ssl/ssltest.c

   1 /* ssl/ssltest.c */
   2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
   3  * All rights reserved.
   4  *
   5  * This package is an SSL implementation written
   6  * by Eric Young (eay@cryptsoft.com).
   7  * The implementation was written so as to conform with Netscapes SSL.
   8  *
   9  * This library is free for commercial and non-commercial use as long as
  10  * the following conditions are aheared to.  The following conditions
  11  * apply to all code found in this distribution, be it the RC4, RSA,
  12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  13  * included with this distribution is covered by the same copyright terms
  14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
  15  *
  16  * Copyright remains Eric Young's, and as such any Copyright notices in
  17  * the code are not to be removed.
  18  * If this package is used in a product, Eric Young should be given attribution
  19  * as the author of the parts of the library used.
  20  * This can be in the form of a textual message at program startup or
  21  * in documentation (online or textual) provided with the package.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 3. All advertising materials mentioning features or use of this software
  32  *    must display the following acknowledgement:
  33  *    "This product includes cryptographic software written by
  34  *     Eric Young (eay@cryptsoft.com)"
  35  *    The word 'cryptographic' can be left out if the rouines from the library
  36  *    being used are not cryptographic related :-).
  37  * 4. If you include any Windows specific code (or a derivative thereof) from
  38  *    the apps directory (application code) you must include an acknowledgement:
  39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
  40  *
  41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  51  * SUCH DAMAGE.
  52  *
  53  * The licence and distribution terms for any publically available version or
  54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  55  * copied and put under another distribution licence
  56  * [including the GNU Public Licence.]
  57  */
  58 /* ====================================================================
  59  * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
  60  *
  61  * Redistribution and use in source and binary forms, with or without
  62  * modification, are permitted provided that the following conditions
  63  * are met:
  64  *
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  *
  68  * 2. Redistributions in binary form must reproduce the above copyright
  69  *    notice, this list of conditions and the following disclaimer in
  70  *    the documentation and/or other materials provided with the
  71  *    distribution.
  72  *
  73  * 3. All advertising materials mentioning features or use of this
  74  *    software must display the following acknowledgment:
  75  *    "This product includes software developed by the OpenSSL Project
  76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
  77  *
  78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  79  *    endorse or promote products derived from this software without
  80  *    prior written permission. For written permission, please contact
  81  *    openssl-core@openssl.org.
  82  *
  83  * 5. Products derived from this software may not be called "OpenSSL"
  84  *    nor may "OpenSSL" appear in their names without prior written
  85  *    permission of the OpenSSL Project.
  86  *
  87  * 6. Redistributions of any form whatsoever must retain the following
  88  *    acknowledgment:
  89  *    "This product includes software developed by the OpenSSL Project
  90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
  91  *
  92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
  96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 103  * OF THE POSSIBILITY OF SUCH DAMAGE.
 104  * ====================================================================
 105  *
 106  * This product includes cryptographic software written by Eric Young
 107  * (eay@cryptsoft.com).  This product includes software written by Tim
 108  * Hudson (tjh@cryptsoft.com).
 109  *
 110  */
 111
 112 #define _BSD_SOURCE 1           /* Or gethostname won't be declared properly
 113                                    on Linux and GNU platforms. */
 114
 115 #include <assert.h>
 116 #include <errno.h>
 117 #include <limits.h>
 118 #include <stdio.h>
 119 #include <stdlib.h>
 120 #include <string.h>
 121 #include <time.h>
 122
 123 #define USE_SOCKETS
 124 #include "e_os.h"
 125
 126 #define _XOPEN_SOURCE 1         /* Or isascii won't be declared properly on
 127                                    VMS (at least with DECompHP C).  */
 128 #include <ctype.h>
 129
 130 #include <openssl/bio.h>
 131 #include <openssl/crypto.h>
 132 #include <openssl/evp.h>
 133 #include <openssl/x509.h>
 134 #include <openssl/x509v3.h>
 135 #include <openssl/ssl.h>
 136 #ifndef OPENSSL_NO_ENGINE
 137 #include <openssl/engine.h>
 138 #endif
 139 #include <openssl/err.h>
 140 #include <openssl/rand.h>
 141 #include <openssl/fips.h>
 142
 143 #define _XOPEN_SOURCE_EXTENDED  1 /* Or gethostname won't be declared properly
 144                                      on Compaq platforms (at least with DEC C).
 145                                      Do not try to put it earlier, or IPv6 includes
 146                                      get screwed...
 147                                   */
 148
 149 #ifdef OPENSSL_SYS_WINDOWS
 150 #include <winsock.h>
 151 #else
 152 #include OPENSSL_UNISTD
 153 #endif
 154
 155 #ifdef OPENSSL_SYS_VMS
 156 #  define TEST_SERVER_CERT "SYS$DISK:[-.APPS]SERVER.PEM"
 157 #  define TEST_CLIENT_CERT "SYS$DISK:[-.APPS]CLIENT.PEM"
 158 #elif defined(OPENSSL_SYS_WINCE)
 159 #  define TEST_SERVER_CERT "\\OpenSSL\\server.pem"
 160 #  define TEST_CLIENT_CERT "\\OpenSSL\\client.pem"
 161 #else
 162 #  define TEST_SERVER_CERT "../apps/server.pem"
 163 #  define TEST_CLIENT_CERT "../apps/client.pem"
 164 #endif
 165
 166 /* There is really no standard for this, so let's assign some tentative
 167    numbers.  In any case, these numbers are only for this test */
 168 #define COMP_RLE        1
 169 #define COMP_ZLIB       2
 170
 171 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
 172 #ifndef OPENSSL_NO_RSA
 173 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export,int keylength);
 174 static void free_tmp_rsa(void);
 175 #endif
 176 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg);
 177 #define APP_CALLBACK_STRING "Test Callback Argument"
 178 struct app_verify_arg
 179         {
 180         char *string;
 181         int app_verify;
 182         int allow_proxy_certs;
 183         char *proxy_auth;
 184         char *proxy_cond;
 185         };
 186
 187 #ifndef OPENSSL_NO_DH
 188 static DH *get_dh512(void);
 189 static DH *get_dh1024(void);
 190 static DH *get_dh1024dsa(void);
 191 #endif
 192
 193 static BIO *bio_err=NULL;
 194 static BIO *bio_stdout=NULL;
 195
 196 static char *cipher=NULL;
 197 static int verbose=0;
 198 static int debug=0;
 199 #if 0
 200 /* Not used yet. */
 201 #ifdef FIONBIO
 202 static int s_nbio=0;
 203 #endif
 204 #endif
 205
 206 static const char rnd_seed[] = "string to make the random number generator think it has entropy";
 207
 208 int doit_biopair(SSL *s_ssl,SSL *c_ssl,long bytes,clock_t *s_time,clock_t *c_time);
 209 int doit(SSL *s_ssl,SSL *c_ssl,long bytes);
 210 static void sv_usage(void)
 211         {
 212         fprintf(stderr,"usage: ssltest [args ...]\n");
 213         fprintf(stderr,"\n");
 214 #ifdef OPENSSL_FIPS
 215         fprintf(stderr,"-F             - run test in FIPS mode\n");
 216 #endif
 217         fprintf(stderr," -server_auth  - check server certificate\n");
 218         fprintf(stderr," -client_auth  - do client authentication\n");
 219         fprintf(stderr," -proxy        - allow proxy certificates\n");
 220         fprintf(stderr," -proxy_auth <val> - set proxy policy rights\n");
 221         fprintf(stderr," -proxy_cond <val> - experssion to test proxy policy rights\n");
 222         fprintf(stderr," -v            - more output\n");
 223         fprintf(stderr," -d            - debug output\n");
 224         fprintf(stderr," -reuse        - use session-id reuse\n");
 225         fprintf(stderr," -num <val>    - number of connections to perform\n");
 226         fprintf(stderr," -bytes <val>  - number of bytes to swap between client/server\n");
 227 #ifndef OPENSSL_NO_DH
 228         fprintf(stderr," -dhe1024      - use 1024 bit key (safe prime) for DHE\n");
 229         fprintf(stderr," -dhe1024dsa   - use 1024 bit key (with 160-bit subprime) for DHE\n");
 230         fprintf(stderr," -no_dhe       - disable DHE\n");
 231 #endif
 232 #ifndef OPENSSL_NO_SSL2
 233         fprintf(stderr," -ssl2         - use SSLv2\n");
 234 #endif
 235 #ifndef OPENSSL_NO_SSL3
 236         fprintf(stderr," -ssl3         - use SSLv3\n");
 237 #endif
 238 #ifndef OPENSSL_NO_TLS1
 239         fprintf(stderr," -tls1         - use TLSv1\n");
 240 #endif
 241         fprintf(stderr," -CApath arg   - PEM format directory of CA's\n");
 242         fprintf(stderr," -CAfile arg   - PEM format file of CA's\n");
 243         fprintf(stderr," -cert arg     - Server certificate file\n");
 244         fprintf(stderr," -key arg      - Server key file (default: same as -cert)\n");
 245         fprintf(stderr," -c_cert arg   - Client certificate file\n");
 246         fprintf(stderr," -c_key arg    - Client key file (default: same as -c_cert)\n");
 247         fprintf(stderr," -cipher arg   - The cipher list\n");
 248         fprintf(stderr," -bio_pair     - Use BIO pairs\n");
 249         fprintf(stderr," -f            - Test even cases that can't work\n");
 250         fprintf(stderr," -time         - measure processor time used by client and server\n");
 251         fprintf(stderr," -zlib         - use zlib compression\n");
 252         fprintf(stderr," -time         - use rle compression\n");
 253         }
 254
 255 static void print_details(SSL *c_ssl, const char *prefix)
 256         {
 257         SSL_CIPHER *ciph;
 258         X509 *cert;
 259
 260         ciph=SSL_get_current_cipher(c_ssl);
 261         BIO_printf(bio_stdout,"%s%s, cipher %s %s",
 262                 prefix,
 263                 SSL_get_version(c_ssl),
 264                 SSL_CIPHER_get_version(ciph),
 265                 SSL_CIPHER_get_name(ciph));
 266         cert=SSL_get_peer_certificate(c_ssl);
 267         if (cert != NULL)
 268                 {
 269                 EVP_PKEY *pkey = X509_get_pubkey(cert);
 270                 if (pkey != NULL)
 271                         {
 272                         if (0)
 273                                 ;
 274 #ifndef OPENSSL_NO_RSA
 275                         else if (pkey->type == EVP_PKEY_RSA && pkey->pkey.rsa != NULL
 276                                 && pkey->pkey.rsa->n != NULL)
 277                                 {
 278                                 BIO_printf(bio_stdout, ", %d bit RSA",
 279                                         BN_num_bits(pkey->pkey.rsa->n));
 280                                 }
 281 #endif
 282 #ifndef OPENSSL_NO_DSA
 283                         else if (pkey->type == EVP_PKEY_DSA && pkey->pkey.dsa != NULL
 284                                 && pkey->pkey.dsa->p != NULL)
 285                                 {
 286                                 BIO_printf(bio_stdout, ", %d bit DSA",
 287                                         BN_num_bits(pkey->pkey.dsa->p));
 288                                 }
 289 #endif
 290                         EVP_PKEY_free(pkey);
 291                         }
 292                 X509_free(cert);
 293                 }
 294         /* The SSL API does not allow us to look at temporary RSA/DH keys,
 295          * otherwise we should print their lengths too */
 296         BIO_printf(bio_stdout,"\n");
 297         }
 298
 299 static void lock_dbg_cb(int mode, int type, const char *file, int line)
 300         {
 301         static int modes[CRYPTO_NUM_LOCKS]; /* = {0, 0, ... } */
 302         const char *errstr = NULL;
 303         int rw;
 304
 305         rw = mode & (CRYPTO_READ|CRYPTO_WRITE);
 306         if (!((rw == CRYPTO_READ) || (rw == CRYPTO_WRITE)))
 307                 {
 308                 errstr = "invalid mode";
 309                 goto err;
 310                 }
 311
 312         if (type < 0 || type >= CRYPTO_NUM_LOCKS)
 313                 {
 314                 errstr = "type out of bounds";
 315                 goto err;
 316                 }
 317
 318         if (mode & CRYPTO_LOCK)
 319                 {
 320                 if (modes[type])
 321                         {
 322                         errstr = "already locked";
 323                         /* must not happen in a single-threaded program
 324                          * (would deadlock) */
 325                         goto err;
 326                         }
 327
 328                 modes[type] = rw;
 329                 }
 330         else if (mode & CRYPTO_UNLOCK)
 331                 {
 332                 if (!modes[type])
 333                         {
 334                         errstr = "not locked";
 335                         goto err;
 336                         }
 337
 338                 if (modes[type] != rw)
 339                         {
 340                         errstr = (rw == CRYPTO_READ) ?
 341                                 "CRYPTO_r_unlock on write lock" :
 342                                 "CRYPTO_w_unlock on read lock";
 343                         }
 344
 345                 modes[type] = 0;
 346                 }
 347         else
 348                 {
 349                 errstr = "invalid mode";
 350                 goto err;
 351                 }
 352
 353  err:
 354         if (errstr)
 355                 {
 356                 /* we cannot use bio_err here */
 357                 fprintf(stderr, "openssl (lock_dbg_cb): %s (mode=%d, type=%d) at %s:%d\n",
 358                         errstr, mode, type, file, line);
 359                 }
 360         }
 361
 362 int main(int argc, char *argv[])
 363         {
 364         char *CApath=NULL,*CAfile=NULL;
 365         int badop=0;
 366         int bio_pair=0;
 367         int force=0;
 368         int tls1=0,ssl2=0,ssl3=0,ret=1;
 369         int client_auth=0;
 370         int server_auth=0,i;
 371         struct app_verify_arg app_verify_arg =
 372                 { APP_CALLBACK_STRING, 0, 0, NULL, NULL };
 373         char *server_cert=TEST_SERVER_CERT;
 374         char *server_key=NULL;
 375         char *client_cert=TEST_CLIENT_CERT;
 376         char *client_key=NULL;
 377         SSL_CTX *s_ctx=NULL;
 378         SSL_CTX *c_ctx=NULL;
 379         SSL_METHOD *meth=NULL;
 380         SSL *c_ssl,*s_ssl;
 381         int number=1,reuse=0;
 382         long bytes=1L;
 383 #ifndef OPENSSL_NO_DH
 384         DH *dh;
 385         int dhe1024 = 0, dhe1024dsa = 0;
 386 #endif
 387         int no_dhe = 0;
 388         int print_time = 0;
 389         clock_t s_time = 0, c_time = 0;
 390         int comp = 0;
 391         COMP_METHOD *cm = NULL;
 392 #ifdef OPENSSL_FIPS
 393         int fips_mode=0;
 394         const char *path=argv[0];
 395 #endif
 396
 397         verbose = 0;
 398         debug = 0;
 399         cipher = 0;
 400
 401         bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
 402
 403         CRYPTO_set_locking_callback(lock_dbg_cb);
 404
 405         /* enable memory leak checking unless explicitly disabled */
 406         if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) && (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off"))))
 407                 {
 408                 CRYPTO_malloc_debug_init();
 409                 CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
 410                 }
 411         else
 412                 {
 413                 /* OPENSSL_DEBUG_MEMORY=off */
 414                 CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0);
 415                 }
 416         CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
 417
 418         RAND_seed(rnd_seed, sizeof rnd_seed);
 419
 420         bio_stdout=BIO_new_fp(stdout,BIO_NOCLOSE);
 421
 422         argc--;
 423         argv++;
 424
 425         while (argc >= 1)
 426                 {
 427                 if(!strcmp(*argv,"-F"))
 428                         {
 429 #ifdef OPENSSL_FIPS
 430                         fips_mode=1;
 431 #else
 432                         fprintf(stderr,"not compiled with FIPS support, so exitting without running.\n");
 433                         EXIT(0);
 434 #endif
 435                         }
 436                 else if (strcmp(*argv,"-server_auth") == 0)
 437                         server_auth=1;
 438                 else if (strcmp(*argv,"-client_auth") == 0)
 439                         client_auth=1;
 440                 else if (strcmp(*argv,"-proxy_auth") == 0)
 441                         {
 442                         if (--argc < 1) goto bad;
 443                         app_verify_arg.proxy_auth= *(++argv);
 444                         }
 445                 else if (strcmp(*argv,"-proxy_cond") == 0)
 446                         {
 447                         if (--argc < 1) goto bad;
 448                         app_verify_arg.proxy_cond= *(++argv);
 449                         }
 450                 else if (strcmp(*argv,"-v") == 0)
 451                         verbose=1;
 452                 else if (strcmp(*argv,"-d") == 0)
 453                         debug=1;
 454                 else if (strcmp(*argv,"-reuse") == 0)
 455                         reuse=1;
 456                 else if (strcmp(*argv,"-dhe1024") == 0)
 457                         {
 458 #ifndef OPENSSL_NO_DH
 459                         dhe1024=1;
 460 #else
 461                         fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
 462 #endif
 463                         }
 464                 else if (strcmp(*argv,"-dhe1024dsa") == 0)
 465                         {
 466 #ifndef OPENSSL_NO_DH
 467                         dhe1024dsa=1;
 468 #else
 469                         fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
 470 #endif
 471                         }
 472                 else if (strcmp(*argv,"-no_dhe") == 0)
 473                         no_dhe=1;
 474                 else if (strcmp(*argv,"-ssl2") == 0)
 475                         ssl2=1;
 476                 else if (strcmp(*argv,"-tls1") == 0)
 477                         tls1=1;
 478                 else if (strcmp(*argv,"-ssl3") == 0)
 479                         ssl3=1;
 480                 else if (strncmp(*argv,"-num",4) == 0)
 481                         {
 482                         if (--argc < 1) goto bad;
 483                         number= atoi(*(++argv));
 484                         if (number == 0) number=1;
 485                         }
 486                 else if (strcmp(*argv,"-bytes") == 0)
 487                         {
 488                         if (--argc < 1) goto bad;
 489                         bytes= atol(*(++argv));
 490                         if (bytes == 0L) bytes=1L;
 491                         i=strlen(argv[0]);
 492                         if (argv[0][i-1] == 'k') bytes*=1024L;
 493                         if (argv[0][i-1] == 'm') bytes*=1024L*1024L;
 494                         }
 495                 else if (strcmp(*argv,"-cert") == 0)
 496                         {
 497                         if (--argc < 1) goto bad;
 498                         server_cert= *(++argv);
 499                         }
 500                 else if (strcmp(*argv,"-s_cert") == 0)
 501                         {
 502                         if (--argc < 1) goto bad;
 503                         server_cert= *(++argv);
 504                         }
 505                 else if (strcmp(*argv,"-key") == 0)
 506                         {
 507                         if (--argc < 1) goto bad;
 508                         server_key= *(++argv);
 509                         }
 510                 else if (strcmp(*argv,"-s_key") == 0)
 511                         {
 512                         if (--argc < 1) goto bad;
 513                         server_key= *(++argv);
 514                         }
 515                 else if (strcmp(*argv,"-c_cert") == 0)
 516                         {
 517                         if (--argc < 1) goto bad;
 518                         client_cert= *(++argv);
 519                         }
 520                 else if (strcmp(*argv,"-c_key") == 0)
 521                         {
 522                         if (--argc < 1) goto bad;
 523                         client_key= *(++argv);
 524                         }
 525                 else if (strcmp(*argv,"-cipher") == 0)
 526                         {
 527                         if (--argc < 1) goto bad;
 528                         cipher= *(++argv);
 529                         }
 530                 else if (strcmp(*argv,"-CApath") == 0)
 531                         {
 532                         if (--argc < 1) goto bad;
 533                         CApath= *(++argv);
 534                         }
 535                 else if (strcmp(*argv,"-CAfile") == 0)
 536                         {
 537                         if (--argc < 1) goto bad;
 538                         CAfile= *(++argv);
 539                         }
 540                 else if (strcmp(*argv,"-bio_pair") == 0)
 541                         {
 542                         bio_pair = 1;
 543                         }
 544                 else if (strcmp(*argv,"-f") == 0)
 545                         {
 546                         force = 1;
 547                         }
 548                 else if (strcmp(*argv,"-time") == 0)
 549                         {
 550                         print_time = 1;
 551                         }
 552                 else if (strcmp(*argv,"-zlib") == 0)
 553                         {
 554                         comp = COMP_ZLIB;
 555                         }
 556                 else if (strcmp(*argv,"-rle") == 0)
 557                         {
 558                         comp = COMP_RLE;
 559                         }
 560                 else if (strcmp(*argv,"-app_verify") == 0)
 561                         {
 562                         app_verify_arg.app_verify = 1;
 563                         }
 564                 else if (strcmp(*argv,"-proxy") == 0)
 565                         {
 566                         app_verify_arg.allow_proxy_certs = 1;
 567                         }
 568                 else
 569                         {
 570                         fprintf(stderr,"unknown option %s\n",*argv);
 571                         badop=1;
 572                         break;
 573                         }
 574                 argc--;
 575                 argv++;
 576                 }
 577         if (badop)
 578                 {
 579 bad:
 580                 sv_usage();
 581                 goto end;
 582                 }
 583
 584
 585         if (!ssl2 && !ssl3 && !tls1 && number > 1 && !reuse && !force)
 586                 {
 587                 fprintf(stderr, "This case cannot work.  Use -f to perform "
 588                         "the test anyway (and\n-d to see what happens), "
 589                         "or add one of -ssl2, -ssl3, -tls1, -reuse\n"
 590                         "to avoid protocol mismatch.\n");
 591                 EXIT(1);
 592                 }
 593
 594 #ifdef OPENSSL_FIPS
 595         if(fips_mode)
 596                 {
 597                 if(!FIPS_mode_set(1,path))
 598                         {
 599                         ERR_load_crypto_strings();
 600                         ERR_print_errors(BIO_new_fp(stderr,BIO_NOCLOSE));
 601                         EXIT(1);
 602                         }
 603                 else
 604                         fprintf(stderr,"*** IN FIPS MODE ***\n");
 605                 }
 606 #endif
 607
 608         if (print_time)
 609                 {
 610                 if (!bio_pair)
 611                         {
 612                         fprintf(stderr, "Using BIO pair (-bio_pair)\n");
 613                         bio_pair = 1;
 614                         }
 615                 if (number < 50 && !force)
 616                         fprintf(stderr, "Warning: For accurate timings, use more connections (e.g. -num 1000)\n");
 617                 }
 618
 619 /*      if (cipher == NULL) cipher=getenv("SSL_CIPHER"); */
 620
 621         SSL_library_init();
 622         SSL_load_error_strings();
 623
 624         if (comp == COMP_ZLIB) cm = COMP_zlib();
 625         if (comp == COMP_RLE) cm = COMP_rle();
 626         if (cm != NULL)
 627                 {
 628                 if (cm->type != NID_undef)
 629                         {
 630                         if (SSL_COMP_add_compression_method(comp, cm) != 0)
 631                                 {
 632                                 fprintf(stderr,
 633                                         "Failed to add compression method\n");
 634                                 ERR_print_errors_fp(stderr);
 635                                 }
 636                         }
 637                 else
 638                         {
 639                         fprintf(stderr,
 640                                 "Warning: %s compression not supported\n",
 641                                 (comp == COMP_RLE ? "rle" :
 642                                         (comp == COMP_ZLIB ? "zlib" :
 643                                                 "unknown")));
 644                         ERR_print_errors_fp(stderr);
 645                         }
 646                 }
 647
 648 #if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
 649         if (ssl2)
 650                 meth=SSLv2_method();
 651         else
 652         if (tls1)
 653                 meth=TLSv1_method();
 654         else
 655         if (ssl3)
 656                 meth=SSLv3_method();
 657         else
 658                 meth=SSLv23_method();
 659 #else
 660 #ifdef OPENSSL_NO_SSL2
 661         meth=SSLv3_method();
 662 #else
 663         meth=SSLv2_method();
 664 #endif
 665 #endif
 666
 667         c_ctx=SSL_CTX_new(meth);
 668         s_ctx=SSL_CTX_new(meth);
 669         if ((c_ctx == NULL) || (s_ctx == NULL))
 670                 {
 671                 ERR_print_errors(bio_err);
 672                 goto end;
 673                 }
 674
 675         if (cipher != NULL)
 676                 {
 677                 SSL_CTX_set_cipher_list(c_ctx,cipher);
 678                 SSL_CTX_set_cipher_list(s_ctx,cipher);
 679                 }
 680
 681 #ifndef OPENSSL_NO_DH
 682         if (!no_dhe)
 683                 {
 684                 if (dhe1024dsa)
 685                         {
 686                         /* use SSL_OP_SINGLE_DH_USE to avoid small subgroup attacks */
 687                         SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
 688                         dh=get_dh1024dsa();
 689                         }
 690                 else if (dhe1024)
 691                         dh=get_dh1024();
 692                 else
 693                         dh=get_dh512();
 694                 SSL_CTX_set_tmp_dh(s_ctx,dh);
 695                 DH_free(dh);
 696                 }
 697 #else
 698         (void)no_dhe;
 699 #endif
 700
 701 #ifndef OPENSSL_NO_RSA
 702         SSL_CTX_set_tmp_rsa_callback(s_ctx,tmp_rsa_cb);
 703 #endif
 704
 705         if (!SSL_CTX_use_certificate_file(s_ctx,server_cert,SSL_FILETYPE_PEM))
 706                 {
 707                 ERR_print_errors(bio_err);
 708                 }
 709         else if (!SSL_CTX_use_PrivateKey_file(s_ctx,
 710                 (server_key?server_key:server_cert), SSL_FILETYPE_PEM))
 711                 {
 712                 ERR_print_errors(bio_err);
 713                 goto end;
 714                 }
 715
 716         if (client_auth)
 717                 {
 718                 SSL_CTX_use_certificate_file(c_ctx,client_cert,
 719                         SSL_FILETYPE_PEM);
 720                 SSL_CTX_use_PrivateKey_file(c_ctx,
 721                         (client_key?client_key:client_cert),
 722                         SSL_FILETYPE_PEM);
 723                 }
 724
 725         if (    (!SSL_CTX_load_verify_locations(s_ctx,CAfile,CApath)) ||
 726                 (!SSL_CTX_set_default_verify_paths(s_ctx)) ||
 727                 (!SSL_CTX_load_verify_locations(c_ctx,CAfile,CApath)) ||
 728                 (!SSL_CTX_set_default_verify_paths(c_ctx)))
 729                 {
 730                 /* fprintf(stderr,"SSL_load_verify_locations\n"); */
 731                 ERR_print_errors(bio_err);
 732                 /* goto end; */
 733                 }
 734
 735         if (client_auth)
 736                 {
 737                 BIO_printf(bio_err,"client authentication\n");
 738                 SSL_CTX_set_verify(s_ctx,
 739                         SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
 740                         verify_callback);
 741                 SSL_CTX_set_cert_verify_callback(s_ctx, app_verify_callback, &app_verify_arg);
 742                 }
 743         if (server_auth)
 744                 {
 745                 BIO_printf(bio_err,"server authentication\n");
 746                 SSL_CTX_set_verify(c_ctx,SSL_VERIFY_PEER,
 747                         verify_callback);
 748                 SSL_CTX_set_cert_verify_callback(c_ctx, app_verify_callback, &app_verify_arg);
 749                 }
 750
 751         {
 752                 int session_id_context = 0;
 753                 SSL_CTX_set_session_id_context(s_ctx, (void *)&session_id_context, sizeof session_id_context);
 754         }
 755
 756         c_ssl=SSL_new(c_ctx);
 757         s_ssl=SSL_new(s_ctx);
 758
 759 #ifndef OPENSSL_NO_KRB5
 760         if (c_ssl  &&  c_ssl->kssl_ctx)
 761                 {
 762                 char    localhost[MAXHOSTNAMELEN+2];
 763
 764                 if (gethostname(localhost, sizeof localhost-1) == 0)
 765                         {
 766                         localhost[sizeof localhost-1]='\0';
 767                         if(strlen(localhost) == sizeof localhost-1)
 768                                 {
 769                                 BIO_printf(bio_err,"localhost name too long\n");
 770                                 goto end;
 771                                 }
 772                         kssl_ctx_setstring(c_ssl->kssl_ctx, KSSL_SERVER,
 773                                 localhost);
 774                         }
 775                 }
 776 #endif    /* OPENSSL_NO_KRB5  */
 777
 778         for (i=0; i<number; i++)
 779                 {
 780                 if (!reuse) SSL_set_session(c_ssl,NULL);
 781                 if (bio_pair)
 782                         ret=doit_biopair(s_ssl,c_ssl,bytes,&s_time,&c_time);
 783                 else
 784                         ret=doit(s_ssl,c_ssl,bytes);
 785                 }
 786
 787         if (!verbose)
 788                 {
 789                 print_details(c_ssl, "");
 790                 }
 791         if ((number > 1) || (bytes > 1L))
 792                 BIO_printf(bio_stdout, "%d handshakes of %ld bytes done\n",number,bytes);
 793         if (print_time)
 794                 {
 795 #ifdef CLOCKS_PER_SEC
 796                 /* "To determine the time in seconds, the value returned
 797                  * by the clock function should be divided by the value
 798                  * of the macro CLOCKS_PER_SEC."
 799                  *                                       -- ISO/IEC 9899 */
 800                 BIO_printf(bio_stdout, "Approximate total server time: %6.2f s\n"
 801                         "Approximate total client time: %6.2f s\n",
 802                         (double)s_time/CLOCKS_PER_SEC,
 803                         (double)c_time/CLOCKS_PER_SEC);
 804 #else
 805                 /* "`CLOCKS_PER_SEC' undeclared (first use this function)"
 806                  *                            -- cc on NeXTstep/OpenStep */
 807                 BIO_printf(bio_stdout,
 808                         "Approximate total server time: %6.2f units\n"
 809                         "Approximate total client time: %6.2f units\n",
 810                         (double)s_time,
 811                         (double)c_time);
 812 #endif
 813                 }
 814
 815         SSL_free(s_ssl);
 816         SSL_free(c_ssl);
 817
 818 end:
 819         if (s_ctx != NULL) SSL_CTX_free(s_ctx);
 820         if (c_ctx != NULL) SSL_CTX_free(c_ctx);
 821
 822         if (bio_stdout != NULL) BIO_free(bio_stdout);
 823
 824 #ifndef OPENSSL_NO_RSA
 825         free_tmp_rsa();
 826 #endif
 827 #ifndef OPENSSL_NO_ENGINE
 828         ENGINE_cleanup();
 829 #endif
 830         CRYPTO_cleanup_all_ex_data();
 831         ERR_free_strings();
 832         ERR_remove_state(0);
 833         EVP_cleanup();
 834         CRYPTO_mem_leaks(bio_err);
 835         if (bio_err != NULL) BIO_free(bio_err);
 836         EXIT(ret);
 837         }
 838
 839 int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count,
 840         clock_t *s_time, clock_t *c_time)
 841         {
 842         long cw_num = count, cr_num = count, sw_num = count, sr_num = count;
 843         BIO *s_ssl_bio = NULL, *c_ssl_bio = NULL;
 844         BIO *server = NULL, *server_io = NULL, *client = NULL, *client_io = NULL;
 845         int ret = 1;
 846
 847         size_t bufsiz = 256; /* small buffer for testing */
 848
 849         if (!BIO_new_bio_pair(&server, bufsiz, &server_io, bufsiz))
 850                 goto err;
 851         if (!BIO_new_bio_pair(&client, bufsiz, &client_io, bufsiz))
 852                 goto err;
 853
 854         s_ssl_bio = BIO_new(BIO_f_ssl());
 855         if (!s_ssl_bio)
 856                 goto err;
 857
 858         c_ssl_bio = BIO_new(BIO_f_ssl());
 859         if (!c_ssl_bio)
 860                 goto err;
 861
 862         SSL_set_connect_state(c_ssl);
 863         SSL_set_bio(c_ssl, client, client);
 864         (void)BIO_set_ssl(c_ssl_bio, c_ssl, BIO_NOCLOSE);
 865
 866         SSL_set_accept_state(s_ssl);
 867         SSL_set_bio(s_ssl, server, server);
 868         (void)BIO_set_ssl(s_ssl_bio, s_ssl, BIO_NOCLOSE);
 869
 870         do
 871                 {
 872                 /* c_ssl_bio:          SSL filter BIO
 873                  *
 874                  * client:             pseudo-I/O for SSL library
 875                  *
 876                  * client_io:          client's SSL communication; usually to be
 877                  *                     relayed over some I/O facility, but in this
 878                  *                     test program, we're the server, too:
 879                  *
 880                  * server_io:          server's SSL communication
 881                  *
 882                  * server:             pseudo-I/O for SSL library
 883                  *
 884                  * s_ssl_bio:          SSL filter BIO
 885                  *
 886                  * The client and the server each employ a "BIO pair":
 887                  * client + client_io, server + server_io.
 888                  * BIO pairs are symmetric.  A BIO pair behaves similar
 889                  * to a non-blocking socketpair (but both endpoints must
 890                  * be handled by the same thread).
 891                  * [Here we could connect client and server to the ends
 892                  * of a single BIO pair, but then this code would be less
 893                  * suitable as an example for BIO pairs in general.]
 894                  *
 895                  * Useful functions for querying the state of BIO pair endpoints:
 896                  *
 897                  * BIO_ctrl_pending(bio)              number of bytes we can read now
 898                  * BIO_ctrl_get_read_request(bio)     number of bytes needed to fulfil
 899                  *                                      other side's read attempt
 900                  * BIO_ctrl_get_write_guarantee(bio)   number of bytes we can write now
 901                  *
 902                  * ..._read_request is never more than ..._write_guarantee;
 903                  * it depends on the application which one you should use.
 904                  */
 905
 906                 /* We have non-blocking behaviour throughout this test program, but
 907                  * can be sure that there is *some* progress in each iteration; so
 908                  * we don't have to worry about ..._SHOULD_READ or ..._SHOULD_WRITE
 909                  * -- we just try everything in each iteration
 910                  */
 911
 912                         {
 913                         /* CLIENT */
 914
 915                         MS_STATIC char cbuf[1024*8];
 916                         int i, r;
 917                         clock_t c_clock = clock();
 918
 919                         memset(cbuf, 0, sizeof(cbuf));
 920
 921                         if (debug)
 922                                 if (SSL_in_init(c_ssl))
 923                                         printf("client waiting in SSL_connect - %s\n",
 924                                                 SSL_state_string_long(c_ssl));
 925
 926                         if (cw_num > 0)
 927                                 {
 928                                 /* Write to server. */
 929
 930                                 if (cw_num > (long)sizeof cbuf)
 931                                         i = sizeof cbuf;
 932                                 else
 933                                         i = (int)cw_num;
 934                                 r = BIO_write(c_ssl_bio, cbuf, i);
 935                                 if (r < 0)
 936                                         {
 937                                         if (!BIO_should_retry(c_ssl_bio))
 938                                                 {
 939                                                 fprintf(stderr,"ERROR in CLIENT\n");
 940                                                 goto err;
 941                                                 }
 942                                         /* BIO_should_retry(...) can just be ignored here.
 943                                          * The library expects us to call BIO_write with
 944                                          * the same arguments again, and that's what we will
 945                                          * do in the next iteration. */
 946                                         }
 947                                 else if (r == 0)
 948                                         {
 949                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
 950                                         goto err;
 951                                         }
 952                                 else
 953                                         {
 954                                         if (debug)
 955                                                 printf("client wrote %d\n", r);
 956                                         cw_num -= r;
 957                                         }
 958                                 }
 959
 960                         if (cr_num > 0)
 961                                 {
 962                                 /* Read from server. */
 963
 964                                 r = BIO_read(c_ssl_bio, cbuf, sizeof(cbuf));
 965                                 if (r < 0)
 966                                         {
 967                                         if (!BIO_should_retry(c_ssl_bio))
 968                                                 {
 969                                                 fprintf(stderr,"ERROR in CLIENT\n");
 970                                                 goto err;
 971                                                 }
 972                                         /* Again, "BIO_should_retry" can be ignored. */
 973                                         }
 974                                 else if (r == 0)
 975                                         {
 976                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
 977                                         goto err;
 978                                         }
 979                                 else
 980                                         {
 981                                         if (debug)
 982                                                 printf("client read %d\n", r);
 983                                         cr_num -= r;
 984                                         }
 985                                 }
 986
 987                         /* c_time and s_time increments will typically be very small
 988                          * (depending on machine speed and clock tick intervals),
 989                          * but sampling over a large number of connections should
 990                          * result in fairly accurate figures.  We cannot guarantee
 991                          * a lot, however -- if each connection lasts for exactly
 992                          * one clock tick, it will be counted only for the client
 993                          * or only for the server or even not at all.
 994                          */
 995                         *c_time += (clock() - c_clock);
 996                         }
 997
 998                         {
 999                         /* SERVER */
1000
1001                         MS_STATIC char sbuf[1024*8];
1002                         int i, r;
1003                         clock_t s_clock = clock();
1004
1005                         memset(sbuf, 0, sizeof(sbuf));
1006
1007                         if (debug)
1008                                 if (SSL_in_init(s_ssl))
1009                                         printf("server waiting in SSL_accept - %s\n",
1010                                                 SSL_state_string_long(s_ssl));
1011
1012                         if (sw_num > 0)
1013                                 {
1014                                 /* Write to client. */
1015
1016                                 if (sw_num > (long)sizeof sbuf)
1017                                         i = sizeof sbuf;
1018                                 else
1019                                         i = (int)sw_num;
1020                                 r = BIO_write(s_ssl_bio, sbuf, i);
1021                                 if (r < 0)
1022                                         {
1023                                         if (!BIO_should_retry(s_ssl_bio))
1024                                                 {
1025                                                 fprintf(stderr,"ERROR in SERVER\n");
1026                                                 goto err;
1027                                                 }
1028                                         /* Ignore "BIO_should_retry". */
1029                                         }
1030                                 else if (r == 0)
1031                                         {
1032                                         fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1033                                         goto err;
1034                                         }
1035                                 else
1036                                         {
1037                                         if (debug)
1038                                                 printf("server wrote %d\n", r);
1039                                         sw_num -= r;
1040                                         }
1041                                 }
1042
1043                         if (sr_num > 0)
1044                                 {
1045                                 /* Read from client. */
1046
1047                                 r = BIO_read(s_ssl_bio, sbuf, sizeof(sbuf));
1048                                 if (r < 0)
1049                                         {
1050                                         if (!BIO_should_retry(s_ssl_bio))
1051                                                 {
1052                                                 fprintf(stderr,"ERROR in SERVER\n");
1053                                                 goto err;
1054                                                 }
1055                                         /* blah, blah */
1056                                         }
1057                                 else if (r == 0)
1058                                         {
1059                                         fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1060                                         goto err;
1061                                         }
1062                                 else
1063                                         {
1064                                         if (debug)
1065                                                 printf("server read %d\n", r);
1066                                         sr_num -= r;
1067                                         }
1068                                 }
1069
1070                         *s_time += (clock() - s_clock);
1071                         }
1072
1073                         {
1074                         /* "I/O" BETWEEN CLIENT AND SERVER. */
1075
1076                         size_t r1, r2;
1077                         BIO *io1 = server_io, *io2 = client_io;
1078                         /* we use the non-copying interface for io1
1079                          * and the standard BIO_write/BIO_read interface for io2
1080                          */
1081
1082                         static int prev_progress = 1;
1083                         int progress = 0;
1084
1085                         /* io1 to io2 */
1086                         do
1087                                 {
1088                                 size_t num;
1089                                 int r;
1090
1091                                 r1 = BIO_ctrl_pending(io1);
1092                                 r2 = BIO_ctrl_get_write_guarantee(io2);
1093
1094                                 num = r1;
1095                                 if (r2 < num)
1096                                         num = r2;
1097                                 if (num)
1098                                         {
1099                                         char *dataptr;
1100
1101                                         if (INT_MAX < num) /* yeah, right */
1102                                                 num = INT_MAX;
1103
1104                                         r = BIO_nread(io1, &dataptr, (int)num);
1105                                         assert(r > 0);
1106                                         assert(r <= (int)num);
1107                                         /* possibly r < num (non-contiguous data) */
1108                                         num = r;
1109                                         r = BIO_write(io2, dataptr, (int)num);
1110                                         if (r != (int)num) /* can't happen */
1111                                                 {
1112                                                 fprintf(stderr, "ERROR: BIO_write could not write "
1113                                                         "BIO_ctrl_get_write_guarantee() bytes");
1114                                                 goto err;
1115                                                 }
1116                                         progress = 1;
1117
1118                                         if (debug)
1119                                                 printf((io1 == client_io) ?
1120                                                         "C->S relaying: %d bytes\n" :
1121                                                         "S->C relaying: %d bytes\n",
1122                                                         (int)num);
1123                                         }
1124                                 }
1125                         while (r1 && r2);
1126
1127                         /* io2 to io1 */
1128                         {
1129                                 size_t num;
1130                                 int r;
1131
1132                                 r1 = BIO_ctrl_pending(io2);
1133                                 r2 = BIO_ctrl_get_read_request(io1);
1134                                 /* here we could use ..._get_write_guarantee instead of
1135                                  * ..._get_read_request, but by using the latter
1136                                  * we test restartability of the SSL implementation
1137                                  * more thoroughly */
1138                                 num = r1;
1139                                 if (r2 < num)
1140                                         num = r2;
1141                                 if (num)
1142                                         {
1143                                         char *dataptr;
1144
1145                                         if (INT_MAX < num)
1146                                                 num = INT_MAX;
1147
1148                                         if (num > 1)
1149                                                 --num; /* test restartability even more thoroughly */
1150
1151                                         r = BIO_nwrite0(io1, &dataptr);
1152                                         assert(r > 0);
1153                                         if (r < (int)num)
1154                                                 num = r;
1155                                         r = BIO_read(io2, dataptr, (int)num);
1156                                         if (r != (int)num) /* can't happen */
1157                                                 {
1158                                                 fprintf(stderr, "ERROR: BIO_read could not read "
1159                                                         "BIO_ctrl_pending() bytes");
1160                                                 goto err;
1161                                                 }
1162                                         progress = 1;
1163                                         r = BIO_nwrite(io1, &dataptr, (int)num);
1164                                         if (r != (int)num) /* can't happen */
1165                                                 {
1166                                                 fprintf(stderr, "ERROR: BIO_nwrite() did not accept "
1167                                                         "BIO_nwrite0() bytes");
1168                                                 goto err;
1169                                                 }
1170
1171                                         if (debug)
1172                                                 printf((io2 == client_io) ?
1173                                                         "C->S relaying: %d bytes\n" :
1174                                                         "S->C relaying: %d bytes\n",
1175                                                         (int)num);
1176                                         }
1177                         } /* no loop, BIO_ctrl_get_read_request now returns 0 anyway */
1178
1179                         if (!progress && !prev_progress)
1180                                 if (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0)
1181                                         {
1182                                         fprintf(stderr, "ERROR: got stuck\n");
1183                                         if (strcmp("SSLv2", SSL_get_version(c_ssl)) == 0)
1184                                                 {
1185                                                 fprintf(stderr, "This can happen for SSL2 because "
1186                                                         "CLIENT-FINISHED and SERVER-VERIFY are written \n"
1187                                                         "concurrently ...");
1188                                                 if (strncmp("2SCF", SSL_state_string(c_ssl), 4) == 0
1189                                                         && strncmp("2SSV", SSL_state_string(s_ssl), 4) == 0)
1190                                                         {
1191                                                         fprintf(stderr, " ok.\n");
1192                                                         goto end;
1193                                                         }
1194                                                 }
1195                                         fprintf(stderr, " ERROR.\n");
1196                                         goto err;
1197                                         }
1198                         prev_progress = progress;
1199                         }
1200                 }
1201         while (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0);
1202
1203         if (verbose)
1204                 print_details(c_ssl, "DONE via BIO pair: ");
1205 end:
1206         ret = 0;
1207
1208  err:
1209         ERR_print_errors(bio_err);
1210
1211         if (server)
1212                 BIO_free(server);
1213         if (server_io)
1214                 BIO_free(server_io);
1215         if (client)
1216                 BIO_free(client);
1217         if (client_io)
1218                 BIO_free(client_io);
1219         if (s_ssl_bio)
1220                 BIO_free(s_ssl_bio);
1221         if (c_ssl_bio)
1222                 BIO_free(c_ssl_bio);
1223
1224         return ret;
1225         }
1226
1227
1228 #define W_READ  1
1229 #define W_WRITE 2
1230 #define C_DONE  1
1231 #define S_DONE  2
1232
1233 int doit(SSL *s_ssl, SSL *c_ssl, long count)
1234         {
1235         MS_STATIC char cbuf[1024*8],sbuf[1024*8];
1236         long cw_num=count,cr_num=count;
1237         long sw_num=count,sr_num=count;
1238         int ret=1;
1239         BIO *c_to_s=NULL;
1240         BIO *s_to_c=NULL;
1241         BIO *c_bio=NULL;
1242         BIO *s_bio=NULL;
1243         int c_r,c_w,s_r,s_w;
1244         int c_want,s_want;
1245         int i,j;
1246         int done=0;
1247         int c_write,s_write;
1248         int do_server=0,do_client=0;
1249
1250         memset(cbuf,0,sizeof(cbuf));
1251         memset(sbuf,0,sizeof(sbuf));
1252
1253         c_to_s=BIO_new(BIO_s_mem());
1254         s_to_c=BIO_new(BIO_s_mem());
1255         if ((s_to_c == NULL) || (c_to_s == NULL))
1256                 {
1257                 ERR_print_errors(bio_err);
1258                 goto err;
1259                 }
1260
1261         c_bio=BIO_new(BIO_f_ssl());
1262         s_bio=BIO_new(BIO_f_ssl());
1263         if ((c_bio == NULL) || (s_bio == NULL))
1264                 {
1265                 ERR_print_errors(bio_err);
1266                 goto err;
1267                 }
1268
1269         SSL_set_connect_state(c_ssl);
1270         SSL_set_bio(c_ssl,s_to_c,c_to_s);
1271         BIO_set_ssl(c_bio,c_ssl,BIO_NOCLOSE);
1272
1273         SSL_set_accept_state(s_ssl);
1274         SSL_set_bio(s_ssl,c_to_s,s_to_c);
1275         BIO_set_ssl(s_bio,s_ssl,BIO_NOCLOSE);
1276
1277         c_r=0; s_r=1;
1278         c_w=1; s_w=0;
1279         c_want=W_WRITE;
1280         s_want=0;
1281         c_write=1,s_write=0;
1282
1283         /* We can always do writes */
1284         for (;;)
1285                 {
1286                 do_server=0;
1287                 do_client=0;
1288
1289                 i=(int)BIO_pending(s_bio);
1290                 if ((i && s_r) || s_w) do_server=1;
1291
1292                 i=(int)BIO_pending(c_bio);
1293                 if ((i && c_r) || c_w) do_client=1;
1294
1295                 if (do_server && debug)
1296                         {
1297                         if (SSL_in_init(s_ssl))
1298                                 printf("server waiting in SSL_accept - %s\n",
1299                                         SSL_state_string_long(s_ssl));
1300 /*                      else if (s_write)
1301                                 printf("server:SSL_write()\n");
1302                         else
1303                                 printf("server:SSL_read()\n"); */
1304                         }
1305
1306                 if (do_client && debug)
1307                         {
1308                         if (SSL_in_init(c_ssl))
1309                                 printf("client waiting in SSL_connect - %s\n",
1310                                         SSL_state_string_long(c_ssl));
1311 /*                      else if (c_write)
1312                                 printf("client:SSL_write()\n");
1313                         else
1314                                 printf("client:SSL_read()\n"); */
1315                         }
1316
1317                 if (!do_client && !do_server)
1318                         {
1319                         fprintf(stdout,"ERROR IN STARTUP\n");
1320                         ERR_print_errors(bio_err);
1321                         break;
1322                         }
1323                 if (do_client && !(done & C_DONE))
1324                         {
1325                         if (c_write)
1326                                 {
1327                                 j=(cw_num > (long)sizeof(cbuf))
1328                                         ?sizeof(cbuf):(int)cw_num;
1329                                 i=BIO_write(c_bio,cbuf,j);
1330                                 if (i < 0)
1331                                         {
1332                                         c_r=0;
1333                                         c_w=0;
1334                                         if (BIO_should_retry(c_bio))
1335                                                 {
1336                                                 if (BIO_should_read(c_bio))
1337                                                         c_r=1;
1338                                                 if (BIO_should_write(c_bio))
1339                                                         c_w=1;
1340                                                 }
1341                                         else
1342                                                 {
1343                                                 fprintf(stderr,"ERROR in CLIENT\n");
1344                                                 ERR_print_errors(bio_err);
1345                                                 goto err;
1346                                                 }
1347                                         }
1348                                 else if (i == 0)
1349                                         {
1350                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1351                                         goto err;
1352                                         }
1353                                 else
1354                                         {
1355                                         if (debug)
1356                                                 printf("client wrote %d\n",i);
1357                                         /* ok */
1358                                         s_r=1;
1359                                         c_write=0;
1360                                         cw_num-=i;
1361                                         }
1362                                 }
1363                         else
1364                                 {
1365                                 i=BIO_read(c_bio,cbuf,sizeof(cbuf));
1366                                 if (i < 0)
1367                                         {
1368                                         c_r=0;
1369                                         c_w=0;
1370                                         if (BIO_should_retry(c_bio))
1371                                                 {
1372                                                 if (BIO_should_read(c_bio))
1373                                                         c_r=1;
1374                                                 if (BIO_should_write(c_bio))
1375                                                         c_w=1;
1376                                                 }
1377                                         else
1378                                                 {
1379                                                 fprintf(stderr,"ERROR in CLIENT\n");
1380                                                 ERR_print_errors(bio_err);
1381                                                 goto err;
1382                                                 }
1383                                         }
1384                                 else if (i == 0)
1385                                         {
1386                                         fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1387                                         goto err;
1388                                         }
1389                                 else
1390                                         {
1391                                         if (debug)
1392                                                 printf("client read %d\n",i);
1393                                         cr_num-=i;
1394                                         if (sw_num > 0)
1395                                                 {
1396                                                 s_write=1;
1397                                                 s_w=1;
1398                                                 }
1399                                         if (cr_num <= 0)
1400                                                 {
1401                                                 s_write=1;
1402                                                 s_w=1;
1403                                                 done=S_DONE|C_DONE;
1404                                                 }
1405                                         }
1406                                 }
1407                         }
1408
1409                 if (do_server && !(done & S_DONE))
1410                         {
1411                         if (!s_write)
1412                                 {
1413                                 i=BIO_read(s_bio,sbuf,sizeof(cbuf));
1414                                 if (i < 0)
1415                                         {
1416                                         s_r=0;
1417                                         s_w=0;
1418                                         if (BIO_should_retry(s_bio))
1419                                                 {
1420                                                 if (BIO_should_read(s_bio))
1421                                                         s_r=1;
1422                                                 if (BIO_should_write(s_bio))
1423                                                         s_w=1;
1424                                                 }
1425                                         else
1426                                                 {
1427                                                 fprintf(stderr,"ERROR in SERVER\n");
1428                                                 ERR_print_errors(bio_err);
1429                                                 goto err;
1430                                                 }
1431                                         }
1432                                 else if (i == 0)
1433                                         {
1434                                         ERR_print_errors(bio_err);
1435                                         fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_read\n");
1436                                         goto err;
1437                                         }
1438                                 else
1439                                         {
1440                                         if (debug)
1441                                                 printf("server read %d\n",i);
1442                                         sr_num-=i;
1443                                         if (cw_num > 0)
1444                                                 {
1445                                                 c_write=1;
1446                                                 c_w=1;
1447                                                 }
1448                                         if (sr_num <= 0)
1449                                                 {
1450                                                 s_write=1;
1451                                                 s_w=1;
1452                                                 c_write=0;
1453                                                 }
1454                                         }
1455                                 }
1456                         else
1457                                 {
1458                                 j=(sw_num > (long)sizeof(sbuf))?
1459                                         sizeof(sbuf):(int)sw_num;
1460                                 i=BIO_write(s_bio,sbuf,j);
1461                                 if (i < 0)
1462                                         {
1463                                         s_r=0;
1464                                         s_w=0;
1465                                         if (BIO_should_retry(s_bio))
1466                                                 {
1467                                                 if (BIO_should_read(s_bio))
1468                                                         s_r=1;
1469                                                 if (BIO_should_write(s_bio))
1470                                                         s_w=1;
1471                                                 }
1472                                         else
1473                                                 {
1474                                                 fprintf(stderr,"ERROR in SERVER\n");
1475                                                 ERR_print_errors(bio_err);
1476                                                 goto err;
1477                                                 }
1478                                         }
1479                                 else if (i == 0)
1480                                         {
1481                                         ERR_print_errors(bio_err);
1482                                         fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_write\n");
1483                                         goto err;
1484                                         }
1485                                 else
1486                                         {
1487                                         if (debug)
1488                                                 printf("server wrote %d\n",i);
1489                                         sw_num-=i;
1490                                         s_write=0;
1491                                         c_r=1;
1492                                         if (sw_num <= 0)
1493                                                 done|=S_DONE;
1494                                         }
1495                                 }
1496                         }
1497
1498                 if ((done & S_DONE) && (done & C_DONE)) break;
1499                 }
1500
1501         if (verbose)
1502                 print_details(c_ssl, "DONE: ");
1503         ret=0;
1504 err:
1505         /* We have to set the BIO's to NULL otherwise they will be
1506          * OPENSSL_free()ed twice.  Once when th s_ssl is SSL_free()ed and
1507          * again when c_ssl is SSL_free()ed.
1508          * This is a hack required because s_ssl and c_ssl are sharing the same
1509          * BIO structure and SSL_set_bio() and SSL_free() automatically
1510          * BIO_free non NULL entries.
1511          * You should not normally do this or be required to do this */
1512         if (s_ssl != NULL)
1513                 {
1514                 s_ssl->rbio=NULL;
1515                 s_ssl->wbio=NULL;
1516                 }
1517         if (c_ssl != NULL)
1518                 {
1519                 c_ssl->rbio=NULL;
1520                 c_ssl->wbio=NULL;
1521                 }
1522
1523         if (c_to_s != NULL) BIO_free(c_to_s);
1524         if (s_to_c != NULL) BIO_free(s_to_c);
1525         if (c_bio != NULL) BIO_free_all(c_bio);
1526         if (s_bio != NULL) BIO_free_all(s_bio);
1527         return(ret);
1528         }
1529
1530 static int get_proxy_auth_ex_data_idx(void)
1531         {
1532         static volatile int idx = -1;
1533         if (idx < 0)
1534                 {
1535                 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
1536                 if (idx < 0)
1537                         {
1538                         idx = X509_STORE_CTX_get_ex_new_index(0,
1539                                 "SSLtest for verify callback", NULL,NULL,NULL);
1540                         }
1541                 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
1542                 }
1543         return idx;
1544         }
1545
1546 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
1547         {
1548         char *s,buf[256];
1549
1550         s=X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),buf,
1551                             sizeof buf);
1552         if (s != NULL)
1553                 {
1554                 if (ok)
1555                         fprintf(stderr,"depth=%d %s\n",
1556                                 ctx->error_depth,buf);
1557                 else
1558                         {
1559                         fprintf(stderr,"depth=%d error=%d %s\n",
1560                                 ctx->error_depth,ctx->error,buf);
1561                         }
1562                 }
1563
1564         if (ok == 0)
1565                 {
1566                 fprintf(stderr,"Error string: %s\n",
1567                         X509_verify_cert_error_string(ctx->error));
1568                 switch (ctx->error)
1569                         {
1570                 case X509_V_ERR_CERT_NOT_YET_VALID:
1571                 case X509_V_ERR_CERT_HAS_EXPIRED:
1572                 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
1573                         fprintf(stderr,"  ... ignored.\n");
1574                         ok=1;
1575                         }
1576                 }
1577
1578         if (ok == 1)
1579                 {
1580                 X509 *xs = ctx->current_cert;
1581 #if 0
1582                 X509 *xi = ctx->current_issuer;
1583 #endif
1584
1585                 if (xs->ex_flags & EXFLAG_PROXY)
1586                         {
1587                         unsigned int *letters =
1588                                 X509_STORE_CTX_get_ex_data(ctx,
1589                                         get_proxy_auth_ex_data_idx());
1590
1591                         if (letters)
1592                                 {
1593                                 int found_any = 0;
1594                                 int i;
1595                                 PROXY_CERT_INFO_EXTENSION *pci =
1596                                         X509_get_ext_d2i(xs, NID_proxyCertInfo,
1597                                                 NULL, NULL);
1598
1599                                 switch (OBJ_obj2nid(pci->proxyPolicy->policyLanguage))
1600                                         {
1601                                 case NID_Independent:
1602                                         /* Completely meaningless in this
1603                                            program, as there's no way to
1604                                            grant explicit rights to a
1605                                            specific PrC.  Basically, using
1606                                            id-ppl-Independent is the perfect
1607                                            way to grant no rights at all. */
1608                                         fprintf(stderr, "  Independent proxy certificate");
1609                                         for (i = 0; i < 26; i++)
1610                                                 letters[i] = 0;
1611                                         break;
1612                                 case NID_id_ppl_inheritAll:
1613                                         /* This is basically a NOP, we
1614                                            simply let the current rights
1615                                            stand as they are. */
1616                                         fprintf(stderr, "  Proxy certificate inherits all");
1617                                         break;
1618                                 default:
1619                                         s = (char *)
1620                                                 pci->proxyPolicy->policy->data;
1621                                         i = pci->proxyPolicy->policy->length;
1622
1623                                         /* The algorithm works as follows:
1624                                            it is assumed that previous
1625                                            iterations or the initial granted
1626                                            rights has already set some elements
1627                                            of `letters'.  What we need to do is
1628                                            to clear those that weren't granted
1629                                            by the current PrC as well.  The
1630                                            easiest way to do this is to add 1
1631                                            to all the elements whose letters
1632                                            are given with the current policy.
1633                                            That way, all elements that are set
1634                                            by the current policy and were
1635                                            already set by earlier policies and
1636                                            through the original grant of rights
1637                                            will get the value 2 or higher.
1638                                            The last thing to do is to sweep
1639                                            through `letters' and keep the
1640                                            elements having the value 2 as set,
1641                                            and clear all the others. */
1642
1643                                         fprintf(stderr, "  Certificate proxy rights = %*.*s", i, i, s);
1644                                         while(i-- > 0)
1645                                                 {
1646                                                 char c = *s++;
1647                                                 if (isascii(c) && isalpha(c))
1648                                                         {
1649                                                         if (islower(c))
1650                                                                 c = toupper(c);
1651                                                         letters[c - 'A']++;
1652                                                         }
1653                                                 }
1654                                         for (i = 0; i < 26; i++)
1655                                                 if (letters[i] < 2)
1656                                                         letters[i] = 0;
1657                                                 else
1658                                                         letters[i] = 1;
1659                                         }
1660
1661                                 found_any = 0;
1662                                 fprintf(stderr,
1663                                         ", resulting proxy rights = ");
1664                                 for(i = 0; i < 26; i++)
1665                                         if (letters[i])
1666                                                 {
1667                                                 fprintf(stderr, "%c", i + 'A');
1668                                                 found_any = 1;
1669                                                 }
1670                                 if (!found_any)
1671                                         fprintf(stderr, "none");
1672                                 fprintf(stderr, "\n");
1673
1674                                 PROXY_CERT_INFO_EXTENSION_free(pci);
1675                                 }
1676                         }
1677                 }
1678
1679         return(ok);
1680         }
1681
1682 static void process_proxy_debug(int indent, const char *format, ...)
1683         {
1684         static const char indentation[] =
1685                 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"
1686                 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"; /* That's 80 > */
1687         char my_format[256];
1688         va_list args;
1689
1690         BIO_snprintf(my_format, sizeof(my_format), "%*.*s %s",
1691                 indent, indent, indentation, format);
1692
1693         va_start(args, format);
1694         vfprintf(stderr, my_format, args);
1695         va_end(args);
1696         }
1697 /* Priority levels:
1698    0    [!]var, ()
1699    1    & ^
1700    2    |
1701 */
1702 static int process_proxy_cond_adders(unsigned int letters[26],
1703         const char *cond, const char **cond_end, int *pos, int indent);
1704 static int process_proxy_cond_val(unsigned int letters[26],
1705         const char *cond, const char **cond_end, int *pos, int indent)
1706         {
1707         char c;
1708         int ok = 1;
1709         int negate = 0;
1710
1711         while(isspace(*cond))
1712                 {
1713                 cond++; (*pos)++;
1714                 }
1715         c = *cond;
1716
1717         if (debug)
1718                 process_proxy_debug(indent,
1719                         "Start process_proxy_cond_val at position %d: %s\n",
1720                         *pos, cond);
1721
1722         while(c == '!')
1723                 {
1724                 negate = !negate;
1725                 cond++; (*pos)++;
1726                 while(isspace(*cond))
1727                         {
1728                         cond++; (*pos)++;
1729                         }
1730                 c = *cond;
1731                 }
1732
1733         if (c == '(')
1734                 {
1735                 cond++; (*pos)++;
1736                 ok = process_proxy_cond_adders(letters, cond, cond_end, pos,
1737                         indent + 1);
1738                 cond = *cond_end;
1739                 if (ok < 0)
1740                         goto end;
1741                 while(isspace(*cond))
1742                         {
1743                         cond++; (*pos)++;
1744                         }
1745                 c = *cond;
1746                 if (c != ')')
1747                         {
1748                         fprintf(stderr,
1749                                 "Weird condition character in position %d: "
1750                                 "%c\n", *pos, c);
1751                         ok = -1;
1752                         goto end;
1753                         }
1754                 cond++; (*pos)++;
1755                 }
1756         else if (isascii(c) && isalpha(c))
1757                 {
1758                 if (islower(c))
1759                         c = toupper(c);
1760                 ok = letters[c - 'A'];
1761                 cond++; (*pos)++;
1762                 }
1763         else
1764                 {
1765                 fprintf(stderr,
1766                         "Weird condition character in position %d: "
1767                         "%c\n", *pos, c);
1768                 ok = -1;
1769                 goto end;
1770                 }
1771  end:
1772         *cond_end = cond;
1773         if (ok >= 0 && negate)
1774                 ok = !ok;
1775
1776         if (debug)
1777                 process_proxy_debug(indent,
1778                         "End process_proxy_cond_val at position %d: %s, returning %d\n",
1779                         *pos, cond, ok);
1780
1781         return ok;
1782         }
1783 static int process_proxy_cond_multipliers(unsigned int letters[26],
1784         const char *cond, const char **cond_end, int *pos, int indent)
1785         {
1786         int ok;
1787         char c;
1788
1789         if (debug)
1790                 process_proxy_debug(indent,
1791                         "Start process_proxy_cond_multipliers at position %d: %s\n",
1792                         *pos, cond);
1793
1794         ok = process_proxy_cond_val(letters, cond, cond_end, pos, indent + 1);
1795         cond = *cond_end;
1796         if (ok < 0)
1797                 goto end;
1798
1799         while(ok >= 0)
1800                 {
1801                 while(isspace(*cond))
1802                         {
1803                         cond++; (*pos)++;
1804                         }
1805                 c = *cond;
1806
1807                 switch(c)
1808                         {
1809                 case '&':
1810                 case '^':
1811                         {
1812                         int save_ok = ok;
1813
1814                         cond++; (*pos)++;
1815                         ok = process_proxy_cond_val(letters,
1816                                 cond, cond_end, pos, indent + 1);
1817                         cond = *cond_end;
1818                         if (ok < 0)
1819                                 break;
1820
1821                         switch(c)
1822                                 {
1823                         case '&':
1824                                 ok &= save_ok;
1825                                 break;
1826                         case '^':
1827                                 ok ^= save_ok;
1828                                 break;
1829                         default:
1830                                 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
1831                                         " STOPPING\n");
1832                                 EXIT(1);
1833                                 }
1834                         }
1835                         break;
1836                 default:
1837                         goto end;
1838                         }
1839                 }
1840  end:
1841         if (debug)
1842                 process_proxy_debug(indent,
1843                         "End process_proxy_cond_multipliers at position %d: %s, returning %d\n",
1844                         *pos, cond, ok);
1845
1846         *cond_end = cond;
1847         return ok;
1848         }
1849 static int process_proxy_cond_adders(unsigned int letters[26],
1850         const char *cond, const char **cond_end, int *pos, int indent)
1851         {
1852         int ok;
1853         char c;
1854
1855         if (debug)
1856                 process_proxy_debug(indent,
1857                         "Start process_proxy_cond_adders at position %d: %s\n",
1858                         *pos, cond);
1859
1860         ok = process_proxy_cond_multipliers(letters, cond, cond_end, pos,
1861                 indent + 1);
1862         cond = *cond_end;
1863         if (ok < 0)
1864                 goto end;
1865
1866         while(ok >= 0)
1867                 {
1868                 while(isspace(*cond))
1869                         {
1870                         cond++; (*pos)++;
1871                         }
1872                 c = *cond;
1873
1874                 switch(c)
1875                         {
1876                 case '|':
1877                         {
1878                         int save_ok = ok;
1879
1880                         cond++; (*pos)++;
1881                         ok = process_proxy_cond_multipliers(letters,
1882                                 cond, cond_end, pos, indent + 1);
1883                         cond = *cond_end;
1884                         if (ok < 0)
1885                                 break;
1886
1887                         switch(c)
1888                                 {
1889                         case '|':
1890                                 ok |= save_ok;
1891                                 break;
1892                         default:
1893                                 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
1894                                         " STOPPING\n");
1895                                 EXIT(1);
1896                                 }
1897                         }
1898                         break;
1899                 default:
1900                         goto end;
1901                         }
1902                 }
1903  end:
1904         if (debug)
1905                 process_proxy_debug(indent,
1906                         "End process_proxy_cond_adders at position %d: %s, returning %d\n",
1907                         *pos, cond, ok);
1908
1909         *cond_end = cond;
1910         return ok;
1911         }
1912
1913 static int process_proxy_cond(unsigned int letters[26],
1914         const char *cond, const char **cond_end)
1915         {
1916         int pos = 1;
1917         return process_proxy_cond_adders(letters, cond, cond_end, &pos, 1);
1918         }
1919
1920 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg)
1921         {
1922         int ok=1;
1923         struct app_verify_arg *cb_arg = arg;
1924         unsigned int letters[26]; /* only used with proxy_auth */
1925
1926         if (cb_arg->app_verify)
1927                 {
1928                 char *s = NULL,buf[256];
1929
1930                 fprintf(stderr, "In app_verify_callback, allowing cert. ");
1931                 fprintf(stderr, "Arg is: %s\n", cb_arg->string);
1932                 fprintf(stderr, "Finished printing do we have a context? 0x%x a cert? 0x%x\n",
1933                         (unsigned int)ctx, (unsigned int)ctx->cert);
1934                 if (ctx->cert)
1935                         s=X509_NAME_oneline(X509_get_subject_name(ctx->cert),buf,256);
1936                 if (s != NULL)
1937                         {
1938                         fprintf(stderr,"cert depth=%d %s\n",ctx->error_depth,buf);
1939                         }
1940                 return(1);
1941                 }
1942         if (cb_arg->proxy_auth)
1943                 {
1944                 int found_any = 0, i;
1945                 char *sp;
1946
1947                 for(i = 0; i < 26; i++)
1948                         letters[i] = 0;
1949                 for(sp = cb_arg->proxy_auth; *sp; sp++)
1950                         {
1951                         char c = *sp;
1952                         if (isascii(c) && isalpha(c))
1953                                 {
1954                                 if (islower(c))
1955                                         c = toupper(c);
1956                                 letters[c - 'A'] = 1;
1957                                 }
1958                         }
1959
1960                 fprintf(stderr,
1961                         "  Initial proxy rights = ");
1962                 for(i = 0; i < 26; i++)
1963                         if (letters[i])
1964                                 {
1965                                 fprintf(stderr, "%c", i + 'A');
1966                                 found_any = 1;
1967                                 }
1968                 if (!found_any)
1969                         fprintf(stderr, "none");
1970                 fprintf(stderr, "\n");
1971
1972                 X509_STORE_CTX_set_ex_data(ctx,
1973                         get_proxy_auth_ex_data_idx(),letters);
1974                 }
1975         if (cb_arg->allow_proxy_certs)
1976                 {
1977                 X509_STORE_CTX_set_flags(ctx, X509_V_FLAG_ALLOW_PROXY_CERTS);
1978                 }
1979
1980 #ifndef OPENSSL_NO_X509_VERIFY
1981         ok = X509_verify_cert(ctx);
1982 #endif
1983
1984         if (cb_arg->proxy_auth)
1985                 {
1986                 if (ok)
1987                         {
1988                         const char *cond_end = NULL;
1989
1990                         ok = process_proxy_cond(letters,
1991                                 cb_arg->proxy_cond, &cond_end);
1992
1993                         if (ok < 0)
1994                                 EXIT(3);
1995                         if (*cond_end)
1996                                 {
1997                                 fprintf(stderr, "Stopped processing condition before it's end.\n");
1998                                 ok = 0;
1999                                 }
2000                         if (!ok)
2001                                 fprintf(stderr, "Proxy rights check with condition '%s' proved invalid\n",
2002                                         cb_arg->proxy_cond);
2003                         else
2004                                 fprintf(stderr, "Proxy rights check with condition '%s' proved valid\n",
2005                                         cb_arg->proxy_cond);
2006                         }
2007                 }
2008         return(ok);
2009         }
2010
2011 #ifndef OPENSSL_NO_RSA
2012 static RSA *rsa_tmp=NULL;
2013
2014 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength)
2015         {
2016         if (rsa_tmp == NULL)
2017                 {
2018                 BIO_printf(bio_err,"Generating temp (%d bit) RSA key...",keylength);
2019                 (void)BIO_flush(bio_err);
2020                 rsa_tmp=RSA_generate_key(keylength,RSA_F4,NULL,NULL);
2021                 BIO_printf(bio_err,"\n");
2022                 (void)BIO_flush(bio_err);
2023                 }
2024         return(rsa_tmp);
2025         }
2026
2027 static void free_tmp_rsa(void)
2028         {
2029         if (rsa_tmp != NULL)
2030                 {
2031                 RSA_free(rsa_tmp);
2032                 rsa_tmp = NULL;
2033                 }
2034         }
2035 #endif
2036
2037 #ifndef OPENSSL_NO_DH
2038 /* These DH parameters have been generated as follows:
2039  *    $ openssl dhparam -C -noout 512
2040  *    $ openssl dhparam -C -noout 1024
2041  *    $ openssl dhparam -C -noout -dsaparam 1024
2042  * (The third function has been renamed to avoid name conflicts.)
2043  */
2044 static DH *get_dh512()
2045         {
2046         static unsigned char dh512_p[]={
2047                 0xCB,0xC8,0xE1,0x86,0xD0,0x1F,0x94,0x17,0xA6,0x99,0xF0,0xC6,
2048                 0x1F,0x0D,0xAC,0xB6,0x25,0x3E,0x06,0x39,0xCA,0x72,0x04,0xB0,
2049                 0x6E,0xDA,0xC0,0x61,0xE6,0x7A,0x77,0x25,0xE8,0x3B,0xB9,0x5F,
2050                 0x9A,0xB6,0xB5,0xFE,0x99,0x0B,0xA1,0x93,0x4E,0x35,0x33,0xB8,
2051                 0xE1,0xF1,0x13,0x4F,0x59,0x1A,0xD2,0x57,0xC0,0x26,0x21,0x33,
2052                 0x02,0xC5,0xAE,0x23,
2053                 };
2054         static unsigned char dh512_g[]={
2055                 0x02,
2056                 };
2057         DH *dh;
2058
2059         if ((dh=DH_new()) == NULL) return(NULL);
2060         dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
2061         dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
2062         if ((dh->p == NULL) || (dh->g == NULL))
2063                 { DH_free(dh); return(NULL); }
2064         return(dh);
2065         }
2066
2067 static DH *get_dh1024()
2068         {
2069         static unsigned char dh1024_p[]={
2070                 0xF8,0x81,0x89,0x7D,0x14,0x24,0xC5,0xD1,0xE6,0xF7,0xBF,0x3A,
2071                 0xE4,0x90,0xF4,0xFC,0x73,0xFB,0x34,0xB5,0xFA,0x4C,0x56,0xA2,
2072                 0xEA,0xA7,0xE9,0xC0,0xC0,0xCE,0x89,0xE1,0xFA,0x63,0x3F,0xB0,
2073                 0x6B,0x32,0x66,0xF1,0xD1,0x7B,0xB0,0x00,0x8F,0xCA,0x87,0xC2,
2074                 0xAE,0x98,0x89,0x26,0x17,0xC2,0x05,0xD2,0xEC,0x08,0xD0,0x8C,
2075                 0xFF,0x17,0x52,0x8C,0xC5,0x07,0x93,0x03,0xB1,0xF6,0x2F,0xB8,
2076                 0x1C,0x52,0x47,0x27,0x1B,0xDB,0xD1,0x8D,0x9D,0x69,0x1D,0x52,
2077                 0x4B,0x32,0x81,0xAA,0x7F,0x00,0xC8,0xDC,0xE6,0xD9,0xCC,0xC1,
2078                 0x11,0x2D,0x37,0x34,0x6C,0xEA,0x02,0x97,0x4B,0x0E,0xBB,0xB1,
2079                 0x71,0x33,0x09,0x15,0xFD,0xDD,0x23,0x87,0x07,0x5E,0x89,0xAB,
2080                 0x6B,0x7C,0x5F,0xEC,0xA6,0x24,0xDC,0x53,
2081                 };
2082         static unsigned char dh1024_g[]={
2083                 0x02,
2084                 };
2085         DH *dh;
2086
2087         if ((dh=DH_new()) == NULL) return(NULL);
2088         dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2089         dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2090         if ((dh->p == NULL) || (dh->g == NULL))
2091                 { DH_free(dh); return(NULL); }
2092         return(dh);
2093         }
2094
2095 static DH *get_dh1024dsa()
2096         {
2097         static unsigned char dh1024_p[]={
2098                 0xC8,0x00,0xF7,0x08,0x07,0x89,0x4D,0x90,0x53,0xF3,0xD5,0x00,
2099                 0x21,0x1B,0xF7,0x31,0xA6,0xA2,0xDA,0x23,0x9A,0xC7,0x87,0x19,
2100                 0x3B,0x47,0xB6,0x8C,0x04,0x6F,0xFF,0xC6,0x9B,0xB8,0x65,0xD2,
2101                 0xC2,0x5F,0x31,0x83,0x4A,0xA7,0x5F,0x2F,0x88,0x38,0xB6,0x55,
2102                 0xCF,0xD9,0x87,0x6D,0x6F,0x9F,0xDA,0xAC,0xA6,0x48,0xAF,0xFC,
2103                 0x33,0x84,0x37,0x5B,0x82,0x4A,0x31,0x5D,0xE7,0xBD,0x52,0x97,
2104                 0xA1,0x77,0xBF,0x10,0x9E,0x37,0xEA,0x64,0xFA,0xCA,0x28,0x8D,
2105                 0x9D,0x3B,0xD2,0x6E,0x09,0x5C,0x68,0xC7,0x45,0x90,0xFD,0xBB,
2106                 0x70,0xC9,0x3A,0xBB,0xDF,0xD4,0x21,0x0F,0xC4,0x6A,0x3C,0xF6,
2107                 0x61,0xCF,0x3F,0xD6,0x13,0xF1,0x5F,0xBC,0xCF,0xBC,0x26,0x9E,
2108                 0xBC,0x0B,0xBD,0xAB,0x5D,0xC9,0x54,0x39,
2109                 };
2110         static unsigned char dh1024_g[]={
2111                 0x3B,0x40,0x86,0xE7,0xF3,0x6C,0xDE,0x67,0x1C,0xCC,0x80,0x05,
2112                 0x5A,0xDF,0xFE,0xBD,0x20,0x27,0x74,0x6C,0x24,0xC9,0x03,0xF3,
2113                 0xE1,0x8D,0xC3,0x7D,0x98,0x27,0x40,0x08,0xB8,0x8C,0x6A,0xE9,
2114                 0xBB,0x1A,0x3A,0xD6,0x86,0x83,0x5E,0x72,0x41,0xCE,0x85,0x3C,
2115                 0xD2,0xB3,0xFC,0x13,0xCE,0x37,0x81,0x9E,0x4C,0x1C,0x7B,0x65,
2116                 0xD3,0xE6,0xA6,0x00,0xF5,0x5A,0x95,0x43,0x5E,0x81,0xCF,0x60,
2117                 0xA2,0x23,0xFC,0x36,0xA7,0x5D,0x7A,0x4C,0x06,0x91,0x6E,0xF6,
2118                 0x57,0xEE,0x36,0xCB,0x06,0xEA,0xF5,0x3D,0x95,0x49,0xCB,0xA7,
2119                 0xDD,0x81,0xDF,0x80,0x09,0x4A,0x97,0x4D,0xA8,0x22,0x72,0xA1,
2120                 0x7F,0xC4,0x70,0x56,0x70,0xE8,0x20,0x10,0x18,0x8F,0x2E,0x60,
2121                 0x07,0xE7,0x68,0x1A,0x82,0x5D,0x32,0xA2,
2122                 };
2123         DH *dh;
2124
2125         if ((dh=DH_new()) == NULL) return(NULL);
2126         dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2127         dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2128         if ((dh->p == NULL) || (dh->g == NULL))
2129                 { DH_free(dh); return(NULL); }
2130         dh->length = 160;
2131         return(dh);
2132         }
2133 #endif