OpenSSL  1.0.1c
 All Classes Files Functions Variables Typedefs Enumerations Enumerator Macros
ssltest.c
Go to the documentation of this file.
1 /* ssl/ssltest.c */
2 /* Copyright (C) 1995-1998 Eric Young ([email protected])
3  * All rights reserved.
4  *
5  * This package is an SSL implementation written
6  * by Eric Young ([email protected]).
7  * The implementation was written so as to conform with Netscapes SSL.
8  *
9  * This library is free for commercial and non-commercial use as long as
10  * the following conditions are aheared to. The following conditions
11  * apply to all code found in this distribution, be it the RC4, RSA,
12  * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13  * included with this distribution is covered by the same copyright terms
14  * except that the holder is Tim Hudson ([email protected]).
15  *
16  * Copyright remains Eric Young's, and as such any Copyright notices in
17  * the code are not to be removed.
18  * If this package is used in a product, Eric Young should be given attribution
19  * as the author of the parts of the library used.
20  * This can be in the form of a textual message at program startup or
21  * in documentation (online or textual) provided with the package.
22  *
23  * Redistribution and use in source and binary forms, with or without
24  * modification, are permitted provided that the following conditions
25  * are met:
26  * 1. Redistributions of source code must retain the copyright
27  * notice, this list of conditions and the following disclaimer.
28  * 2. Redistributions in binary form must reproduce the above copyright
29  * notice, this list of conditions and the following disclaimer in the
30  * documentation and/or other materials provided with the distribution.
31  * 3. All advertising materials mentioning features or use of this software
32  * must display the following acknowledgement:
33  * "This product includes cryptographic software written by
34  * Eric Young ([email protected])"
35  * The word 'cryptographic' can be left out if the rouines from the library
36  * being used are not cryptographic related :-).
37  * 4. If you include any Windows specific code (or a derivative thereof) from
38  * the apps directory (application code) you must include an acknowledgement:
39  * "This product includes software written by Tim Hudson ([email protected])"
40  *
41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51  * SUCH DAMAGE.
52  *
53  * The licence and distribution terms for any publically available version or
54  * derivative of this code cannot be changed. i.e. this code cannot simply be
55  * copied and put under another distribution licence
56  * [including the GNU Public Licence.]
57  */
58 /* ====================================================================
59  * Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved.
60  *
61  * Redistribution and use in source and binary forms, with or without
62  * modification, are permitted provided that the following conditions
63  * are met:
64  *
65  * 1. Redistributions of source code must retain the above copyright
66  * notice, this list of conditions and the following disclaimer.
67  *
68  * 2. Redistributions in binary form must reproduce the above copyright
69  * notice, this list of conditions and the following disclaimer in
70  * the documentation and/or other materials provided with the
71  * distribution.
72  *
73  * 3. All advertising materials mentioning features or use of this
74  * software must display the following acknowledgment:
75  * "This product includes software developed by the OpenSSL Project
76  * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77  *
78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79  * endorse or promote products derived from this software without
80  * prior written permission. For written permission, please contact
81  * [email protected].
82  *
83  * 5. Products derived from this software may not be called "OpenSSL"
84  * nor may "OpenSSL" appear in their names without prior written
85  * permission of the OpenSSL Project.
86  *
87  * 6. Redistributions of any form whatsoever must retain the following
88  * acknowledgment:
89  * "This product includes software developed by the OpenSSL Project
90  * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91  *
92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103  * OF THE POSSIBILITY OF SUCH DAMAGE.
104  * ====================================================================
105  *
106  * This product includes cryptographic software written by Eric Young
107  * ([email protected]). This product includes software written by Tim
108  * Hudson ([email protected]).
109  *
110  */
111 /* ====================================================================
112  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
113  * ECC cipher suite support in OpenSSL originally developed by
114  * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
115  */
116 /* ====================================================================
117  * Copyright 2005 Nokia. All rights reserved.
118  *
119  * The portions of the attached software ("Contribution") is developed by
120  * Nokia Corporation and is licensed pursuant to the OpenSSL open source
121  * license.
122  *
123  * The Contribution, originally written by Mika Kousa and Pasi Eronen of
124  * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
125  * support (see RFC 4279) to OpenSSL.
126  *
127  * No patent licenses or other rights except those expressly stated in
128  * the OpenSSL open source license shall be deemed granted or received
129  * expressly, by implication, estoppel, or otherwise.
130  *
131  * No assurances are provided by Nokia that the Contribution does not
132  * infringe the patent or other intellectual property rights of any third
133  * party or that the license provides you with all the necessary rights
134  * to make use of the Contribution.
135  *
136  * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
137  * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
138  * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
139  * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
140  * OTHERWISE.
141  */
142 
143 #define _BSD_SOURCE 1 /* Or gethostname won't be declared properly
144  on Linux and GNU platforms. */
145 
146 #include <assert.h>
147 #include <errno.h>
148 #include <limits.h>
149 #include <stdio.h>
150 #include <stdlib.h>
151 #include <string.h>
152 #include <time.h>
153 
154 #define USE_SOCKETS
155 #include "e_os.h"
156 
157 #ifdef OPENSSL_SYS_VMS
158 #define _XOPEN_SOURCE 500 /* Or isascii won't be declared properly on
159  VMS (at least with DECompHP C). */
160 #endif
161 
162 #include <ctype.h>
163 
164 #include <openssl/bio.h>
165 #include <openssl/crypto.h>
166 #include <openssl/evp.h>
167 #include <openssl/x509.h>
168 #include <openssl/x509v3.h>
169 #include <openssl/ssl.h>
170 #ifndef OPENSSL_NO_ENGINE
171 #include <openssl/engine.h>
172 #endif
173 #include <openssl/err.h>
174 #include <openssl/rand.h>
175 #ifndef OPENSSL_NO_RSA
176 #include <openssl/rsa.h>
177 #endif
178 #ifndef OPENSSL_NO_DSA
179 #include <openssl/dsa.h>
180 #endif
181 #ifndef OPENSSL_NO_DH
182 #include <openssl/dh.h>
183 #endif
184 #ifndef OPENSSL_NO_SRP
185 #include <openssl/srp.h>
186 #endif
187 #include <openssl/bn.h>
188 
189 #define _XOPEN_SOURCE_EXTENDED 1 /* Or gethostname won't be declared properly
190  on Compaq platforms (at least with DEC C).
191  Do not try to put it earlier, or IPv6 includes
192  get screwed...
193  */
194 
195 #ifdef OPENSSL_SYS_WINDOWS
196 #include <winsock.h>
197 #else
198 #include OPENSSL_UNISTD
199 #endif
200 
201 #ifdef OPENSSL_SYS_VMS
202 # define TEST_SERVER_CERT "SYS$DISK:[-.APPS]SERVER.PEM"
203 # define TEST_CLIENT_CERT "SYS$DISK:[-.APPS]CLIENT.PEM"
204 #elif defined(OPENSSL_SYS_WINCE)
205 # define TEST_SERVER_CERT "\\OpenSSL\\server.pem"
206 # define TEST_CLIENT_CERT "\\OpenSSL\\client.pem"
207 #elif defined(OPENSSL_SYS_NETWARE)
208 # define TEST_SERVER_CERT "\\openssl\\apps\\server.pem"
209 # define TEST_CLIENT_CERT "\\openssl\\apps\\client.pem"
210 #else
211 # define TEST_SERVER_CERT "../apps/server.pem"
212 # define TEST_CLIENT_CERT "../apps/client.pem"
213 #endif
214 
215 /* There is really no standard for this, so let's assign some tentative
216  numbers. In any case, these numbers are only for this test */
217 #define COMP_RLE 255
218 #define COMP_ZLIB 1
219 
220 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
221 #ifndef OPENSSL_NO_RSA
222 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export,int keylength);
223 static void free_tmp_rsa(void);
224 #endif
225 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg);
226 #define APP_CALLBACK_STRING "Test Callback Argument"
227 struct app_verify_arg
228  {
229  char *string;
230  int app_verify;
231  int allow_proxy_certs;
232  char *proxy_auth;
233  char *proxy_cond;
234  };
235 
236 #ifndef OPENSSL_NO_DH
237 static DH *get_dh512(void);
238 static DH *get_dh1024(void);
239 static DH *get_dh1024dsa(void);
240 #endif
241 
242 
243 static char *psk_key=NULL; /* by default PSK is not used */
244 #ifndef OPENSSL_NO_PSK
245 static unsigned int psk_client_callback(SSL *ssl, const char *hint, char *identity,
246  unsigned int max_identity_len, unsigned char *psk,
247  unsigned int max_psk_len);
248 static unsigned int psk_server_callback(SSL *ssl, const char *identity, unsigned char *psk,
249  unsigned int max_psk_len);
250 #endif
251 
252 #ifndef OPENSSL_NO_SRP
253 /* SRP client */
254 /* This is a context that we pass to all callbacks */
255 typedef struct srp_client_arg_st
256  {
257  char *srppassin;
258  char *srplogin;
259  } SRP_CLIENT_ARG;
260 
261 #define PWD_STRLEN 1024
262 
263 static char * MS_CALLBACK ssl_give_srp_client_pwd_cb(SSL *s, void *arg)
264  {
265  SRP_CLIENT_ARG *srp_client_arg = (SRP_CLIENT_ARG *)arg;
266  return BUF_strdup((char *)srp_client_arg->srppassin);
267  }
268 
269 /* SRP server */
270 /* This is a context that we pass to SRP server callbacks */
271 typedef struct srp_server_arg_st
272  {
273  char *expected_user;
274  char *pass;
275  } SRP_SERVER_ARG;
276 
277 static int MS_CALLBACK ssl_srp_server_param_cb(SSL *s, int *ad, void *arg)
278  {
279  SRP_SERVER_ARG * p = (SRP_SERVER_ARG *) arg;
280 
281  if (strcmp(p->expected_user, SSL_get_srp_username(s)) != 0)
282  {
283  fprintf(stderr, "User %s doesn't exist\n", SSL_get_srp_username(s));
284  return SSL3_AL_FATAL;
285  }
286  if (SSL_set_srp_server_param_pw(s,p->expected_user,p->pass,"1024")<0)
287  {
288  *ad = SSL_AD_INTERNAL_ERROR;
289  return SSL3_AL_FATAL;
290  }
291  return SSL_ERROR_NONE;
292  }
293 #endif
294 
295 static BIO *bio_err=NULL;
296 static BIO *bio_stdout=NULL;
297 
298 static char *cipher=NULL;
299 static int verbose=0;
300 static int debug=0;
301 #if 0
302 /* Not used yet. */
303 #ifdef FIONBIO
304 static int s_nbio=0;
305 #endif
306 #endif
307 
308 static const char rnd_seed[] = "string to make the random number generator think it has entropy";
309 
310 int doit_biopair(SSL *s_ssl,SSL *c_ssl,long bytes,clock_t *s_time,clock_t *c_time);
311 int doit(SSL *s_ssl,SSL *c_ssl,long bytes);
312 static int do_test_cipherlist(void);
313 static void sv_usage(void)
314  {
315  fprintf(stderr,"usage: ssltest [args ...]\n");
316  fprintf(stderr,"\n");
317 #ifdef OPENSSL_FIPS
318  fprintf(stderr,"-F - run test in FIPS mode\n");
319 #endif
320  fprintf(stderr," -server_auth - check server certificate\n");
321  fprintf(stderr," -client_auth - do client authentication\n");
322  fprintf(stderr," -proxy - allow proxy certificates\n");
323  fprintf(stderr," -proxy_auth <val> - set proxy policy rights\n");
324  fprintf(stderr," -proxy_cond <val> - experssion to test proxy policy rights\n");
325  fprintf(stderr," -v - more output\n");
326  fprintf(stderr," -d - debug output\n");
327  fprintf(stderr," -reuse - use session-id reuse\n");
328  fprintf(stderr," -num <val> - number of connections to perform\n");
329  fprintf(stderr," -bytes <val> - number of bytes to swap between client/server\n");
330 #ifndef OPENSSL_NO_DH
331  fprintf(stderr," -dhe1024 - use 1024 bit key (safe prime) for DHE\n");
332  fprintf(stderr," -dhe1024dsa - use 1024 bit key (with 160-bit subprime) for DHE\n");
333  fprintf(stderr," -no_dhe - disable DHE\n");
334 #endif
335 #ifndef OPENSSL_NO_ECDH
336  fprintf(stderr," -no_ecdhe - disable ECDHE\n");
337 #endif
338 #ifndef OPENSSL_NO_PSK
339  fprintf(stderr," -psk arg - PSK in hex (without 0x)\n");
340 #endif
341 #ifndef OPENSSL_NO_SRP
342  fprintf(stderr," -srpuser user - SRP username to use\n");
343  fprintf(stderr," -srppass arg - password for 'user'\n");
344 #endif
345 #ifndef OPENSSL_NO_SSL2
346  fprintf(stderr," -ssl2 - use SSLv2\n");
347 #endif
348 #ifndef OPENSSL_NO_SSL3
349  fprintf(stderr," -ssl3 - use SSLv3\n");
350 #endif
351 #ifndef OPENSSL_NO_TLS1
352  fprintf(stderr," -tls1 - use TLSv1\n");
353 #endif
354  fprintf(stderr," -CApath arg - PEM format directory of CA's\n");
355  fprintf(stderr," -CAfile arg - PEM format file of CA's\n");
356  fprintf(stderr," -cert arg - Server certificate file\n");
357  fprintf(stderr," -key arg - Server key file (default: same as -cert)\n");
358  fprintf(stderr," -c_cert arg - Client certificate file\n");
359  fprintf(stderr," -c_key arg - Client key file (default: same as -c_cert)\n");
360  fprintf(stderr," -cipher arg - The cipher list\n");
361  fprintf(stderr," -bio_pair - Use BIO pairs\n");
362  fprintf(stderr," -f - Test even cases that can't work\n");
363  fprintf(stderr," -time - measure processor time used by client and server\n");
364  fprintf(stderr," -zlib - use zlib compression\n");
365  fprintf(stderr," -rle - use rle compression\n");
366 #ifndef OPENSSL_NO_ECDH
367  fprintf(stderr," -named_curve arg - Elliptic curve name to use for ephemeral ECDH keys.\n" \
368  " Use \"openssl ecparam -list_curves\" for all names\n" \
369  " (default is sect163r2).\n");
370 #endif
371  fprintf(stderr," -test_cipherlist - verifies the order of the ssl cipher lists\n");
372  }
373 
374 static void print_details(SSL *c_ssl, const char *prefix)
375  {
376  const SSL_CIPHER *ciph;
377  X509 *cert;
378 
379  ciph=SSL_get_current_cipher(c_ssl);
380  BIO_printf(bio_stdout,"%s%s, cipher %s %s",
381  prefix,
382  SSL_get_version(c_ssl),
383  SSL_CIPHER_get_version(ciph),
384  SSL_CIPHER_get_name(ciph));
385  cert=SSL_get_peer_certificate(c_ssl);
386  if (cert != NULL)
387  {
388  EVP_PKEY *pkey = X509_get_pubkey(cert);
389  if (pkey != NULL)
390  {
391  if (0)
392  ;
393 #ifndef OPENSSL_NO_RSA
394  else if (pkey->type == EVP_PKEY_RSA && pkey->pkey.rsa != NULL
395  && pkey->pkey.rsa->n != NULL)
396  {
397  BIO_printf(bio_stdout, ", %d bit RSA",
398  BN_num_bits(pkey->pkey.rsa->n));
399  }
400 #endif
401 #ifndef OPENSSL_NO_DSA
402  else if (pkey->type == EVP_PKEY_DSA && pkey->pkey.dsa != NULL
403  && pkey->pkey.dsa->p != NULL)
404  {
405  BIO_printf(bio_stdout, ", %d bit DSA",
406  BN_num_bits(pkey->pkey.dsa->p));
407  }
408 #endif
409  EVP_PKEY_free(pkey);
410  }
411  X509_free(cert);
412  }
413  /* The SSL API does not allow us to look at temporary RSA/DH keys,
414  * otherwise we should print their lengths too */
415  BIO_printf(bio_stdout,"\n");
416  }
417 
418 static void lock_dbg_cb(int mode, int type, const char *file, int line)
419  {
420  static int modes[CRYPTO_NUM_LOCKS]; /* = {0, 0, ... } */
421  const char *errstr = NULL;
422  int rw;
423 
424  rw = mode & (CRYPTO_READ|CRYPTO_WRITE);
425  if (!((rw == CRYPTO_READ) || (rw == CRYPTO_WRITE)))
426  {
427  errstr = "invalid mode";
428  goto err;
429  }
430 
431  if (type < 0 || type >= CRYPTO_NUM_LOCKS)
432  {
433  errstr = "type out of bounds";
434  goto err;
435  }
436 
437  if (mode & CRYPTO_LOCK)
438  {
439  if (modes[type])
440  {
441  errstr = "already locked";
442  /* must not happen in a single-threaded program
443  * (would deadlock) */
444  goto err;
445  }
446 
447  modes[type] = rw;
448  }
449  else if (mode & CRYPTO_UNLOCK)
450  {
451  if (!modes[type])
452  {
453  errstr = "not locked";
454  goto err;
455  }
456 
457  if (modes[type] != rw)
458  {
459  errstr = (rw == CRYPTO_READ) ?
460  "CRYPTO_r_unlock on write lock" :
461  "CRYPTO_w_unlock on read lock";
462  }
463 
464  modes[type] = 0;
465  }
466  else
467  {
468  errstr = "invalid mode";
469  goto err;
470  }
471 
472  err:
473  if (errstr)
474  {
475  /* we cannot use bio_err here */
476  fprintf(stderr, "openssl (lock_dbg_cb): %s (mode=%d, type=%d) at %s:%d\n",
477  errstr, mode, type, file, line);
478  }
479  }
480 
481 #ifdef TLSEXT_TYPE_opaque_prf_input
482 struct cb_info_st { void *input; size_t len; int ret; };
483 struct cb_info_st co1 = { "C", 1, 1 }; /* try to negotiate oqaque PRF input */
484 struct cb_info_st co2 = { "C", 1, 2 }; /* insist on oqaque PRF input */
485 struct cb_info_st so1 = { "S", 1, 1 }; /* try to negotiate oqaque PRF input */
486 struct cb_info_st so2 = { "S", 1, 2 }; /* insist on oqaque PRF input */
487 
488 int opaque_prf_input_cb(SSL *ssl, void *peerinput, size_t len, void *arg_)
489  {
490  struct cb_info_st *arg = arg_;
491 
492  if (arg == NULL)
493  return 1;
494 
495  if (!SSL_set_tlsext_opaque_prf_input(ssl, arg->input, arg->len))
496  return 0;
497  return arg->ret;
498  }
499 #endif
500 
501 int main(int argc, char *argv[])
502  {
503  char *CApath=NULL,*CAfile=NULL;
504  int badop=0;
505  int bio_pair=0;
506  int force=0;
507  int tls1=0,ssl2=0,ssl3=0,ret=1;
508  int client_auth=0;
509  int server_auth=0,i;
510  struct app_verify_arg app_verify_arg =
511  { APP_CALLBACK_STRING, 0, 0, NULL, NULL };
512  char *server_cert=TEST_SERVER_CERT;
513  char *server_key=NULL;
514  char *client_cert=TEST_CLIENT_CERT;
515  char *client_key=NULL;
516 #ifndef OPENSSL_NO_ECDH
517  char *named_curve = NULL;
518 #endif
519  SSL_CTX *s_ctx=NULL;
520  SSL_CTX *c_ctx=NULL;
521  const SSL_METHOD *meth=NULL;
522  SSL *c_ssl,*s_ssl;
523  int number=1,reuse=0;
524  long bytes=256L;
525 #ifndef OPENSSL_NO_DH
526  DH *dh;
527  int dhe1024 = 0, dhe1024dsa = 0;
528 #endif
529 #ifndef OPENSSL_NO_ECDH
530  EC_KEY *ecdh = NULL;
531 #endif
532 #ifndef OPENSSL_NO_SRP
533  /* client */
534  SRP_CLIENT_ARG srp_client_arg = {NULL,NULL};
535  /* server */
536  SRP_SERVER_ARG srp_server_arg = {NULL,NULL};
537 #endif
538  int no_dhe = 0;
539  int no_ecdhe = 0;
540  int no_psk = 0;
541  int print_time = 0;
542  clock_t s_time = 0, c_time = 0;
543  int comp = 0;
544 #ifndef OPENSSL_NO_COMP
545  COMP_METHOD *cm = NULL;
546 #endif
547  STACK_OF(SSL_COMP) *ssl_comp_methods = NULL;
548  int test_cipherlist = 0;
549 #ifdef OPENSSL_FIPS
550  int fips_mode=0;
551 #endif
552 
553  verbose = 0;
554  debug = 0;
555  cipher = 0;
556 
557  bio_err=BIO_new_fp(stderr,BIO_NOCLOSE|BIO_FP_TEXT);
558 
559  CRYPTO_set_locking_callback(lock_dbg_cb);
560 
561  /* enable memory leak checking unless explicitly disabled */
562  if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) && (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off"))))
563  {
564  CRYPTO_malloc_debug_init();
565  CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
566  }
567  else
568  {
569  /* OPENSSL_DEBUG_MEMORY=off */
570  CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0);
571  }
572  CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
573 
574  RAND_seed(rnd_seed, sizeof rnd_seed);
575 
576  bio_stdout=BIO_new_fp(stdout,BIO_NOCLOSE|BIO_FP_TEXT);
577 
578  argc--;
579  argv++;
580 
581  while (argc >= 1)
582  {
583  if(!strcmp(*argv,"-F"))
584  {
585 #ifdef OPENSSL_FIPS
586  fips_mode=1;
587 #else
588  fprintf(stderr,"not compiled with FIPS support, so exitting without running.\n");
589  EXIT(0);
590 #endif
591  }
592  else if (strcmp(*argv,"-server_auth") == 0)
593  server_auth=1;
594  else if (strcmp(*argv,"-client_auth") == 0)
595  client_auth=1;
596  else if (strcmp(*argv,"-proxy_auth") == 0)
597  {
598  if (--argc < 1) goto bad;
599  app_verify_arg.proxy_auth= *(++argv);
600  }
601  else if (strcmp(*argv,"-proxy_cond") == 0)
602  {
603  if (--argc < 1) goto bad;
604  app_verify_arg.proxy_cond= *(++argv);
605  }
606  else if (strcmp(*argv,"-v") == 0)
607  verbose=1;
608  else if (strcmp(*argv,"-d") == 0)
609  debug=1;
610  else if (strcmp(*argv,"-reuse") == 0)
611  reuse=1;
612  else if (strcmp(*argv,"-dhe1024") == 0)
613  {
614 #ifndef OPENSSL_NO_DH
615  dhe1024=1;
616 #else
617  fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
618 #endif
619  }
620  else if (strcmp(*argv,"-dhe1024dsa") == 0)
621  {
622 #ifndef OPENSSL_NO_DH
623  dhe1024dsa=1;
624 #else
625  fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
626 #endif
627  }
628  else if (strcmp(*argv,"-no_dhe") == 0)
629  no_dhe=1;
630  else if (strcmp(*argv,"-no_ecdhe") == 0)
631  no_ecdhe=1;
632  else if (strcmp(*argv,"-psk") == 0)
633  {
634  if (--argc < 1) goto bad;
635  psk_key=*(++argv);
636 #ifndef OPENSSL_NO_PSK
637  if (strspn(psk_key, "abcdefABCDEF1234567890") != strlen(psk_key))
638  {
639  BIO_printf(bio_err,"Not a hex number '%s'\n",*argv);
640  goto bad;
641  }
642 #else
643  no_psk=1;
644 #endif
645  }
646 #ifndef OPENSSL_NO_SRP
647  else if (strcmp(*argv,"-srpuser") == 0)
648  {
649  if (--argc < 1) goto bad;
650  srp_server_arg.expected_user = srp_client_arg.srplogin= *(++argv);
651  tls1=1;
652  }
653  else if (strcmp(*argv,"-srppass") == 0)
654  {
655  if (--argc < 1) goto bad;
656  srp_server_arg.pass = srp_client_arg.srppassin= *(++argv);
657  tls1=1;
658  }
659 #endif
660  else if (strcmp(*argv,"-ssl2") == 0)
661  ssl2=1;
662  else if (strcmp(*argv,"-tls1") == 0)
663  tls1=1;
664  else if (strcmp(*argv,"-ssl3") == 0)
665  ssl3=1;
666  else if (strncmp(*argv,"-num",4) == 0)
667  {
668  if (--argc < 1) goto bad;
669  number= atoi(*(++argv));
670  if (number == 0) number=1;
671  }
672  else if (strcmp(*argv,"-bytes") == 0)
673  {
674  if (--argc < 1) goto bad;
675  bytes= atol(*(++argv));
676  if (bytes == 0L) bytes=1L;
677  i=strlen(argv[0]);
678  if (argv[0][i-1] == 'k') bytes*=1024L;
679  if (argv[0][i-1] == 'm') bytes*=1024L*1024L;
680  }
681  else if (strcmp(*argv,"-cert") == 0)
682  {
683  if (--argc < 1) goto bad;
684  server_cert= *(++argv);
685  }
686  else if (strcmp(*argv,"-s_cert") == 0)
687  {
688  if (--argc < 1) goto bad;
689  server_cert= *(++argv);
690  }
691  else if (strcmp(*argv,"-key") == 0)
692  {
693  if (--argc < 1) goto bad;
694  server_key= *(++argv);
695  }
696  else if (strcmp(*argv,"-s_key") == 0)
697  {
698  if (--argc < 1) goto bad;
699  server_key= *(++argv);
700  }
701  else if (strcmp(*argv,"-c_cert") == 0)
702  {
703  if (--argc < 1) goto bad;
704  client_cert= *(++argv);
705  }
706  else if (strcmp(*argv,"-c_key") == 0)
707  {
708  if (--argc < 1) goto bad;
709  client_key= *(++argv);
710  }
711  else if (strcmp(*argv,"-cipher") == 0)
712  {
713  if (--argc < 1) goto bad;
714  cipher= *(++argv);
715  }
716  else if (strcmp(*argv,"-CApath") == 0)
717  {
718  if (--argc < 1) goto bad;
719  CApath= *(++argv);
720  }
721  else if (strcmp(*argv,"-CAfile") == 0)
722  {
723  if (--argc < 1) goto bad;
724  CAfile= *(++argv);
725  }
726  else if (strcmp(*argv,"-bio_pair") == 0)
727  {
728  bio_pair = 1;
729  }
730  else if (strcmp(*argv,"-f") == 0)
731  {
732  force = 1;
733  }
734  else if (strcmp(*argv,"-time") == 0)
735  {
736  print_time = 1;
737  }
738  else if (strcmp(*argv,"-zlib") == 0)
739  {
740  comp = COMP_ZLIB;
741  }
742  else if (strcmp(*argv,"-rle") == 0)
743  {
744  comp = COMP_RLE;
745  }
746  else if (strcmp(*argv,"-named_curve") == 0)
747  {
748  if (--argc < 1) goto bad;
749 #ifndef OPENSSL_NO_ECDH
750  named_curve = *(++argv);
751 #else
752  fprintf(stderr,"ignoring -named_curve, since I'm compiled without ECDH\n");
753  ++argv;
754 #endif
755  }
756  else if (strcmp(*argv,"-app_verify") == 0)
757  {
758  app_verify_arg.app_verify = 1;
759  }
760  else if (strcmp(*argv,"-proxy") == 0)
761  {
762  app_verify_arg.allow_proxy_certs = 1;
763  }
764  else if (strcmp(*argv,"-test_cipherlist") == 0)
765  {
766  test_cipherlist = 1;
767  }
768  else
769  {
770  fprintf(stderr,"unknown option %s\n",*argv);
771  badop=1;
772  break;
773  }
774  argc--;
775  argv++;
776  }
777  if (badop)
778  {
779 bad:
780  sv_usage();
781  goto end;
782  }
783 
784  if (test_cipherlist == 1)
785  {
786  /* ensure that the cipher list are correctly sorted and exit */
787  if (do_test_cipherlist() == 0)
788  EXIT(1);
789  ret = 0;
790  goto end;
791  }
792 
793  if (!ssl2 && !ssl3 && !tls1 && number > 1 && !reuse && !force)
794  {
795  fprintf(stderr, "This case cannot work. Use -f to perform "
796  "the test anyway (and\n-d to see what happens), "
797  "or add one of -ssl2, -ssl3, -tls1, -reuse\n"
798  "to avoid protocol mismatch.\n");
799  EXIT(1);
800  }
801 
802 #ifdef OPENSSL_FIPS
803  if(fips_mode)
804  {
805  if(!FIPS_mode_set(1))
806  {
807  ERR_load_crypto_strings();
808  ERR_print_errors(BIO_new_fp(stderr,BIO_NOCLOSE));
809  EXIT(1);
810  }
811  else
812  fprintf(stderr,"*** IN FIPS MODE ***\n");
813  }
814 #endif
815 
816  if (print_time)
817  {
818  if (!bio_pair)
819  {
820  fprintf(stderr, "Using BIO pair (-bio_pair)\n");
821  bio_pair = 1;
822  }
823  if (number < 50 && !force)
824  fprintf(stderr, "Warning: For accurate timings, use more connections (e.g. -num 1000)\n");
825  }
826 
827 /* if (cipher == NULL) cipher=getenv("SSL_CIPHER"); */
828 
829  SSL_library_init();
830  SSL_load_error_strings();
831 
832 #ifndef OPENSSL_NO_COMP
833  if (comp == COMP_ZLIB) cm = COMP_zlib();
834  if (comp == COMP_RLE) cm = COMP_rle();
835  if (cm != NULL)
836  {
837  if (cm->type != NID_undef)
838  {
839  if (SSL_COMP_add_compression_method(comp, cm) != 0)
840  {
841  fprintf(stderr,
842  "Failed to add compression method\n");
843  ERR_print_errors_fp(stderr);
844  }
845  }
846  else
847  {
848  fprintf(stderr,
849  "Warning: %s compression not supported\n",
850  (comp == COMP_RLE ? "rle" :
851  (comp == COMP_ZLIB ? "zlib" :
852  "unknown")));
853  ERR_print_errors_fp(stderr);
854  }
855  }
856  ssl_comp_methods = SSL_COMP_get_compression_methods();
857  fprintf(stderr, "Available compression methods:\n");
858  {
859  int j, n = sk_SSL_COMP_num(ssl_comp_methods);
860  if (n == 0)
861  fprintf(stderr, " NONE\n");
862  else
863  for (j = 0; j < n; j++)
864  {
865  SSL_COMP *c = sk_SSL_COMP_value(ssl_comp_methods, j);
866  fprintf(stderr, " %d: %s\n", c->id, c->name);
867  }
868  }
869 #endif
870 
871 #if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
872  if (ssl2)
873  meth=SSLv2_method();
874  else
875  if (tls1)
876  meth=TLSv1_method();
877  else
878  if (ssl3)
879  meth=SSLv3_method();
880  else
881  meth=SSLv23_method();
882 #else
883 #ifdef OPENSSL_NO_SSL2
884  meth=SSLv3_method();
885 #else
886  meth=SSLv2_method();
887 #endif
888 #endif
889 
890  c_ctx=SSL_CTX_new(meth);
891  s_ctx=SSL_CTX_new(meth);
892  if ((c_ctx == NULL) || (s_ctx == NULL))
893  {
894  ERR_print_errors(bio_err);
895  goto end;
896  }
897 
898  if (cipher != NULL)
899  {
900  SSL_CTX_set_cipher_list(c_ctx,cipher);
901  SSL_CTX_set_cipher_list(s_ctx,cipher);
902  }
903 
904 #ifndef OPENSSL_NO_DH
905  if (!no_dhe)
906  {
907  if (dhe1024dsa)
908  {
909  /* use SSL_OP_SINGLE_DH_USE to avoid small subgroup attacks */
910  SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
911  dh=get_dh1024dsa();
912  }
913  else if (dhe1024)
914  dh=get_dh1024();
915  else
916  dh=get_dh512();
917  SSL_CTX_set_tmp_dh(s_ctx,dh);
918  DH_free(dh);
919  }
920 #else
921  (void)no_dhe;
922 #endif
923 
924 #ifndef OPENSSL_NO_ECDH
925  if (!no_ecdhe)
926  {
927  int nid;
928 
929  if (named_curve != NULL)
930  {
931  nid = OBJ_sn2nid(named_curve);
932  if (nid == 0)
933  {
934  BIO_printf(bio_err, "unknown curve name (%s)\n", named_curve);
935  goto end;
936  }
937  }
938  else
939 #ifdef OPENSSL_NO_EC2M
940  nid = NID_X9_62_prime256v1;
941 #else
942  nid = NID_sect163r2;
943 #endif
944 
945  ecdh = EC_KEY_new_by_curve_name(nid);
946  if (ecdh == NULL)
947  {
948  BIO_printf(bio_err, "unable to create curve\n");
949  goto end;
950  }
951 
952  SSL_CTX_set_tmp_ecdh(s_ctx, ecdh);
953  SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_ECDH_USE);
954  EC_KEY_free(ecdh);
955  }
956 #else
957  (void)no_ecdhe;
958 #endif
959 
960 #ifndef OPENSSL_NO_RSA
961  SSL_CTX_set_tmp_rsa_callback(s_ctx,tmp_rsa_cb);
962 #endif
963 
964 #ifdef TLSEXT_TYPE_opaque_prf_input
965  SSL_CTX_set_tlsext_opaque_prf_input_callback(c_ctx, opaque_prf_input_cb);
966  SSL_CTX_set_tlsext_opaque_prf_input_callback(s_ctx, opaque_prf_input_cb);
967  SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(c_ctx, &co1); /* or &co2 or NULL */
968  SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(s_ctx, &so1); /* or &so2 or NULL */
969 #endif
970 
971  if (!SSL_CTX_use_certificate_file(s_ctx,server_cert,SSL_FILETYPE_PEM))
972  {
973  ERR_print_errors(bio_err);
974  }
975  else if (!SSL_CTX_use_PrivateKey_file(s_ctx,
976  (server_key?server_key:server_cert), SSL_FILETYPE_PEM))
977  {
978  ERR_print_errors(bio_err);
979  goto end;
980  }
981 
982  if (client_auth)
983  {
984  SSL_CTX_use_certificate_file(c_ctx,client_cert,
985  SSL_FILETYPE_PEM);
986  SSL_CTX_use_PrivateKey_file(c_ctx,
987  (client_key?client_key:client_cert),
988  SSL_FILETYPE_PEM);
989  }
990 
991  if ( (!SSL_CTX_load_verify_locations(s_ctx,CAfile,CApath)) ||
992  (!SSL_CTX_set_default_verify_paths(s_ctx)) ||
993  (!SSL_CTX_load_verify_locations(c_ctx,CAfile,CApath)) ||
994  (!SSL_CTX_set_default_verify_paths(c_ctx)))
995  {
996  /* fprintf(stderr,"SSL_load_verify_locations\n"); */
997  ERR_print_errors(bio_err);
998  /* goto end; */
999  }
1000 
1001  if (client_auth)
1002  {
1003  BIO_printf(bio_err,"client authentication\n");
1004  SSL_CTX_set_verify(s_ctx,
1005  SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
1006  verify_callback);
1007  SSL_CTX_set_cert_verify_callback(s_ctx, app_verify_callback, &app_verify_arg);
1008  }
1009  if (server_auth)
1010  {
1011  BIO_printf(bio_err,"server authentication\n");
1012  SSL_CTX_set_verify(c_ctx,SSL_VERIFY_PEER,
1013  verify_callback);
1014  SSL_CTX_set_cert_verify_callback(c_ctx, app_verify_callback, &app_verify_arg);
1015  }
1016 
1017  {
1018  int session_id_context = 0;
1019  SSL_CTX_set_session_id_context(s_ctx, (void *)&session_id_context, sizeof session_id_context);
1020  }
1021 
1022  /* Use PSK only if PSK key is given */
1023  if (psk_key != NULL)
1024  {
1025  /* no_psk is used to avoid putting psk command to openssl tool */
1026  if (no_psk)
1027  {
1028  /* if PSK is not compiled in and psk key is
1029  * given, do nothing and exit successfully */
1030  ret=0;
1031  goto end;
1032  }
1033 #ifndef OPENSSL_NO_PSK
1034  SSL_CTX_set_psk_client_callback(c_ctx, psk_client_callback);
1035  SSL_CTX_set_psk_server_callback(s_ctx, psk_server_callback);
1036  if (debug)
1037  BIO_printf(bio_err,"setting PSK identity hint to s_ctx\n");
1038  if (!SSL_CTX_use_psk_identity_hint(s_ctx, "ctx server identity_hint"))
1039  {
1040  BIO_printf(bio_err,"error setting PSK identity hint to s_ctx\n");
1041  ERR_print_errors(bio_err);
1042  goto end;
1043  }
1044 #endif
1045  }
1046 #ifndef OPENSSL_NO_SRP
1047  if (srp_client_arg.srplogin)
1048  {
1049  if (!SSL_CTX_set_srp_username(c_ctx, srp_client_arg.srplogin))
1050  {
1051  BIO_printf(bio_err,"Unable to set SRP username\n");
1052  goto end;
1053  }
1054  SSL_CTX_set_srp_cb_arg(c_ctx,&srp_client_arg);
1055  SSL_CTX_set_srp_client_pwd_callback(c_ctx, ssl_give_srp_client_pwd_cb);
1056  /*SSL_CTX_set_srp_strength(c_ctx, srp_client_arg.strength);*/
1057  }
1058 
1059  if (srp_server_arg.expected_user != NULL)
1060  {
1061  SSL_CTX_set_verify(s_ctx,SSL_VERIFY_NONE,verify_callback);
1062  SSL_CTX_set_srp_cb_arg(s_ctx, &srp_server_arg);
1063  SSL_CTX_set_srp_username_callback(s_ctx, ssl_srp_server_param_cb);
1064  }
1065 #endif
1066 
1067  c_ssl=SSL_new(c_ctx);
1068  s_ssl=SSL_new(s_ctx);
1069 
1070 #ifndef OPENSSL_NO_KRB5
1071  if (c_ssl && c_ssl->kssl_ctx)
1072  {
1073  char localhost[MAXHOSTNAMELEN+2];
1074 
1075  if (gethostname(localhost, sizeof localhost-1) == 0)
1076  {
1077  localhost[sizeof localhost-1]='\0';
1078  if(strlen(localhost) == sizeof localhost-1)
1079  {
1080  BIO_printf(bio_err,"localhost name too long\n");
1081  goto end;
1082  }
1083  kssl_ctx_setstring(c_ssl->kssl_ctx, KSSL_SERVER,
1084  localhost);
1085  }
1086  }
1087 #endif /* OPENSSL_NO_KRB5 */
1088 
1089  for (i=0; i<number; i++)
1090  {
1091  if (!reuse) SSL_set_session(c_ssl,NULL);
1092  if (bio_pair)
1093  ret=doit_biopair(s_ssl,c_ssl,bytes,&s_time,&c_time);
1094  else
1095  ret=doit(s_ssl,c_ssl,bytes);
1096  }
1097 
1098  if (!verbose)
1099  {
1100  print_details(c_ssl, "");
1101  }
1102  if ((number > 1) || (bytes > 1L))
1103  BIO_printf(bio_stdout, "%d handshakes of %ld bytes done\n",number,bytes);
1104  if (print_time)
1105  {
1106 #ifdef CLOCKS_PER_SEC
1107  /* "To determine the time in seconds, the value returned
1108  * by the clock function should be divided by the value
1109  * of the macro CLOCKS_PER_SEC."
1110  * -- ISO/IEC 9899 */
1111  BIO_printf(bio_stdout, "Approximate total server time: %6.2f s\n"
1112  "Approximate total client time: %6.2f s\n",
1113  (double)s_time/CLOCKS_PER_SEC,
1114  (double)c_time/CLOCKS_PER_SEC);
1115 #else
1116  /* "`CLOCKS_PER_SEC' undeclared (first use this function)"
1117  * -- cc on NeXTstep/OpenStep */
1118  BIO_printf(bio_stdout,
1119  "Approximate total server time: %6.2f units\n"
1120  "Approximate total client time: %6.2f units\n",
1121  (double)s_time,
1122  (double)c_time);
1123 #endif
1124  }
1125 
1126  SSL_free(s_ssl);
1127  SSL_free(c_ssl);
1128 
1129 end:
1130  if (s_ctx != NULL) SSL_CTX_free(s_ctx);
1131  if (c_ctx != NULL) SSL_CTX_free(c_ctx);
1132 
1133  if (bio_stdout != NULL) BIO_free(bio_stdout);
1134 
1135 #ifndef OPENSSL_NO_RSA
1136  free_tmp_rsa();
1137 #endif
1138 #ifndef OPENSSL_NO_ENGINE
1139  ENGINE_cleanup();
1140 #endif
1141  CRYPTO_cleanup_all_ex_data();
1142  ERR_free_strings();
1143  ERR_remove_thread_state(NULL);
1144  EVP_cleanup();
1145  CRYPTO_mem_leaks(bio_err);
1146  if (bio_err != NULL) BIO_free(bio_err);
1147  EXIT(ret);
1148  return ret;
1149  }
1150 
1151 int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count,
1152  clock_t *s_time, clock_t *c_time)
1153  {
1154  long cw_num = count, cr_num = count, sw_num = count, sr_num = count;
1155  BIO *s_ssl_bio = NULL, *c_ssl_bio = NULL;
1156  BIO *server = NULL, *server_io = NULL, *client = NULL, *client_io = NULL;
1157  int ret = 1;
1158 
1159  size_t bufsiz = 256; /* small buffer for testing */
1160 
1161  if (!BIO_new_bio_pair(&server, bufsiz, &server_io, bufsiz))
1162  goto err;
1163  if (!BIO_new_bio_pair(&client, bufsiz, &client_io, bufsiz))
1164  goto err;
1165 
1166  s_ssl_bio = BIO_new(BIO_f_ssl());
1167  if (!s_ssl_bio)
1168  goto err;
1169 
1170  c_ssl_bio = BIO_new(BIO_f_ssl());
1171  if (!c_ssl_bio)
1172  goto err;
1173 
1174  SSL_set_connect_state(c_ssl);
1175  SSL_set_bio(c_ssl, client, client);
1176  (void)BIO_set_ssl(c_ssl_bio, c_ssl, BIO_NOCLOSE);
1177 
1178  SSL_set_accept_state(s_ssl);
1179  SSL_set_bio(s_ssl, server, server);
1180  (void)BIO_set_ssl(s_ssl_bio, s_ssl, BIO_NOCLOSE);
1181 
1182  do
1183  {
1184  /* c_ssl_bio: SSL filter BIO
1185  *
1186  * client: pseudo-I/O for SSL library
1187  *
1188  * client_io: client's SSL communication; usually to be
1189  * relayed over some I/O facility, but in this
1190  * test program, we're the server, too:
1191  *
1192  * server_io: server's SSL communication
1193  *
1194  * server: pseudo-I/O for SSL library
1195  *
1196  * s_ssl_bio: SSL filter BIO
1197  *
1198  * The client and the server each employ a "BIO pair":
1199  * client + client_io, server + server_io.
1200  * BIO pairs are symmetric. A BIO pair behaves similar
1201  * to a non-blocking socketpair (but both endpoints must
1202  * be handled by the same thread).
1203  * [Here we could connect client and server to the ends
1204  * of a single BIO pair, but then this code would be less
1205  * suitable as an example for BIO pairs in general.]
1206  *
1207  * Useful functions for querying the state of BIO pair endpoints:
1208  *
1209  * BIO_ctrl_pending(bio) number of bytes we can read now
1210  * BIO_ctrl_get_read_request(bio) number of bytes needed to fulfil
1211  * other side's read attempt
1212  * BIO_ctrl_get_write_guarantee(bio) number of bytes we can write now
1213  *
1214  * ..._read_request is never more than ..._write_guarantee;
1215  * it depends on the application which one you should use.
1216  */
1217 
1218  /* We have non-blocking behaviour throughout this test program, but
1219  * can be sure that there is *some* progress in each iteration; so
1220  * we don't have to worry about ..._SHOULD_READ or ..._SHOULD_WRITE
1221  * -- we just try everything in each iteration
1222  */
1223 
1224  {
1225  /* CLIENT */
1226 
1227  MS_STATIC char cbuf[1024*8];
1228  int i, r;
1229  clock_t c_clock = clock();
1230 
1231  memset(cbuf, 0, sizeof(cbuf));
1232 
1233  if (debug)
1234  if (SSL_in_init(c_ssl))
1235  printf("client waiting in SSL_connect - %s\n",
1236  SSL_state_string_long(c_ssl));
1237 
1238  if (cw_num > 0)
1239  {
1240  /* Write to server. */
1241 
1242  if (cw_num > (long)sizeof cbuf)
1243  i = sizeof cbuf;
1244  else
1245  i = (int)cw_num;
1246  r = BIO_write(c_ssl_bio, cbuf, i);
1247  if (r < 0)
1248  {
1249  if (!BIO_should_retry(c_ssl_bio))
1250  {
1251  fprintf(stderr,"ERROR in CLIENT\n");
1252  goto err;
1253  }
1254  /* BIO_should_retry(...) can just be ignored here.
1255  * The library expects us to call BIO_write with
1256  * the same arguments again, and that's what we will
1257  * do in the next iteration. */
1258  }
1259  else if (r == 0)
1260  {
1261  fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1262  goto err;
1263  }
1264  else
1265  {
1266  if (debug)
1267  printf("client wrote %d\n", r);
1268  cw_num -= r;
1269  }
1270  }
1271 
1272  if (cr_num > 0)
1273  {
1274  /* Read from server. */
1275 
1276  r = BIO_read(c_ssl_bio, cbuf, sizeof(cbuf));
1277  if (r < 0)
1278  {
1279  if (!BIO_should_retry(c_ssl_bio))
1280  {
1281  fprintf(stderr,"ERROR in CLIENT\n");
1282  goto err;
1283  }
1284  /* Again, "BIO_should_retry" can be ignored. */
1285  }
1286  else if (r == 0)
1287  {
1288  fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1289  goto err;
1290  }
1291  else
1292  {
1293  if (debug)
1294  printf("client read %d\n", r);
1295  cr_num -= r;
1296  }
1297  }
1298 
1299  /* c_time and s_time increments will typically be very small
1300  * (depending on machine speed and clock tick intervals),
1301  * but sampling over a large number of connections should
1302  * result in fairly accurate figures. We cannot guarantee
1303  * a lot, however -- if each connection lasts for exactly
1304  * one clock tick, it will be counted only for the client
1305  * or only for the server or even not at all.
1306  */
1307  *c_time += (clock() - c_clock);
1308  }
1309 
1310  {
1311  /* SERVER */
1312 
1313  MS_STATIC char sbuf[1024*8];
1314  int i, r;
1315  clock_t s_clock = clock();
1316 
1317  memset(sbuf, 0, sizeof(sbuf));
1318 
1319  if (debug)
1320  if (SSL_in_init(s_ssl))
1321  printf("server waiting in SSL_accept - %s\n",
1322  SSL_state_string_long(s_ssl));
1323 
1324  if (sw_num > 0)
1325  {
1326  /* Write to client. */
1327 
1328  if (sw_num > (long)sizeof sbuf)
1329  i = sizeof sbuf;
1330  else
1331  i = (int)sw_num;
1332  r = BIO_write(s_ssl_bio, sbuf, i);
1333  if (r < 0)
1334  {
1335  if (!BIO_should_retry(s_ssl_bio))
1336  {
1337  fprintf(stderr,"ERROR in SERVER\n");
1338  goto err;
1339  }
1340  /* Ignore "BIO_should_retry". */
1341  }
1342  else if (r == 0)
1343  {
1344  fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1345  goto err;
1346  }
1347  else
1348  {
1349  if (debug)
1350  printf("server wrote %d\n", r);
1351  sw_num -= r;
1352  }
1353  }
1354 
1355  if (sr_num > 0)
1356  {
1357  /* Read from client. */
1358 
1359  r = BIO_read(s_ssl_bio, sbuf, sizeof(sbuf));
1360  if (r < 0)
1361  {
1362  if (!BIO_should_retry(s_ssl_bio))
1363  {
1364  fprintf(stderr,"ERROR in SERVER\n");
1365  goto err;
1366  }
1367  /* blah, blah */
1368  }
1369  else if (r == 0)
1370  {
1371  fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1372  goto err;
1373  }
1374  else
1375  {
1376  if (debug)
1377  printf("server read %d\n", r);
1378  sr_num -= r;
1379  }
1380  }
1381 
1382  *s_time += (clock() - s_clock);
1383  }
1384 
1385  {
1386  /* "I/O" BETWEEN CLIENT AND SERVER. */
1387 
1388  size_t r1, r2;
1389  BIO *io1 = server_io, *io2 = client_io;
1390  /* we use the non-copying interface for io1
1391  * and the standard BIO_write/BIO_read interface for io2
1392  */
1393 
1394  static int prev_progress = 1;
1395  int progress = 0;
1396 
1397  /* io1 to io2 */
1398  do
1399  {
1400  size_t num;
1401  int r;
1402 
1403  r1 = BIO_ctrl_pending(io1);
1404  r2 = BIO_ctrl_get_write_guarantee(io2);
1405 
1406  num = r1;
1407  if (r2 < num)
1408  num = r2;
1409  if (num)
1410  {
1411  char *dataptr;
1412 
1413  if (INT_MAX < num) /* yeah, right */
1414  num = INT_MAX;
1415 
1416  r = BIO_nread(io1, &dataptr, (int)num);
1417  assert(r > 0);
1418  assert(r <= (int)num);
1419  /* possibly r < num (non-contiguous data) */
1420  num = r;
1421  r = BIO_write(io2, dataptr, (int)num);
1422  if (r != (int)num) /* can't happen */
1423  {
1424  fprintf(stderr, "ERROR: BIO_write could not write "
1425  "BIO_ctrl_get_write_guarantee() bytes");
1426  goto err;
1427  }
1428  progress = 1;
1429 
1430  if (debug)
1431  printf((io1 == client_io) ?
1432  "C->S relaying: %d bytes\n" :
1433  "S->C relaying: %d bytes\n",
1434  (int)num);
1435  }
1436  }
1437  while (r1 && r2);
1438 
1439  /* io2 to io1 */
1440  {
1441  size_t num;
1442  int r;
1443 
1444  r1 = BIO_ctrl_pending(io2);
1445  r2 = BIO_ctrl_get_read_request(io1);
1446  /* here we could use ..._get_write_guarantee instead of
1447  * ..._get_read_request, but by using the latter
1448  * we test restartability of the SSL implementation
1449  * more thoroughly */
1450  num = r1;
1451  if (r2 < num)
1452  num = r2;
1453  if (num)
1454  {
1455  char *dataptr;
1456 
1457  if (INT_MAX < num)
1458  num = INT_MAX;
1459 
1460  if (num > 1)
1461  --num; /* test restartability even more thoroughly */
1462 
1463  r = BIO_nwrite0(io1, &dataptr);
1464  assert(r > 0);
1465  if (r < (int)num)
1466  num = r;
1467  r = BIO_read(io2, dataptr, (int)num);
1468  if (r != (int)num) /* can't happen */
1469  {
1470  fprintf(stderr, "ERROR: BIO_read could not read "
1471  "BIO_ctrl_pending() bytes");
1472  goto err;
1473  }
1474  progress = 1;
1475  r = BIO_nwrite(io1, &dataptr, (int)num);
1476  if (r != (int)num) /* can't happen */
1477  {
1478  fprintf(stderr, "ERROR: BIO_nwrite() did not accept "
1479  "BIO_nwrite0() bytes");
1480  goto err;
1481  }
1482 
1483  if (debug)
1484  printf((io2 == client_io) ?
1485  "C->S relaying: %d bytes\n" :
1486  "S->C relaying: %d bytes\n",
1487  (int)num);
1488  }
1489  } /* no loop, BIO_ctrl_get_read_request now returns 0 anyway */
1490 
1491  if (!progress && !prev_progress)
1492  if (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0)
1493  {
1494  fprintf(stderr, "ERROR: got stuck\n");
1495  if (strcmp("SSLv2", SSL_get_version(c_ssl)) == 0)
1496  {
1497  fprintf(stderr, "This can happen for SSL2 because "
1498  "CLIENT-FINISHED and SERVER-VERIFY are written \n"
1499  "concurrently ...");
1500  if (strncmp("2SCF", SSL_state_string(c_ssl), 4) == 0
1501  && strncmp("2SSV", SSL_state_string(s_ssl), 4) == 0)
1502  {
1503  fprintf(stderr, " ok.\n");
1504  goto end;
1505  }
1506  }
1507  fprintf(stderr, " ERROR.\n");
1508  goto err;
1509  }
1510  prev_progress = progress;
1511  }
1512  }
1513  while (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0);
1514 
1515  if (verbose)
1516  print_details(c_ssl, "DONE via BIO pair: ");
1517 end:
1518  ret = 0;
1519 
1520  err:
1521  ERR_print_errors(bio_err);
1522 
1523  if (server)
1524  BIO_free(server);
1525  if (server_io)
1526  BIO_free(server_io);
1527  if (client)
1528  BIO_free(client);
1529  if (client_io)
1530  BIO_free(client_io);
1531  if (s_ssl_bio)
1532  BIO_free(s_ssl_bio);
1533  if (c_ssl_bio)
1534  BIO_free(c_ssl_bio);
1535 
1536  return ret;
1537  }
1538 
1539 
1540 #define W_READ 1
1541 #define W_WRITE 2
1542 #define C_DONE 1
1543 #define S_DONE 2
1544 
1545 int doit(SSL *s_ssl, SSL *c_ssl, long count)
1546  {
1547  MS_STATIC char cbuf[1024*8],sbuf[1024*8];
1548  long cw_num=count,cr_num=count;
1549  long sw_num=count,sr_num=count;
1550  int ret=1;
1551  BIO *c_to_s=NULL;
1552  BIO *s_to_c=NULL;
1553  BIO *c_bio=NULL;
1554  BIO *s_bio=NULL;
1555  int c_r,c_w,s_r,s_w;
1556  int i,j;
1557  int done=0;
1558  int c_write,s_write;
1559  int do_server=0,do_client=0;
1560 
1561  memset(cbuf,0,sizeof(cbuf));
1562  memset(sbuf,0,sizeof(sbuf));
1563 
1564  c_to_s=BIO_new(BIO_s_mem());
1565  s_to_c=BIO_new(BIO_s_mem());
1566  if ((s_to_c == NULL) || (c_to_s == NULL))
1567  {
1568  ERR_print_errors(bio_err);
1569  goto err;
1570  }
1571 
1572  c_bio=BIO_new(BIO_f_ssl());
1573  s_bio=BIO_new(BIO_f_ssl());
1574  if ((c_bio == NULL) || (s_bio == NULL))
1575  {
1576  ERR_print_errors(bio_err);
1577  goto err;
1578  }
1579 
1580  SSL_set_connect_state(c_ssl);
1581  SSL_set_bio(c_ssl,s_to_c,c_to_s);
1582  BIO_set_ssl(c_bio,c_ssl,BIO_NOCLOSE);
1583 
1584  SSL_set_accept_state(s_ssl);
1585  SSL_set_bio(s_ssl,c_to_s,s_to_c);
1586  BIO_set_ssl(s_bio,s_ssl,BIO_NOCLOSE);
1587 
1588  c_r=0; s_r=1;
1589  c_w=1; s_w=0;
1590  c_write=1,s_write=0;
1591 
1592  /* We can always do writes */
1593  for (;;)
1594  {
1595  do_server=0;
1596  do_client=0;
1597 
1598  i=(int)BIO_pending(s_bio);
1599  if ((i && s_r) || s_w) do_server=1;
1600 
1601  i=(int)BIO_pending(c_bio);
1602  if ((i && c_r) || c_w) do_client=1;
1603 
1604  if (do_server && debug)
1605  {
1606  if (SSL_in_init(s_ssl))
1607  printf("server waiting in SSL_accept - %s\n",
1608  SSL_state_string_long(s_ssl));
1609 /* else if (s_write)
1610  printf("server:SSL_write()\n");
1611  else
1612  printf("server:SSL_read()\n"); */
1613  }
1614 
1615  if (do_client && debug)
1616  {
1617  if (SSL_in_init(c_ssl))
1618  printf("client waiting in SSL_connect - %s\n",
1619  SSL_state_string_long(c_ssl));
1620 /* else if (c_write)
1621  printf("client:SSL_write()\n");
1622  else
1623  printf("client:SSL_read()\n"); */
1624  }
1625 
1626  if (!do_client && !do_server)
1627  {
1628  fprintf(stdout,"ERROR IN STARTUP\n");
1629  ERR_print_errors(bio_err);
1630  break;
1631  }
1632  if (do_client && !(done & C_DONE))
1633  {
1634  if (c_write)
1635  {
1636  j = (cw_num > (long)sizeof(cbuf)) ?
1637  (int)sizeof(cbuf) : (int)cw_num;
1638  i=BIO_write(c_bio,cbuf,j);
1639  if (i < 0)
1640  {
1641  c_r=0;
1642  c_w=0;
1643  if (BIO_should_retry(c_bio))
1644  {
1645  if (BIO_should_read(c_bio))
1646  c_r=1;
1647  if (BIO_should_write(c_bio))
1648  c_w=1;
1649  }
1650  else
1651  {
1652  fprintf(stderr,"ERROR in CLIENT\n");
1653  ERR_print_errors(bio_err);
1654  goto err;
1655  }
1656  }
1657  else if (i == 0)
1658  {
1659  fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1660  goto err;
1661  }
1662  else
1663  {
1664  if (debug)
1665  printf("client wrote %d\n",i);
1666  /* ok */
1667  s_r=1;
1668  c_write=0;
1669  cw_num-=i;
1670  }
1671  }
1672  else
1673  {
1674  i=BIO_read(c_bio,cbuf,sizeof(cbuf));
1675  if (i < 0)
1676  {
1677  c_r=0;
1678  c_w=0;
1679  if (BIO_should_retry(c_bio))
1680  {
1681  if (BIO_should_read(c_bio))
1682  c_r=1;
1683  if (BIO_should_write(c_bio))
1684  c_w=1;
1685  }
1686  else
1687  {
1688  fprintf(stderr,"ERROR in CLIENT\n");
1689  ERR_print_errors(bio_err);
1690  goto err;
1691  }
1692  }
1693  else if (i == 0)
1694  {
1695  fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1696  goto err;
1697  }
1698  else
1699  {
1700  if (debug)
1701  printf("client read %d\n",i);
1702  cr_num-=i;
1703  if (sw_num > 0)
1704  {
1705  s_write=1;
1706  s_w=1;
1707  }
1708  if (cr_num <= 0)
1709  {
1710  s_write=1;
1711  s_w=1;
1712  done=S_DONE|C_DONE;
1713  }
1714  }
1715  }
1716  }
1717 
1718  if (do_server && !(done & S_DONE))
1719  {
1720  if (!s_write)
1721  {
1722  i=BIO_read(s_bio,sbuf,sizeof(cbuf));
1723  if (i < 0)
1724  {
1725  s_r=0;
1726  s_w=0;
1727  if (BIO_should_retry(s_bio))
1728  {
1729  if (BIO_should_read(s_bio))
1730  s_r=1;
1731  if (BIO_should_write(s_bio))
1732  s_w=1;
1733  }
1734  else
1735  {
1736  fprintf(stderr,"ERROR in SERVER\n");
1737  ERR_print_errors(bio_err);
1738  goto err;
1739  }
1740  }
1741  else if (i == 0)
1742  {
1743  ERR_print_errors(bio_err);
1744  fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_read\n");
1745  goto err;
1746  }
1747  else
1748  {
1749  if (debug)
1750  printf("server read %d\n",i);
1751  sr_num-=i;
1752  if (cw_num > 0)
1753  {
1754  c_write=1;
1755  c_w=1;
1756  }
1757  if (sr_num <= 0)
1758  {
1759  s_write=1;
1760  s_w=1;
1761  c_write=0;
1762  }
1763  }
1764  }
1765  else
1766  {
1767  j = (sw_num > (long)sizeof(sbuf)) ?
1768  (int)sizeof(sbuf) : (int)sw_num;
1769  i=BIO_write(s_bio,sbuf,j);
1770  if (i < 0)
1771  {
1772  s_r=0;
1773  s_w=0;
1774  if (BIO_should_retry(s_bio))
1775  {
1776  if (BIO_should_read(s_bio))
1777  s_r=1;
1778  if (BIO_should_write(s_bio))
1779  s_w=1;
1780  }
1781  else
1782  {
1783  fprintf(stderr,"ERROR in SERVER\n");
1784  ERR_print_errors(bio_err);
1785  goto err;
1786  }
1787  }
1788  else if (i == 0)
1789  {
1790  ERR_print_errors(bio_err);
1791  fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_write\n");
1792  goto err;
1793  }
1794  else
1795  {
1796  if (debug)
1797  printf("server wrote %d\n",i);
1798  sw_num-=i;
1799  s_write=0;
1800  c_r=1;
1801  if (sw_num <= 0)
1802  done|=S_DONE;
1803  }
1804  }
1805  }
1806 
1807  if ((done & S_DONE) && (done & C_DONE)) break;
1808  }
1809 
1810  if (verbose)
1811  print_details(c_ssl, "DONE: ");
1812  ret=0;
1813 err:
1814  /* We have to set the BIO's to NULL otherwise they will be
1815  * OPENSSL_free()ed twice. Once when th s_ssl is SSL_free()ed and
1816  * again when c_ssl is SSL_free()ed.
1817  * This is a hack required because s_ssl and c_ssl are sharing the same
1818  * BIO structure and SSL_set_bio() and SSL_free() automatically
1819  * BIO_free non NULL entries.
1820  * You should not normally do this or be required to do this */
1821  if (s_ssl != NULL)
1822  {
1823  s_ssl->rbio=NULL;
1824  s_ssl->wbio=NULL;
1825  }
1826  if (c_ssl != NULL)
1827  {
1828  c_ssl->rbio=NULL;
1829  c_ssl->wbio=NULL;
1830  }
1831 
1832  if (c_to_s != NULL) BIO_free(c_to_s);
1833  if (s_to_c != NULL) BIO_free(s_to_c);
1834  if (c_bio != NULL) BIO_free_all(c_bio);
1835  if (s_bio != NULL) BIO_free_all(s_bio);
1836  return(ret);
1837  }
1838 
1839 static int get_proxy_auth_ex_data_idx(void)
1840  {
1841  static volatile int idx = -1;
1842  if (idx < 0)
1843  {
1844  CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
1845  if (idx < 0)
1846  {
1847  idx = X509_STORE_CTX_get_ex_new_index(0,
1848  "SSLtest for verify callback", NULL,NULL,NULL);
1849  }
1850  CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
1851  }
1852  return idx;
1853  }
1854 
1855 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
1856  {
1857  char *s,buf[256];
1858 
1859  s=X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),buf,
1860  sizeof buf);
1861  if (s != NULL)
1862  {
1863  if (ok)
1864  fprintf(stderr,"depth=%d %s\n",
1865  ctx->error_depth,buf);
1866  else
1867  {
1868  fprintf(stderr,"depth=%d error=%d %s\n",
1869  ctx->error_depth,ctx->error,buf);
1870  }
1871  }
1872 
1873  if (ok == 0)
1874  {
1875  fprintf(stderr,"Error string: %s\n",
1876  X509_verify_cert_error_string(ctx->error));
1877  switch (ctx->error)
1878  {
1879  case X509_V_ERR_CERT_NOT_YET_VALID:
1880  case X509_V_ERR_CERT_HAS_EXPIRED:
1881  case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
1882  fprintf(stderr," ... ignored.\n");
1883  ok=1;
1884  }
1885  }
1886 
1887  if (ok == 1)
1888  {
1889  X509 *xs = ctx->current_cert;
1890 #if 0
1891  X509 *xi = ctx->current_issuer;
1892 #endif
1893 
1894  if (xs->ex_flags & EXFLAG_PROXY)
1895  {
1896  unsigned int *letters =
1897  X509_STORE_CTX_get_ex_data(ctx,
1898  get_proxy_auth_ex_data_idx());
1899 
1900  if (letters)
1901  {
1902  int found_any = 0;
1903  int i;
1904  PROXY_CERT_INFO_EXTENSION *pci =
1905  X509_get_ext_d2i(xs, NID_proxyCertInfo,
1906  NULL, NULL);
1907 
1908  switch (OBJ_obj2nid(pci->proxyPolicy->policyLanguage))
1909  {
1910  case NID_Independent:
1911  /* Completely meaningless in this
1912  program, as there's no way to
1913  grant explicit rights to a
1914  specific PrC. Basically, using
1915  id-ppl-Independent is the perfect
1916  way to grant no rights at all. */
1917  fprintf(stderr, " Independent proxy certificate");
1918  for (i = 0; i < 26; i++)
1919  letters[i] = 0;
1920  break;
1921  case NID_id_ppl_inheritAll:
1922  /* This is basically a NOP, we
1923  simply let the current rights
1924  stand as they are. */
1925  fprintf(stderr, " Proxy certificate inherits all");
1926  break;
1927  default:
1928  s = (char *)
1929  pci->proxyPolicy->policy->data;
1930  i = pci->proxyPolicy->policy->length;
1931 
1932  /* The algorithm works as follows:
1933  it is assumed that previous
1934  iterations or the initial granted
1935  rights has already set some elements
1936  of `letters'. What we need to do is
1937  to clear those that weren't granted
1938  by the current PrC as well. The
1939  easiest way to do this is to add 1
1940  to all the elements whose letters
1941  are given with the current policy.
1942  That way, all elements that are set
1943  by the current policy and were
1944  already set by earlier policies and
1945  through the original grant of rights
1946  will get the value 2 or higher.
1947  The last thing to do is to sweep
1948  through `letters' and keep the
1949  elements having the value 2 as set,
1950  and clear all the others. */
1951 
1952  fprintf(stderr, " Certificate proxy rights = %*.*s", i, i, s);
1953  while(i-- > 0)
1954  {
1955  int c = *s++;
1956  if (isascii(c) && isalpha(c))
1957  {
1958  if (islower(c))
1959  c = toupper(c);
1960  letters[c - 'A']++;
1961  }
1962  }
1963  for (i = 0; i < 26; i++)
1964  if (letters[i] < 2)
1965  letters[i] = 0;
1966  else
1967  letters[i] = 1;
1968  }
1969 
1970  found_any = 0;
1971  fprintf(stderr,
1972  ", resulting proxy rights = ");
1973  for(i = 0; i < 26; i++)
1974  if (letters[i])
1975  {
1976  fprintf(stderr, "%c", i + 'A');
1977  found_any = 1;
1978  }
1979  if (!found_any)
1980  fprintf(stderr, "none");
1981  fprintf(stderr, "\n");
1982 
1983  PROXY_CERT_INFO_EXTENSION_free(pci);
1984  }
1985  }
1986  }
1987 
1988  return(ok);
1989  }
1990 
1991 static void process_proxy_debug(int indent, const char *format, ...)
1992  {
1993  static const char indentation[] =
1994  ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"
1995  ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"; /* That's 80 > */
1996  char my_format[256];
1997  va_list args;
1998 
1999  BIO_snprintf(my_format, sizeof(my_format), "%*.*s %s",
2000  indent, indent, indentation, format);
2001 
2002  va_start(args, format);
2003  vfprintf(stderr, my_format, args);
2004  va_end(args);
2005  }
2006 /* Priority levels:
2007  0 [!]var, ()
2008  1 & ^
2009  2 |
2010 */
2011 static int process_proxy_cond_adders(unsigned int letters[26],
2012  const char *cond, const char **cond_end, int *pos, int indent);
2013 static int process_proxy_cond_val(unsigned int letters[26],
2014  const char *cond, const char **cond_end, int *pos, int indent)
2015  {
2016  int c;
2017  int ok = 1;
2018  int negate = 0;
2019 
2020  while(isspace((int)*cond))
2021  {
2022  cond++; (*pos)++;
2023  }
2024  c = *cond;
2025 
2026  if (debug)
2027  process_proxy_debug(indent,
2028  "Start process_proxy_cond_val at position %d: %s\n",
2029  *pos, cond);
2030 
2031  while(c == '!')
2032  {
2033  negate = !negate;
2034  cond++; (*pos)++;
2035  while(isspace((int)*cond))
2036  {
2037  cond++; (*pos)++;
2038  }
2039  c = *cond;
2040  }
2041 
2042  if (c == '(')
2043  {
2044  cond++; (*pos)++;
2045  ok = process_proxy_cond_adders(letters, cond, cond_end, pos,
2046  indent + 1);
2047  cond = *cond_end;
2048  if (ok < 0)
2049  goto end;
2050  while(isspace((int)*cond))
2051  {
2052  cond++; (*pos)++;
2053  }
2054  c = *cond;
2055  if (c != ')')
2056  {
2057  fprintf(stderr,
2058  "Weird condition character in position %d: "
2059  "%c\n", *pos, c);
2060  ok = -1;
2061  goto end;
2062  }
2063  cond++; (*pos)++;
2064  }
2065  else if (isascii(c) && isalpha(c))
2066  {
2067  if (islower(c))
2068  c = toupper(c);
2069  ok = letters[c - 'A'];
2070  cond++; (*pos)++;
2071  }
2072  else
2073  {
2074  fprintf(stderr,
2075  "Weird condition character in position %d: "
2076  "%c\n", *pos, c);
2077  ok = -1;
2078  goto end;
2079  }
2080  end:
2081  *cond_end = cond;
2082  if (ok >= 0 && negate)
2083  ok = !ok;
2084 
2085  if (debug)
2086  process_proxy_debug(indent,
2087  "End process_proxy_cond_val at position %d: %s, returning %d\n",
2088  *pos, cond, ok);
2089 
2090  return ok;
2091  }
2092 static int process_proxy_cond_multipliers(unsigned int letters[26],
2093  const char *cond, const char **cond_end, int *pos, int indent)
2094  {
2095  int ok;
2096  char c;
2097 
2098  if (debug)
2099  process_proxy_debug(indent,
2100  "Start process_proxy_cond_multipliers at position %d: %s\n",
2101  *pos, cond);
2102 
2103  ok = process_proxy_cond_val(letters, cond, cond_end, pos, indent + 1);
2104  cond = *cond_end;
2105  if (ok < 0)
2106  goto end;
2107 
2108  while(ok >= 0)
2109  {
2110  while(isspace((int)*cond))
2111  {
2112  cond++; (*pos)++;
2113  }
2114  c = *cond;
2115 
2116  switch(c)
2117  {
2118  case '&':
2119  case '^':
2120  {
2121  int save_ok = ok;
2122 
2123  cond++; (*pos)++;
2124  ok = process_proxy_cond_val(letters,
2125  cond, cond_end, pos, indent + 1);
2126  cond = *cond_end;
2127  if (ok < 0)
2128  break;
2129 
2130  switch(c)
2131  {
2132  case '&':
2133  ok &= save_ok;
2134  break;
2135  case '^':
2136  ok ^= save_ok;
2137  break;
2138  default:
2139  fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
2140  " STOPPING\n");
2141  EXIT(1);
2142  }
2143  }
2144  break;
2145  default:
2146  goto end;
2147  }
2148  }
2149  end:
2150  if (debug)
2151  process_proxy_debug(indent,
2152  "End process_proxy_cond_multipliers at position %d: %s, returning %d\n",
2153  *pos, cond, ok);
2154 
2155  *cond_end = cond;
2156  return ok;
2157  }
2158 static int process_proxy_cond_adders(unsigned int letters[26],
2159  const char *cond, const char **cond_end, int *pos, int indent)
2160  {
2161  int ok;
2162  char c;
2163 
2164  if (debug)
2165  process_proxy_debug(indent,
2166  "Start process_proxy_cond_adders at position %d: %s\n",
2167  *pos, cond);
2168 
2169  ok = process_proxy_cond_multipliers(letters, cond, cond_end, pos,
2170  indent + 1);
2171  cond = *cond_end;
2172  if (ok < 0)
2173  goto end;
2174 
2175  while(ok >= 0)
2176  {
2177  while(isspace((int)*cond))
2178  {
2179  cond++; (*pos)++;
2180  }
2181  c = *cond;
2182 
2183  switch(c)
2184  {
2185  case '|':
2186  {
2187  int save_ok = ok;
2188 
2189  cond++; (*pos)++;
2190  ok = process_proxy_cond_multipliers(letters,
2191  cond, cond_end, pos, indent + 1);
2192  cond = *cond_end;
2193  if (ok < 0)
2194  break;
2195 
2196  switch(c)
2197  {
2198  case '|':
2199  ok |= save_ok;
2200  break;
2201  default:
2202  fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
2203  " STOPPING\n");
2204  EXIT(1);
2205  }
2206  }
2207  break;
2208  default:
2209  goto end;
2210  }
2211  }
2212  end:
2213  if (debug)
2214  process_proxy_debug(indent,
2215  "End process_proxy_cond_adders at position %d: %s, returning %d\n",
2216  *pos, cond, ok);
2217 
2218  *cond_end = cond;
2219  return ok;
2220  }
2221 
2222 static int process_proxy_cond(unsigned int letters[26],
2223  const char *cond, const char **cond_end)
2224  {
2225  int pos = 1;
2226  return process_proxy_cond_adders(letters, cond, cond_end, &pos, 1);
2227  }
2228 
2229 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg)
2230  {
2231  int ok=1;
2232  struct app_verify_arg *cb_arg = arg;
2233  unsigned int letters[26]; /* only used with proxy_auth */
2234 
2235  if (cb_arg->app_verify)
2236  {
2237  char *s = NULL,buf[256];
2238 
2239  fprintf(stderr, "In app_verify_callback, allowing cert. ");
2240  fprintf(stderr, "Arg is: %s\n", cb_arg->string);
2241  fprintf(stderr, "Finished printing do we have a context? 0x%p a cert? 0x%p\n",
2242  (void *)ctx, (void *)ctx->cert);
2243  if (ctx->cert)
2244  s=X509_NAME_oneline(X509_get_subject_name(ctx->cert),buf,256);
2245  if (s != NULL)
2246  {
2247  fprintf(stderr,"cert depth=%d %s\n",ctx->error_depth,buf);
2248  }
2249  return(1);
2250  }
2251  if (cb_arg->proxy_auth)
2252  {
2253  int found_any = 0, i;
2254  char *sp;
2255 
2256  for(i = 0; i < 26; i++)
2257  letters[i] = 0;
2258  for(sp = cb_arg->proxy_auth; *sp; sp++)
2259  {
2260  int c = *sp;
2261  if (isascii(c) && isalpha(c))
2262  {
2263  if (islower(c))
2264  c = toupper(c);
2265  letters[c - 'A'] = 1;
2266  }
2267  }
2268 
2269  fprintf(stderr,
2270  " Initial proxy rights = ");
2271  for(i = 0; i < 26; i++)
2272  if (letters[i])
2273  {
2274  fprintf(stderr, "%c", i + 'A');
2275  found_any = 1;
2276  }
2277  if (!found_any)
2278  fprintf(stderr, "none");
2279  fprintf(stderr, "\n");
2280 
2281  X509_STORE_CTX_set_ex_data(ctx,
2282  get_proxy_auth_ex_data_idx(),letters);
2283  }
2284  if (cb_arg->allow_proxy_certs)
2285  {
2286  X509_STORE_CTX_set_flags(ctx, X509_V_FLAG_ALLOW_PROXY_CERTS);
2287  }
2288 
2289 #ifndef OPENSSL_NO_X509_VERIFY
2290  ok = X509_verify_cert(ctx);
2291 #endif
2292 
2293  if (cb_arg->proxy_auth)
2294  {
2295  if (ok > 0)
2296  {
2297  const char *cond_end = NULL;
2298 
2299  ok = process_proxy_cond(letters,
2300  cb_arg->proxy_cond, &cond_end);
2301 
2302  if (ok < 0)
2303  EXIT(3);
2304  if (*cond_end)
2305  {
2306  fprintf(stderr, "Stopped processing condition before it's end.\n");
2307  ok = 0;
2308  }
2309  if (!ok)
2310  fprintf(stderr, "Proxy rights check with condition '%s' proved invalid\n",
2311  cb_arg->proxy_cond);
2312  else
2313  fprintf(stderr, "Proxy rights check with condition '%s' proved valid\n",
2314  cb_arg->proxy_cond);
2315  }
2316  }
2317  return(ok);
2318  }
2319 
2320 #ifndef OPENSSL_NO_RSA
2321 static RSA *rsa_tmp=NULL;
2322 
2323 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength)
2324  {
2325  BIGNUM *bn = NULL;
2326  if (rsa_tmp == NULL)
2327  {
2328  bn = BN_new();
2329  rsa_tmp = RSA_new();
2330  if(!bn || !rsa_tmp || !BN_set_word(bn, RSA_F4))
2331  {
2332  BIO_printf(bio_err, "Memory error...");
2333  goto end;
2334  }
2335  BIO_printf(bio_err,"Generating temp (%d bit) RSA key...",keylength);
2336  (void)BIO_flush(bio_err);
2337  if(!RSA_generate_key_ex(rsa_tmp,keylength,bn,NULL))
2338  {
2339  BIO_printf(bio_err, "Error generating key.");
2340  RSA_free(rsa_tmp);
2341  rsa_tmp = NULL;
2342  }
2343 end:
2344  BIO_printf(bio_err,"\n");
2345  (void)BIO_flush(bio_err);
2346  }
2347  if(bn) BN_free(bn);
2348  return(rsa_tmp);
2349  }
2350 
2351 static void free_tmp_rsa(void)
2352  {
2353  if (rsa_tmp != NULL)
2354  {
2355  RSA_free(rsa_tmp);
2356  rsa_tmp = NULL;
2357  }
2358  }
2359 #endif
2360 
2361 #ifndef OPENSSL_NO_DH
2362 /* These DH parameters have been generated as follows:
2363  * $ openssl dhparam -C -noout 512
2364  * $ openssl dhparam -C -noout 1024
2365  * $ openssl dhparam -C -noout -dsaparam 1024
2366  * (The third function has been renamed to avoid name conflicts.)
2367  */
2368 static DH *get_dh512()
2369  {
2370  static unsigned char dh512_p[]={
2371  0xCB,0xC8,0xE1,0x86,0xD0,0x1F,0x94,0x17,0xA6,0x99,0xF0,0xC6,
2372  0x1F,0x0D,0xAC,0xB6,0x25,0x3E,0x06,0x39,0xCA,0x72,0x04,0xB0,
2373  0x6E,0xDA,0xC0,0x61,0xE6,0x7A,0x77,0x25,0xE8,0x3B,0xB9,0x5F,
2374  0x9A,0xB6,0xB5,0xFE,0x99,0x0B,0xA1,0x93,0x4E,0x35,0x33,0xB8,
2375  0xE1,0xF1,0x13,0x4F,0x59,0x1A,0xD2,0x57,0xC0,0x26,0x21,0x33,
2376  0x02,0xC5,0xAE,0x23,
2377  };
2378  static unsigned char dh512_g[]={
2379  0x02,
2380  };
2381  DH *dh;
2382 
2383  if ((dh=DH_new()) == NULL) return(NULL);
2384  dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
2385  dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
2386  if ((dh->p == NULL) || (dh->g == NULL))
2387  { DH_free(dh); return(NULL); }
2388  return(dh);
2389  }
2390 
2391 static DH *get_dh1024()
2392  {
2393  static unsigned char dh1024_p[]={
2394  0xF8,0x81,0x89,0x7D,0x14,0x24,0xC5,0xD1,0xE6,0xF7,0xBF,0x3A,
2395  0xE4,0x90,0xF4,0xFC,0x73,0xFB,0x34,0xB5,0xFA,0x4C,0x56,0xA2,
2396  0xEA,0xA7,0xE9,0xC0,0xC0,0xCE,0x89,0xE1,0xFA,0x63,0x3F,0xB0,
2397  0x6B,0x32,0x66,0xF1,0xD1,0x7B,0xB0,0x00,0x8F,0xCA,0x87,0xC2,
2398  0xAE,0x98,0x89,0x26,0x17,0xC2,0x05,0xD2,0xEC,0x08,0xD0,0x8C,
2399  0xFF,0x17,0x52,0x8C,0xC5,0x07,0x93,0x03,0xB1,0xF6,0x2F,0xB8,
2400  0x1C,0x52,0x47,0x27,0x1B,0xDB,0xD1,0x8D,0x9D,0x69,0x1D,0x52,
2401  0x4B,0x32,0x81,0xAA,0x7F,0x00,0xC8,0xDC,0xE6,0xD9,0xCC,0xC1,
2402  0x11,0x2D,0x37,0x34,0x6C,0xEA,0x02,0x97,0x4B,0x0E,0xBB,0xB1,
2403  0x71,0x33,0x09,0x15,0xFD,0xDD,0x23,0x87,0x07,0x5E,0x89,0xAB,
2404  0x6B,0x7C,0x5F,0xEC,0xA6,0x24,0xDC,0x53,
2405  };
2406  static unsigned char dh1024_g[]={
2407  0x02,
2408  };
2409  DH *dh;
2410 
2411  if ((dh=DH_new()) == NULL) return(NULL);
2412  dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2413  dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2414  if ((dh->p == NULL) || (dh->g == NULL))
2415  { DH_free(dh); return(NULL); }
2416  return(dh);
2417  }
2418 
2419 static DH *get_dh1024dsa()
2420  {
2421  static unsigned char dh1024_p[]={
2422  0xC8,0x00,0xF7,0x08,0x07,0x89,0x4D,0x90,0x53,0xF3,0xD5,0x00,
2423  0x21,0x1B,0xF7,0x31,0xA6,0xA2,0xDA,0x23,0x9A,0xC7,0x87,0x19,
2424  0x3B,0x47,0xB6,0x8C,0x04,0x6F,0xFF,0xC6,0x9B,0xB8,0x65,0xD2,
2425  0xC2,0x5F,0x31,0x83,0x4A,0xA7,0x5F,0x2F,0x88,0x38,0xB6,0x55,
2426  0xCF,0xD9,0x87,0x6D,0x6F,0x9F,0xDA,0xAC,0xA6,0x48,0xAF,0xFC,
2427  0x33,0x84,0x37,0x5B,0x82,0x4A,0x31,0x5D,0xE7,0xBD,0x52,0x97,
2428  0xA1,0x77,0xBF,0x10,0x9E,0x37,0xEA,0x64,0xFA,0xCA,0x28,0x8D,
2429  0x9D,0x3B,0xD2,0x6E,0x09,0x5C,0x68,0xC7,0x45,0x90,0xFD,0xBB,
2430  0x70,0xC9,0x3A,0xBB,0xDF,0xD4,0x21,0x0F,0xC4,0x6A,0x3C,0xF6,
2431  0x61,0xCF,0x3F,0xD6,0x13,0xF1,0x5F,0xBC,0xCF,0xBC,0x26,0x9E,
2432  0xBC,0x0B,0xBD,0xAB,0x5D,0xC9,0x54,0x39,
2433  };
2434  static unsigned char dh1024_g[]={
2435  0x3B,0x40,0x86,0xE7,0xF3,0x6C,0xDE,0x67,0x1C,0xCC,0x80,0x05,
2436  0x5A,0xDF,0xFE,0xBD,0x20,0x27,0x74,0x6C,0x24,0xC9,0x03,0xF3,
2437  0xE1,0x8D,0xC3,0x7D,0x98,0x27,0x40,0x08,0xB8,0x8C,0x6A,0xE9,
2438  0xBB,0x1A,0x3A,0xD6,0x86,0x83,0x5E,0x72,0x41,0xCE,0x85,0x3C,
2439  0xD2,0xB3,0xFC,0x13,0xCE,0x37,0x81,0x9E,0x4C,0x1C,0x7B,0x65,
2440  0xD3,0xE6,0xA6,0x00,0xF5,0x5A,0x95,0x43,0x5E,0x81,0xCF,0x60,
2441  0xA2,0x23,0xFC,0x36,0xA7,0x5D,0x7A,0x4C,0x06,0x91,0x6E,0xF6,
2442  0x57,0xEE,0x36,0xCB,0x06,0xEA,0xF5,0x3D,0x95,0x49,0xCB,0xA7,
2443  0xDD,0x81,0xDF,0x80,0x09,0x4A,0x97,0x4D,0xA8,0x22,0x72,0xA1,
2444  0x7F,0xC4,0x70,0x56,0x70,0xE8,0x20,0x10,0x18,0x8F,0x2E,0x60,
2445  0x07,0xE7,0x68,0x1A,0x82,0x5D,0x32,0xA2,
2446  };
2447  DH *dh;
2448 
2449  if ((dh=DH_new()) == NULL) return(NULL);
2450  dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2451  dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2452  if ((dh->p == NULL) || (dh->g == NULL))
2453  { DH_free(dh); return(NULL); }
2454  dh->length = 160;
2455  return(dh);
2456  }
2457 #endif
2458 
2459 #ifndef OPENSSL_NO_PSK
2460 /* convert the PSK key (psk_key) in ascii to binary (psk) */
2461 static int psk_key2bn(const char *pskkey, unsigned char *psk,
2462  unsigned int max_psk_len)
2463  {
2464  int ret;
2465  BIGNUM *bn = NULL;
2466 
2467  ret = BN_hex2bn(&bn, pskkey);
2468  if (!ret)
2469  {
2470  BIO_printf(bio_err,"Could not convert PSK key '%s' to BIGNUM\n", pskkey);
2471  if (bn)
2472  BN_free(bn);
2473  return 0;
2474  }
2475  if (BN_num_bytes(bn) > (int)max_psk_len)
2476  {
2477  BIO_printf(bio_err,"psk buffer of callback is too small (%d) for key (%d)\n",
2478  max_psk_len, BN_num_bytes(bn));
2479  BN_free(bn);
2480  return 0;
2481  }
2482  ret = BN_bn2bin(bn, psk);
2483  BN_free(bn);
2484  return ret;
2485  }
2486 
2487 static unsigned int psk_client_callback(SSL *ssl, const char *hint, char *identity,
2488  unsigned int max_identity_len, unsigned char *psk,
2489  unsigned int max_psk_len)
2490  {
2491  int ret;
2492  unsigned int psk_len = 0;
2493 
2494  ret = BIO_snprintf(identity, max_identity_len, "Client_identity");
2495  if (ret < 0)
2496  goto out_err;
2497  if (debug)
2498  fprintf(stderr, "client: created identity '%s' len=%d\n", identity, ret);
2499  ret = psk_key2bn(psk_key, psk, max_psk_len);
2500  if (ret < 0)
2501  goto out_err;
2502  psk_len = ret;
2503 out_err:
2504  return psk_len;
2505  }
2506 
2507 static unsigned int psk_server_callback(SSL *ssl, const char *identity,
2508  unsigned char *psk, unsigned int max_psk_len)
2509  {
2510  unsigned int psk_len=0;
2511 
2512  if (strcmp(identity, "Client_identity") != 0)
2513  {
2514  BIO_printf(bio_err, "server: PSK error: client identity not found\n");
2515  return 0;
2516  }
2517  psk_len=psk_key2bn(psk_key, psk, max_psk_len);
2518  return psk_len;
2519  }
2520 #endif
2521 
2522 static int do_test_cipherlist(void)
2523  {
2524  int i = 0;
2525  const SSL_METHOD *meth;
2526  const SSL_CIPHER *ci, *tci = NULL;
2527 
2528 #ifndef OPENSSL_NO_SSL2
2529  fprintf(stderr, "testing SSLv2 cipher list order: ");
2530  meth = SSLv2_method();
2531  while ((ci = meth->get_cipher(i++)) != NULL)
2532  {
2533  if (tci != NULL)
2534  if (ci->id >= tci->id)
2535  {
2536  fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2537  return 0;
2538  }
2539  tci = ci;
2540  }
2541  fprintf(stderr, "ok\n");
2542 #endif
2543 #ifndef OPENSSL_NO_SSL3
2544  fprintf(stderr, "testing SSLv3 cipher list order: ");
2545  meth = SSLv3_method();
2546  tci = NULL;
2547  while ((ci = meth->get_cipher(i++)) != NULL)
2548  {
2549  if (tci != NULL)
2550  if (ci->id >= tci->id)
2551  {
2552  fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2553  return 0;
2554  }
2555  tci = ci;
2556  }
2557  fprintf(stderr, "ok\n");
2558 #endif
2559 #ifndef OPENSSL_NO_TLS1
2560  fprintf(stderr, "testing TLSv1 cipher list order: ");
2561  meth = TLSv1_method();
2562  tci = NULL;
2563  while ((ci = meth->get_cipher(i++)) != NULL)
2564  {
2565  if (tci != NULL)
2566  if (ci->id >= tci->id)
2567  {
2568  fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2569  return 0;
2570  }
2571  tci = ci;
2572  }
2573  fprintf(stderr, "ok\n");
2574 #endif
2575 
2576  return 1;
2577  }
Generated on Thu Jan 10 2013 09:53:44 for OpenSSL by   doxygen 1.8.2