1 /* ssl/ssltest.c */ 2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3 * All rights reserved. 4 * 5 * This package is an SSL implementation written 6 * by Eric Young (eay@cryptsoft.com). 7 * The implementation was written so as to conform with Netscapes SSL. 8 * 9 * This library is free for commercial and non-commercial use as long as 10 * the following conditions are aheared to. The following conditions 11 * apply to all code found in this distribution, be it the RC4, RSA, 12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13 * included with this distribution is covered by the same copyright terms 14 * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15 * 16 * Copyright remains Eric Young's, and as such any Copyright notices in 17 * the code are not to be removed. 18 * If this package is used in a product, Eric Young should be given attribution 19 * as the author of the parts of the library used. 20 * This can be in the form of a textual message at program startup or 21 * in documentation (online or textual) provided with the package. 22 * 23 * Redistribution and use in source and binary forms, with or without 24 * modification, are permitted provided that the following conditions 25 * are met: 26 * 1. Redistributions of source code must retain the copyright 27 * notice, this list of conditions and the following disclaimer. 28 * 2. Redistributions in binary form must reproduce the above copyright 29 * notice, this list of conditions and the following disclaimer in the 30 * documentation and/or other materials provided with the distribution. 31 * 3. All advertising materials mentioning features or use of this software 32 * must display the following acknowledgement: 33 * "This product includes cryptographic software written by 34 * Eric Young (eay@cryptsoft.com)" 35 * The word 'cryptographic' can be left out if the rouines from the library 36 * being used are not cryptographic related :-). 37 * 4. If you include any Windows specific code (or a derivative thereof) from 38 * the apps directory (application code) you must include an acknowledgement: 39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40 * 41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51 * SUCH DAMAGE. 52 * 53 * The licence and distribution terms for any publically available version or 54 * derivative of this code cannot be changed. i.e. this code cannot simply be 55 * copied and put under another distribution licence 56 * [including the GNU Public Licence.] 57 */ 58 /* ==================================================================== 59 * Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved. 60 * 61 * Redistribution and use in source and binary forms, with or without 62 * modification, are permitted provided that the following conditions 63 * are met: 64 * 65 * 1. Redistributions of source code must retain the above copyright 66 * notice, this list of conditions and the following disclaimer. 67 * 68 * 2. Redistributions in binary form must reproduce the above copyright 69 * notice, this list of conditions and the following disclaimer in 70 * the documentation and/or other materials provided with the 71 * distribution. 72 * 73 * 3. All advertising materials mentioning features or use of this 74 * software must display the following acknowledgment: 75 * "This product includes software developed by the OpenSSL Project 76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 77 * 78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 79 * endorse or promote products derived from this software without 80 * prior written permission. For written permission, please contact 81 * openssl-core@openssl.org. 82 * 83 * 5. Products derived from this software may not be called "OpenSSL" 84 * nor may "OpenSSL" appear in their names without prior written 85 * permission of the OpenSSL Project. 86 * 87 * 6. Redistributions of any form whatsoever must retain the following 88 * acknowledgment: 89 * "This product includes software developed by the OpenSSL Project 90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 91 * 92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 103 * OF THE POSSIBILITY OF SUCH DAMAGE. 104 * ==================================================================== 105 * 106 * This product includes cryptographic software written by Eric Young 107 * (eay@cryptsoft.com). This product includes software written by Tim 108 * Hudson (tjh@cryptsoft.com). 109 * 110 */ 111 /* ==================================================================== 112 * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED. 113 * ECC cipher suite support in OpenSSL originally developed by 114 * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project. 115 */ 116 /* ==================================================================== 117 * Copyright 2005 Nokia. All rights reserved. 118 * 119 * The portions of the attached software ("Contribution") is developed by 120 * Nokia Corporation and is licensed pursuant to the OpenSSL open source 121 * license. 122 * 123 * The Contribution, originally written by Mika Kousa and Pasi Eronen of 124 * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites 125 * support (see RFC 4279) to OpenSSL. 126 * 127 * No patent licenses or other rights except those expressly stated in 128 * the OpenSSL open source license shall be deemed granted or received 129 * expressly, by implication, estoppel, or otherwise. 130 * 131 * No assurances are provided by Nokia that the Contribution does not 132 * infringe the patent or other intellectual property rights of any third 133 * party or that the license provides you with all the necessary rights 134 * to make use of the Contribution. 135 * 136 * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN 137 * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA 138 * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY 139 * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR 140 * OTHERWISE. 141 */ 142 143 #define _BSD_SOURCE 1 /* Or gethostname won't be declared properly 144 on Linux and GNU platforms. */ 145 #include <sys/types.h> 146 #include <sys/param.h> 147 #include <sys/socket.h> 148 149 #include <netinet/in.h> 150 151 #include <assert.h> 152 #include <errno.h> 153 #include <limits.h> 154 #include <netdb.h> 155 #include <stdio.h> 156 #include <stdlib.h> 157 #include <string.h> 158 #include <time.h> 159 #include <unistd.h> 160 161 #include <ctype.h> 162 163 #include <openssl/opensslconf.h> 164 #include <openssl/bio.h> 165 #include <openssl/crypto.h> 166 #include <openssl/evp.h> 167 #include <openssl/x509.h> 168 #include <openssl/x509v3.h> 169 #include <openssl/ssl.h> 170 #ifndef OPENSSL_NO_ENGINE 171 #include <openssl/engine.h> 172 #endif 173 #include <openssl/err.h> 174 #include <openssl/rand.h> 175 #include <openssl/rsa.h> 176 #include <openssl/dsa.h> 177 #include <openssl/dh.h> 178 #include <openssl/bn.h> 179 180 #define TEST_SERVER_CERT "../apps/server.pem" 181 #define TEST_CLIENT_CERT "../apps/client.pem" 182 183 static int verify_callback(int ok, X509_STORE_CTX *ctx); 184 static int app_verify_callback(X509_STORE_CTX *ctx, void *arg); 185 #define APP_CALLBACK_STRING "Test Callback Argument" 186 struct app_verify_arg { 187 char *string; 188 int app_verify; 189 int allow_proxy_certs; 190 char *proxy_auth; 191 char *proxy_cond; 192 }; 193 194 static DH *get_dh1024(void); 195 static DH *get_dh1024dsa(void); 196 197 static BIO *bio_err = NULL; 198 static BIO *bio_stdout = NULL; 199 200 static const char *alpn_client; 201 static const char *alpn_server; 202 static const char *alpn_expected; 203 static unsigned char *alpn_selected; 204 205 /* 206 * next_protos_parse parses a comma separated list of strings into a string 207 * in a format suitable for passing to SSL_CTX_set_next_protos_advertised. 208 * outlen: (output) set to the length of the resulting buffer on success. 209 * err: (maybe NULL) on failure, an error message line is written to this BIO. 210 * in: a NUL terminated string like "abc,def,ghi" 211 * 212 * returns: a malloced buffer or NULL on failure. 213 */ 214 static unsigned char * 215 next_protos_parse(unsigned short *outlen, const char *in) 216 { 217 size_t i, len, start = 0; 218 unsigned char *out; 219 220 len = strlen(in); 221 if (len >= 65535) 222 return (NULL); 223 224 if ((out = malloc(strlen(in) + 1)) == NULL) 225 return (NULL); 226 227 for (i = 0; i <= len; ++i) { 228 if (i == len || in[i] == ',') { 229 if (i - start > 255) { 230 free(out); 231 return (NULL); 232 } 233 out[start] = i - start; 234 start = i + 1; 235 } else 236 out[i+1] = in[i]; 237 } 238 *outlen = len + 1; 239 return (out); 240 } 241 242 static int 243 cb_server_alpn(SSL *s, const unsigned char **out, unsigned char *outlen, 244 const unsigned char *in, unsigned int inlen, void *arg) 245 { 246 unsigned char *protos; 247 unsigned short protos_len; 248 249 if ((protos = next_protos_parse(&protos_len, alpn_server)) == NULL) { 250 fprintf(stderr, 251 "failed to parser ALPN server protocol string: %s\n", 252 alpn_server); 253 abort(); 254 } 255 256 if (SSL_select_next_proto((unsigned char **)out, outlen, protos, 257 protos_len, in, inlen) != OPENSSL_NPN_NEGOTIATED) { 258 free(protos); 259 return (SSL_TLSEXT_ERR_NOACK); 260 } 261 262 /* 263 * Make a copy of the selected protocol which will be freed in 264 * verify_alpn. 265 */ 266 if ((alpn_selected = malloc(*outlen)) == NULL) { 267 fprintf(stderr, "malloc failed\n"); 268 abort(); 269 } 270 memcpy(alpn_selected, *out, *outlen); 271 *out = alpn_selected; 272 free(protos); 273 274 return (SSL_TLSEXT_ERR_OK); 275 } 276 277 static int 278 verify_alpn(SSL *client, SSL *server) 279 { 280 const unsigned char *client_proto, *server_proto; 281 unsigned int client_proto_len = 0, server_proto_len = 0; 282 283 SSL_get0_alpn_selected(client, &client_proto, &client_proto_len); 284 SSL_get0_alpn_selected(server, &server_proto, &server_proto_len); 285 286 free(alpn_selected); 287 alpn_selected = NULL; 288 289 if (client_proto_len != server_proto_len || 290 memcmp(client_proto, server_proto, client_proto_len) != 0) { 291 BIO_printf(bio_stdout, "ALPN selected protocols differ!\n"); 292 goto err; 293 } 294 295 if (client_proto_len > 0 && alpn_expected == NULL) { 296 BIO_printf(bio_stdout, "ALPN unexpectedly negotiated\n"); 297 goto err; 298 } 299 300 if (alpn_expected != NULL && 301 (client_proto_len != strlen(alpn_expected) || 302 memcmp(client_proto, alpn_expected, client_proto_len) != 0)) { 303 BIO_printf(bio_stdout, "ALPN selected protocols not equal to " 304 "expected protocol: %s\n", alpn_expected); 305 goto err; 306 } 307 308 return (0); 309 310 err: 311 BIO_printf(bio_stdout, "ALPN results: client: '"); 312 BIO_write(bio_stdout, client_proto, client_proto_len); 313 BIO_printf(bio_stdout, "', server: '"); 314 BIO_write(bio_stdout, server_proto, server_proto_len); 315 BIO_printf(bio_stdout, "'\n"); 316 BIO_printf(bio_stdout, "ALPN configured: client: '%s', server: '%s'\n", 317 alpn_client, alpn_server); 318 319 return (-1); 320 } 321 322 static char *cipher = NULL; 323 static int verbose = 0; 324 static int debug = 0; 325 326 int doit_biopair(SSL *s_ssl, SSL *c_ssl, long bytes, clock_t *s_time, 327 clock_t *c_time); 328 int doit(SSL *s_ssl, SSL *c_ssl, long bytes); 329 static int do_test_cipherlist(void); 330 331 static void 332 sv_usage(void) 333 { 334 fprintf(stderr, "usage: ssltest [args ...]\n"); 335 fprintf(stderr, "\n"); 336 fprintf(stderr, " -server_auth - check server certificate\n"); 337 fprintf(stderr, " -client_auth - do client authentication\n"); 338 fprintf(stderr, " -proxy - allow proxy certificates\n"); 339 fprintf(stderr, " -proxy_auth <val> - set proxy policy rights\n"); 340 fprintf(stderr, " -proxy_cond <val> - experssion to test proxy policy rights\n"); 341 fprintf(stderr, " -v - more output\n"); 342 fprintf(stderr, " -d - debug output\n"); 343 fprintf(stderr, " -reuse - use session-id reuse\n"); 344 fprintf(stderr, " -num <val> - number of connections to perform\n"); 345 fprintf(stderr, " -bytes <val> - number of bytes to swap between client/server\n"); 346 fprintf(stderr, " -dhe1024dsa - use 1024 bit key (with 160-bit subprime) for DHE\n"); 347 fprintf(stderr, " -no_dhe - disable DHE\n"); 348 fprintf(stderr, " -no_ecdhe - disable ECDHE\n"); 349 fprintf(stderr, " -dtls1 - use DTLSv1\n"); 350 fprintf(stderr, " -tls1 - use TLSv1\n"); 351 fprintf(stderr, " -tls1_2 - use TLSv1.2\n"); 352 fprintf(stderr, " -CApath arg - PEM format directory of CA's\n"); 353 fprintf(stderr, " -CAfile arg - PEM format file of CA's\n"); 354 fprintf(stderr, " -cert arg - Server certificate file\n"); 355 fprintf(stderr, " -key arg - Server key file (default: same as -cert)\n"); 356 fprintf(stderr, " -c_cert arg - Client certificate file\n"); 357 fprintf(stderr, " -c_key arg - Client key file (default: same as -c_cert)\n"); 358 fprintf(stderr, " -cipher arg - The cipher list\n"); 359 fprintf(stderr, " -bio_pair - Use BIO pairs\n"); 360 fprintf(stderr, " -f - Test even cases that can't work\n"); 361 fprintf(stderr, " -time - measure processor time used by client and server\n"); 362 fprintf(stderr, " -named_curve arg - Elliptic curve name to use for ephemeral ECDH keys.\n" \ 363 " Use \"openssl ecparam -list_curves\" for all names\n" \ 364 " (default is sect163r2).\n"); 365 fprintf(stderr, " -test_cipherlist - verifies the order of the ssl cipher lists\n"); 366 fprintf(stderr, " -alpn_client <string> - have client side offer ALPN\n"); 367 fprintf(stderr, " -alpn_server <string> - have server side offer ALPN\n"); 368 fprintf(stderr, " -alpn_expected <string> - the ALPN protocol that should be negotiated\n"); 369 } 370 371 static void 372 print_details(SSL *c_ssl, const char *prefix) 373 { 374 const SSL_CIPHER *ciph; 375 X509 *cert; 376 377 ciph = SSL_get_current_cipher(c_ssl); 378 BIO_printf(bio_stdout, "%s%s, cipher %s %s", 379 prefix, SSL_get_version(c_ssl), SSL_CIPHER_get_version(ciph), 380 SSL_CIPHER_get_name(ciph)); 381 cert = SSL_get_peer_certificate(c_ssl); 382 if (cert != NULL) { 383 EVP_PKEY *pkey = X509_get_pubkey(cert); 384 if (pkey != NULL) { 385 if (pkey->type == EVP_PKEY_RSA && 386 pkey->pkey.rsa != NULL && 387 pkey->pkey.rsa->n != NULL) { 388 BIO_printf(bio_stdout, ", %d bit RSA", 389 BN_num_bits(pkey->pkey.rsa->n)); 390 } else if (pkey->type == EVP_PKEY_DSA && 391 pkey->pkey.dsa != NULL && 392 pkey->pkey.dsa->p != NULL) { 393 BIO_printf(bio_stdout, ", %d bit DSA", 394 BN_num_bits(pkey->pkey.dsa->p)); 395 } 396 EVP_PKEY_free(pkey); 397 } 398 X509_free(cert); 399 } 400 /* The SSL API does not allow us to look at temporary RSA/DH keys, 401 * otherwise we should print their lengths too */ 402 BIO_printf(bio_stdout, "\n"); 403 } 404 405 int 406 main(int argc, char *argv[]) 407 { 408 char *CApath = NULL, *CAfile = NULL; 409 int badop = 0; 410 int bio_pair = 0; 411 int force = 0; 412 int tls1 = 0, tls1_2 = 0, dtls1 = 0, ret = 1; 413 int client_auth = 0; 414 int server_auth = 0, i; 415 struct app_verify_arg app_verify_arg = 416 { APP_CALLBACK_STRING, 0, 0, NULL, NULL }; 417 char *server_cert = TEST_SERVER_CERT; 418 char *server_key = NULL; 419 char *client_cert = TEST_CLIENT_CERT; 420 char *client_key = NULL; 421 char *named_curve = NULL; 422 SSL_CTX *s_ctx = NULL; 423 SSL_CTX *c_ctx = NULL; 424 const SSL_METHOD *meth = NULL; 425 SSL *c_ssl, *s_ssl; 426 int number = 1, reuse = 0; 427 long bytes = 256L; 428 DH *dh; 429 int dhe1024dsa = 0; 430 EC_KEY *ecdh = NULL; 431 int no_dhe = 0; 432 int no_ecdhe = 0; 433 int print_time = 0; 434 clock_t s_time = 0, c_time = 0; 435 int test_cipherlist = 0; 436 437 verbose = 0; 438 debug = 0; 439 cipher = 0; 440 441 bio_err = BIO_new_fp(stderr, BIO_NOCLOSE|BIO_FP_TEXT); 442 443 bio_stdout = BIO_new_fp(stdout, BIO_NOCLOSE|BIO_FP_TEXT); 444 445 argc--; 446 argv++; 447 448 while (argc >= 1) { 449 if (!strcmp(*argv, "-F")) { 450 fprintf(stderr, "not compiled with FIPS support, so exiting without running.\n"); 451 exit(0); 452 } else if (strcmp(*argv, "-server_auth") == 0) 453 server_auth = 1; 454 else if (strcmp(*argv, "-client_auth") == 0) 455 client_auth = 1; 456 else if (strcmp(*argv, "-proxy_auth") == 0) { 457 if (--argc < 1) 458 goto bad; 459 app_verify_arg.proxy_auth= *(++argv); 460 } else if (strcmp(*argv, "-proxy_cond") == 0) { 461 if (--argc < 1) 462 goto bad; 463 app_verify_arg.proxy_cond= *(++argv); 464 } else if (strcmp(*argv, "-v") == 0) 465 verbose = 1; 466 else if (strcmp(*argv, "-d") == 0) 467 debug = 1; 468 else if (strcmp(*argv, "-reuse") == 0) 469 reuse = 1; 470 else if (strcmp(*argv, "-dhe1024dsa") == 0) { 471 dhe1024dsa = 1; 472 } else if (strcmp(*argv, "-no_dhe") == 0) 473 no_dhe = 1; 474 else if (strcmp(*argv, "-no_ecdhe") == 0) 475 no_ecdhe = 1; 476 else if (strcmp(*argv, "-dtls1") == 0) 477 dtls1 = 1; 478 else if (strcmp(*argv, "-tls1") == 0) 479 tls1 = 1; 480 else if (strcmp(*argv, "-tls1_2") == 0) 481 tls1_2 = 1; 482 else if (strncmp(*argv, "-num", 4) == 0) { 483 if (--argc < 1) 484 goto bad; 485 number = atoi(*(++argv)); 486 if (number == 0) 487 number = 1; 488 } else if (strcmp(*argv, "-bytes") == 0) { 489 if (--argc < 1) 490 goto bad; 491 bytes = atol(*(++argv)); 492 if (bytes == 0L) 493 bytes = 1L; 494 i = strlen(argv[0]); 495 if (argv[0][i - 1] == 'k') 496 bytes*=1024L; 497 if (argv[0][i - 1] == 'm') 498 bytes*=1024L*1024L; 499 } else if (strcmp(*argv, "-cert") == 0) { 500 if (--argc < 1) 501 goto bad; 502 server_cert= *(++argv); 503 } else if (strcmp(*argv, "-s_cert") == 0) { 504 if (--argc < 1) 505 goto bad; 506 server_cert= *(++argv); 507 } else if (strcmp(*argv, "-key") == 0) { 508 if (--argc < 1) 509 goto bad; 510 server_key= *(++argv); 511 } else if (strcmp(*argv, "-s_key") == 0) { 512 if (--argc < 1) 513 goto bad; 514 server_key= *(++argv); 515 } else if (strcmp(*argv, "-c_cert") == 0) { 516 if (--argc < 1) 517 goto bad; 518 client_cert= *(++argv); 519 } else if (strcmp(*argv, "-c_key") == 0) { 520 if (--argc < 1) 521 goto bad; 522 client_key= *(++argv); 523 } else if (strcmp(*argv, "-cipher") == 0) { 524 if (--argc < 1) 525 goto bad; 526 cipher= *(++argv); 527 } else if (strcmp(*argv, "-CApath") == 0) { 528 if (--argc < 1) 529 goto bad; 530 CApath= *(++argv); 531 } else if (strcmp(*argv, "-CAfile") == 0) { 532 if (--argc < 1) 533 goto bad; 534 CAfile= *(++argv); 535 } else if (strcmp(*argv, "-bio_pair") == 0) { 536 bio_pair = 1; 537 } else if (strcmp(*argv, "-f") == 0) { 538 force = 1; 539 } else if (strcmp(*argv, "-time") == 0) { 540 print_time = 1; 541 } else if (strcmp(*argv, "-named_curve") == 0) { 542 if (--argc < 1) 543 goto bad; 544 named_curve = *(++argv); 545 } else if (strcmp(*argv, "-app_verify") == 0) { 546 app_verify_arg.app_verify = 1; 547 } else if (strcmp(*argv, "-proxy") == 0) { 548 app_verify_arg.allow_proxy_certs = 1; 549 } else if (strcmp(*argv, "-test_cipherlist") == 0) { 550 test_cipherlist = 1; 551 } else if (strcmp(*argv, "-alpn_client") == 0) { 552 if (--argc < 1) 553 goto bad; 554 alpn_client = *(++argv); 555 } else if (strcmp(*argv, "-alpn_server") == 0) { 556 if (--argc < 1) 557 goto bad; 558 alpn_server = *(++argv); 559 } else if (strcmp(*argv, "-alpn_expected") == 0) { 560 if (--argc < 1) 561 goto bad; 562 alpn_expected = *(++argv); 563 } else { 564 fprintf(stderr, "unknown option %s\n", *argv); 565 badop = 1; 566 break; 567 } 568 argc--; 569 argv++; 570 } 571 if (badop) { 572 bad: 573 sv_usage(); 574 goto end; 575 } 576 577 if (test_cipherlist == 1) { 578 /* ensure that the cipher list are correctly sorted and exit */ 579 if (do_test_cipherlist() == 0) 580 exit(1); 581 ret = 0; 582 goto end; 583 } 584 585 if (!dtls1 && !tls1 && !tls1_2 && number > 1 && !reuse && !force) { 586 fprintf(stderr, 587 "This case cannot work. Use -f to perform " 588 "the test anyway (and\n-d to see what happens), " 589 "or add one of -dtls1, -tls1, -tls1_2, -reuse\n" 590 "to avoid protocol mismatch.\n"); 591 exit(1); 592 } 593 594 if (print_time) { 595 if (!bio_pair) { 596 fprintf(stderr, "Using BIO pair (-bio_pair)\n"); 597 bio_pair = 1; 598 } 599 if (number < 50 && !force) 600 fprintf(stderr, "Warning: For accurate timings, use more connections (e.g. -num 1000)\n"); 601 } 602 603 /* if (cipher == NULL) cipher=getenv("SSL_CIPHER"); */ 604 605 SSL_library_init(); 606 SSL_load_error_strings(); 607 608 if (dtls1) 609 meth = DTLSv1_method(); 610 else if (tls1) 611 meth = TLSv1_method(); 612 else if (tls1_2) 613 meth = TLSv1_2_method(); 614 else 615 meth = TLS_method(); 616 617 c_ctx = SSL_CTX_new(meth); 618 s_ctx = SSL_CTX_new(meth); 619 if ((c_ctx == NULL) || (s_ctx == NULL)) { 620 ERR_print_errors(bio_err); 621 goto end; 622 } 623 624 if (cipher != NULL) { 625 SSL_CTX_set_cipher_list(c_ctx, cipher); 626 SSL_CTX_set_cipher_list(s_ctx, cipher); 627 } 628 629 if (!no_dhe) { 630 if (dhe1024dsa) { 631 /* use SSL_OP_SINGLE_DH_USE to avoid small subgroup attacks */ 632 SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE); 633 dh = get_dh1024dsa(); 634 } else 635 dh = get_dh1024(); 636 SSL_CTX_set_tmp_dh(s_ctx, dh); 637 DH_free(dh); 638 } 639 640 if (!no_ecdhe) { 641 int nid; 642 643 if (named_curve != NULL) { 644 nid = OBJ_sn2nid(named_curve); 645 if (nid == 0) { 646 BIO_printf(bio_err, "unknown curve name (%s)\n", named_curve); 647 goto end; 648 } 649 } else 650 nid = NID_X9_62_prime256v1; 651 652 ecdh = EC_KEY_new_by_curve_name(nid); 653 if (ecdh == NULL) { 654 BIO_printf(bio_err, "unable to create curve\n"); 655 goto end; 656 } 657 658 SSL_CTX_set_tmp_ecdh(s_ctx, ecdh); 659 SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_ECDH_USE); 660 EC_KEY_free(ecdh); 661 } 662 663 if (!SSL_CTX_use_certificate_file(s_ctx, server_cert, 664 SSL_FILETYPE_PEM)) { 665 ERR_print_errors(bio_err); 666 } else if (!SSL_CTX_use_PrivateKey_file(s_ctx, 667 (server_key ? server_key : server_cert), SSL_FILETYPE_PEM)) { 668 ERR_print_errors(bio_err); 669 goto end; 670 } 671 672 if (client_auth) { 673 SSL_CTX_use_certificate_file(c_ctx, client_cert, 674 SSL_FILETYPE_PEM); 675 SSL_CTX_use_PrivateKey_file(c_ctx, 676 (client_key ? client_key : client_cert), 677 SSL_FILETYPE_PEM); 678 } 679 680 if ((!SSL_CTX_load_verify_locations(s_ctx, CAfile, CApath)) || 681 (!SSL_CTX_set_default_verify_paths(s_ctx)) || 682 (!SSL_CTX_load_verify_locations(c_ctx, CAfile, CApath)) || 683 (!SSL_CTX_set_default_verify_paths(c_ctx))) { 684 /* fprintf(stderr,"SSL_load_verify_locations\n"); */ 685 ERR_print_errors(bio_err); 686 /* goto end; */ 687 } 688 689 if (client_auth) { 690 BIO_printf(bio_err, "client authentication\n"); 691 SSL_CTX_set_verify(s_ctx, 692 SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT, 693 verify_callback); 694 SSL_CTX_set_cert_verify_callback(s_ctx, app_verify_callback, 695 &app_verify_arg); 696 } 697 if (server_auth) { 698 BIO_printf(bio_err, "server authentication\n"); 699 SSL_CTX_set_verify(c_ctx, SSL_VERIFY_PEER, 700 verify_callback); 701 SSL_CTX_set_cert_verify_callback(c_ctx, app_verify_callback, 702 &app_verify_arg); 703 } 704 705 { 706 int session_id_context = 0; 707 SSL_CTX_set_session_id_context(s_ctx, 708 (void *)&session_id_context, sizeof(session_id_context)); 709 } 710 711 if (alpn_server != NULL) 712 SSL_CTX_set_alpn_select_cb(s_ctx, cb_server_alpn, NULL); 713 714 if (alpn_client != NULL) { 715 unsigned short alpn_len; 716 unsigned char *alpn = next_protos_parse(&alpn_len, alpn_client); 717 718 if (alpn == NULL) { 719 BIO_printf(bio_err, "Error parsing -alpn_client argument\n"); 720 goto end; 721 } 722 SSL_CTX_set_alpn_protos(c_ctx, alpn, alpn_len); 723 free(alpn); 724 } 725 726 c_ssl = SSL_new(c_ctx); 727 s_ssl = SSL_new(s_ctx); 728 729 for (i = 0; i < number; i++) { 730 if (!reuse) 731 SSL_set_session(c_ssl, NULL); 732 if (bio_pair) 733 ret = doit_biopair(s_ssl, c_ssl, bytes, &s_time, 734 &c_time); 735 else 736 ret = doit(s_ssl, c_ssl, bytes); 737 } 738 739 if (!verbose) { 740 print_details(c_ssl, ""); 741 } 742 if ((number > 1) || (bytes > 1L)) 743 BIO_printf(bio_stdout, "%d handshakes of %ld bytes done\n", 744 number, bytes); 745 if (print_time) { 746 #ifdef CLOCKS_PER_SEC 747 /* "To determine the time in seconds, the value returned 748 * by the clock function should be divided by the value 749 * of the macro CLOCKS_PER_SEC." 750 * -- ISO/IEC 9899 */ 751 BIO_printf(bio_stdout, 752 "Approximate total server time: %6.2f s\n" 753 "Approximate total client time: %6.2f s\n", 754 (double)s_time/CLOCKS_PER_SEC, 755 (double)c_time/CLOCKS_PER_SEC); 756 #else 757 /* "`CLOCKS_PER_SEC' undeclared (first use this function)" 758 * -- cc on NeXTstep/OpenStep */ 759 BIO_printf(bio_stdout, 760 "Approximate total server time: %6.2f units\n" 761 "Approximate total client time: %6.2f units\n", 762 (double)s_time, 763 (double)c_time); 764 #endif 765 } 766 767 SSL_free(s_ssl); 768 SSL_free(c_ssl); 769 770 end: 771 SSL_CTX_free(s_ctx); 772 SSL_CTX_free(c_ctx); 773 BIO_free(bio_stdout); 774 775 #ifndef OPENSSL_NO_ENGINE 776 ENGINE_cleanup(); 777 #endif 778 CRYPTO_cleanup_all_ex_data(); 779 ERR_free_strings(); 780 ERR_remove_thread_state(NULL); 781 EVP_cleanup(); 782 CRYPTO_mem_leaks(bio_err); 783 BIO_free(bio_err); 784 785 exit(ret); 786 return ret; 787 } 788 789 int 790 doit_biopair(SSL *s_ssl, SSL *c_ssl, long count, clock_t *s_time, 791 clock_t *c_time) 792 { 793 long cw_num = count, cr_num = count, sw_num = count, sr_num = count; 794 BIO *s_ssl_bio = NULL, *c_ssl_bio = NULL; 795 BIO *server = NULL, *server_io = NULL; 796 BIO *client = NULL, *client_io = NULL; 797 int ret = 1; 798 799 size_t bufsiz = 256; /* small buffer for testing */ 800 801 if (!BIO_new_bio_pair(&server, bufsiz, &server_io, bufsiz)) 802 goto err; 803 if (!BIO_new_bio_pair(&client, bufsiz, &client_io, bufsiz)) 804 goto err; 805 806 s_ssl_bio = BIO_new(BIO_f_ssl()); 807 if (!s_ssl_bio) 808 goto err; 809 810 c_ssl_bio = BIO_new(BIO_f_ssl()); 811 if (!c_ssl_bio) 812 goto err; 813 814 SSL_set_connect_state(c_ssl); 815 SSL_set_bio(c_ssl, client, client); 816 (void)BIO_set_ssl(c_ssl_bio, c_ssl, BIO_NOCLOSE); 817 818 SSL_set_accept_state(s_ssl); 819 SSL_set_bio(s_ssl, server, server); 820 (void)BIO_set_ssl(s_ssl_bio, s_ssl, BIO_NOCLOSE); 821 822 do { 823 /* c_ssl_bio: SSL filter BIO 824 * 825 * client: pseudo-I/O for SSL library 826 * 827 * client_io: client's SSL communication; usually to be 828 * relayed over some I/O facility, but in this 829 * test program, we're the server, too: 830 * 831 * server_io: server's SSL communication 832 * 833 * server: pseudo-I/O for SSL library 834 * 835 * s_ssl_bio: SSL filter BIO 836 * 837 * The client and the server each employ a "BIO pair": 838 * client + client_io, server + server_io. 839 * BIO pairs are symmetric. A BIO pair behaves similar 840 * to a non-blocking socketpair (but both endpoints must 841 * be handled by the same thread). 842 * [Here we could connect client and server to the ends 843 * of a single BIO pair, but then this code would be less 844 * suitable as an example for BIO pairs in general.] 845 * 846 * Useful functions for querying the state of BIO pair endpoints: 847 * 848 * BIO_ctrl_pending(bio) number of bytes we can read now 849 * BIO_ctrl_get_read_request(bio) number of bytes needed to fulfil 850 * other side's read attempt 851 * BIO_ctrl_get_write_guarantee(bio) number of bytes we can write now 852 * 853 * ..._read_request is never more than ..._write_guarantee; 854 * it depends on the application which one you should use. 855 */ 856 857 /* We have non-blocking behaviour throughout this test program, but 858 * can be sure that there is *some* progress in each iteration; so 859 * we don't have to worry about ..._SHOULD_READ or ..._SHOULD_WRITE 860 * -- we just try everything in each iteration 861 */ 862 863 { 864 /* CLIENT */ 865 866 char cbuf[1024*8]; 867 int i, r; 868 clock_t c_clock = clock(); 869 870 memset(cbuf, 0, sizeof(cbuf)); 871 872 if (debug) 873 if (SSL_in_init(c_ssl)) 874 printf("client waiting in SSL_connect - %s\n", 875 SSL_state_string_long(c_ssl)); 876 877 if (cw_num > 0) { 878 /* Write to server. */ 879 880 if (cw_num > (long)sizeof cbuf) 881 i = sizeof cbuf; 882 else 883 i = (int)cw_num; 884 r = BIO_write(c_ssl_bio, cbuf, i); 885 if (r < 0) { 886 if (!BIO_should_retry(c_ssl_bio)) { 887 fprintf(stderr, "ERROR in CLIENT\n"); 888 goto err; 889 } 890 /* BIO_should_retry(...) can just be ignored here. 891 * The library expects us to call BIO_write with 892 * the same arguments again, and that's what we will 893 * do in the next iteration. */ 894 } else if (r == 0) { 895 fprintf(stderr, "SSL CLIENT STARTUP FAILED\n"); 896 goto err; 897 } else { 898 if (debug) 899 printf("client wrote %d\n", r); 900 cw_num -= r; 901 902 } 903 } 904 905 if (cr_num > 0) { 906 /* Read from server. */ 907 908 r = BIO_read(c_ssl_bio, cbuf, sizeof(cbuf)); 909 if (r < 0) { 910 if (!BIO_should_retry(c_ssl_bio)) { 911 fprintf(stderr, "ERROR in CLIENT\n"); 912 goto err; 913 } 914 /* Again, "BIO_should_retry" can be ignored. */ 915 } else if (r == 0) { 916 fprintf(stderr, "SSL CLIENT STARTUP FAILED\n"); 917 goto err; 918 } else { 919 if (debug) 920 printf("client read %d\n", r); 921 cr_num -= r; 922 } 923 } 924 925 /* c_time and s_time increments will typically be very small 926 * (depending on machine speed and clock tick intervals), 927 * but sampling over a large number of connections should 928 * result in fairly accurate figures. We cannot guarantee 929 * a lot, however -- if each connection lasts for exactly 930 * one clock tick, it will be counted only for the client 931 * or only for the server or even not at all. 932 */ 933 *c_time += (clock() - c_clock); 934 } 935 936 { 937 /* SERVER */ 938 939 char sbuf[1024*8]; 940 int i, r; 941 clock_t s_clock = clock(); 942 943 memset(sbuf, 0, sizeof(sbuf)); 944 945 if (debug) 946 if (SSL_in_init(s_ssl)) 947 printf("server waiting in SSL_accept - %s\n", 948 SSL_state_string_long(s_ssl)); 949 950 if (sw_num > 0) { 951 /* Write to client. */ 952 953 if (sw_num > (long)sizeof sbuf) 954 i = sizeof sbuf; 955 else 956 i = (int)sw_num; 957 r = BIO_write(s_ssl_bio, sbuf, i); 958 if (r < 0) { 959 if (!BIO_should_retry(s_ssl_bio)) { 960 fprintf(stderr, "ERROR in SERVER\n"); 961 goto err; 962 } 963 /* Ignore "BIO_should_retry". */ 964 } else if (r == 0) { 965 fprintf(stderr, "SSL SERVER STARTUP FAILED\n"); 966 goto err; 967 } else { 968 if (debug) 969 printf("server wrote %d\n", r); 970 sw_num -= r; 971 972 } 973 } 974 975 if (sr_num > 0) { 976 /* Read from client. */ 977 978 r = BIO_read(s_ssl_bio, sbuf, sizeof(sbuf)); 979 if (r < 0) { 980 if (!BIO_should_retry(s_ssl_bio)) { 981 fprintf(stderr, "ERROR in SERVER\n"); 982 goto err; 983 } 984 /* blah, blah */ 985 } else if (r == 0) { 986 fprintf(stderr, "SSL SERVER STARTUP FAILED\n"); 987 goto err; 988 } else { 989 if (debug) 990 printf("server read %d\n", r); 991 sr_num -= r; 992 } 993 } 994 995 *s_time += (clock() - s_clock); 996 } 997 998 { 999 /* "I/O" BETWEEN CLIENT AND SERVER. */ 1000 1001 size_t r1, r2; 1002 BIO *io1 = server_io, *io2 = client_io; 1003 /* we use the non-copying interface for io1 1004 * and the standard BIO_write/BIO_read interface for io2 1005 */ 1006 1007 static int prev_progress = 1; 1008 int progress = 0; 1009 1010 /* io1 to io2 */ 1011 do { 1012 size_t num; 1013 int r; 1014 1015 r1 = BIO_ctrl_pending(io1); 1016 r2 = BIO_ctrl_get_write_guarantee(io2); 1017 1018 num = r1; 1019 if (r2 < num) 1020 num = r2; 1021 if (num) { 1022 char *dataptr; 1023 1024 if (INT_MAX < num) /* yeah, right */ 1025 num = INT_MAX; 1026 1027 r = BIO_nread(io1, &dataptr, (int)num); 1028 assert(r > 0); 1029 assert(r <= (int)num); 1030 /* possibly r < num (non-contiguous data) */ 1031 num = r; 1032 r = BIO_write(io2, dataptr, (int)num); 1033 if (r != (int)num) /* can't happen */ 1034 { 1035 fprintf(stderr, "ERROR: BIO_write could not write " 1036 "BIO_ctrl_get_write_guarantee() bytes"); 1037 goto err; 1038 } 1039 progress = 1; 1040 1041 if (debug) 1042 printf((io1 == client_io) ? 1043 "C->S relaying: %d bytes\n" : 1044 "S->C relaying: %d bytes\n", 1045 (int)num); 1046 } 1047 } while (r1 && r2); 1048 1049 /* io2 to io1 */ 1050 { 1051 size_t num; 1052 int r; 1053 1054 r1 = BIO_ctrl_pending(io2); 1055 r2 = BIO_ctrl_get_read_request(io1); 1056 /* here we could use ..._get_write_guarantee instead of 1057 * ..._get_read_request, but by using the latter 1058 * we test restartability of the SSL implementation 1059 * more thoroughly */ 1060 num = r1; 1061 if (r2 < num) 1062 num = r2; 1063 if (num) { 1064 char *dataptr; 1065 1066 if (INT_MAX < num) 1067 num = INT_MAX; 1068 1069 if (num > 1) 1070 --num; /* test restartability even more thoroughly */ 1071 1072 r = BIO_nwrite0(io1, &dataptr); 1073 assert(r > 0); 1074 if (r < (int)num) 1075 num = r; 1076 r = BIO_read(io2, dataptr, (int)num); 1077 if (r != (int)num) /* can't happen */ 1078 { 1079 fprintf(stderr, "ERROR: BIO_read could not read " 1080 "BIO_ctrl_pending() bytes"); 1081 goto err; 1082 } 1083 progress = 1; 1084 r = BIO_nwrite(io1, &dataptr, (int)num); 1085 if (r != (int)num) /* can't happen */ 1086 { 1087 fprintf(stderr, "ERROR: BIO_nwrite() did not accept " 1088 "BIO_nwrite0() bytes"); 1089 goto err; 1090 } 1091 1092 if (debug) 1093 printf((io2 == client_io) ? 1094 "C->S relaying: %d bytes\n" : 1095 "S->C relaying: %d bytes\n", 1096 (int)num); 1097 } 1098 } /* no loop, BIO_ctrl_get_read_request now returns 0 anyway */ 1099 1100 if (!progress && !prev_progress) { 1101 if (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0) { 1102 fprintf(stderr, "ERROR: got stuck\n"); 1103 goto err; 1104 } 1105 } 1106 prev_progress = progress; 1107 } 1108 } while (cw_num > 0 || cr_num > 0 || sw_num > 0 || sr_num > 0); 1109 1110 if (verbose) 1111 print_details(c_ssl, "DONE via BIO pair: "); 1112 1113 if (verify_alpn(c_ssl, s_ssl) < 0) { 1114 ret = 1; 1115 goto err; 1116 } 1117 1118 ret = 0; 1119 1120 err: 1121 ERR_print_errors(bio_err); 1122 1123 BIO_free(server); 1124 BIO_free(server_io); 1125 BIO_free(client); 1126 BIO_free(client_io); 1127 BIO_free(s_ssl_bio); 1128 BIO_free(c_ssl_bio); 1129 1130 return ret; 1131 } 1132 1133 1134 #define W_READ 1 1135 #define W_WRITE 2 1136 #define C_DONE 1 1137 #define S_DONE 2 1138 1139 int 1140 doit(SSL *s_ssl, SSL *c_ssl, long count) 1141 { 1142 char cbuf[1024*8], sbuf[1024*8]; 1143 long cw_num = count, cr_num = count; 1144 long sw_num = count, sr_num = count; 1145 int ret = 1; 1146 BIO *c_to_s = NULL; 1147 BIO *s_to_c = NULL; 1148 BIO *c_bio = NULL; 1149 BIO *s_bio = NULL; 1150 int c_r, c_w, s_r, s_w; 1151 int i, j; 1152 int done = 0; 1153 int c_write, s_write; 1154 int do_server = 0, do_client = 0; 1155 1156 memset(cbuf, 0, sizeof(cbuf)); 1157 memset(sbuf, 0, sizeof(sbuf)); 1158 1159 c_to_s = BIO_new(BIO_s_mem()); 1160 s_to_c = BIO_new(BIO_s_mem()); 1161 if ((s_to_c == NULL) || (c_to_s == NULL)) { 1162 ERR_print_errors(bio_err); 1163 goto err; 1164 } 1165 1166 c_bio = BIO_new(BIO_f_ssl()); 1167 s_bio = BIO_new(BIO_f_ssl()); 1168 if ((c_bio == NULL) || (s_bio == NULL)) { 1169 ERR_print_errors(bio_err); 1170 goto err; 1171 } 1172 1173 SSL_set_connect_state(c_ssl); 1174 SSL_set_bio(c_ssl, s_to_c, c_to_s); 1175 BIO_set_ssl(c_bio, c_ssl, BIO_NOCLOSE); 1176 1177 SSL_set_accept_state(s_ssl); 1178 SSL_set_bio(s_ssl, c_to_s, s_to_c); 1179 BIO_set_ssl(s_bio, s_ssl, BIO_NOCLOSE); 1180 1181 c_r = 0; 1182 s_r = 1; 1183 c_w = 1; 1184 s_w = 0; 1185 c_write = 1, s_write = 0; 1186 1187 /* We can always do writes */ 1188 for (;;) { 1189 do_server = 0; 1190 do_client = 0; 1191 1192 i = (int)BIO_pending(s_bio); 1193 if ((i && s_r) || s_w) 1194 do_server = 1; 1195 1196 i = (int)BIO_pending(c_bio); 1197 if ((i && c_r) || c_w) 1198 do_client = 1; 1199 1200 if (do_server && debug) { 1201 if (SSL_in_init(s_ssl)) 1202 printf("server waiting in SSL_accept - %s\n", 1203 SSL_state_string_long(s_ssl)); 1204 } 1205 1206 if (do_client && debug) { 1207 if (SSL_in_init(c_ssl)) 1208 printf("client waiting in SSL_connect - %s\n", 1209 SSL_state_string_long(c_ssl)); 1210 } 1211 1212 if (!do_client && !do_server) { 1213 fprintf(stdout, "ERROR in STARTUP\n"); 1214 ERR_print_errors(bio_err); 1215 goto err; 1216 } 1217 1218 if (do_client && !(done & C_DONE)) { 1219 if (c_write) { 1220 j = (cw_num > (long)sizeof(cbuf)) ? 1221 (int)sizeof(cbuf) : (int)cw_num; 1222 i = BIO_write(c_bio, cbuf, j); 1223 if (i < 0) { 1224 c_r = 0; 1225 c_w = 0; 1226 if (BIO_should_retry(c_bio)) { 1227 if (BIO_should_read(c_bio)) 1228 c_r = 1; 1229 if (BIO_should_write(c_bio)) 1230 c_w = 1; 1231 } else { 1232 fprintf(stderr, "ERROR in CLIENT\n"); 1233 ERR_print_errors(bio_err); 1234 goto err; 1235 } 1236 } else if (i == 0) { 1237 fprintf(stderr, "SSL CLIENT STARTUP FAILED\n"); 1238 goto err; 1239 } else { 1240 if (debug) 1241 printf("client wrote %d\n", i); 1242 /* ok */ 1243 s_r = 1; 1244 c_write = 0; 1245 cw_num -= i; 1246 } 1247 } else { 1248 i = BIO_read(c_bio, cbuf, sizeof(cbuf)); 1249 if (i < 0) { 1250 c_r = 0; 1251 c_w = 0; 1252 if (BIO_should_retry(c_bio)) { 1253 if (BIO_should_read(c_bio)) 1254 c_r = 1; 1255 if (BIO_should_write(c_bio)) 1256 c_w = 1; 1257 } else { 1258 fprintf(stderr, "ERROR in CLIENT\n"); 1259 ERR_print_errors(bio_err); 1260 goto err; 1261 } 1262 } else if (i == 0) { 1263 fprintf(stderr, "SSL CLIENT STARTUP FAILED\n"); 1264 goto err; 1265 } else { 1266 if (debug) 1267 printf("client read %d\n", i); 1268 cr_num -= i; 1269 if (sw_num > 0) { 1270 s_write = 1; 1271 s_w = 1; 1272 } 1273 if (cr_num <= 0) { 1274 s_write = 1; 1275 s_w = 1; 1276 done = S_DONE|C_DONE; 1277 } 1278 } 1279 } 1280 } 1281 1282 if (do_server && !(done & S_DONE)) { 1283 if (!s_write) { 1284 i = BIO_read(s_bio, sbuf, sizeof(cbuf)); 1285 if (i < 0) { 1286 s_r = 0; 1287 s_w = 0; 1288 if (BIO_should_retry(s_bio)) { 1289 if (BIO_should_read(s_bio)) 1290 s_r = 1; 1291 if (BIO_should_write(s_bio)) 1292 s_w = 1; 1293 } else { 1294 fprintf(stderr, "ERROR in SERVER\n"); 1295 ERR_print_errors(bio_err); 1296 goto err; 1297 } 1298 } else if (i == 0) { 1299 ERR_print_errors(bio_err); 1300 fprintf(stderr, "SSL SERVER STARTUP FAILED in SSL_read\n"); 1301 goto err; 1302 } else { 1303 if (debug) 1304 printf("server read %d\n", i); 1305 sr_num -= i; 1306 if (cw_num > 0) { 1307 c_write = 1; 1308 c_w = 1; 1309 } 1310 if (sr_num <= 0) { 1311 s_write = 1; 1312 s_w = 1; 1313 c_write = 0; 1314 } 1315 } 1316 } else { 1317 j = (sw_num > (long)sizeof(sbuf)) ? 1318 (int)sizeof(sbuf) : (int)sw_num; 1319 i = BIO_write(s_bio, sbuf, j); 1320 if (i < 0) { 1321 s_r = 0; 1322 s_w = 0; 1323 if (BIO_should_retry(s_bio)) { 1324 if (BIO_should_read(s_bio)) 1325 s_r = 1; 1326 if (BIO_should_write(s_bio)) 1327 s_w = 1; 1328 } else { 1329 fprintf(stderr, "ERROR in SERVER\n"); 1330 ERR_print_errors(bio_err); 1331 goto err; 1332 } 1333 } else if (i == 0) { 1334 ERR_print_errors(bio_err); 1335 fprintf(stderr, "SSL SERVER STARTUP FAILED in SSL_write\n"); 1336 goto err; 1337 } else { 1338 if (debug) 1339 printf("server wrote %d\n", i); 1340 sw_num -= i; 1341 s_write = 0; 1342 c_r = 1; 1343 if (sw_num <= 0) 1344 done |= S_DONE; 1345 } 1346 } 1347 } 1348 1349 if ((done & S_DONE) && (done & C_DONE)) 1350 break; 1351 } 1352 1353 if (verbose) 1354 print_details(c_ssl, "DONE: "); 1355 1356 if (verify_alpn(c_ssl, s_ssl) < 0) { 1357 ret = 1; 1358 goto err; 1359 } 1360 1361 ret = 0; 1362 err: 1363 /* We have to set the BIO's to NULL otherwise they will be 1364 * free()ed twice. Once when th s_ssl is SSL_free()ed and 1365 * again when c_ssl is SSL_free()ed. 1366 * This is a hack required because s_ssl and c_ssl are sharing the same 1367 * BIO structure and SSL_set_bio() and SSL_free() automatically 1368 * BIO_free non NULL entries. 1369 * You should not normally do this or be required to do this */ 1370 if (s_ssl != NULL) { 1371 s_ssl->rbio = NULL; 1372 s_ssl->wbio = NULL; 1373 } 1374 if (c_ssl != NULL) { 1375 c_ssl->rbio = NULL; 1376 c_ssl->wbio = NULL; 1377 } 1378 1379 BIO_free(c_to_s); 1380 BIO_free(s_to_c); 1381 BIO_free_all(c_bio); 1382 BIO_free_all(s_bio); 1383 1384 return (ret); 1385 } 1386 1387 static int 1388 get_proxy_auth_ex_data_idx(void) 1389 { 1390 static volatile int idx = -1; 1391 if (idx < 0) { 1392 CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX); 1393 if (idx < 0) { 1394 idx = X509_STORE_CTX_get_ex_new_index(0, 1395 "SSLtest for verify callback", NULL, NULL, NULL); 1396 } 1397 CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX); 1398 } 1399 return idx; 1400 } 1401 1402 static int 1403 verify_callback(int ok, X509_STORE_CTX *ctx) 1404 { 1405 char *s, buf[256]; 1406 1407 s = X509_NAME_oneline(X509_get_subject_name(ctx->current_cert), buf, 1408 sizeof buf); 1409 if (s != NULL) { 1410 if (ok) 1411 fprintf(stderr, "depth=%d %s\n", 1412 ctx->error_depth, buf); 1413 else { 1414 fprintf(stderr, "depth=%d error=%d %s\n", 1415 ctx->error_depth, ctx->error, buf); 1416 } 1417 } 1418 1419 if (ok == 0) { 1420 fprintf(stderr, "Error string: %s\n", 1421 X509_verify_cert_error_string(ctx->error)); 1422 switch (ctx->error) { 1423 case X509_V_ERR_CERT_NOT_YET_VALID: 1424 case X509_V_ERR_CERT_HAS_EXPIRED: 1425 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT: 1426 fprintf(stderr, " ... ignored.\n"); 1427 ok = 1; 1428 } 1429 } 1430 1431 if (ok == 1) { 1432 X509 *xs = ctx->current_cert; 1433 #if 0 1434 X509 *xi = ctx->current_issuer; 1435 #endif 1436 1437 if (xs->ex_flags & EXFLAG_PROXY) { 1438 unsigned int *letters = 1439 X509_STORE_CTX_get_ex_data(ctx, 1440 get_proxy_auth_ex_data_idx()); 1441 1442 if (letters) { 1443 int found_any = 0; 1444 int i; 1445 PROXY_CERT_INFO_EXTENSION *pci = 1446 X509_get_ext_d2i(xs, NID_proxyCertInfo, 1447 NULL, NULL); 1448 1449 switch (OBJ_obj2nid(pci->proxyPolicy->policyLanguage)) { 1450 case NID_Independent: 1451 /* Completely meaningless in this 1452 program, as there's no way to 1453 grant explicit rights to a 1454 specific PrC. Basically, using 1455 id-ppl-Independent is the perfect 1456 way to grant no rights at all. */ 1457 fprintf(stderr, " Independent proxy certificate"); 1458 for (i = 0; i < 26; i++) 1459 letters[i] = 0; 1460 break; 1461 case NID_id_ppl_inheritAll: 1462 /* This is basically a NOP, we 1463 simply let the current rights 1464 stand as they are. */ 1465 fprintf(stderr, " Proxy certificate inherits all"); 1466 break; 1467 default: 1468 s = (char *) 1469 pci->proxyPolicy->policy->data; 1470 i = pci->proxyPolicy->policy->length; 1471 1472 /* The algorithm works as follows: 1473 it is assumed that previous 1474 iterations or the initial granted 1475 rights has already set some elements 1476 of `letters'. What we need to do is 1477 to clear those that weren't granted 1478 by the current PrC as well. The 1479 easiest way to do this is to add 1 1480 to all the elements whose letters 1481 are given with the current policy. 1482 That way, all elements that are set 1483 by the current policy and were 1484 already set by earlier policies and 1485 through the original grant of rights 1486 will get the value 2 or higher. 1487 The last thing to do is to sweep 1488 through `letters' and keep the 1489 elements having the value 2 as set, 1490 and clear all the others. */ 1491 1492 fprintf(stderr, " Certificate proxy rights = %*.*s", i, i, s); 1493 while (i-- > 0) { 1494 int c = *s++; 1495 if (isascii(c) && isalpha(c)) { 1496 if (islower(c)) 1497 c = toupper(c); 1498 letters[c - 'A']++; 1499 } 1500 } 1501 for (i = 0; i < 26; i++) 1502 if (letters[i] < 2) 1503 letters[i] = 0; 1504 else 1505 letters[i] = 1; 1506 } 1507 1508 found_any = 0; 1509 fprintf(stderr, ", resulting proxy rights = "); 1510 for (i = 0; i < 26; i++) 1511 if (letters[i]) { 1512 fprintf(stderr, "%c", i + 'A'); 1513 found_any = 1; 1514 } 1515 if (!found_any) 1516 fprintf(stderr, "none"); 1517 fprintf(stderr, "\n"); 1518 1519 PROXY_CERT_INFO_EXTENSION_free(pci); 1520 } 1521 } 1522 } 1523 1524 return (ok); 1525 } 1526 1527 static void 1528 process_proxy_debug(int indent, const char *format, ...) 1529 { 1530 static const char indentation[] = 1531 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>" 1532 ">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"; /* That's 80 > */ 1533 char my_format[256]; 1534 va_list args; 1535 1536 (void) snprintf(my_format, sizeof(my_format), "%*.*s %s", 1537 indent, indent, indentation, format); 1538 1539 va_start(args, format); 1540 vfprintf(stderr, my_format, args); 1541 va_end(args); 1542 } 1543 /* Priority levels: 1544 0 [!]var, () 1545 1 & ^ 1546 2 | 1547 */ 1548 static int process_proxy_cond_adders(unsigned int letters[26], 1549 const char *cond, const char **cond_end, int *pos, int indent); 1550 1551 static int 1552 process_proxy_cond_val(unsigned int letters[26], const char *cond, 1553 const char **cond_end, int *pos, int indent) 1554 { 1555 int c; 1556 int ok = 1; 1557 int negate = 0; 1558 1559 while (isspace((int)*cond)) { 1560 cond++; 1561 (*pos)++; 1562 } 1563 c = *cond; 1564 1565 if (debug) 1566 process_proxy_debug(indent, 1567 "Start process_proxy_cond_val at position %d: %s\n", 1568 *pos, cond); 1569 1570 while (c == '!') { 1571 negate = !negate; 1572 cond++; 1573 (*pos)++; 1574 while (isspace((int)*cond)) { 1575 cond++; 1576 (*pos)++; 1577 } 1578 c = *cond; 1579 } 1580 1581 if (c == '(') { 1582 cond++; 1583 (*pos)++; 1584 ok = process_proxy_cond_adders(letters, cond, cond_end, pos, 1585 indent + 1); 1586 cond = *cond_end; 1587 if (ok < 0) 1588 goto end; 1589 while (isspace((int)*cond)) { 1590 cond++; 1591 (*pos)++; 1592 } 1593 c = *cond; 1594 if (c != ')') { 1595 fprintf(stderr, 1596 "Weird condition character in position %d: " 1597 "%c\n", *pos, c); 1598 ok = -1; 1599 goto end; 1600 } 1601 cond++; 1602 (*pos)++; 1603 } else if (isascii(c) && isalpha(c)) { 1604 if (islower(c)) 1605 c = toupper(c); 1606 ok = letters[c - 'A']; 1607 cond++; 1608 (*pos)++; 1609 } else { 1610 fprintf(stderr, 1611 "Weird condition character in position %d: " 1612 "%c\n", *pos, c); 1613 ok = -1; 1614 goto end; 1615 } 1616 end: 1617 *cond_end = cond; 1618 if (ok >= 0 && negate) 1619 ok = !ok; 1620 1621 if (debug) 1622 process_proxy_debug(indent, 1623 "End process_proxy_cond_val at position %d: %s, returning %d\n", 1624 *pos, cond, ok); 1625 1626 return ok; 1627 } 1628 1629 static int 1630 process_proxy_cond_multipliers(unsigned int letters[26], const char *cond, 1631 const char **cond_end, int *pos, int indent) 1632 { 1633 int ok; 1634 char c; 1635 1636 if (debug) 1637 process_proxy_debug(indent, 1638 "Start process_proxy_cond_multipliers at position %d: %s\n", 1639 *pos, cond); 1640 1641 ok = process_proxy_cond_val(letters, cond, cond_end, pos, indent + 1); 1642 cond = *cond_end; 1643 if (ok < 0) 1644 goto end; 1645 1646 while (ok >= 0) { 1647 while (isspace((int)*cond)) { 1648 cond++; 1649 (*pos)++; 1650 } 1651 c = *cond; 1652 1653 switch (c) { 1654 case '&': 1655 case '^': 1656 { 1657 int save_ok = ok; 1658 1659 cond++; 1660 (*pos)++; 1661 ok = process_proxy_cond_val(letters, 1662 cond, cond_end, pos, indent + 1); 1663 cond = *cond_end; 1664 if (ok < 0) 1665 break; 1666 1667 switch (c) { 1668 case '&': 1669 ok &= save_ok; 1670 break; 1671 case '^': 1672 ok ^= save_ok; 1673 break; 1674 default: 1675 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!" 1676 " STOPPING\n"); 1677 exit(1); 1678 } 1679 } 1680 break; 1681 default: 1682 goto end; 1683 } 1684 } 1685 end: 1686 if (debug) 1687 process_proxy_debug(indent, 1688 "End process_proxy_cond_multipliers at position %d: %s, " 1689 "returning %d\n", 1690 *pos, cond, ok); 1691 1692 *cond_end = cond; 1693 return ok; 1694 } 1695 1696 static int 1697 process_proxy_cond_adders(unsigned int letters[26], const char *cond, 1698 const char **cond_end, int *pos, int indent) 1699 { 1700 int ok; 1701 char c; 1702 1703 if (debug) 1704 process_proxy_debug(indent, 1705 "Start process_proxy_cond_adders at position %d: %s\n", 1706 *pos, cond); 1707 1708 ok = process_proxy_cond_multipliers(letters, cond, cond_end, pos, 1709 indent + 1); 1710 cond = *cond_end; 1711 if (ok < 0) 1712 goto end; 1713 1714 while (ok >= 0) { 1715 while (isspace((int)*cond)) { 1716 cond++; 1717 (*pos)++; 1718 } 1719 c = *cond; 1720 1721 switch (c) { 1722 case '|': 1723 { 1724 int save_ok = ok; 1725 1726 cond++; 1727 (*pos)++; 1728 ok = process_proxy_cond_multipliers(letters, 1729 cond, cond_end, pos, indent + 1); 1730 cond = *cond_end; 1731 if (ok < 0) 1732 break; 1733 1734 switch (c) { 1735 case '|': 1736 ok |= save_ok; 1737 break; 1738 default: 1739 fprintf(stderr, "SOMETHING IS SERIOUSLY WRONG!" 1740 " STOPPING\n"); 1741 exit(1); 1742 } 1743 } 1744 break; 1745 default: 1746 goto end; 1747 } 1748 } 1749 end: 1750 if (debug) 1751 process_proxy_debug(indent, 1752 "End process_proxy_cond_adders at position %d: %s, returning %d\n", 1753 *pos, cond, ok); 1754 1755 *cond_end = cond; 1756 return ok; 1757 } 1758 1759 static int 1760 process_proxy_cond(unsigned int letters[26], const char *cond, 1761 const char **cond_end) 1762 { 1763 int pos = 1; 1764 return process_proxy_cond_adders(letters, cond, cond_end, &pos, 1); 1765 } 1766 1767 static int 1768 app_verify_callback(X509_STORE_CTX *ctx, void *arg) 1769 { 1770 int ok = 1; 1771 struct app_verify_arg *cb_arg = arg; 1772 unsigned int letters[26]; /* only used with proxy_auth */ 1773 1774 if (cb_arg->app_verify) { 1775 char *s = NULL, buf[256]; 1776 1777 fprintf(stderr, "In app_verify_callback, allowing cert. "); 1778 fprintf(stderr, "Arg is: %s\n", cb_arg->string); 1779 fprintf(stderr, "Finished printing do we have a context? 0x%p a cert? 0x%p\n", 1780 (void *)ctx, (void *)ctx->cert); 1781 if (ctx->cert) 1782 s = X509_NAME_oneline(X509_get_subject_name(ctx->cert), buf, 256); 1783 if (s != NULL) { 1784 fprintf(stderr, "cert depth=%d %s\n", ctx->error_depth, buf); 1785 } 1786 return (1); 1787 } 1788 if (cb_arg->proxy_auth) { 1789 int found_any = 0, i; 1790 char *sp; 1791 1792 for (i = 0; i < 26; i++) 1793 letters[i] = 0; 1794 for (sp = cb_arg->proxy_auth; *sp; sp++) { 1795 int c = *sp; 1796 if (isascii(c) && isalpha(c)) { 1797 if (islower(c)) 1798 c = toupper(c); 1799 letters[c - 'A'] = 1; 1800 } 1801 } 1802 1803 fprintf(stderr, " Initial proxy rights = "); 1804 for (i = 0; i < 26; i++) 1805 if (letters[i]) { 1806 fprintf(stderr, "%c", i + 'A'); 1807 found_any = 1; 1808 } 1809 if (!found_any) 1810 fprintf(stderr, "none"); 1811 fprintf(stderr, "\n"); 1812 1813 X509_STORE_CTX_set_ex_data(ctx, 1814 get_proxy_auth_ex_data_idx(), letters); 1815 } 1816 if (cb_arg->allow_proxy_certs) { 1817 X509_STORE_CTX_set_flags(ctx, X509_V_FLAG_ALLOW_PROXY_CERTS); 1818 } 1819 1820 ok = X509_verify_cert(ctx); 1821 1822 if (cb_arg->proxy_auth) { 1823 if (ok > 0) { 1824 const char *cond_end = NULL; 1825 1826 ok = process_proxy_cond(letters, 1827 cb_arg->proxy_cond, &cond_end); 1828 1829 if (ok < 0) 1830 exit(3); 1831 if (*cond_end) { 1832 fprintf(stderr, "Stopped processing condition before it's end.\n"); 1833 ok = 0; 1834 } 1835 if (!ok) 1836 fprintf(stderr, "Proxy rights check with condition '%s' proved invalid\n", 1837 cb_arg->proxy_cond); 1838 else 1839 fprintf(stderr, "Proxy rights check with condition '%s' proved valid\n", 1840 cb_arg->proxy_cond); 1841 } 1842 } 1843 return (ok); 1844 } 1845 1846 /* These DH parameters have been generated as follows: 1847 * $ openssl dhparam -C -noout 1024 1848 * $ openssl dhparam -C -noout -dsaparam 1024 1849 * (The second function has been renamed to avoid name conflicts.) 1850 */ 1851 static DH * 1852 get_dh1024() 1853 { 1854 static unsigned char dh1024_p[] = { 1855 0xF8, 0x81, 0x89, 0x7D, 0x14, 0x24, 0xC5, 0xD1, 0xE6, 0xF7, 0xBF, 0x3A, 1856 0xE4, 0x90, 0xF4, 0xFC, 0x73, 0xFB, 0x34, 0xB5, 0xFA, 0x4C, 0x56, 0xA2, 1857 0xEA, 0xA7, 0xE9, 0xC0, 0xC0, 0xCE, 0x89, 0xE1, 0xFA, 0x63, 0x3F, 0xB0, 1858 0x6B, 0x32, 0x66, 0xF1, 0xD1, 0x7B, 0xB0, 0x00, 0x8F, 0xCA, 0x87, 0xC2, 1859 0xAE, 0x98, 0x89, 0x26, 0x17, 0xC2, 0x05, 0xD2, 0xEC, 0x08, 0xD0, 0x8C, 1860 0xFF, 0x17, 0x52, 0x8C, 0xC5, 0x07, 0x93, 0x03, 0xB1, 0xF6, 0x2F, 0xB8, 1861 0x1C, 0x52, 0x47, 0x27, 0x1B, 0xDB, 0xD1, 0x8D, 0x9D, 0x69, 0x1D, 0x52, 1862 0x4B, 0x32, 0x81, 0xAA, 0x7F, 0x00, 0xC8, 0xDC, 0xE6, 0xD9, 0xCC, 0xC1, 1863 0x11, 0x2D, 0x37, 0x34, 0x6C, 0xEA, 0x02, 0x97, 0x4B, 0x0E, 0xBB, 0xB1, 1864 0x71, 0x33, 0x09, 0x15, 0xFD, 0xDD, 0x23, 0x87, 0x07, 0x5E, 0x89, 0xAB, 1865 0x6B, 0x7C, 0x5F, 0xEC, 0xA6, 0x24, 0xDC, 0x53, 1866 }; 1867 static unsigned char dh1024_g[] = { 1868 0x02, 1869 }; 1870 DH *dh; 1871 1872 if ((dh = DH_new()) == NULL) 1873 return (NULL); 1874 dh->p = BN_bin2bn(dh1024_p, sizeof(dh1024_p), NULL); 1875 dh->g = BN_bin2bn(dh1024_g, sizeof(dh1024_g), NULL); 1876 if ((dh->p == NULL) || (dh->g == NULL)) { 1877 DH_free(dh); 1878 return (NULL); 1879 } 1880 return (dh); 1881 } 1882 1883 static DH * 1884 get_dh1024dsa() 1885 { 1886 static unsigned char dh1024_p[] = { 1887 0xC8, 0x00, 0xF7, 0x08, 0x07, 0x89, 0x4D, 0x90, 0x53, 0xF3, 0xD5, 0x00, 1888 0x21, 0x1B, 0xF7, 0x31, 0xA6, 0xA2, 0xDA, 0x23, 0x9A, 0xC7, 0x87, 0x19, 1889 0x3B, 0x47, 0xB6, 0x8C, 0x04, 0x6F, 0xFF, 0xC6, 0x9B, 0xB8, 0x65, 0xD2, 1890 0xC2, 0x5F, 0x31, 0x83, 0x4A, 0xA7, 0x5F, 0x2F, 0x88, 0x38, 0xB6, 0x55, 1891 0xCF, 0xD9, 0x87, 0x6D, 0x6F, 0x9F, 0xDA, 0xAC, 0xA6, 0x48, 0xAF, 0xFC, 1892 0x33, 0x84, 0x37, 0x5B, 0x82, 0x4A, 0x31, 0x5D, 0xE7, 0xBD, 0x52, 0x97, 1893 0xA1, 0x77, 0xBF, 0x10, 0x9E, 0x37, 0xEA, 0x64, 0xFA, 0xCA, 0x28, 0x8D, 1894 0x9D, 0x3B, 0xD2, 0x6E, 0x09, 0x5C, 0x68, 0xC7, 0x45, 0x90, 0xFD, 0xBB, 1895 0x70, 0xC9, 0x3A, 0xBB, 0xDF, 0xD4, 0x21, 0x0F, 0xC4, 0x6A, 0x3C, 0xF6, 1896 0x61, 0xCF, 0x3F, 0xD6, 0x13, 0xF1, 0x5F, 0xBC, 0xCF, 0xBC, 0x26, 0x9E, 1897 0xBC, 0x0B, 0xBD, 0xAB, 0x5D, 0xC9, 0x54, 0x39, 1898 }; 1899 static unsigned char dh1024_g[] = { 1900 0x3B, 0x40, 0x86, 0xE7, 0xF3, 0x6C, 0xDE, 0x67, 0x1C, 0xCC, 0x80, 0x05, 1901 0x5A, 0xDF, 0xFE, 0xBD, 0x20, 0x27, 0x74, 0x6C, 0x24, 0xC9, 0x03, 0xF3, 1902 0xE1, 0x8D, 0xC3, 0x7D, 0x98, 0x27, 0x40, 0x08, 0xB8, 0x8C, 0x6A, 0xE9, 1903 0xBB, 0x1A, 0x3A, 0xD6, 0x86, 0x83, 0x5E, 0x72, 0x41, 0xCE, 0x85, 0x3C, 1904 0xD2, 0xB3, 0xFC, 0x13, 0xCE, 0x37, 0x81, 0x9E, 0x4C, 0x1C, 0x7B, 0x65, 1905 0xD3, 0xE6, 0xA6, 0x00, 0xF5, 0x5A, 0x95, 0x43, 0x5E, 0x81, 0xCF, 0x60, 1906 0xA2, 0x23, 0xFC, 0x36, 0xA7, 0x5D, 0x7A, 0x4C, 0x06, 0x91, 0x6E, 0xF6, 1907 0x57, 0xEE, 0x36, 0xCB, 0x06, 0xEA, 0xF5, 0x3D, 0x95, 0x49, 0xCB, 0xA7, 1908 0xDD, 0x81, 0xDF, 0x80, 0x09, 0x4A, 0x97, 0x4D, 0xA8, 0x22, 0x72, 0xA1, 1909 0x7F, 0xC4, 0x70, 0x56, 0x70, 0xE8, 0x20, 0x10, 0x18, 0x8F, 0x2E, 0x60, 1910 0x07, 0xE7, 0x68, 0x1A, 0x82, 0x5D, 0x32, 0xA2, 1911 }; 1912 DH *dh; 1913 1914 if ((dh = DH_new()) == NULL) 1915 return (NULL); 1916 dh->p = BN_bin2bn(dh1024_p, sizeof(dh1024_p), NULL); 1917 dh->g = BN_bin2bn(dh1024_g, sizeof(dh1024_g), NULL); 1918 if ((dh->p == NULL) || (dh->g == NULL)) { 1919 DH_free(dh); 1920 return (NULL); 1921 } 1922 dh->length = 160; 1923 return (dh); 1924 } 1925 1926 static int 1927 do_test_cipherlist(void) 1928 { 1929 int i = 0; 1930 const SSL_METHOD *meth; 1931 const SSL_CIPHER *ci, *tci = NULL; 1932 1933 fprintf(stderr, "testing TLSv1 cipher list order: "); 1934 meth = TLSv1_method(); 1935 tci = NULL; 1936 while ((ci = meth->get_cipher(i++)) != NULL) { 1937 if (tci != NULL) { 1938 if (ci->id >= tci->id) { 1939 fprintf(stderr, 1940 "failed %lx vs. %lx\n", ci->id, tci->id); 1941 return 0; 1942 } 1943 } 1944 tci = ci; 1945 } 1946 fprintf(stderr, "ok\n"); 1947 1948 return 1; 1949 } 1950