X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=ssl%2Fssltest.c;h=5aadfa51d0748111ddebc9b24ff3b44fe39a5780;hp=76d1521399fb69204402b37690fa458ab50fcea6;hb=27545970134d703ed96027aac9b67eced124eec3;hpb=563f1503a83f690ac428f725057fc19be6728e9e diff --git a/ssl/ssltest.c b/ssl/ssltest.c index 76d1521399..5aadfa51d0 100644 --- a/ssl/ssltest.c +++ b/ssl/ssltest.c @@ -55,6 +55,67 @@ * copied and put under another distribution licence * [including the GNU Public Licence.] */ +/* ==================================================================== + * Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. All advertising materials mentioning features or use of this + * software must display the following acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" + * + * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to + * endorse or promote products derived from this software without + * prior written permission. For written permission, please contact + * openssl-core@openssl.org. + * + * 5. Products derived from this software may not be called "OpenSSL" + * nor may "OpenSSL" appear in their names without prior written + * permission of the OpenSSL Project. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes software developed by the OpenSSL Project + * for use in the OpenSSL Toolkit (http://www.openssl.org/)" + * + * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY + * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR + * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * ==================================================================== + * + * This product includes cryptographic software written by Eric Young + * (eay@cryptsoft.com). This product includes software written by Tim + * Hudson (tjh@cryptsoft.com). + * + */ +/* ==================================================================== + * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. + * ECC cipher suite support in OpenSSL originally developed by + * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project. + */ + +#define _BSD_SOURCE 1 /* Or gethostname won't be declared properly + on Linux and GNU platforms. */ #include #include @@ -64,32 +125,58 @@ #include #include -#include "openssl/e_os.h" +#define USE_SOCKETS +#include "e_os.h" #include #include #include #include #include +#ifndef OPENSSL_NO_ENGINE +#include +#endif #include #include -#ifdef WINDOWS -#include "../crypto/bio/bss_file.c" + +#define _XOPEN_SOURCE_EXTENDED 1 /* Or gethostname won't be declared properly + on Compaq platforms (at least with DEC C). + Do not try to put it earlier, or IPv6 includes + get screwed... + */ + +#ifdef OPENSSL_SYS_WINDOWS +#include +#else +#include OPENSSL_UNISTD #endif -#ifdef VMS +#ifdef OPENSSL_SYS_VMS # define TEST_SERVER_CERT "SYS$DISK:[-.APPS]SERVER.PEM" # define TEST_CLIENT_CERT "SYS$DISK:[-.APPS]CLIENT.PEM" +#elif defined(OPENSSL_SYS_WINCE) +# define TEST_SERVER_CERT "\\OpenSSL\\server.pem" +# define TEST_CLIENT_CERT "\\OpenSSL\\client.pem" #else # define TEST_SERVER_CERT "../apps/server.pem" # define TEST_CLIENT_CERT "../apps/client.pem" #endif +/* There is really no standard for this, so let's assign some tentative + numbers. In any case, these numbers are only for this test */ +#define COMP_RLE 255 +#define COMP_ZLIB 1 + static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx); -#ifndef NO_RSA +#ifndef OPENSSL_NO_RSA static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export,int keylength); +static void free_tmp_rsa(void); #endif -#ifndef NO_DH +static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg); +#define APP_CALLBACK "Test Callback Argument" +static char *app_verify_arg = APP_CALLBACK; + +#ifndef OPENSSL_NO_DH static DH *get_dh512(void); static DH *get_dh1024(void); static DH *get_dh1024dsa(void); @@ -123,29 +210,40 @@ static void sv_usage(void) fprintf(stderr," -reuse - use session-id reuse\n"); fprintf(stderr," -num - number of connections to perform\n"); fprintf(stderr," -bytes - number of bytes to swap between client/server\n"); -#ifndef NO_DH +#ifndef OPENSSL_NO_DH fprintf(stderr," -dhe1024 - use 1024 bit key (safe prime) for DHE\n"); fprintf(stderr," -dhe1024dsa - use 1024 bit key (with 160-bit subprime) for DHE\n"); fprintf(stderr," -no_dhe - disable DHE\n"); #endif -#ifndef NO_SSL2 +#ifndef OPENSSL_NO_ECDH + fprintf(stderr," -no_ecdhe - disable ECDHE\n"); +#endif +#ifndef OPENSSL_NO_SSL2 fprintf(stderr," -ssl2 - use SSLv2\n"); #endif -#ifndef NO_SSL3 +#ifndef OPENSSL_NO_SSL3 fprintf(stderr," -ssl3 - use SSLv3\n"); #endif -#ifndef NO_TLS1 +#ifndef OPENSSL_NO_TLS1 fprintf(stderr," -tls1 - use TLSv1\n"); #endif fprintf(stderr," -CApath arg - PEM format directory of CA's\n"); fprintf(stderr," -CAfile arg - PEM format file of CA's\n"); - fprintf(stderr," -cert arg - Certificate file\n"); - fprintf(stderr," -s_cert arg - Just the server certificate file\n"); - fprintf(stderr," -c_cert arg - Just the client certificate file\n"); + fprintf(stderr," -cert arg - Server certificate file\n"); + fprintf(stderr," -key arg - Server key file (default: same as -cert)\n"); + fprintf(stderr," -c_cert arg - Client certificate file\n"); + fprintf(stderr," -c_key arg - Client key file (default: same as -c_cert)\n"); fprintf(stderr," -cipher arg - The cipher list\n"); fprintf(stderr," -bio_pair - Use BIO pairs\n"); fprintf(stderr," -f - Test even cases that can't work\n"); fprintf(stderr," -time - measure processor time used by client and server\n"); + fprintf(stderr," -zlib - use zlib compression\n"); + fprintf(stderr," -rle - use rle compression\n"); +#ifndef OPENSSL_NO_ECDH + fprintf(stderr," -named_curve arg - Elliptic curve name to use for ephemeral ECDH keys.\n" \ + " Use \"openssl ecparam -list_curves\" for all names\n" \ + " (default is sect163r2).\n"); +#endif } static void print_details(SSL *c_ssl, const char *prefix) @@ -167,7 +265,7 @@ static void print_details(SSL *c_ssl, const char *prefix) { if (0) ; -#ifndef NO_RSA +#ifndef OPENSSL_NO_RSA else if (pkey->type == EVP_PKEY_RSA && pkey->pkey.rsa != NULL && pkey->pkey.rsa->n != NULL) { @@ -175,7 +273,7 @@ static void print_details(SSL *c_ssl, const char *prefix) BN_num_bits(pkey->pkey.rsa->n)); } #endif -#ifndef NO_DSA +#ifndef OPENSSL_NO_DSA else if (pkey->type == EVP_PKEY_DSA && pkey->pkey.dsa != NULL && pkey->pkey.dsa->p != NULL) { @@ -192,6 +290,69 @@ static void print_details(SSL *c_ssl, const char *prefix) BIO_printf(bio_stdout,"\n"); } +static void lock_dbg_cb(int mode, int type, const char *file, int line) + { + static int modes[CRYPTO_NUM_LOCKS]; /* = {0, 0, ... } */ + const char *errstr = NULL; + int rw; + + rw = mode & (CRYPTO_READ|CRYPTO_WRITE); + if (!((rw == CRYPTO_READ) || (rw == CRYPTO_WRITE))) + { + errstr = "invalid mode"; + goto err; + } + + if (type < 0 || type >= CRYPTO_NUM_LOCKS) + { + errstr = "type out of bounds"; + goto err; + } + + if (mode & CRYPTO_LOCK) + { + if (modes[type]) + { + errstr = "already locked"; + /* must not happen in a single-threaded program + * (would deadlock) */ + goto err; + } + + modes[type] = rw; + } + else if (mode & CRYPTO_UNLOCK) + { + if (!modes[type]) + { + errstr = "not locked"; + goto err; + } + + if (modes[type] != rw) + { + errstr = (rw == CRYPTO_READ) ? + "CRYPTO_r_unlock on write lock" : + "CRYPTO_w_unlock on read lock"; + } + + modes[type] = 0; + } + else + { + errstr = "invalid mode"; + goto err; + } + + err: + if (errstr) + { + /* we cannot use bio_err here */ + fprintf(stderr, "openssl (lock_dbg_cb): %s (mode=%d, type=%d) at %s:%d\n", + errstr, mode, type, file, line); + } + } + int main(int argc, char *argv[]) { char *CApath=NULL,*CAfile=NULL; @@ -201,31 +362,56 @@ int main(int argc, char *argv[]) int tls1=0,ssl2=0,ssl3=0,ret=1; int client_auth=0; int server_auth=0,i; + int app_verify=0; char *server_cert=TEST_SERVER_CERT; + char *server_key=NULL; char *client_cert=TEST_CLIENT_CERT; + char *client_key=NULL; + char *named_curve = NULL; SSL_CTX *s_ctx=NULL; SSL_CTX *c_ctx=NULL; SSL_METHOD *meth=NULL; SSL *c_ssl,*s_ssl; int number=1,reuse=0; - long bytes=1L; -#ifndef NO_DH + long bytes=256L; +#ifndef OPENSSL_NO_DH DH *dh; int dhe1024 = 0, dhe1024dsa = 0; +#endif +#ifndef OPENSSL_NO_ECDH + EC_KEY *ecdh = NULL; #endif int no_dhe = 0; + int no_ecdhe = 0; int print_time = 0; clock_t s_time = 0, c_time = 0; + int comp = 0; + COMP_METHOD *cm = NULL; + STACK_OF(SSL_COMP) *ssl_comp_methods = NULL; verbose = 0; debug = 0; cipher = 0; - + + bio_err=BIO_new_fp(stderr,BIO_NOCLOSE); + + CRYPTO_set_locking_callback(lock_dbg_cb); + + /* enable memory leak checking unless explicitly disabled */ + if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) && (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off")))) + { + CRYPTO_malloc_debug_init(); + CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL); + } + else + { + /* OPENSSL_DEBUG_MEMORY=off */ + CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0); + } CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON); RAND_seed(rnd_seed, sizeof rnd_seed); - bio_err=BIO_new_fp(stderr,BIO_NOCLOSE); bio_stdout=BIO_new_fp(stdout,BIO_NOCLOSE); argc--; @@ -243,14 +429,26 @@ int main(int argc, char *argv[]) debug=1; else if (strcmp(*argv,"-reuse") == 0) reuse=1; -#ifndef NO_DH else if (strcmp(*argv,"-dhe1024") == 0) + { +#ifndef OPENSSL_NO_DH dhe1024=1; +#else + fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n"); +#endif + } else if (strcmp(*argv,"-dhe1024dsa") == 0) + { +#ifndef OPENSSL_NO_DH dhe1024dsa=1; +#else + fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n"); #endif + } else if (strcmp(*argv,"-no_dhe") == 0) no_dhe=1; + else if (strcmp(*argv,"-no_ecdhe") == 0) + no_ecdhe=1; else if (strcmp(*argv,"-ssl2") == 0) ssl2=1; else if (strcmp(*argv,"-tls1") == 0) @@ -282,11 +480,26 @@ int main(int argc, char *argv[]) if (--argc < 1) goto bad; server_cert= *(++argv); } + else if (strcmp(*argv,"-key") == 0) + { + if (--argc < 1) goto bad; + server_key= *(++argv); + } + else if (strcmp(*argv,"-s_key") == 0) + { + if (--argc < 1) goto bad; + server_key= *(++argv); + } else if (strcmp(*argv,"-c_cert") == 0) { if (--argc < 1) goto bad; client_cert= *(++argv); } + else if (strcmp(*argv,"-c_key") == 0) + { + if (--argc < 1) goto bad; + client_key= *(++argv); + } else if (strcmp(*argv,"-cipher") == 0) { if (--argc < 1) goto bad; @@ -314,6 +527,28 @@ int main(int argc, char *argv[]) { print_time = 1; } + else if (strcmp(*argv,"-zlib") == 0) + { + comp = COMP_ZLIB; + } + else if (strcmp(*argv,"-rle") == 0) + { + comp = COMP_RLE; + } + else if (strcmp(*argv,"-named_curve") == 0) + { + if (--argc < 1) goto bad; +#ifndef OPENSSL_NO_ECDH + named_curve = *(++argv); +#else + fprintf(stderr,"ignoring -named_curve, since I'm compiled without ECDH\n"); + ++argv; +#endif + } + else if (strcmp(*argv,"-app_verify") == 0) + { + app_verify = 1; + } else { fprintf(stderr,"unknown option %s\n",*argv); @@ -336,7 +571,7 @@ bad: "the test anyway (and\n-d to see what happens), " "or add one of -ssl2, -ssl3, -tls1, -reuse\n" "to avoid protocol mismatch.\n"); - exit(1); + EXIT(1); } if (print_time) @@ -355,7 +590,44 @@ bad: SSL_library_init(); SSL_load_error_strings(); -#if !defined(NO_SSL2) && !defined(NO_SSL3) + if (comp == COMP_ZLIB) cm = COMP_zlib(); + if (comp == COMP_RLE) cm = COMP_rle(); + if (cm != NULL) + { + if (cm->type != NID_undef) + { + if (SSL_COMP_add_compression_method(comp, cm) != 0) + { + fprintf(stderr, + "Failed to add compression method\n"); + ERR_print_errors_fp(stderr); + } + } + else + { + fprintf(stderr, + "Warning: %s compression not supported\n", + (comp == COMP_RLE ? "rle" : + (comp == COMP_ZLIB ? "zlib" : + "unknown"))); + ERR_print_errors_fp(stderr); + } + } + ssl_comp_methods = SSL_COMP_get_compression_methods(); + fprintf(stderr, "Available compression methods:\n"); + { + int j, n = sk_SSL_COMP_num(ssl_comp_methods); + if (n == 0) + fprintf(stderr, " NONE\n"); + else + for (j = 0; j < n; j++) + { + SSL_COMP *c = sk_SSL_COMP_value(ssl_comp_methods, j); + fprintf(stderr, " %d: %s\n", c->id, c->name); + } + } + +#if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3) if (ssl2) meth=SSLv2_method(); else @@ -367,7 +639,7 @@ bad: else meth=SSLv23_method(); #else -#ifdef NO_SSL2 +#ifdef OPENSSL_NO_SSL2 meth=SSLv3_method(); #else meth=SSLv2_method(); @@ -388,7 +660,7 @@ bad: SSL_CTX_set_cipher_list(s_ctx,cipher); } -#ifndef NO_DH +#ifndef OPENSSL_NO_DH if (!no_dhe) { if (dhe1024dsa) @@ -408,7 +680,45 @@ bad: (void)no_dhe; #endif -#ifndef NO_RSA +#ifndef OPENSSL_NO_ECDH + if (!no_ecdhe) + { + ecdh = EC_KEY_new(); + if (ecdh != NULL) + { + if (named_curve) + { + int nid = OBJ_sn2nid(named_curve); + + if (nid == 0) + { + BIO_printf(bio_err, "unknown curve name (%s)\n", named_curve); + EC_KEY_free(ecdh); + goto end; + } + + ecdh->group = EC_GROUP_new_by_nid(nid); + if (ecdh->group == NULL) + { + BIO_printf(bio_err, "unable to create curve (%s)\n", named_curve); + EC_KEY_free(ecdh); + goto end; + } + } + + if (ecdh->group == NULL) + ecdh->group=EC_GROUP_new_by_nid(NID_sect163r2); + + SSL_CTX_set_tmp_ecdh(s_ctx, ecdh); + SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_ECDH_USE); + EC_KEY_free(ecdh); + } + } +#else + (void)no_ecdhe; +#endif + +#ifndef OPENSSL_NO_RSA SSL_CTX_set_tmp_rsa_callback(s_ctx,tmp_rsa_cb); #endif @@ -416,8 +726,8 @@ bad: { ERR_print_errors(bio_err); } - else if (!SSL_CTX_use_PrivateKey_file(s_ctx,server_cert, - SSL_FILETYPE_PEM)) + else if (!SSL_CTX_use_PrivateKey_file(s_ctx, + (server_key?server_key:server_cert), SSL_FILETYPE_PEM)) { ERR_print_errors(bio_err); goto end; @@ -427,7 +737,8 @@ bad: { SSL_CTX_use_certificate_file(c_ctx,client_cert, SSL_FILETYPE_PEM); - SSL_CTX_use_PrivateKey_file(c_ctx,client_cert, + SSL_CTX_use_PrivateKey_file(c_ctx, + (client_key?client_key:client_cert), SSL_FILETYPE_PEM); } @@ -447,12 +758,20 @@ bad: SSL_CTX_set_verify(s_ctx, SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT, verify_callback); + if (app_verify) + { + SSL_CTX_set_cert_verify_callback(s_ctx, app_verify_callback, app_verify_arg); + } } if (server_auth) { BIO_printf(bio_err,"server authentication\n"); SSL_CTX_set_verify(c_ctx,SSL_VERIFY_PEER, verify_callback); + if (app_verify) + { + SSL_CTX_set_cert_verify_callback(s_ctx, app_verify_callback, app_verify_arg); + } } { @@ -463,6 +782,25 @@ bad: c_ssl=SSL_new(c_ctx); s_ssl=SSL_new(s_ctx); +#ifndef OPENSSL_NO_KRB5 + if (c_ssl && c_ssl->kssl_ctx) + { + char localhost[MAXHOSTNAMELEN+2]; + + if (gethostname(localhost, sizeof localhost-1) == 0) + { + localhost[sizeof localhost-1]='\0'; + if(strlen(localhost) == sizeof localhost-1) + { + BIO_printf(bio_err,"localhost name too long\n"); + goto end; + } + kssl_ctx_setstring(c_ssl->kssl_ctx, KSSL_SERVER, + localhost); + } + } +#endif /* OPENSSL_NO_KRB5 */ + for (i=0; i 1) --num; /* test restartability even more thoroughly */ - r = BIO_nwrite(io1, &dataptr, (int)num); + r = BIO_nwrite0(io1, &dataptr); assert(r > 0); - assert(r <= (int)num); - num = r; + if (r < (int)num) + num = r; r = BIO_read(io2, dataptr, (int)num); if (r != (int)num) /* can't happen */ { @@ -823,6 +1186,13 @@ int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count, goto err; } progress = 1; + r = BIO_nwrite(io1, &dataptr, (int)num); + if (r != (int)num) /* can't happen */ + { + fprintf(stderr, "ERROR: BIO_nwrite() did not accept " + "BIO_nwrite0() bytes"); + goto err; + } if (debug) printf((io2 == client_io) ? @@ -903,6 +1273,9 @@ int doit(SSL *s_ssl, SSL *c_ssl, long count) int c_write,s_write; int do_server=0,do_client=0; + memset(cbuf,0,sizeof(cbuf)); + memset(sbuf,0,sizeof(sbuf)); + c_to_s=BIO_new(BIO_s_mem()); s_to_c=BIO_new(BIO_s_mem()); if ((s_to_c == NULL) || (c_to_s == NULL)) @@ -977,8 +1350,8 @@ int doit(SSL *s_ssl, SSL *c_ssl, long count) { if (c_write) { - j=(cw_num > (long)sizeof(cbuf)) - ?sizeof(cbuf):(int)cw_num; + j = (cw_num > (long)sizeof(cbuf)) ? + (int)sizeof(cbuf) : (int)cw_num; i=BIO_write(c_bio,cbuf,j); if (i < 0) { @@ -1108,8 +1481,8 @@ int doit(SSL *s_ssl, SSL *c_ssl, long count) } else { - j=(sw_num > (long)sizeof(sbuf))? - sizeof(sbuf):(int)sw_num; + j = (sw_num > (long)sizeof(sbuf)) ? + (int)sizeof(sbuf) : (int)sw_num; i=BIO_write(s_bio,sbuf,j); if (i < 0) { @@ -1156,7 +1529,7 @@ int doit(SSL *s_ssl, SSL *c_ssl, long count) ret=0; err: /* We have to set the BIO's to NULL otherwise they will be - * Free()ed twice. Once when th s_ssl is SSL_free()ed and + * OPENSSL_free()ed twice. Once when th s_ssl is SSL_free()ed and * again when c_ssl is SSL_free()ed. * This is a hack required because s_ssl and c_ssl are sharing the same * BIO structure and SSL_set_bio() and SSL_free() automatically @@ -1184,7 +1557,8 @@ static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx) { char *s,buf[256]; - s=X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),buf,256); + s=X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),buf, + sizeof buf); if (s != NULL) { if (ok) @@ -1208,31 +1582,71 @@ static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx) return(ok); } -#ifndef NO_RSA -static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength) +static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg) { - static RSA *rsa_tmp=NULL; + char *s = NULL,buf[256]; + int ok=1; + + fprintf(stderr, "In app_verify_callback, allowing cert. "); + fprintf(stderr, "Arg is: %s\n", (char *)arg); + fprintf(stderr, "Finished printing do we have a context? 0x%x a cert? 0x%x\n", + (unsigned int)ctx, (unsigned int)ctx->cert); + if (ctx->cert) + s=X509_NAME_oneline(X509_get_subject_name(ctx->cert),buf,256); + if (s != NULL) + { + fprintf(stderr,"cert depth=%d %s\n",ctx->error_depth,buf); + } + return(ok); + } + +#ifndef OPENSSL_NO_RSA +static RSA *rsa_tmp=NULL; + +static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength) + { if (rsa_tmp == NULL) { + rsa_tmp = RSA_new(); + if(!rsa_tmp) + { + BIO_printf(bio_err, "Memory error..."); + goto end; + } BIO_printf(bio_err,"Generating temp (%d bit) RSA key...",keylength); (void)BIO_flush(bio_err); - rsa_tmp=RSA_generate_key(keylength,RSA_F4,NULL,NULL); + if(!RSA_generate_key_ex(rsa_tmp,keylength,RSA_F4,NULL)) + { + BIO_printf(bio_err, "Error generating key."); + RSA_free(rsa_tmp); + rsa_tmp = NULL; + } +end: BIO_printf(bio_err,"\n"); (void)BIO_flush(bio_err); } return(rsa_tmp); } + +static void free_tmp_rsa(void) + { + if (rsa_tmp != NULL) + { + RSA_free(rsa_tmp); + rsa_tmp = NULL; + } + } #endif -#ifndef NO_DH +#ifndef OPENSSL_NO_DH /* These DH parameters have been generated as follows: * $ openssl dhparam -C -noout 512 * $ openssl dhparam -C -noout 1024 * $ openssl dhparam -C -noout -dsaparam 1024 * (The third function has been renamed to avoid name conflicts.) */ -DH *get_dh512() +static DH *get_dh512() { static unsigned char dh512_p[]={ 0xCB,0xC8,0xE1,0x86,0xD0,0x1F,0x94,0x17,0xA6,0x99,0xF0,0xC6, @@ -1255,7 +1669,7 @@ DH *get_dh512() return(dh); } -DH *get_dh1024() +static DH *get_dh1024() { static unsigned char dh1024_p[]={ 0xF8,0x81,0x89,0x7D,0x14,0x24,0xC5,0xD1,0xE6,0xF7,0xBF,0x3A, @@ -1283,7 +1697,7 @@ DH *get_dh1024() return(dh); } -DH *get_dh1024dsa() +static DH *get_dh1024dsa() { static unsigned char dh1024_p[]={ 0xC8,0x00,0xF7,0x08,0x07,0x89,0x4D,0x90,0x53,0xF3,0xD5,0x00,