108                 process_proxy_debug(indent,
2109                         "Start process_proxy_cond_multipliers at position %d: %s\n",
2110                         *pos, cond);
2111
2112         ok = process_proxy_cond_val(letters, cond, cond_end, pos, indent + 1);
2113         cond = *cond_end;
2114         if (ok < 0)
2115                 goto end;
2116
2117         while(ok >= 0)
2118                 {
2119                 while(isspace((int)*cond))
2120                         {
2121                         cond++; (*pos)++;
2122                         }
2123                 c = *cond;
2124
2125                 switch(c)
2126                         {
2127                 case '&':
2128                 case '^':
2129                         {
2130                         int save_ok = ok;
2131
2132                         cond++; (*pos)++;
2133                         ok = process_proxy_cond_val(letters,
2134                                 cond, cond_end, pos, indent + 1);
2135                         cond = *cond_end;
2136                         if (ok < 0)
2137                                 break;
2138
2139                         switch(c)
2140                                 {
2141                         case '&':
2142                                 ok &= save_ok;
2143                                 break;
2144                         case '^':
2145                                 ok ^= save_ok;
2146                                 break;
2147                         default:
2148                                 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
2149                                         " STOPPING\n");
2150                                 EXIT(1);
2151                                 }
2152                         }
2153                         break;
2154                 default:
2155                         goto end;
2156                         }
2157                 }
2158  end:
2159         if (debug)
2160                 process_proxy_debug(indent,
2161                         "End process_proxy_cond_multipliers at position %d: %s, returning %d\n",
2162                         *pos, cond, ok);
2163
2164         *cond_end = cond;
2165         return ok;
2166         }
2167 static int process_proxy_cond_adders(unsigned int letters[26],
2168         const char *cond, const char **cond_end, int *pos, int indent)
2169         {
2170         int ok;
2171         char c;
2172
2173         if (debug)
2174                 process_proxy_debug(indent,
2175                         "Start process_proxy_cond_adders at position %d: %s\n",
2176                         *pos, cond);
2177
2178         ok = process_proxy_cond_multipliers(letters, cond, cond_end, pos,
2179                 indent + 1);
2180         cond = *cond_end;
2181         if (ok < 0)
2182                 goto end;
2183
2184         while(ok >= 0)
2185                 {
2186                 while(isspace((int)*cond))
2187                         {
2188                         cond++; (*pos)++;
2189                         }
2190                 c = *cond;
2191
2192                 switch(c)
2193                         {
2194                 case '|':
2195                         {
2196                         int save_ok = ok;
2197
2198                         cond++; (*pos)++;
2199                         ok = process_proxy_cond_multipliers(letters,
2200                                 cond, cond_end, pos, indent + 1);
2201                         cond = *cond_end;
2202                         if (ok < 0)
2203                                 break;
2204
2205                         switch(c)
2206                                 {
2207                         case '|':
2208                                 ok |= save_ok;
2209                                 break;
2210                         default:
2211                                 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
2212                                         " STOPPING\n");
2213                                 EXIT(1);
2214                                 }
2215                         }
2216                         break;
2217                 default:
2218                         goto end;
2219                         }
2220                 }
2221  end:
2222         if (debug)
2223                 process_proxy_debug(indent,
2224                         "End process_proxy_cond_adders at position %d: %s, returning %d\n",
2225                         *pos, cond, ok);
2226
2227         *cond_end = cond;
2228         return ok;
2229         }
2230
2231 static int process_proxy_cond(unsigned int letters[26],
2232         const char *cond, const char **cond_end)
2233         {
2234         int pos = 1;
2235         return process_proxy_cond_adders(letters, cond, cond_end, &pos, 1);
2236         }
2237
2238 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg)
2239         {
2240         int ok=1;
2241         struct app_verify_arg *cb_arg = arg;
2242         unsigned int letters[26]; /* only used with proxy_auth */
2243
2244         if (cb_arg->app_verify)
2245                 {
2246                 char *s = NULL,buf[256];
2247
2248                 fprintf(stderr, "In app_verify_callback, allowing cert. ");
2249                 fprintf(stderr, "Arg is: %s\n", cb_arg->string);
2250                 fprintf(stderr, "Finished printing do we have a context? 0x%p a cert? 0x%p\n",
2251                         (void *)ctx, (void *)ctx->cert);
2252                 if (ctx->cert)
2253                         s=X509_NAME_oneline(X509_get_subject_name(ctx->cert),buf,256);
2254                 if (s != NULL)
2255                         {
2256                         fprintf(stderr,"cert depth=%d %s\n",ctx->error_depth,buf);
2257                         }
2258                 return(1);
2259                 }
2260         if (cb_arg->proxy_auth)
2261                 {
2262                 int found_any = 0, i;
2263                 char *sp;
2264
2265                 for(i = 0; i < 26; i++)
2266                         letters[i] = 0;
2267                 for(sp = cb_arg->proxy_auth; *sp; sp++)
2268                         {
2269                         int c = *sp;
2270                         if (isascii(c) && isalpha(c))
2271                                 {
2272                                 if (islower(c))
2273                                         c = toupper(c);
2274                                 letters[c - 'A'] = 1;
2275                                 }
2276                         }
2277
2278                 fprintf(stderr,
2279                         "  Initial proxy rights = ");
2280                 for(i = 0; i < 26; i++)
2281                         if (letters[i])
2282                                 {
2283                                 fprintf(stderr, "%c", i + 'A');
2284                                 found_any = 1;
2285                                 }
2286                 if (!found_any)
2287                         fprintf(stderr, "none");
2288                 fprintf(stderr, "\n");
2289
2290                 X509_STORE_CTX_set_ex_data(ctx,
2291                         get_proxy_auth_ex_data_idx(),letters);
2292                 }
2293         if (cb_arg->allow_proxy_certs)
2294                 {
2295                 X509_STORE_CTX_set_flags(ctx, X509_V_FLAG_ALLOW_PROXY_CERTS);
2296                 }
2297
2298 #ifndef OPENSSL_NO_X509_VERIFY
2299         ok = X509_verify_cert(ctx);
2300 #endif
2301
2302         if (cb_arg->proxy_auth)
2303                 {
2304                 if (ok > 0)
2305                         {
2306                         const char *cond_end = NULL;
2307
2308                         ok = process_proxy_cond(letters,
2309                                 cb_arg->proxy_cond, &cond_end);
2310
2311                         if (ok < 0)
2312                                 EXIT(3);
2313                         if (*cond_end)
2314                                 {
2315                                 fprintf(stderr, "Stopped processing condition before it's end.\n");
2316                                 ok = 0;
2317                                 }
2318                         if (!ok)
2319                                 fprintf(stderr, "Proxy rights check with condition '%s' proved invalid\n",
2320                                         cb_arg->proxy_cond);
2321                         else
2322                                 fprintf(stderr, "Proxy rights check with condition '%s' proved valid\n",
2323                                         cb_arg->proxy_cond);
2324                         }
2325                 }
2326         return(ok);
2327         }
2328
2329 #ifndef OPENSSL_NO_RSA
2330 static RSA *rsa_tmp=NULL;
2331
2332 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength)
2333         {
2334         BIGNUM *bn = NULL;
2335         if (rsa_tmp == NULL)
2336                 {
2337                 bn = BN_new();
2338                 rsa_tmp = RSA_new();
2339                 if(!bn || !rsa_tmp || !BN_set_word(bn, RSA_F4))
2340                         {
2341                         BIO_printf(bio_err, "Memory error...");
2342                         goto end;
2343                         }
2344                 BIO_printf(bio_err,"Generating temp (%d bit) RSA key...",keylength);
2345                 (void)BIO_flush(bio_err);
2346                 if(!RSA_generate_key_ex(rsa_tmp,keylength,bn,NULL))
2347                         {
2348                         BIO_printf(bio_err, "Error generating key.");
2349                         RSA_free(rsa_tmp);
2350                         rsa_tmp = NULL;
2351                         }
2352 end:
2353                 BIO_printf(bio_err,"\n");
2354                 (void)BIO_flush(bio_err);
2355                 }
2356         if(bn) BN_free(bn);
2357         return(rsa_tmp);
2358         }
2359
2360 static void free_tmp_rsa(void)
2361         {
2362         if (rsa_tmp != NULL)
2363                 {
2364                 RSA_free(rsa_tmp);
2365                 rsa_tmp = NULL;
2366                 }
2367         }
2368 #endif
2369
2370 #ifndef OPENSSL_NO_DH
2371 /* These DH parameters have been generated as follows:
2372  *    $ openssl dhparam -C -noout 512
2373  *    $ openssl dhparam -C -noout 1024
2374  *    $ openssl dhparam -C -noout -dsaparam 1024
2375  * (The third function has been renamed to avoid name conflicts.)
2376  */
2377 static DH *get_dh512()
2378         {
2379         static unsigned char dh512_p[]={
2380                 0xCB,0xC8,0xE1,0x86,0xD0,0x1F,0x94,0x17,0xA6,0x99,0xF0,0xC6,
2381                 0x1F,0x0D,0xAC,0xB6,0x25,0x3E,0x06,0x39,0xCA,0x72,0x04,0xB0,
2382                 0x6E,0xDA,0xC0,0x61,0xE6,0x7A,0x77,0x25,0xE8,0x3B,0xB9,0x5F,
2383                 0x9A,0xB6,0xB5,0xFE,0x99,0x0B,0xA1,0x93,0x4E,0x35,0x33,0xB8,
2384                 0xE1,0xF1,0x13,0x4F,0x59,0x1A,0xD2,0x57,0xC0,0x26,0x21,0x33,
2385                 0x02,0xC5,0xAE,0x23,
2386                 };
2387         static unsigned char dh512_g[]={
2388                 0x02,
2389                 };
2390         DH *dh;
2391
2392         if ((dh=DH_new()) == NULL) return(NULL);
2393         dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
2394         dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
2395         if ((dh->p == NULL) || (dh->g == NULL))
2396                 { DH_free(dh); return(NULL); }
2397         return(dh);
2398         }
2399
2400 static DH *get_dh1024()
2401         {
2402         static unsigned char dh1024_p[]={
2403                 0xF8,0x81,0x89,0x7D,0x14,0x24,0xC5,0xD1,0xE6,0xF7,0xBF,0x3A,
2404                 0xE4,0x90,0xF4,0xFC,0x73,0xFB,0x34,0xB5,0xFA,0x4C,0x56,0xA2,
2405                 0xEA,0xA7,0xE9,0xC0,0xC0,0xCE,0x89,0xE1,0xFA,0x63,0x3F,0xB0,
2406                 0x6B,0x32,0x66,0xF1,0xD1,0x7B,0xB0,0x00,0x8F,0xCA,0x87,0xC2,
2407                 0xAE,0x98,0x89,0x26,0x17,0xC2,0x05,0xD2,0xEC,0x08,0xD0,0x8C,
2408                 0xFF,0x17,0x52,0x8C,0xC5,0x07,0x93,0x03,0xB1,0xF6,0x2F,0xB8,
2409                 0x1C,0x52,0x47,0x27,0x1B,0xDB,0xD1,0x8D,0x9D,0x69,0x1D,0x52,
2410                 0x4B,0x32,0x81,0xAA,0x7F,0x00,0xC8,0xDC,0xE6,0xD9,0xCC,0xC1,
2411                 0x11,0x2D,0x37,0x34,0x6C,0xEA,0x02,0x97,0x4B,0x0E,0xBB,0xB1,
2412                 0x71,0x33,0x09,0x15,0xFD,0xDD,0x23,0x87,0x07,0x5E,0x89,0xAB,
2413                 0x6B,0x7C,0x5F,0xEC,0xA6,0x24,0xDC,0x53,
2414                 };
2415         static unsigned char dh1024_g[]={
2416                 0x02,
2417                 };
2418         DH *dh;
2419
2420         if ((dh=DH_new()) == NULL) return(NULL);
2421         dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2422         dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2423         if ((dh->p == NULL) || (dh->g == NULL))
2424                 { DH_free(dh); return(NULL); }
2425         return(dh);
2426         }
2427
2428 static DH *get_dh1024dsa()
2429         {
2430         static unsigned char dh1024_p[]={
2431                 0xC8,0x00,0xF7,0x08,0x07,0x89,0x4D,0x90,0x53,0xF3,0xD5,0x00,
2432                 0x21,0x1B,0xF7,0x31,0xA6,0xA2,0xDA,0x23,0x9A,0xC7,0x87,0x19,
2433                 0x3B,0x47,0xB6,0x8C,0x04,0x6F,0xFF,0xC6,0x9B,0xB8,0x65,0xD2,
2434                 0xC2,0x5F,0x31,0x83,0x4A,0xA7,0x5F,0x2F,0x88,0x38,0xB6,0x55,
2435                 0xCF,0xD9,0x87,0x6D,0x6F,0x9F,0xDA,0xAC,0xA6,0x48,0xAF,0xFC,
2436                 0x33,0x84,0x37,0x5B,0x82,0x4A,0x31,0x5D,0xE7,0xBD,0x52,0x97,
2437                 0xA1,0x77,0xBF,0x10,0x9E,0x37,0xEA,0x64,0xFA,0xCA,0x28,0x8D,
2438                 0x9D,0x3B,0xD2,0x6E,0x09,0x5C,0x68,0xC7,0x45,0x90,0xFD,0xBB,
2439                 0x70,0xC9,0x3A,0xBB,0xDF,0xD4,0x21,0x0F,0xC4,0x6A,0x3C,0xF6,
2440                 0x61,0xCF,0x3F,0xD6,0x13,0xF1,0x5F,0xBC,0xCF,0xBC,0x26,0x9E,
2441                 0xBC,0x0B,0xBD,0xAB,0x5D,0xC9,0x54,0x39,
2442                 };
2443         static unsigned char dh1024_g[]={
2444                 0x3B,0x40,0x86,0xE7,0xF3,0x6C,0xDE,0x67,0x1C,0xCC,0x80,0x05,
2445                 0x5A,0xDF,0xFE,0xBD,0x20,0x27,0x74,0x6C,0x24,0xC9,0x03,0xF3,
2446                 0xE1,0x8D,0xC3,0x7D,0x98,0x27,0x40,0x08,0xB8,0x8C,0x6A,0xE9,
2447                 0xBB,0x1A,0x3A,0xD6,0x86,0x83,0x5E,0x72,0x41,0xCE,0x85,0x3C,
2448                 0xD2,0xB3,0xFC,0x13,0xCE,0x37,0x81,0x9E,0x4C,0x1C,0x7B,0x65,
2449                 0xD3,0xE6,0xA6,0x00,0xF5,0x5A,0x95,0x43,0x5E,0x81,0xCF,0x60,
2450                 0xA2,0x23,0xFC,0x36,0xA7,0x5D,0x7A,0x4C,0x06,0x91,0x6E,0xF6,
2451                 0x57,0xEE,0x36,0xCB,0x06,0xEA,0xF5,0x3D,0x95,0x49,0xCB,0xA7,
2452                 0xDD,0x81,0xDF,0x80,0x09,0x4A,0x97,0x4D,0xA8,0x22,0x72,0xA1,
2453                 0x7F,0xC4,0x70,0x56,0x70,0xE8,0x20,0x10,0x18,0x8F,0x2E,0x60,
2454                 0x07,0xE7,0x68,0x1A,0x82,0x5D,0x32,0xA2,
2455                 };
2456         DH *dh;
2457
2458         if ((dh=DH_new()) == NULL) return(NULL);
2459         dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2460         dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2461         if ((dh->p == NULL) || (dh->g == NULL))
2462                 { DH_free(dh); return(NULL); }
2463         dh->length = 160;
2464         return(dh);
2465         }
2466 #endif
2467
2468 #ifndef OPENSSL_NO_PSK
2469 /* convert the PSK key (psk_key) in ascii to binary (psk) */
2470 static int psk_key2bn(const char *pskkey, unsigned char *psk,
2471         unsigned int max_psk_len)
2472         {
2473         int ret;
2474         BIGNUM *bn = NULL;
2475
2476         ret = BN_hex2bn(&bn, pskkey);
2477         if (!ret)
2478                 {
2479                 BIO_printf(bio_err,"Could not convert PSK key '%s' to BIGNUM\n", pskkey);
2480                 if (bn)
2481                         BN_free(bn);
2482                 return 0;
2483                 }
2484         if (BN_num_bytes(bn) > (int)max_psk_len)
2485                 {
2486                 BIO_printf(bio_err,"psk buffer of callback is too small (%d) for key (%d)\n",
2487                         max_psk_len, BN_num_bytes(bn));
2488                 BN_free(bn);
2489                 return 0;
2490                 }
2491         ret = BN_bn2bin(bn, psk);
2492         BN_free(bn);
2493         return ret;
2494         }
2495
2496 static unsigned int psk_client_callback(SSL *ssl, const char *hint, char *identity,
2497         unsigned int max_identity_len, unsigned char *psk,
2498         unsigned int max_psk_len)
2499         {
2500         int ret;
2501         unsigned int psk_len = 0;
2502
2503         ret = BIO_snprintf(identity, max_identity_len, "Client_identity");
2504         if (ret < 0)
2505                 goto out_err;
2506         if (debug)
2507                 fprintf(stderr, "client: created identity '%s' len=%d\n", identity, ret);
2508         ret = psk_key2bn(psk_key, psk, max_psk_len);
2509         if (ret < 0)
2510                 goto out_err;
2511         psk_len = ret;
2512 out_err:
2513         return psk_len;
2514         }
2515
2516 static unsigned int psk_server_callback(SSL *ssl, const char *identity,
2517         unsigned char *psk, unsigned int max_psk_len)
2518         {
2519         unsigned int psk_len=0;
2520
2521         if (strcmp(identity, "Client_identity") != 0)
2522                 {
2523                 BIO_printf(bio_err, "server: PSK error: client identity not found\n");
2524                 return 0;
2525                 }
2526         psk_len=psk_key2bn(psk_key, psk, max_psk_len);
2527         return psk_len;
2528         }
2529 #endif
2530
2531 static int do_test_cipherlist(void)
2532         {
2533         int i = 0;
2534         const SSL_METHOD *meth;
2535         const SSL_CIPHER *ci, *tci = NULL;
2536
2537 #ifndef OPENSSL_NO_SSL2
2538         fprintf(stderr, "testing SSLv2 cipher list order: ");
2539         meth = SSLv2_method();
2540         while ((ci = meth->get_cipher(i++)) != NULL)
2541                 {
2542                 if (tci != NULL)
2543                         if (ci->id >= tci->id)
2544                                 {
2545                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2546                                 return 0;
2547                                 }
2548                 tci = ci;
2549                 }
2550         fprintf(stderr, "ok\n");
2551 #endif
2552 #ifndef OPENSSL_NO_SSL3
2553         fprintf(stderr, "testing SSLv3 cipher list order: ");
2554         meth = SSLv3_method();
2555         tci = NULL;
2556         while ((ci = meth->get_cipher(i++)) != NULL)
2557                 {
2558                 if (tci != NULL)
2559                         if (ci->id >= tci->id)
2560                                 {
2561                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2562                                 return 0;
2563                                 }
2564                 tci = ci;
2565                 }
2566         fprintf(stderr, "ok\n");
2567 #endif
2568 #ifndef OPENSSL_NO_TLS1
2569         fprintf(stderr, "testing TLSv1 cipher list order: ");
2570         meth = TLSv1_method();
2571         tci = NULL;
2572         while ((ci = meth->get_cipher(i++)) != NULL)
2573                 {
2574                 if (tci != NULL)
2575                         if (ci->id >= tci->id)
2576                                 {
2577                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2578                                 return 0;
2579                                 }
2580                 tci = ci;
2581                 }
2582         fprintf(stderr, "ok\n");
2583 #endif
2584
2585         return 1;
2586         }