make depend
[openssl.git] / apps / s_server.c
index 45eea96..329f6c7 100644 (file)
@@ -207,6 +207,7 @@ static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength);
 static int not_resumable_sess_cb(SSL *s, int is_forward_secure);
 static int sv_body(char *hostname, int s, unsigned char *context);
 static int www_body(char *hostname, int s, unsigned char *context);
+static int rev_body(char *hostname, int s, unsigned char *context);
 static void close_accept_socket(void );
 static void sv_usage(void);
 static int init_ssl_connection(SSL *s);
@@ -268,17 +269,13 @@ static int accept_socket= -1;
 #undef PROG
 #define PROG           s_server_main
 
-extern int verify_depth, verify_return_error;
+extern int verify_depth, verify_return_error, verify_quiet;
 
-static char *cipher=NULL;
 static int s_server_verify=SSL_VERIFY_NONE;
 static int s_server_session_id_context = 1; /* anything will do */
 static const char *s_cert_file=TEST_CERT,*s_key_file=NULL, *s_chain_file=NULL;
 #ifndef OPENSSL_NO_TLSEXT
 static const char *s_cert_file2=TEST_CERT2,*s_key_file2=NULL;
-static char *curves=NULL;
-static char *sigalgs=NULL;
-static char *client_sigalgs=NULL;
 #endif
 static char *s_dcert_file=NULL,*s_dkey_file=NULL, *s_dchain_file=NULL;
 #ifdef FIONBIO
@@ -303,6 +300,7 @@ static int cert_status_cb(SSL *s, void *arg);
 static int no_resume_ephemeral = 0;
 static int s_msg=0;
 static int s_quiet=0;
+static int s_brief=0;
 
 static char *keymatexportlabel=NULL;
 static int keymatexportlen=20;
@@ -441,7 +439,6 @@ static int MS_CALLBACK ssl_srp_server_param_cb(SSL *s, int *ad, void *arg)
 static void s_server_init(void)
        {
        accept_socket=-1;
-       cipher=NULL;
        s_server_verify=SSL_VERIFY_NONE;
        s_dcert_file=NULL;
        s_dkey_file=NULL;
@@ -450,7 +447,6 @@ static void s_server_init(void)
        s_key_file=NULL;
        s_chain_file=NULL;
 #ifndef OPENSSL_NO_TLSEXT
-       curves=NULL;
        s_cert_file2=TEST_CERT2;
        s_key_file2=NULL;
        ctx2=NULL;
@@ -466,6 +462,7 @@ static void s_server_init(void)
        s_debug=0;
        s_msg=0;
        s_quiet=0;
+       s_brief=0;
        hack=0;
 #ifndef OPENSSL_NO_ENGINE
        engine_id=NULL;
@@ -948,6 +945,9 @@ static char *jpake_secret = NULL;
        static srpsrvparm srp_callback_parm;
 #endif
 static char *srtp_profiles = NULL;
+static unsigned char *checkhost = NULL, *checkemail = NULL;
+static char *checkip = NULL;
+
 
 int MAIN(int argc, char *argv[])
        {
@@ -962,10 +962,8 @@ int MAIN(int argc, char *argv[])
 #ifndef OPENSSL_NO_ECDH
        char *named_curve = NULL;
 #endif
-       int badop=0,bugs=0;
+       int badop=0;
        int ret=1;
-       int off=0;
-       unsigned int cert_flags = 0;
        int build_chain = 0;
        int no_tmp_rsa=0,no_dhe=0,no_ecdhe=0,nocert=0;
        int state=0;
@@ -981,6 +979,7 @@ int MAIN(int argc, char *argv[])
        STACK_OF(X509) *s_chain = NULL, *s_dchain = NULL;
        EVP_PKEY *s_key = NULL, *s_dkey = NULL;
        int no_cache = 0, ext_cache = 0;
+       int rev = 0, naccept = -1;
 #ifndef OPENSSL_NO_TLSEXT
        EVP_PKEY *s_key2 = NULL;
        X509 *s_cert2 = NULL;
@@ -999,6 +998,9 @@ int MAIN(int argc, char *argv[])
        char *srp_verifier_file = NULL;
 #endif
        SSL_EXCERT *exc = NULL;
+       SSL_CONF_CTX *cctx = NULL;
+       STACK_OF(OPENSSL_STRING) *ssl_args = NULL;
+
        meth=SSLv23_server_method();
 
        local_argc=argc;
@@ -1015,6 +1017,11 @@ int MAIN(int argc, char *argv[])
        if (!load_config(bio_err, NULL))
                goto end;
 
+       cctx = SSL_CONF_CTX_new();
+       if (!cctx)
+               goto end;
+       SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_SERVER);
+
        verify_depth=0;
 #ifdef FIONBIO
        s_nbio=0;
@@ -1033,6 +1040,17 @@ int MAIN(int argc, char *argv[])
                        if (!extract_port(*(++argv),&port))
                                goto bad;
                        }
+               else if (strcmp(*argv,"-naccept") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       naccept = atol(*(++argv));
+                       if (naccept <= 0)
+                               {
+                               BIO_printf(bio_err, "bad accept value %s\n",
+                                                       *argv);
+                               goto bad;
+                               }
+                       }
                else if (strcmp(*argv,"-verify") == 0)
                        {
                        s_server_verify=SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE;
@@ -1095,13 +1113,6 @@ int MAIN(int argc, char *argv[])
                        if (--argc < 1) goto bad;
                        dhfile = *(++argv);
                        }
-#ifndef OPENSSL_NO_ECDH                
-               else if (strcmp(*argv,"-named_curve") == 0)
-                       {
-                       if (--argc < 1) goto bad;
-                       named_curve = *(++argv);
-                       }
-#endif
                else if (strcmp(*argv,"-dcertform") == 0)
                        {
                        if (--argc < 1) goto bad;
@@ -1167,17 +1178,16 @@ int MAIN(int argc, char *argv[])
                                goto bad;
                        continue;
                        }
-               else if (strcmp(*argv,"-verify_return_error") == 0)
-                       verify_return_error = 1;
-               else if (strcmp(*argv,"-serverpref") == 0)
-                       { off|=SSL_OP_CIPHER_SERVER_PREFERENCE; }
-               else if (strcmp(*argv,"-legacy_renegotiation") == 0)
-                       off|=SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;
-               else if (strcmp(*argv,"-cipher") == 0)
+               else if (args_ssl(&argv, &argc, cctx, &badarg, bio_err, &ssl_args))
                        {
-                       if (--argc < 1) goto bad;
-                       cipher= *(++argv);
+                       if (badarg)
+                               goto bad;
+                       continue;
                        }
+               else if (strcmp(*argv,"-verify_return_error") == 0)
+                       verify_return_error = 1;
+               else if (strcmp(*argv,"-verify_quiet") == 0)
+                       verify_quiet = 1;
                else if (strcmp(*argv,"-build_chain") == 0)
                        build_chain = 1;
                else if (strcmp(*argv,"-CAfile") == 0)
@@ -1238,22 +1248,22 @@ int MAIN(int argc, char *argv[])
                                goto bad;
                                }
                        }
-               else if (strcmp(*argv,"-curves") == 0)
+#endif
+               else if (strcmp(*argv,"-checkhost") == 0)
                        {
                        if (--argc < 1) goto bad;
-                       curves= *(++argv);
+                       checkhost=(unsigned char *)*(++argv);
                        }
-               else if (strcmp(*argv,"-sigalgs") == 0)
+               else if (strcmp(*argv,"-checkemail") == 0)
                        {
                        if (--argc < 1) goto bad;
-                       sigalgs= *(++argv);
+                       checkemail=(unsigned char *)*(++argv);
                        }
-               else if (strcmp(*argv,"-client_sigalgs") == 0)
+               else if (strcmp(*argv,"-checkip") == 0)
                        {
                        if (--argc < 1) goto bad;
-                       client_sigalgs= *(++argv);
+                       checkip=*(++argv);
                        }
-#endif
                else if (strcmp(*argv,"-msg") == 0)
                        { s_msg=1; }
                else if (strcmp(*argv,"-msgfile") == 0)
@@ -1273,8 +1283,12 @@ int MAIN(int argc, char *argv[])
                        { s_crlf=1; }
                else if (strcmp(*argv,"-quiet") == 0)
                        { s_quiet=1; }
-               else if (strcmp(*argv,"-bugs") == 0)
-                       { bugs=1; }
+               else if (strcmp(*argv,"-brief") == 0)
+                       {
+                       s_quiet=1;
+                       s_brief=1;
+                       verify_quiet=1;
+                       }
                else if (strcmp(*argv,"-no_tmp_rsa") == 0)
                        { no_tmp_rsa=1; }
                else if (strcmp(*argv,"-no_dhe") == 0)
@@ -1318,28 +1332,14 @@ int MAIN(int argc, char *argv[])
                        meth = TLSv1_server_method();
                        }
 #endif
+               else if (strcmp(*argv,"-rev") == 0)
+                       { rev=1; }
                else if (strcmp(*argv,"-www") == 0)
                        { www=1; }
                else if (strcmp(*argv,"-WWW") == 0)
                        { www=2; }
                else if (strcmp(*argv,"-HTTP") == 0)
                        { www=3; }
-               else if (strcmp(*argv,"-no_ssl2") == 0)
-                       { off|=SSL_OP_NO_SSLv2; }
-               else if (strcmp(*argv,"-no_ssl3") == 0)
-                       { off|=SSL_OP_NO_SSLv3; }
-               else if (strcmp(*argv,"-no_tls1") == 0)
-                       { off|=SSL_OP_NO_TLSv1; }
-               else if (strcmp(*argv,"-no_tls1_1") == 0)
-                       { off|=SSL_OP_NO_TLSv1_1; }
-               else if (strcmp(*argv,"-no_tls1_2") == 0)
-                       { off|=SSL_OP_NO_TLSv1_2; }
-               else if (strcmp(*argv,"-no_comp") == 0)
-                       { off|=SSL_OP_NO_COMPRESSION; }
-#ifndef OPENSSL_NO_TLSEXT
-               else if (strcmp(*argv,"-no_ticket") == 0)
-                       { off|=SSL_OP_NO_TICKET; }
-#endif
 #ifndef OPENSSL_NO_SSL2
                else if (strcmp(*argv,"-ssl2") == 0)
                        { meth=SSLv2_server_method(); }
@@ -1438,12 +1438,6 @@ int MAIN(int argc, char *argv[])
                        keymatexportlen=atoi(*(++argv));
                        if (keymatexportlen == 0) goto bad;
                        }
-               else if (strcmp(*argv, "-cert_strict") == 0)
-                       cert_flags |= SSL_CERT_FLAG_TLS_STRICT;
-#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
-               else if (strcmp(*argv, "-debug_broken_protocol") == 0)
-                       cert_flags |= SSL_CERT_FLAG_BROKEN_PROTCOL;
-#endif
                else
                        {
                        BIO_printf(bio_err,"unknown option %s\n",*argv);
@@ -1661,10 +1655,7 @@ bad:
                BIO_printf(bio_err,"id_prefix '%s' set.\n", session_id_prefix);
                }
        SSL_CTX_set_quiet_shutdown(ctx,1);
-       if (bugs) SSL_CTX_set_options(ctx,SSL_OP_ALL);
        if (hack) SSL_CTX_set_options(ctx,SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG);
-       SSL_CTX_set_options(ctx,off);
-       if (cert_flags) SSL_CTX_set_cert_flags(ctx, cert_flags);
        if (exc) ssl_ctx_set_excert(ctx, exc);
        /* DTLS: partial reads end up discarding unread UDP bytes :-( 
         * Setting read ahead solves this problem.
@@ -1704,6 +1695,9 @@ bad:
        if (vpm)
                SSL_CTX_set1_param(ctx, vpm);
 
+       if (!args_ssl_call(ctx, bio_err, cctx, ssl_args))
+               goto end;
+
        if (!ssl_load_stores(ctx, vfyCApath, vfyCAfile, chCApath, chCAfile))
                {
                BIO_printf(bio_err, "Error loading store locations\n");
@@ -1743,10 +1737,7 @@ bad:
                        BIO_printf(bio_err,"id_prefix '%s' set.\n", session_id_prefix);
                        }
                SSL_CTX_set_quiet_shutdown(ctx2,1);
-               if (bugs) SSL_CTX_set_options(ctx2,SSL_OP_ALL);
                if (hack) SSL_CTX_set_options(ctx2,SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG);
-               SSL_CTX_set_options(ctx2,off);
-               if (cert_flags) SSL_CTX_set_cert_flags(ctx2, cert_flags);
                if (exc) ssl_ctx_set_excert(ctx2, exc);
                /* DTLS: partial reads end up discarding unread UDP bytes :-( 
                 * Setting read ahead solves this problem.
@@ -1769,6 +1760,9 @@ bad:
                        }
                if (vpm)
                        SSL_CTX_set1_param(ctx2, vpm);
+
+               if (!args_ssl_call(ctx2, bio_err, cctx, ssl_args))
+                       goto end;
                }
 
 # ifndef OPENSSL_NO_NEXTPROTONEG
@@ -1959,70 +1953,6 @@ bad:
                }
 #endif
 
-       if (cipher != NULL)
-               {
-               if(!SSL_CTX_set_cipher_list(ctx,cipher))
-                       {
-                       BIO_printf(bio_err,"error setting cipher list\n");
-                       ERR_print_errors(bio_err);
-                       goto end;
-                       }
-#ifndef OPENSSL_NO_TLSEXT
-               if (ctx2 && !SSL_CTX_set_cipher_list(ctx2,cipher))
-                       {
-                       BIO_printf(bio_err,"error setting cipher list\n");
-                       ERR_print_errors(bio_err);
-                       goto end;
-                       }
-#endif
-               }
-#ifndef OPENSSL_NO_TLSEXT
-       if (curves)
-               {
-               if(!SSL_CTX_set1_curves_list(ctx,curves))
-                       {
-                       BIO_printf(bio_err,"error setting curves list\n");
-                       ERR_print_errors(bio_err);
-                       goto end;
-                       }
-               if(ctx2 && !SSL_CTX_set1_curves_list(ctx2,curves))
-                       {
-                       BIO_printf(bio_err,"error setting curves list\n");
-                       ERR_print_errors(bio_err);
-                       goto end;
-                       }
-               }
-       if (sigalgs)
-               {
-               if(!SSL_CTX_set1_sigalgs_list(ctx,sigalgs))
-                       {
-                       BIO_printf(bio_err,"error setting signature algorithms\n");
-                       ERR_print_errors(bio_err);
-                       goto end;
-                       }
-               if(ctx2 && !SSL_CTX_set1_sigalgs_list(ctx2,sigalgs))
-                       {
-                       BIO_printf(bio_err,"error setting signature algorithms\n");
-                       ERR_print_errors(bio_err);
-                       goto end;
-                       }
-               }
-       if (client_sigalgs)
-               {
-               if(!SSL_CTX_set1_client_sigalgs_list(ctx,client_sigalgs))
-                       {
-                       BIO_printf(bio_err,"error setting client signature algorithms\n");
-                       ERR_print_errors(bio_err);
-                       goto end;
-                       }
-               if(ctx2 && !SSL_CTX_set1_client_sigalgs_list(ctx2,client_sigalgs))
-                       {
-                       BIO_printf(bio_err,"error setting client signature algorithms\n");
-                       ERR_print_errors(bio_err);
-                       goto end;
-                       }
-               }
-#endif
        SSL_CTX_set_verify(ctx,s_server_verify,verify_callback);
        SSL_CTX_set_session_id_context(ctx,(void*)&s_server_session_id_context,
                sizeof s_server_session_id_context);
@@ -2076,10 +2006,12 @@ bad:
 
        BIO_printf(bio_s_out,"ACCEPT\n");
        (void)BIO_flush(bio_s_out);
-       if (www)
-               do_server(port,socket_type,&accept_socket,www_body, context);
+       if (rev)
+               do_server(port,socket_type,&accept_socket,rev_body, context, naccept);
+       else if (www)
+               do_server(port,socket_type,&accept_socket,www_body, context, naccept);
        else
-               do_server(port,socket_type,&accept_socket,sv_body, context);
+               do_server(port,socket_type,&accept_socket,sv_body, context, naccept);
        print_stats(bio_s_out,ctx);
        ret=0;
 end:
@@ -2092,12 +2024,22 @@ end:
                EVP_PKEY_free(s_key);
        if (s_dkey)
                EVP_PKEY_free(s_dkey);
+       if (s_chain)
+               sk_X509_pop_free(s_chain, X509_free);
+       if (s_dchain)
+               sk_X509_pop_free(s_dchain, X509_free);
        if (pass)
                OPENSSL_free(pass);
        if (dpass)
                OPENSSL_free(dpass);
        free_sessions();
 #ifndef OPENSSL_NO_TLSEXT
+       if (tlscstatp.host)
+               OPENSSL_free(tlscstatp.host);
+       if (tlscstatp.port)
+               OPENSSL_free(tlscstatp.port);
+       if (tlscstatp.path)
+               OPENSSL_free(tlscstatp.path);
        if (ctx2 != NULL) SSL_CTX_free(ctx2);
        if (s_cert2)
                X509_free(s_cert2);
@@ -2107,6 +2049,10 @@ end:
                BIO_free(authz_in);
 #endif
        ssl_excert_free(exc);
+       if (ssl_args)
+               sk_OPENSSL_STRING_free(ssl_args);
+       if (cctx)
+               SSL_CONF_CTX_free(cctx);
        if (bio_s_out != NULL)
                {
         BIO_free(bio_s_out);
@@ -2379,7 +2325,7 @@ static int sv_body(char *hostname, int s, unsigned char *context)
                                }
                        else
                                i=raw_read_stdin(buf,bufsize);
-                       if (!s_quiet)
+                       if (!s_quiet && !s_brief)
                                {
                                if ((i <= 0) || (buf[0] == 'Q'))
                                        {
@@ -2632,6 +2578,11 @@ static int init_ssl_connection(SSL *con)
                return(0);
                }
 
+       if (s_brief)
+               print_ssl_summary(bio_err, con);
+
+       print_ssl_cert_checks(bio_err, con, checkhost, checkemail, checkip);
+
        PEM_write_bio_SSL_SESSION(bio_s_out,SSL_get_session(con));
 
        peer=SSL_get_peer_certificate(con);
@@ -2650,7 +2601,7 @@ static int init_ssl_connection(SSL *con)
                BIO_printf(bio_s_out,"Shared ciphers:%s\n",buf);
        str=SSL_CIPHER_get_name(SSL_get_current_cipher(con));
        ssl_print_sigalgs(bio_s_out, con);
-       ssl_print_curves(bio_s_out, con);
+       ssl_print_curves(bio_s_out, con, 0);
        BIO_printf(bio_s_out,"CIPHER is %s\n",(str != NULL)?str:"(NONE)");
 
 #if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
@@ -2993,7 +2944,7 @@ static int www_body(char *hostname, int s, unsigned char *context)
                                BIO_puts(io,"\n");
                                }
                        ssl_print_sigalgs(io, con);
-                       ssl_print_curves(io, con);
+                       ssl_print_curves(io, con, 0);
                        BIO_printf(io,(SSL_cache_hit(con)
                                ?"---\nReused, "
                                :"---\nNew, "));
@@ -3187,6 +3138,146 @@ err:
        return(ret);
        }
 
+static int rev_body(char *hostname, int s, unsigned char *context)
+       {
+       char *buf=NULL;
+       int i;
+       int ret=1;
+       SSL *con;
+       BIO *io,*ssl_bio,*sbio;
+#ifndef OPENSSL_NO_KRB5
+       KSSL_CTX *kctx;
+#endif
+
+       buf=OPENSSL_malloc(bufsize);
+       if (buf == NULL) return(0);
+       io=BIO_new(BIO_f_buffer());
+       ssl_bio=BIO_new(BIO_f_ssl());
+       if ((io == NULL) || (ssl_bio == NULL)) goto err;
+
+       /* lets make the output buffer a reasonable size */
+       if (!BIO_set_write_buffer_size(io,bufsize)) goto err;
+
+       if ((con=SSL_new(ctx)) == NULL) goto err;
+#ifndef OPENSSL_NO_TLSEXT
+       if (s_tlsextdebug)
+               {
+               SSL_set_tlsext_debug_callback(con, tlsext_cb);
+               SSL_set_tlsext_debug_arg(con, bio_s_out);
+               }
+#endif
+#ifndef OPENSSL_NO_KRB5
+       if ((kctx = kssl_ctx_new()) != NULL)
+               {
+               kssl_ctx_setstring(kctx, KSSL_SERVICE, KRB5SVC);
+               kssl_ctx_setstring(kctx, KSSL_KEYTAB, KRB5KEYTAB);
+               }
+#endif /* OPENSSL_NO_KRB5 */
+       if(context) SSL_set_session_id_context(con, context,
+                                              strlen((char *)context));
+
+       sbio=BIO_new_socket(s,BIO_NOCLOSE);
+       SSL_set_bio(con,sbio,sbio);
+       SSL_set_accept_state(con);
+
+       BIO_set_ssl(ssl_bio,con,BIO_CLOSE);
+       BIO_push(io,ssl_bio);
+#ifdef CHARSET_EBCDIC
+       io = BIO_push(BIO_new(BIO_f_ebcdic_filter()),io);
+#endif
+
+       if (s_debug)
+               {
+               SSL_set_debug(con, 1);
+               BIO_set_callback(SSL_get_rbio(con),bio_dump_callback);
+               BIO_set_callback_arg(SSL_get_rbio(con),(char *)bio_s_out);
+               }
+       if (s_msg)
+               {
+#ifndef OPENSSL_NO_SSL_TRACE
+               if (s_msg == 2)
+                       SSL_set_msg_callback(con, SSL_trace);
+               else
+#endif
+                       SSL_set_msg_callback(con, msg_cb);
+               SSL_set_msg_callback_arg(con, bio_s_msg ? bio_s_msg : bio_s_out);
+               }
+
+       for (;;)
+               {
+               i = BIO_do_handshake(io);
+               if (i > 0)
+                       break;
+               if (!BIO_should_retry(io))
+                       {
+                       BIO_puts(bio_err, "CONNECTION FAILURE\n");
+                       ERR_print_errors(bio_err);
+                       goto end;
+                       }
+               }
+       BIO_printf(bio_err, "CONNECTION ESTABLISHED\n");
+       print_ssl_summary(bio_err, con);
+
+       for (;;)
+               {
+               i=BIO_gets(io,buf,bufsize-1);
+               if (i < 0) /* error */
+                       {
+                       if (!BIO_should_retry(io))
+                               {
+                               if (!s_quiet)
+                                       ERR_print_errors(bio_err);
+                               goto err;
+                               }
+                       else
+                               {
+                               BIO_printf(bio_s_out,"read R BLOCK\n");
+#if defined(OPENSSL_SYS_NETWARE)
+            delay(1000);
+#elif !defined(OPENSSL_SYS_MSDOS) && !defined(__DJGPP__)
+                               sleep(1);
+#endif
+                               continue;
+                               }
+                       }
+               else if (i == 0) /* end of input */
+                       {
+                       ret=1;
+                       BIO_printf(bio_err, "CONNECTION CLOSED\n");
+                       goto end;
+                       }
+               else
+                       {
+                       char *p = buf + i - 1;
+                       while(i && (*p == '\n' || *p == '\r'))
+                               {
+                               p--;
+                               i--;
+                               }
+                       BUF_reverse((unsigned char *)buf, NULL, i);
+                       buf[i] = '\n';
+                       BIO_write(io, buf, i + 1);
+                       for (;;)
+                               {
+                               i = BIO_flush(io);
+                               if (i > 0)
+                                       break;
+                               if (!BIO_should_retry(io))
+                                       goto end;
+                               }
+                       }
+               }
+end:
+       /* make sure we re-use sessions */
+       SSL_set_shutdown(con,SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
+
+err:
+
+       if (buf != NULL) OPENSSL_free(buf);
+       if (io != NULL) BIO_free_all(io);
+       return(ret);
+       }
+
 #ifndef OPENSSL_NO_RSA
 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength)
        {