~ubuntu-branches/ubuntu/vivid/openssl/vivid-updates : revision 93

1

/* ssl/ssltest.c */

2

3

4

*

5

* This package is an SSL implementation written

6

* by Eric Young (eay@cryptsoft.com).

7

* The implementation was written so as to conform with Netscapes SSL.

8

*

9

* This library is free for commercial and non-commercial use as long as

10

* the following conditions are aheared to. The following conditions

11

* apply to all code found in this distribution, be it the RC4, RSA,

12

* lhash, DES, etc., code; not just the SSL code. The SSL documentation

13

* included with this distribution is covered by the same copyright terms

14

* except that the holder is Tim Hudson (tjh@cryptsoft.com).

15

*

16

* Copyright remains Eric Young's, and as such any Copyright notices in

17

* the code are not to be removed.

18

* If this package is used in a product, Eric Young should be given attribution

19

* as the author of the parts of the library used.

20

* This can be in the form of a textual message at program startup or

21

* in documentation (online or textual) provided with the package.

22

*

23

* Redistribution and use in source and binary forms, with or without

24

* modification, are permitted provided that the following conditions

25

* are met:

26

* 1. Redistributions of source code must retain the copyright

27

* notice, this list of conditions and the following disclaimer.

28

* 2. Redistributions in binary form must reproduce the above copyright

29

* notice, this list of conditions and the following disclaimer in the

30

* documentation and/or other materials provided with the distribution.

31

* 3. All advertising materials mentioning features or use of this software

32

* must display the following acknowledgement:

33

* "This product includes cryptographic software written by

34

* Eric Young (eay@cryptsoft.com)"

35

* The word 'cryptographic' can be left out if the rouines from the library

36

* being used are not cryptographic related :-).

37

* 4. If you include any Windows specific code (or a derivative thereof) from

38

* the apps directory (application code) you must include an acknowledgement:

39

* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"

40

*

41

* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND

42

* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

43

* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

44

* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE

45

* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

46

* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

47

* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

48

* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

49

* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

50

* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

51

* SUCH DAMAGE.

52

*

53

* The licence and distribution terms for any publically available version or

54

* derivative of this code cannot be changed. i.e. this code cannot simply be

55

* copied and put under another distribution licence

56

* [including the GNU Public Licence.]

57

*/

58

/* ====================================================================

59

60

*

61

* Redistribution and use in source and binary forms, with or without

62

* modification, are permitted provided that the following conditions

63

* are met:

64

*

65

* 1. Redistributions of source code must retain the above copyright

66

* notice, this list of conditions and the following disclaimer.

67

*

68

* 2. Redistributions in binary form must reproduce the above copyright

69

* notice, this list of conditions and the following disclaimer in

70

* the documentation and/or other materials provided with the

71

* distribution.

72

*

73

* 3. All advertising materials mentioning features or use of this

74

* software must display the following acknowledgment:

75

* "This product includes software developed by the OpenSSL Project

76

* for use in the OpenSSL Toolkit. (http://www.openssl.org/)"

77

*

78

* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

79

* endorse or promote products derived from this software without

80

* prior written permission. For written permission, please contact

81

* openssl-core@openssl.org.

82

*

83

* 5. Products derived from this software may not be called "OpenSSL"

84

* nor may "OpenSSL" appear in their names without prior written

85

* permission of the OpenSSL Project.

86

*

87

* 6. Redistributions of any form whatsoever must retain the following

88

* acknowledgment:

89

* "This product includes software developed by the OpenSSL Project

90

* for use in the OpenSSL Toolkit (http://www.openssl.org/)"

91

*

92

* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

93

* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

94

* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

95

* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR

96

* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

97

* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

98

* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

99

* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

100

* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

101

* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

102

* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

103

* OF THE POSSIBILITY OF SUCH DAMAGE.

104

* ====================================================================

105

*

106

* This product includes cryptographic software written by Eric Young

107

* (eay@cryptsoft.com). This product includes software written by Tim

108

* Hudson (tjh@cryptsoft.com).

109

*

110

*/

111

/* ====================================================================

112

113

* ECC cipher suite support in OpenSSL originally developed by

114

* SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.

115

*/

116

/* ====================================================================

117

118

*

119

* The portions of the attached software ("Contribution") is developed by

120

* Nokia Corporation and is licensed pursuant to the OpenSSL open source

121

* license.

122

*

123

* The Contribution, originally written by Mika Kousa and Pasi Eronen of

124

* Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites

125

* support (see RFC 4279) to OpenSSL.

126

*

127

* No patent licenses or other rights except those expressly stated in

128

* the OpenSSL open source license shall be deemed granted or received

129

* expressly, by implication, estoppel, or otherwise.

130

*

131

* No assurances are provided by Nokia that the Contribution does not

132

* infringe the patent or other intellectual property rights of any third

133

* party or that the license provides you with all the necessary rights

134

* to make use of the Contribution.

135

*

136

* THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN

137

* ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA

138

* SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY

139

* OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR

140

* OTHERWISE.

141

*/

142

143

#define _BSD_SOURCE 1 /* Or gethostname won't be declared properly

144

on Linux and GNU platforms. */

145

146

#include <assert.h>

147

#include <errno.h>

148

#include <limits.h>

149

#include <stdio.h>

150

#include <stdlib.h>

151

#include <string.h>

152

#include <time.h>

153

154

#define USE_SOCKETS

155

#include "e_os.h"

156

157

#ifdef OPENSSL_SYS_VMS

158

#define _XOPEN_SOURCE 500 /* Or isascii won't be declared properly on

159

VMS (at least with DECompHP C). */

160

#endif

161

162

#include <ctype.h>

163

164

#include <openssl/bio.h>

165

#include <openssl/crypto.h>

166

#include <openssl/evp.h>

167

#include <openssl/x509.h>

168

#include <openssl/x509v3.h>

169

#include <openssl/ssl.h>

170

#ifndef OPENSSL_NO_ENGINE

171

#include <openssl/engine.h>

172

#endif

173

#include <openssl/err.h>

174

#include <openssl/rand.h>

175

#ifndef OPENSSL_NO_RSA

176

#include <openssl/rsa.h>

177

#endif

178

#ifndef OPENSSL_NO_DSA

179

#include <openssl/dsa.h>

180

#endif

181

#ifndef OPENSSL_NO_DH

182

#include <openssl/dh.h>

183

#endif

184

#ifndef OPENSSL_NO_SRP

185

#include <openssl/srp.h>

186

#endif

187

#include <openssl/bn.h>

188

189

#define _XOPEN_SOURCE_EXTENDED 1 /* Or gethostname won't be declared properly

190

on Compaq platforms (at least with DEC C).

191

Do not try to put it earlier, or IPv6 includes

192

get screwed...

193

*/

194

195

#ifdef OPENSSL_SYS_WINDOWS

196

#include <winsock.h>

197

#else

198

#include OPENSSL_UNISTD

199

#endif

200

201

#ifdef OPENSSL_SYS_VMS

202

# define TEST_SERVER_CERT "SYS$DISK:[-.APPS]SERVER.PEM"

203

# define TEST_CLIENT_CERT "SYS$DISK:[-.APPS]CLIENT.PEM"

204

#elif defined(OPENSSL_SYS_WINCE)

205

# define TEST_SERVER_CERT "\\OpenSSL\\server.pem"

206

# define TEST_CLIENT_CERT "\\OpenSSL\\client.pem"

207

#elif defined(OPENSSL_SYS_NETWARE)

208

# define TEST_SERVER_CERT "\\openssl\\apps\\server.pem"

209

# define TEST_CLIENT_CERT "\\openssl\\apps\\client.pem"

210

#else

211

# define TEST_SERVER_CERT "../apps/server.pem"

212

# define TEST_CLIENT_CERT "../apps/client.pem"

213

#endif

214

215

/* There is really no standard for this, so let's assign some tentative

216

numbers. In any case, these numbers are only for this test */

217

#define COMP_RLE 255

218

#define COMP_ZLIB 1

219

220

static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);

221

#ifndef OPENSSL_NO_RSA

222

static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export,int keylength);

223

static void free_tmp_rsa(void);

224

#endif

225

static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg);

226

#define APP_CALLBACK_STRING "Test Callback Argument"

227

struct app_verify_arg

228

{

229

char *string;

230

int app_verify;

231

int allow_proxy_certs;

232

char *proxy_auth;

233

char *proxy_cond;

234

};

235

236

#ifndef OPENSSL_NO_DH

237

static DH *get_dh512(void);

238

static DH *get_dh1024(void);

239

static DH *get_dh1024dsa(void);

240

#endif

241

242

243

static char *psk_key=NULL; /* by default PSK is not used */

244

#ifndef OPENSSL_NO_PSK

245

static unsigned int psk_client_callback(SSL *ssl, const char *hint, char *identity,

246

unsigned int max_identity_len, unsigned char *psk,

247

unsigned int max_psk_len);

248

static unsigned int psk_server_callback(SSL *ssl, const char *identity, unsigned char *psk,

249

unsigned int max_psk_len);

250

#endif

251

252

#ifndef OPENSSL_NO_SRP

253

/* SRP client */

254

/* This is a context that we pass to all callbacks */

255

typedef struct srp_client_arg_st

256

{

257

char *srppassin;

258

char *srplogin;

259

} SRP_CLIENT_ARG;

260

261

#define PWD_STRLEN 1024

262

263

static char * MS_CALLBACK ssl_give_srp_client_pwd_cb(SSL *s, void *arg)

264

{

265

SRP_CLIENT_ARG *srp_client_arg = (SRP_CLIENT_ARG *)arg;

266

return BUF_strdup((char *)srp_client_arg->srppassin);

267

}

268

269

/* SRP server */

270

/* This is a context that we pass to SRP server callbacks */

271

typedef struct srp_server_arg_st

272

{

273

char *expected_user;

274

char *pass;

275

} SRP_SERVER_ARG;

276

277

static int MS_CALLBACK ssl_srp_server_param_cb(SSL *s, int *ad, void *arg)

278

{

279

SRP_SERVER_ARG * p = (SRP_SERVER_ARG *) arg;

280

281

if (strcmp(p->expected_user, SSL_get_srp_username(s)) != 0)

282

{

283

fprintf(stderr, "User %s doesn't exist\n", SSL_get_srp_username(s));

284

return SSL3_AL_FATAL;

285

}

286

if (SSL_set_srp_server_param_pw(s,p->expected_user,p->pass,"1024")<0)

287

{

288

*ad = SSL_AD_INTERNAL_ERROR;

289

return SSL3_AL_FATAL;

290

}

291

return SSL_ERROR_NONE;

292

}

293

#endif

294

295

static BIO *bio_err=NULL;

296

static BIO *bio_stdout=NULL;

297

298

static char *cipher=NULL;

299

static int verbose=0;

300

static int debug=0;

301

#if 0

302

/* Not used yet. */

303

#ifdef FIONBIO

304

static int s_nbio=0;

305

#endif

306

#endif

307

308

static const char rnd_seed[] = "string to make the random number generator think it has entropy";

309

310

int doit_biopair(SSL *s_ssl,SSL *c_ssl,long bytes,clock_t *s_time,clock_t *c_time);

311

int doit(SSL *s_ssl,SSL *c_ssl,long bytes);

312

static int do_test_cipherlist(void);

313

static void sv_usage(void)

314

{

315

fprintf(stderr,"usage: ssltest [args ...]\n");

316

fprintf(stderr,"\n");

317

#ifdef OPENSSL_FIPS

318

fprintf(stderr,"-F - run test in FIPS mode\n");

319

#endif

320

fprintf(stderr," -server_auth - check server certificate\n");

321

fprintf(stderr," -client_auth - do client authentication\n");

322

fprintf(stderr," -proxy - allow proxy certificates\n");

323

fprintf(stderr," -proxy_auth <val> - set proxy policy rights\n");

324

fprintf(stderr," -proxy_cond <val> - experssion to test proxy policy rights\n");

325

fprintf(stderr," -v - more output\n");

326

fprintf(stderr," -d - debug output\n");

327

fprintf(stderr," -reuse - use session-id reuse\n");

328

fprintf(stderr," -num <val> - number of connections to perform\n");

329

fprintf(stderr," -bytes <val> - number of bytes to swap between client/server\n");

330

#ifndef OPENSSL_NO_DH

331

fprintf(stderr," -dhe1024 - use 1024 bit key (safe prime) for DHE\n");

332

fprintf(stderr," -dhe1024dsa - use 1024 bit key (with 160-bit subprime) for DHE\n");

333

fprintf(stderr," -no_dhe - disable DHE\n");

334

#endif

335

#ifndef OPENSSL_NO_ECDH

336

fprintf(stderr," -no_ecdhe - disable ECDHE\n");

337

#endif

338

#ifndef OPENSSL_NO_PSK

339

fprintf(stderr," -psk arg - PSK in hex (without 0x)\n");

340

#endif

341

#ifndef OPENSSL_NO_SRP

342

fprintf(stderr," -srpuser user - SRP username to use\n");

343

fprintf(stderr," -srppass arg - password for 'user'\n");

344

#endif

345

#ifndef OPENSSL_NO_SSL2

346

fprintf(stderr," -ssl2 - use SSLv2\n");

347

#endif

348

#ifndef OPENSSL_NO_SSL3

349

fprintf(stderr," -ssl3 - use SSLv3\n");

350

#endif

351

#ifndef OPENSSL_NO_TLS1

352

fprintf(stderr," -tls1 - use TLSv1\n");

353

#endif

354

fprintf(stderr," -CApath arg - PEM format directory of CA's\n");

355

fprintf(stderr," -CAfile arg - PEM format file of CA's\n");

356

fprintf(stderr," -cert arg - Server certificate file\n");

357

fprintf(stderr," -key arg - Server key file (default: same as -cert)\n");

358

fprintf(stderr," -c_cert arg - Client certificate file\n");

359

fprintf(stderr," -c_key arg - Client key file (default: same as -c_cert)\n");

360

fprintf(stderr," -cipher arg - The cipher list\n");

361

fprintf(stderr," -bio_pair - Use BIO pairs\n");

362

fprintf(stderr," -f - Test even cases that can't work\n");

363

fprintf(stderr," -time - measure processor time used by client and server\n");

364

fprintf(stderr," -zlib - use zlib compression\n");

365

fprintf(stderr," -rle - use rle compression\n");

366

#ifndef OPENSSL_NO_ECDH

367

fprintf(stderr," -named_curve arg - Elliptic curve name to use for ephemeral ECDH keys.\n" \

368

" Use \"openssl ecparam -list_curves\" for all names\n" \

369

" (default is sect163r2).\n");

370

#endif

371

fprintf(stderr," -test_cipherlist - verifies the order of the ssl cipher lists\n");

372

}

373

374

static void print_details(SSL *c_ssl, const char *prefix)

375

{

376

const SSL_CIPHER *ciph;

377

X509 *cert;

378

379

ciph=SSL_get_current_cipher(c_ssl);

380

BIO_printf(bio_stdout,"%s%s, cipher %s %s",

381

prefix,

382

SSL_get_version(c_ssl),

383

SSL_CIPHER_get_version(ciph),

384

SSL_CIPHER_get_name(ciph));

385

cert=SSL_get_peer_certificate(c_ssl);

386

if (cert != NULL)

387

{

388

EVP_PKEY *pkey = X509_get_pubkey(cert);

389

if (pkey != NULL)

390

{

391

if (0)

392

;

393

#ifndef OPENSSL_NO_RSA

394

else if (pkey->type == EVP_PKEY_RSA && pkey->pkey.rsa != NULL

395

&& pkey->pkey.rsa->n != NULL)

396

{

397

BIO_printf(bio_stdout, ", %d bit RSA",

398

BN_num_bits(pkey->pkey.rsa->n));

399

}

400

#endif

401

#ifndef OPENSSL_NO_DSA

402

else if (pkey->type == EVP_PKEY_DSA && pkey->pkey.dsa != NULL

403

&& pkey->pkey.dsa->p != NULL)

404

{

405

BIO_printf(bio_stdout, ", %d bit DSA",

406

BN_num_bits(pkey->pkey.dsa->p));

407

}

408

#endif

409

EVP_PKEY_free(pkey);

410

}

411

X509_free(cert);

412

}

413

/* The SSL API does not allow us to look at temporary RSA/DH keys,

414

* otherwise we should print their lengths too */

415

BIO_printf(bio_stdout,"\n");

416

}

417

418

static void lock_dbg_cb(int mode, int type, const char *file, int line)

419

{

420

static int modes[CRYPTO_NUM_LOCKS]; /* = {0, 0, ... } */

421

const char *errstr = NULL;

422

int rw;

423

424

rw = mode & (CRYPTO_READ|CRYPTO_WRITE);

425

if (!((rw == CRYPTO_READ) || (rw == CRYPTO_WRITE)))

426

{

427

errstr = "invalid mode";

428

goto err;

429

}

430

431

if (type < 0 || type >= CRYPTO_NUM_LOCKS)

432

{

433

errstr = "type out of bounds";

434

goto err;

435

}

436

437

if (mode & CRYPTO_LOCK)

438

{

439

if (modes[type])

440

{

441

errstr = "already locked";

442

/* must not happen in a single-threaded program

443

* (would deadlock) */

444

goto err;

445

}

446

447

modes[type] = rw;

448

}

449

else if (mode & CRYPTO_UNLOCK)

450

{

451

if (!modes[type])

452

{

453

errstr = "not locked";

454

goto err;

455

}

456

457

if (modes[type] != rw)

458

{

459

errstr = (rw == CRYPTO_READ) ?

460

"CRYPTO_r_unlock on write lock" :

461

"CRYPTO_w_unlock on read lock";

462

}

463

464

modes[type] = 0;

465

}

466

else

467

{

468

errstr = "invalid mode";

469

goto err;

470

}

471

472

err:

473

if (errstr)

474

{

475

/* we cannot use bio_err here */

476

fprintf(stderr, "openssl (lock_dbg_cb): %s (mode=%d, type=%d) at %s:%d\n",

477

errstr, mode, type, file, line);

478

}

479

}

480

481

#ifdef TLSEXT_TYPE_opaque_prf_input

482

struct cb_info_st { void *input; size_t len; int ret; };

483

struct cb_info_st co1 = { "C", 1, 1 }; /* try to negotiate oqaque PRF input */

484

struct cb_info_st co2 = { "C", 1, 2 }; /* insist on oqaque PRF input */

485

struct cb_info_st so1 = { "S", 1, 1 }; /* try to negotiate oqaque PRF input */

486

struct cb_info_st so2 = { "S", 1, 2 }; /* insist on oqaque PRF input */

487

488

int opaque_prf_input_cb(SSL *ssl, void *peerinput, size_t len, void *arg_)

489

{

490

struct cb_info_st *arg = arg_;

491

492

if (arg == NULL)

493

return 1;

494

495

if (!SSL_set_tlsext_opaque_prf_input(ssl, arg->input, arg->len))

496

return 0;

497

return arg->ret;

498

}

499

#endif

500

501

int main(int argc, char *argv[])

502

{

503

char *CApath=NULL,*CAfile=NULL;

504

int badop=0;

505

int bio_pair=0;

506

int force=0;

507

int tls1=0,ssl2=0,ssl3=0,ret=1;

508

int client_auth=0;

509

int server_auth=0,i;

510

struct app_verify_arg app_verify_arg =

511

{ APP_CALLBACK_STRING, 0, 0, NULL, NULL };

512

char *server_cert=TEST_SERVER_CERT;

513

char *server_key=NULL;

514

char *client_cert=TEST_CLIENT_CERT;

515

char *client_key=NULL;

516

#ifndef OPENSSL_NO_ECDH

517

char *named_curve = NULL;

518

#endif

519

SSL_CTX *s_ctx=NULL;

520

SSL_CTX *c_ctx=NULL;

521

const SSL_METHOD *meth=NULL;

522

SSL *c_ssl,*s_ssl;

523

int number=1,reuse=0;

524

long bytes=256L;

525

#ifndef OPENSSL_NO_DH

526

DH *dh;

527

int dhe1024 = 0, dhe1024dsa = 0;

528

#endif

529

#ifndef OPENSSL_NO_ECDH

530

EC_KEY *ecdh = NULL;

531

#endif

532

#ifndef OPENSSL_NO_SRP

533

/* client */

534

SRP_CLIENT_ARG srp_client_arg = {NULL,NULL};

535

/* server */

536

SRP_SERVER_ARG srp_server_arg = {NULL,NULL};

537

#endif

538

int no_dhe = 0;

539

int no_ecdhe = 0;

540

int no_psk = 0;

541

int print_time = 0;

542

clock_t s_time = 0, c_time = 0;

543

int comp = 0;

544

#ifndef OPENSSL_NO_COMP

545

COMP_METHOD *cm = NULL;

546

#endif

547

STACK_OF(SSL_COMP) *ssl_comp_methods = NULL;

548

int test_cipherlist = 0;

549

#ifdef OPENSSL_FIPS

550

int fips_mode=0;

551

#endif

552

553

verbose = 0;

554

debug = 0;

555

cipher = 0;

556

557

bio_err=BIO_new_fp(stderr,BIO_NOCLOSE|BIO_FP_TEXT);

558

559

CRYPTO_set_locking_callback(lock_dbg_cb);

560

561

/* enable memory leak checking unless explicitly disabled */

562

if (!((getenv("OPENSSL_DEBUG_MEMORY") != NULL) && (0 == strcmp(getenv("OPENSSL_DEBUG_MEMORY"), "off"))))

563

{

564

CRYPTO_malloc_debug_init();

565

CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);

566

}

567

else

568

{

569

/* OPENSSL_DEBUG_MEMORY=off */

570

CRYPTO_set_mem_debug_functions(0, 0, 0, 0, 0);

571

}

572

CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);

573

574

RAND_seed(rnd_seed, sizeof rnd_seed);

575

576

bio_stdout=BIO_new_fp(stdout,BIO_NOCLOSE|BIO_FP_TEXT);

577

578

argc--;

579

argv++;

580

581

while (argc >= 1)

582

{

583

if(!strcmp(*argv,"-F"))

584

{

585

#ifdef OPENSSL_FIPS

586

fips_mode=1;

587

#else

588

fprintf(stderr,"not compiled with FIPS support, so exitting without running.\n");

589

EXIT(0);

590

#endif

591

}

592

else if (strcmp(*argv,"-server_auth") == 0)

593

server_auth=1;

594

else if (strcmp(*argv,"-client_auth") == 0)

595

client_auth=1;

596

else if (strcmp(*argv,"-proxy_auth") == 0)

597

{

598

if (--argc < 1) goto bad;

599

app_verify_arg.proxy_auth= *(++argv);

600

}

601

else if (strcmp(*argv,"-proxy_cond") == 0)

602

{

603

if (--argc < 1) goto bad;

604

app_verify_arg.proxy_cond= *(++argv);

605

}

606

else if (strcmp(*argv,"-v") == 0)

607

verbose=1;

608

else if (strcmp(*argv,"-d") == 0)

609

debug=1;

610

else if (strcmp(*argv,"-reuse") == 0)

611

reuse=1;

612

else if (strcmp(*argv,"-dhe1024") == 0)

613

{

614

#ifndef OPENSSL_NO_DH

615

dhe1024=1;

616

#else

617

fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");

618

#endif

619

}

620

else if (strcmp(*argv,"-dhe1024dsa") == 0)

621

{

622

#ifndef OPENSSL_NO_DH

623

dhe1024dsa=1;

624

#else

625

fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n");

626

#endif

627

}

628

else if (strcmp(*argv,"-no_dhe") == 0)

629

no_dhe=1;

630

else if (strcmp(*argv,"-no_ecdhe") == 0)

631

no_ecdhe=1;

632

else if (strcmp(*argv,"-psk") == 0)

633

{

634

if (--argc < 1) goto bad;

635

psk_key=*(++argv);

636

#ifndef OPENSSL_NO_PSK

637

if (strspn(psk_key, "abcdefABCDEF1234567890") != strlen(psk_key))

638

{

639

BIO_printf(bio_err,"Not a hex number '%s'\n",*argv);

640

goto bad;

641

}

642

#else

643

no_psk=1;

644

#endif

645

}

646

#ifndef OPENSSL_NO_SRP

647

else if (strcmp(*argv,"-srpuser") == 0)

648

{

649

if (--argc < 1) goto bad;

650

srp_server_arg.expected_user = srp_client_arg.srplogin= *(++argv);

651

tls1=1;

652

}

653

else if (strcmp(*argv,"-srppass") == 0)

654

{

655

if (--argc < 1) goto bad;

656

srp_server_arg.pass = srp_client_arg.srppassin= *(++argv);

657

tls1=1;

658

}

659

#endif

660

else if (strcmp(*argv,"-ssl2") == 0)

661

ssl2=1;

662

else if (strcmp(*argv,"-tls1") == 0)

663

tls1=1;

664

else if (strcmp(*argv,"-ssl3") == 0)

665

ssl3=1;

666

else if (strncmp(*argv,"-num",4) == 0)

667

{

668

if (--argc < 1) goto bad;

669

number= atoi(*(++argv));

670

if (number == 0) number=1;

671

}

672

else if (strcmp(*argv,"-bytes") == 0)

673

{

674

if (--argc < 1) goto bad;

675

bytes= atol(*(++argv));

676

if (bytes == 0L) bytes=1L;

677

i=strlen(argv[0]);

678

if (argv[0][i-1] == 'k') bytes*=1024L;

679

if (argv[0][i-1] == 'm') bytes*=1024L*1024L;

680

}

681

else if (strcmp(*argv,"-cert") == 0)

682

{

683

if (--argc < 1) goto bad;

684

server_cert= *(++argv);

685

}

686

else if (strcmp(*argv,"-s_cert") == 0)

687

{

688

if (--argc < 1) goto bad;

689

server_cert= *(++argv);

690

}

691

else if (strcmp(*argv,"-key") == 0)

692

{

693

if (--argc < 1) goto bad;

694

server_key= *(++argv);

695

}

696

else if (strcmp(*argv,"-s_key") == 0)

697

{

698

if (--argc < 1) goto bad;

699

server_key= *(++argv);

700

}

701

else if (strcmp(*argv,"-c_cert") == 0)

702

{

703

if (--argc < 1) goto bad;

704

client_cert= *(++argv);

705

}

706

else if (strcmp(*argv,"-c_key") == 0)

707

{

708

if (--argc < 1) goto bad;

709

client_key= *(++argv);

710

}

711

else if (strcmp(*argv,"-cipher") == 0)

712

{

713

if (--argc < 1) goto bad;

714

cipher= *(++argv);

715

}

716

else if (strcmp(*argv,"-CApath") == 0)

717

{

718

if (--argc < 1) goto bad;

719

CApath= *(++argv);

720

}

721

else if (strcmp(*argv,"-CAfile") == 0)

722

{

723

if (--argc < 1) goto bad;

724

CAfile= *(++argv);

725

}

726

else if (strcmp(*argv,"-bio_pair") == 0)

727

{

728

bio_pair = 1;

729

}

730

else if (strcmp(*argv,"-f") == 0)

731

{

732

force = 1;

733

}

734

else if (strcmp(*argv,"-time") == 0)

735

{

736

print_time = 1;

737

}

738

else if (strcmp(*argv,"-zlib") == 0)

739

{

740

comp = COMP_ZLIB;

741

}

742

else if (strcmp(*argv,"-rle") == 0)

743

{

744

comp = COMP_RLE;

745

}

746

else if (strcmp(*argv,"-named_curve") == 0)

747

{

748

if (--argc < 1) goto bad;

749

#ifndef OPENSSL_NO_ECDH

750

named_curve = *(++argv);

751

#else

752

fprintf(stderr,"ignoring -named_curve, since I'm compiled without ECDH\n");

753

++argv;

754

#endif

755

}

756

else if (strcmp(*argv,"-app_verify") == 0)

757

{

758

app_verify_arg.app_verify = 1;

759

}

760

else if (strcmp(*argv,"-proxy") == 0)

761

{

762

app_verify_arg.allow_proxy_certs = 1;

763

}

764

else if (strcmp(*argv,"-test_cipherlist") == 0)

765

{

766

test_cipherlist = 1;

767

}

768

else

769

{

770

fprintf(stderr,"unknown option %s\n",*argv);

771

badop=1;

772

break;

773

}

774

argc--;

775

argv++;

776

}

777

if (badop)

778

{

779

bad:

780

sv_usage();

781

goto end;

782

}

783

784

if (test_cipherlist == 1)

785

{

786

/* ensure that the cipher list are correctly sorted and exit */

787

if (do_test_cipherlist() == 0)

788

EXIT(1);

789

ret = 0;

790

goto end;

791

}

792

793

if (!ssl2 && !ssl3 && !tls1 && number > 1 && !reuse && !force)

794

{

795

fprintf(stderr, "This case cannot work. Use -f to perform "

796

"the test anyway (and\n-d to see what happens), "

797

"or add one of -ssl2, -ssl3, -tls1, -reuse\n"

798

"to avoid protocol mismatch.\n");

799

EXIT(1);

800

}

801

802

#ifdef OPENSSL_FIPS

803

if(fips_mode)

804

{

805

if(!FIPS_mode_set(1))

806

{

807

ERR_load_crypto_strings();

808

ERR_print_errors(BIO_new_fp(stderr,BIO_NOCLOSE));

809

EXIT(1);

810

}

811

else

812

fprintf(stderr,"*** IN FIPS MODE ***\n");

813

}

814

#endif

815

816

if (print_time)

817

{

818

if (!bio_pair)

819

{

820

fprintf(stderr, "Using BIO pair (-bio_pair)\n");

821

bio_pair = 1;

822

}

823

if (number < 50 && !force)

824

fprintf(stderr, "Warning: For accurate timings, use more connections (e.g. -num 1000)\n");

825

}

826

827

/* if (cipher == NULL) cipher=getenv("SSL_CIPHER"); */

828

829

SSL_library_init();

830

SSL_load_error_strings();

831

832

#ifndef OPENSSL_NO_COMP

833

if (comp == COMP_ZLIB) cm = COMP_zlib();

834

if (comp == COMP_RLE) cm = COMP_rle();

835

if (cm != NULL)

836

{

837

if (cm->type != NID_undef)

838

{

839

if (SSL_COMP_add_compression_method(comp, cm) != 0)

840

{

841

fprintf(stderr,

842

"Failed to add compression method\n");

843

ERR_print_errors_fp(stderr);

844

}

845

}

846

else

847

{

848

fprintf(stderr,

849

"Warning: %s compression not supported\n",

850

(comp == COMP_RLE ? "rle" :

851

(comp == COMP_ZLIB ? "zlib" :

852

"unknown")));

853

ERR_print_errors_fp(stderr);

854

}

855

}

856

ssl_comp_methods = SSL_COMP_get_compression_methods();

857

fprintf(stderr, "Available compression methods:\n");

858

{

859

int j, n = sk_SSL_COMP_num(ssl_comp_methods);

860

if (n == 0)

861

fprintf(stderr, " NONE\n");

862

else

863

for (j = 0; j < n; j++)

864

{

865

SSL_COMP *c = sk_SSL_COMP_value(ssl_comp_methods, j);

866

fprintf(stderr, " %d: %s\n", c->id, c->name);

867

}

868

}

869

#endif

870

871

#if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)

872

if (ssl2)

873

meth=SSLv2_method();

874

else

875

if (tls1)

876

meth=TLSv1_method();

877

else

878

if (ssl3)

879

meth=SSLv3_method();

880

else

881

meth=SSLv23_method();

882

#else

883

#ifdef OPENSSL_NO_SSL2

884

meth=SSLv3_method();

885

#else

886

meth=SSLv2_method();

887

#endif

888

#endif

889

890

c_ctx=SSL_CTX_new(meth);

891

s_ctx=SSL_CTX_new(meth);

892

if ((c_ctx == NULL) || (s_ctx == NULL))

893

{

894

ERR_print_errors(bio_err);

895

goto end;

896

}

897

898

if (cipher != NULL)

899

{

900

SSL_CTX_set_cipher_list(c_ctx,cipher);

901

SSL_CTX_set_cipher_list(s_ctx,cipher);

902

}

903

904

#ifndef OPENSSL_NO_DH

905

if (!no_dhe)

906

{

907

if (dhe1024dsa)

908

{

909

/* use SSL_OP_SINGLE_DH_USE to avoid small subgroup attacks */

910

SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);

911

dh=get_dh1024dsa();

912

}

913

else if (dhe1024)

914

dh=get_dh1024();

915

else

916

dh=get_dh512();

917

SSL_CTX_set_tmp_dh(s_ctx,dh);

918

DH_free(dh);

919

}

920

#else

921

(void)no_dhe;

922

#endif

923

924

#ifndef OPENSSL_NO_ECDH

925

if (!no_ecdhe)

926

{

927

int nid;

928

929

if (named_curve != NULL)

930

{

931

nid = OBJ_sn2nid(named_curve);

932

if (nid == 0)

933

{

934

BIO_printf(bio_err, "unknown curve name (%s)\n", named_curve);

935

goto end;

936

}

937

}

938

else

939

#ifdef OPENSSL_NO_EC2M

940

nid = NID_X9_62_prime256v1;

941

#else

942

nid = NID_sect163r2;

943

#endif

944

945

ecdh = EC_KEY_new_by_curve_name(nid);

946

if (ecdh == NULL)

947

{

948

BIO_printf(bio_err, "unable to create curve\n");

949

goto end;

950

}

951

952

SSL_CTX_set_tmp_ecdh(s_ctx, ecdh);

953

SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_ECDH_USE);

954

EC_KEY_free(ecdh);

955

}

956

#else

957

(void)no_ecdhe;

958

#endif

959

960

#ifndef OPENSSL_NO_RSA

961

SSL_CTX_set_tmp_rsa_callback(s_ctx,tmp_rsa_cb);

962

#endif

963

964

#ifdef TLSEXT_TYPE_opaque_prf_input

965

SSL_CTX_set_tlsext_opaque_prf_input_callback(c_ctx, opaque_prf_input_cb);

966

SSL_CTX_set_tlsext_opaque_prf_input_callback(s_ctx, opaque_prf_input_cb);

967

SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(c_ctx, &co1); /* or &co2 or NULL */

968

SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(s_ctx, &so1); /* or &so2 or NULL */

969

#endif

970

971

if (!SSL_CTX_use_certificate_file(s_ctx,server_cert,SSL_FILETYPE_PEM))

972

{

973

ERR_print_errors(bio_err);

974

}

975

else if (!SSL_CTX_use_PrivateKey_file(s_ctx,

976

(server_key?server_key:server_cert), SSL_FILETYPE_PEM))

977

{

978

ERR_print_errors(bio_err);

979

goto end;

980

}

981

982

if (client_auth)

983

{

984

SSL_CTX_use_certificate_file(c_ctx,client_cert,

985

SSL_FILETYPE_PEM);

986

SSL_CTX_use_PrivateKey_file(c_ctx,

987

(client_key?client_key:client_cert),

988

SSL_FILETYPE_PEM);

989

}

990

991

if ( (!SSL_CTX_load_verify_locations(s_ctx,CAfile,CApath)) ||

992

(!SSL_CTX_set_default_verify_paths(s_ctx)) ||

993

(!SSL_CTX_load_verify_locations(c_ctx,CAfile,CApath)) ||

994

(!SSL_CTX_set_default_verify_paths(c_ctx)))

995

{

996

/* fprintf(stderr,"SSL_load_verify_locations\n"); */

997

ERR_print_errors(bio_err);

998

/* goto end; */

999

}

1000

1001

if (client_auth)

1002

{

1003

BIO_printf(bio_err,"client authentication\n");

1004

SSL_CTX_set_verify(s_ctx,

1005

SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT,

1006

verify_callback);

1007

SSL_CTX_set_cert_verify_callback(s_ctx, app_verify_callback, &app_verify_arg);

1008

}

1009

if (server_auth)

1010

{

1011

BIO_printf(bio_err,"server authentication\n");

1012

SSL_CTX_set_verify(c_ctx,SSL_VERIFY_PEER,

1013

verify_callback);

1014

SSL_CTX_set_cert_verify_callback(c_ctx, app_verify_callback, &app_verify_arg);

1015

}

1016

1017

{

1018

int session_id_context = 0;

1019

SSL_CTX_set_session_id_context(s_ctx, (void *)&session_id_context, sizeof session_id_context);

1020

}

1021

1022

/* Use PSK only if PSK key is given */

1023

if (psk_key != NULL)

1024

{

1025

/* no_psk is used to avoid putting psk command to openssl tool */

1026

if (no_psk)

1027

{

1028

/* if PSK is not compiled in and psk key is

1029

* given, do nothing and exit successfully */

1030

ret=0;

1031

goto end;

1032

}

1033

#ifndef OPENSSL_NO_PSK

1034

SSL_CTX_set_psk_client_callback(c_ctx, psk_client_callback);

1035

SSL_CTX_set_psk_server_callback(s_ctx, psk_server_callback);

1036

if (debug)

1037

BIO_printf(bio_err,"setting PSK identity hint to s_ctx\n");

1038

if (!SSL_CTX_use_psk_identity_hint(s_ctx, "ctx server identity_hint"))

1039

{

1040

BIO_printf(bio_err,"error setting PSK identity hint to s_ctx\n");

1041

ERR_print_errors(bio_err);

1042

goto end;

1043

}

1044

#endif

1045

}

1046

#ifndef OPENSSL_NO_SRP

1047

if (srp_client_arg.srplogin)

1048

{

1049

if (!SSL_CTX_set_srp_username(c_ctx, srp_client_arg.srplogin))

1050

{

1051

BIO_printf(bio_err,"Unable to set SRP username\n");

1052

goto end;

1053

}

1054

SSL_CTX_set_srp_cb_arg(c_ctx,&srp_client_arg);

1055

SSL_CTX_set_srp_client_pwd_callback(c_ctx, ssl_give_srp_client_pwd_cb);

1056

/*SSL_CTX_set_srp_strength(c_ctx, srp_client_arg.strength);*/

1057

}

1058

1059

if (srp_server_arg.expected_user != NULL)

1060

{

1061

SSL_CTX_set_verify(s_ctx,SSL_VERIFY_NONE,verify_callback);

1062

SSL_CTX_set_srp_cb_arg(s_ctx, &srp_server_arg);

1063

SSL_CTX_set_srp_username_callback(s_ctx, ssl_srp_server_param_cb);

1064

}

1065

#endif

1066

1067

c_ssl=SSL_new(c_ctx);

1068

s_ssl=SSL_new(s_ctx);

1069

1070

#ifndef OPENSSL_NO_KRB5

1071

if (c_ssl && c_ssl->kssl_ctx)

1072

{

1073

char localhost[MAXHOSTNAMELEN+2];

1074

1075

if (gethostname(localhost, sizeof localhost-1) == 0)

1076

{

1077

localhost[sizeof localhost-1]='\0';

1078

if(strlen(localhost) == sizeof localhost-1)

1079

{

1080

BIO_printf(bio_err,"localhost name too long\n");

1081

goto end;

1082

}

1083

kssl_ctx_setstring(c_ssl->kssl_ctx, KSSL_SERVER,

1084

localhost);

1085

}

1086

}

1087

#endif /* OPENSSL_NO_KRB5 */

1088

1089

for (i=0; i<number; i++)

1090

{

1091

if (!reuse) SSL_set_session(c_ssl,NULL);

1092

if (bio_pair)

1093

ret=doit_biopair(s_ssl,c_ssl,bytes,&s_time,&c_time);

1094

else

1095

ret=doit(s_ssl,c_ssl,bytes);

1096

}

1097

1098

if (!verbose)

1099

{

1100

print_details(c_ssl, "");

1101

}

1102

if ((number > 1) || (bytes > 1L))

1103

BIO_printf(bio_stdout, "%d handshakes of %ld bytes done\n",number,bytes);

1104

if (print_time)

1105

{

1106

#ifdef CLOCKS_PER_SEC

1107

/* "To determine the time in seconds, the value returned

1108

* by the clock function should be divided by the value

1109

* of the macro CLOCKS_PER_SEC."

1110

* -- ISO/IEC 9899 */

1111

BIO_printf(bio_stdout, "Approximate total server time: %6.2f s\n"

1112

"Approximate total client time: %6.2f s\n",

1113

(double)s_time/CLOCKS_PER_SEC,

1114

(double)c_time/CLOCKS_PER_SEC);

1115

#else

1116

/* "`CLOCKS_PER_SEC' undeclared (first use this function)"

1117

* -- cc on NeXTstep/OpenStep */

1118

BIO_printf(bio_stdout,

1119

"Approximate total server time: %6.2f units\n"

1120

"Approximate total client time: %6.2f units\n",

1121

(double)s_time,

1122

(double)c_time);

1123

#endif

1124

}

1125

1126

SSL_free(s_ssl);

1127

SSL_free(c_ssl);

1128

1129

end:

1130

if (s_ctx != NULL) SSL_CTX_free(s_ctx);

1131

if (c_ctx != NULL) SSL_CTX_free(c_ctx);

1132

1133

if (bio_stdout != NULL) BIO_free(bio_stdout);

1134

1135

#ifndef OPENSSL_NO_RSA

1136

free_tmp_rsa();

1137

#endif

1138

#ifndef OPENSSL_NO_ENGINE

1139

ENGINE_cleanup();

1140

#endif

1141

CRYPTO_cleanup_all_ex_data();

1142

ERR_free_strings();

1143

ERR_remove_thread_state(NULL);

1144

EVP_cleanup();

1145

CRYPTO_mem_leaks(bio_err);

1146

if (bio_err != NULL) BIO_free(bio_err);

1147

EXIT(ret);

1148

return ret;

1149

}

1150

1151

int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count,

1152

clock_t *s_time, clock_t *c_time)

1153

{

1154

long cw_num = count, cr_num = count, sw_num = count, sr_num = count;

1155

BIO *s_ssl_bio = NULL, *c_ssl_bio = NULL;

1156

BIO *server = NULL, *server_io = NULL, *client = NULL, *client_io = NULL;

1157

int ret = 1;

1158

1159

size_t bufsiz = 256; /* small buffer for testing */

1160

1161

if (!BIO_new_bio_pair(&server, bufsiz, &server_io, bufsiz))

1162

goto err;

1163

if (!BIO_new_bio_pair(&client, bufsiz, &client_io, bufsiz))

1164

goto err;

1165

1166

s_ssl_bio = BIO_new(BIO_f_ssl());

1167

if (!s_ssl_bio)

1168

goto err;

1169

1170

c_ssl_bio = BIO_new(BIO_f_ssl());

1171

if (!c_ssl_bio)

1172

goto err;

1173

1174

SSL_set_connect_state(c_ssl);

1175

SSL_set_bio(c_ssl, client, client);

1176

(void)BIO_set_ssl(c_ssl_bio, c_ssl, BIO_NOCLOSE);

1177

1178

SSL_set_accept_state(s_ssl);

1179

SSL_set_bio(s_ssl, server, server);

1180

(void)BIO_set_ssl(s_ssl_bio, s_ssl, BIO_NOCLOSE);

1181

1182

do

1183

{

1184

/* c_ssl_bio: SSL filter BIO

1185

*

1186

* client: pseudo-I/O for SSL library

1187

*

1188

* client_io: client's SSL communication; usually to be

1189

* relayed over some I/O facility, but in this

1190

* test program, we're the server, too:

1191

*

1192

* server_io: server's SSL communication

1193

*

1194

* server: pseudo-I/O for SSL library

1195

*

1196

* s_ssl_bio: SSL filter BIO

1197

*

1198

* The client and the server each employ a "BIO pair":

1199

* client + client_io, server + server_io.

1200

* BIO pairs are symmetric. A BIO pair behaves similar

1201

* to a non-blocking socketpair (but both endpoints must

1202

* be handled by the same thread).

1203

* [Here we could connect client and server to the ends

1204

* of a single BIO pair, but then this code would be less

1205

* suitable as an example for BIO pairs in general.]

1206

*

1207

* Useful functions for querying the state of BIO pair endpoints:

1208

*

1209

* BIO_ctrl_pending(bio) number of bytes we can read now

1210

* BIO_ctrl_get_read_request(bio) number of bytes needed to fulfil

1211

* other side's read attempt

1212

* BIO_ctrl_get_write_guarantee(bio) number of bytes we can write now

1213

*

1214

* ..._read_request is never more than ..._write_guarantee;

1215

* it depends on the application which one you should use.

1216

*/

1217

1218

/* We have non-blocking behaviour throughout this test program, but

1219

* can be sure that there is *some* progress in each iteration; so

1220

* we don't have to worry about ..._SHOULD_READ or ..._SHOULD_WRITE

1221

* -- we just try everything in each iteration

1222

*/

1223

1224

{

1225

/* CLIENT */

1226

1227

MS_STATIC char cbuf[1024*8];

1228

int i, r;

1229

clock_t c_clock = clock();

1230

1231

memset(cbuf, 0, sizeof(cbuf));

1232

1233

if (debug)

1234

if (SSL_in_init(c_ssl))

1235

printf("client waiting in SSL_connect - %s\n",

1236

SSL_state_string_long(c_ssl));

1237

1238

if (cw_num > 0)

1239

{

1240

/* Write to server. */

1241

1242

if (cw_num > (long)sizeof cbuf)

1243

i = sizeof cbuf;

1244

else

1245

i = (int)cw_num;

1246

r = BIO_write(c_ssl_bio, cbuf, i);

1247

if (r < 0)

1248

{

1249

if (!BIO_should_retry(c_ssl_bio))

1250

{

1251

fprintf(stderr,"ERROR in CLIENT\n");

1252

goto err;

1253

}

1254

/* BIO_should_retry(...) can just be ignored here.

1255

* The library expects us to call BIO_write with

1256

* the same arguments again, and that's what we will

1257

* do in the next iteration. */

1258

}

1259

else if (r == 0)

1260

{

1261

fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");

1262

goto err;

1263

}

1264

else

1265

{

1266

if (debug)

1267

printf("client wrote %d\n", r);

1268

cw_num -= r;

1269

}

1270

}

1271

1272

if (cr_num > 0)

1273

{

1274

/* Read from server. */

1275

1276

r = BIO_read(c_ssl_bio, cbuf, sizeof(cbuf));

1277

if (r < 0)

1278

{

1279

if (!BIO_should_retry(c_ssl_bio))

1280

{

1281

fprintf(stderr,"ERROR in CLIENT\n");

1282

goto err;

1283

}

1284

/* Again, "BIO_should_retry" can be ignored. */

1285

}

1286

else if (r == 0)

1287

{

1288

fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");

1289

goto err;

1290

}

1291

else

1292

{

1293

if (debug)

1294

printf("client read %d\n", r);

1295

cr_num -= r;

1296

}

1297

}

1298

1299

/* c_time and s_time increments will typically be very small

1300

* (depending on machine speed and clock tick intervals),

1301

* but sampling over a large number of connections should

1302

* result in fairly accurate figures. We cannot guarantee

1303

* a lot, however -- if each connection lasts for exactly

1304

* one clock tick, it will be counted only for the client

1305

* or only for the server or even not at all.

1306

*/

1307

*c_time += (clock() - c_clock);

1308

}

1309

1310

{

1311

/* SERVER */

1312

1313

MS_STATIC char sbuf[1024*8];

1314

int i, r;

1315

clock_t s_clock = clock();

1316

1317

memset(sbuf, 0, sizeof(sbuf));

1318

1319

if (debug)

1320

if (SSL_in_init(s_ssl))

1321

printf("server waiting in SSL_accept - %s\n",

1322

SSL_state_string_long(s_ssl));

1323

1324

if (sw_num > 0)

1325

{

1326

/* Write to client. */

1327

1328

if (sw_num > (long)sizeof sbuf)

1329

i = sizeof sbuf;

1330

else

1331

i = (int)sw_num;

1332

r = BIO_write(s_ssl_bio, sbuf, i);

1333

if (r < 0)

1334

{

1335

if (!BIO_should_retry(s_ssl_bio))

1336

{

1337

fprintf(stderr,"ERROR in SERVER\n");

1338

goto err;

1339

}

1340

/* Ignore "BIO_should_retry". */

1341

}

1342

else if (r == 0)

1343

{

1344

fprintf(stderr,"SSL SERVER STARTUP FAILED\n");

1345

goto err;

1346

}

1347

else

1348

{

1349

if (debug)

1350

printf("server wrote %d\n", r);

1351

sw_num -= r;

1352

}

1353

}

1354

1355

if (sr_num > 0)

1356

{

1357

/* Read from client. */

1358

1359

r = BIO_read(s_ssl_bio, sbuf, sizeof(sbuf));

1360

if (r < 0)

1361

{

1362

if (!BIO_should_retry(s_ssl_bio))

1363

{

1364

fprintf(stderr,"ERROR in SERVER\n");

1365

goto err;

1366

}

1367

/* blah, blah */

1368

}

1369

else if (r == 0)

1370

{

1371

fprintf(stderr,"SSL SERVER STARTUP FAILED\n");

1372

goto err;

1373

}

1374

else

1375

{

1376

if (debug)

1377

printf("server read %d\n", r);

1378

sr_num -= r;

1379

}

1380

}

1381

1382

*s_time += (clock() - s_clock);

1383

}

1384

1385

{

1386

/* "I/O" BETWEEN CLIENT AND SERVER. */

1387

1388

size_t r1, r2;

1389

BIO *io1 = server_io, *io2 = client_io;

1390

/* we use the non-copying interface for io1

1391

* and the standard BIO_write/BIO_read interface for io2

1392

*/

1393

1394

static int prev_progress = 1;

1395

int progress = 0;

1396

1397

/* io1 to io2 */

1398

do

1399

{

1400

size_t num;

1401

int r;

1402

1403

r1 = BIO_ctrl_pending(io1);

1404

r2 = BIO_ctrl_get_write_guarantee(io2);

1405

1406

num = r1;

1407

if (r2 < num)

1408

num = r2;

1409

if (num)

1410

{

1411

char *dataptr;

1412

1413

if (INT_MAX < num) /* yeah, right */

1414

num = INT_MAX;

1415

1416

r = BIO_nread(io1, &dataptr, (int)num);

1417

assert(r > 0);

1418

assert(r <= (int)num);

1419

/* possibly r < num (non-contiguous data) */

1420

num = r;

1421

r = BIO_write(io2, dataptr, (int)num);

1422

if (r != (int)num) /* can't happen */

1423

{

1424

fprintf(stderr, "ERROR: BIO_write could not write "

1425

"BIO_ctrl_get_write_guarantee() bytes");

1426

goto err;

1427

}

1428

progress = 1;

1429

1430

if (debug)

1431

printf((io1 == client_io) ?

1432

"C->S relaying: %d bytes\n" :

1433

"S->C relaying: %d bytes\n",

1434

(int)num);

1435

}

1436

}

1437

while (r1 && r2);

1438

1439

/* io2 to io1 */

1440

{

1441

size_t num;

1442

int r;

1443

1444

r1 = BIO_ctrl_pending(io2);

1445

r2 = BIO_ctrl_get_read_request(io1);

1446

/* here we could use ..._get_write_guarantee instead of

1447

* ..._get_read_request, but by using the latter

1448

* we test restartability of the SSL implementation

1449

* more thoroughly */

1450

num = r1;

1451

if (r2 < num)

1452

num = r2;

1453

if (num)

1454

{

1455

char *dataptr;

1456

1457

if (INT_MAX < num)

1458

num = INT_MAX;

1459

1460

if (num > 1)

1461

--num; /* test restartability even more thoroughly */

1462

1463

r = BIO_nwrite0(io1, &dataptr);

1464

assert(r > 0);

1465

if (r < (int)num)

1466

num = r;

1467

r = BIO_read(io2, dataptr, (int)num);

1468

if (r != (int)num) /* can't happen */

1469

{

1470

fprintf(stderr, "ERROR: BIO_read could not read "

1471

"BIO_ctrl_pending() bytes");

1472

goto err;

1473

}

1474

progress = 1;

1475

r = BIO_nwrite(io1, &dataptr, (int)num);

1476

if (r != (int)num) /* can't happen */

1477

{

1478

fprintf(stderr, "ERROR: BIO_nwrite() did not accept "

1479

"BIO_nwrite0() bytes");

1480

goto err;

1481

}

1482

1483

if (debug)

1484

printf((io2 == client_io) ?

1485

"C->S relaying: %d bytes\n" :

1486

"S->C relaying: %d bytes\n",

1487

(int)num);

1488

}

1489

} /* no loop, BIO_ctrl_get_read_request now returns 0 anyway */

1490

1491

if (!progress && !prev_progress)

1492

if (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0)

1493

{

1494

fprintf(stderr, "ERROR: got stuck\n");

1495

if (strcmp("SSLv2", SSL_get_version(c_ssl)) == 0)

1496

{

1497

fprintf(stderr, "This can happen for SSL2 because "

1498

"CLIENT-FINISHED and SERVER-VERIFY are written \n"

1499

"concurrently ...");

1500

if (strncmp("2SCF", SSL_state_string(c_ssl), 4) == 0

1501

&& strncmp("2SSV", SSL_state_string(s_ssl), 4) == 0)

1502

{

1503

fprintf(stderr, " ok.\n");

1504

goto end;

1505

}

1506

}

1507

fprintf(stderr, " ERROR.\n");

1508

goto err;

1509

}

1510

prev_progress = progress;

1511

}

1512

}

1513

while (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0);

1514

1515

if (verbose)

1516

print_details(c_ssl, "DONE via BIO pair: ");

1517

end:

1518

ret = 0;

1519

1520

err:

1521

ERR_print_errors(bio_err);

1522

1523

if (server)

1524

BIO_free(server);

1525

if (server_io)

1526

BIO_free(server_io);

1527

if (client)

1528

BIO_free(client);

1529

if (client_io)

1530

BIO_free(client_io);

1531

if (s_ssl_bio)

1532

BIO_free(s_ssl_bio);

1533

if (c_ssl_bio)

1534

BIO_free(c_ssl_bio);

1535

1536

return ret;

1537

}

1538

1539

1540

#define W_READ 1

1541

#define W_WRITE 2

1542

#define C_DONE 1

1543

#define S_DONE 2

1544

1545

int doit(SSL *s_ssl, SSL *c_ssl, long count)

1546

{

1547

MS_STATIC char cbuf[1024*8],sbuf[1024*8];

1548

long cw_num=count,cr_num=count;

1549

long sw_num=count,sr_num=count;

1550

int ret=1;

1551

BIO *c_to_s=NULL;

1552

BIO *s_to_c=NULL;

1553

BIO *c_bio=NULL;

1554

BIO *s_bio=NULL;

1555

int c_r,c_w,s_r,s_w;

1556

int i,j;

1557

int done=0;

1558

int c_write,s_write;

1559

int do_server=0,do_client=0;

1560

1561

memset(cbuf,0,sizeof(cbuf));

1562

memset(sbuf,0,sizeof(sbuf));

1563

1564

c_to_s=BIO_new(BIO_s_mem());

1565

s_to_c=BIO_new(BIO_s_mem());

1566

if ((s_to_c == NULL) || (c_to_s == NULL))

1567

{

1568

ERR_print_errors(bio_err);

1569

goto err;

1570

}

1571

1572

c_bio=BIO_new(BIO_f_ssl());

1573

s_bio=BIO_new(BIO_f_ssl());

1574

if ((c_bio == NULL) || (s_bio == NULL))

1575

{

1576

ERR_print_errors(bio_err);

1577

goto err;

1578

}

1579

1580

SSL_set_connect_state(c_ssl);

1581

SSL_set_bio(c_ssl,s_to_c,c_to_s);

1582

BIO_set_ssl(c_bio,c_ssl,BIO_NOCLOSE);

1583

1584

SSL_set_accept_state(s_ssl);

1585

SSL_set_bio(s_ssl,c_to_s,s_to_c);

1586

BIO_set_ssl(s_bio,s_ssl,BIO_NOCLOSE);

1587

1588

c_r=0; s_r=1;

1589

c_w=1; s_w=0;

1590

c_write=1,s_write=0;

1591

1592

/* We can always do writes */

1593

for (;;)

1594

{

1595

do_server=0;

1596

do_client=0;

1597

1598

i=(int)BIO_pending(s_bio);

1599

if ((i && s_r) || s_w) do_server=1;

1600

1601

i=(int)BIO_pending(c_bio);

1602

if ((i && c_r) || c_w) do_client=1;

1603

1604

if (do_server && debug)

1605

{

1606

if (SSL_in_init(s_ssl))

1607

printf("server waiting in SSL_accept - %s\n",

1608

SSL_state_string_long(s_ssl));

1609

/* else if (s_write)

1610

printf("server:SSL_write()\n");

1611

else

1612

printf("server:SSL_read()\n"); */

1613

}

1614

1615

if (do_client && debug)

1616

{

1617

if (SSL_in_init(c_ssl))

1618

printf("client waiting in SSL_connect - %s\n",

1619

SSL_state_string_long(c_ssl));

1620

/* else if (c_write)

1621

printf("client:SSL_write()\n");

1622

else

1623

printf("client:SSL_read()\n"); */

1624

}

1625

1626

if (!do_client && !do_server)

1627

{

1628

fprintf(stdout,"ERROR IN STARTUP\n");

1629

ERR_print_errors(bio_err);

1630

break;

1631

}

1632

if (do_client && !(done & C_DONE))

1633

{

1634

if (c_write)

1635

{

1636

j = (cw_num > (long)sizeof(cbuf)) ?

1637

(int)sizeof(cbuf) : (int)cw_num;

1638

i=BIO_write(c_bio,cbuf,j);

1639

if (i < 0)

1640

{

1641

c_r=0;

1642

c_w=0;

1643

if (BIO_should_retry(c_bio))

1644

{

1645

if (BIO_should_read(c_bio))

1646

c_r=1;

1647

if (BIO_should_write(c_bio))

1648

c_w=1;

1649

}

1650

else

1651

{

1652

fprintf(stderr,"ERROR in CLIENT\n");

1653

ERR_print_errors(bio_err);

1654

goto err;

1655

}

1656

}

1657

else if (i == 0)

1658

{

1659

fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");

1660

goto err;

1661

}

1662

else

1663

{

1664

if (debug)

1665

printf("client wrote %d\n",i);

1666

/* ok */

1667

s_r=1;

1668

c_write=0;

1669

cw_num-=i;

1670

}

1671

}

1672

else

1673

{

1674

i=BIO_read(c_bio,cbuf,sizeof(cbuf));

1675

if (i < 0)

1676

{

1677

c_r=0;

1678

c_w=0;

1679

if (BIO_should_retry(c_bio))

1680

{

1681

if (BIO_should_read(c_bio))

1682

c_r=1;

1683

if (BIO_should_write(c_bio))

1684

c_w=1;

1685

}

1686

else

1687

{

1688

fprintf(stderr,"ERROR in CLIENT\n");

1689

ERR_print_errors(bio_err);

1690

goto err;

1691

}

1692

}

1693

else if (i == 0)

1694

{

1695

fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");

1696

goto err;

1697

}

1698

else

1699

{

1700

if (debug)

1701

printf("client read %d\n",i);

1702

cr_num-=i;

1703

if (sw_num > 0)

1704

{

1705

s_write=1;

1706

s_w=1;

1707

}

1708

if (cr_num <= 0)

1709

{

1710

s_write=1;

1711

s_w=1;

1712

done=S_DONE|C_DONE;

1713

}

1714

}

1715

}

1716

}

1717

1718

if (do_server && !(done & S_DONE))

1719

{

1720

if (!s_write)

1721

{

1722

i=BIO_read(s_bio,sbuf,sizeof(cbuf));

1723

if (i < 0)

1724

{

1725

s_r=0;

1726

s_w=0;

1727

if (BIO_should_retry(s_bio))

1728

{

1729

if (BIO_should_read(s_bio))

1730

s_r=1;

1731

if (BIO_should_write(s_bio))

1732

s_w=1;

1733

}

1734

else

1735

{

1736

fprintf(stderr,"ERROR in SERVER\n");

1737

ERR_print_errors(bio_err);

1738

goto err;

1739

}

1740

}

1741

else if (i == 0)

1742

{

1743

ERR_print_errors(bio_err);

1744

fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_read\n");

1745

goto err;

1746

}

1747

else

1748

{

1749

if (debug)

1750

printf("server read %d\n",i);

1751

sr_num-=i;

1752

if (cw_num > 0)

1753

{

1754

c_write=1;

1755

c_w=1;

1756

}

1757

if (sr_num <= 0)

1758

{

1759

s_write=1;

1760

s_w=1;

1761

c_write=0;

1762

}

1763

}

1764

}

1765

else

1766

{

1767

j = (sw_num > (long)sizeof(sbuf)) ?

1768

(int)sizeof(sbuf) : (int)sw_num;

1769

i=BIO_write(s_bio,sbuf,j);

1770

if (i < 0)

1771

{

1772

s_r=0;

1773

s_w=0;

1774

if (BIO_should_retry(s_bio))

1775

{

1776

if (BIO_should_read(s_bio))

1777

s_r=1;

1778

if (BIO_should_write(s_bio))

1779

s_w=1;

1780

}

1781

else

1782

{

1783

fprintf(stderr,"ERROR in SERVER\n");

1784

ERR_print_errors(bio_err);

1785

goto err;

1786

}

1787

}

1788

else if (i == 0)

1789

{

1790

ERR_print_errors(bio_err);

1791

fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_write\n");

1792

goto err;

1793

}

1794

else

1795

{

1796

if (debug)

1797

printf("server wrote %d\n",i);

1798

sw_num-=i;

1799

s_write=0;

1800

c_r=1;

1801

if (sw_num <= 0)

1802

done|=S_DONE;

1803

}

1804

}

1805

}

1806

1807

if ((done & S_DONE) && (done & C_DONE)) break;

1808

}

1809

1810

if (verbose)

1811

print_details(c_ssl, "DONE: ");

1812

ret=0;

1813

err:

1814

/* We have to set the BIO's to NULL otherwise they will be

1815

* OPENSSL_free()ed twice. Once when th s_ssl is SSL_free()ed and

1816

* again when c_ssl is SSL_free()ed.

1817

* This is a hack required because s_ssl and c_ssl are sharing the same

1818

* BIO structure and SSL_set_bio() and SSL_free() automatically

1819

* BIO_free non NULL entries.

1820

* You should not normally do this or be required to do this */

1821

if (s_ssl != NULL)

1822

{

1823

s_ssl->rbio=NULL;

1824

s_ssl->wbio=NULL;

1825

}

1826

if (c_ssl != NULL)

1827

{

1828

c_ssl->rbio=NULL;

1829

c_ssl->wbio=NULL;

1830

}

1831

1832

if (c_to_s != NULL) BIO_free(c_to_s);

1833

if (s_to_c != NULL) BIO_free(s_to_c);

1834

if (c_bio != NULL) BIO_free_all(c_bio);

1835

if (s_bio != NULL) BIO_free_all(s_bio);

1836

return(ret);

1837

}

1838

1839

static int get_proxy_auth_ex_data_idx(void)

1840

{

1841

static volatile int idx = -1;

1842

if (idx < 0)

1843

{

1844

CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);

1845

if (idx < 0)

1846

{

1847

idx = X509_STORE_CTX_get_ex_new_index(0,

1848

"SSLtest for verify callback", NULL,NULL,NULL);

1849

}

1850

CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);

1851

}

1852

return idx;

1853

}

1854

1855

static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)

1856

{

1857

char *s,buf[256];

1858

1859

s=X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),buf,

1860

sizeof buf);

1861

if (s != NULL)

1862

{

1863

if (ok)

1864

fprintf(stderr,"depth=%d %s\n",

1865

ctx->error_depth,buf);

1866

else

1867

{

1868

fprintf(stderr,"depth=%d error=%d %s\n",

1869

ctx->error_depth,ctx->error,buf);

1870

}

1871

}

1872

1873

if (ok == 0)

1874

{

1875

fprintf(stderr,"Error string: %s\n",

1876

X509_verify_cert_error_string(ctx->error));

1877

switch (ctx->error)

1878

{

1879

case X509_V_ERR_CERT_NOT_YET_VALID:

1880

case X509_V_ERR_CERT_HAS_EXPIRED:

1881

case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:

1882

fprintf(stderr," ... ignored.\n");

1883

ok=1;

1884

}

1885

}

1886

1887

if (ok == 1)

1888

{

1889

X509 *xs = ctx->current_cert;

1890

#if 0

1891

X509 *xi = ctx->current_issuer;

1892

#endif

1893

1894

if (xs->ex_flags & EXFLAG_PROXY)

1895

{

1896

unsigned int *letters =

1897

X509_STORE_CTX_get_ex_data(ctx,

1898

get_proxy_auth_ex_data_idx());

1899

1900

if (letters)

1901

{

1902

int found_any = 0;

1903

int i;

1904

PROXY_CERT_INFO_EXTENSION *pci =

1905

X509_get_ext_d2i(xs, NID_proxyCertInfo,

1906

NULL, NULL);

1907

1908

switch (OBJ_obj2nid(pci->proxyPolicy->policyLanguage))

1909

{

1910

case NID_Independent:

1911

/* Completely meaningless in this

1912

program, as there's no way to

1913

grant explicit rights to a

1914

specific PrC. Basically, using

1915

id-ppl-Independent is the perfect

1916

way to grant no rights at all. */

1917

fprintf(stderr, " Independent proxy certificate");

1918

for (i = 0; i < 26; i++)

1919

letters[i] = 0;

1920

break;

1921

case NID_id_ppl_inheritAll:

1922

/* This is basically a NOP, we

1923

simply let the current rights

1924

stand as they are. */

1925

fprintf(stderr, " Proxy certificate inherits all");

1926

break;

1927

default:

1928

s = (char *)

1929

pci->proxyPolicy->policy->data;

1930

i = pci->proxyPolicy->policy->length;

1931

1932

/* The algorithm works as follows:

1933

it is assumed that previous

1934

iterations or the initial granted

1935

rights has already set some elements

1936

of `letters'. What we need to do is

1937

to clear those that weren't granted

1938

by the current PrC as well. The

1939

easiest way to do this is to add 1

1940

to all the elements whose letters

1941

are given with the current policy.

1942

That way, all elements that are set

1943

by the current policy and were

1944

already set by earlier policies and

1945

through the original grant of rights

1946

will get the value 2 or higher.

1947

The last thing to do is to sweep

1948

through `letters' and keep the

1949

elements having the value 2 as set,

1950

and clear all the others. */

1951

1952

fprintf(stderr, " Certificate proxy rights = %*.*s", i, i, s);

1953

while(i-- > 0)

1954

{

1955

int c = *s++;

1956

if (isascii(c) && isalpha(c))

1957

{

1958

if (islower(c))

1959

c = toupper(c);

1960

letters[c - 'A']++;

1961

}

1962

}

1963

for (i = 0; i < 26; i++)

1964

if (letters[i] < 2)

1965

letters[i] = 0;

1966

else

1967

letters[i] = 1;

1968

}

1969

1970

found_any = 0;

1971

fprintf(stderr,

1972

", resulting proxy rights = ");

1973

for(i = 0; i < 26; i++)

1974

if (letters[i])

1975

{

1976

fprintf(stderr, "%c", i + 'A');

1977

found_any = 1;

1978

}

1979

if (!found_any)

1980

fprintf(stderr, "none");

1981

fprintf(stderr, "\n");

1982

1983

PROXY_CERT_INFO_EXTENSION_free(pci);

1984

}

1985

}

1986

}

1987

1988

return(ok);

1989

}

1990

1991

static void process_proxy_debug(int indent, const char *format, ...)

1992

{

1993

static const char indentation[] =

1994

">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"

1995

">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"; /* That's 80 > */

1996

char my_format[256];

1997

va_list args;

1998

1999

BIO_snprintf(my_format, sizeof(my_format), "%*.*s %s",

2000

indent, indent, indentation, format);

2001

2002

va_start(args, format);

2003

vfprintf(stderr, my_format, args);

2004

va_end(args);

2005

}

2006

/* Priority levels:

2007

0 [!]var, ()

2008

1 & ^

2009

2 |

2010

*/

2011

static int process_proxy_cond_adders(unsigned int letters[26],

2012

const char *cond, const char **cond_end, int *pos, int indent);

2013

static int process_proxy_cond_val(unsigned int letters[26],

2014

const char *cond, const char **cond_end, int *pos, int indent)

2015

{

2016

int c;

2017

int ok = 1;

2018

int negate = 0;

2019

2020

while(isspace((int)*cond))

2021

{

2022

cond++; (*pos)++;

2023

}

2024

c = *cond;

2025

2026

if (debug)

2027

process_proxy_debug(indent,

2028

"Start process_proxy_cond_val at position %d: %s\n",

2029

*pos, cond);

2030

2031

while(c == '!')

2032

{

2033

negate = !negate;

2034

cond++; (*pos)++;

2035

while(isspace((int)*cond))

2036

{

2037

cond++; (*pos)++;

2038

}

2039

c = *cond;

2040

}

2041

2042

if (c == '(')

2043

{

2044

cond++; (*pos)++;

2045

ok = process_proxy_cond_adders(letters, cond, cond_end, pos,

2046

indent + 1);

2047

cond = *cond_end;

2048

if (ok < 0)

2049

goto end;

2050

while(isspace((int)*cond))

2051

{

2052

cond++; (*pos)++;

2053

}

2054

c = *cond;

2055

if (c != ')')

2056

{

2057

fprintf(stderr,

2058

"Weird condition character in position %d: "

2059

"%c\n", *pos, c);

2060

ok = -1;

2061

goto end;

2062

}

2063

cond++; (*pos)++;

2064

}

2065

else if (isascii(c) && isalpha(c))

2066

{

2067

if (islower(c))

2068

c = toupper(c);

2069

ok = letters[c - 'A'];

2070

cond++; (*pos)++;

2071

}

2072

else

2073

{

2074

fprintf(stderr,

2075

"Weird condition character in position %d: "

2076

"%c\n", *pos, c);

2077

ok = -1;

2078

goto end;

2079

}

2080

end:

2081

*cond_end = cond;

2082

if (ok >= 0 && negate)

2083

ok = !ok;

2084

2085

if (debug)

2086

process_proxy_debug(indent,

2087

"End process_proxy_cond_val at position %d: %s, returning %d\n",

2088

*pos, cond, ok);

2089

2090

return ok;

2091

}

2092

static int process_proxy_cond_multipliers(unsigned int letters[26],

2093

const char *cond, const char **cond_end, int *pos, int indent)

2094

{

2095

int ok;

2096

char c;

2097

2098

if (debug)

2099

process_proxy_debug(indent,

2100

"Start process_proxy_cond_multipliers at position %d: %s\n",

2101

*pos, cond);

2102

2103

ok = process_proxy_cond_val(letters, cond, cond_end, pos, indent + 1);

2104

cond = *cond_end;

2105

if (ok < 0)

2106

goto end;

2107

2108

while(ok >= 0)

2109

{

2110

while(isspace((int)*cond))

2111

{

2112

cond++; (*pos)++;

2113

}

2114

c = *cond;

2115

2116

switch(c)

2117

{

2118

case '&':

2119

case '^':

2120

{

2121

int save_ok = ok;

2122

2123

cond++; (*pos)++;

2124

ok = process_proxy_cond_val(letters,

2125

cond, cond_end, pos, indent + 1);

2126

cond = *cond_end;

2127

if (ok < 0)

2128

break;

2129

2130

switch(c)

2131

{

2132

case '&':

2133

ok &= save_ok;

2134

break;

2135

case '^':

2136

ok ^= save_ok;

2137

break;

2138

default:

2139

fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"

2140

" STOPPING\n");

2141

EXIT(1);

2142

}

2143

}

2144

break;

2145

default:

2146

goto end;

2147

}

2148

}

2149

end:

2150

if (debug)

2151

process_proxy_debug(indent,

2152

"End process_proxy_cond_multipliers at position %d: %s, returning %d\n",

2153

*pos, cond, ok);

2154

2155

*cond_end = cond;

2156

return ok;

2157

}

2158

static int process_proxy_cond_adders(unsigned int letters[26],

2159

const char *cond, const char **cond_end, int *pos, int indent)

2160

{

2161

int ok;

2162

char c;

2163

2164

if (debug)

2165

process_proxy_debug(indent,

2166

"Start process_proxy_cond_adders at position %d: %s\n",

2167

*pos, cond);

2168

2169

ok = process_proxy_cond_multipliers(letters, cond, cond_end, pos,

2170

indent + 1);

2171

cond = *cond_end;

2172

if (ok < 0)

2173

goto end;

2174

2175

while(ok >= 0)

2176

{

2177

while(isspace((int)*cond))

2178

{

2179

cond++; (*pos)++;

2180

}

2181

c = *cond;

2182

2183

switch(c)

2184

{

2185

case '|':

2186

{

2187

int save_ok = ok;

2188

2189

cond++; (*pos)++;

2190

ok = process_proxy_cond_multipliers(letters,

2191

cond, cond_end, pos, indent + 1);

2192

cond = *cond_end;

2193

if (ok < 0)

2194

break;

2195

2196

switch(c)

2197

{

2198

case '|':

2199

ok |= save_ok;

2200

break;

2201

default:

2202

fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!"

2203

" STOPPING\n");

2204

EXIT(1);

2205

}

2206

}

2207

break;

2208

default:

2209

goto end;

2210

}

2211

}

2212

end:

2213

if (debug)

2214

process_proxy_debug(indent,

2215

"End process_proxy_cond_adders at position %d: %s, returning %d\n",

2216

*pos, cond, ok);

2217

2218

*cond_end = cond;

2219

return ok;

2220

}

2221

2222

static int process_proxy_cond(unsigned int letters[26],

2223

const char *cond, const char **cond_end)

2224

{

2225

int pos = 1;

2226

return process_proxy_cond_adders(letters, cond, cond_end, &pos, 1);

2227

}

2228

2229

static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg)

2230

{

2231

int ok=1;

2232

struct app_verify_arg *cb_arg = arg;

2233

unsigned int letters[26]; /* only used with proxy_auth */

2234

2235

if (cb_arg->app_verify)

2236

{

2237

char *s = NULL,buf[256];

2238

2239

fprintf(stderr, "In app_verify_callback, allowing cert. ");

2240

fprintf(stderr, "Arg is: %s\n", cb_arg->string);

2241

fprintf(stderr, "Finished printing do we have a context? 0x%p a cert? 0x%p\n",

2242

(void *)ctx, (void *)ctx->cert);

2243

if (ctx->cert)

2244

s=X509_NAME_oneline(X509_get_subject_name(ctx->cert),buf,256);

2245

if (s != NULL)

2246

{

2247

fprintf(stderr,"cert depth=%d %s\n",ctx->error_depth,buf);

2248

}

2249

return(1);

2250

}

2251

if (cb_arg->proxy_auth)

2252

{

2253

int found_any = 0, i;

2254

char *sp;

2255

2256

for(i = 0; i < 26; i++)

2257

letters[i] = 0;

2258

for(sp = cb_arg->proxy_auth; *sp; sp++)

2259

{

2260

int c = *sp;

2261

if (isascii(c) && isalpha(c))

2262

{

2263

if (islower(c))

2264

c = toupper(c);

2265

letters[c - 'A'] = 1;

2266

}

2267

}

2268

2269

fprintf(stderr,

2270

" Initial proxy rights = ");

2271

for(i = 0; i < 26; i++)

2272

if (letters[i])

2273

{

2274

fprintf(stderr, "%c", i + 'A');

2275

found_any = 1;

2276

}

2277

if (!found_any)

2278

fprintf(stderr, "none");

2279

fprintf(stderr, "\n");

2280

2281

X509_STORE_CTX_set_ex_data(ctx,

2282

get_proxy_auth_ex_data_idx(),letters);

2283

}

2284

if (cb_arg->allow_proxy_certs)

2285

{

2286

X509_STORE_CTX_set_flags(ctx, X509_V_FLAG_ALLOW_PROXY_CERTS);

2287

}

2288

2289

#ifndef OPENSSL_NO_X509_VERIFY

2290

ok = X509_verify_cert(ctx);

2291

#endif

2292

2293

if (cb_arg->proxy_auth)

2294

{

2295

if (ok > 0)

2296

{

2297

const char *cond_end = NULL;

2298

2299

ok = process_proxy_cond(letters,

2300

cb_arg->proxy_cond, &cond_end);

2301

2302

if (ok < 0)

2303

EXIT(3);

2304

if (*cond_end)

2305

{

2306

fprintf(stderr, "Stopped processing condition before it's end.\n");

2307

ok = 0;

2308

}

2309

if (!ok)

2310

fprintf(stderr, "Proxy rights check with condition '%s' proved invalid\n",

2311

cb_arg->proxy_cond);

2312

else

2313

fprintf(stderr, "Proxy rights check with condition '%s' proved valid\n",

2314

cb_arg->proxy_cond);

2315

}

2316

}

2317

return(ok);

2318

}

2319

2320

#ifndef OPENSSL_NO_RSA

2321

static RSA *rsa_tmp=NULL;

2322

2323

static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength)

2324

{

2325

BIGNUM *bn = NULL;

2326

if (rsa_tmp == NULL)

2327

{

2328

bn = BN_new();

2329

rsa_tmp = RSA_new();

2330

if(!bn || !rsa_tmp || !BN_set_word(bn, RSA_F4))

2331

{

2332

BIO_printf(bio_err, "Memory error...");

2333

goto end;

2334

}

2335

BIO_printf(bio_err,"Generating temp (%d bit) RSA key...",keylength);

2336

(void)BIO_flush(bio_err);

2337

if(!RSA_generate_key_ex(rsa_tmp,keylength,bn,NULL))

2338

{

2339

BIO_printf(bio_err, "Error generating key.");

2340

RSA_free(rsa_tmp);

2341

rsa_tmp = NULL;

2342

}

2343

end:

2344

BIO_printf(bio_err,"\n");

2345

(void)BIO_flush(bio_err);

2346

}

2347

if(bn) BN_free(bn);

2348

return(rsa_tmp);

2349

}

2350

2351

static void free_tmp_rsa(void)

2352

{

2353

if (rsa_tmp != NULL)

2354

{

2355

RSA_free(rsa_tmp);

2356

rsa_tmp = NULL;

2357

}

2358

}

2359

#endif

2360

2361

#ifndef OPENSSL_NO_DH

2362

/* These DH parameters have been generated as follows:

2363

* $ openssl dhparam -C -noout 512

2364

* $ openssl dhparam -C -noout 1024

2365

* $ openssl dhparam -C -noout -dsaparam 1024

2366

* (The third function has been renamed to avoid name conflicts.)

2367

*/

2368

static DH *get_dh512()

2369

{

2370

static unsigned char dh512_p[]={

2371

0xCB,0xC8,0xE1,0x86,0xD0,0x1F,0x94,0x17,0xA6,0x99,0xF0,0xC6,

2372

0x1F,0x0D,0xAC,0xB6,0x25,0x3E,0x06,0x39,0xCA,0x72,0x04,0xB0,

2373

0x6E,0xDA,0xC0,0x61,0xE6,0x7A,0x77,0x25,0xE8,0x3B,0xB9,0x5F,

2374

0x9A,0xB6,0xB5,0xFE,0x99,0x0B,0xA1,0x93,0x4E,0x35,0x33,0xB8,

2375

0xE1,0xF1,0x13,0x4F,0x59,0x1A,0xD2,0x57,0xC0,0x26,0x21,0x33,

2376

0x02,0xC5,0xAE,0x23,

2377

};

2378

static unsigned char dh512_g[]={

2379

0x02,

2380

};

2381

DH *dh;

2382

2383

if ((dh=DH_new()) == NULL) return(NULL);

2384

dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);

2385

dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);

2386

if ((dh->p == NULL) || (dh->g == NULL))

2387

{ DH_free(dh); return(NULL); }

2388

return(dh);

2389

}

2390

2391

static DH *get_dh1024()

2392

{

2393

static unsigned char dh1024_p[]={

2394

0xF8,0x81,0x89,0x7D,0x14,0x24,0xC5,0xD1,0xE6,0xF7,0xBF,0x3A,

2395

0xE4,0x90,0xF4,0xFC,0x73,0xFB,0x34,0xB5,0xFA,0x4C,0x56,0xA2,

2396

0xEA,0xA7,0xE9,0xC0,0xC0,0xCE,0x89,0xE1,0xFA,0x63,0x3F,0xB0,

2397

0x6B,0x32,0x66,0xF1,0xD1,0x7B,0xB0,0x00,0x8F,0xCA,0x87,0xC2,

2398

0xAE,0x98,0x89,0x26,0x17,0xC2,0x05,0xD2,0xEC,0x08,0xD0,0x8C,

2399

0xFF,0x17,0x52,0x8C,0xC5,0x07,0x93,0x03,0xB1,0xF6,0x2F,0xB8,

2400

0x1C,0x52,0x47,0x27,0x1B,0xDB,0xD1,0x8D,0x9D,0x69,0x1D,0x52,

2401

0x4B,0x32,0x81,0xAA,0x7F,0x00,0xC8,0xDC,0xE6,0xD9,0xCC,0xC1,

2402

0x11,0x2D,0x37,0x34,0x6C,0xEA,0x02,0x97,0x4B,0x0E,0xBB,0xB1,

2403

0x71,0x33,0x09,0x15,0xFD,0xDD,0x23,0x87,0x07,0x5E,0x89,0xAB,

2404

0x6B,0x7C,0x5F,0xEC,0xA6,0x24,0xDC,0x53,

2405

};

2406

static unsigned char dh1024_g[]={

2407

0x02,

2408

};

2409

DH *dh;

2410

2411

if ((dh=DH_new()) == NULL) return(NULL);

2412

dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);

2413

dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);

2414

if ((dh->p == NULL) || (dh->g == NULL))

2415

{ DH_free(dh); return(NULL); }

2416

return(dh);

2417

}

2418

2419

static DH *get_dh1024dsa()

2420

{

2421

static unsigned char dh1024_p[]={

2422

0xC8,0x00,0xF7,0x08,0x07,0x89,0x4D,0x90,0x53,0xF3,0xD5,0x00,

2423

0x21,0x1B,0xF7,0x31,0xA6,0xA2,0xDA,0x23,0x9A,0xC7,0x87,0x19,

2424

0x3B,0x47,0xB6,0x8C,0x04,0x6F,0xFF,0xC6,0x9B,0xB8,0x65,0xD2,

2425

0xC2,0x5F,0x31,0x83,0x4A,0xA7,0x5F,0x2F,0x88,0x38,0xB6,0x55,

2426

0xCF,0xD9,0x87,0x6D,0x6F,0x9F,0xDA,0xAC,0xA6,0x48,0xAF,0xFC,

2427

0x33,0x84,0x37,0x5B,0x82,0x4A,0x31,0x5D,0xE7,0xBD,0x52,0x97,

2428

0xA1,0x77,0xBF,0x10,0x9E,0x37,0xEA,0x64,0xFA,0xCA,0x28,0x8D,

2429

0x9D,0x3B,0xD2,0x6E,0x09,0x5C,0x68,0xC7,0x45,0x90,0xFD,0xBB,

2430

0x70,0xC9,0x3A,0xBB,0xDF,0xD4,0x21,0x0F,0xC4,0x6A,0x3C,0xF6,

2431

0x61,0xCF,0x3F,0xD6,0x13,0xF1,0x5F,0xBC,0xCF,0xBC,0x26,0x9E,

2432

0xBC,0x0B,0xBD,0xAB,0x5D,0xC9,0x54,0x39,

2433

};

2434

static unsigned char dh1024_g[]={

2435

0x3B,0x40,0x86,0xE7,0xF3,0x6C,0xDE,0x67,0x1C,0xCC,0x80,0x05,

2436

0x5A,0xDF,0xFE,0xBD,0x20,0x27,0x74,0x6C,0x24,0xC9,0x03,0xF3,

2437

0xE1,0x8D,0xC3,0x7D,0x98,0x27,0x40,0x08,0xB8,0x8C,0x6A,0xE9,

2438

0xBB,0x1A,0x3A,0xD6,0x86,0x83,0x5E,0x72,0x41,0xCE,0x85,0x3C,

2439

0xD2,0xB3,0xFC,0x13,0xCE,0x37,0x81,0x9E,0x4C,0x1C,0x7B,0x65,

2440

0xD3,0xE6,0xA6,0x00,0xF5,0x5A,0x95,0x43,0x5E,0x81,0xCF,0x60,

2441

0xA2,0x23,0xFC,0x36,0xA7,0x5D,0x7A,0x4C,0x06,0x91,0x6E,0xF6,

2442

0x57,0xEE,0x36,0xCB,0x06,0xEA,0xF5,0x3D,0x95,0x49,0xCB,0xA7,

2443

0xDD,0x81,0xDF,0x80,0x09,0x4A,0x97,0x4D,0xA8,0x22,0x72,0xA1,

2444

0x7F,0xC4,0x70,0x56,0x70,0xE8,0x20,0x10,0x18,0x8F,0x2E,0x60,

2445

0x07,0xE7,0x68,0x1A,0x82,0x5D,0x32,0xA2,

2446

};

2447

DH *dh;

2448

2449

if ((dh=DH_new()) == NULL) return(NULL);

2450

dh->p=BN_bin2bn(dh1024_p,sizeof(dh1024_p),NULL);

2451

dh->g=BN_bin2bn(dh1024_g,sizeof(dh1024_g),NULL);

2452

if ((dh->p == NULL) || (dh->g == NULL))

2453

{ DH_free(dh); return(NULL); }

2454

dh->length = 160;

2455

return(dh);

2456

}

2457

#endif

2458

2459

#ifndef OPENSSL_NO_PSK

2460

/* convert the PSK key (psk_key) in ascii to binary (psk) */

2461

static int psk_key2bn(const char *pskkey, unsigned char *psk,

2462

unsigned int max_psk_len)

2463

{

2464

int ret;

2465

BIGNUM *bn = NULL;

2466

2467

ret = BN_hex2bn(&bn, pskkey);

2468

if (!ret)

2469

{

2470

BIO_printf(bio_err,"Could not convert PSK key '%s' to BIGNUM\n", pskkey);

2471

if (bn)

2472

BN_free(bn);

2473

return 0;

2474

}

2475

if (BN_num_bytes(bn) > (int)max_psk_len)

2476

{

2477

BIO_printf(bio_err,"psk buffer of callback is too small (%d) for key (%d)\n",

2478

max_psk_len, BN_num_bytes(bn));

2479

BN_free(bn);

2480

return 0;

2481

}

2482

ret = BN_bn2bin(bn, psk);

2483

BN_free(bn);

2484

return ret;

2485

}

2486

2487

static unsigned int psk_client_callback(SSL *ssl, const char *hint, char *identity,

2488

unsigned int max_identity_len, unsigned char *psk,

2489

unsigned int max_psk_len)

2490

{

2491

int ret;

2492

unsigned int psk_len = 0;

2493

2494

ret = BIO_snprintf(identity, max_identity_len, "Client_identity");

2495

if (ret < 0)

2496

goto out_err;

2497

if (debug)

2498

fprintf(stderr, "client: created identity '%s' len=%d\n", identity, ret);

2499

ret = psk_key2bn(psk_key, psk, max_psk_len);

2500

if (ret < 0)

2501

goto out_err;

2502

psk_len = ret;

2503

out_err:

2504

return psk_len;

2505

}

2506

2507

static unsigned int psk_server_callback(SSL *ssl, const char *identity,

2508

unsigned char *psk, unsigned int max_psk_len)

2509

{

2510

unsigned int psk_len=0;

2511

2512

if (strcmp(identity, "Client_identity") != 0)

2513

{

2514

BIO_printf(bio_err, "server: PSK error: client identity not found\n");

2515

return 0;

2516

}

2517

psk_len=psk_key2bn(psk_key, psk, max_psk_len);

2518

return psk_len;

2519

}

2520

#endif

2521

2522

static int do_test_cipherlist(void)

2523

{

2524

int i = 0;

2525

const SSL_METHOD *meth;

2526

const SSL_CIPHER *ci, *tci = NULL;

2527

2528

#ifndef OPENSSL_NO_SSL2

2529

fprintf(stderr, "testing SSLv2 cipher list order: ");

2530

meth = SSLv2_method();

2531

while ((ci = meth->get_cipher(i++)) != NULL)

2532

{

2533

if (tci != NULL)

2534

if (ci->id >= tci->id)

2535

{

2536

fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);

2537

return 0;

2538

}

2539

tci = ci;

2540

}

2541

fprintf(stderr, "ok\n");

2542

#endif

2543

#ifndef OPENSSL_NO_SSL3

2544

fprintf(stderr, "testing SSLv3 cipher list order: ");

2545

meth = SSLv3_method();

2546

tci = NULL;

2547

while ((ci = meth->get_cipher(i++)) != NULL)

2548

{

2549

if (tci != NULL)

2550

if (ci->id >= tci->id)

2551

{

2552

fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);

2553

return 0;

2554

}

2555

tci = ci;

2556

}

2557

fprintf(stderr, "ok\n");

2558

#endif

2559

#ifndef OPENSSL_NO_TLS1

2560

fprintf(stderr, "testing TLSv1 cipher list order: ");

2561

meth = TLSv1_method();

2562

tci = NULL;

2563

while ((ci = meth->get_cipher(i++)) != NULL)

2564

{

2565

if (tci != NULL)

2566

if (ci->id >= tci->id)

2567

{

2568

fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);

2569

return 0;

2570

}

2571

tci = ci;

2572

}

2573

fprintf(stderr, "ok\n");

2574

#endif

2575

2576

return 1;

2577

}