ssl/ssltest.c

   1 /* ssl/ssltest.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111 /* ====================================================================
 112  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
 113  * ECC cipher suite support in OpenSSL originally developed by
 114  * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
 115  */
 116 /* ====================================================================
 117  * Copyright 2005 Nokia. All rights reserved.
 118  *
 119  * The portions of the attached software ("Contribution") is developed by
 120  * Nokia Corporation and is licensed pursuant to the OpenSSL open source
 121  * license.
 122  *
 123  * The Contribution, originally written by Mika Kousa and Pasi Eronen of
 124  * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
 125  * support (see RFC 4279) to OpenSSL.
 126  *
 127  * No patent licenses or other rights except those expressly stated in
 128  * the OpenSSL open source license shall be deemed granted or received
 129  * expressly, by implication, estoppel, or otherwise.
 130  *
 131  * No assurances are provided by Nokia that the Contribution does not
 132  * infringe the patent or other intellectual property rights of any third
 133  * party or that the license provides you with all the necessary rights
 134  * to make use of the Contribution.
 135  *
 136  * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
 137  * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
 138  * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
 139  * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
 140  * OTHERWISE.
 141  */
 142
 143 #define _BSD_SOURCE 1           /* Or gethostname won't be declared properly
 144                                    on Linux and GNU platforms. */
 145
 146 #include <assert.h>
 147 #include <errno.h>
 148 #include <limits.h>
 149 #include <stdio.h>
 150 #include <stdlib.h>
 151 #include <string.h>
 152 #include <time.h>
 153
 154 #define USE_SOCKETS
 155 #include "e_os.h"
 156
 157 #ifdef OPENSSL_SYS_VMS
 158 #define _XOPEN_SOURCE 500       /* Or isascii won't be declared properly on
 159                                    VMS (at least with DECompHP C).  */
 160 #endif
 161
 162 #include <ctype.h>
 163
 164 #include <openssl/bio.h>
 165 #include <openssl/crypto.h>
 166 #include <openssl/evp.h>
 167 #include <openssl/x509.h>
 168 #include <openssl/x509v3.h>
 169 #include <openssl/ssl.h>
 170 #ifndef OPENSSL_NO_ENGINE
 171 #include <openssl/engine.h>
 172 #endif
 173 #include <openssl/err.h>
 174 #include <openssl/rand.h>
 175 #ifndef OPENSSL_NO_RSA
 176 #include <openssl/rsa.h>
 177 #endif
 178 #ifndef OPENSSL_NO_DSA
 179 #include <openssl/dsa.h>
 180 #endif
 181 #ifndef OPENSSL_NO_DH
 182 #include <openssl/dh.h>
 183 #endif
 184 #include <openssl/bn.h>
 185
 186 #define _XOPEN_SOURCE_EXTENDED  1 /* Or gethostname won't be declared properly
 187                                      on Compaq platforms (at least with DEC C).
 188                                      Do not try to put it earlier, or IPv6 includes
 189                                      get screwed...
 190                                   */
 191
 192 #ifdef OPENSSL_SYS_WINDOWS
 193 #include <winsock.h>
 194 #else
 195 #include OPENSSL_UNISTD
 196 #endif
 197
 198 #ifdef OPENSSL_SYS_VMS
 199 #  define TEST_SERVER_CERT "SYS$DISK:[-.APPS]SERVER.PEM"
 200 #  define TEST_CLIENT_CERT "SYS$DISK:[-.APPS]CLIENT.PEM"
 201 #elif defined(OPENSSL_SYS_WINCE)
 202 #  define TEST_SERVER_CERT "\\OpenSSL\\server.pem"
 203 #  define TEST_CLIENT_CERT "\\OpenSSL\\client.pem"
 204 #elif defined(OPENSSL_SYS_NETWARE)
 205 #  define TEST_SERVER_CERT "\\openssl\\apps\\server.pem"
 206 #  define TEST_CLIENT_CERT "\\openssl\\apps\\client.pem"
 207 #else
 208 #  define TEST_SERVER_CERT "../apps/server.pem"
 209 #  define TEST_CLIENT_CERT "../apps/client.pem"
 210 #endif
 211
 212 /* There is really no standard for this, so let's assign some tentative
 213    numbers.  In any case, these numbers are only for this test */
 214 #define COMP_RLE        255
 215 #define COMP_ZLIB       1
 216
 217 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
 218 #ifndef OPENSSL_NO_RSA
 219 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export,int keylength);
 220 static void free_tmp_rsa(void);
 221 #endif
 222 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg);
 223 #define APP_CALLBACK_STRING "Test Callback Argument"
 224 struct app_verify_arg
 225         {
 226         char *string;
 227         int app_verify;
 228         int allow_proxy_certs;
 229         char *proxy_auth;
 230         char *proxy_cond;
 231         };
 232
 233 #ifndef OPENSSL_NO_DH
 234 static DH *get_dh512(void);
 235 static DH *get_dh1024(void);
 236 static DH *get_dh1024dsa(void);
 237 #endif
 238
 239
 240 static char *psk_key=NULL; /* by default PSK is not used */
 241 #ifndef OPENSSL_NO_PSK
 242 static unsigned int psk_client_callback(SSL *ssl, const char *hint, char *identity,
 243         unsigned int max_identity_len, unsigned char *psk,
 244         unsigned int max_psk_len);
 245 static unsigned int psk_server_callback(SSL *ssl, const char *identity, unsigned char *psk,
 246         unsigned int max_psk_len);
 247 #endif
 248
 249 static BIO *bio_err=NULL;
 250 static BIO *bio_stdout=NULL;
 251
 252 static char *cipher=NULL;
 253 static int verbose=0;
 254 static int debug=0;
 255 #if 0
 256 /* Not used yet. */
 257 #ifdef FIONBIO
 258 static int s_nbio=0;
 259 #endif
 260 #endif
 261
 262 static const char rnd_seed[] = "string to make the random number generator think it has entropy";
 263
 264 int doit_biopair(SSL *s_ssl,SSL *c_ssl,long bytes,clock_t *s_time,clock_t *c_time);
 265 int doit(SSL *s_ssl,SSL *c_ssl,long bytes);
 266 static int do_test_cipherlist(void);
 267 static void sv_usage(void)
 268         {
 269         fprintf(stderr,"usage: ssltest [args ...]\n");
 270         fprintf(stderr,"\n");
 271         fprintf(stderr," -server_auth  - check server certificate\n");
 272         fprintf(stderr," -client_auth  - do client authentication\n");
 273         fprintf(stderr," -proxy        - allow proxy certificates\n");
 274         fprintf(stderr," -proxy_auth <val> - set proxy policy rights\n");
 275         fprintf(stderr," -proxy_cond <val> - experssion to test proxy policy rights\n");
 276         fprintf(stderr," -v            - more output\n");
 277         fprintf(stderr," -d            - debug output\n");
 278         fprintf(stderr," -reuse        - use session-id reuse\n");
 279         fprintf(stderr," -num <val>    - number of connections to perform\n");
 280         fprintf(stderr," -bytes <val>  - number of bytes to swap between client/server\n");
 281 #ifndef OPENSSL_NO_DH
 282         fprintf(stderr," -dhe1024      - use 1024 bit key (safe prime) for DHE\n");
 283         fprintf(stderr," -dhe1024dsa   - use 1024 bit key (with 160-bit subprime) for DHE\n");
 284         fprintf(stderr," -no_dhe       - disable DHE\n");
 285 #endif
 286 #ifndef OPENSSL_NO_ECDH
 287         fprintf(stderr," -no_ecdhe     - disable ECDHE\n");
 288 #endif
 289 #ifndef OPENSSL_NO_PSK
 290         fprintf(stderr," -psk arg      - PSK in hex (without 0x)\n");
 291 #endif
 292 #ifndef OPENSSL_NO_SSL2
 293         fprintf(stderr," -ssl2         - use SSLv2\n");
 294 #endif
 295 #ifndef OPENSSL_NO_SSL3
 296         fprintf(stderr," -ssl3         - use SSLv3\n");
 297 #endif
 298 #ifndef OPENSSL_NO_TLS1
 299         fprintf(stderr," -tls1         - use TLSv1\n");
 300 #endif
 301         fprintf(stderr," -CApath arg   - PEM format directory of CA's\n");
 302         fprintf(stderr," -CAfile arg   - PEM format file of CA's\n");
 303         fprintf(stderr," -cert arg     - Server certificate file\n");
 304         fprintf(stderr," -key arg      - Server key file (default: same as -cert)\n");
 305         fprintf(stderr," -c_cert arg   - Client certificate file\n");
 306         fprintf(stderr," -c_key arg    - Client key file (default: same as -c_cert)\n");
 307         fprintf(stderr," -cipher arg   - The cipher list\n");
 308         fprintf(stderr," -bio_pair     - Use BIO pairs\n");
 309         fprintf(stderr," -f            - Test even cases that can't work\n");
 310         fprintf(stderr," -time         - measure processor time used by client and server\n");
 311         fprintf(stderr," -zlib         - use zlib compression\n");
 312         fprintf(stderr," -rle          - use rle compression\n");
 313 #ifndef OPENSSL_NO_ECDH
 314         fprintf(stderr," -named_curve arg  - Elliptic curve name to use for ephemeral ECDH keys.\n" \
 315                        "                 Use \"openssl ecparam -list_curves\" for all names\n"  \
 316                        "                 (default is sect163r2).\n");
 317 #endif
 318         fprintf(stderr," -test_cipherlist - verifies the order of the ssl cipher lists\n");
 319         }
 320
 321 static void print_details(SSL *c_ssl, const char *prefix)
 322         {
 323         const SSL_CIPHER *ciph;
 324         X509 *cert;
 325
 326         ciph=SSL_get_current_cipher(c_ssl);
 327         BIO_printf(bio_stdout,"%s%s, cipher %s %s",
 328                 prefix,
 329                 SSL_get_version(c_ssl),
 330                 SSL_CIPHER_get_version(ciph),
 331                 SSL_CIPHER_get_name(ciph));
 332         cert=SSL_get_peer_certificate(c_ssl);
 333         if (cert != NULL)
 334                 {
 335                 EVP_PKEY *pkey = X509_get_pubkey(cert);
 336                 if (pkey != NULL)
 337                         {
 338                         if (0)
 339                                 ;
 340 #ifndef OPENSSL_NO_RSA
 341                         else if (pkey->type == EVP_PKEY_RSA && pkey->pkey.rsa != NULL
 342                                 && pkey->pkey.rsa->n != NULL)
 343                                 {
 344                                 BIO_printf(bio_stdout, ", %d bit RSA",
 345                                         BN_num_bits(pkey->pkey.rsa->n));
 346                                 }
 347 #endif
 348 #ifndef OPENSSL_NO_DSA
 349                         else if (pkey->type == EVP_PKEY_DSA && pkey->pkey.dsa != NULL
 350                                 && pkey->pkey.dsa->p != NULL)
 351                                 {
 352                                 BIO_printf(bio_stdout, ", %d bit DSA",
 353                                         BN_num_bits(pkey->pkey.dsa->p));
 354                                 }
 355 #endif
 356                         EVP_PKEY_free(pkey);
 357                         }
 358                 X509_free(cert);
 359                 }
 360         /* The SSL API does not allow us to look at temporary RSA/DH keys,
 361          * otherwise we should print their lengths too */
 362         BIO_printf(bio_stdout,"\n");
 363         }
 364
 365 static void lock_dbg_cb(int mode, int type, const char *file, int line)
 366         {
 367         static int modes[CRYPTO_NUM_LOCKS]; /* = {0, 0, ... } */
 368         const char *errstr = NULL;
 369         int rw;
 370
 371         rw = mode & (CRYPTO_READ|CRYPTO_WRITE);
 372         if (!((rw == CRYPTO_READ) || (rw == CRYPTO_WRITE)))
 373                 {
 374                 errstr = "invalid mode";
 375                 goto err;
 376                 }
 377
 378         if (type < 0 || type >= CRYPTO_NUM_LOCKS)
 379                 {
 380                 errstr = "type out of bounds";
 381                 goto err;
 382                 }
 383
 384         if (mode & CRYPTO_LOCK)
 385                 {
 386                 if (modes[type])
 387                         {
 388                         errstr = "already locked";
 389                         /* must not happen in a single-threaded program
 390                          * (would deadlock) */
 391                         goto err;
 392                         }
 393
 394                 modes[type] = rw;
 395                 }
 396         else if (mode & CRYPTO_UNLOCK)
 397                 {
 398                 if (!modes[type])
 399                         {
 400                         errstr = "not locked";
 401                         goto err;
 402                         }
 403
 404                 if (modes[type] != rw)
 405                         {
 406                         errstr = (rw == CRYPTO_READ) ?
 407                                 "CRYPTO_r_unlock on write lock" :
 408                                 "CRYPTO_w_unlock on read lock";
 409                         }
 410
 411                 modes[type] = 0;
 412                 }
 413         else
 414                 {
 415                 errstr = "invalid mode";
 416                 goto err;
 417                 }
 418
 419  err:
 420         if (errstr)
 421                 {
 422                 /* we cannot use bio_err here */
 423                 fprintf(stderr, "openssl (lock_dbg_cb): %s (mode=%d, type=%d) at %s:%d\n",
 424                         errstr, mode, type, file, line);
 425                 }
 426         }
 427
 428 #ifdef TLSEXT_TYPE_opaque_prf_input
 429 struct cb_info_st { void *input; size_t len; int ret; };
 430 struct cb_info_st co1 = { "C", 1, 1 }; /* try to negotiate oqaque PRF input */
 431 struct cb_info_st co2 = { "C", 1, 2 }; /* insist on oqaque PRF input */
 432 struct cb_info_st so1 = { "S", 1, 1 }; /* try to negotiate oqaque PRF input */
 433 struct cb_info_st so2 = { "S", 1, 2 }; /* insist on oqaque PRF input */
 434
 435 int opaque_prf_input_cb(SSL *ssl, void *peerinput, size_t len, void *arg_)
 436         {
 437         struct cb_info_st *arg = arg_;
 438
 439         if (arg == NULL)
 440                 return 1;
 441
 442         if (!SSL_set_tlsext_opaque_prf_input(ssl, arg->input, arg->len))
 443                 return 0;
 444         return arg->ret;
 445         }
 446 #endif
 447
 448 int main(int argc, char *argv[])
 449         {
 450         char *CApath=NULL,*CAfile=NULL;
 451         int badop=0;
 452         int bio_pair=0;
 453         int force=0;
 454         int tls1=0,ssl2=0,ssl3=0,ret=1;
 455         int client_auth=0;
 456         int server_auth=0,i;
 457         struct app_verify_arg app_verify_arg =
 458                 { APP_CALLBACK_STRING, 0, 0, NULL, NULL };
 459         char *server_cert=TEST_SERVER_CERT;
 460         char *server_key=NULL;
 461         char *client_cert=TEST_CLIENT_CERT;
 462         char *client_key=NULL;
 463 #ifndef OPENSSL_NO_ECDH
 464         char *named_curve = NULL;
 465 #endif
 466         SSL_CTX *s_ctx=NULL;
 467         SSL_CTX *c_ctx=NULL;
 468         const SSL_METHOD *meth=NULL;
 469         SSL *c_ssl,*s_ssl;
 470         int number=1,reuse=0;
 471         long bytes=256L;
 472 #ifndef OPENSSL_NO_DH
 473         DH *dh;
 474         int dhe1024 = 0, dhe1024dsa = 0;
 475 #endif
 476 #ifndef OPENSSL_NO_ECDH
 477         EC_KEY *ecdh = NULL;
 478 #endif
 479         int no_dhe = 0;
 480         int no_ecdhe = 0;
 481         int no_psk = 0;
 482         int print_time = 0;
 483         clock_t s_time = 0, c_time = 0;
 484         int comp = 0;
 485 #ifndef OPENSSL_NO_COMP
 486         COMP_METHOD *cm = NULL;
 487 #endif
 488         STACK_OF(SSL_COMP) *ssl_comp_methods = NULL;
 489         int test_cipherlist = 0;
 490
 491         verbose = 0;
 492         debug = 0;
 493         cipher = 0;
 494
 495         bio_err=BIO_new_fp(stderr,BIO_NOCLOSE|BIO_FP_TEXT);
 496
 497         CRYPTO_set_locking_callback(lock_dbg_cb);
 498
 499         /* enable memory leak checking unless explicitly disabled */
 500         if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) && (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off"))))
 501                 {
 502                 CRYPTO_malloc_debug_init();
 503                 CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
 504                 }
 505         else
 506                 {
 507                 /* OPENSSL_DEBUG_MEMORY=off */
 508                 CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0);
 509                 }
 510         CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
 511
 512         RAND_seed(rnd_seed, sizeof rnd_seed);
 513
 514         bio_stdout=BIO_new_fp(stdout,BIO_NOCLOSE|BIO_FP_TEXT);
 515
 516         argc--;
 517         argv++;
 518
 519         while (argc >= 1)
 520                 {
 521                 if      (strcmp(*argv,"-server_auth") == 0)
 522                         server_auth=1;
 523                 else if (strcmp(*argv,"-client_auth") == 0)
 524                         client_auth=1;
 525                 else if (strcmp(*argv,"-proxy_auth") == 0)
 526                         {
 527                         if (--argc < 1) goto bad;
 528                         app_verify_arg.proxy_auth= *(++argv);
 529                         }
 530                 else if (strcmp(*argv,"-proxy_cond") == 0)
 531                         {
 532                         if (--argc < 1) goto bad;
 533                         app_verify_arg.proxy_cond= *(++argv);
 534                         }
 535                 else if (strcmp(*argv,"-v") == 0)
 536                         verbose=1;
 537                 else if (strcmp(*argv,"-d") == 0)
 538                         debug=1;
 539                 else if (strcmp(*argv,"-reuse") == 0)
 540                         reuse=1;
 541                 else if (strcmp(*argv,"-dhe1024") == 0)
 542                         {
 543 #ifndef OPENSSL_NO_DH
 544                         dhe1024=1;
 545 #else
 546                         fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
 547 #endif
 548                         }
 549                 else if (strcmp(*argv,"-dhe1024dsa") == 0)
 550                         {
 551 #ifndef OPENSSL_NO_DH
 552                         dhe1024dsa=1;
 553 #else
 554                         fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
 555 #endif
 556                         }
 557                 else if (strcmp(*argv,"-no_dhe") == 0)
 558                         no_dhe=1;
 559                 else if (strcmp(*argv,"-no_ecdhe") == 0)
 560                         no_ecdhe=1;
 561                 else if (strcmp(*argv,"-psk") == 0)
 562                         {
 563                         if (--argc < 1) goto bad;
 564                         psk_key=*(++argv);
 565 #ifndef OPENSSL_NO_PSK
 566                         if (strspn(psk_key, "abcdefABCDEF1234567890") != strlen(psk_key))
 567                                 {
 568                                 BIO_printf(bio_err,"Not a hex number '%s'\n",*argv);
 569                                 goto bad;
 570                                 }
 571 #else
 572                         no_psk=1;
 573 #endif
 574                         }
 575                 else if (strcmp(*argv,"-ssl2") == 0)
 576                         ssl2=1;
 577                 else if (strcmp(*argv,"-tls1") == 0)
 578                         tls1=1;
 579                 else if (strcmp(*argv,"-ssl3") == 0)
 580                         ssl3=1;
 581                 else if (strncmp(*argv,"-num",4) == 0)
 582                         {
 583                         if (--argc < 1) goto bad;
 584                         number= atoi(*(++argv));
 585                         if (number == 0) number=1;
 586                         }
 587                 else if (strcmp(*argv,"-bytes") == 0)
 588                         {
 589                         if (--argc < 1) goto bad;
 590                         bytes= atol(*(++argv));
 591                         if (bytes == 0L) bytes=1L;
 592                         i=strlen(argv[0]);
 593                         if (argv[0][i-1] == 'k') bytes*=1024L;
 594                         if (argv[0][i-1] == 'm') bytes*=1024L*1024L;
 595                         }
 596                 else if (strcmp(*argv,"-cert") == 0)
 597                         {
 598                         if (--argc < 1) goto bad;
 599                         server_cert= *(++argv);
 600                         }
 601                 else if (strcmp(*argv,"-s_cert") == 0)
 602                         {
 603                         if (--argc < 1) goto bad;
 604                         server_cert= *(++argv);
 605                         }
 606                 else if (strcmp(*argv,"-key") == 0)
 607                         {
 608                         if (--argc < 1) goto bad;
 609                         server_key= *(++argv);
 610                         }
 611                 else if (strcmp(*argv,"-s_key") == 0)
 612                         {
 613                         if (--argc < 1) goto bad;
 614                         server_key= *(++argv);
 615                         }
 616                 else if (strcmp(*argv,"-c_cert") == 0)
 617                         {
 618                         if (--argc < 1) goto bad;
 619                         client_cert= *(++argv);
 620                         }
 621                 else if (strcmp(*argv,"-c_key") == 0)
 622                         {
 623                         if (--argc < 1) goto bad;
 624                         client_key= *(++argv);
 625                         }
 626                 else if (strcmp(*argv,"-cipher") == 0)
 627                         {
 628                         if (--argc < 1) goto bad;
 629                         cipher= *(++argv);
 630                         }
 631                 else if (strcmp(*argv,"-CApath") == 0)
 632                         {
 633                         if (--argc < 1) goto bad;
 634                         CApath= *(++argv);
 635                         }
 636                 else if (strcmp(*argv,"-CAfile") == 0)
 637                         {
 638                         if (--argc < 1) goto bad;
 639                         CAfile= *(++argv);
 640                         }
 641                 else if (strcmp(*argv,"-bio_pair") == 0)
 642                         {
 643                         bio_pair = 1;
 644                         }
 645                 else if (strcmp(*argv,"-f") == 0)
 646                         {
 647                         force = 1;
 648                         }
 649                 else if (strcmp(*argv,"-time") == 0)
 650                         {
 651                         print_time = 1;
 652                         }
 653                 else if (strcmp(*argv,"-zlib") == 0)
 654                         {
 655                         comp = COMP_ZLIB;
 656                         }
 657                 else if (strcmp(*argv,"-rle") == 0)
 658                         {
 659                         comp = COMP_RLE;
 660                         }
 661                 else if (strcmp(*argv,"-named_curve") == 0)
 662                         {
 663                         if (--argc < 1) goto bad;
 664 #ifndef OPENSSL_NO_ECDH
 665                         named_curve = *(++argv);
 666 #else
 667                         fprintf(stderr,"ignoring -named_curve, since I'm compiled without ECDH\n");
 668                         ++argv;
 669 #endif
 670                         }
 671                 else if (strcmp(*argv,"-app_verify") == 0)
 672                         {
 673                         app_verify_arg.app_verify = 1;
 674                         }
 675                 else if (strcmp(*argv,"-proxy") == 0)
 676                         {
 677                         app_verify_arg.allow_proxy_certs = 1;
 678                         }
 679                 else if (strcmp(*argv,"-test_cipherlist") == 0)
 680                         {
 681                         test_cipherlist = 1;
 682                         }
 683                 else
 684                         {
 685                         fprintf(stderr,"unknown option %s\n",*argv);
 686                         badop=1;
 687                         break;
 688                         }
 689                 argc--;
 690                 argv++;
 691                 }
 692         if (badop)
 693                 {
 694 bad:
 695                 sv_usage();
 696                 goto end;
 697                 }
 698
 699         if (test_cipherlist == 1)
 700                 {
 701                 /* ensure that the cipher list are correctly sorted and exit */
 702                 if (do_test_cipherlist() == 0)
 703                         EXIT(1);
 704                 ret = 0;
 705                 goto end;
 706                 }
 707
 708         if (!ssl2 && !ssl3 && !tls1 && number > 1 && !reuse && !force)
 709                 {
 710                 fprintf(stderr, "This case cannot work.  Use -f to perform "
 711                         "the test anyway (and\n-d to see what happens), "
 712                         "or add one of -ssl2, -ssl3, -tls1, -reuse\n"
 713                         "to avoid protocol mismatch.\n");
 714                 EXIT(1);
 715                 }
 716
 717         if (print_time)
 718                 {
 719                 if (!bio_pair)
 720                         {
 721                         fprintf(stderr, "Using BIO pair (-bio_pair)\n");
 722                         bio_pair = 1;
 723                         }
 724                 if (number < 50 && !force)
 725                         fprintf(stderr, "Warning: For accurate timings, use more connections (e.g. -num 1000)\n");
 726                 }
 727
 728 /*      if (cipher == NULL) cipher=getenv("SSL_CIPHER"); */
 729
 730         SSL_library_init();
 731         SSL_load_error_strings();
 732
 733 #ifndef OPENSSL_NO_COMP
 734         if (comp == COMP_ZLIB) cm = COMP_zlib();
 735         if (comp == COMP_RLE) cm = COMP_rle();
 736         if (cm != NULL)
 737                 {
 738                 if (cm->type != NID_undef)
 739                         {
 740                         if (SSL_COMP_add_compression_method(comp, cm) != 0)
 741                                 {
 742                                 fprintf(stderr,
 743                                         "Failed to add compression method\n");
 744                                 ERR_print_errors_fp(stderr);
 745                                 }
 746                         }
 747                 else
 748                         {
 749                         fprintf(stderr,
 750                                 "Warning: %s compression not supported\n",
 751                                 (comp == COMP_RLE ? "rle" :
 752                                         (comp == COMP_ZLIB ? "zlib" :
 753                                                 "unknown")));
 754                         ERR_print_errors_fp(stderr);
 755                         }
 756                 }
 757         ssl_comp_methods = SSL_COMP_get_compression_methods();
 758         fprintf(stderr, "Available compression methods:\n");
 759         {
 760         int j, n = sk_SSL_COMP_num(ssl_comp_methods);
 761         if (n == 0)
 762                 fprintf(stderr, "  NONE\n");
 763         else
 764                 for (j = 0; j < n; j++)
 765                         {
 766                         SSL_COMP *c = sk_SSL_COMP_value(ssl_comp_methods, j);
 767                         fprintf(stderr, "  %d: %s\n", c->id, c->name);
 768                         }
 769         }
 770 #endif
 771
 772 #if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
 773         if (ssl2)
 774                 meth=SSLv2_method();
 775         else
 776         if (tls1)
 777                 meth=TLSv1_method();
 778         else
 779         if (ssl3)
 780                 meth=SSLv3_method();
 781         else
 782                 meth=SSLv23_method();
 783 #else
 784 #ifdef OPENSSL_NO_SSL2
 785         if (tls1)
 786                 meth=TLSv1_method();
 787         else
 788         if (ssl3)
 789                 meth=SSLv3_method();
 790         else
 791                 meth=SSLv23_method();
 792 #else
 793         meth=SSLv2_method();
 794 #endif
 795 #endif
 796
 797         c_ctx=SSL_CTX_new(meth);
 798         s_ctx=SSL_CTX_new(meth);
 799         if ((c_ctx == NULL) || (s_ctx == NULL))
 800                 {
 801                 ERR_print_errors(bio_err);
 802                 goto end;
 803                 }
 804
 805         if (cipher != NULL)
 806                 {
 807                 SSL_CTX_set_cipher_list(c_ctx,cipher);
 808                 SSL_CTX_set_cipher_list(s_ctx,cipher);
 809                 }
 810
 811 #ifndef OPENSSL_NO_DH
 812         if (!no_dhe)
 813                 {
 814                 if (dhe1024dsa)
 815                         {
 816                         /* use SSL_OP_SINGLE_DH_USE to avoid small subgroup attacks */
 817                         SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
 818                         dh=get_dh1024dsa();
 819                         }
 820                 else if (dhe1024)
 821                         dh=get_dh1024();
 822                 else
 823                         dh=get_dh512();
 824                 SSL_CTX_set_tmp_dh(s_ctx,dh);
 825                 DH_free(dh);
 826                 }
 827 #else
 828         (void)no_dhe;
 829 #endif
 830
 831 #ifndef OPENSSL_NO_ECDH
 832         if (!no_ecdhe)
 833                 {
 834                 int nid;
 835
 836                 if (named_curve != NULL)
 837                         {
 838                         nid = OBJ_sn2nid(named_curve);
 839                         if (nid == 0)
 840                         {
 841                                 BIO_printf(bio_err, "unknown curve name (%s)\n", named_curve);
 842                                 goto end;
 843                                 }
 844                         }
 845                 else
 846                         nid = NID_sect163r2;
 847
 848                 ecdh = EC_KEY_new_by_curve_name(nid);
 849                 if (ecdh == NULL)
 850                         {
 851                         BIO_printf(bio_err, "unable to create curve\n");
 852                         goto end;
 853                         }
 854
 855                 SSL_CTX_set_tmp_ecdh(s_ctx, ecdh);
 856                 SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_ECDH_USE);
 857                 EC_KEY_free(ecdh);
 858                 }
 859 #else
 860         (void)no_ecdhe;
 861 #endif
 862
 863 #ifndef OPENSSL_NO_RSA
 864         SSL_CTX_set_tmp_rsa_callback(s_ctx,tmp_rsa_cb);
 865 #endif
 866
 867 #ifdef TLSEXT_TYPE_opaque_prf_input
 868         SSL_CTX_set_tlsext_opaque_prf_input_callback(c_ctx, opaque_prf_input_cb);
 869         SSL_CTX_set_tlsext_opaque_prf_input_callback(s_ctx, opaque_prf_input_cb);
 870         SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(c_ctx, &co1); /* or &co2 or NULL */
 871         SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(s_ctx, &so1); /* or &so2 or NULL */
 872 #endif
 873
 874         if (!SSL_CTX_use_certificate_file(s_ctx,server_cert,SSL_FILETYPE_PEM))
 875                 {
 876                 ERR_print_errors(bio_err);
 877                 }
 878         else if (!SSL_CTX_use_PrivateKey_file(s_ctx,
 879                 (server_key?server_key:server_cert), SSL_FILETYPE_PEM))
 880                 {
 881                 ERR_print_errors(bio_err);
 882                 goto end;
 883                 }
 884
 885         if (client_auth)
 886                 {
 887                 SSL_CTX_use_certificate_file(c_ctx,client_cert,
 888                         SSL_FILETYPE_PEM);
 889                 SSL_CTX_use_PrivateKey_file(c_ctx,
 890                         (client_key?client_key:client_cert),
 891                         SSL_FILETYPE_PEM);
 892                 }
 893
 894         if (    (!SSL_CTX_load_verify_locations(s_ctx,CAfile,CApath)) ||
 895                 (!SSL_CTX_set_default_verify_paths(s_ctx)) ||
 896                 (!SSL_CTX_load_verify_locations(c_ctx,CAfile,CApath)) ||
 897                 (!SSL_CTX_set_default_verify_paths(c_ctx)))
 898                 {
 899                 /* fprintf(stderr,"SSL_load_verify_locations\n"); */
 900                 ERR_print_errors(bio_err);
 901                 /* goto end; */
 902                 }
 903
 904         if (client_auth)
 905                 {
 906                 BIO_printf(bio_err,"client authentication\n");
 907                 SSL_CTX_set_verify(s_ctx,
 908                         SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
 909                         verify_callback);
 910                 SSL_CTX_set_cert_verify_callback(s_ctx, app_verify_callback, &app_verify_arg);
 911                 }
 912         if (server_auth)
 913                 {
 914                 BIO_printf(bio_err,"server authentication\n");
 915                 SSL_CTX_set_verify(c_ctx,SSL_VERIFY_PEER,
 916                         verify_callback);
 917                 SSL_CTX_set_cert_verify_callback(c_ctx, app_verify_callback, &app_verify_arg);
 918                 }
 919
 920         {
 921                 int session_id_context = 0;
 922                 SSL_CTX_set_session_id_context(s_ctx, (void *)&session_id_context, sizeof session_id_context);
 923         }
 924
 925         /* Use PSK only if PSK key is given */
 926         if (psk_key != NULL)
 927                 {
 928                 /* no_psk is used to avoid putting psk command to openssl tool */
 929                 if (no_psk)
 930                         {
 931                         /* if PSK is not compiled in and psk key is
 932                          * given, do nothing and exit successfully */
 933                         ret=0;
 934                         goto end;
 935                         }
 936 #ifndef OPENSSL_NO_PSK
 937                 SSL_CTX_set_psk_client_callback(c_ctx, psk_client_callback);
 938                 SSL_CTX_set_psk_server_callback(s_ctx, psk_server_callback);
 939                 if (debug)
 940                         BIO_printf(bio_err,"setting PSK identity hint to s_ctx\n");
 941                 if (!SSL_CTX_use_psk_identity_hint(s_ctx, "ctx server identity_hint"))
 942                         {
 943                         BIO_printf(bio_err,"error setting PSK identity hint to s_ctx\n");
 944                         ERR_print_errors(bio_err);
 945                         goto end;
 946                         }
 947 #endif
 948                 }
 949
 950         c_ssl=SSL_new(c_ctx);
 951         s_ssl=SSL_new(s_ctx);
 952
 953 #ifndef OPENSSL_NO_KRB5
 954         if (c_ssl  &&  c_ssl->kssl_ctx)
 955                 {
 956                 char    localhost[MAXHOSTNAMELEN+2];
 957
 958                 if (gethostname(localhost, sizeof localhost-1) == 0)
 959                         {
 960                         localhost[sizeof localhost-1]='\0';
 961                         if(strlen(localhost) == sizeof localhost-1)
 962                                 {
 963                                 BIO_printf(bio_err,"localhost name too long\n");
 964                                 goto end;
 965                                 }
 966                         kssl_ctx_setstring(c_ssl->kssl_ctx, KSSL_SERVER,
 967                                 localhost);
 968                         }
 969                 }
 970 #endif    /* OPENSSL_NO_KRB5  */
 971
 972         for (i=0; i<number; i++)
 973                 {
 974                 if (!reuse) SSL_set_session(c_ssl,NULL);
 975                 if (bio_pair)
 976                         ret=doit_biopair(s_ssl,c_ssl,bytes,&s_time,&c_time);
 977                 else
 978                         ret=doit(s_ssl,c_ssl,bytes);
 979                 }
 980
 981         if (!verbose)
 982                 {
 983                 print_details(c_ssl, "");
 984                 }
 985         if ((number > 1) || (bytes > 1L))
 986                 BIO_printf(bio_stdout, "%d handshakes of %ld bytes done\n",number,bytes);
 987         if (print_time)
 988                 {
 989 #ifdef CLOCKS_PER_SEC
 990                 /* "To determine the time in seconds, the value returned
 991                  * by the clock function should be divided by the value
 992                  * of the macro CLOCKS_PER_SEC."
 993                  *                                       -- ISO/IEC 9899 */
 994                 BIO_printf(bio_stdout, "Approximate total server time: %6.2f s\n"
 995                         "Approximate total client time: %6.2f s\n",
 996                         (double)s_time/CLOCKS_PER_SEC,
 997                         (double)c_time/CLOCKS_PER_SEC);
 998 #else
 999                 /* "`CLOCKS_PER_SEC' undeclared (first use this function)"
1000                  *                            -- cc on NeXTstep/OpenStep */
1001                 BIO_printf(bio_stdout,
1002                         "Approximate total server time: %6.2f units\n"
1003                         "Approximate total client time: %6.2f units\n",
1004                         (double)s_time,
1005                         (double)c_time);
1006 #endif
1007                 }
1008
1009         SSL_free(s_ssl);
1010         SSL_free(c_ssl);
1011
1012 end:
1013         if (s_ctx != NULL) SSL_CTX_free(s_ctx);
1014         if (c_ctx != NULL) SSL_CTX_free(c_ctx);
1015
1016         if (bio_stdout != NULL) BIO_free(bio_stdout);
1017
1018 #ifndef OPENSSL_NO_RSA
1019         free_tmp_rsa();
1020 #endif
1021 #ifndef OPENSSL_NO_ENGINE
1022         ENGINE_cleanup();
1023 #endif
1024         CRYPTO_cleanup_all_ex_data();
1025         ERR_free_strings();
1026         ERR_remove_thread_state(NULL);
1027         EVP_cleanup();
1028         CRYPTO_mem_leaks(bio_err);
1029         if (bio_err != NULL) BIO_free(bio_err);
1030         EXIT(ret);
1031         return ret;
1032         }
1033
1034 int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count,
1035         clock_t *s_time, clock_t *c_time)
1036         {
1037         long cw_num = count, cr_num = count, sw_num = count, sr_num = count;
1038         BIO *s_ssl_bio = NULL, *c_ssl_bio = NULL;
1039         BIO *server = NULL, *server_io = NULL, *client = NULL, *client_io = NULL;
1040         int ret = 1;
1041
1042         size_t bufsiz = 256; /* small buffer for testing */
1043
1044         if (!BIO_new_bio_pair(&server, bufsiz, &server_io, bufsiz))
1045                 goto err;
1046         if (!BIO_new_bio_pair(&client, bufsiz, &client_io, bufsiz))
1047                 goto err;
1048
1049         s_ssl_bio = BIO_new(BIO_f_ssl());
1050         if (!s_ssl_bio)
1051                 goto err;
1052
1053         c_ssl_bio = BIO_new(BIO_f_ssl());
1054         if (!c_ssl_bio)
1055                 goto err;
1056
1057         SSL_set_connect_state(c_ssl);
1058         SSL_set_bio(c_ssl, client, client);
1059         (void)BIO_set_ssl(c_ssl_bio, c_ssl, BIO_NOCLOSE);
1060
1061         SSL_set_accept_state(s_ssl);
1062         SSL_set_bio(s_ssl, server, server);
1063         (void)BIO_set_ssl(s_ssl_bio, s_ssl, BIO_NOCLOSE);
1064
1065         do
1066                 {
1067                 /*-
1068                  * c_ssl_bio:          SSL filter BIO
1069                  *
1070                  * client:             pseudo-I/O for SSL library
1071                  *
1072                  * client_io:          client's SSL communication; usually to be
1073                  *                     relayed over some I/O facility, but in this
1074                  *                     test program, we're the server, too:
1075                  *
1076                  * server_io:          server's SSL communication
1077                  *
1078                  * server:             pseudo-I/O for SSL library
1079                  *
1080                  * s_ssl_bio:          SSL filter BIO
1081                  *
1082                  * The client and the server each employ a "BIO pair":
1083                  * client + client_io, server + server_io.
1084                  * BIO pairs are symmetric.  A BIO pair behaves similar
1085                  * to a non-blocking socketpair (but both endpoints must
1086                  * be handled by the same thread).
1087                  * [Here we could connect client and server to the ends
1088                  * of a single BIO pair, but then this code would be less
1089                  * suitable as an example for BIO pairs in general.]
1090                  *
1091                  * Useful functions for querying the state of BIO pair endpoints:
1092                  *
1093                  * BIO_ctrl_pending(bio)              number of bytes we can read now
1094                  * BIO_ctrl_get_read_request(bio)     number of bytes needed to fulfil
1095                  *                                      other side's read attempt
1096                  * BIO_ctrl_get_write_guarantee(bio)   number of bytes we can write now
1097                  *
1098                  * ..._read_request is never more than ..._write_guarantee;
1099                  * it depends on the application which one you should use.
1100                  */
1101
1102                 /* We have non-blocking behaviour throughout this test program, but
1103                  * can be sure that there is *some* progress in each iteration; so
1104                  * we don't have to worry about ..._SHOULD_READ or ..._SHOULD_WRITE
1105                  * -- we just try everything in each iteration
1106                  */
1107
1108                         {
1109                         /* CLIENT */
1110
1111                         MS_STATIC char cbuf[1024*8];
1112                         int i, r;
1113                         clock_t c_clock = clock();
1114
1115                         memset(cbuf, 0, sizeof(cbuf));
1116
1117                         if (debug)
1118                                 if (SSL_in_init(c_ssl))
1119                                         printf("client waiting in SSL_connect - %s\n",
1120                                                 SSL_state_string_long(c_ssl));
1121
1122                         if (cw_num > 0)
1123                                 {
1124                                 /* Write to server. */
1125
1126                                 if (cw_num > (long)sizeof cbuf)
1127                                         i = sizeof cbuf;
1128                                 else
1129                                         i = (int)cw_num;
1130                                 r = BIO_write(c_ssl_bio, cbuf, i);
1131                                 if (r < 0)
1132                                         {
1133                                         if (!BIO_should_retry(c_ssl_bio))
1134                                                 {
1135                                                 fprintf(stderr,"ERROR in CLIENT\n");
1136                                                 goto err;
1137                                                 }
1138                                         /* BIO_should_retry(...) can just be ignored here.
1139                                          * The library expects us to call BIO_write with
1140                                          * the same arguments again, and that's what we will
1141                                          * do in the next iteration. */
1142                                         }
1143                                 else if (r == 0)
1144                                         {
1145                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1146                                         goto err;
1147                                         }
1148                                 else
1149                                         {
1150                                         if (debug)
1151                                                 printf("client wrote %d\n", r);
1152                                         cw_num -= r;
1153                                         }
1154                                 }
1155
1156                         if (cr_num > 0)
1157                                 {
1158                                 /* Read from server. */
1159
1160                                 r = BIO_read(c_ssl_bio, cbuf, sizeof(cbuf));
1161                                 if (r < 0)
1162                                         {
1163                                         if (!BIO_should_retry(c_ssl_bio))
1164                                                 {
1165                                                 fprintf(stderr,"ERROR in CLIENT\n");
1166                                                 goto err;
1167                                                 }
1168                                         /* Again, "BIO_should_retry" can be ignored. */
1169                                         }
1170                                 else if (r == 0)
1171                                         {
1172                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1173                                         goto err;
1174                                         }
1175                                 else
1176                                         {
1177                                         if (debug)
1178                                                 printf("client read %d\n", r);
1179                                         cr_num -= r;
1180                                         }
1181                                 }
1182
1183                         /* c_time and s_time increments will typically be very small
1184                          * (depending on machine speed and clock tick intervals),
1185                          * but sampling over a large number of connections should
1186                          * result in fairly accurate figures.  We cannot guarantee
1187                          * a lot, however -- if each connection lasts for exactly
1188                          * one clock tick, it will be counted only for the client
1189                          * or only for the server or even not at all.
1190                          */
1191                         *c_time += (clock() - c_clock);
1192                         }
1193
1194                         {
1195                         /* SERVER */
1196
1197                         MS_STATIC char sbuf[1024*8];
1198                         int i, r;
1199                         clock_t s_clock = clock();
1200
1201                         memset(sbuf, 0, sizeof(sbuf));
1202
1203                         if (debug)
1204                                 if (SSL_in_init(s_ssl))
1205                                         printf("server waiting in SSL_accept - %s\n",
1206                                                 SSL_state_string_long(s_ssl));
1207
1208                         if (sw_num > 0)
1209                                 {
1210                                 /* Write to client. */
1211
1212                                 if (sw_num > (long)sizeof sbuf)
1213                                         i = sizeof sbuf;
1214                                 else
1215                                         i = (int)sw_num;
1216                                 r = BIO_write(s_ssl_bio, sbuf, i);
1217                                 if (r < 0)
1218                                         {
1219                                         if (!BIO_should_retry(s_ssl_bio))
1220                                                 {
1221                                                 fprintf(stderr,"ERROR in SERVER\n");
1222                                                 goto err;
1223                                                 }
1224                                         /* Ignore "BIO_should_retry". */
1225                                         }
1226                                 else if (r == 0)
1227                                         {
1228                                         fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1229                                         goto err;
1230                                         }
1231                                 else
1232                                         {
1233                                         if (debug)
1234                                                 printf("server wrote %d\n", r);
1235                                         sw_num -= r;
1236                                         }
1237                                 }
1238
1239                         if (sr_num > 0)
1240                                 {
1241                                 /* Read from client. */
1242
1243                                 r = BIO_read(s_ssl_bio, sbuf, sizeof(sbuf));
1244                                 if (r < 0)
1245                                         {
1246                                         if (!BIO_should_retry(s_ssl_bio))
1247                                                 {
1248                                                 fprintf(stderr,"ERROR in SERVER\n");
1249                                                 goto err;
1250                                                 }
1251                                         /* blah, blah */
1252                                         }
1253                                 else if (r == 0)
1254                                         {
1255                                         fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1256                                         goto err;
1257                                         }
1258                                 else
1259                                         {
1260                                         if (debug)
1261                                                 printf("server read %d\n", r);
1262                                         sr_num -= r;
1263                                         }
1264                                 }
1265
1266                         *s_time += (clock() - s_clock);
1267                         }
1268
1269                         {
1270                         /* "I/O" BETWEEN CLIENT AND SERVER. */
1271
1272                         size_t r1, r2;
1273                         BIO *io1 = server_io, *io2 = client_io;
1274                         /* we use the non-copying interface for io1
1275                          * and the standard BIO_write/BIO_read interface for io2
1276                          */
1277
1278                         static int prev_progress = 1;
1279                         int progress = 0;
1280
1281                         /* io1 to io2 */
1282                         do
1283                                 {
1284                                 size_t num;
1285                                 int r;
1286
1287                                 r1 = BIO_ctrl_pending(io1);
1288                                 r2 = BIO_ctrl_get_write_guarantee(io2);
1289
1290                                 num = r1;
1291                                 if (r2 < num)
1292                                         num = r2;
1293                                 if (num)
1294                                         {
1295                                         char *dataptr;
1296
1297                                         if (INT_MAX < num) /* yeah, right */
1298                                                 num = INT_MAX;
1299
1300                                         r = BIO_nread(io1, &dataptr, (int)num);
1301                                         assert(r > 0);
1302                                         assert(r <= (int)num);
1303                                         /* possibly r < num (non-contiguous data) */
1304                                         num = r;
1305                                         r = BIO_write(io2, dataptr, (int)num);
1306                                         if (r != (int)num) /* can't happen */
1307                                                 {
1308                                                 fprintf(stderr, "ERROR: BIO_write could not write "
1309                                                         "BIO_ctrl_get_write_guarantee() bytes");
1310                                                 goto err;
1311                                                 }
1312                                         progress = 1;
1313
1314                                         if (debug)
1315                                                 printf((io1 == client_io) ?
1316                                                         "C->S relaying: %d bytes\n" :
1317                                                         "S->C relaying: %d bytes\n",
1318                                                         (int)num);
1319                                         }
1320                                 }
1321                         while (r1 && r2);
1322
1323                         /* io2 to io1 */
1324                         {
1325                                 size_t num;
1326                                 int r;
1327
1328                                 r1 = BIO_ctrl_pending(io2);
1329                                 r2 = BIO_ctrl_get_read_request(io1);
1330                                 /* here we could use ..._get_write_guarantee instead of
1331                                  * ..._get_read_request, but by using the latter
1332                                  * we test restartability of the SSL implementation
1333                                  * more thoroughly */
1334                                 num = r1;
1335                                 if (r2 < num)
1336                                         num = r2;
1337                                 if (num)
1338                                         {
1339                                         char *dataptr;
1340
1341                                         if (INT_MAX < num)
1342                                                 num = INT_MAX;
1343
1344                                         if (num > 1)
1345                                                 --num; /* test restartability even more thoroughly */
1346
1347                                         r = BIO_nwrite0(io1, &dataptr);
1348                                         assert(r > 0);
1349                                         if (r < (int)num)
1350                                                 num = r;
1351                                         r = BIO_read(io2, dataptr, (int)num);
1352                                         if (r != (int)num) /* can't happen */
1353                                                 {
1354                                                 fprintf(stderr, "ERROR: BIO_read could not read "
1355                                                         "BIO_ctrl_pending() bytes");
1356                                                 goto err;
1357                                                 }
1358                                         progress = 1;
1359                                         r = BIO_nwrite(io1, &dataptr, (int)num);
1360                                         if (r != (int)num) /* can't happen */
1361                                                 {
1362                                                 fprintf(stderr, "ERROR: BIO_nwrite() did not accept "
1363                                                         "BIO_nwrite0() bytes");
1364                                                 goto err;
1365                                                 }
1366
1367                                         if (debug)
1368                                                 printf((io2 == client_io) ?
1369                                                         "C->S relaying: %d bytes\n" :
1370                                                         "S->C relaying: %d bytes\n",
1371                                                         (int)num);
1372                                         }
1373                         } /* no loop, BIO_ctrl_get_read_request now returns 0 anyway */
1374
1375                         if (!progress && !prev_progress)
1376                                 if (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0)
1377                                         {
1378                                         fprintf(stderr, "ERROR: got stuck\n");
1379                                         if (strcmp("SSLv2", SSL_get_version(c_ssl)) == 0)
1380                                                 {
1381                                                 fprintf(stderr, "This can happen for SSL2 because "
1382                                                         "CLIENT-FINISHED and SERVER-VERIFY are written \n"
1383                                                         "concurrently ...");
1384                                                 if (strncmp("2SCF", SSL_state_string(c_ssl), 4) == 0
1385                                                         && strncmp("2SSV", SSL_state_string(s_ssl), 4) == 0)
1386                                                         {
1387                                                         fprintf(stderr, " ok.\n");
1388                                                         goto end;
1389                                                         }
1390                                                 }
1391                                         fprintf(stderr, " ERROR.\n");
1392                                         goto err;
1393                                         }
1394                         prev_progress = progress;
1395                         }
1396                 }
1397         while (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0);
1398
1399         if (verbose)
1400                 print_details(c_ssl, "DONE via BIO pair: ");
1401 end:
1402         ret = 0;
1403
1404  err:
1405         ERR_print_errors(bio_err);
1406
1407         if (server)
1408                 BIO_free(server);
1409         if (server_io)
1410                 BIO_free(server_io);
1411         if (client)
1412                 BIO_free(client);
1413         if (client_io)
1414                 BIO_free(client_io);
1415         if (s_ssl_bio)
1416                 BIO_free(s_ssl_bio);
1417         if (c_ssl_bio)
1418                 BIO_free(c_ssl_bio);
1419
1420         return ret;
1421         }
1422
1423
1424 #define W_READ  1
1425 #define W_WRITE 2
1426 #define C_DONE  1
1427 #define S_DONE  2
1428
1429 int doit(SSL *s_ssl, SSL *c_ssl, long count)
1430         {
1431         MS_STATIC char cbuf[1024*8],sbuf[1024*8];
1432         long cw_num=count,cr_num=count;
1433         long sw_num=count,sr_num=count;
1434         int ret=1;
1435         BIO *c_to_s=NULL;
1436         BIO *s_to_c=NULL;
1437         BIO *c_bio=NULL;
1438         BIO *s_bio=NULL;
1439         int c_r,c_w,s_r,s_w;
1440         int i,j;
1441         int done=0;
1442         int c_write,s_write;
1443         int do_server=0,do_client=0;
1444
1445         memset(cbuf,0,sizeof(cbuf));
1446         memset(sbuf,0,sizeof(sbuf));
1447
1448         c_to_s=BIO_new(BIO_s_mem());
1449         s_to_c=BIO_new(BIO_s_mem());
1450         if ((s_to_c == NULL) || (c_to_s == NULL))
1451                 {
1452                 ERR_print_errors(bio_err);
1453                 goto err;
1454                 }
1455
1456         c_bio=BIO_new(BIO_f_ssl());
1457         s_bio=BIO_new(BIO_f_ssl());
1458         if ((c_bio == NULL) || (s_bio == NULL))
1459                 {
1460                 ERR_print_errors(bio_err);
1461                 goto err;
1462                 }
1463
1464         SSL_set_connect_state(c_ssl);
1465         SSL_set_bio(c_ssl,s_to_c,c_to_s);
1466         BIO_set_ssl(c_bio,c_ssl,BIO_NOCLOSE);
1467
1468         SSL_set_accept_state(s_ssl);
1469         SSL_set_bio(s_ssl,c_to_s,s_to_c);
1470         BIO_set_ssl(s_bio,s_ssl,BIO_NOCLOSE);
1471
1472         c_r=0; s_r=1;
1473         c_w=1; s_w=0;
1474         c_write=1,s_write=0;
1475
1476         /* We can always do writes */
1477         for (;;)
1478                 {
1479                 do_server=0;
1480                 do_client=0;
1481
1482                 i=(int)BIO_pending(s_bio);
1483                 if ((i && s_r) || s_w) do_server=1;
1484
1485                 i=(int)BIO_pending(c_bio);
1486                 if ((i && c_r) || c_w) do_client=1;
1487
1488                 if (do_server && debug)
1489                         {
1490                         if (SSL_in_init(s_ssl))
1491                                 printf("server waiting in SSL_accept - %s\n",
1492                                         SSL_state_string_long(s_ssl));
1493 /*-
1494                         else if (s_write)
1495                                 printf("server:SSL_write()\n");
1496                         else
1497                                 printf("server:SSL_read()\n"); */
1498                         }
1499
1500                 if (do_client && debug)
1501                         {
1502                         if (SSL_in_init(c_ssl))
1503                                 printf("client waiting in SSL_connect - %s\n",
1504                                         SSL_state_string_long(c_ssl));
1505 /*-
1506                         else if (c_write)
1507                                 printf("client:SSL_write()\n");
1508                         else
1509                                 printf("client:SSL_read()\n"); */
1510                         }
1511
1512                 if (!do_client && !do_server)
1513                         {
1514                         fprintf(stdout,"ERROR IN STARTUP\n");
1515                         ERR_print_errors(bio_err);
1516                         break;
1517                         }
1518                 if (do_client && !(done & C_DONE))
1519                         {
1520                         if (c_write)
1521                                 {
1522                                 j = (cw_num > (long)sizeof(cbuf)) ?
1523                                         (int)sizeof(cbuf) : (int)cw_num;
1524                                 i=BIO_write(c_bio,cbuf,j);
1525                                 if (i < 0)
1526                                         {
1527                                         c_r=0;
1528                                         c_w=0;
1529                                         if (BIO_should_retry(c_bio))
1530                                                 {
1531                                                 if (BIO_should_read(c_bio))
1532                                                         c_r=1;
1533                                                 if (BIO_should_write(c_bio))
1534                                                         c_w=1;
1535                                                 }
1536                                         else
1537                                                 {
1538                                                 fprintf(stderr,"ERROR in CLIENT\n");
1539                                                 ERR_print_errors(bio_err);
1540                                                 goto err;
1541                                                 }
1542                                         }
1543                                 else if (i == 0)
1544                                         {
1545                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1546                                         goto err;
1547                                         }
1548                                 else
1549                                         {
1550                                         if (debug)
1551                                                 printf("client wrote %d\n",i);
1552                                         /* ok */
1553                                         s_r=1;
1554                                         c_write=0;
1555                                         cw_num-=i;
1556                                         }
1557                                 }
1558                         else
1559                                 {
1560                                 i=BIO_read(c_bio,cbuf,sizeof(cbuf));
1561                                 if (i < 0)
1562                                         {
1563                                         c_r=0;
1564                                         c_w=0;
1565                                         if (BIO_should_retry(c_bio))
1566                                                 {
1567                                                 if (BIO_should_read(c_bio))
1568                                                         c_r=1;
1569                                                 if (BIO_should_write(c_bio))
1570                                                         c_w=1;
1571                                                 }
1572                                         else
1573                                                 {
1574                                                 fprintf(stderr,"ERROR in CLIENT\n");
1575                                                 ERR_print_errors(bio_err);
1576                                                 goto err;
1577                                                 }
1578                                         }
1579                                 else if (i == 0)
1580                                         {
1581                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1582                                         goto err;
1583                                         }
1584                                 else
1585                                         {
1586                                         if (debug)
1587                                                 printf("client read %d\n",i);
1588                                         cr_num-=i;
1589                                         if (sw_num > 0)
1590                                                 {
1591                                                 s_write=1;
1592                                                 s_w=1;
1593                                                 }
1594                                         if (cr_num <= 0)
1595                                                 {
1596                                                 s_write=1;
1597                                                 s_w=1;
1598                                                 done=S_DONE|C_DONE;
1599                                                 }
1600                                         }
1601                                 }
1602                         }
1603
1604                 if (do_server && !(done & S_DONE))
1605                         {
1606                         if (!s_write)
1607                                 {
1608                                 i=BIO_read(s_bio,sbuf,sizeof(cbuf));
1609                                 if (i < 0)
1610                                         {
1611                                         s_r=0;
1612                                         s_w=0;
1613                                         if (BIO_should_retry(s_bio))
1614                                                 {
1615                                                 if (BIO_should_read(s_bio))
1616                                                         s_r=1;
1617                                                 if (BIO_should_write(s_bio))
1618                                                         s_w=1;
1619                                                 }
1620                                         else
1621                                                 {
1622                                                 fprintf(stderr,"ERROR in SERVER\n");
1623                                                 ERR_print_errors(bio_err);
1624                                                 goto err;
1625                                                 }
1626                                         }
1627                                 else if (i == 0)
1628                                         {
1629                                         ERR_print_errors(bio_err);
1630                                         fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_read\n");
1631                                         goto err;
1632                                         }
1633                                 else
1634                                         {
1635                                         if (debug)
1636                                                 printf("server read %d\n",i);
1637                                         sr_num-=i;
1638                                         if (cw_num > 0)
1639                                                 {
1640                                                 c_write=1;
1641                                                 c_w=1;
1642                                                 }
1643                                         if (sr_num <= 0)
1644                                                 {
1645                                                 s_write=1;
1646                                                 s_w=1;
1647                                                 c_write=0;
1648                                                 }
1649                                         }
1650                                 }
1651                         else
1652                                 {
1653                                 j = (sw_num > (long)sizeof(sbuf)) ?
1654                                         (int)sizeof(sbuf) : (int)sw_num;
1655                                 i=BIO_write(s_bio,sbuf,j);
1656                                 if (i < 0)
1657                                         {
1658                                         s_r=0;
1659                                         s_w=0;
1660                                         if (BIO_should_retry(s_bio))
1661                                                 {
1662                                                 if (BIO_should_read(s_bio))
1663                                                         s_r=1;
1664                                                 if (BIO_should_write(s_bio))
1665                                                         s_w=1;
1666                                                 }
1667                                         else
1668                                                 {
1669                                                 fprintf(stderr,"ERROR in SERVER\n");
1670                                                 ERR_print_errors(bio_err);
1671                                                 goto err;
1672                                                 }
1673                                         }
1674                                 else if (i == 0)
1675                                         {
1676                                         ERR_print_errors(bio_err);
1677                                         fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_write\n");
1678                                         goto err;
1679                                         }
1680                                 else
1681                                         {
1682                                         if (debug)
1683                                                 printf("server wrote %d\n",i);
1684                                         sw_num-=i;
1685                                         s_write=0;
1686                                         c_r=1;
1687                                         if (sw_num <= 0)
1688                                                 done|=S_DONE;
1689                                         }
1690                                 }
1691                         }
1692
1693                 if ((done & S_DONE) && (done & C_DONE)) break;
1694                 }
1695
1696         if (verbose)
1697                 print_details(c_ssl, "DONE: ");
1698         ret=0;
1699 err:
1700         /* We have to set the BIO's to NULL otherwise they will be
1701          * OPENSSL_free()ed twice.  Once when th s_ssl is SSL_free()ed and
1702          * again when c_ssl is SSL_free()ed.
1703          * This is a hack required because s_ssl and c_ssl are sharing the same
1704          * BIO structure and SSL_set_bio() and SSL_free() automatically
1705          * BIO_free non NULL entries.
1706          * You should not normally do this or be required to do this */
1707         if (s_ssl != NULL)
1708                 {
1709                 s_ssl->rbio=NULL;
1710                 s_ssl->wbio=NULL;
1711                 }
1712         if (c_ssl != NULL)
1713                 {
1714                 c_ssl->rbio=NULL;
1715                 c_ssl->wbio=NULL;
1716                 }
1717
1718         if (c_to_s != NULL) BIO_free(c_to_s);
1719         if (s_to_c != NULL) BIO_free(s_to_c);
1720         if (c_bio != NULL) BIO_free_all(c_bio);
1721         if (s_bio != NULL) BIO_free_all(s_bio);
1722         return(ret);
1723         }
1724
1725 static int get_proxy_auth_ex_data_idx(void)
1726         {
1727         static volatile int idx = -1;
1728         if (idx < 0)
1729                 {
1730                 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
1731                 if (idx < 0)
1732                         {
1733                         idx = X509_STORE_CTX_get_ex_new_index(0,
1734                                 "SSLtest for verify callback", NULL,NULL,NULL);
1735                         }
1736                 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
1737                 }
1738         return idx;
1739         }
1740
1741 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
1742         {
1743         char *s,buf[256];
1744
1745         s=X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),buf,
1746                             sizeof buf);
1747         if (s != NULL)
1748                 {
1749                 if (ok)
1750                         fprintf(stderr,"depth=%d %s\n",
1751                                 ctx->error_depth,buf);
1752                 else
1753                         {
1754                         fprintf(stderr,"depth=%d error=%d %s\n",
1755                                 ctx->error_depth,ctx->error,buf);
1756                         }
1757                 }
1758
1759         if (ok == 0)
1760                 {
1761                 fprintf(stderr,"Error string: %s\n",
1762                         X509_verify_cert_error_string(ctx->error));
1763                 switch (ctx->error)
1764                         {
1765                 case X509_V_ERR_CERT_NOT_YET_VALID:
1766                 case X509_V_ERR_CERT_HAS_EXPIRED:
1767                 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
1768                         fprintf(stderr,"  ... ignored.\n");
1769                         ok=1;
1770                         }
1771                 }
1772
1773         if (ok == 1)
1774                 {
1775                 X509 *xs = ctx->current_cert;
1776 #if 0
1777                 X509 *xi = ctx->current_issuer;
1778 #endif
1779
1780                 if (xs->ex_flags & EXFLAG_PROXY)
1781                         {
1782                         unsigned int *letters =
1783                                 X509_STORE_CTX_get_ex_data(ctx,
1784                                         get_proxy_auth_ex_data_idx());
1785
1786                         if (letters)
1787                                 {
1788                                 int found_any = 0;
1789                                 int i;
1790                                 PROXY_CERT_INFO_EXTENSION *pci =
1791                                         X509_get_ext_d2i(xs, NID_proxyCertInfo,
1792                                                 NULL, NULL);
1793
1794                                 switch (OBJ_obj2nid(pci->proxyPolicy->policyLanguage))
1795                                         {
1796                                 case NID_Independent:
1797                                         /* Completely meaningless in this
1798                                            program, as there's no way to
1799                                            grant explicit rights to a
1800                                            specific PrC.  Basically, using
1801                                            id-ppl-Independent is the perfect
1802                                            way to grant no rights at all. */
1803                                         fprintf(stderr, "  Independent proxy certificate");
1804                                         for (i = 0; i < 26; i++)
1805                                                 letters[i] = 0;
1806                                         break;
1807                                 case NID_id_ppl_inheritAll:
1808                                         /* This is basically a NOP, we
1809                                            simply let the current rights
1810                                            stand as they are. */
1811                                         fprintf(stderr, "  Proxy certificate inherits all");
1812                                         break;
1813                                 default:
1814                                         s = (char *)
1815                                                 pci->proxyPolicy->policy->data;
1816                                         i = pci->proxyPolicy->policy->length;
1817
1818                                         /* The algorithm works as follows:
1819                                            it is assumed that previous
1820                                            iterations or the initial granted
1821                                            rights has already set some elements
1822                                            of `letters'.  What we need to do is
1823                                            to clear those that weren't granted
1824                                            by the current PrC as well.  The
1825                                            easiest way to do this is to add 1
1826                                            to all the elements whose letters
1827                                            are given with the current policy.
1828                                            That way, all elements that are set
1829                                            by the current policy and were
1830                                            already set by earlier policies and
1831                                            through the original grant of rights
1832                                            will get the value 2 or higher.
1833                                            The last thing to do is to sweep
1834                                            through `letters' and keep the
1835                                            elements having the value 2 as set,
1836                                            and clear all the others. */
1837
1838                                         fprintf(stderr, "  Certificate proxy rights = %*.*s", i, i, s);
1839                                         while(i-- > 0)
1840                                                 {
1841                                                 int c = *s++;
1842                                                 if (isascii(c) && isalpha(c))
1843                                                         {
1844                                                         if (islower(c))
1845                                                                 c = toupper(c);
1846                                                         letters[c - 'A']++;
1847                                                         }
1848                                                 }
1849                                         for (i = 0; i < 26; i++)
1850                                                 if (letters[i] < 2)
1851                                                         letters[i] = 0;
1852                                                 else
1853                                                         letters[i] = 1;
1854                                         }
1855
1856                                 found_any = 0;
1857                                 fprintf(stderr,
1858                                         ", resulting proxy rights = ");
1859                                 for(i = 0; i < 26; i++)
1860                                         if (letters[i])
1861                                                 {
1862                                                 fprintf(stderr, "%c", i + 'A');
1863                                                 found_any = 1;
1864                                                 }
1865                                 if (!found_any)
1866                                         fprintf(stderr, "none");
1867                                 fprintf(stderr, "\n");
1868
1869                                 PROXY_CERT_INFO_EXTENSION_free(pci);
1870                                 }
1871                         }
1872                 }
1873
1874         return(ok);
1875         }
1876
1877 static void process_proxy_debug(int indent, const char *format, ...)
1878         {
1879         static const char indentation[] =
1880                 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"
1881                 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"; /* That's 80 > */
1882         char my_format[256];
1883         va_list args;
1884
1885         BIO_snprintf(my_format, sizeof(my_format), "%*.*s %s",
1886                 indent, indent, indentation, format);
1887
1888         va_start(args, format);
1889         vfprintf(stderr, my_format, args);
1890         va_end(args);
1891         }
1892 /*-
1893  * Priority levels:
1894  *  0   [!]var, ()
1895  *  1   & ^
1896  *  2   |
1897  */
1898 static int process_proxy_cond_adders(unsigned int letters[26],
1899         const char *cond, const char **cond_end, int *pos, int indent);
1900 static int process_proxy_cond_val(unsigned int letters[26],
1901         const char *cond, const char **cond_end, int *pos, int indent)
1902         {
1903         int c;
1904         int ok = 1;
1905         int negate = 0;
1906
1907         while(isspace((int)*cond))
1908                 {
1909                 cond++; (*pos)++;
1910                 }
1911         c = *cond;
1912
1913         if (debug)
1914                 process_proxy_debug(indent,
1915                         "Start process_proxy_cond_val at position %d: %s\n",
1916                         *pos, cond);
1917
1918         while(c == '!')
1919                 {
1920                 negate = !negate;
1921                 cond++; (*pos)++;
1922                 while(isspace((int)*cond))
1923                         {
1924                         cond++; (*pos)++;
1925                         }
1926                 c = *cond;
1927                 }
1928
1929         if (c == '(')
1930                 {
1931                 cond++; (*pos)++;
1932                 ok = process_proxy_cond_adders(letters, cond, cond_end, pos,
1933                         indent + 1);
1934                 cond = *cond_end;
1935                 if (ok < 0)
1936                         goto end;
1937                 while(isspace((int)*cond))
1938                         {
1939                         cond++; (*pos)++;
1940                         }
1941                 c = *cond;
1942                 if (c != ')')
1943                         {
1944                         fprintf(stderr,
1945                                 "Weird condition character in position %d: "
1946                                 "%c\n", *pos, c);
1947                         ok = -1;
1948                         goto end;
1949                         }
1950                 cond++; (*pos)++;
1951                 }
1952         else if (isascii(c) && isalpha(c))
1953                 {
1954                 if (islower(c))
1955                         c = toupper(c);
1956                 ok = letters[c - 'A'];
1957                 cond++; (*pos)++;
1958                 }
1959         else
1960                 {
1961                 fprintf(stderr,
1962                         "Weird condition character in position %d: "
1963                         "%c\n", *pos, c);
1964                 ok = -1;
1965                 goto end;
1966                 }
1967  end:
1968         *cond_end = cond;
1969         if (ok >= 0 && negate)
1970                 ok = !ok;
1971
1972         if (debug)
1973                 process_proxy_debug(indent,
1974                         "End process_proxy_cond_val at position %d: %s, returning %d\n",
1975                         *pos, cond, ok);
1976
1977         return ok;
1978         }
1979 static int process_proxy_cond_multipliers(unsigned int letters[26],
1980         const char *cond, const char **cond_end, int *pos, int indent)
1981         {
1982         int ok;
1983         char c;
1984
1985         if (debug)
1986                 process_proxy_debug(indent,
1987                         "Start process_proxy_cond_multipliers at position %d: %s\n",
1988                         *pos, cond);
1989
1990         ok = process_proxy_cond_val(letters, cond, cond_end, pos, indent + 1);
1991         cond = *cond_end;
1992         if (ok < 0)
1993                 goto end;
1994
1995         while(ok >= 0)
1996                 {
1997                 while(isspace((int)*cond))
1998                         {
1999                         cond++; (*pos)++;
2000                         }
2001                 c = *cond;
2002
2003                 switch(c)
2004                         {
2005                 case '&':
2006                 case '^':
2007                         {
2008                         int save_ok = ok;
2009
2010                         cond++; (*pos)++;
2011                         ok = process_proxy_cond_val(letters,
2012                                 cond, cond_end, pos, indent + 1);
2013                         cond = *cond_end;
2014                         if (ok < 0)
2015                                 break;
2016
2017                         switch(c)
2018                                 {
2019                         case '&':
2020                                 ok &= save_ok;
2021                                 break;
2022                         case '^':
2023                                 ok ^= save_ok;
2024                                 break;
2025                         default:
2026                                 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
2027                                         " STOPPING\n");
2028                                 EXIT(1);
2029                                 }
2030                         }
2031                         break;
2032                 default:
2033                         goto end;
2034                         }
2035                 }
2036  end:
2037         if (debug)
2038                 process_proxy_debug(indent,
2039                         "End process_proxy_cond_multipliers at position %d: %s, returning %d\n",
2040                         *pos, cond, ok);
2041
2042         *cond_end = cond;
2043         return ok;
2044         }
2045 static int process_proxy_cond_adders(unsigned int letters[26],
2046         const char *cond, const char **cond_end, int *pos, int indent)
2047         {
2048         int ok;
2049         char c;
2050
2051         if (debug)
2052                 process_proxy_debug(indent,
2053                         "Start process_proxy_cond_adders at position %d: %s\n",
2054                         *pos, cond);
2055
2056         ok = process_proxy_cond_multipliers(letters, cond, cond_end, pos,
2057                 indent + 1);
2058         cond = *cond_end;
2059         if (ok < 0)
2060                 goto end;
2061
2062         while(ok >= 0)
2063                 {
2064                 while(isspace((int)*cond))
2065                         {
2066                         cond++; (*pos)++;
2067                         }
2068                 c = *cond;
2069
2070                 switch(c)
2071                         {
2072                 case '|':
2073                         {
2074                         int save_ok = ok;
2075
2076                         cond++; (*pos)++;
2077                         ok = process_proxy_cond_multipliers(letters,
2078                                 cond, cond_end, pos, indent + 1);
2079                         cond = *cond_end;
2080                         if (ok < 0)
2081                                 break;
2082
2083                         switch(c)
2084                                 {
2085                         case '|':
2086                                 ok |= save_ok;
2087                                 break;
2088                         default:
2089                                 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
2090                                         " STOPPING\n");
2091                                 EXIT(1);
2092                                 }
2093                         }
2094                         break;
2095                 default:
2096                         goto end;
2097                         }
2098                 }
2099  end:
2100         if (debug)
2101                 process_proxy_debug(indent,
2102                         "End process_proxy_cond_adders at position %d: %s, returning %d\n",
2103                         *pos, cond, ok);
2104
2105         *cond_end = cond;
2106         return ok;
2107         }
2108
2109 static int process_proxy_cond(unsigned int letters[26],
2110         const char *cond, const char **cond_end)
2111         {
2112         int pos = 1;
2113         return process_proxy_cond_adders(letters, cond, cond_end, &pos, 1);
2114         }
2115
2116 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg)
2117         {
2118         int ok=1;
2119         struct app_verify_arg *cb_arg = arg;
2120         unsigned int letters[26]; /* only used with proxy_auth */
2121
2122         if (cb_arg->app_verify)
2123                 {
2124                 char *s = NULL,buf[256];
2125
2126                 fprintf(stderr, "In app_verify_callback, allowing cert. ");
2127                 fprintf(stderr, "Arg is: %s\n", cb_arg->string);
2128                 fprintf(stderr, "Finished printing do we have a context? 0x%p a cert? 0x%p\n",
2129                         (void *)ctx, (void *)ctx->cert);
2130                 if (ctx->cert)
2131                         s=X509_NAME_oneline(X509_get_subject_name(ctx->cert),buf,256);
2132                 if (s != NULL)
2133                         {
2134                         fprintf(stderr,"cert depth=%d %s\n",ctx->error_depth,buf);
2135                         }
2136                 return(1);
2137                 }
2138         if (cb_arg->proxy_auth)
2139                 {
2140                 int found_any = 0, i;
2141                 char *sp;
2142
2143                 for(i = 0; i < 26; i++)
2144                         letters[i] = 0;
2145                 for(sp = cb_arg->proxy_auth; *sp; sp++)
2146                         {
2147                         int c = *sp;
2148                         if (isascii(c) && isalpha(c))
2149                                 {
2150                                 if (islower(c))
2151                                         c = toupper(c);
2152                                 letters[c - 'A'] = 1;
2153                                 }
2154                         }
2155
2156                 fprintf(stderr,
2157                         "  Initial proxy rights = ");
2158                 for(i = 0; i < 26; i++)
2159                         if (letters[i])
2160                                 {
2161                                 fprintf(stderr, "%c", i + 'A');
2162                                 found_any = 1;
2163                                 }
2164                 if (!found_any)
2165                         fprintf(stderr, "none");
2166                 fprintf(stderr, "\n");
2167
2168                 X509_STORE_CTX_set_ex_data(ctx,
2169                         get_proxy_auth_ex_data_idx(),letters);
2170                 }
2171         if (cb_arg->allow_proxy_certs)
2172                 {
2173                 X509_STORE_CTX_set_flags(ctx, X509_V_FLAG_ALLOW_PROXY_CERTS);
2174                 }
2175
2176 #ifndef OPENSSL_NO_X509_VERIFY
2177 # ifdef OPENSSL_FIPS
2178         if(s->version == TLS1_VERSION)
2179                 FIPS_allow_md5(1);
2180 # endif
2181         ok = X509_verify_cert(ctx);
2182 # ifdef OPENSSL_FIPS
2183         if(s->version == TLS1_VERSION)
2184                 FIPS_allow_md5(0);
2185 # endif
2186 #endif
2187
2188         if (cb_arg->proxy_auth)
2189                 {
2190                 if (ok > 0)
2191                         {
2192                         const char *cond_end = NULL;
2193
2194                         ok = process_proxy_cond(letters,
2195                                 cb_arg->proxy_cond, &cond_end);
2196
2197                         if (ok < 0)
2198                                 EXIT(3);
2199                         if (*cond_end)
2200                                 {
2201                                 fprintf(stderr, "Stopped processing condition before it's end.\n");
2202                                 ok = 0;
2203                                 }
2204                         if (!ok)
2205                                 fprintf(stderr, "Proxy rights check with condition '%s' proved invalid\n",
2206                                         cb_arg->proxy_cond);
2207                         else
2208                                 fprintf(stderr, "Proxy rights check with condition '%s' proved valid\n",
2209                                         cb_arg->proxy_cond);
2210                         }
2211                 }
2212         return(ok);
2213         }
2214
2215 #ifndef OPENSSL_NO_RSA
2216 static RSA *rsa_tmp=NULL;
2217
2218 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength)
2219         {
2220         BIGNUM *bn = NULL;
2221         if (rsa_tmp == NULL)
2222                 {
2223                 bn = BN_new();
2224                 rsa_tmp = RSA_new();
2225                 if(!bn || !rsa_tmp || !BN_set_word(bn, RSA_F4))
2226                         {
2227                         BIO_printf(bio_err, "Memory error...");
2228                         goto end;
2229                         }
2230                 BIO_printf(bio_err,"Generating temp (%d bit) RSA key...",keylength);
2231                 (void)BIO_flush(bio_err);
2232                 if(!RSA_generate_key_ex(rsa_tmp,keylength,bn,NULL))
2233                         {
2234                         BIO_printf(bio_err, "Error generating key.");
2235                         RSA_free(rsa_tmp);
2236                         rsa_tmp = NULL;
2237                         }
2238 end:
2239                 BIO_printf(bio_err,"\n");
2240                 (void)BIO_flush(bio_err);
2241                 }
2242         if(bn) BN_free(bn);
2243         return(rsa_tmp);
2244         }
2245
2246 static void free_tmp_rsa(void)
2247         {
2248         if (rsa_tmp != NULL)
2249                 {
2250                 RSA_free(rsa_tmp);
2251                 rsa_tmp = NULL;
2252                 }
2253         }
2254 #endif
2255
2256 #ifndef OPENSSL_NO_DH
2257 /*-
2258  * These DH parameters have been generated as follows:
2259  *    $ openssl dhparam -C -noout 512
2260  *    $ openssl dhparam -C -noout 1024
2261  *    $ openssl dhparam -C -noout -dsaparam 1024
2262  * (The third function has been renamed to avoid name conflicts.)
2263  */
2264 static DH *get_dh512()
2265         {
2266         static unsigned char dh512_p[]={
2267                 0xCB,0xC8,0xE1,0x86,0xD0,0x1F,0x94,0x17,0xA6,0x99,0xF0,0xC6,
2268                 0x1F,0x0D,0xAC,0xB6,0x25,0x3E,0x06,0x39,0xCA,0x72,0x04,0xB0,
2269                 0x6E,0xDA,0xC0,0x61,0xE6,0x7A,0x77,0x25,0xE8,0x3B,0xB9,0x5F,
2270                 0x9A,0xB6,0xB5,0xFE,0x99,0x0B,0xA1,0x93,0x4E,0x35,0x33,0xB8,
2271                 0xE1,0xF1,0x13,0x4F,0x59,0x1A,0xD2,0x57,0xC0,0x26,0x21,0x33,
2272                 0x02,0xC5,0xAE,0x23,
2273                 };
2274         static unsigned char dh512_g[]={
2275                 0x02,
2276                 };
2277         DH *dh;
2278
2279         if ((dh=DH_new()) == NULL) return(NULL);
2280         dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
2281         dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
2282         if ((dh->p == NULL) || (dh->g == NULL))
2283                 { DH_free(dh); return(NULL); }
2284         return(dh);
2285         }
2286
2287 static DH *get_dh1024()
2288         {
2289         static unsigned char dh1024_p[]={
2290                 0xF8,0x81,0x89,0x7D,0x14,0x24,0xC5,0xD1,0xE6,0xF7,0xBF,0x3A,
2291                 0xE4,0x90,0xF4,0xFC,0x73,0xFB,0x34,0xB5,0xFA,0x4C,0x56,0xA2,
2292                 0xEA,0xA7,0xE9,0xC0,0xC0,0xCE,0x89,0xE1,0xFA,0x63,0x3F,0xB0,
2293                 0x6B,0x32,0x66,0xF1,0xD1,0x7B,0xB0,0x00,0x8F,0xCA,0x87,0xC2,
2294                 0xAE,0x98,0x89,0x26,0x17,0xC2,0x05,0xD2,0xEC,0x08,0xD0,0x8C,
2295                 0xFF,0x17,0x52,0x8C,0xC5,0x07,0x93,0x03,0xB1,0xF6,0x2F,0xB8,
2296                 0x1C,0x52,0x47,0x27,0x1B,0xDB,0xD1,0x8D,0x9D,0x69,0x1D,0x52,
2297                 0x4B,0x32,0x81,0xAA,0x7F,0x00,0xC8,0xDC,0xE6,0xD9,0xCC,0xC1,
2298                 0x11,0x2D,0x37,0x34,0x6C,0xEA,0x02,0x97,0x4B,0x0E,0xBB,0xB1,
2299                 0x71,0x33,0x09,0x15,0xFD,0xDD,0x23,0x87,0x07,0x5E,0x89,0xAB,
2300                 0x6B,0x7C,0x5F,0xEC,0xA6,0x24,0xDC,0x53,
2301                 };
2302         static unsigned char dh1024_g[]={
2303                 0x02,
2304                 };
2305         DH *dh;
2306
2307         if ((dh=DH_new()) == NULL) return(NULL);
2308         dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2309         dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2310         if ((dh->p == NULL) || (dh->g == NULL))
2311                 { DH_free(dh); return(NULL); }
2312         return(dh);
2313         }
2314
2315 static DH *get_dh1024dsa()
2316         {
2317         static unsigned char dh1024_p[]={
2318                 0xC8,0x00,0xF7,0x08,0x07,0x89,0x4D,0x90,0x53,0xF3,0xD5,0x00,
2319                 0x21,0x1B,0xF7,0x31,0xA6,0xA2,0xDA,0x23,0x9A,0xC7,0x87,0x19,
2320                 0x3B,0x47,0xB6,0x8C,0x04,0x6F,0xFF,0xC6,0x9B,0xB8,0x65,0xD2,
2321                 0xC2,0x5F,0x31,0x83,0x4A,0xA7,0x5F,0x2F,0x88,0x38,0xB6,0x55,
2322                 0xCF,0xD9,0x87,0x6D,0x6F,0x9F,0xDA,0xAC,0xA6,0x48,0xAF,0xFC,
2323                 0x33,0x84,0x37,0x5B,0x82,0x4A,0x31,0x5D,0xE7,0xBD,0x52,0x97,
2324                 0xA1,0x77,0xBF,0x10,0x9E,0x37,0xEA,0x64,0xFA,0xCA,0x28,0x8D,
2325                 0x9D,0x3B,0xD2,0x6E,0x09,0x5C,0x68,0xC7,0x45,0x90,0xFD,0xBB,
2326                 0x70,0xC9,0x3A,0xBB,0xDF,0xD4,0x21,0x0F,0xC4,0x6A,0x3C,0xF6,
2327                 0x61,0xCF,0x3F,0xD6,0x13,0xF1,0x5F,0xBC,0xCF,0xBC,0x26,0x9E,
2328                 0xBC,0x0B,0xBD,0xAB,0x5D,0xC9,0x54,0x39,
2329                 };
2330         static unsigned char dh1024_g[]={
2331                 0x3B,0x40,0x86,0xE7,0xF3,0x6C,0xDE,0x67,0x1C,0xCC,0x80,0x05,
2332                 0x5A,0xDF,0xFE,0xBD,0x20,0x27,0x74,0x6C,0x24,0xC9,0x03,0xF3,
2333                 0xE1,0x8D,0xC3,0x7D,0x98,0x27,0x40,0x08,0xB8,0x8C,0x6A,0xE9,
2334                 0xBB,0x1A,0x3A,0xD6,0x86,0x83,0x5E,0x72,0x41,0xCE,0x85,0x3C,
2335                 0xD2,0xB3,0xFC,0x13,0xCE,0x37,0x81,0x9E,0x4C,0x1C,0x7B,0x65,
2336                 0xD3,0xE6,0xA6,0x00,0xF5,0x5A,0x95,0x43,0x5E,0x81,0xCF,0x60,
2337                 0xA2,0x23,0xFC,0x36,0xA7,0x5D,0x7A,0x4C,0x06,0x91,0x6E,0xF6,
2338                 0x57,0xEE,0x36,0xCB,0x06,0xEA,0xF5,0x3D,0x95,0x49,0xCB,0xA7,
2339                 0xDD,0x81,0xDF,0x80,0x09,0x4A,0x97,0x4D,0xA8,0x22,0x72,0xA1,
2340                 0x7F,0xC4,0x70,0x56,0x70,0xE8,0x20,0x10,0x18,0x8F,0x2E,0x60,
2341                 0x07,0xE7,0x68,0x1A,0x82,0x5D,0x32,0xA2,
2342                 };
2343         DH *dh;
2344
2345         if ((dh=DH_new()) == NULL) return(NULL);
2346         dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2347         dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2348         if ((dh->p == NULL) || (dh->g == NULL))
2349                 { DH_free(dh); return(NULL); }
2350         dh->length = 160;
2351         return(dh);
2352         }
2353 #endif
2354
2355 #ifndef OPENSSL_NO_PSK
2356 /* convert the PSK key (psk_key) in ascii to binary (psk) */
2357 static int psk_key2bn(const char *pskkey, unsigned char *psk,
2358         unsigned int max_psk_len)
2359         {
2360         int ret;
2361         BIGNUM *bn = NULL;
2362
2363         ret = BN_hex2bn(&bn, pskkey);
2364         if (!ret)
2365                 {
2366                 BIO_printf(bio_err,"Could not convert PSK key '%s' to BIGNUM\n", pskkey);
2367                 if (bn)
2368                         BN_free(bn);
2369                 return 0;
2370                 }
2371         if (BN_num_bytes(bn) > (int)max_psk_len)
2372                 {
2373                 BIO_printf(bio_err,"psk buffer of callback is too small (%d) for key (%d)\n",
2374                         max_psk_len, BN_num_bytes(bn));
2375                 BN_free(bn);
2376                 return 0;
2377                 }
2378         ret = BN_bn2bin(bn, psk);
2379         BN_free(bn);
2380         return ret;
2381         }
2382
2383 static unsigned int psk_client_callback(SSL *ssl, const char *hint, char *identity,
2384         unsigned int max_identity_len, unsigned char *psk,
2385         unsigned int max_psk_len)
2386         {
2387         int ret;
2388         unsigned int psk_len = 0;
2389
2390         ret = BIO_snprintf(identity, max_identity_len, "Client_identity");
2391         if (ret < 0)
2392                 goto out_err;
2393         if (debug)
2394                 fprintf(stderr, "client: created identity '%s' len=%d\n", identity, ret);
2395         ret = psk_key2bn(psk_key, psk, max_psk_len);
2396         if (ret < 0)
2397                 goto out_err;
2398         psk_len = ret;
2399 out_err:
2400         return psk_len;
2401         }
2402
2403 static unsigned int psk_server_callback(SSL *ssl, const char *identity,
2404         unsigned char *psk, unsigned int max_psk_len)
2405         {
2406         unsigned int psk_len=0;
2407
2408         if (strcmp(identity, "Client_identity") != 0)
2409                 {
2410                 BIO_printf(bio_err, "server: PSK error: client identity not found\n");
2411                 return 0;
2412                 }
2413         psk_len=psk_key2bn(psk_key, psk, max_psk_len);
2414         return psk_len;
2415         }
2416 #endif
2417
2418 static int do_test_cipherlist(void)
2419         {
2420         int i = 0;
2421         const SSL_METHOD *meth;
2422         const SSL_CIPHER *ci, *tci = NULL;
2423
2424 #ifndef OPENSSL_NO_SSL2
2425         fprintf(stderr, "testing SSLv2 cipher list order: ");
2426         meth = SSLv2_method();
2427         while ((ci = meth->get_cipher(i++)) != NULL)
2428                 {
2429                 if (tci != NULL)
2430                         if (ci->id >= tci->id)
2431                                 {
2432                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2433                                 return 0;
2434                                 }
2435                 tci = ci;
2436                 }
2437         fprintf(stderr, "ok\n");
2438 #endif
2439 #ifndef OPENSSL_NO_SSL3
2440         fprintf(stderr, "testing SSLv3 cipher list order: ");
2441         meth = SSLv3_method();
2442         tci = NULL;
2443         while ((ci = meth->get_cipher(i++)) != NULL)
2444                 {
2445                 if (tci != NULL)
2446                         if (ci->id >= tci->id)
2447                                 {
2448                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2449                                 return 0;
2450                                 }
2451                 tci = ci;
2452                 }
2453         fprintf(stderr, "ok\n");
2454 #endif
2455 #ifndef OPENSSL_NO_TLS1
2456         fprintf(stderr, "testing TLSv1 cipher list order: ");
2457         meth = TLSv1_method();
2458         tci = NULL;
2459         while ((ci = meth->get_cipher(i++)) != NULL)
2460                 {
2461                 if (tci != NULL)
2462                         if (ci->id >= tci->id)
2463                                 {
2464                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2465                                 return 0;
2466                                 }
2467                 tci = ci;
2468                 }
2469         fprintf(stderr, "ok\n");
2470 #endif
2471
2472         return 1;
2473         }