2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
58 /* ====================================================================
59 * Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved.
61 * Redistribution and use in source and binary forms, with or without
62 * modification, are permitted provided that the following conditions
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
68 * 2. Redistributions in binary form must reproduce the above copyright
69 * notice, this list of conditions and the following disclaimer in
70 * the documentation and/or other materials provided with the
73 * 3. All advertising materials mentioning features or use of this
74 * software must display the following acknowledgment:
75 * "This product includes software developed by the OpenSSL Project
76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79 * endorse or promote products derived from this software without
80 * prior written permission. For written permission, please contact
81 * openssl-core@openssl.org.
83 * 5. Products derived from this software may not be called "OpenSSL"
84 * nor may "OpenSSL" appear in their names without prior written
85 * permission of the OpenSSL Project.
87 * 6. Redistributions of any form whatsoever must retain the following
89 * "This product includes software developed by the OpenSSL Project
90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103 * OF THE POSSIBILITY OF SUCH DAMAGE.
104 * ====================================================================
106 * This product includes cryptographic software written by Eric Young
107 * (eay@cryptsoft.com). This product includes software written by Tim
108 * Hudson (tjh@cryptsoft.com).
111 /* ====================================================================
112 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
113 * ECC cipher suite support in OpenSSL originally developed by
114 * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
117 #define _BSD_SOURCE 1 /* Or gethostname won't be declared properly
118 on Linux and GNU platforms. */
131 #define _XOPEN_SOURCE 500 /* Or isascii won't be declared properly on
132 VMS (at least with DECompHP C). */
135 #include <openssl/bio.h>
136 #include <openssl/crypto.h>
137 #include <openssl/evp.h>
138 #include <openssl/x509.h>
139 #include <openssl/x509v3.h>
140 #include <openssl/ssl.h>
141 #ifndef OPENSSL_NO_ENGINE
142 #include <openssl/engine.h>
144 #include <openssl/err.h>
145 #include <openssl/rand.h>
146 #ifndef OPENSSL_NO_RSA
147 #include <openssl/rsa.h>
149 #ifndef OPENSSL_NO_DSA
150 #include <openssl/dsa.h>
152 #ifndef OPENSSL_NO_DH
153 #include <openssl/dh.h>
155 #include <openssl/bn.h>
157 #define _XOPEN_SOURCE_EXTENDED 1 /* Or gethostname won't be declared properly
158 on Compaq platforms (at least with DEC C).
159 Do not try to put it earlier, or IPv6 includes
163 #ifdef OPENSSL_SYS_WINDOWS
166 #include OPENSSL_UNISTD
169 #ifdef OPENSSL_SYS_VMS
170 # define TEST_SERVER_CERT "SYS$DISK:[-.APPS]SERVER.PEM"
171 # define TEST_CLIENT_CERT "SYS$DISK:[-.APPS]CLIENT.PEM"
172 #elif defined(OPENSSL_SYS_WINCE)
173 # define TEST_SERVER_CERT "\\OpenSSL\\server.pem"
174 # define TEST_CLIENT_CERT "\\OpenSSL\\client.pem"
175 #elif defined(OPENSSL_SYS_NETWARE)
176 # define TEST_SERVER_CERT "\\openssl\\apps\\server.pem"
177 # define TEST_CLIENT_CERT "\\openssl\\apps\\client.pem"
179 # define TEST_SERVER_CERT "../apps/server.pem"
180 # define TEST_CLIENT_CERT "../apps/client.pem"
183 /* There is really no standard for this, so let's assign some tentative
184 numbers. In any case, these numbers are only for this test */
188 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
189 #ifndef OPENSSL_NO_RSA
190 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export,int keylength);
191 static void free_tmp_rsa(void);
193 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg);
194 #define APP_CALLBACK_STRING "Test Callback Argument"
195 struct app_verify_arg
199 int allow_proxy_certs;
204 #ifndef OPENSSL_NO_DH
205 static DH *get_dh512(void);
206 static DH *get_dh1024(void);
207 static DH *get_dh1024dsa(void);
210 static BIO *bio_err=NULL;
211 static BIO *bio_stdout=NULL;
213 static char *cipher=NULL;
214 static int verbose=0;
223 static const char rnd_seed[] = "string to make the random number generator think it has entropy";
225 int doit_biopair(SSL *s_ssl,SSL *c_ssl,long bytes,clock_t *s_time,clock_t *c_time);
226 int doit(SSL *s_ssl,SSL *c_ssl,long bytes);
227 static int do_test_cipherlist(void);
228 static void sv_usage(void)
230 fprintf(stderr,"usage: ssltest [args ...]\n");
231 fprintf(stderr,"\n");
233 fprintf(stderr,"-F - run test in FIPS mode\n");
235 fprintf(stderr," -server_auth - check server certificate\n");
236 fprintf(stderr," -client_auth - do client authentication\n");
237 fprintf(stderr," -proxy - allow proxy certificates\n");
238 fprintf(stderr," -proxy_auth <val> - set proxy policy rights\n");
239 fprintf(stderr," -proxy_cond <val> - experssion to test proxy policy rights\n");
240 fprintf(stderr," -v - more output\n");
241 fprintf(stderr," -d - debug output\n");
242 fprintf(stderr," -reuse - use session-id reuse\n");
243 fprintf(stderr," -num <val> - number of connections to perform\n");
244 fprintf(stderr," -bytes <val> - number of bytes to swap between client/server\n");
245 #ifndef OPENSSL_NO_DH
246 fprintf(stderr," -dhe1024 - use 1024 bit key (safe prime) for DHE\n");
247 fprintf(stderr," -dhe1024dsa - use 1024 bit key (with 160-bit subprime) for DHE\n");
248 fprintf(stderr," -no_dhe - disable DHE\n");
250 #ifndef OPENSSL_NO_ECDH
251 fprintf(stderr," -no_ecdhe - disable ECDHE\n");
253 #ifndef OPENSSL_NO_SSL2
254 fprintf(stderr," -ssl2 - use SSLv2\n");
256 #ifndef OPENSSL_NO_SSL3
257 fprintf(stderr," -ssl3 - use SSLv3\n");
259 #ifndef OPENSSL_NO_TLS1
260 fprintf(stderr," -tls1 - use TLSv1\n");
262 fprintf(stderr," -CApath arg - PEM format directory of CA's\n");
263 fprintf(stderr," -CAfile arg - PEM format file of CA's\n");
264 fprintf(stderr," -cert arg - Server certificate file\n");
265 fprintf(stderr," -key arg - Server key file (default: same as -cert)\n");
266 fprintf(stderr," -c_cert arg - Client certificate file\n");
267 fprintf(stderr," -c_key arg - Client key file (default: same as -c_cert)\n");
268 fprintf(stderr," -cipher arg - The cipher list\n");
269 fprintf(stderr," -bio_pair - Use BIO pairs\n");
270 fprintf(stderr," -f - Test even cases that can't work\n");
271 fprintf(stderr," -time - measure processor time used by client and server\n");
272 fprintf(stderr," -zlib - use zlib compression\n");
273 fprintf(stderr," -rle - use rle compression\n");
274 #ifndef OPENSSL_NO_ECDH
275 fprintf(stderr," -named_curve arg - Elliptic curve name to use for ephemeral ECDH keys.\n" \
276 " Use \"openssl ecparam -list_curves\" for all names\n" \
277 " (default is sect163r2).\n");
279 fprintf(stderr," -test_cipherlist - verifies the order of the ssl cipher lists\n");
282 static void print_details(SSL *c_ssl, const char *prefix)
287 ciph=SSL_get_current_cipher(c_ssl);
288 BIO_printf(bio_stdout,"%s%s, cipher %s %s",
290 SSL_get_version(c_ssl),
291 SSL_CIPHER_get_version(ciph),
292 SSL_CIPHER_get_name(ciph));
293 cert=SSL_get_peer_certificate(c_ssl);
296 EVP_PKEY *pkey = X509_get_pubkey(cert);
301 #ifndef OPENSSL_NO_RSA
302 else if (pkey->type == EVP_PKEY_RSA && pkey->pkey.rsa != NULL
303 && pkey->pkey.rsa->n != NULL)
305 BIO_printf(bio_stdout, ", %d bit RSA",
306 BN_num_bits(pkey->pkey.rsa->n));
309 #ifndef OPENSSL_NO_DSA
310 else if (pkey->type == EVP_PKEY_DSA && pkey->pkey.dsa != NULL
311 && pkey->pkey.dsa->p != NULL)
313 BIO_printf(bio_stdout, ", %d bit DSA",
314 BN_num_bits(pkey->pkey.dsa->p));
321 /* The SSL API does not allow us to look at temporary RSA/DH keys,
322 * otherwise we should print their lengths too */
323 BIO_printf(bio_stdout,"\n");
326 static void lock_dbg_cb(int mode, int type, const char *file, int line)
328 static int modes[CRYPTO_NUM_LOCKS]; /* = {0, 0, ... } */
329 const char *errstr = NULL;
332 rw = mode & (CRYPTO_READ|CRYPTO_WRITE);
333 if (!((rw == CRYPTO_READ) || (rw == CRYPTO_WRITE)))
335 errstr = "invalid mode";
339 if (type < 0 || type >= CRYPTO_NUM_LOCKS)
341 errstr = "type out of bounds";
345 if (mode & CRYPTO_LOCK)
349 errstr = "already locked";
350 /* must not happen in a single-threaded program
351 * (would deadlock) */
357 else if (mode & CRYPTO_UNLOCK)
361 errstr = "not locked";
365 if (modes[type] != rw)
367 errstr = (rw == CRYPTO_READ) ?
368 "CRYPTO_r_unlock on write lock" :
369 "CRYPTO_w_unlock on read lock";
376 errstr = "invalid mode";
383 /* we cannot use bio_err here */
384 fprintf(stderr, "openssl (lock_dbg_cb): %s (mode=%d, type=%d) at %s:%d\n",
385 errstr, mode, type, file, line);
390 int main(int argc, char *argv[])
392 char *CApath=NULL,*CAfile=NULL;
396 int tls1=0,ssl2=0,ssl3=0,ret=1;
399 struct app_verify_arg app_verify_arg =
400 { APP_CALLBACK_STRING, 0, 0, NULL, NULL };
401 char *server_cert=TEST_SERVER_CERT;
402 char *server_key=NULL;
403 char *client_cert=TEST_CLIENT_CERT;
404 char *client_key=NULL;
405 #ifndef OPENSSL_NO_ECDH
406 char *named_curve = NULL;
410 SSL_METHOD *meth=NULL;
412 int number=1,reuse=0;
414 #ifndef OPENSSL_NO_DH
416 int dhe1024 = 1, dhe1024dsa = 0;
418 #ifndef OPENSSL_NO_ECDH
424 clock_t s_time = 0, c_time = 0;
426 #ifndef OPENSSL_NO_COMP
427 COMP_METHOD *cm = NULL;
429 STACK_OF(SSL_COMP) *ssl_comp_methods = NULL;
430 int test_cipherlist = 0;
439 bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
441 CRYPTO_set_locking_callback(lock_dbg_cb);
443 /* enable memory leak checking unless explicitly disabled */
444 if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) && (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off"))))
446 CRYPTO_malloc_debug_init();
447 CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
451 /* OPENSSL_DEBUG_MEMORY=off */
452 CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0);
454 CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
456 RAND_seed(rnd_seed, sizeof rnd_seed);
458 bio_stdout=BIO_new_fp(stdout,BIO_NOCLOSE);
465 if(!strcmp(*argv,"-F"))
470 fprintf(stderr,"not compiled with FIPS support, so exitting without running.\n");
474 else if (strcmp(*argv,"-server_auth") == 0)
476 else if (strcmp(*argv,"-client_auth") == 0)
478 else if (strcmp(*argv,"-proxy_auth") == 0)
480 if (--argc < 1) goto bad;
481 app_verify_arg.proxy_auth= *(++argv);
483 else if (strcmp(*argv,"-proxy_cond") == 0)
485 if (--argc < 1) goto bad;
486 app_verify_arg.proxy_cond= *(++argv);
488 else if (strcmp(*argv,"-v") == 0)
490 else if (strcmp(*argv,"-d") == 0)
492 else if (strcmp(*argv,"-reuse") == 0)
494 else if (strcmp(*argv,"-dhe1024") == 0)
496 #ifndef OPENSSL_NO_DH
499 fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
502 else if (strcmp(*argv,"-dhe1024dsa") == 0)
504 #ifndef OPENSSL_NO_DH
507 fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");
510 else if (strcmp(*argv,"-no_dhe") == 0)
512 else if (strcmp(*argv,"-no_ecdhe") == 0)
514 else if (strcmp(*argv,"-ssl2") == 0)
516 else if (strcmp(*argv,"-tls1") == 0)
518 else if (strcmp(*argv,"-ssl3") == 0)
520 else if (strncmp(*argv,"-num",4) == 0)
522 if (--argc < 1) goto bad;
523 number= atoi(*(++argv));
524 if (number == 0) number=1;
526 else if (strcmp(*argv,"-bytes") == 0)
528 if (--argc < 1) goto bad;
529 bytes= atol(*(++argv));
530 if (bytes == 0L) bytes=1L;
532 if (argv[0][i-1] == 'k') bytes*=1024L;
533 if (argv[0][i-1] == 'm') bytes*=1024L*1024L;
535 else if (strcmp(*argv,"-cert") == 0)
537 if (--argc < 1) goto bad;
538 server_cert= *(++argv);
540 else if (strcmp(*argv,"-s_cert") == 0)
542 if (--argc < 1) goto bad;
543 server_cert= *(++argv);
545 else if (strcmp(*argv,"-key") == 0)
547 if (--argc < 1) goto bad;
548 server_key= *(++argv);
550 else if (strcmp(*argv,"-s_key") == 0)
552 if (--argc < 1) goto bad;
553 server_key= *(++argv);
555 else if (strcmp(*argv,"-c_cert") == 0)
557 if (--argc < 1) goto bad;
558 client_cert= *(++argv);
560 else if (strcmp(*argv,"-c_key") == 0)
562 if (--argc < 1) goto bad;
563 client_key= *(++argv);
565 else if (strcmp(*argv,"-cipher") == 0)
567 if (--argc < 1) goto bad;
570 else if (strcmp(*argv,"-CApath") == 0)
572 if (--argc < 1) goto bad;
575 else if (strcmp(*argv,"-CAfile") == 0)
577 if (--argc < 1) goto bad;
580 else if (strcmp(*argv,"-bio_pair") == 0)
584 else if (strcmp(*argv,"-f") == 0)
588 else if (strcmp(*argv,"-time") == 0)
592 else if (strcmp(*argv,"-zlib") == 0)
596 else if (strcmp(*argv,"-rle") == 0)
600 else if (strcmp(*argv,"-named_curve") == 0)
602 if (--argc < 1) goto bad;
603 #ifndef OPENSSL_NO_ECDH
604 named_curve = *(++argv);
606 fprintf(stderr,"ignoring -named_curve, since I'm compiled without ECDH\n");
610 else if (strcmp(*argv,"-app_verify") == 0)
612 app_verify_arg.app_verify = 1;
614 else if (strcmp(*argv,"-proxy") == 0)
616 app_verify_arg.allow_proxy_certs = 1;
618 else if (strcmp(*argv,"-test_cipherlist") == 0)
624 fprintf(stderr,"unknown option %s\n",*argv);
638 if (test_cipherlist == 1)
640 /* ensure that the cipher list are correctly sorted and exit */
641 if (do_test_cipherlist() == 0)
647 if (!ssl2 && !ssl3 && !tls1 && number > 1 && !reuse && !force)
649 fprintf(stderr, "This case cannot work. Use -f to perform "
650 "the test anyway (and\n-d to see what happens), "
651 "or add one of -ssl2, -ssl3, -tls1, -reuse\n"
652 "to avoid protocol mismatch.\n");
659 if(!FIPS_mode_set(1))
661 ERR_load_crypto_strings();
662 ERR_print_errors(BIO_new_fp(stderr,BIO_NOCLOSE));
666 fprintf(stderr,"*** IN FIPS MODE ***\n");
674 fprintf(stderr, "Using BIO pair (-bio_pair)\n");
677 if (number < 50 && !force)
678 fprintf(stderr, "Warning: For accurate timings, use more connections (e.g. -num 1000)\n");
681 /* if (cipher == NULL) cipher=getenv("SSL_CIPHER"); */
684 SSL_load_error_strings();
686 #ifndef OPENSSL_NO_COMP
687 if (comp == COMP_ZLIB) cm = COMP_zlib();
688 if (comp == COMP_RLE) cm = COMP_rle();
691 if (cm->type != NID_undef)
693 if (SSL_COMP_add_compression_method(comp, cm) != 0)
696 "Failed to add compression method\n");
697 ERR_print_errors_fp(stderr);
703 "Warning: %s compression not supported\n",
704 (comp == COMP_RLE ? "rle" :
705 (comp == COMP_ZLIB ? "zlib" :
707 ERR_print_errors_fp(stderr);
710 ssl_comp_methods = SSL_COMP_get_compression_methods();
711 fprintf(stderr, "Available compression methods:\n");
713 int j, n = sk_SSL_COMP_num(ssl_comp_methods);
715 fprintf(stderr, " NONE\n");
717 for (j = 0; j < n; j++)
719 SSL_COMP *c = sk_SSL_COMP_value(ssl_comp_methods, j);
720 fprintf(stderr, " %d: %s\n", c->id, c->name);
725 #if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
735 meth=SSLv23_method();
737 #ifdef OPENSSL_NO_SSL2
744 c_ctx=SSL_CTX_new(meth);
745 s_ctx=SSL_CTX_new(meth);
746 if ((c_ctx == NULL) || (s_ctx == NULL))
748 ERR_print_errors(bio_err);
754 SSL_CTX_set_cipher_list(c_ctx,cipher);
755 SSL_CTX_set_cipher_list(s_ctx,cipher);
758 #ifndef OPENSSL_NO_DH
763 /* use SSL_OP_SINGLE_DH_USE to avoid small subgroup attacks */
764 SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
771 SSL_CTX_set_tmp_dh(s_ctx,dh);
778 #ifndef OPENSSL_NO_ECDH
783 if (named_curve != NULL)
785 nid = OBJ_sn2nid(named_curve);
788 BIO_printf(bio_err, "unknown curve name (%s)\n", named_curve);
795 ecdh = EC_KEY_new_by_curve_name(nid);
798 BIO_printf(bio_err, "unable to create curve\n");
802 SSL_CTX_set_tmp_ecdh(s_ctx, ecdh);
803 SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_ECDH_USE);
810 #ifndef OPENSSL_NO_RSA
811 SSL_CTX_set_tmp_rsa_callback(s_ctx,tmp_rsa_cb);
814 if (!SSL_CTX_use_certificate_file(s_ctx,server_cert,SSL_FILETYPE_PEM))
816 ERR_print_errors(bio_err);
818 else if (!SSL_CTX_use_PrivateKey_file(s_ctx,
819 (server_key?server_key:server_cert), SSL_FILETYPE_PEM))
821 ERR_print_errors(bio_err);
827 SSL_CTX_use_certificate_file(c_ctx,client_cert,
829 SSL_CTX_use_PrivateKey_file(c_ctx,
830 (client_key?client_key:client_cert),
834 if ( (!SSL_CTX_load_verify_locations(s_ctx,CAfile,CApath)) ||
835 (!SSL_CTX_set_default_verify_paths(s_ctx)) ||
836 (!SSL_CTX_load_verify_locations(c_ctx,CAfile,CApath)) ||
837 (!SSL_CTX_set_default_verify_paths(c_ctx)))
839 /* fprintf(stderr,"SSL_load_verify_locations\n"); */
840 ERR_print_errors(bio_err);
846 BIO_printf(bio_err,"client authentication\n");
847 SSL_CTX_set_verify(s_ctx,
848 SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
850 SSL_CTX_set_cert_verify_callback(s_ctx, app_verify_callback, &app_verify_arg);
854 BIO_printf(bio_err,"server authentication\n");
855 SSL_CTX_set_verify(c_ctx,SSL_VERIFY_PEER,
857 SSL_CTX_set_cert_verify_callback(c_ctx, app_verify_callback, &app_verify_arg);
861 int session_id_context = 0;
862 SSL_CTX_set_session_id_context(s_ctx, (void *)&session_id_context, sizeof session_id_context);
865 c_ssl=SSL_new(c_ctx);
866 s_ssl=SSL_new(s_ctx);
868 #ifndef OPENSSL_NO_KRB5
869 if (c_ssl && c_ssl->kssl_ctx)
871 char localhost[MAXHOSTNAMELEN+2];
873 if (gethostname(localhost, sizeof localhost-1) == 0)
875 localhost[sizeof localhost-1]='\0';
876 if(strlen(localhost) == sizeof localhost-1)
878 BIO_printf(bio_err,"localhost name too long\n");
881 kssl_ctx_setstring(c_ssl->kssl_ctx, KSSL_SERVER,
885 #endif /* OPENSSL_NO_KRB5 */
887 for (i=0; i<number; i++)
889 if (!reuse) SSL_set_session(c_ssl,NULL);
891 ret=doit_biopair(s_ssl,c_ssl,bytes,&s_time,&c_time);
893 ret=doit(s_ssl,c_ssl,bytes);
898 print_details(c_ssl, "");
900 if ((number > 1) || (bytes > 1L))
901 BIO_printf(bio_stdout, "%d handshakes of %ld bytes done\n",number,bytes);
904 #ifdef CLOCKS_PER_SEC
905 /* "To determine the time in seconds, the value returned
906 * by the clock function should be divided by the value
907 * of the macro CLOCKS_PER_SEC."
909 BIO_printf(bio_stdout, "Approximate total server time: %6.2f s\n"
910 "Approximate total client time: %6.2f s\n",
911 (double)s_time/CLOCKS_PER_SEC,
912 (double)c_time/CLOCKS_PER_SEC);
914 /* "`CLOCKS_PER_SEC' undeclared (first use this function)"
915 * -- cc on NeXTstep/OpenStep */
916 BIO_printf(bio_stdout,
917 "Approximate total server time: %6.2f units\n"
918 "Approximate total client time: %6.2f units\n",
928 if (s_ctx != NULL) SSL_CTX_free(s_ctx);
929 if (c_ctx != NULL) SSL_CTX_free(c_ctx);
931 if (bio_stdout != NULL) BIO_free(bio_stdout);
933 #ifndef OPENSSL_NO_RSA
936 #ifndef OPENSSL_NO_ENGINE
939 CRYPTO_cleanup_all_ex_data();
943 CRYPTO_mem_leaks(bio_err);
944 if (bio_err != NULL) BIO_free(bio_err);
949 int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count,
950 clock_t *s_time, clock_t *c_time)
952 long cw_num = count, cr_num = count, sw_num = count, sr_num = count;
953 BIO *s_ssl_bio = NULL, *c_ssl_bio = NULL;
954 BIO *server = NULL, *server_io = NULL, *client = NULL, *client_io = NULL;
957 size_t bufsiz = 256; /* small buffer for testing */
959 if (!BIO_new_bio_pair(&server, bufsiz, &server_io, bufsiz))
961 if (!BIO_new_bio_pair(&client, bufsiz, &client_io, bufsiz))
964 s_ssl_bio = BIO_new(BIO_f_ssl());
968 c_ssl_bio = BIO_new(BIO_f_ssl());
972 SSL_set_connect_state(c_ssl);
973 SSL_set_bio(c_ssl, client, client);
974 (void)BIO_set_ssl(c_ssl_bio, c_ssl, BIO_NOCLOSE);
976 SSL_set_accept_state(s_ssl);
977 SSL_set_bio(s_ssl, server, server);
978 (void)BIO_set_ssl(s_ssl_bio, s_ssl, BIO_NOCLOSE);
982 /* c_ssl_bio: SSL filter BIO
984 * client: pseudo-I/O for SSL library
986 * client_io: client's SSL communication; usually to be
987 * relayed over some I/O facility, but in this
988 * test program, we're the server, too:
990 * server_io: server's SSL communication
992 * server: pseudo-I/O for SSL library
994 * s_ssl_bio: SSL filter BIO
996 * The client and the server each employ a "BIO pair":
997 * client + client_io, server + server_io.
998 * BIO pairs are symmetric. A BIO pair behaves similar
999 * to a non-blocking socketpair (but both endpoints must
1000 * be handled by the same thread).
1001 * [Here we could connect client and server to the ends
1002 * of a single BIO pair, but then this code would be less
1003 * suitable as an example for BIO pairs in general.]
1005 * Useful functions for querying the state of BIO pair endpoints:
1007 * BIO_ctrl_pending(bio) number of bytes we can read now
1008 * BIO_ctrl_get_read_request(bio) number of bytes needed to fulfil
1009 * other side's read attempt
1010 * BIO_ctrl_get_write_guarantee(bio) number of bytes we can write now
1012 * ..._read_request is never more than ..._write_guarantee;
1013 * it depends on the application which one you should use.
1016 /* We have non-blocking behaviour throughout this test program, but
1017 * can be sure that there is *some* progress in each iteration; so
1018 * we don't have to worry about ..._SHOULD_READ or ..._SHOULD_WRITE
1019 * -- we just try everything in each iteration
1025 MS_STATIC char cbuf[1024*8];
1027 clock_t c_clock = clock();
1029 memset(cbuf, 0, sizeof(cbuf));
1032 if (SSL_in_init(c_ssl))
1033 printf("client waiting in SSL_connect - %s\n",
1034 SSL_state_string_long(c_ssl));
1038 /* Write to server. */
1040 if (cw_num > (long)sizeof cbuf)
1044 r = BIO_write(c_ssl_bio, cbuf, i);
1047 if (!BIO_should_retry(c_ssl_bio))
1049 fprintf(stderr,"ERROR in CLIENT\n");
1052 /* BIO_should_retry(...) can just be ignored here.
1053 * The library expects us to call BIO_write with
1054 * the same arguments again, and that's what we will
1055 * do in the next iteration. */
1059 fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1065 printf("client wrote %d\n", r);
1072 /* Read from server. */
1074 r = BIO_read(c_ssl_bio, cbuf, sizeof(cbuf));
1077 if (!BIO_should_retry(c_ssl_bio))
1079 fprintf(stderr,"ERROR in CLIENT\n");
1082 /* Again, "BIO_should_retry" can be ignored. */
1086 fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1092 printf("client read %d\n", r);
1097 /* c_time and s_time increments will typically be very small
1098 * (depending on machine speed and clock tick intervals),
1099 * but sampling over a large number of connections should
1100 * result in fairly accurate figures. We cannot guarantee
1101 * a lot, however -- if each connection lasts for exactly
1102 * one clock tick, it will be counted only for the client
1103 * or only for the server or even not at all.
1105 *c_time += (clock() - c_clock);
1111 MS_STATIC char sbuf[1024*8];
1113 clock_t s_clock = clock();
1115 memset(sbuf, 0, sizeof(sbuf));
1118 if (SSL_in_init(s_ssl))
1119 printf("server waiting in SSL_accept - %s\n",
1120 SSL_state_string_long(s_ssl));
1124 /* Write to client. */
1126 if (sw_num > (long)sizeof sbuf)
1130 r = BIO_write(s_ssl_bio, sbuf, i);
1133 if (!BIO_should_retry(s_ssl_bio))
1135 fprintf(stderr,"ERROR in SERVER\n");
1138 /* Ignore "BIO_should_retry". */
1142 fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1148 printf("server wrote %d\n", r);
1155 /* Read from client. */
1157 r = BIO_read(s_ssl_bio, sbuf, sizeof(sbuf));
1160 if (!BIO_should_retry(s_ssl_bio))
1162 fprintf(stderr,"ERROR in SERVER\n");
1169 fprintf(stderr,"SSL SERVER STARTUP FAILED\n");
1175 printf("server read %d\n", r);
1180 *s_time += (clock() - s_clock);
1184 /* "I/O" BETWEEN CLIENT AND SERVER. */
1187 BIO *io1 = server_io, *io2 = client_io;
1188 /* we use the non-copying interface for io1
1189 * and the standard BIO_write/BIO_read interface for io2
1192 static int prev_progress = 1;
1201 r1 = BIO_ctrl_pending(io1);
1202 r2 = BIO_ctrl_get_write_guarantee(io2);
1211 if (INT_MAX < num) /* yeah, right */
1214 r = BIO_nread(io1, &dataptr, (int)num);
1216 assert(r <= (int)num);
1217 /* possibly r < num (non-contiguous data) */
1219 r = BIO_write(io2, dataptr, (int)num);
1220 if (r != (int)num) /* can't happen */
1222 fprintf(stderr, "ERROR: BIO_write could not write "
1223 "BIO_ctrl_get_write_guarantee() bytes");
1229 printf((io1 == client_io) ?
1230 "C->S relaying: %d bytes\n" :
1231 "S->C relaying: %d bytes\n",
1242 r1 = BIO_ctrl_pending(io2);
1243 r2 = BIO_ctrl_get_read_request(io1);
1244 /* here we could use ..._get_write_guarantee instead of
1245 * ..._get_read_request, but by using the latter
1246 * we test restartability of the SSL implementation
1247 * more thoroughly */
1259 --num; /* test restartability even more thoroughly */
1261 r = BIO_nwrite0(io1, &dataptr);
1265 r = BIO_read(io2, dataptr, (int)num);
1266 if (r != (int)num) /* can't happen */
1268 fprintf(stderr, "ERROR: BIO_read could not read "
1269 "BIO_ctrl_pending() bytes");
1273 r = BIO_nwrite(io1, &dataptr, (int)num);
1274 if (r != (int)num) /* can't happen */
1276 fprintf(stderr, "ERROR: BIO_nwrite() did not accept "
1277 "BIO_nwrite0() bytes");
1282 printf((io2 == client_io) ?
1283 "C->S relaying: %d bytes\n" :
1284 "S->C relaying: %d bytes\n",
1287 } /* no loop, BIO_ctrl_get_read_request now returns 0 anyway */
1289 if (!progress && !prev_progress)
1290 if (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0)
1292 fprintf(stderr, "ERROR: got stuck\n");
1293 if (strcmp("SSLv2", SSL_get_version(c_ssl)) == 0)
1295 fprintf(stderr, "This can happen for SSL2 because "
1296 "CLIENT-FINISHED and SERVER-VERIFY are written \n"
1297 "concurrently ...");
1298 if (strncmp("2SCF", SSL_state_string(c_ssl), 4) == 0
1299 && strncmp("2SSV", SSL_state_string(s_ssl), 4) == 0)
1301 fprintf(stderr, " ok.\n");
1305 fprintf(stderr, " ERROR.\n");
1308 prev_progress = progress;
1311 while (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0);
1314 print_details(c_ssl, "DONE via BIO pair: ");
1319 ERR_print_errors(bio_err);
1324 BIO_free(server_io);
1328 BIO_free(client_io);
1330 BIO_free(s_ssl_bio);
1332 BIO_free(c_ssl_bio);
1343 int doit(SSL *s_ssl, SSL *c_ssl, long count)
1345 MS_STATIC char cbuf[1024*8],sbuf[1024*8];
1346 long cw_num=count,cr_num=count;
1347 long sw_num=count,sr_num=count;
1353 int c_r,c_w,s_r,s_w;
1356 int c_write,s_write;
1357 int do_server=0,do_client=0;
1359 memset(cbuf,0,sizeof(cbuf));
1360 memset(sbuf,0,sizeof(sbuf));
1362 c_to_s=BIO_new(BIO_s_mem());
1363 s_to_c=BIO_new(BIO_s_mem());
1364 if ((s_to_c == NULL) || (c_to_s == NULL))
1366 ERR_print_errors(bio_err);
1370 c_bio=BIO_new(BIO_f_ssl());
1371 s_bio=BIO_new(BIO_f_ssl());
1372 if ((c_bio == NULL) || (s_bio == NULL))
1374 ERR_print_errors(bio_err);
1378 SSL_set_connect_state(c_ssl);
1379 SSL_set_bio(c_ssl,s_to_c,c_to_s);
1380 BIO_set_ssl(c_bio,c_ssl,BIO_NOCLOSE);
1382 SSL_set_accept_state(s_ssl);
1383 SSL_set_bio(s_ssl,c_to_s,s_to_c);
1384 BIO_set_ssl(s_bio,s_ssl,BIO_NOCLOSE);
1388 c_write=1,s_write=0;
1390 /* We can always do writes */
1396 i=(int)BIO_pending(s_bio);
1397 if ((i && s_r) || s_w) do_server=1;
1399 i=(int)BIO_pending(c_bio);
1400 if ((i && c_r) || c_w) do_client=1;
1402 if (do_server && debug)
1404 if (SSL_in_init(s_ssl))
1405 printf("server waiting in SSL_accept - %s\n",
1406 SSL_state_string_long(s_ssl));
1407 /* else if (s_write)
1408 printf("server:SSL_write()\n");
1410 printf("server:SSL_read()\n"); */
1413 if (do_client && debug)
1415 if (SSL_in_init(c_ssl))
1416 printf("client waiting in SSL_connect - %s\n",
1417 SSL_state_string_long(c_ssl));
1418 /* else if (c_write)
1419 printf("client:SSL_write()\n");
1421 printf("client:SSL_read()\n"); */
1424 if (!do_client && !do_server)
1426 fprintf(stdout,"ERROR IN STARTUP\n");
1427 ERR_print_errors(bio_err);
1430 if (do_client && !(done & C_DONE))
1434 j = (cw_num > (long)sizeof(cbuf)) ?
1435 (int)sizeof(cbuf) : (int)cw_num;
1436 i=BIO_write(c_bio,cbuf,j);
1441 if (BIO_should_retry(c_bio))
1443 if (BIO_should_read(c_bio))
1445 if (BIO_should_write(c_bio))
1450 fprintf(stderr,"ERROR in CLIENT\n");
1451 ERR_print_errors(bio_err);
1457 fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1463 printf("client wrote %d\n",i);
1472 i=BIO_read(c_bio,cbuf,sizeof(cbuf));
1477 if (BIO_should_retry(c_bio))
1479 if (BIO_should_read(c_bio))
1481 if (BIO_should_write(c_bio))
1486 fprintf(stderr,"ERROR in CLIENT\n");
1487 ERR_print_errors(bio_err);
1493 fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
1499 printf("client read %d\n",i);
1516 if (do_server && !(done & S_DONE))
1520 i=BIO_read(s_bio,sbuf,sizeof(cbuf));
1525 if (BIO_should_retry(s_bio))
1527 if (BIO_should_read(s_bio))
1529 if (BIO_should_write(s_bio))
1534 fprintf(stderr,"ERROR in SERVER\n");
1535 ERR_print_errors(bio_err);
1541 ERR_print_errors(bio_err);
1542 fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_read\n");
1548 printf("server read %d\n",i);
1565 j = (sw_num > (long)sizeof(sbuf)) ?
1566 (int)sizeof(sbuf) : (int)sw_num;
1567 i=BIO_write(s_bio,sbuf,j);
1572 if (BIO_should_retry(s_bio))
1574 if (BIO_should_read(s_bio))
1576 if (BIO_should_write(s_bio))
1581 fprintf(stderr,"ERROR in SERVER\n");
1582 ERR_print_errors(bio_err);
1588 ERR_print_errors(bio_err);
1589 fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_write\n");
1595 printf("server wrote %d\n",i);
1605 if ((done & S_DONE) && (done & C_DONE)) break;
1609 print_details(c_ssl, "DONE: ");
1612 /* We have to set the BIO's to NULL otherwise they will be
1613 * OPENSSL_free()ed twice. Once when th s_ssl is SSL_free()ed and
1614 * again when c_ssl is SSL_free()ed.
1615 * This is a hack required because s_ssl and c_ssl are sharing the same
1616 * BIO structure and SSL_set_bio() and SSL_free() automatically
1617 * BIO_free non NULL entries.
1618 * You should not normally do this or be required to do this */
1630 if (c_to_s != NULL) BIO_free(c_to_s);
1631 if (s_to_c != NULL) BIO_free(s_to_c);
1632 if (c_bio != NULL) BIO_free_all(c_bio);
1633 if (s_bio != NULL) BIO_free_all(s_bio);
1637 static int get_proxy_auth_ex_data_idx(void)
1639 static volatile int idx = -1;
1642 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
1645 idx = X509_STORE_CTX_get_ex_new_index(0,
1646 "SSLtest for verify callback", NULL,NULL,NULL);
1648 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
1653 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
1657 s=X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),buf,
1662 fprintf(stderr,"depth=%d %s\n",
1663 ctx->error_depth,buf);
1666 fprintf(stderr,"depth=%d error=%d %s\n",
1667 ctx->error_depth,ctx->error,buf);
1673 fprintf(stderr,"Error string: %s\n",
1674 X509_verify_cert_error_string(ctx->error));
1677 case X509_V_ERR_CERT_NOT_YET_VALID:
1678 case X509_V_ERR_CERT_HAS_EXPIRED:
1679 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
1680 fprintf(stderr," ... ignored.\n");
1687 X509 *xs = ctx->current_cert;
1689 X509 *xi = ctx->current_issuer;
1692 if (xs->ex_flags & EXFLAG_PROXY)
1694 unsigned int *letters =
1695 X509_STORE_CTX_get_ex_data(ctx,
1696 get_proxy_auth_ex_data_idx());
1702 PROXY_CERT_INFO_EXTENSION *pci =
1703 X509_get_ext_d2i(xs, NID_proxyCertInfo,
1706 switch (OBJ_obj2nid(pci->proxyPolicy->policyLanguage))
1708 case NID_Independent:
1709 /* Completely meaningless in this
1710 program, as there's no way to
1711 grant explicit rights to a
1712 specific PrC. Basically, using
1713 id-ppl-Independent is the perfect
1714 way to grant no rights at all. */
1715 fprintf(stderr, " Independent proxy certificate");
1716 for (i = 0; i < 26; i++)
1719 case NID_id_ppl_inheritAll:
1720 /* This is basically a NOP, we
1721 simply let the current rights
1722 stand as they are. */
1723 fprintf(stderr, " Proxy certificate inherits all");
1727 pci->proxyPolicy->policy->data;
1728 i = pci->proxyPolicy->policy->length;
1730 /* The algorithm works as follows:
1731 it is assumed that previous
1732 iterations or the initial granted
1733 rights has already set some elements
1734 of `letters'. What we need to do is
1735 to clear those that weren't granted
1736 by the current PrC as well. The
1737 easiest way to do this is to add 1
1738 to all the elements whose letters
1739 are given with the current policy.
1740 That way, all elements that are set
1741 by the current policy and were
1742 already set by earlier policies and
1743 through the original grant of rights
1744 will get the value 2 or higher.
1745 The last thing to do is to sweep
1746 through `letters' and keep the
1747 elements having the value 2 as set,
1748 and clear all the others. */
1750 fprintf(stderr, " Certificate proxy rights = %*.*s", i, i, s);
1754 if (isascii(c) && isalpha(c))
1761 for (i = 0; i < 26; i++)
1770 ", resulting proxy rights = ");
1771 for(i = 0; i < 26; i++)
1774 fprintf(stderr, "%c", i + 'A');
1778 fprintf(stderr, "none");
1779 fprintf(stderr, "\n");
1781 PROXY_CERT_INFO_EXTENSION_free(pci);
1789 static void process_proxy_debug(int indent, const char *format, ...)
1791 static const char indentation[] =
1792 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"
1793 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"; /* That's 80 > */
1794 char my_format[256];
1797 BIO_snprintf(my_format, sizeof(my_format), "%*.*s %s",
1798 indent, indent, indentation, format);
1800 va_start(args, format);
1801 vfprintf(stderr, my_format, args);
1809 static int process_proxy_cond_adders(unsigned int letters[26],
1810 const char *cond, const char **cond_end, int *pos, int indent);
1811 static int process_proxy_cond_val(unsigned int letters[26],
1812 const char *cond, const char **cond_end, int *pos, int indent)
1818 while(isspace((int)*cond))
1825 process_proxy_debug(indent,
1826 "Start process_proxy_cond_val at position %d: %s\n",
1833 while(isspace((int)*cond))
1843 ok = process_proxy_cond_adders(letters, cond, cond_end, pos,
1848 while(isspace((int)*cond))
1856 "Weird condition character in position %d: "
1863 else if (isascii(c) && isalpha(c))
1867 ok = letters[c - 'A'];
1873 "Weird condition character in position %d: "
1880 if (ok >= 0 && negate)
1884 process_proxy_debug(indent,
1885 "End process_proxy_cond_val at position %d: %s, returning %d\n",
1890 static int process_proxy_cond_multipliers(unsigned int letters[26],
1891 const char *cond, const char **cond_end, int *pos, int indent)
1897 process_proxy_debug(indent,
1898 "Start process_proxy_cond_multipliers at position %d: %s\n",
1901 ok = process_proxy_cond_val(letters, cond, cond_end, pos, indent + 1);
1908 while(isspace((int)*cond))
1922 ok = process_proxy_cond_val(letters,
1923 cond, cond_end, pos, indent + 1);
1937 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
1949 process_proxy_debug(indent,
1950 "End process_proxy_cond_multipliers at position %d: %s, returning %d\n",
1956 static int process_proxy_cond_adders(unsigned int letters[26],
1957 const char *cond, const char **cond_end, int *pos, int indent)
1963 process_proxy_debug(indent,
1964 "Start process_proxy_cond_adders at position %d: %s\n",
1967 ok = process_proxy_cond_multipliers(letters, cond, cond_end, pos,
1975 while(isspace((int)*cond))
1988 ok = process_proxy_cond_multipliers(letters,
1989 cond, cond_end, pos, indent + 1);
2000 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"
2012 process_proxy_debug(indent,
2013 "End process_proxy_cond_adders at position %d: %s, returning %d\n",
2020 static int process_proxy_cond(unsigned int letters[26],
2021 const char *cond, const char **cond_end)
2024 return process_proxy_cond_adders(letters, cond, cond_end, &pos, 1);
2027 static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg)
2030 struct app_verify_arg *cb_arg = arg;
2031 unsigned int letters[26]; /* only used with proxy_auth */
2033 if (cb_arg->app_verify)
2035 char *s = NULL,buf[256];
2037 fprintf(stderr, "In app_verify_callback, allowing cert. ");
2038 fprintf(stderr, "Arg is: %s\n", cb_arg->string);
2039 fprintf(stderr, "Finished printing do we have a context? 0x%p a cert? 0x%p\n",
2040 (void *)ctx, (void *)ctx->cert);
2042 s=X509_NAME_oneline(X509_get_subject_name(ctx->cert),buf,256);
2045 fprintf(stderr,"cert depth=%d %s\n",ctx->error_depth,buf);
2049 if (cb_arg->proxy_auth)
2051 int found_any = 0, i;
2054 for(i = 0; i < 26; i++)
2056 for(sp = cb_arg->proxy_auth; *sp; sp++)
2059 if (isascii(c) && isalpha(c))
2063 letters[c - 'A'] = 1;
2068 " Initial proxy rights = ");
2069 for(i = 0; i < 26; i++)
2072 fprintf(stderr, "%c", i + 'A');
2076 fprintf(stderr, "none");
2077 fprintf(stderr, "\n");
2079 X509_STORE_CTX_set_ex_data(ctx,
2080 get_proxy_auth_ex_data_idx(),letters);
2082 if (cb_arg->allow_proxy_certs)
2084 X509_STORE_CTX_set_flags(ctx, X509_V_FLAG_ALLOW_PROXY_CERTS);
2087 #ifndef OPENSSL_NO_X509_VERIFY
2088 ok = X509_verify_cert(ctx);
2091 if (cb_arg->proxy_auth)
2095 const char *cond_end = NULL;
2097 ok = process_proxy_cond(letters,
2098 cb_arg->proxy_cond, &cond_end);
2104 fprintf(stderr, "Stopped processing condition before it's end.\n");
2108 fprintf(stderr, "Proxy rights check with condition '%s' proved invalid\n",
2109 cb_arg->proxy_cond);
2111 fprintf(stderr, "Proxy rights check with condition '%s' proved valid\n",
2112 cb_arg->proxy_cond);
2118 #ifndef OPENSSL_NO_RSA
2119 static RSA *rsa_tmp=NULL;
2121 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength)
2124 if (rsa_tmp == NULL)
2127 rsa_tmp = RSA_new();
2128 if(!bn || !rsa_tmp || !BN_set_word(bn, RSA_F4))
2130 BIO_printf(bio_err, "Memory error...");
2133 BIO_printf(bio_err,"Generating temp (%d bit) RSA key...",keylength);
2134 (void)BIO_flush(bio_err);
2135 if(!RSA_generate_key_ex(rsa_tmp,keylength,bn,NULL))
2137 BIO_printf(bio_err, "Error generating key.");
2142 BIO_printf(bio_err,"\n");
2143 (void)BIO_flush(bio_err);
2149 static void free_tmp_rsa(void)
2151 if (rsa_tmp != NULL)
2159 #ifndef OPENSSL_NO_DH
2160 /* These DH parameters have been generated as follows:
2161 * $ openssl dhparam -C -noout 512
2162 * $ openssl dhparam -C -noout 1024
2163 * $ openssl dhparam -C -noout -dsaparam 1024
2164 * (The third function has been renamed to avoid name conflicts.)
2166 static DH *get_dh512()
2168 static unsigned char dh512_p[]={
2169 0xCB,0xC8,0xE1,0x86,0xD0,0x1F,0x94,0x17,0xA6,0x99,0xF0,0xC6,
2170 0x1F,0x0D,0xAC,0xB6,0x25,0x3E,0x06,0x39,0xCA,0x72,0x04,0xB0,
2171 0x6E,0xDA,0xC0,0x61,0xE6,0x7A,0x77,0x25,0xE8,0x3B,0xB9,0x5F,
2172 0x9A,0xB6,0xB5,0xFE,0x99,0x0B,0xA1,0x93,0x4E,0x35,0x33,0xB8,
2173 0xE1,0xF1,0x13,0x4F,0x59,0x1A,0xD2,0x57,0xC0,0x26,0x21,0x33,
2174 0x02,0xC5,0xAE,0x23,
2176 static unsigned char dh512_g[]={
2181 if ((dh=DH_new()) == NULL) return(NULL);
2182 dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
2183 dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
2184 if ((dh->p == NULL) || (dh->g == NULL))
2185 { DH_free(dh); return(NULL); }
2189 static DH *get_dh1024()
2191 static unsigned char dh1024_p[]={
2192 0xF8,0x81,0x89,0x7D,0x14,0x24,0xC5,0xD1,0xE6,0xF7,0xBF,0x3A,
2193 0xE4,0x90,0xF4,0xFC,0x73,0xFB,0x34,0xB5,0xFA,0x4C,0x56,0xA2,
2194 0xEA,0xA7,0xE9,0xC0,0xC0,0xCE,0x89,0xE1,0xFA,0x63,0x3F,0xB0,
2195 0x6B,0x32,0x66,0xF1,0xD1,0x7B,0xB0,0x00,0x8F,0xCA,0x87,0xC2,
2196 0xAE,0x98,0x89,0x26,0x17,0xC2,0x05,0xD2,0xEC,0x08,0xD0,0x8C,
2197 0xFF,0x17,0x52,0x8C,0xC5,0x07,0x93,0x03,0xB1,0xF6,0x2F,0xB8,
2198 0x1C,0x52,0x47,0x27,0x1B,0xDB,0xD1,0x8D,0x9D,0x69,0x1D,0x52,
2199 0x4B,0x32,0x81,0xAA,0x7F,0x00,0xC8,0xDC,0xE6,0xD9,0xCC,0xC1,
2200 0x11,0x2D,0x37,0x34,0x6C,0xEA,0x02,0x97,0x4B,0x0E,0xBB,0xB1,
2201 0x71,0x33,0x09,0x15,0xFD,0xDD,0x23,0x87,0x07,0x5E,0x89,0xAB,
2202 0x6B,0x7C,0x5F,0xEC,0xA6,0x24,0xDC,0x53,
2204 static unsigned char dh1024_g[]={
2209 if ((dh=DH_new()) == NULL) return(NULL);
2210 dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2211 dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2212 if ((dh->p == NULL) || (dh->g == NULL))
2213 { DH_free(dh); return(NULL); }
2217 static DH *get_dh1024dsa()
2219 static unsigned char dh1024_p[]={
2220 0xC8,0x00,0xF7,0x08,0x07,0x89,0x4D,0x90,0x53,0xF3,0xD5,0x00,
2221 0x21,0x1B,0xF7,0x31,0xA6,0xA2,0xDA,0x23,0x9A,0xC7,0x87,0x19,
2222 0x3B,0x47,0xB6,0x8C,0x04,0x6F,0xFF,0xC6,0x9B,0xB8,0x65,0xD2,
2223 0xC2,0x5F,0x31,0x83,0x4A,0xA7,0x5F,0x2F,0x88,0x38,0xB6,0x55,
2224 0xCF,0xD9,0x87,0x6D,0x6F,0x9F,0xDA,0xAC,0xA6,0x48,0xAF,0xFC,
2225 0x33,0x84,0x37,0x5B,0x82,0x4A,0x31,0x5D,0xE7,0xBD,0x52,0x97,
2226 0xA1,0x77,0xBF,0x10,0x9E,0x37,0xEA,0x64,0xFA,0xCA,0x28,0x8D,
2227 0x9D,0x3B,0xD2,0x6E,0x09,0x5C,0x68,0xC7,0x45,0x90,0xFD,0xBB,
2228 0x70,0xC9,0x3A,0xBB,0xDF,0xD4,0x21,0x0F,0xC4,0x6A,0x3C,0xF6,
2229 0x61,0xCF,0x3F,0xD6,0x13,0xF1,0x5F,0xBC,0xCF,0xBC,0x26,0x9E,
2230 0xBC,0x0B,0xBD,0xAB,0x5D,0xC9,0x54,0x39,
2232 static unsigned char dh1024_g[]={
2233 0x3B,0x40,0x86,0xE7,0xF3,0x6C,0xDE,0x67,0x1C,0xCC,0x80,0x05,
2234 0x5A,0xDF,0xFE,0xBD,0x20,0x27,0x74,0x6C,0x24,0xC9,0x03,0xF3,
2235 0xE1,0x8D,0xC3,0x7D,0x98,0x27,0x40,0x08,0xB8,0x8C,0x6A,0xE9,
2236 0xBB,0x1A,0x3A,0xD6,0x86,0x83,0x5E,0x72,0x41,0xCE,0x85,0x3C,
2237 0xD2,0xB3,0xFC,0x13,0xCE,0x37,0x81,0x9E,0x4C,0x1C,0x7B,0x65,
2238 0xD3,0xE6,0xA6,0x00,0xF5,0x5A,0x95,0x43,0x5E,0x81,0xCF,0x60,
2239 0xA2,0x23,0xFC,0x36,0xA7,0x5D,0x7A,0x4C,0x06,0x91,0x6E,0xF6,
2240 0x57,0xEE,0x36,0xCB,0x06,0xEA,0xF5,0x3D,0x95,0x49,0xCB,0xA7,
2241 0xDD,0x81,0xDF,0x80,0x09,0x4A,0x97,0x4D,0xA8,0x22,0x72,0xA1,
2242 0x7F,0xC4,0x70,0x56,0x70,0xE8,0x20,0x10,0x18,0x8F,0x2E,0x60,
2243 0x07,0xE7,0x68,0x1A,0x82,0x5D,0x32,0xA2,
2247 if ((dh=DH_new()) == NULL) return(NULL);
2248 dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);
2249 dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);
2250 if ((dh->p == NULL) || (dh->g == NULL))
2251 { DH_free(dh); return(NULL); }
2257 static int do_test_cipherlist(void)
2260 const SSL_METHOD *meth;
2261 SSL_CIPHER *ci, *tci = NULL;
2263 #ifndef OPENSSL_NO_SSL2
2264 fprintf(stderr, "testing SSLv2 cipher list order: ");
2265 meth = SSLv2_method();
2266 while ((ci = meth->get_cipher(i++)) != NULL)
2269 if (ci->id >= tci->id)
2271 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2276 fprintf(stderr, "ok\n");
2278 #ifndef OPENSSL_NO_SSL3
2279 fprintf(stderr, "testing SSLv3 cipher list order: ");
2280 meth = SSLv3_method();
2282 while ((ci = meth->get_cipher(i++)) != NULL)
2285 if (ci->id >= tci->id)
2287 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2292 fprintf(stderr, "ok\n");
2294 #ifndef OPENSSL_NO_TLS1
2295 fprintf(stderr, "testing TLSv1 cipher list order: ");
2296 meth = TLSv1_method();
2298 while ((ci = meth->get_cipher(i++)) != NULL)
2301 if (ci->id >= tci->id)
2303 fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
2308 fprintf(stderr, "ok\n");