ssl/ssltest.c

   1 /* ssl/ssltest.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111 /* ====================================================================
 112  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
 113  * ECC cipher suite support in OpenSSL originally developed by
 114  * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
 115  */
 116 /* ====================================================================
 117  * Copyright 2005 Nokia. All rights reserved.
 118  *
 119  * The portions of the attached software ("Contribution") is developed by
 120  * Nokia Corporation and is licensed pursuant to the OpenSSL open source
 121  * license.
 122  *
 123  * The Contribution, originally written by Mika Kousa and Pasi Eronen of
 124  * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
 125  * support (see RFC 4279) to OpenSSL.
 126  *
 127  * No patent licenses or other rights except those expressly stated in
 128  * the OpenSSL open source license shall be deemed granted or received
 129  * expressly, by implication, estoppel, or otherwise.
 130  *
 131  * No assurances are provided by Nokia that the Contribution does not
 132  * infringe the patent or other intellectual property rights of any third
 133  * party or that the license provides you with all the necessary rights
 134  * to make use of the Contribution.
 135  *
 136  * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
 137  * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
 138  * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
 139  * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
 140  * OTHERWISE.
 141  */
 142
 143 #define _BSD_SOURCE 1           /* Or gethostname won't be declared properly
 144                                    on Linux and GNU platforms. */
 145
 146 #include <assert.h>
 147 #include <errno.h>
 148 #include <limits.h>
 149 #include <stdio.h>
 150 #include <stdlib.h>
 151 #include <string.h>
 152 #include <time.h>
 153
 154 #define USE_SOCKETS
 155 #include "e_os.h"
 156
 157 #ifdef OPENSSL_SYS_VMS
 158 #define _XOPEN_SOURCE 500       /* Or isascii won't be declared properly on
 159                                    VMS (at least with DECompHP C).  */
 160 #endif
 161
 162 #include <ctype.h>
 163
 164 #include <openssl/bio.h>
 165 #include <openssl/crypto.h>
 166 #include <openssl/evp.h>
 167 #include <openssl/x509.h>
 168 #include <openssl/x509v3.h>
 169 #include <openssl/ssl.h>
 170 #ifndef OPENSSL_NO_ENGINE
 171 #include <openssl/engine.h>
 172 #endif
 173 #include <openssl/err.h>
 174 #include <openssl/rand.h>
 175 #ifndef OPENSSL_NO_RSA
 176 #include <openssl/rsa.h>
 177 #endif
 178 #ifndef OPENSSL_NO_DSA
 179 #include <openssl/dsa.h>
 180 #endif
 181 #ifndef OPENSSL_NO_DH
 182 #include <openssl/dh.h>
 183 #endif
 184 #include <openssl/bn.h>
 185
 186 #define _XOPEN_SOURCE_EXTENDED  1 /* Or gethostname won't be declared properly
 187                                      on Compaq platforms (at least with DEC C).
 188                                      Do not try to put it earlier, or IPv6 includes
 189                                      get screwed...
 190                                   */
 191
 192 #ifdef OPENSSL_SYS_WINDOWS
 193 #include <winsock.h>
 194 #else
 195 #include OPENSSL_UNISTD
 196 #endif
 197
 198 #ifdef OPENSSL_SYS_VMS
 199 #  define TEST_SERVER_CERT "SYS$DISK:[-.APPS]SERVER.PEM"
 200 #  define TEST_CLIENT_CERT "SYS$DISK:[-.APPS]CLIENT.PEM"
 201 #elif defined(OPENSSL_SYS_WINCE)
 202 #  define TEST_SERVER_CERT "\\OpenSSL\\server.pem"
 203 #  define TEST_CLIENT_CERT "\\OpenSSL\\client.pem"
 204 #elif defined(OPENSSL_SYS_NETWARE)
 205 #  define TEST_SERVER_CERT "\\openssl\\apps\\server.pem"
 206 #  define TEST_CLIENT_CERT "\\openssl\\apps\\client.pem"
 207 #else
 208 #  define TEST_SERVER_CERT "../apps/server.pem"
 209 #  define TEST_CLIENT_CERT "../apps/client.pem"
 210 #endif
 211
 212 /* There is really no standard for this, so let's assign some tentative
 213    numbers.  In any case, these numbers are only for this test */
 214 #define COMP_RLE        255
 215 #define COMP_ZLIB       1
 216
 217 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
 218 #ifndef OPENSSL_NO_RSA
 219 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export,int keylength);
 220 static void free_tmp_rsa(void);
 221 #endif
 222 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg);
 223 #define APP_CALLBACK_STRING "Test Callback Argument"
 224 struct app_verify_arg
 225         {
 226         char *string;
 227         int app_verify;
 228         int allow_proxy_certs;
 229         char *proxy_auth;
 230         char *proxy_cond;
 231         };
 232
 233 #ifndef OPENSSL_NO_DH
 234 static DH *get_dh512(void);
 235 static DH *get_dh1024(void);
 236 static DH *get_dh1024dsa(void);
 237 #endif
 238
 239
 240 static char *psk_key=NULL; /* by default PSK is not used */
 241 #ifndef OPENSSL_NO_PSK
 242 static unsigned int psk_client_callback(SSL *ssl, const char *hint, char *identity,
 243         unsigned int max_identity_len, unsigned char *psk,
 244         unsigned int max_psk_len);
 245 static unsigned int psk_server_callback(SSL *ssl, const char *identity, unsigned char *psk,
 246         unsigned int max_psk_len);
 247 #endif
 248
 249 static BIO *bio_err=NULL;
 250 static BIO *bio_stdout=NULL;
 251
 252 static char *cipher=NULL;
 253 static int verbose=0;
 254 static int debug=0;
 255 #if 0
 256 /* Not used yet. */
 257 #ifdef FIONBIO
 258 static int s_nbio=0;
 259 #endif
 260 #endif
 261
 262 static const char rnd_seed[] = "string to make the random number generator think it has entropy";
 263
 264 int doit_biopair(SSL *s_ssl,SSL *c_ssl,long bytes,clock_t *s_time,clock_t *c_time);
 265 int doit(SSL *s_ssl,SSL *c_ssl,long bytes);
 266 static int do_test_cipherlist(void);
 267 static void sv_usage(void)
 268         {
 269         fprintf(stderr,"usage: ssltest [args ...]\n");
 270         fprintf(stderr,"\n");
 271         fprintf(stderr," -server_auth  - check server certificate\n");
 272         fprintf(stderr," -client_auth  - do client authentication\n");
 273         fprintf(stderr," -proxy        - allow proxy certificates\n");
 274         fprintf(stderr," -proxy_auth <val> - set proxy policy rights\n");
 275         fprintf(stderr," -proxy_cond <val> - experssion to test proxy policy rights\n");
 276         fprintf(stderr," -v            - more output\n");
 277         fprintf(stderr," -d            - debug output\n");
 278         fprintf(stderr," -reuse        - use session-id reuse\n");
 279         fprintf(stderr," -num <val>    - number of connections to perform\n");
 280         fprintf(stderr," -bytes <val>  - number of bytes to swap between client/server\n");
 281 #ifndef OPENSSL_NO_DH
 282         fprintf(stderr," -dhe1024      - use 1024 bit key (safe prime) for DHE\n");
 283         fprintf(stderr," -dhe1024dsa   - use 1024 bit key (with 160-bit subprime) for DHE\n");
 284         fprintf(stderr," -no_dhe       - disable DHE\n");
 285 #endif
 286 #ifndef OPENSSL_NO_ECDH
 287         fprintf(stderr," -no_ecdhe     - disable ECDHE\n");
 288 #endif
 289 #ifndef OPENSSL_NO_PSK
 290         fprintf(stderr," -psk arg      - PSK in hex (without 0x)\n");
 291 #endif
 292 #ifndef OPENSSL_NO_SSL2
 293         fprintf(stderr," -ssl2         - use SSLv2\n");
 294 #endif
 295 #ifndef OPENSSL_NO_SSL3
 296         fprintf(stderr," -ssl3         - use SSLv3\n");
 297 #endif
 298 #ifndef OPENSSL_NO_TLS1
 299         fprintf(stderr," -tls1         - use TLSv1\n");
 300 #endif
 301         fprintf(stderr," -CApath arg   - PEM format directory of CA's\n");
 302         fprintf(stderr," -CAfile arg   - PEM format file of CA's\n");
 303         fprintf(stderr," -cert arg     - Server certificate file\n");
 304         fprintf(stderr," -key arg      - Server key file (default: same as -cert)\n");
 305         fprintf(stderr," -c_cert arg   - Client certificate file\n");
 306         fprintf(stderr," -c_key arg    - Client key file (default: same as -c_cert)\n");
 307         fprintf(stderr," -cipher arg   - The cipher list\n");
 308         fprintf(stderr," -bio_pair     - Use BIO pairs\n");
 309         fprintf(stderr," -f            - Test even cases that can't work\n");
 310         fprintf(stderr," -time         - measure processor time used by client and server\n");
 311         fprintf(stderr," -zlib         - use zlib compression\n");
 312         fprintf(stderr," -rle          - use rle compression\n");
 313 #ifndef OPENSSL_NO_ECDH
 314         fprintf(stderr," -named_curve arg  - Elliptic curve name to use for ephemeral ECDH keys.\n" \
 315                        "                 Use \"openssl ecparam -list_curves\" for all names\n"  \
 316                        "                 (default is sect163r2).\n");
 317 #endif
 318         fprintf(stderr," -test_cipherlist - verifies the order of the ssl cipher lists\n");
 319         }
 320
 321 static void print_details(SSL *c_ssl, const char *prefix)
 322         {
 323         const SSL_CIPHER *ciph;
 324         X509 *cert;
 325
 326         ciph=SSL_get_current_cipher(c_ssl);
 327         BIO_printf(bio_stdout,"%s%s, cipher %s %s",
 328                 prefix,
 329                 SSL_get_version(c_ssl),
 330                 SSL_CIPHER_get_version(ciph),
 331                 SSL_CIPHER_get_name(ciph));
 332         cert=SSL_get_peer_certificate(c_ssl);
 333         if (cert != NULL)
 334                 {
 335                 EVP_PKEY *pkey = X509_get_pubkey(cert);
 336                 if (pkey != NULL)
 337                         {
 338                         if (0)
 339                                 ;
 340 #ifndef OPENSSL_NO_RSA
 341                         else if (pkey->type == EVP_PKEY_RSA && pkey->pkey.rsa != NULL
 342                                 && pkey->pkey.rsa->n != NULL)
 343                                 {
 344                                 BIO_printf(bio_stdout, ", %d bit RSA",
 345                                         BN_num_bits(pkey->pkey.rsa->n));
 346                                 }
 347 #endif
 348 #ifndef OPENSSL_NO_DSA
 349                         else if (pkey->type == EVP_PKEY_DSA && pkey->pkey.dsa != NULL
 350                                 && pkey->pkey.dsa->p != NULL)
 351                                 {
 352                                 BIO_printf(bio_stdout, ", %d bit DSA",
 353                                         BN_num_bits(pkey->pkey.dsa->p));
 354                                 }
 355 #endif
 356                         EVP_PKEY_free(pkey);
 357                         }
 358                 X509_free(cert);
 359                 }
 360         /* The SSL API does not allow us to look at temporary RSA/DH keys,
 361          * otherwise we should print their lengths too */
 362         BIO_printf(bio_stdout,"\n");
 363         }
 364
 365 static void lock_dbg_cb(int mode, int type, const char *file, int line)
 366         {
 367         static int modes[CRYPTO_NUM_LOCKS]; /* = {0, 0, ... } */
 368         const char *errstr = NULL;
 369         int rw;
 370
 371         rw = mode & (CRYPTO_READ|CRYPTO_WRITE);
 372         if (!((rw == CRYPTO_READ) || (rw == CRYPTO_WRITE)))
 373                 {
 374                 errstr = "invalid mode";
 375                 goto err;
 376                 }
 377
 378         if (type < 0 || type >= CRYPTO_NUM_LOCKS)
 379                 {
 380                 errstr = "type out of bounds";
 381                 goto err;
 382                 }
 383
 384         if (mode & CRYPTO_LOCK)
 385                 {
 386                 if (modes[type])
 387                         {
 388                         errstr = "already locked";
 389                         /* must not happen in a single-threaded program
 390                          * (would deadlock) */
 391                         goto err;
 392                         }
 393
 394                 modes[type] = rw;
 395                 }
 396         else if (mode & CRYPTO_UNLOCK)
 397                 {
 398                 if (!modes[type])
 399                         {
 400                         errstr = "not locked";
 401                         goto err;
 402                         }
 403
 404                 if (modes[type] != rw)
 405                         {
 406                         errstr = (rw == CRYPTO_READ) ?
 407                                 "CRYPTO_r_unlock on write lock" :
 408                                 "CRYPTO_w_unlock on read lock";
 409                         }
 410
 411                 modes[type] = 0;
 412                 }
 413         else
 414                 {
 415                 errstr = "invalid mode";
 416                 goto err;
 417                 }
 418
 419  err:
 420         if (errstr)
 421                 {
 422                 /* we cannot use bio_err here */
 423                 fprintf(stderr, "openssl (lock_dbg_cb): %s (mode=%d, type=%d) at %s:%d\n",
 424                         errstr, mode, type, file, line);
 425                 }
 426         }
 427
 428 #ifdef TLSEXT_TYPE_opaque_prf_input
 429 struct cb_info_st { void *input; size_t len; int ret; };
 430 struct cb_info_st co1 = { "C", 1, 1 }; /* try to negotiate oqaque PRF input */
 431 struct cb_info_st co2 = { "C", 1, 2 }; /* insist on oqaque PRF input */
 432 struct cb_info_st so1 = { "S", 1, 1 }; /* try to negotiate oqaque PRF input */
 433 struct cb_info_st so2 = { "S", 1, 2 }; /* insist on oqaque PRF input */
 434
 435 int opaque_prf_input_cb(SSL *ssl, void *peerinput, size_t len, void *arg_)
 436         {
 437         struct cb_info_st *arg = arg_;
 438
 439         if (arg == NULL)
 440                 return 1;
 441
 442         if (!SSL_set_tlsext_opaque_prf_input(ssl, arg->input, arg->len))
 443                 return 0;
 444         return arg->ret;
 445         }
 446 #endif
 447
 448 int main(int argc, char *argv[])
 449         {
 450         char *CApath=NULL,*CAfile=NULL;
 451         int badop=0;
 452         int bio_pair=0;
 453         int force=0;
 454         int tls1=0,ssl2=0,ssl3=0,ret=1;
 455         int client_auth=0;
 456         int server_auth=0,i;
 457         struct app_verify_arg app_verify_arg =
 458                 { APP_CALLBACK_STRING, 0, 0, NULL, NULL };
 459         char *server_cert=TEST_SERVER_CERT;
 460         char *server_key=NULL;
 461         char *client_cert=TEST_CLIENT_CERT;
 462         char *client_key=NULL;
 463 #ifndef OPENSSL_NO_ECDH
 464         char *named_curve = NULL;
 465 #endif
 466         SSL_CTX *s_ctx=NULL;
 467         SSL_CTX *c_ctx=NULL;
 468         const SSL_METHOD *meth=NULL;
 469         SSL *c_ssl,*s_ssl;
 470         int number=1,reuse=0;
 471         long bytes=256L;
 472 #ifndef OPENSSL_NO_DH
 473         DH *dh;
 474         int dhe1024 = 0, dhe1024dsa = 0;
 475 #endif
 476 #ifndef OPENSSL_NO_ECDH
 477         EC_KEY *ecdh = NULL;
 478 #endif
 479         int no_dhe = 0;
 480         int no_ecdhe = 0;
 481         int no_psk = 0;
 482         int print_time = 0;
 483         clock_t s_time = 0, c_time = 0;
 484         int comp = 0;
 485 #ifndef OPENSSL_NO_COMP
 486         COMP_METHOD *cm = NULL;
 487         STACK_OF(SSL_COMP) *ssl_comp_methods = NULL;
 488 #endif
 489         int test_cipherlist = 0;
 490
 491         verbose = 0;
 492         debug = 0;
 493         cipher = 0;
 494
 495         bio_err=BIO_new_fp(stderr,BIO_NOCLOSE|BIO_FP_TEXT);
 496
 497         CRYPTO_set_locking_callback(lock_dbg_cb);
 498
 499         /* enable memory leak checking unless explicitly disabled */
 500         if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) && (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off"))))
 501                 {
 502                 CRYPTO_malloc_debug_init();
 503                 CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
 504                 }
 505         else
 506                 {
 507                 /* OPENSSL_DEBUG_MEMORY=off */
 508                 CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0);
 509                 }
 510         CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
 511
 512         RAND_seed(rnd_seed, sizeof rnd_seed);
 513
 514         bio_stdout=BIO_new_fp(stdout,BIO_NOCLOSE|BIO_FP_TEXT);
 515
 516         argc--;
 517         argv++;
 518
 519         while (argc >= 1)
 520                 {
 521                 if      (strcmp(*argv,"-server_auth") == 0)
 522                         server_auth=1;
 523                 else if (strcmp(*argv,"-client_auth") == 0)
 524                         client_auth=1;
 525                 else if (strcmp(*argv,"-proxy_auth") == 0)
 526                         {
 527                         if (--argc < 1) goto bad;
 528                         app_verify_arg.proxy_auth= *(++argv);
 529                         }
 530                 else if (strcmp(*argv,"-proxy_cond") == 0)
 531                         {
 532                         if (--argc < 1) goto bad;
 533                         app_verify_arg.proxy_cond= *(++argv);
 534                         }
 535                 else if (strcmp(*argv,"-v") == 0)
 536                         verbose=1;
 537                 else if (strcmp(*argv,"-d") == 0)
 538                         debug=1;
 539                 else if (strcmp(*argv,"-reuse") == 0)
 540                         reuse=1;
 541                 else if (strcmp(*argv,"-dhe1024") == 0)
 542                         {
 543 #ifndef OPENSSL_NO_DH
 544                         dhe1024=1;
 545 #else
 546                         fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
 547 #endif
 548                         }
 549                 else if (strcmp(*argv,"-dhe1024dsa") == 0)
 550                         {
 551 #ifndef OPENSSL_NO_DH
 552                         dhe1024dsa=1;
 553 #else
 554                         fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
 555 #endif
 556                         }
 557                 else if (strcmp(*argv,"-no_dhe") == 0)
 558                         no_dhe=1;
 559                 else if (strcmp(*argv,"-no_ecdhe") == 0)
 560                         no_ecdhe=1;
 561                 else if (strcmp(*argv,"-psk") == 0)
 562                         {
 563                         if (--argc < 1) goto bad;
 564                         psk_key=*(++argv);
 565 #ifndef OPENSSL_NO_PSK
 566                         if (strspn(psk_key, "abcdefABCDEF1234567890") != strlen(psk_key))
 567                                 {
 568                                 BIO_printf(bio_err,"Not a hex number '%s'\n",*argv);
 569                                 goto bad;
 570                                 }
 571 #else
 572                         no_psk=1;
 573 #endif
 574                         }
 575                 else if (strcmp(*argv,"-ssl2") == 0)
 576                         ssl2=1;
 577                 else if (strcmp(*argv,"-tls1") == 0)
 578                         tls1=1;
 579                 else if (strcmp(*argv,"-ssl3") == 0)
 580                         ssl3=1;
 581                 else if (strncmp(*argv,"-num",4) == 0)
 582                         {
 583                         if (--argc < 1) goto bad;
 584                         number= atoi(*(++argv));
 585                         if (number == 0) number=1;
 586                         }
 587                 else if (strcmp(*argv,"-bytes") == 0)
 588                         {
 589                         if (--argc < 1) goto bad;
 590                         bytes= atol(*(++argv));
 591                         if (bytes == 0L) bytes=1L;
 592                         i=strlen(argv[0]);
 593                         if (argv[0][i-1] == 'k') bytes*=1024L;
 594                         if (argv[0][i-1] == 'm') bytes*=1024L*1024L;
 595                         }
 596                 else if (strcmp(*argv,"-cert") == 0)
 597                         {
 598                         if (--argc < 1) goto bad;
 599                         server_cert= *(++argv);
 600                         }
 601                 else if (strcmp(*argv,"-s_cert") == 0)
 602                         {
 603                         if (--argc < 1) goto bad;
 604                         server_cert= *(++argv);
 605                         }
 606                 else if (strcmp(*argv,"-key") == 0)
 607                         {
 608                         if (--argc < 1) goto bad;
 609                         server_key= *(++argv);
 610                         }
 611                 else if (strcmp(*argv,"-s_key") == 0)
 612                         {
 613                         if (--argc < 1) goto bad;
 614                         server_key= *(++argv);
 615                         }
 616                 else if (strcmp(*argv,"-c_cert") == 0)
 617                         {
 618                         if (--argc < 1) goto bad;
 619                         client_cert= *(++argv);
 620                         }
 621                 else if (strcmp(*argv,"-c_key") == 0)
 622                         {
 623                         if (--argc < 1) goto bad;
 624                         client_key= *(++argv);
 625                         }
 626                 else if (strcmp(*argv,"-cipher") == 0)
 627                         {
 628                         if (--argc < 1) goto bad;
 629                         cipher= *(++argv);
 630                         }
 631                 else if (strcmp(*argv,"-CApath") == 0)
 632                         {
 633                         if (--argc < 1) goto bad;
 634                         CApath= *(++argv);
 635                         }
 636                 else if (strcmp(*argv,"-CAfile") == 0)
 637                         {
 638                         if (--argc < 1) goto bad;
 639                         CAfile= *(++argv);
 640                         }
 641                 else if (strcmp(*argv,"-bio_pair") == 0)
 642                         {
 643                         bio_pair = 1;
 644                         }
 645                 else if (strcmp(*argv,"-f") == 0)
 646                         {
 647                         force = 1;
 648                         }
 649                 else if (strcmp(*argv,"-time") == 0)
 650                         {
 651                         print_time = 1;
 652                         }
 653                 else if (strcmp(*argv,"-zlib") == 0)
 654                         {
 655                         comp = COMP_ZLIB;
 656                         }
 657                 else if (strcmp(*argv,"-rle") == 0)
 658                         {
 659                         comp = COMP_RLE;
 660                         }
 661                 else if (strcmp(*argv,"-named_curve") == 0)
 662                         {
 663                         if (--argc < 1) goto bad;
 664 #ifndef OPENSSL_NO_ECDH
 665                         named_curve = *(++argv);
 666 #else
 667                         fprintf(stderr,"ignoring -named_curve, since I'm compiled without ECDH\n");
 668                         ++argv;
 669 #endif
 670                         }
 671                 else if (strcmp(*argv,"-app_verify") == 0)
 672                         {
 673                         app_verify_arg.app_verify = 1;
 674                         }
 675                 else if (strcmp(*argv,"-proxy") == 0)
 676                         {
 677                         app_verify_arg.allow_proxy_certs = 1;
 678                         }
 679                 else if (strcmp(*argv,"-test_cipherlist") == 0)
 680                         {
 681                         test_cipherlist = 1;
 682                         }
 683                 else
 684                         {
 685                         fprintf(stderr,"unknown option %s\n",*argv);
 686                         badop=1;
 687                         break;
 688                         }
 689                 argc--;
 690                 argv++;
 691                 }
 692         if (badop)
 693                 {
 694 bad:
 695                 sv_usage();
 696                 goto end;
 697                 }
 698
 699         if (test_cipherlist == 1)
 700                 {
 701                 /* ensure that the cipher list are correctly sorted and exit */
 702                 if (do_test_cipherlist() == 0)
 703                         EXIT(1);
 704                 ret = 0;
 705                 goto end;
 706                 }
 707
 708         if (!ssl2 && !ssl3 && !tls1 && number > 1 && !reuse && !force)
 709                 {
 710                 fprintf(stderr, "This case cannot work.  Use -f to perform "
 711                         "the test anyway (and\n-d to see what happens), "
 712                         "or add one of -ssl2, -ssl3, -tls1, -reuse\n"
 713                         "to avoid protocol mismatch.\n");
 714                 EXIT(1);
 715                 }
 716
 717         if (print_time)
 718                 {
 719                 if (!bio_pair)
 720                         {
 721                         fprintf(stderr, "Using BIO pair (-bio_pair)\n");
 722                         bio_pair = 1;
 723                         }
 724                 if (number < 50 && !force)
 725                         fprintf(stderr, "Warning: For accurate timings, use more connections (e.g. -num 1000)\n");
 726                 }
 727
 728 /*      if (cipher == NULL) cipher=getenv("SSL_CIPHER"); */
 729
 730         SSL_library_init();
 731         SSL_load_error_strings();
 732
 733 #ifndef OPENSSL_NO_COMP
 734         if (comp == COMP_ZLIB) cm = COMP_zlib();
 735         if (comp == COMP_RLE) cm = COMP_rle();
 736         if (cm != NULL)
 737                 {
 738                 if (cm->type != NID_undef)
 739                         {
 740                         if (SSL_COMP_add_compression_method(comp, cm) != 0)
 741                                 {
 742                                 fprintf(stderr,
 743                                         "Failed to add compression method\n");
 744                                 ERR_print_errors_fp(stderr);
 745                                 }
 746                         }
 747                 else
 748                         {
 749                         fprintf(stderr,
 750                                 "Warning: %s compression not supported\n",
 751                                 (comp == COMP_RLE ? "rle" :
 752                                         (comp == COMP_ZLIB ? "zlib" :
 753                                                 "unknown")));
 754                         ERR_print_errors_fp(stderr);
 755                         }
 756                 }
 757         ssl_comp_methods = SSL_COMP_get_compression_methods();
 758         fprintf(stderr, "Available compression methods:\n");
 759         {
 760         int j, n = sk_SSL_COMP_num(ssl_comp_methods);
 761         if (n == 0)
 762                 fprintf(stderr, "  NONE\n");
 763         else
 764                 for (j = 0; j < n; j++)
 765                         {
 766                         SSL_COMP *c = sk_SSL_COMP_value(ssl_comp_methods, j);
 767                         fprintf(stderr, "  %d: %s\n", c->id, c->name);
 768                         }
 769         }
 770 #endif
 771
 772 #if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
 773         if (ssl2)
 774                 meth=SSLv2_method();
 775         else
 776         if (tls1)
 777                 meth=TLSv1_method();
 778         else
 779         if (ssl3)
 780                 meth=SSLv3_method();
 781         else
 782                 meth=SSLv23_method();
 783 #else
 784 #ifdef OPENSSL_NO_SSL2
 785         meth=SSLv3_method();
 786 #else
 787         meth=SSLv2_method();
 788 #endif
 789 #endif
 790
 791         c_ctx=SSL_CTX_new(meth);
 792         s_ctx=SSL_CTX_new(meth);
 793         if ((c_ctx == NULL) || (s_ctx == NULL))
 794                 {
 795                 ERR_print_errors(bio_err);
 796                 goto end;
 797                 }
 798
 799         if (cipher != NULL)
 800                 {
 801                 SSL_CTX_set_cipher_list(c_ctx,cipher);
 802                 SSL_CTX_set_cipher_list(s_ctx,cipher);
 803                 }
 804
 805 #ifndef OPENSSL_NO_DH
 806         if (!no_dhe)
 807                 {
 808                 if (dhe1024dsa)
 809                         {
 810                         /* use SSL_OP_SINGLE_DH_USE to avoid small subgroup attacks */
 811                         SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
 812                         dh=get_dh1024dsa();
 813                         }
 814                 else if (dhe1024)
 815                         dh=get_dh1024();
 816                 else
 817                         dh=get_dh512();
 818                 SSL_CTX_set_tmp_dh(s_ctx,dh);
 819                 DH_free(dh);
 820                 }
 821 #else
 822         (void)no_dhe;
 823 #endif
 824
 825 #ifndef OPENSSL_NO_ECDH
 826         if (!no_ecdhe)
 827                 {
 828                 int nid;
 829
 830                 if (named_curve != NULL)
 831                         {
 832                         nid = OBJ_sn2nid(named_curve);
 833                         if (nid == 0)
 834                         {
 835                                 BIO_printf(bio_err, "unknown curve name (%s)\n", named_curve);
 836                                 goto end;
 837                                 }
 838                         }
 839                 else
 840                         nid = NID_sect163r2;
 841
 842                 ecdh = EC_KEY_new_by_curve_name(nid);
 843                 if (ecdh == NULL)
 844                         {
 845                         BIO_printf(bio_err, "unable to create curve\n");
 846                         goto end;
 847                         }
 848
 849                 SSL_CTX_set_tmp_ecdh(s_ctx, ecdh);
 850                 SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_ECDH_USE);
 851                 EC_KEY_free(ecdh);
 852                 }
 853 #else
 854         (void)no_ecdhe;
 855 #endif
 856
 857 #ifndef OPENSSL_NO_RSA
 858         SSL_CTX_set_tmp_rsa_callback(s_ctx,tmp_rsa_cb);
 859 #endif
 860
 861 #ifdef TLSEXT_TYPE_opaque_prf_input
 862         SSL_CTX_set_tlsext_opaque_prf_input_callback(c_ctx, opaque_prf_input_cb);
 863         SSL_CTX_set_tlsext_opaque_prf_input_callback(s_ctx, opaque_prf_input_cb);
 864         SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(c_ctx, &co1); /* or &co2 or NULL */
 865         SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(s_ctx, &so1); /* or &so2 or NULL */
 866 #endif
 867
 868         if (!SSL_CTX_use_certificate_file(s_ctx,server_cert,SSL_FILETYPE_PEM))
 869                 {
 870                 ERR_print_errors(bio_err);
 871                 }
 872         else if (!SSL_CTX_use_PrivateKey_file(s_ctx,
 873                 (server_key?server_key:server_cert), SSL_FILETYPE_PEM))
 874                 {
 875                 ERR_print_errors(bio_err);
 876                 goto end;
 877                 }
 878
 879         if (client_auth)
 880                 {
 881                 SSL_CTX_use_certificate_file(c_ctx,client_cert,
 882                         SSL_FILETYPE_PEM);
 883                 SSL_CTX_use_PrivateKey_file(c_ctx,
 884                         (client_key?client_key:client_cert),
 885                         SSL_FILETYPE_PEM);
 886                 }
 887
 888         if (    (!SSL_CTX_load_verify_locations(s_ctx,CAfile,CApath)) ||
 889                 (!SSL_CTX_set_default_verify_paths(s_ctx)) ||
 890                 (!SSL_CTX_load_verify_locations(c_ctx,CAfile,CApath)) ||
 891                 (!SSL_CTX_set_default_verify_paths(c_ctx)))
 892                 {
 893                 /* fprintf(stderr,"SSL_load_verify_locations\n"); */
 894                 ERR_print_errors(bio_err);
 895                 /* goto end; */
 896                 }
 897
 898         if (client_auth)
 899                 {
 900                 BIO_printf(bio_err,"client authentication\n");
 901                 SSL_CTX_set_verify(s_ctx,
 902                         SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
 903                         verify_callback);
 904                 SSL_CTX_set_cert_verify_callback(s_ctx, app_verify_callback, &app_verify_arg);
 905                 }
 906         if (server_auth)
 907                 {
 908                 BIO_printf(bio_err,"server authentication\n");
 909                 SSL_CTX_set_verify(c_ctx,SSL_VERIFY_PEER,
 910                         verify_callback);
 911                 SSL_CTX_set_cert_verify_callback(c_ctx, app_verify_callback, &app_verify_arg);
 912                 }
 913
 914         {
 915                 int session_id_context = 0;
 916                 SSL_CTX_set_session_id_context(s_ctx, (void *)&session_id_context, sizeof session_id_context);
 917         }
 918
 919         /* Use PSK only if PSK key is given */
 920         if (psk_key != NULL)
 921                 {
 922                 /* no_psk is used to avoid putting psk command to openssl tool */
 923                 if (no_psk)
 924                         {
 925                         /* if PSK is not compiled in and psk key is
 926                          * given, do nothing and exit successfully */
 927                         ret=0;
 928                         goto end;
 929                         }
 930 #ifndef OPENSSL_NO_PSK
 931                 SSL_CTX_set_psk_client_callback(c_ctx, psk_client_callback);
 932                 SSL_CTX_set_psk_server_callback(s_ctx, psk_server_callback);
 933                 if (debug)
 934                         BIO_printf(bio_err,"setting PSK identity hint to s_ctx\n");
 935                 if (!SSL_CTX_use_psk_identity_hint(s_ctx, "ctx server identity_hint"))
 936                         {
 937                         BIO_printf(bio_err,"error setting PSK identity hint to s_ctx\n");
 938                         ERR_print_errors(bio_err);
 939                         goto end;
 940                         }
 941 #endif
 942                 }
 943
 944         c_ssl=SSL_new(c_ctx);
 945         s_ssl=SSL_new(s_ctx);
 946
 947 #ifndef OPENSSL_NO_KRB5
 948         if (c_ssl  &&  c_ssl->kssl_ctx)
 949                 {
 950                 char    localhost[MAXHOSTNAMELEN+2];
 951
 952                 if (gethostname(localhost, sizeof localhost-1) == 0)
 953                         {
 954                         localhost[sizeof localhost-1]='\0';
 955                         if(strlen(localhost) == sizeof localhost-1)
 956                                 {
 957                                 BIO_printf(bio_err,"localhost name too long\n");
 958                                 goto end;
 959                                 }
 960                         kssl_ctx_setstring(c_ssl->kssl_ctx, KSSL_SERVER,
 961                                 localhost);
 962                         }
 963                 }
 964 #endif    /* OPENSSL_NO_KRB5  */
 965
 966         for (i=0; i<number; i++)
 967                 {
 968                 if (!reuse) SSL_set_session(c_ssl,NULL);
 969                 if (bio_pair)
 970                         ret=doit_biopair(s_ssl,c_ssl,bytes,&s_time,&c_time);
 971                 else
 972                         ret=doit(s_ssl,c_ssl,bytes);
 973                 }
 974
 975         if (!verbose)
 976                 {
 977                 print_details(c_ssl, "");
 978                 }
 979         if ((number > 1) || (bytes > 1L))
 980                 BIO_printf(bio_stdout, "%d handshakes of %ld bytes done\n",number,bytes);
 981         if (print_time)
 982                 {
 983 #ifdef CLOCKS_PER_SEC
 984                 /* "To determine the time in seconds, the value returned
 985                  * by the clock function should be divided by the value
 986                  * of the macro CLOCKS_PER_SEC."
 987                  *                                       -- ISO/IEC 9899 */
 988                 BIO_printf(bio_stdout, "Approximate total server time: %6.2f s\n"
 989                         "Approximate total client time: %6.2f s\n",
 990                         (double)s_time/CLOCKS_PER_SEC,
 991                         (double)c_time/CLOCKS_PER_SEC);
 992 #else
 993                 /* "`CLOCKS_PER_SEC' undeclared (first use this function)"
 994                  *                            -- cc on NeXTstep/OpenStep */
 995                 BIO_printf(bio_stdout,
 996                         "Approximate total server time: %6.2f units\n"
 997                         "Approximate total client time: %6.2f units\n",
 998                         (double)s_time,
 999                         (double)c_time);
1000 #endif
1001                 }
1002
1003         SSL_free(s_ssl);
1004         SSL_free(c_ssl);
1005
1006 end:
1007         if (s_ctx != NULL) SSL_CTX_free(s_ctx);
1008         if (c_ctx != NULL) SSL_CTX_free(c_ctx);
1009
1010         if (bio_stdout != NULL) BIO_free(bio_stdout);
1011
1012 #ifndef OPENSSL_NO_RSA
1013         free_tmp_rsa();
1014 #endif
1015 #ifndef OPENSSL_NO_ENGINE
1016         ENGINE_cleanup();
1017 #endif
1018         CRYPTO_cleanup_all_ex_data();
1019         ERR_free_strings();
1020         ERR_remove_thread_state(NULL);
1021         EVP_cleanup();
1022         CRYPTO_mem_leaks(bio_err);
1023         if (bio_err != NULL) BIO_free(bio_err);
1024         EXIT(ret);
1025         return ret;
1026         }
1027
1028 int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count,
1029         clock_t *s_time, clock_t *c_time)
1030         {
1031         long cw_num = count, cr_num = count, sw_num = count, sr_num = count;
1032         BIO *s_ssl_bio = NULL, *c_ssl_bio = NULL;
1033         BIO *server = NULL, *server_io = NULL, *client = NULL, *client_io = NULL;
1034         int ret = 1;
1035
1036         size_t bufsiz = 256; /* small buffer for testing */
1037
1038         if (!BIO_new_bio_pair(&server, bufsiz, &server_io, bufsiz))
1039                 goto err;
1040         if (!BIO_new_bio_pair(&client, bufsiz, &client_io, bufsiz))
1041                 goto err;
1042
1043         s_ssl_bio = BIO_new(BIO_f_ssl());
1044         if (!s_ssl_bio)
1045                 goto err;
1046
1047         c_ssl_bio = BIO_new(BIO_f_ssl());
1048         if (!c_ssl_bio)
1049                 goto err;
1050
1051         SSL_set_connect_state(c_ssl);
1052         SSL_set_bio(c_ssl, client, client);
1053         (void)BIO_set_ssl(c_ssl_bio, c_ssl, BIO_NOCLOSE);
1054
1055         SSL_set_accept_state(s_ssl);
1056         SSL_set_bio(s_ssl, server, server);
1057         (void)BIO_set_ssl(s_ssl_bio, s_ssl, BIO_NOCLOSE);
1058
1059         do
1060                 {
1061                 /* c_ssl_bio:          SSL filter BIO
1062                  *
1063                  * client:             pseudo-I/O for SSL library
1064                  *
1065                  * client_io:          client's SSL communication; usually to be
1066                  *                     relayed over some I/O facility, but in this
1067                  *                     test program, we're the server, too:
1068                  *
1069                  * server_io:          server's SSL communication
1070                  *
1071                  * server:             pseudo-I/O for SSL library
1072                  *
1073                  * s_ssl_bio:          SSL filter BIO
1074                  *
1075                  * The client and the server each employ a "BIO pair":
1076                  * client + client_io, server + server_io.
1077                  * BIO pairs are symmetric.  A BIO pair behaves similar
1078                  * to a non-blocking socketpair (but both endpoints must
1079                  * be handled by the same thread).
1080                  * [Here we could connect client and server to the ends
1081                  * of a single BIO pair, but then this code would be less
1082                  * suitable as an example for BIO pairs in general.]
1083                  *
1084                  * Useful functions for querying the state of BIO pair endpoints:
1085                  *
1086                  * BIO_ctrl_pending(bio)              number of bytes we can read now
1087                  * BIO_ctrl_get_read_request(bio)     number of bytes needed to fulfil
1088                  *                                      other side's read attempt
1089                  * BIO_ctrl_get_write_guarantee(bio)   number of bytes we can write now
1090                  *
1091                  * ..._read_request is never more than ..._write_guarantee;
1092                  * it depends on the application which one you should use.
1093                  */
1094
1095                 /* We have non-blocking behaviour throughout this test program, but
1096                  * can be sure that there is *some* progress in each iteration; so
1097                  * we don't have to worry about ..._SHOULD_READ or ..._SHOULD_WRITE
1098                  * -- we just try everything in each iteration
1099                  */
1100
1101                         {
1102                         /* CLIENT */
1103
1104                         MS_STATIC char cbuf[1024*8];
1105                         int i, r;
1106                         clock_t c_clock = clock();
1107
1108                         memset(cbuf, 0, sizeof(cbuf));
1109
1110                         if (debug)
1111                                 if (SSL_in_init(c_ssl))
1112                                         printf("client waiting in SSL_connect - %s\n",
1113                                                 SSL_state_string_long(c_ssl));
1114
1115                         if (cw_num > 0)
1116                                 {
1117                                 /* Write to server. */
1118
1119                                 if (cw_num > (long)sizeof cbuf)
1120                                         i = sizeof cbuf;
1121                                 else
1122                                         i = (int)cw_num;
1123                                 r = BIO_write(c_ssl_bio, cbuf, i);
1124                                 if (r < 0)
1125                                         {
1126                                         if (!BIO_should_retry(c_ssl_bio))
1127                                                 {
1128                                                 fprintf(stderr,"ERROR in CLIENT\n");
1129                                                 goto err;
1130                                                 }
1131                                         /* BIO_should_retry(...) can just be ignored here.
1132                                          * The library expects us to call BIO_write with
1133                                          * the same arguments again, and that's what we will
1134                                          * do in the next iteration. */
1135                                         }
1136                                 else if (r == 0)
1137                                         {
1138                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1139                                         goto err;
1140                                         }
1141                                 else
1142                                         {
1143                                         if (debug)
1144                                                 printf("client wrote %d\n", r);
1145                                         cw_num -= r;
1146                                         }
1147                                 }
1148
1149                         if (cr_num > 0)
1150                                 {
1151                                 /* Read from server. */
1152
1153                                 r = BIO_read(c_ssl_bio, cbuf, sizeof(cbuf));
1154                                 if (r < 0)
1155                                         {
1156                                         if (!BIO_should_retry(c_ssl_bio))
1157                                                 {
1158                                                 fprintf(stderr,"ERROR in CLIENT\n");
1159                                                 goto err;
1160                                                 }
1161                                         /* Again, "BIO_should_retry" can be ignored. */
1162                                         }
1163                                 else if (r == 0)
1164                                         {
1165                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1166                                         goto err;
1167                                         }
1168                                 else
1169                                         {
1170                                         if (debug)
1171                                                 printf("client read %d\n", r);
1172                                         cr_num -= r;
1173                                         }
1174                                 }
1175
1176                         /* c_time and s_time increments will typically be very small
1177                          * (depending on machine speed and clock tick intervals),
1178                          * but sampling over a large number of connections should
1179                          * result in fairly accurate figures.  We cannot guarantee
1180                          * a lot, however -- if each connection lasts for exactly
1181                          * one clock tick, it will be counted only for the client
1182                          * or only for the server or even not at all.
1183                          */
1184                         *c_time += (clock() - c_clock);
1185                         }
1186
1187                         {
1188                         /* SERVER */
1189
1190                         MS_STATIC char sbuf[1024*8];
1191                         int i, r;
1192                         clock_t s_clock = clock();
1193
1194                         memset(sbuf, 0, sizeof(sbuf));
1195
1196                         if (debug)
1197                                 if (SSL_in_init(s_ssl))
1198                                         printf("server waiting in SSL_accept - %s\n",
1199                                                 SSL_state_string_long(s_ssl));
1200
1201                         if (sw_num > 0)
1202                                 {
1203                                 /* Write to client. */
1204
1205                                 if (sw_num > (long)sizeof sbuf)
1206                                         i = sizeof sbuf;
1207                                 else
1208                                         i = (int)sw_num;
1209                                 r = BIO_write(s_ssl_bio, sbuf, i);
1210                                 if (r < 0)
1211                                         {
1212                                         if (!BIO_should_retry(s_ssl_bio))
1213                                                 {
1214                                                 fprintf(stderr,"ERROR in SERVER\n");
1215                                                 goto err;
1216                                                 }
1217                                         /* Ignore "BIO_should_retry". */
1218                                         }
1219                                 else if (r == 0)
1220                                         {
1221                                         fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1222                                         goto err;
1223                                         }
1224                                 else
1225                                         {
1226                                         if (debug)
1227                                                 printf("server wrote %d\n", r);
1228                                         sw_num -= r;
1229                                         }
1230                                 }
1231
1232                         if (sr_num > 0)
1233                                 {
1234                                 /* Read from client. */
1235
1236                                 r = BIO_read(s_ssl_bio, sbuf, sizeof(sbuf));
1237                                 if (r < 0)
1238                                         {
1239                                         if (!BIO_should_retry(s_ssl_bio))
1240                                                 {
1241                                                 fprintf(stderr,"ERROR in SERVER\n");
1242                                                 goto err;
1243                                                 }
1244                                         /* blah, blah */
1245                                         }
1246                                 else if (r == 0)
1247                                         {
1248                                         fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1249                                         goto err;
1250                                         }
1251                                 else
1252                                         {
1253                                         if (debug)
1254                                                 printf("server read %d\n", r);
1255                                         sr_num -= r;
1256                                         }
1257                                 }
1258
1259                         *s_time += (clock() - s_clock);
1260                         }
1261
1262                         {
1263                         /* "I/O" BETWEEN CLIENT AND SERVER. */
1264
1265                         size_t r1, r2;
1266                         BIO *io1 = server_io, *io2 = client_io;
1267                         /* we use the non-copying interface for io1
1268                          * and the standard BIO_write/BIO_read interface for io2
1269                          */
1270
1271                         static int prev_progress = 1;
1272                         int progress = 0;
1273
1274                         /* io1 to io2 */
1275                         do
1276                                 {
1277                                 size_t num;
1278                                 int r;
1279
1280                                 r1 = BIO_ctrl_pending(io1);
1281                                 r2 = BIO_ctrl_get_write_guarantee(io2);
1282
1283                                 num = r1;
1284                                 if (r2 < num)
1285                                         num = r2;
1286                                 if (num)
1287                                         {
1288                                         char *dataptr;
1289
1290                                         if (INT_MAX < num) /* yeah, right */
1291                                                 num = INT_MAX;
1292
1293                                         r = BIO_nread(io1, &dataptr, (int)num);
1294                                         assert(r > 0);
1295                                         assert(r <= (int)num);
1296                                         /* possibly r < num (non-contiguous data) */
1297                                         num = r;
1298                                         r = BIO_write(io2, dataptr, (int)num);
1299                                         if (r != (int)num) /* can't happen */
1300                                                 {
1301                                                 fprintf(stderr, "ERROR: BIO_write could not write "
1302                                                         "BIO_ctrl_get_write_guarantee() bytes");
1303                                                 goto err;
1304                                                 }
1305                                         progress = 1;
1306
1307                                         if (debug)
1308                                                 printf((io1 == client_io) ?
1309                                                         "C->S relaying: %d bytes\n" :
1310                                                         "S->C relaying: %d bytes\n",
1311                                                         (int)num);
1312                                         }
1313                                 }
1314                         while (r1 && r2);
1315
1316                         /* io2 to io1 */
1317                         {
1318                                 size_t num;
1319                                 int r;
1320
1321                                 r1 = BIO_ctrl_pending(io2);
1322                                 r2 = BIO_ctrl_get_read_request(io1);
1323                                 /* here we could use ..._get_write_guarantee instead of
1324                                  * ..._get_read_request, but by using the latter
1325                                  * we test restartability of the SSL implementation
1326                                  * more thoroughly */
1327                                 num = r1;
1328                                 if (r2 < num)
1329                                         num = r2;
1330                                 if (num)
1331                                         {
1332                                         char *dataptr;
1333
1334                                         if (INT_MAX < num)
1335                                                 num = INT_MAX;
1336
1337                                         if (num > 1)
1338                                                 --num; /* test restartability even more thoroughly */
1339
1340                                         r = BIO_nwrite0(io1, &dataptr);
1341                                         assert(r > 0);
1342                                         if (r < (int)num)
1343                                                 num = r;
1344                                         r = BIO_read(io2, dataptr, (int)num);
1345                                         if (r != (int)num) /* can't happen */
1346                                                 {
1347                                                 fprintf(stderr, "ERROR: BIO_read could not read "
1348                                                         "BIO_ctrl_pending() bytes");
1349                                                 goto err;
1350                                                 }
1351                                         progress = 1;
1352                                         r = BIO_nwrite(io1, &dataptr, (int)num);
1353                                         if (r != (int)num) /* can't happen */
1354                                                 {
1355                                                 fprintf(stderr, "ERROR: BIO_nwrite() did not accept "
1356                                                         "BIO_nwrite0() bytes");
1357                                                 goto err;
1358                                                 }
1359
1360                                         if (debug)
1361                                                 printf((io2 == client_io) ?
1362                                                         "C->S relaying: %d bytes\n" :
1363                                                         "S->C relaying: %d bytes\n",
1364                                                         (int)num);
1365                                         }
1366                         } /* no loop, BIO_ctrl_get_read_request now returns 0 anyway */
1367
1368                         if (!progress && !prev_progress)
1369                                 if (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0)
1370                                         {
1371                                         fprintf(stderr, "ERROR: got stuck\n");
1372                                         if (strcmp("SSLv2", SSL_get_version(c_ssl)) == 0)
1373                                                 {
1374                                                 fprintf(stderr, "This can happen for SSL2 because "
1375                                                         "CLIENT-FINISHED and SERVER-VERIFY are written \n"
1376                                                         "concurrently ...");
1377                                                 if (strncmp("2SCF", SSL_state_string(c_ssl), 4) == 0
1378                                                         && strncmp("2SSV", SSL_state_string(s_ssl), 4) == 0)
1379                                                         {
1380                                                         fprintf(stderr, " ok.\n");
1381                                                         goto end;
1382                                                         }
1383                                                 }
1384                                         fprintf(stderr, " ERROR.\n");
1385                                         goto err;
1386                                         }
1387                         prev_progress = progress;
1388                         }
1389                 }
1390         while (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0);
1391
1392         if (verbose)
1393                 print_details(c_ssl, "DONE via BIO pair: ");
1394 end:
1395         ret = 0;
1396
1397  err:
1398         ERR_print_errors(bio_err);
1399
1400         if (server)
1401                 BIO_free(server);
1402         if (server_io)
1403                 BIO_free(server_io);
1404         if (client)
1405                 BIO_free(client);
1406         if (client_io)
1407                 BIO_free(client_io);
1408         if (s_ssl_bio)
1409                 BIO_free(s_ssl_bio);
1410         if (c_ssl_bio)
1411                 BIO_free(c_ssl_bio);
1412
1413         return ret;
1414         }
1415
1416
1417 #define W_READ  1
1418 #define W_WRITE 2
1419 #define C_DONE  1
1420 #define S_DONE  2
1421
1422 int doit(SSL *s_ssl, SSL *c_ssl, long count)
1423         {
1424         MS_STATIC char cbuf[1024*8],sbuf[1024*8];
1425         long cw_num=count,cr_num=count;
1426         long sw_num=count,sr_num=count;
1427         int ret=1;
1428         BIO *c_to_s=NULL;
1429         BIO *s_to_c=NULL;
1430         BIO *c_bio=NULL;
1431         BIO *s_bio=NULL;
1432         int c_r,c_w,s_r,s_w;
1433         int c_want,s_want;
1434         int i,j;
1435         int done=0;
1436         int c_write,s_write;
1437         int do_server=0,do_client=0;
1438
1439         memset(cbuf,0,sizeof(cbuf));
1440         memset(sbuf,0,sizeof(sbuf));
1441
1442         c_to_s=BIO_new(BIO_s_mem());
1443         s_to_c=BIO_new(BIO_s_mem());
1444         if ((s_to_c == NULL) || (c_to_s == NULL))
1445                 {
1446                 ERR_print_errors(bio_err);
1447                 goto err;
1448                 }
1449
1450         c_bio=BIO_new(BIO_f_ssl());
1451         s_bio=BIO_new(BIO_f_ssl());
1452         if ((c_bio == NULL) || (s_bio == NULL))
1453                 {
1454                 ERR_print_errors(bio_err);
1455                 goto err;
1456                 }
1457
1458         SSL_set_connect_state(c_ssl);
1459         SSL_set_bio(c_ssl,s_to_c,c_to_s);
1460         BIO_set_ssl(c_bio,c_ssl,BIO_NOCLOSE);
1461
1462         SSL_set_accept_state(s_ssl);
1463         SSL_set_bio(s_ssl,c_to_s,s_to_c);
1464         BIO_set_ssl(s_bio,s_ssl,BIO_NOCLOSE);
1465
1466         c_r=0; s_r=1;
1467         c_w=1; s_w=0;
1468         c_want=W_WRITE;
1469         s_want=0;
1470         c_write=1,s_write=0;
1471
1472         /* We can always do writes */
1473         for (;;)
1474                 {
1475                 do_server=0;
1476                 do_client=0;
1477
1478                 i=(int)BIO_pending(s_bio);
1479                 if ((i && s_r) || s_w) do_server=1;
1480
1481                 i=(int)BIO_pending(c_bio);
1482                 if ((i && c_r) || c_w) do_client=1;
1483
1484                 if (do_server && debug)
1485                         {
1486                         if (SSL_in_init(s_ssl))
1487                                 printf("server waiting in SSL_accept - %s\n",
1488                                         SSL_state_string_long(s_ssl));
1489 /*                      else if (s_write)
1490                                 printf("server:SSL_write()\n");
1491                         else
1492                                 printf("server:SSL_read()\n"); */
1493                         }
1494
1495                 if (do_client && debug)
1496                         {
1497                         if (SSL_in_init(c_ssl))
1498                                 printf("client waiting in SSL_connect - %s\n",
1499                                         SSL_state_string_long(c_ssl));
1500 /*                      else if (c_write)
1501                                 printf("client:SSL_write()\n");
1502                         else
1503                                 printf("client:SSL_read()\n"); */
1504                         }
1505
1506                 if (!do_client && !do_server)
1507                         {
1508                         fprintf(stdout,"ERROR IN STARTUP\n");
1509                         ERR_print_errors(bio_err);
1510                         break;
1511                         }
1512                 if (do_client && !(done & C_DONE))
1513                         {
1514                         if (c_write)
1515                                 {
1516                                 j = (cw_num > (long)sizeof(cbuf)) ?
1517                                         (int)sizeof(cbuf) : (int)cw_num;
1518                                 i=BIO_write(c_bio,cbuf,j);
1519                                 if (i < 0)
1520                                         {
1521                                         c_r=0;
1522                                         c_w=0;
1523                                         if (BIO_should_retry(c_bio))
1524                                                 {
1525                                                 if (BIO_should_read(c_bio))
1526                                                         c_r=1;
1527                                                 if (BIO_should_write(c_bio))
1528                                                         c_w=1;
1529                                                 }
1530                                         else
1531                                                 {
1532                                                 fprintf(stderr,"ERROR in CLIENT\n");
1533                                                 ERR_print_errors(bio_err);
1534                                                 goto err;
1535                                                 }
1536                                         }
1537                                 else if (i == 0)
1538                                         {
1539                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1540                                         goto err;
1541                                         }
1542                                 else
1543                                         {
1544                                         if (debug)
1545                                                 printf("client wrote %d\n",i);
1546                                         /* ok */
1547                                         s_r=1;
1548                                         c_write=0;
1549                                         cw_num-=i;
1550                                         }
1551                                 }
1552                         else
1553                                 {
1554                                 i=BIO_read(c_bio,cbuf,sizeof(cbuf));
1555                                 if (i < 0)
1556                                         {
1557                                         c_r=0;
1558                                         c_w=0;
1559                                         if (BIO_should_retry(c_bio))
1560                                                 {
1561                                                 if (BIO_should_read(c_bio))
1562                                                         c_r=1;
1563                                                 if (BIO_should_write(c_bio))
1564                                                         c_w=1;
1565                                                 }
1566                                         else
1567                                                 {
1568                                                 fprintf(stderr,"ERROR in CLIENT\n");
1569                                                 ERR_print_errors(bio_err);
1570                                                 goto err;
1571                                                 }
1572                                         }
1573                                 else if (i == 0)
1574                                         {
1575                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1576                                         goto err;
1577                                         }
1578                                 else
1579                                         {
1580                                         if (debug)
1581                                                 printf("client read %d\n",i);
1582                                         cr_num-=i;
1583                                         if (sw_num > 0)
1584                                                 {
1585                                                 s_write=1;
1586                                                 s_w=1;
1587                                                 }
1588                                         if (cr_num <= 0)
1589                                                 {
1590                                                 s_write=1;
1591                                                 s_w=1;
1592                                                 done=S_DONE|C_DONE;
1593                                                 }
1594                                         }
1595                                 }
1596                         }
1597
1598                 if (do_server && !(done & S_DONE))
1599                         {
1600                         if (!s_write)
1601                                 {
1602                                 i=BIO_read(s_bio,sbuf,sizeof(cbuf));
1603                                 if (i < 0)
1604                                         {
1605                                         s_r=0;
1606                                         s_w=0;
1607                                         if (BIO_should_retry(s_bio))
1608                                                 {
1609                                                 if (BIO_should_read(s_bio))
1610                                                         s_r=1;
1611                                                 if (BIO_should_write(s_bio))
1612                                                         s_w=1;
1613                                                 }
1614                                         else
1615                                                 {
1616                                                 fprintf(stderr,"ERROR in SERVER\n");
1617                                                 ERR_print_errors(bio_err);
1618                                                 goto err;
1619                                                 }
1620                                         }
1621                                 else if (i == 0)
1622                                         {
1623                                         ERR_print_errors(bio_err);
1624                                         fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_read\n");
1625                                         goto err;
1626                                         }
1627                                 else
1628                                         {
1629                                         if (debug)
1630                                                 printf("server read %d\n",i);
1631                                         sr_num-=i;
1632                                         if (cw_num > 0)
1633                                                 {
1634                                                 c_write=1;
1635                                                 c_w=1;
1636                                                 }
1637                                         if (sr_num <= 0)
1638                                                 {
1639                                                 s_write=1;
1640                                                 s_w=1;
1641                                                 c_write=0;
1642                                                 }
1643                                         }
1644                                 }
1645                         else
1646                                 {
1647                                 j = (sw_num > (long)sizeof(sbuf)) ?
1648                                         (int)sizeof(sbuf) : (int)sw_num;
1649                                 i=BIO_write(s_bio,sbuf,j);
1650                                 if (i < 0)
1651                                         {
1652                                         s_r=0;
1653                                         s_w=0;
1654                                         if (BIO_should_retry(s_bio))
1655                                                 {
1656                                                 if (BIO_should_read(s_bio))
1657                                                         s_r=1;
1658                                                 if (BIO_should_write(s_bio))
1659                                                         s_w=1;
1660                                                 }
1661                                         else
1662                                                 {
1663                                                 fprintf(stderr,"ERROR in SERVER\n");
1664                                                 ERR_print_errors(bio_err);
1665                                                 goto err;
1666                                                 }
1667                                         }
1668                                 else if (i == 0)
1669                                         {
1670                                         ERR_print_errors(bio_err);
1671                                         fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_write\n");
1672                                         goto err;
1673                                         }
1674                                 else
1675                                         {
1676                                         if (debug)
1677                                                 printf("server wrote %d\n",i);
1678                                         sw_num-=i;
1679                                         s_write=0;
1680                                         c_r=1;
1681                                         if (sw_num <= 0)
1682                                                 done|=S_DONE;
1683                                         }
1684                                 }
1685                         }
1686
1687                 if ((done & S_DONE) && (done & C_DONE)) break;
1688                 }
1689
1690         if (verbose)
1691                 print_details(c_ssl, "DONE: ");
1692         ret=0;
1693 err:
1694         /* We have to set the BIO's to NULL otherwise they will be
1695          * OPENSSL_free()ed twice.  Once when th s_ssl is SSL_free()ed and
1696          * again when c_ssl is SSL_free()ed.
1697          * This is a hack required because s_ssl and c_ssl are sharing the same
1698          * BIO structure and SSL_set_bio() and SSL_free() automatically
1699          * BIO_free non NULL entries.
1700          * You should not normally do this or be required to do this */
1701         if (s_ssl != NULL)
1702                 {
1703                 s_ssl->rbio=NULL;
1704                 s_ssl->wbio=NULL;
1705                 }
1706         if (c_ssl != NULL)
1707                 {
1708                 c_ssl->rbio=NULL;
1709                 c_ssl->wbio=NULL;
1710                 }
1711
1712         if (c_to_s != NULL) BIO_free(c_to_s);
1713         if (s_to_c != NULL) BIO_free(s_to_c);
1714         if (c_bio != NULL) BIO_free_all(c_bio);
1715         if (s_bio != NULL) BIO_free_all(s_bio);
1716         return(ret);
1717         }
1718
1719 static int get_proxy_auth_ex_data_idx(void)
1720         {
1721         static volatile int idx = -1;
1722         if (idx < 0)
1723                 {
1724                 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
1725                 if (idx < 0)
1726                         {
1727                         idx = X509_STORE_CTX_get_ex_new_index(0,
1728                                 "SSLtest for verify callback", NULL,NULL,NULL);
1729                         }
1730                 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
1731                 }
1732         return idx;
1733         }
1734
1735 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
1736         {
1737         char *s,buf[256];
1738
1739         s=X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),buf,
1740                             sizeof buf);
1741         if (s != NULL)
1742                 {
1743                 if (ok)
1744                         fprintf(stderr,"depth=%d %s\n",
1745                                 ctx->error_depth,buf);
1746                 else
1747                         {
1748                         fprintf(stderr,"depth=%d error=%d %s\n",
1749                                 ctx->error_depth,ctx->error,buf);
1750                         }
1751                 }
1752
1753         if (ok == 0)
1754                 {
1755                 fprintf(stderr,"Error string: %s\n",
1756                         X509_verify_cert_error_string(ctx->error));
1757                 switch (ctx->error)
1758                         {
1759                 case X509_V_ERR_CERT_NOT_YET_VALID:
1760                 case X509_V_ERR_CERT_HAS_EXPIRED:
1761                 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
1762                         fprintf(stderr,"  ... ignored.\n");
1763                         ok=1;
1764                         }
1765                 }
1766
1767         if (ok == 1)
1768                 {
1769                 X509 *xs = ctx->current_cert;
1770 #if 0
1771                 X509 *xi = ctx->current_issuer;
1772 #endif
1773
1774                 if (xs->ex_flags & EXFLAG_PROXY)
1775                         {
1776                         unsigned int *letters =
1777                                 X509_STORE_CTX_get_ex_data(ctx,
1778                                         get_proxy_auth_ex_data_idx());
1779
1780                         if (letters)
1781                                 {
1782                                 int found_any = 0;
1783                                 int i;
1784                                 PROXY_CERT_INFO_EXTENSION *pci =
1785                                         X509_get_ext_d2i(xs, NID_proxyCertInfo,
1786                                                 NULL, NULL);
1787
1788                                 switch (OBJ_obj2nid(pci->proxyPolicy->policyLanguage))
1789                                         {
1790                                 case NID_Independent:
1791                                         /* Completely meaningless in this
1792                                            program, as there's no way to
1793                                            grant explicit rights to a
1794                                            specific PrC.  Basically, using
1795                                            id-ppl-Independent is the perfect
1796                                            way to grant no rights at all. */
1797                                         fprintf(stderr, "  Independent proxy certificate");
1798                                         for (i = 0; i < 26; i++)
1799                                                 letters[i] = 0;
1800                                         break;
1801                                 case NID_id_ppl_inheritAll:
1802                                         /* This is basically a NOP, we
1803                                            simply let the current rights
1804                                            stand as they are. */
1805                                         fprintf(stderr, "  Proxy certificate inherits all");
1806                                         break;
1807                                 default:
1808                                         s = (char *)
1809                                                 pci->proxyPolicy->policy->data;
1810                                         i = pci->proxyPolicy->policy->length;
1811
1812                                         /* The algorithm works as follows:
1813                                            it is assumed that previous
1814                                            iterations or the initial granted
1815                                            rights has already set some elements
1816                                            of `letters'.  What we need to do is
1817                                            to clear those that weren't granted
1818                                            by the current PrC as well.  The
1819                                            easiest way to do this is to add 1
1820                                            to all the elements whose letters
1821                                            are given with the current policy.
1822                                            That way, all elements that are set
1823                                            by the current policy and were
1824                                            already set by earlier policies and
1825                                            through the original grant of rights
1826                                            will get the value 2 or higher.
1827                                            The last thing to do is to sweep
1828                                            through `letters' and keep the
1829                                            elements having the value 2 as set,
1830                                            and clear all the others. */
1831
1832                                         fprintf(stderr, "  Certificate proxy rights = %*.*s", i, i, s);
1833                                         while(i-- > 0)
1834                                                 {
1835                                                 int c = *s++;
1836                                                 if (isascii(c) && isalpha(c))
1837                                                         {
1838                                                         if (islower(c))
1839                                                                 c = toupper(c);
1840                                                         letters[c - 'A']++;
1841                                                         }
1842                                                 }
1843                                         for (i = 0; i < 26; i++)
1844                                                 if (letters[i] < 2)
1845                                                         letters[i] = 0;
1846                                                 else
1847                                                         letters[i] = 1;
1848                                         }
1849
1850                                 found_any = 0;
1851                                 fprintf(stderr,
1852                                         ", resulting proxy rights = ");
1853                                 for(i = 0; i < 26; i++)
1854                                         if (letters[i])
1855                                                 {
1856                                                 fprintf(stderr, "%c", i + 'A');
1857                                                 found_any = 1;
1858                                                 }
1859                                 if (!found_any)
1860                                         fprintf(stderr, "none");
1861                                 fprintf(stderr, "\n");
1862
1863                                 PROXY_CERT_INFO_EXTENSION_free(pci);
1864                                 }
1865                         }
1866                 }
1867
1868         return(ok);
1869         }
1870
1871 static void process_proxy_debug(int indent, const char *format, ...)
1872         {
1873         static const char indentation[] =
1874                 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"
1875                 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"; /* That's 80 > */
1876         char my_format[256];
1877         va_list args;
1878
1879         BIO_snprintf(my_format, sizeof(my_format), "%*.*s %s",
1880                 indent, indent, indentation, format);
1881
1882         va_start(args, format);
1883         vfprintf(stderr, my_format, args);
1884         va_end(args);
1885         }
1886 /* Priority levels:
1887    0    [!]var, ()
1888    1    & ^
1889    2    |
1890 */
1891 static int process_proxy_cond_adders(unsigned int letters[26],
1892         const char *cond, const char **cond_end, int *pos, int indent);
1893 static int process_proxy_cond_val(unsigned int letters[26],
1894         const char *cond, const char **cond_end, int *pos, int indent)
1895         {
1896         int c;
1897         int ok = 1;
1898         int negate = 0;
1899
1900         while(isspace((int)*cond))
1901                 {
1902                 cond++; (*pos)++;
1903                 }
1904         c = *cond;
1905
1906         if (debug)
1907                 process_proxy_debug(indent,
1908                         "Start process_proxy_cond_val at position %d: %s\n",
1909                         *pos, cond);
1910
1911         while(c == '!')
1912                 {
1913                 negate = !negate;
1914                 cond++; (*pos)++;
1915                 while(isspace((int)*cond))
1916                         {
1917                         cond++; (*pos)++;
1918                         }
1919                 c = *cond;
1920                 }
1921
1922         if (c == '(')
1923                 {
1924                 cond++; (*pos)++;
1925                 ok = process_proxy_cond_adders(letters, cond, cond_end, pos,
1926                         indent + 1);
1927                 cond = *cond_end;
1928                 if (ok < 0)
1929                         goto end;
1930                 while(isspace((int)*cond))
1931                         {
1932                         cond++; (*pos)++;
1933                         }
1934                 c = *cond;
1935                 if (c != ')')
1936                         {
1937                         fprintf(stderr,
1938                                 "Weird condition character in position %d: "
1939                                 "%c\n", *pos, c);
1940                         ok = -1;
1941                         goto end;
1942                         }
1943                 cond++; (*pos)++;
1944                 }
1945         else if (isascii(c) && isalpha(c))
1946                 {
1947                 if (islower(c))
1948                         c = toupper(c);
1949                 ok = letters[c - 'A'];
1950                 cond++; (*pos)++;
1951                 }
1952         else
1953                 {
1954                 fprintf(stderr,
1955                         "Weird condition character in position %d: "
1956                         "%c\n", *pos, c);
1957                 ok = -1;
1958                 goto end;
1959                 }
1960  end:
1961         *cond_end = cond;
1962         if (ok >= 0 && negate)
1963                 ok = !ok;
1964
1965         if (debug)
1966                 process_proxy_debug(indent,
1967                         "End process_proxy_cond_val at position %d: %s, returning %d\n",
1968                         *pos, cond, ok);
1969
1970         return ok;
1971         }
1972 static int process_proxy_cond_multipliers(unsigned int letters[26],
1973         const char *cond, const char **cond_end, int *pos, int indent)
1974         {
1975         int ok;
1976         char c;
1977
1978         if (debug)
1979                 process_proxy_debug(indent,
1980                         "Start process_proxy_cond_multipliers at position %d: %s\n",
1981                         *pos, cond);
1982
1983         ok = process_proxy_cond_val(letters, cond, cond_end, pos, indent + 1);
1984         cond = *cond_end;
1985         if (ok < 0)
1986                 goto end;
1987
1988         while(ok >= 0)
1989                 {
1990                 while(isspace((int)*cond))
1991                         {
1992                         cond++; (*pos)++;
1993                         }
1994                 c = *cond;
1995
1996                 switch(c)
1997                         {
1998                 case '&':
1999                 case '^':
2000                         {
2001                         int save_ok = ok;
2002
2003                         cond++; (*pos)++;
2004                         ok = process_proxy_cond_val(letters,
2005                                 cond, cond_end, pos, indent + 1);
2006                         cond = *cond_end;
2007                         if (ok < 0)
2008                                 break;
2009
2010                         switch(c)
2011                                 {
2012                         case '&':
2013                                 ok &= save_ok;
2014                                 break;
2015                         case '^':
2016                                 ok ^= save_ok;
2017                                 break;
2018                         default:
2019                                 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
2020                                         " STOPPING\n");
2021                                 EXIT(1);
2022                                 }
2023                         }
2024                         break;
2025                 default:
2026                         goto end;
2027                         }
2028                 }
2029  end:
2030         if (debug)
2031                 process_proxy_debug(indent,
2032                         "End process_proxy_cond_multipliers at position %d: %s, returning %d\n",
2033                         *pos, cond, ok);
2034
2035         *cond_end = cond;
2036         return ok;
2037         }
2038 static int process_proxy_cond_adders(unsigned int letters[26],
2039         const char *cond, const char **cond_end, int *pos, int indent)
2040         {
2041         int ok;
2042         char c;
2043
2044         if (debug)
2045                 process_proxy_debug(indent,
2046                         "Start process_proxy_cond_adders at position %d: %s\n",
2047                         *pos, cond);
2048
2049         ok = process_proxy_cond_multipliers(letters, cond, cond_end, pos,
2050                 indent + 1);
2051         cond = *cond_end;
2052         if (ok < 0)
2053                 goto end;
2054
2055         while(ok >= 0)
2056                 {
2057                 while(isspace((int)*cond))
2058                         {
2059                         cond++; (*pos)++;
2060                         }
2061                 c = *cond;
2062
2063                 switch(c)
2064                         {
2065                 case '|':
2066                         {
2067                         int save_ok = ok;
2068
2069                         cond++; (*pos)++;
2070                         ok = process_proxy_cond_multipliers(letters,
2071                                 cond, cond_end, pos, indent + 1);
2072                         cond = *cond_end;
2073                         if (ok < 0)
2074                                 break;
2075
2076                         switch(c)
2077                                 {
2078                         case '|':
2079                                 ok |= save_ok;
2080                                 break;
2081                         default:
2082                                 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
2083                                         " STOPPING\n");
2084                                 EXIT(1);
2085                                 }
2086                         }
2087                         break;
2088                 default:
2089                         goto end;
2090                         }
2091                 }
2092  end:
2093         if (debug)
2094                 process_proxy_debug(indent,
2095                         "End process_proxy_cond_adders at position %d: %s, returning %d\n",
2096                         *pos, cond, ok);
2097
2098         *cond_end = cond;
2099         return ok;
2100         }
2101
2102 static int process_proxy_cond(unsigned int letters[26],
2103         const char *cond, const char **cond_end)
2104         {
2105         int pos = 1;
2106         return process_proxy_cond_adders(letters, cond, cond_end, &pos, 1);
2107         }
2108
2109 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg)
2110         {
2111         int ok=1;
2112         struct app_verify_arg *cb_arg = arg;
2113         unsigned int letters[26]; /* only used with proxy_auth */
2114
2115         if (cb_arg->app_verify)
2116                 {
2117                 char *s = NULL,buf[256];
2118
2119                 fprintf(stderr, "In app_verify_callback, allowing cert. ");
2120                 fprintf(stderr, "Arg is: %s\n", cb_arg->string);
2121                 fprintf(stderr, "Finished printing do we have a context? 0x%p a cert? 0x%p\n",
2122                         (void *)ctx, (void *)ctx->cert);
2123                 if (ctx->cert)
2124                         s=X509_NAME_oneline(X509_get_subject_name(ctx->cert),buf,256);
2125                 if (s != NULL)
2126                         {
2127                         fprintf(stderr,"cert depth=%d %s\n",ctx->error_depth,buf);
2128                         }
2129                 return(1);
2130                 }
2131         if (cb_arg->proxy_auth)
2132                 {
2133                 int found_any = 0, i;
2134                 char *sp;
2135
2136                 for(i = 0; i < 26; i++)
2137                         letters[i] = 0;
2138                 for(sp = cb_arg->proxy_auth; *sp; sp++)
2139                         {
2140                         int c = *sp;
2141                         if (isascii(c) && isalpha(c))
2142                                 {
2143                                 if (islower(c))
2144                                         c = toupper(c);
2145                                 letters[c - 'A'] = 1;
2146                                 }
2147                         }
2148
2149                 fprintf(stderr,
2150                         "  Initial proxy rights = ");
2151                 for(i = 0; i < 26; i++)
2152                         if (letters[i])
2153                                 {
2154                                 fprintf(stderr, "%c", i + 'A');
2155                                 found_any = 1;
2156                                 }
2157                 if (!found_any)
2158                         fprintf(stderr, "none");
2159                 fprintf(stderr, "\n");
2160
2161                 X509_STORE_CTX_set_ex_data(ctx,
2162                         get_proxy_auth_ex_data_idx(),letters);
2163                 }
2164         if (cb_arg->allow_proxy_certs)
2165                 {
2166                 X509_STORE_CTX_set_flags(ctx, X509_V_FLAG_ALLOW_PROXY_CERTS);
2167                 }
2168
2169 #ifndef OPENSSL_NO_X509_VERIFY
2170 # ifdef OPENSSL_FIPS
2171         if(s->version == TLS1_VERSION)
2172                 FIPS_allow_md5(1);
2173 # endif
2174         ok = X509_verify_cert(ctx);
2175 # ifdef OPENSSL_FIPS
2176         if(s->version == TLS1_VERSION)
2177                 FIPS_allow_md5(0);
2178 # endif
2179 #endif
2180
2181         if (cb_arg->proxy_auth)
2182                 {
2183                 if (ok > 0)
2184                         {
2185                         const char *cond_end = NULL;
2186
2187                         ok = process_proxy_cond(letters,
2188                                 cb_arg->proxy_cond, &cond_end);
2189
2190                         if (ok < 0)
2191                                 EXIT(3);
2192                         if (*cond_end)
2193                                 {
2194                                 fprintf(stderr, "Stopped processing condition before it's end.\n");
2195                                 ok = 0;
2196                                 }
2197                         if (!ok)
2198                                 fprintf(stderr, "Proxy rights check with condition '%s' proved invalid\n",
2199                                         cb_arg->proxy_cond);
2200                         else
2201                                 fprintf(stderr, "Proxy rights check with condition '%s' proved valid\n",
2202                                         cb_arg->proxy_cond);
2203                         }
2204                 }
2205         return(ok);
2206         }
2207
2208 #ifndef OPENSSL_NO_RSA
2209 static RSA *rsa_tmp=NULL;
2210
2211 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength)
2212         {
2213         BIGNUM *bn = NULL;
2214         if (rsa_tmp == NULL)
2215                 {
2216                 bn = BN_new();
2217                 rsa_tmp = RSA_new();
2218                 if(!bn || !rsa_tmp || !BN_set_word(bn, RSA_F4))
2219                         {
2220                         BIO_printf(bio_err, "Memory error...");
2221                         goto end;
2222                         }
2223                 BIO_printf(bio_err,"Generating temp (%d bit) RSA key...",keylength);
2224                 (void)BIO_flush(bio_err);
2225                 if(!RSA_generate_key_ex(rsa_tmp,keylength,bn,NULL))
2226                         {
2227                         BIO_printf(bio_err, "Error generating key.");
2228                         RSA_free(rsa_tmp);
2229                         rsa_tmp = NULL;
2230                         }
2231 end:
2232                 BIO_printf(bio_err,"\n");
2233                 (void)BIO_flush(bio_err);
2234                 }
2235         if(bn) BN_free(bn);
2236         return(rsa_tmp);
2237         }
2238
2239 static void free_tmp_rsa(void)
2240         {
2241         if (rsa_tmp != NULL)
2242                 {
2243                 RSA_free(rsa_tmp);
2244                 rsa_tmp = NULL;
2245                 }
2246         }
2247 #endif
2248
2249 #ifndef OPENSSL_NO_DH
2250 /* These DH parameters have been generated as follows:
2251  *    $ openssl dhparam -C -noout 512
2252  *    $ openssl dhparam -C -noout 1024
2253  *    $ openssl dhparam -C -noout -dsaparam 1024
2254  * (The third function has been renamed to avoid name conflicts.)
2255  */
2256 static DH *get_dh512()
2257         {
2258         static unsigned char dh512_p[]={
2259                 0xCB,0xC8,0xE1,0x86,0xD0,0x1F,0x94,0x17,0xA6,0x99,0xF0,0xC6,
2260                 0x1F,0x0D,0xAC,0xB6,0x25,0x3E,0x06,0x39,0xCA,0x72,0x04,0xB0,
2261                 0x6E,0xDA,0xC0,0x61,0xE6,0x7A,0x77,0x25,0xE8,0x3B,0xB9,0x5F,
2262                 0x9A,0xB6,0xB5,0xFE,0x99,0x0B,0xA1,0x93,0x4E,0x35,0x33,0xB8,
2263                 0xE1,0xF1,0x13,0x4F,0x59,0x1A,0xD2,0x57,0xC0,0x26,0x21,0x33,
2264                 0x02,0xC5,0xAE,0x23,
2265                 };
2266         static unsigned char dh512_g[]={
2267                 0x02,
2268                 };
2269         DH *dh;
2270
2271         if ((dh=DH_new()) == NULL) return(NULL);
2272         dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
2273         dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
2274         if ((dh->p == NULL) || (dh->g == NULL))
2275                 { DH_free(dh); return(NULL); }
2276         return(dh);
2277         }
2278
2279 static DH *get_dh1024()
2280         {
2281         static unsigned char dh1024_p[]={
2282                 0xF8,0x81,0x89,0x7D,0x14,0x24,0xC5,0xD1,0xE6,0xF7,0xBF,0x3A,
2283                 0xE4,0x90,0xF4,0xFC,0x73,0xFB,0x34,0xB5,0xFA,0x4C,0x56,0xA2,
2284                 0xEA,0xA7,0xE9,0xC0,0xC0,0xCE,0x89,0xE1,0xFA,0x63,0x3F,0xB0,
2285                 0x6B,0x32,0x66,0xF1,0xD1,0x7B,0xB0,0x00,0x8F,0xCA,0x87,0xC2,
2286                 0xAE,0x98,0x89,0x26,0x17,0xC2,0x05,0xD2,0xEC,0x08,0xD0,0x8C,
2287                 0xFF,0x17,0x52,0x8C,0xC5,0x07,0x93,0x03,0xB1,0xF6,0x2F,0xB8,
2288                 0x1C,0x52,0x47,0x27,0x1B,0xDB,0xD1,0x8D,0x9D,0x69,0x1D,0x52,
2289                 0x4B,0x32,0x81,0xAA,0x7F,0x00,0xC8,0xDC,0xE6,0xD9,0xCC,0xC1,
2290                 0x11,0x2D,0x37,0x34,0x6C,0xEA,0x02,0x97,0x4B,0x0E,0xBB,0xB1,
2291                 0x71,0x33,0x09,0x15,0xFD,0xDD,0x23,0x87,0x07,0x5E,0x89,0xAB,
2292                 0x6B,0x7C,0x5F,0xEC,0xA6,0x24,0xDC,0x53,
2293                 };
2294         static unsigned char dh1024_g[]={
2295                 0x02,
2296                 };
2297         DH *dh;
2298
2299         if ((dh=DH_new()) == NULL) return(NULL);
2300         dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2301         dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2302         if ((dh->p == NULL) || (dh->g == NULL))
2303                 { DH_free(dh); return(NULL); }
2304         return(dh);
2305         }
2306
2307 static DH *get_dh1024dsa()
2308         {
2309         static unsigned char dh1024_p[]={
2310                 0xC8,0x00,0xF7,0x08,0x07,0x89,0x4D,0x90,0x53,0xF3,0xD5,0x00,
2311                 0x21,0x1B,0xF7,0x31,0xA6,0xA2,0xDA,0x23,0x9A,0xC7,0x87,0x19,
2312                 0x3B,0x47,0xB6,0x8C,0x04,0x6F,0xFF,0xC6,0x9B,0xB8,0x65,0xD2,
2313                 0xC2,0x5F,0x31,0x83,0x4A,0xA7,0x5F,0x2F,0x88,0x38,0xB6,0x55,
2314                 0xCF,0xD9,0x87,0x6D,0x6F,0x9F,0xDA,0xAC,0xA6,0x48,0xAF,0xFC,
2315                 0x33,0x84,0x37,0x5B,0x82,0x4A,0x31,0x5D,0xE7,0xBD,0x52,0x97,
2316                 0xA1,0x77,0xBF,0x10,0x9E,0x37,0xEA,0x64,0xFA,0xCA,0x28,0x8D,
2317                 0x9D,0x3B,0xD2,0x6E,0x09,0x5C,0x68,0xC7,0x45,0x90,0xFD,0xBB,
2318                 0x70,0xC9,0x3A,0xBB,0xDF,0xD4,0x21,0x0F,0xC4,0x6A,0x3C,0xF6,
2319                 0x61,0xCF,0x3F,0xD6,0x13,0xF1,0x5F,0xBC,0xCF,0xBC,0x26,0x9E,
2320                 0xBC,0x0B,0xBD,0xAB,0x5D,0xC9,0x54,0x39,
2321                 };
2322         static unsigned char dh1024_g[]={
2323                 0x3B,0x40,0x86,0xE7,0xF3,0x6C,0xDE,0x67,0x1C,0xCC,0x80,0x05,
2324                 0x5A,0xDF,0xFE,0xBD,0x20,0x27,0x74,0x6C,0x24,0xC9,0x03,0xF3,
2325                 0xE1,0x8D,0xC3,0x7D,0x98,0x27,0x40,0x08,0xB8,0x8C,0x6A,0xE9,
2326                 0xBB,0x1A,0x3A,0xD6,0x86,0x83,0x5E,0x72,0x41,0xCE,0x85,0x3C,
2327                 0xD2,0xB3,0xFC,0x13,0xCE,0x37,0x81,0x9E,0x4C,0x1C,0x7B,0x65,
2328                 0xD3,0xE6,0xA6,0x00,0xF5,0x5A,0x95,0x43,0x5E,0x81,0xCF,0x60,
2329                 0xA2,0x23,0xFC,0x36,0xA7,0x5D,0x7A,0x4C,0x06,0x91,0x6E,0xF6,
2330                 0x57,0xEE,0x36,0xCB,0x06,0xEA,0xF5,0x3D,0x95,0x49,0xCB,0xA7,
2331                 0xDD,0x81,0xDF,0x80,0x09,0x4A,0x97,0x4D,0xA8,0x22,0x72,0xA1,
2332                 0x7F,0xC4,0x70,0x56,0x70,0xE8,0x20,0x10,0x18,0x8F,0x2E,0x60,
2333                 0x07,0xE7,0x68,0x1A,0x82,0x5D,0x32,0xA2,
2334                 };
2335         DH *dh;
2336
2337         if ((dh=DH_new()) == NULL) return(NULL);
2338         dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2339         dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2340         if ((dh->p == NULL) || (dh->g == NULL))
2341                 { DH_free(dh); return(NULL); }
2342         dh->length = 160;
2343         return(dh);
2344         }
2345 #endif
2346
2347 #ifndef OPENSSL_NO_PSK
2348 /* convert the PSK key (psk_key) in ascii to binary (psk) */
2349 static int psk_key2bn(const char *pskkey, unsigned char *psk,
2350         unsigned int max_psk_len)
2351         {
2352         int ret;
2353         BIGNUM *bn = NULL;
2354
2355         ret = BN_hex2bn(&bn, pskkey);
2356         if (!ret)
2357                 {
2358                 BIO_printf(bio_err,"Could not convert PSK key '%s' to BIGNUM\n", pskkey);
2359                 if (bn)
2360                         BN_free(bn);
2361                 return 0;
2362                 }
2363         if (BN_num_bytes(bn) > (int)max_psk_len)
2364                 {
2365                 BIO_printf(bio_err,"psk buffer of callback is too small (%d) for key (%d)\n",
2366                         max_psk_len, BN_num_bytes(bn));
2367                 BN_free(bn);
2368                 return 0;
2369                 }
2370         ret = BN_bn2bin(bn, psk);
2371         BN_free(bn);
2372         return ret;
2373         }
2374
2375 static unsigned int psk_client_callback(SSL *ssl, const char *hint, char *identity,
2376         unsigned int max_identity_len, unsigned char *psk,
2377         unsigned int max_psk_len)
2378         {
2379         int ret;
2380         unsigned int psk_len = 0;
2381
2382         ret = BIO_snprintf(identity, max_identity_len, "Client_identity");
2383         if (ret < 0)
2384                 goto out_err;
2385         if (debug)
2386                 fprintf(stderr, "client: created identity '%s' len=%d\n", identity, ret);
2387         ret = psk_key2bn(psk_key, psk, max_psk_len);
2388         if (ret < 0)
2389                 goto out_err;
2390         psk_len = ret;
2391 out_err:
2392         return psk_len;
2393         }
2394
2395 static unsigned int psk_server_callback(SSL *ssl, const char *identity,
2396         unsigned char *psk, unsigned int max_psk_len)
2397         {
2398         unsigned int psk_len=0;
2399
2400         if (strcmp(identity, "Client_identity") != 0)
2401                 {
2402                 BIO_printf(bio_err, "server: PSK error: client identity not found\n");
2403                 return 0;
2404                 }
2405         psk_len=psk_key2bn(psk_key, psk, max_psk_len);
2406         return psk_len;
2407         }
2408 #endif
2409
2410 static int do_test_cipherlist(void)
2411         {
2412         int i = 0;
2413         const SSL_METHOD *meth;
2414         const SSL_CIPHER *ci, *tci = NULL;
2415
2416 #ifndef OPENSSL_NO_SSL2
2417         fprintf(stderr, "testing SSLv2 cipher list order: ");
2418         meth = SSLv2_method();
2419         while ((ci = meth->get_cipher(i++)) != NULL)
2420                 {
2421                 if (tci != NULL)
2422                         if (ci->id >= tci->id)
2423                                 {
2424                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2425                                 return 0;
2426                                 }
2427                 tci = ci;
2428                 }
2429         fprintf(stderr, "ok\n");
2430 #endif
2431 #ifndef OPENSSL_NO_SSL3
2432         fprintf(stderr, "testing SSLv3 cipher list order: ");
2433         meth = SSLv3_method();
2434         tci = NULL;
2435         while ((ci = meth->get_cipher(i++)) != NULL)
2436                 {
2437                 if (tci != NULL)
2438                         if (ci->id >= tci->id)
2439                                 {
2440                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2441                                 return 0;
2442                                 }
2443                 tci = ci;
2444                 }
2445         fprintf(stderr, "ok\n");
2446 #endif
2447 #ifndef OPENSSL_NO_TLS1
2448         fprintf(stderr, "testing TLSv1 cipher list order: ");
2449         meth = TLSv1_method();
2450         tci = NULL;
2451         while ((ci = meth->get_cipher(i++)) != NULL)
2452                 {
2453                 if (tci != NULL)
2454                         if (ci->id >= tci->id)
2455                                 {
2456                                 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2457                                 return 0;
2458                                 }
2459                 tci = ci;
2460                 }
2461         fprintf(stderr, "ok\n");
2462 #endif
2463
2464         return 1;
2465         }