[thirdparty/openssl.git] / ssl / ssltest.c

/* ssl/ssltest.c */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
 * This package is an SSL implementation written
 * by Eric Young (eay@cryptsoft.com).
 * The implementation was written so as to conform with Netscapes SSL.
 * 
 * This library is free for commercial and non-commercial use as long as
 * the following conditions are aheared to.  The following conditions
 * apply to all code found in this distribution, be it the RC4, RSA,
 * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
 * included with this distribution is covered by the same copyright terms
 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
 * 
 * Copyright remains Eric Young's, and as such any Copyright notices in
 * the code are not to be removed.
 * If this package is used in a product, Eric Young should be given attribution
 * as the author of the parts of the library used.
 * This can be in the form of a textual message at program startup or
 * in documentation (online or textual) provided with the package.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
 * 4. If you include any Windows specific code (or a derivative thereof) from 
 *    the apps directory (application code) you must include an acknowledgement:
 *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
 * 
 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 * 
 * The licence and distribution terms for any publically available version or
 * derivative of this code cannot be changed.  i.e. this code cannot simply be
 * copied and put under another distribution licence
 * [including the GNU Public Licence.]
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>

#include "openssl/e_os.h"

#include <openssl/bio.h>
#include <openssl/crypto.h>
#include <openssl/x509.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#ifdef WINDOWS
#include "../crypto/bio/bss_file.c"
#endif

#if defined(NO_RSA) && !defined(NO_SSL2)
#define NO_SSL2
#endif

#ifdef VMS
#  define TEST_SERVER_CERT "SYS$DISK:[-.APPS]SERVER.PEM"
#  define TEST_CLIENT_CERT "SYS$DISK:[-.APPS]CLIENT.PEM"
#else
#  define TEST_SERVER_CERT "../apps/server.pem"
#  define TEST_CLIENT_CERT "../apps/client.pem"
#endif

int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
#ifndef NO_RSA
static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export,int keylength);
#endif
#ifndef NO_DH
static DH *get_dh512(void);
#endif
BIO *bio_err=NULL;
BIO *bio_stdout=NULL;

static char *cipher=NULL;
int verbose=0;
int debug=0;
#ifdef FIONBIO
static int s_nbio=0;
#endif


int doit(SSL *s_ssl,SSL *c_ssl,long bytes);
static void sv_usage(void)
	{
	fprintf(stderr,"usage: ssltest [args ...]\n");
	fprintf(stderr,"\n");
	fprintf(stderr," -server_auth  - check server certificate\n");
	fprintf(stderr," -client_auth  - do client authentication\n");
	fprintf(stderr," -v            - more output\n");
	fprintf(stderr," -d            - debug output\n");
	fprintf(stderr," -reuse        - use session-id reuse\n");
	fprintf(stderr," -num <val>    - number of connections to perform\n");
	fprintf(stderr," -bytes <val>  - number of bytes to swap between client/server\n");
#ifndef NO_SSL2
	fprintf(stderr," -ssl2         - use SSLv2\n");
#endif
#ifndef NO_SSL3
	fprintf(stderr," -ssl3         - use SSLv3\n");
#endif
#ifndef NO_TLS1
	fprintf(stderr," -tls1         - use TLSv1\n");
#endif
	fprintf(stderr," -CApath arg   - PEM format directory of CA's\n");
	fprintf(stderr," -CAfile arg   - PEM format file of CA's\n");
	fprintf(stderr," -cert arg     - Certificate file\n");
	fprintf(stderr," -s_cert arg   - Just the server certificate file\n");
	fprintf(stderr," -c_cert arg   - Just the client certificate file\n");
	fprintf(stderr," -cipher arg   - The cipher list\n");
	}

int main(int argc, char *argv[])
	{
	char *CApath=NULL,*CAfile=NULL;
	int badop=0;
	int tls1=0,ssl2=0,ssl3=0,ret=1;
	int client_auth=0;
	int server_auth=0,i;
	char *server_cert=TEST_SERVER_CERT;
	char *client_cert=TEST_CLIENT_CERT;
	SSL_CTX *s_ctx=NULL;
	SSL_CTX *c_ctx=NULL;
	SSL_METHOD *meth=NULL;
	SSL *c_ssl,*s_ssl;
	int number=1,reuse=0;
	long bytes=1L;
	SSL_CIPHER *ciph;
#ifndef NO_DH
	DH *dh;
#endif

	bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
	bio_stdout=BIO_new_fp(stdout,BIO_NOCLOSE);

	CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);

	argc--;
	argv++;

	while (argc >= 1)
		{
		if	(strcmp(*argv,"-server_auth") == 0)
			server_auth=1;
		else if	(strcmp(*argv,"-client_auth") == 0)
			client_auth=1;
		else if	(strcmp(*argv,"-v") == 0)
			verbose=1;
		else if	(strcmp(*argv,"-d") == 0)
			debug=1;
		else if	(strcmp(*argv,"-reuse") == 0)
			reuse=1;
		else if	(strcmp(*argv,"-ssl2") == 0)
			ssl2=1;
		else if	(strcmp(*argv,"-tls1") == 0)
			tls1=1;
		else if	(strcmp(*argv,"-ssl3") == 0)
			ssl3=1;
		else if	(strncmp(*argv,"-num",4) == 0)
			{
			if (--argc < 1) goto bad;
			number= atoi(*(++argv));
			if (number == 0) number=1;
			}
		else if	(strcmp(*argv,"-bytes") == 0)
			{
			if (--argc < 1) goto bad;
			bytes= atol(*(++argv));
			if (bytes == 0L) bytes=1L;
			i=strlen(argv[0]);
			if (argv[0][i-1] == 'k') bytes*=1024L;
			if (argv[0][i-1] == 'm') bytes*=1024L*1024L;
			}
		else if	(strcmp(*argv,"-cert") == 0)
			{
			if (--argc < 1) goto bad;
			server_cert= *(++argv);
			}
		else if	(strcmp(*argv,"-s_cert") == 0)
			{
			if (--argc < 1) goto bad;
			server_cert= *(++argv);
			}
		else if	(strcmp(*argv,"-c_cert") == 0)
			{
			if (--argc < 1) goto bad;
			client_cert= *(++argv);
			}
		else if	(strcmp(*argv,"-cipher") == 0)
			{
			if (--argc < 1) goto bad;
			cipher= *(++argv);
			}
		else if	(strcmp(*argv,"-CApath") == 0)
			{
			if (--argc < 1) goto bad;
			CApath= *(++argv);
			}
		else if	(strcmp(*argv,"-CAfile") == 0)
			{
			if (--argc < 1) goto bad;
			CAfile= *(++argv);
			}
		else
			{
			fprintf(stderr,"unknown option %s\n",*argv);
			badop=1;
			break;
			}
		argc--;
		argv++;
		}
	if (badop)
		{
bad:
		sv_usage();
		goto end;
		}

/*	if (cipher == NULL) cipher=getenv("SSL_CIPHER"); */

	SSL_library_init();
	SSL_load_error_strings();

#if !defined(NO_SSL2) && !defined(NO_SSL3)
	if (ssl2)
		meth=SSLv2_method();
	else 
	if (tls1)
		meth=TLSv1_method();
	else
	if (ssl3)
		meth=SSLv3_method();
	else
		meth=SSLv23_method();
#else
#ifdef NO_SSL2
	meth=SSLv3_method();
#else
	meth=SSLv2_method();
#endif
#endif

	c_ctx=SSL_CTX_new(meth);
	s_ctx=SSL_CTX_new(meth);
	if ((c_ctx == NULL) || (s_ctx == NULL))
		{
		ERR_print_errors(bio_err);
		goto end;
		}

	if (cipher != NULL)
		{
		SSL_CTX_set_cipher_list(c_ctx,cipher);
		SSL_CTX_set_cipher_list(s_ctx,cipher);
		}

#ifndef NO_DH
	dh=get_dh512();
	SSL_CTX_set_tmp_dh(s_ctx,dh);
	DH_free(dh);
#endif

#ifndef NO_RSA
	SSL_CTX_set_tmp_rsa_callback(s_ctx,tmp_rsa_cb);
#endif

	if (!SSL_CTX_use_certificate_file(s_ctx,server_cert,SSL_FILETYPE_PEM))
		{
		ERR_print_errors(bio_err);
		}
	else if (!SSL_CTX_use_PrivateKey_file(s_ctx,server_cert,
		SSL_FILETYPE_PEM))
		{
		ERR_print_errors(bio_err);
		goto end;
		}

	if (client_auth)
		{
		SSL_CTX_use_certificate_file(c_ctx,client_cert,
			SSL_FILETYPE_PEM);
		SSL_CTX_use_PrivateKey_file(c_ctx,client_cert,
			SSL_FILETYPE_PEM);
		}

	if (	(!SSL_CTX_load_verify_locations(s_ctx,CAfile,CApath)) ||
		(!SSL_CTX_set_default_verify_paths(s_ctx)) ||
		(!SSL_CTX_load_verify_locations(c_ctx,CAfile,CApath)) ||
		(!SSL_CTX_set_default_verify_paths(c_ctx)))
		{
		/* fprintf(stderr,"SSL_load_verify_locations\n"); */
		ERR_print_errors(bio_err);
		/* goto end; */
		}

	if (client_auth)
		{
		fprintf(stderr,"client authentication\n");
		SSL_CTX_set_verify(s_ctx,
			SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
			verify_callback);
		}
	if (server_auth)
		{
		fprintf(stderr,"server authentication\n");
		SSL_CTX_set_verify(c_ctx,SSL_VERIFY_PEER,
			verify_callback);
		}

	c_ssl=SSL_new(c_ctx);
	s_ssl=SSL_new(s_ctx);

	for (i=0; i<number; i++)
		{
		if (!reuse) SSL_set_session(c_ssl,NULL);
		ret=doit(s_ssl,c_ssl,bytes);
		}

	if (!verbose)
		{
		ciph=SSL_get_current_cipher(c_ssl);
		fprintf(stdout,"Protocol %s, cipher %s, %s\n",
			SSL_get_version(c_ssl),
			SSL_CIPHER_get_version(ciph),
			SSL_CIPHER_get_name(ciph));
		}
	if ((number > 1) || (bytes > 1L))
		printf("%d handshakes of %ld bytes done\n",number,bytes);

	SSL_free(s_ssl);
	SSL_free(c_ssl);

end:
	if (s_ctx != NULL) SSL_CTX_free(s_ctx);
	if (c_ctx != NULL) SSL_CTX_free(c_ctx);

	if (bio_stdout != NULL) BIO_free(bio_stdout);

	ERR_free_strings();
	ERR_remove_state(0);
	EVP_cleanup();
	CRYPTO_mem_leaks(bio_err);
	EXIT(ret);
	}

#define W_READ	1
#define W_WRITE	2
#define C_DONE	1
#define S_DONE	2

int doit(SSL *s_ssl, SSL *c_ssl, long count)
	{
	MS_STATIC char cbuf[1024*8],sbuf[1024*8];
	long cw_num=count,cr_num=count;
	long sw_num=count,sr_num=count;
	int ret=1;
	BIO *c_to_s=NULL;
	BIO *s_to_c=NULL;
	BIO *c_bio=NULL;
	BIO *s_bio=NULL;
	int c_r,c_w,s_r,s_w;
	int c_want,s_want;
	int i,j;
	int done=0;
	int c_write,s_write;
	int do_server=0,do_client=0;
	SSL_CIPHER *ciph;

	c_to_s=BIO_new(BIO_s_mem());
	s_to_c=BIO_new(BIO_s_mem());
	if ((s_to_c == NULL) || (c_to_s == NULL))
		{
		ERR_print_errors(bio_err);
		goto err;
		}

	c_bio=BIO_new(BIO_f_ssl());
	s_bio=BIO_new(BIO_f_ssl());
	if ((c_bio == NULL) || (s_bio == NULL))
		{
		ERR_print_errors(bio_err);
		goto err;
		}

	SSL_set_connect_state(c_ssl);
	SSL_set_bio(c_ssl,s_to_c,c_to_s);
	BIO_set_ssl(c_bio,c_ssl,BIO_NOCLOSE);

	SSL_set_accept_state(s_ssl);
	SSL_set_bio(s_ssl,c_to_s,s_to_c);
	BIO_set_ssl(s_bio,s_ssl,BIO_NOCLOSE);

	c_r=0; s_r=1;
	c_w=1; s_w=0;
	c_want=W_WRITE;
	s_want=0;
	c_write=1,s_write=0;

	/* We can always do writes */
	for (;;)
		{
		do_server=0;
		do_client=0;

		i=(int)BIO_pending(s_bio);
		if ((i && s_r) || s_w) do_server=1;

		i=(int)BIO_pending(c_bio);
		if ((i && c_r) || c_w) do_client=1;

		if (do_server && debug)
			{
			if (SSL_in_init(s_ssl))
				printf("server waiting in SSL_accept - %s\n",
					SSL_state_string_long(s_ssl));
/*			else if (s_write)
				printf("server:SSL_write()\n");
			else
				printf("server:SSL_read()\n"); */
			}

		if (do_client && debug)
			{
			if (SSL_in_init(c_ssl))
				printf("client waiting in SSL_connect - %s\n",
					SSL_state_string_long(c_ssl));
/*			else if (c_write)
				printf("client:SSL_write()\n");
			else
				printf("client:SSL_read()\n"); */
			}

		if (!do_client && !do_server)
			{
			fprintf(stdout,"ERROR IN STARTUP\n");
			ERR_print_errors(bio_err);
			break;
			}
		if (do_client && !(done & C_DONE))
			{
			if (c_write)
				{
				j=(cw_num > (long)sizeof(cbuf))
					?sizeof(cbuf):(int)cw_num;
				i=BIO_write(c_bio,cbuf,j);
				if (i < 0)
					{
					c_r=0;
					c_w=0;
					if (BIO_should_retry(c_bio))
						{
						if (BIO_should_read(c_bio))
							c_r=1;
						if (BIO_should_write(c_bio))
							c_w=1;
						}
					else
						{
						fprintf(stderr,"ERROR in CLIENT\n");
						ERR_print_errors(bio_err);
						goto err;
						}
					}
				else if (i == 0)
					{
					fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
					goto err;
					}
				else
					{
					if (debug)
						printf("client wrote %d\n",i);
					/* ok */
					s_r=1;
					c_write=0;
					cw_num-=i;
					}
				}
			else
				{
				i=BIO_read(c_bio,cbuf,sizeof(cbuf));
				if (i < 0)
					{
					c_r=0;
					c_w=0;
					if (BIO_should_retry(c_bio))
						{
						if (BIO_should_read(c_bio))
							c_r=1;
						if (BIO_should_write(c_bio))
							c_w=1;
						}
					else
						{
						fprintf(stderr,"ERROR in CLIENT\n");
						ERR_print_errors(bio_err);
						goto err;
						}
					}
				else if (i == 0)
					{
					fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
					goto err;
					}
				else
					{
					if (debug)
						printf("client read %d\n",i);
					cr_num-=i;
					if (sw_num > 0)
						{
						s_write=1;
						s_w=1;
						}
					if (cr_num <= 0)
						{
						s_write=1;
						s_w=1;
						done=S_DONE|C_DONE;
						}
					}
				}
			}

		if (do_server && !(done & S_DONE))
			{
			if (!s_write)
				{
				i=BIO_read(s_bio,sbuf,sizeof(cbuf));
				if (i < 0)
					{
					s_r=0;
					s_w=0;
					if (BIO_should_retry(s_bio))
						{
						if (BIO_should_read(s_bio))
							s_r=1;
						if (BIO_should_write(s_bio))
							s_w=1;
						}
					else
						{
						fprintf(stderr,"ERROR in SERVER\n");
						ERR_print_errors(bio_err);
						goto err;
						}
					}
				else if (i == 0)
					{
					ERR_print_errors(bio_err);
					fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_read\n");
					goto err;
					}
				else
					{
					if (debug)
						printf("server read %d\n",i);
					sr_num-=i;
					if (cw_num > 0)
						{
						c_write=1;
						c_w=1;
						}
					if (sr_num <= 0)
						{
						s_write=1;
						s_w=1;
						c_write=0;
						}
					}
				}
			else
				{
				j=(sw_num > (long)sizeof(sbuf))?
					sizeof(sbuf):(int)sw_num;
				i=BIO_write(s_bio,sbuf,j);
				if (i < 0)
					{
					s_r=0;
					s_w=0;
					if (BIO_should_retry(s_bio))
						{
						if (BIO_should_read(s_bio))
							s_r=1;
						if (BIO_should_write(s_bio))
							s_w=1;
						}
					else
						{
						fprintf(stderr,"ERROR in SERVER\n");
						ERR_print_errors(bio_err);
						goto err;
						}
					}
				else if (i == 0)
					{
					ERR_print_errors(bio_err);
					fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_write\n");
					goto err;
					}
				else
					{
					if (debug)
						printf("server wrote %d\n",i);
					sw_num-=i;
					s_write=0;
					c_r=1;
					if (sw_num <= 0)
						done|=S_DONE;
					}
				}
			}

		if ((done & S_DONE) && (done & C_DONE)) break;
		}

	ciph=SSL_get_current_cipher(c_ssl);
	if (verbose)
		fprintf(stdout,"DONE, protocol %s, cipher %s, %s\n",
			SSL_get_version(c_ssl),
			SSL_CIPHER_get_version(ciph),
			SSL_CIPHER_get_name(ciph));
	ret=0;
err:
	/* We have to set the BIO's to NULL otherwise they will be
	 * Free()ed twice.  Once when th s_ssl is SSL_free()ed and
	 * again when c_ssl is SSL_free()ed.
	 * This is a hack required because s_ssl and c_ssl are sharing the same
	 * BIO structure and SSL_set_bio() and SSL_free() automatically
	 * BIO_free non NULL entries.
	 * You should not normally do this or be required to do this */
	if (s_ssl != NULL)
		{
		s_ssl->rbio=NULL;
		s_ssl->wbio=NULL;
		}
	if (c_ssl != NULL)
		{
		c_ssl->rbio=NULL;
		c_ssl->wbio=NULL;
		}

	if (c_to_s != NULL) BIO_free(c_to_s);
	if (s_to_c != NULL) BIO_free(s_to_c);
	if (c_bio != NULL) BIO_free_all(c_bio);
	if (s_bio != NULL) BIO_free_all(s_bio);
	return(ret);
	}

int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
	{
	char *s,buf[256];

	s=X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),buf,256);
	if (s != NULL)
		{
		if (ok)
			fprintf(stderr,"depth=%d %s\n",ctx->error_depth,buf);
		else
			fprintf(stderr,"depth=%d error=%d %s\n",
				ctx->error_depth,ctx->error,buf);
		}

	if (ok == 0)
		{
		switch (ctx->error)
			{
		case X509_V_ERR_CERT_NOT_YET_VALID:
		case X509_V_ERR_CERT_HAS_EXPIRED:
		case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
			ok=1;
			}
		}

	return(ok);
	}

#ifndef NO_DH
static unsigned char dh512_p[]={
	0xDA,0x58,0x3C,0x16,0xD9,0x85,0x22,0x89,0xD0,0xE4,0xAF,0x75,
	0x6F,0x4C,0xCA,0x92,0xDD,0x4B,0xE5,0x33,0xB8,0x04,0xFB,0x0F,
	0xED,0x94,0xEF,0x9C,0x8A,0x44,0x03,0xED,0x57,0x46,0x50,0xD3,
	0x69,0x99,0xDB,0x29,0xD7,0x76,0x27,0x6B,0xA2,0xD3,0xD4,0x12,
	0xE2,0x18,0xF4,0xDD,0x1E,0x08,0x4C,0xF6,0xD8,0x00,0x3E,0x7C,
	0x47,0x74,0xE8,0x33,
	};
static unsigned char dh512_g[]={
	0x02,
	};

static DH *get_dh512(void)
	{
	DH *dh=NULL;

	if ((dh=DH_new()) == NULL) return(NULL);
	dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
	dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
	if ((dh->p == NULL) || (dh->g == NULL))
		return(NULL);
	return(dh);
	}
#endif

#ifndef NO_RSA
static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength)
	{
	static RSA *rsa_tmp=NULL;

	if (rsa_tmp == NULL)
		{
		BIO_printf(bio_err,"Generating temp (%d bit) RSA key...",keylength);
		BIO_flush(bio_err);
		rsa_tmp=RSA_generate_key(keylength,RSA_F4,NULL,NULL);
		BIO_printf(bio_err,"\n");
		BIO_flush(bio_err);
		}
	return(rsa_tmp);
	}
#endif
Commit	Line	Data
d02b48c6	1	/* ssl/ssltest.c */
58964a49	2	/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
d02b48c6 RE	3	* All rights reserved.
	4	*
	5	* This package is an SSL implementation written
	6	* by Eric Young (eay@cryptsoft.com).
	7	* The implementation was written so as to conform with Netscapes SSL.
	8	*
	9	* This library is free for commercial and non-commercial use as long as
	10	* the following conditions are aheared to. The following conditions
	11	* apply to all code found in this distribution, be it the RC4, RSA,
	12	* lhash, DES, etc., code; not just the SSL code. The SSL documentation
	13	* included with this distribution is covered by the same copyright terms
	14	* except that the holder is Tim Hudson (tjh@cryptsoft.com).
	15	*
	16	* Copyright remains Eric Young's, and as such any Copyright notices in
	17	* the code are not to be removed.
	18	* If this package is used in a product, Eric Young should be given attribution
	19	* as the author of the parts of the library used.
	20	* This can be in the form of a textual message at program startup or
	21	* in documentation (online or textual) provided with the package.
	22	*
	23	* Redistribution and use in source and binary forms, with or without
	24	* modification, are permitted provided that the following conditions
	25	* are met:
	26	* 1. Redistributions of source code must retain the copyright
	27	* notice, this list of conditions and the following disclaimer.
	28	* 2. Redistributions in binary form must reproduce the above copyright
	29	* notice, this list of conditions and the following disclaimer in the
	30	* documentation and/or other materials provided with the distribution.
	31	* 3. All advertising materials mentioning features or use of this software
	32	* must display the following acknowledgement:
	33	* "This product includes cryptographic software written by
	34	* Eric Young (eay@cryptsoft.com)"
	35	* The word 'cryptographic' can be left out if the rouines from the library
	36	* being used are not cryptographic related :-).
	37	* 4. If you include any Windows specific code (or a derivative thereof) from
	38	* the apps directory (application code) you must include an acknowledgement:
	39	* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
	40	*
	41	* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
	42	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	43	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	44	* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
	45	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	46	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	47	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	48	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	49	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	50	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	51	* SUCH DAMAGE.
	52	*
	53	* The licence and distribution terms for any publically available version or
	54	* derivative of this code cannot be changed. i.e. this code cannot simply be
	55	* copied and put under another distribution licence
	56	* [including the GNU Public Licence.]
	57	*/
	58
	59	#include <stdio.h>
	60	#include <stdlib.h>
	61	#include <string.h>
	62	#include <errno.h>
17e3dd1c	63
7e701817	64	#include "openssl/e_os.h"
17e3dd1c	65
ec577822 BM	66	#include <openssl/bio.h>
	67	#include <openssl/crypto.h>
	68	#include <openssl/x509.h>
	69	#include <openssl/ssl.h>
	70	#include <openssl/err.h>
58964a49	71	#ifdef WINDOWS
d02b48c6 RE	72	#include "../crypto/bio/bss_file.c"
	73	#endif
	74
79df9d62 UM	75	#if defined(NO_RSA) && !defined(NO_SSL2)
	76	#define NO_SSL2
	77	#endif
	78
7d7d2cbc UM	79	#ifdef VMS
	80	# define TEST_SERVER_CERT "SYS$DISK:[-.APPS]SERVER.PEM"
	81	# define TEST_CLIENT_CERT "SYS$DISK:[-.APPS]CLIENT.PEM"
	82	#else
	83	# define TEST_SERVER_CERT "../apps/server.pem"
	84	# define TEST_CLIENT_CERT "../apps/client.pem"
	85	#endif
d02b48c6	86
d02b48c6	87	int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
79df9d62	88	#ifndef NO_RSA
df63a389	89	static RSA MS_CALLBACK tmp_rsa_cb(SSL s, int is_export,int keylength);
79df9d62 UM	90	#endif
79df9d62 UM	91	#ifndef NO_DH
d02b48c6	92	static DH *get_dh512(void);
58964a49	93	#endif
d02b48c6 RE	94	BIO *bio_err=NULL;
	95	BIO *bio_stdout=NULL;
	96
	97	static char *cipher=NULL;
	98	int verbose=0;
58964a49	99	int debug=0;
d02b48c6 RE	100	#ifdef FIONBIO
	101	static int s_nbio=0;
	102	#endif
	103
	104
58964a49	105	int doit(SSL s_ssl,SSL c_ssl,long bytes);
6b691a5c	106	static void sv_usage(void)
d02b48c6 RE	107	{
	108	fprintf(stderr,"usage: ssltest [args ...]\n");
	109	fprintf(stderr,"\n");
	110	fprintf(stderr," -server_auth - check server certificate\n");
	111	fprintf(stderr," -client_auth - do client authentication\n");
	112	fprintf(stderr," -v - more output\n");
58964a49 RE	113	fprintf(stderr," -d - debug output\n");
	114	fprintf(stderr," -reuse - use session-id reuse\n");
	115	fprintf(stderr," -num <val> - number of connections to perform\n");
	116	fprintf(stderr," -bytes <val> - number of bytes to swap between client/server\n");
d02b48c6 RE	117	#ifndef NO_SSL2
	118	fprintf(stderr," -ssl2 - use SSLv2\n");
	119	#endif
	120	#ifndef NO_SSL3
	121	fprintf(stderr," -ssl3 - use SSLv3\n");
58964a49 RE	122	#endif
	123	#ifndef NO_TLS1
	124	fprintf(stderr," -tls1 - use TLSv1\n");
d02b48c6 RE	125	#endif
	126	fprintf(stderr," -CApath arg - PEM format directory of CA's\n");
	127	fprintf(stderr," -CAfile arg - PEM format file of CA's\n");
58964a49 RE	128	fprintf(stderr," -cert arg - Certificate file\n");
	129	fprintf(stderr," -s_cert arg - Just the server certificate file\n");
	130	fprintf(stderr," -c_cert arg - Just the client certificate file\n");
	131	fprintf(stderr," -cipher arg - The cipher list\n");
d02b48c6 RE	132	}
d02b48c6 RE	133
6b691a5c	134	int main(int argc, char *argv[])
d02b48c6 RE	135	{
	136	char CApath=NULL,CAfile=NULL;
	137	int badop=0;
58964a49	138	int tls1=0,ssl2=0,ssl3=0,ret=1;
d02b48c6	139	int client_auth=0;
58964a49	140	int server_auth=0,i;
d02b48c6 RE	141	char *server_cert=TEST_SERVER_CERT;
	142	char *client_cert=TEST_CLIENT_CERT;
	143	SSL_CTX *s_ctx=NULL;
	144	SSL_CTX *c_ctx=NULL;
	145	SSL_METHOD *meth=NULL;
58964a49 RE	146	SSL c_ssl,s_ssl;
	147	int number=1,reuse=0;
	148	long bytes=1L;
	149	SSL_CIPHER *ciph;
	150	#ifndef NO_DH
d02b48c6	151	DH *dh;
58964a49	152	#endif
d02b48c6 RE	153
	154	bio_err=BIO_new_fp(stderr,BIO_NOCLOSE);
	155	bio_stdout=BIO_new_fp(stdout,BIO_NOCLOSE);
	156
	157	CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
	158
	159	argc--;
	160	argv++;
	161
	162	while (argc >= 1)
	163	{
	164	if (strcmp(*argv,"-server_auth") == 0)
	165	server_auth=1;
	166	else if (strcmp(*argv,"-client_auth") == 0)
	167	client_auth=1;
	168	else if (strcmp(*argv,"-v") == 0)
	169	verbose=1;
58964a49 RE	170	else if (strcmp(*argv,"-d") == 0)
	171	debug=1;
	172	else if (strcmp(*argv,"-reuse") == 0)
	173	reuse=1;
d02b48c6 RE	174	else if (strcmp(*argv,"-ssl2") == 0)
d02b48c6 RE	175	ssl2=1;
58964a49 RE	176	else if (strcmp(*argv,"-tls1") == 0)
58964a49 RE	177	tls1=1;
d02b48c6 RE	178	else if (strcmp(*argv,"-ssl3") == 0)
d02b48c6 RE	179	ssl3=1;
58964a49 RE	180	else if (strncmp(*argv,"-num",4) == 0)
	181	{
	182	if (--argc < 1) goto bad;
	183	number= atoi(*(++argv));
	184	if (number == 0) number=1;
	185	}
	186	else if (strcmp(*argv,"-bytes") == 0)
	187	{
	188	if (--argc < 1) goto bad;
	189	bytes= atol(*(++argv));
	190	if (bytes == 0L) bytes=1L;
	191	i=strlen(argv[0]);
	192	if (argv[0][i-1] == 'k') bytes*=1024L;
	193	if (argv[0][i-1] == 'm') bytes=1024L1024L;
	194	}
d02b48c6 RE	195	else if (strcmp(*argv,"-cert") == 0)
	196	{
	197	if (--argc < 1) goto bad;
	198	server_cert= *(++argv);
	199	}
	200	else if (strcmp(*argv,"-s_cert") == 0)
	201	{
	202	if (--argc < 1) goto bad;
	203	server_cert= *(++argv);
	204	}
	205	else if (strcmp(*argv,"-c_cert") == 0)
	206	{
	207	if (--argc < 1) goto bad;
	208	client_cert= *(++argv);
	209	}
	210	else if (strcmp(*argv,"-cipher") == 0)
	211	{
	212	if (--argc < 1) goto bad;
	213	cipher= *(++argv);
	214	}
	215	else if (strcmp(*argv,"-CApath") == 0)
	216	{
	217	if (--argc < 1) goto bad;
	218	CApath= *(++argv);
	219	}
	220	else if (strcmp(*argv,"-CAfile") == 0)
	221	{
	222	if (--argc < 1) goto bad;
	223	CAfile= *(++argv);
	224	}
	225	else
	226	{
	227	fprintf(stderr,"unknown option %s\n",*argv);
	228	badop=1;
	229	break;
	230	}
	231	argc--;
	232	argv++;
	233	}
	234	if (badop)
	235	{
	236	bad:
	237	sv_usage();
	238	goto end;
	239	}
	240
	241	/* if (cipher == NULL) cipher=getenv("SSL_CIPHER"); */
	242
413c4f45	243	SSL_library_init();
d02b48c6 RE	244	SSL_load_error_strings();
	245
	246	#if !defined(NO_SSL2) && !defined(NO_SSL3)
	247	if (ssl2)
	248	meth=SSLv2_method();
	249	else
58964a49 RE	250	if (tls1)
	251	meth=TLSv1_method();
	252	else
d02b48c6 RE	253	if (ssl3)
	254	meth=SSLv3_method();
	255	else
	256	meth=SSLv23_method();
	257	#else
	258	#ifdef NO_SSL2
	259	meth=SSLv3_method();
	260	#else
	261	meth=SSLv2_method();
	262	#endif
	263	#endif
	264
	265	c_ctx=SSL_CTX_new(meth);
	266	s_ctx=SSL_CTX_new(meth);
	267	if ((c_ctx == NULL) \|\| (s_ctx == NULL))
	268	{
	269	ERR_print_errors(bio_err);
	270	goto end;
	271	}
	272
	273	if (cipher != NULL)
	274	{
	275	SSL_CTX_set_cipher_list(c_ctx,cipher);
	276	SSL_CTX_set_cipher_list(s_ctx,cipher);
	277	}
	278
	279	#ifndef NO_DH
	280	dh=get_dh512();
	281	SSL_CTX_set_tmp_dh(s_ctx,dh);
58964a49 RE	282	DH_free(dh);
	283	#endif
	284
	285	#ifndef NO_RSA
	286	SSL_CTX_set_tmp_rsa_callback(s_ctx,tmp_rsa_cb);
d02b48c6 RE	287	#endif
	288
	289	if (!SSL_CTX_use_certificate_file(s_ctx,server_cert,SSL_FILETYPE_PEM))
	290	{
	291	ERR_print_errors(bio_err);
	292	}
	293	else if (!SSL_CTX_use_PrivateKey_file(s_ctx,server_cert,
	294	SSL_FILETYPE_PEM))
	295	{
	296	ERR_print_errors(bio_err);
	297	goto end;
	298	}
	299
	300	if (client_auth)
	301	{
	302	SSL_CTX_use_certificate_file(c_ctx,client_cert,
	303	SSL_FILETYPE_PEM);
	304	SSL_CTX_use_PrivateKey_file(c_ctx,client_cert,
	305	SSL_FILETYPE_PEM);
	306	}
	307
	308	if ( (!SSL_CTX_load_verify_locations(s_ctx,CAfile,CApath)) \|\|
	309	(!SSL_CTX_set_default_verify_paths(s_ctx)) \|\|
	310	(!SSL_CTX_load_verify_locations(c_ctx,CAfile,CApath)) \|\|
	311	(!SSL_CTX_set_default_verify_paths(c_ctx)))
	312	{
58964a49	313	/* fprintf(stderr,"SSL_load_verify_locations\n"); */
d02b48c6	314	ERR_print_errors(bio_err);
58964a49	315	/* goto end; */
d02b48c6 RE	316	}
	317
	318	if (client_auth)
	319	{
	320	fprintf(stderr,"client authentication\n");
	321	SSL_CTX_set_verify(s_ctx,
	322	SSL_VERIFY_PEER\|SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
	323	verify_callback);
	324	}
	325	if (server_auth)
	326	{
	327	fprintf(stderr,"server authentication\n");
	328	SSL_CTX_set_verify(c_ctx,SSL_VERIFY_PEER,
	329	verify_callback);
	330	}
	331
58964a49 RE	332	c_ssl=SSL_new(c_ctx);
	333	s_ssl=SSL_new(s_ctx);
	334
	335	for (i=0; i<number; i++)
	336	{
	337	if (!reuse) SSL_set_session(c_ssl,NULL);
	338	ret=doit(s_ssl,c_ssl,bytes);
	339	}
	340
	341	if (!verbose)
	342	{
	343	ciph=SSL_get_current_cipher(c_ssl);
	344	fprintf(stdout,"Protocol %s, cipher %s, %s\n",
	345	SSL_get_version(c_ssl),
	346	SSL_CIPHER_get_version(ciph),
	347	SSL_CIPHER_get_name(ciph));
	348	}
	349	if ((number > 1) \|\| (bytes > 1L))
	350	printf("%d handshakes of %ld bytes done\n",number,bytes);
	351
	352	SSL_free(s_ssl);
	353	SSL_free(c_ssl);
	354
d02b48c6 RE	355	end:
	356	if (s_ctx != NULL) SSL_CTX_free(s_ctx);
	357	if (c_ctx != NULL) SSL_CTX_free(c_ctx);
	358
	359	if (bio_stdout != NULL) BIO_free(bio_stdout);
	360
dfeab068	361	ERR_free_strings();
d02b48c6 RE	362	ERR_remove_state(0);
	363	EVP_cleanup();
	364	CRYPTO_mem_leaks(bio_err);
	365	EXIT(ret);
	366	}
	367
	368	#define W_READ 1
	369	#define W_WRITE 2
	370	#define C_DONE 1
	371	#define S_DONE 2
	372
6b691a5c	373	int doit(SSL s_ssl, SSL c_ssl, long count)
d02b48c6	374	{
58964a49 RE	375	MS_STATIC char cbuf[10248],sbuf[10248];
	376	long cw_num=count,cr_num=count;
	377	long sw_num=count,sr_num=count;
d02b48c6	378	int ret=1;
d02b48c6 RE	379	BIO *c_to_s=NULL;
	380	BIO *s_to_c=NULL;
	381	BIO *c_bio=NULL;
	382	BIO *s_bio=NULL;
	383	int c_r,c_w,s_r,s_w;
	384	int c_want,s_want;
58964a49	385	int i,j;
d02b48c6 RE	386	int done=0;
	387	int c_write,s_write;
	388	int do_server=0,do_client=0;
	389	SSL_CIPHER *ciph;
	390
d02b48c6 RE	391	c_to_s=BIO_new(BIO_s_mem());
	392	s_to_c=BIO_new(BIO_s_mem());
	393	if ((s_to_c == NULL) \|\| (c_to_s == NULL))
	394	{
	395	ERR_print_errors(bio_err);
	396	goto err;
	397	}
	398
	399	c_bio=BIO_new(BIO_f_ssl());
	400	s_bio=BIO_new(BIO_f_ssl());
	401	if ((c_bio == NULL) \|\| (s_bio == NULL))
	402	{
	403	ERR_print_errors(bio_err);
	404	goto err;
	405	}
	406
	407	SSL_set_connect_state(c_ssl);
	408	SSL_set_bio(c_ssl,s_to_c,c_to_s);
58964a49	409	BIO_set_ssl(c_bio,c_ssl,BIO_NOCLOSE);
d02b48c6 RE	410
	411	SSL_set_accept_state(s_ssl);
	412	SSL_set_bio(s_ssl,c_to_s,s_to_c);
58964a49	413	BIO_set_ssl(s_bio,s_ssl,BIO_NOCLOSE);
d02b48c6 RE	414
	415	c_r=0; s_r=1;
	416	c_w=1; s_w=0;
	417	c_want=W_WRITE;
	418	s_want=0;
	419	c_write=1,s_write=0;
	420
	421	/* We can always do writes */
	422	for (;;)
	423	{
	424	do_server=0;
	425	do_client=0;
	426
	427	i=(int)BIO_pending(s_bio);
	428	if ((i && s_r) \|\| s_w) do_server=1;
	429
	430	i=(int)BIO_pending(c_bio);
	431	if ((i && c_r) \|\| c_w) do_client=1;
	432
58964a49	433	if (do_server && debug)
d02b48c6 RE	434	{
	435	if (SSL_in_init(s_ssl))
	436	printf("server waiting in SSL_accept - %s\n",
	437	SSL_state_string_long(s_ssl));
58964a49	438	/* else if (s_write)
d02b48c6	439	printf("server:SSL_write()\n");
58964a49 RE	440	else
58964a49 RE	441	printf("server:SSL_read()\n"); */
d02b48c6 RE	442	}
d02b48c6 RE	443
58964a49	444	if (do_client && debug)
d02b48c6 RE	445	{
	446	if (SSL_in_init(c_ssl))
	447	printf("client waiting in SSL_connect - %s\n",
	448	SSL_state_string_long(c_ssl));
58964a49	449	/* else if (c_write)
d02b48c6 RE	450	printf("client:SSL_write()\n");
d02b48c6 RE	451	else
58964a49	452	printf("client:SSL_read()\n"); */
d02b48c6 RE	453	}
	454
	455	if (!do_client && !do_server)
	456	{
	457	fprintf(stdout,"ERROR IN STARTUP\n");
	458	ERR_print_errors(bio_err);
	459	break;
	460	}
	461	if (do_client && !(done & C_DONE))
	462	{
	463	if (c_write)
	464	{
58964a49 RE	465	j=(cw_num > (long)sizeof(cbuf))
	466	?sizeof(cbuf):(int)cw_num;
	467	i=BIO_write(c_bio,cbuf,j);
d02b48c6 RE	468	if (i < 0)
	469	{
	470	c_r=0;
	471	c_w=0;
	472	if (BIO_should_retry(c_bio))
	473	{
	474	if (BIO_should_read(c_bio))
	475	c_r=1;
	476	if (BIO_should_write(c_bio))
	477	c_w=1;
	478	}
	479	else
	480	{
	481	fprintf(stderr,"ERROR in CLIENT\n");
	482	ERR_print_errors(bio_err);
	483	goto err;
	484	}
	485	}
	486	else if (i == 0)
	487	{
	488	fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
	489	goto err;
	490	}
	491	else
	492	{
58964a49 RE	493	if (debug)
58964a49 RE	494	printf("client wrote %d\n",i);
d02b48c6	495	/* ok */
58964a49	496	s_r=1;
d02b48c6	497	c_write=0;
58964a49	498	cw_num-=i;
d02b48c6 RE	499	}
	500	}
	501	else
	502	{
58964a49	503	i=BIO_read(c_bio,cbuf,sizeof(cbuf));
d02b48c6 RE	504	if (i < 0)
	505	{
	506	c_r=0;
	507	c_w=0;
	508	if (BIO_should_retry(c_bio))
	509	{
	510	if (BIO_should_read(c_bio))
	511	c_r=1;
	512	if (BIO_should_write(c_bio))
	513	c_w=1;
	514	}
	515	else
	516	{
	517	fprintf(stderr,"ERROR in CLIENT\n");
	518	ERR_print_errors(bio_err);
	519	goto err;
	520	}
	521	}
	522	else if (i == 0)
	523	{
	524	fprintf(stderr,"SSL CLIENT STARTUP FAILED\n");
	525	goto err;
	526	}
	527	else
	528	{
58964a49 RE	529	if (debug)
	530	printf("client read %d\n",i);
	531	cr_num-=i;
	532	if (sw_num > 0)
	533	{
	534	s_write=1;
	535	s_w=1;
	536	}
	537	if (cr_num <= 0)
	538	{
	539	s_write=1;
	540	s_w=1;
	541	done=S_DONE\|C_DONE;
	542	}
d02b48c6 RE	543	}
	544	}
	545	}
	546
	547	if (do_server && !(done & S_DONE))
	548	{
	549	if (!s_write)
	550	{
58964a49	551	i=BIO_read(s_bio,sbuf,sizeof(cbuf));
d02b48c6 RE	552	if (i < 0)
	553	{
	554	s_r=0;
	555	s_w=0;
	556	if (BIO_should_retry(s_bio))
	557	{
	558	if (BIO_should_read(s_bio))
	559	s_r=1;
	560	if (BIO_should_write(s_bio))
	561	s_w=1;
	562	}
	563	else
	564	{
	565	fprintf(stderr,"ERROR in SERVER\n");
	566	ERR_print_errors(bio_err);
	567	goto err;
	568	}
	569	}
	570	else if (i == 0)
	571	{
	572	ERR_print_errors(bio_err);
	573	fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_read\n");
	574	goto err;
	575	}
	576	else
	577	{
58964a49 RE	578	if (debug)
	579	printf("server read %d\n",i);
	580	sr_num-=i;
	581	if (cw_num > 0)
	582	{
	583	c_write=1;
	584	c_w=1;
	585	}
	586	if (sr_num <= 0)
	587	{
	588	s_write=1;
	589	s_w=1;
	590	c_write=0;
	591	}
d02b48c6 RE	592	}
	593	}
	594	else
	595	{
58964a49 RE	596	j=(sw_num > (long)sizeof(sbuf))?
	597	sizeof(sbuf):(int)sw_num;
	598	i=BIO_write(s_bio,sbuf,j);
d02b48c6 RE	599	if (i < 0)
	600	{
	601	s_r=0;
	602	s_w=0;
	603	if (BIO_should_retry(s_bio))
	604	{
	605	if (BIO_should_read(s_bio))
	606	s_r=1;
	607	if (BIO_should_write(s_bio))
	608	s_w=1;
	609	}
	610	else
	611	{
	612	fprintf(stderr,"ERROR in SERVER\n");
	613	ERR_print_errors(bio_err);
	614	goto err;
	615	}
	616	}
	617	else if (i == 0)
	618	{
	619	ERR_print_errors(bio_err);
	620	fprintf(stderr,"SSL SERVER STARTUP FAILED in SSL_write\n");
	621	goto err;
	622	}
	623	else
	624	{
58964a49 RE	625	if (debug)
	626	printf("server wrote %d\n",i);
	627	sw_num-=i;
d02b48c6	628	s_write=0;
58964a49 RE	629	c_r=1;
	630	if (sw_num <= 0)
	631	done\|=S_DONE;
d02b48c6 RE	632	}
	633	}
	634	}
	635
	636	if ((done & S_DONE) && (done & C_DONE)) break;
	637	}
	638
	639	ciph=SSL_get_current_cipher(c_ssl);
58964a49 RE	640	if (verbose)
	641	fprintf(stdout,"DONE, protocol %s, cipher %s, %s\n",
	642	SSL_get_version(c_ssl),
	643	SSL_CIPHER_get_version(ciph),
	644	SSL_CIPHER_get_name(ciph));
d02b48c6 RE	645	ret=0;
	646	err:
	647	/* We have to set the BIO's to NULL otherwise they will be
	648	* Free()ed twice. Once when th s_ssl is SSL_free()ed and
	649	* again when c_ssl is SSL_free()ed.
	650	* This is a hack required because s_ssl and c_ssl are sharing the same
	651	* BIO structure and SSL_set_bio() and SSL_free() automatically
	652	* BIO_free non NULL entries.
	653	* You should not normally do this or be required to do this */
	654	if (s_ssl != NULL)
	655	{
	656	s_ssl->rbio=NULL;
	657	s_ssl->wbio=NULL;
	658	}
	659	if (c_ssl != NULL)
	660	{
	661	c_ssl->rbio=NULL;
	662	c_ssl->wbio=NULL;
	663	}
	664
	665	if (c_to_s != NULL) BIO_free(c_to_s);
	666	if (s_to_c != NULL) BIO_free(s_to_c);
58964a49 RE	667	if (c_bio != NULL) BIO_free_all(c_bio);
58964a49 RE	668	if (s_bio != NULL) BIO_free_all(s_bio);
d02b48c6 RE	669	return(ret);
	670	}
	671
6b691a5c	672	int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
d02b48c6 RE	673	{
	674	char *s,buf[256];
	675
	676	s=X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),buf,256);
	677	if (s != NULL)
	678	{
	679	if (ok)
	680	fprintf(stderr,"depth=%d %s\n",ctx->error_depth,buf);
	681	else
	682	fprintf(stderr,"depth=%d error=%d %s\n",
	683	ctx->error_depth,ctx->error,buf);
	684	}
	685
	686	if (ok == 0)
	687	{
	688	switch (ctx->error)
	689	{
	690	case X509_V_ERR_CERT_NOT_YET_VALID:
	691	case X509_V_ERR_CERT_HAS_EXPIRED:
	692	case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
	693	ok=1;
	694	}
	695	}
	696
	697	return(ok);
	698	}
	699
58964a49	700	#ifndef NO_DH
d02b48c6 RE	701	static unsigned char dh512_p[]={
	702	0xDA,0x58,0x3C,0x16,0xD9,0x85,0x22,0x89,0xD0,0xE4,0xAF,0x75,
	703	0x6F,0x4C,0xCA,0x92,0xDD,0x4B,0xE5,0x33,0xB8,0x04,0xFB,0x0F,
	704	0xED,0x94,0xEF,0x9C,0x8A,0x44,0x03,0xED,0x57,0x46,0x50,0xD3,
	705	0x69,0x99,0xDB,0x29,0xD7,0x76,0x27,0x6B,0xA2,0xD3,0xD4,0x12,
	706	0xE2,0x18,0xF4,0xDD,0x1E,0x08,0x4C,0xF6,0xD8,0x00,0x3E,0x7C,
	707	0x47,0x74,0xE8,0x33,
	708	};
	709	static unsigned char dh512_g[]={
	710	0x02,
	711	};
	712
6b691a5c	713	static DH *get_dh512(void)
d02b48c6 RE	714	{
	715	DH *dh=NULL;
	716
d02b48c6 RE	717	if ((dh=DH_new()) == NULL) return(NULL);
	718	dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
	719	dh->g=BN_bin2bn(dh512_g,sizeof(dh512_g),NULL);
	720	if ((dh->p == NULL) \|\| (dh->g == NULL))
	721	return(NULL);
d02b48c6 RE	722	return(dh);
d02b48c6 RE	723	}
58964a49 RE	724	#endif
58964a49 RE	725
79df9d62	726	#ifndef NO_RSA
df63a389	727	static RSA MS_CALLBACK tmp_rsa_cb(SSL s, int is_export, int keylength)
58964a49 RE	728	{
	729	static RSA *rsa_tmp=NULL;
	730
	731	if (rsa_tmp == NULL)
	732	{
60e31c3a	733	BIO_printf(bio_err,"Generating temp (%d bit) RSA key...",keylength);
58964a49	734	BIO_flush(bio_err);
60e31c3a	735	rsa_tmp=RSA_generate_key(keylength,RSA_F4,NULL,NULL);
58964a49 RE	736	BIO_printf(bio_err,"\n");
	737	BIO_flush(bio_err);
	738	}
	739	return(rsa_tmp);
	740	}
79df9d62	741	#endif