xref: /openbsd-src/usr.bin/openssl/s_server.c (revision c020cf82e0cc147236f01a8dca7052034cf9d30d)
1 /* $OpenBSD: s_server.c,v 1.38 2020/05/23 13:00:30 tb Exp $ */
2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
3  * All rights reserved.
4  *
5  * This package is an SSL implementation written
6  * by Eric Young (eay@cryptsoft.com).
7  * The implementation was written so as to conform with Netscapes SSL.
8  *
9  * This library is free for commercial and non-commercial use as long as
10  * the following conditions are aheared to.  The following conditions
11  * apply to all code found in this distribution, be it the RC4, RSA,
12  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
13  * included with this distribution is covered by the same copyright terms
14  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15  *
16  * Copyright remains Eric Young's, and as such any Copyright notices in
17  * the code are not to be removed.
18  * If this package is used in a product, Eric Young should be given attribution
19  * as the author of the parts of the library used.
20  * This can be in the form of a textual message at program startup or
21  * in documentation (online or textual) provided with the package.
22  *
23  * Redistribution and use in source and binary forms, with or without
24  * modification, are permitted provided that the following conditions
25  * are met:
26  * 1. Redistributions of source code must retain the copyright
27  *    notice, this list of conditions and the following disclaimer.
28  * 2. Redistributions in binary form must reproduce the above copyright
29  *    notice, this list of conditions and the following disclaimer in the
30  *    documentation and/or other materials provided with the distribution.
31  * 3. All advertising materials mentioning features or use of this software
32  *    must display the following acknowledgement:
33  *    "This product includes cryptographic software written by
34  *     Eric Young (eay@cryptsoft.com)"
35  *    The word 'cryptographic' can be left out if the rouines from the library
36  *    being used are not cryptographic related :-).
37  * 4. If you include any Windows specific code (or a derivative thereof) from
38  *    the apps directory (application code) you must include an acknowledgement:
39  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40  *
41  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51  * SUCH DAMAGE.
52  *
53  * The licence and distribution terms for any publically available version or
54  * derivative of this code cannot be changed.  i.e. this code cannot simply be
55  * copied and put under another distribution licence
56  * [including the GNU Public Licence.]
57  */
58 /* ====================================================================
59  * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
60  *
61  * Redistribution and use in source and binary forms, with or without
62  * modification, are permitted provided that the following conditions
63  * are met:
64  *
65  * 1. Redistributions of source code must retain the above copyright
66  *    notice, this list of conditions and the following disclaimer.
67  *
68  * 2. Redistributions in binary form must reproduce the above copyright
69  *    notice, this list of conditions and the following disclaimer in
70  *    the documentation and/or other materials provided with the
71  *    distribution.
72  *
73  * 3. All advertising materials mentioning features or use of this
74  *    software must display the following acknowledgment:
75  *    "This product includes software developed by the OpenSSL Project
76  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
77  *
78  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
79  *    endorse or promote products derived from this software without
80  *    prior written permission. For written permission, please contact
81  *    openssl-core@openssl.org.
82  *
83  * 5. Products derived from this software may not be called "OpenSSL"
84  *    nor may "OpenSSL" appear in their names without prior written
85  *    permission of the OpenSSL Project.
86  *
87  * 6. Redistributions of any form whatsoever must retain the following
88  *    acknowledgment:
89  *    "This product includes software developed by the OpenSSL Project
90  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
91  *
92  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
93  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
94  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
95  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
96  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
97  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
98  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
99  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
100  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
101  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
103  * OF THE POSSIBILITY OF SUCH DAMAGE.
104  * ====================================================================
105  *
106  * This product includes cryptographic software written by Eric Young
107  * (eay@cryptsoft.com).  This product includes software written by Tim
108  * Hudson (tjh@cryptsoft.com).
109  *
110  */
111 /* ====================================================================
112  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
113  * ECC cipher suite support in OpenSSL originally developed by
114  * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
115  */
116 /* ====================================================================
117  * Copyright 2005 Nokia. All rights reserved.
118  *
119  * The portions of the attached software ("Contribution") is developed by
120  * Nokia Corporation and is licensed pursuant to the OpenSSL open source
121  * license.
122  *
123  * The Contribution, originally written by Mika Kousa and Pasi Eronen of
124  * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
125  * support (see RFC 4279) to OpenSSL.
126  *
127  * No patent licenses or other rights except those expressly stated in
128  * the OpenSSL open source license shall be deemed granted or received
129  * expressly, by implication, estoppel, or otherwise.
130  *
131  * No assurances are provided by Nokia that the Contribution does not
132  * infringe the patent or other intellectual property rights of any third
133  * party or that the license provides you with all the necessary rights
134  * to make use of the Contribution.
135  *
136  * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
137  * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
138  * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
139  * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
140  * OTHERWISE.
141  */
142 
143 /* Until the key-gen callbacks are modified to use newer prototypes, we allow
144  * deprecated functions for openssl-internal code */
145 #ifdef OPENSSL_NO_DEPRECATED
146 #undef OPENSSL_NO_DEPRECATED
147 #endif
148 
149 #include <sys/types.h>
150 #include <sys/socket.h>
151 
152 #include <assert.h>
153 #include <ctype.h>
154 #include <stdio.h>
155 #include <stdlib.h>
156 #include <limits.h>
157 #include <string.h>
158 #include <unistd.h>
159 #include <poll.h>
160 
161 #include "apps.h"
162 
163 #include <openssl/bn.h>
164 #include <openssl/err.h>
165 #include <openssl/lhash.h>
166 #include <openssl/ocsp.h>
167 #include <openssl/pem.h>
168 #include <openssl/ssl.h>
169 #include <openssl/x509.h>
170 
171 #ifndef OPENSSL_NO_DH
172 #include <openssl/dh.h>
173 #endif
174 
175 #include <openssl/rsa.h>
176 
177 #include "s_apps.h"
178 #include "timeouts.h"
179 
180 static int sv_body(char *hostname, int s, unsigned char *context);
181 static int www_body(char *hostname, int s, unsigned char *context);
182 static void close_accept_socket(void);
183 static void sv_usage(void);
184 static int init_ssl_connection(SSL * s);
185 static void print_stats(BIO * bp, SSL_CTX * ctx);
186 static int
187 generate_session_id(const SSL * ssl, unsigned char *id,
188     unsigned int *id_len);
189 #ifndef OPENSSL_NO_DH
190 static DH *load_dh_param(const char *dhfile);
191 #endif
192 
193 static void s_server_init(void);
194 
195 /* static int load_CA(SSL_CTX *ctx, char *file);*/
196 
197 #define BUFSIZZ	16*1024
198 static int bufsize = BUFSIZZ;
199 static int accept_socket = -1;
200 
201 #define TEST_CERT	"server.pem"
202 #define TEST_CERT2	"server2.pem"
203 
204 static char *cipher = NULL;
205 static int s_server_verify = SSL_VERIFY_NONE;
206 static int s_server_session_id_context = 1;	/* anything will do */
207 static const char *s_cert_file = TEST_CERT, *s_key_file = NULL;
208 static const char *s_cert_file2 = TEST_CERT2, *s_key_file2 = NULL;
209 static char *s_dcert_file = NULL, *s_dkey_file = NULL;
210 static int s_nbio = 0;
211 static int s_nbio_test = 0;
212 int s_crlf = 0;
213 static SSL_CTX *ctx = NULL;
214 static SSL_CTX *ctx2 = NULL;
215 static int www = 0;
216 
217 static BIO *bio_s_out = NULL;
218 static int s_debug = 0;
219 static int s_tlsextdebug = 0;
220 static int s_tlsextstatus = 0;
221 static int cert_status_cb(SSL * s, void *arg);
222 static int s_msg = 0;
223 static int s_quiet = 0;
224 
225 static char *keymatexportlabel = NULL;
226 static int keymatexportlen = 20;
227 
228 static const char *session_id_prefix = NULL;
229 
230 static int enable_timeouts = 0;
231 static long socket_mtu;
232 #ifndef OPENSSL_NO_DTLS1
233 static int cert_chain = 0;
234 #endif
235 
236 
237 
238 
239 static void
240 s_server_init(void)
241 {
242 	accept_socket = -1;
243 	cipher = NULL;
244 	s_server_verify = SSL_VERIFY_NONE;
245 	s_dcert_file = NULL;
246 	s_dkey_file = NULL;
247 	s_cert_file = TEST_CERT;
248 	s_key_file = NULL;
249 	s_cert_file2 = TEST_CERT2;
250 	s_key_file2 = NULL;
251 	ctx2 = NULL;
252 	s_nbio = 0;
253 	s_nbio_test = 0;
254 	ctx = NULL;
255 	www = 0;
256 
257 	bio_s_out = NULL;
258 	s_debug = 0;
259 	s_msg = 0;
260 	s_quiet = 0;
261 }
262 
263 static void
264 sv_usage(void)
265 {
266 	BIO_printf(bio_err, "usage: s_server [args ...]\n");
267 	BIO_printf(bio_err, "\n");
268 	BIO_printf(bio_err, " -accept arg   - port to accept on (default is %d)\n", PORT);
269 	BIO_printf(bio_err, " -context arg  - set session ID context\n");
270 	BIO_printf(bio_err, " -verify arg   - turn on peer certificate verification\n");
271 	BIO_printf(bio_err, " -Verify arg   - turn on peer certificate verification, must have a cert.\n");
272 	BIO_printf(bio_err, " -cert arg     - certificate file to use\n");
273 	BIO_printf(bio_err, "                 (default is %s)\n", TEST_CERT);
274 	BIO_printf(bio_err, " -crl_check    - check the peer certificate has not been revoked by its CA.\n" \
275 	    "                 The CRL(s) are appended to the certificate file\n");
276 	BIO_printf(bio_err, " -crl_check_all - check the peer certificate has not been revoked by its CA\n" \
277 	    "                 or any other CRL in the CA chain. CRL(s) are appended to the\n" \
278 	    "                 the certificate file.\n");
279 	BIO_printf(bio_err, " -certform arg - certificate format (PEM or DER) PEM default\n");
280 	BIO_printf(bio_err, " -key arg      - Private Key file to use, in cert file if\n");
281 	BIO_printf(bio_err, "                 not specified (default is %s)\n", TEST_CERT);
282 	BIO_printf(bio_err, " -keyform arg  - key format (PEM or DER) PEM default\n");
283 	BIO_printf(bio_err, " -pass arg     - private key file pass phrase source\n");
284 	BIO_printf(bio_err, " -dcert arg    - second certificate file to use (usually for DSA)\n");
285 	BIO_printf(bio_err, " -dcertform x  - second certificate format (PEM or DER) PEM default\n");
286 	BIO_printf(bio_err, " -dkey arg     - second private key file to use (usually for DSA)\n");
287 	BIO_printf(bio_err, " -dkeyform arg - second key format (PEM or DER) PEM default\n");
288 	BIO_printf(bio_err, " -dpass arg    - second private key file pass phrase source\n");
289 	BIO_printf(bio_err, " -dhparam arg  - DH parameter file to use, in cert file if not specified\n");
290 	BIO_printf(bio_err, "                 or a default set of parameters is used\n");
291 	BIO_printf(bio_err, " -nbio         - Run with non-blocking IO\n");
292 	BIO_printf(bio_err, " -nbio_test    - test with the non-blocking test bio\n");
293 	BIO_printf(bio_err, " -crlf         - convert LF from terminal into CRLF\n");
294 	BIO_printf(bio_err, " -debug        - Print more output\n");
295 	BIO_printf(bio_err, " -msg          - Show protocol messages\n");
296 	BIO_printf(bio_err, " -state        - Print the SSL states\n");
297 	BIO_printf(bio_err, " -CApath arg   - PEM format directory of CA's\n");
298 	BIO_printf(bio_err, " -CAfile arg   - PEM format file of CA's\n");
299 	BIO_printf(bio_err, " -nocert       - Don't use any certificates (Anon-DH)\n");
300 	BIO_printf(bio_err, " -cipher arg   - play with 'openssl ciphers' to see what goes here\n");
301 	BIO_printf(bio_err, " -serverpref   - Use server's cipher preferences\n");
302 	BIO_printf(bio_err, " -quiet        - Inhibit printing of session and certificate information\n");
303 	BIO_printf(bio_err, " -tls1_3       - Just talk TLSv1.3\n");
304 	BIO_printf(bio_err, " -tls1_2       - Just talk TLSv1.2\n");
305 	BIO_printf(bio_err, " -tls1_1       - Just talk TLSv1.1\n");
306 	BIO_printf(bio_err, " -tls1         - Just talk TLSv1\n");
307 	BIO_printf(bio_err, " -dtls1        - Just talk DTLSv1\n");
308 	BIO_printf(bio_err, " -timeout      - Enable timeouts\n");
309 	BIO_printf(bio_err, " -mtu          - Set link layer MTU\n");
310 	BIO_printf(bio_err, " -chain        - Read a certificate chain\n");
311 	BIO_printf(bio_err, " -no_ssl2      - Just disable SSLv2\n");
312 	BIO_printf(bio_err, " -no_ssl3      - Just disable SSLv3\n");
313 	BIO_printf(bio_err, " -no_tls1      - Just disable TLSv1\n");
314 	BIO_printf(bio_err, " -no_tls1_1    - Just disable TLSv1.1\n");
315 	BIO_printf(bio_err, " -no_tls1_2    - Just disable TLSv1.2\n");
316 	BIO_printf(bio_err, " -no_tls1_3    - Just disable TLSv1.3\n");
317 #ifndef OPENSSL_NO_DH
318 	BIO_printf(bio_err, " -no_dhe       - Disable ephemeral DH\n");
319 #endif
320 	BIO_printf(bio_err, " -no_ecdhe     - Disable ephemeral ECDH\n");
321 	BIO_printf(bio_err, " -bugs         - Turn on SSL bug compatibility\n");
322 	BIO_printf(bio_err, " -www          - Respond to a 'GET /' with a status page\n");
323 	BIO_printf(bio_err, " -WWW          - Respond to a 'GET /<path> HTTP/1.0' with file ./<path>\n");
324 	BIO_printf(bio_err, " -HTTP         - Respond to a 'GET /<path> HTTP/1.0' with file ./<path>\n");
325 	BIO_printf(bio_err, "                 with the assumption it contains a complete HTTP response.\n");
326 	BIO_printf(bio_err, " -id_prefix arg - Generate SSL/TLS session IDs prefixed by 'arg'\n");
327 	BIO_printf(bio_err, " -servername host - servername for HostName TLS extension\n");
328 	BIO_printf(bio_err, " -servername_fatal - on mismatch send fatal alert (default warning alert)\n");
329 	BIO_printf(bio_err, " -cert2 arg    - certificate file to use for servername\n");
330 	BIO_printf(bio_err, "                 (default is %s)\n", TEST_CERT2);
331 	BIO_printf(bio_err, " -key2 arg     - Private Key file to use for servername, in cert file if\n");
332 	BIO_printf(bio_err, "                 not specified (default is %s)\n", TEST_CERT2);
333 	BIO_printf(bio_err, " -tlsextdebug  - hex dump of all TLS extensions received\n");
334 	BIO_printf(bio_err, " -no_ticket    - disable use of RFC4507bis session tickets\n");
335 	BIO_printf(bio_err, " -alpn arg     - set the advertised protocols for the ALPN extension (comma-separated list)\n");
336 	BIO_printf(bio_err, " -groups arg   - specify EC groups (colon-separated list)\n");
337 #ifndef OPENSSL_NO_SRTP
338 	BIO_printf(bio_err, " -use_srtp profiles - Offer SRTP key management with a colon-separated profile list\n");
339 #endif
340 	BIO_printf(bio_err, " -keymatexport label   - Export keying material using label\n");
341 	BIO_printf(bio_err, " -keymatexportlen len  - Export len bytes of keying material (default 20)\n");
342 }
343 
344 static int local_argc = 0;
345 static char **local_argv;
346 
347 
348 /* This is a context that we pass to callbacks */
349 typedef struct tlsextctx_st {
350 	char *servername;
351 	BIO *biodebug;
352 	int extension_error;
353 } tlsextctx;
354 
355 
356 static int
357 ssl_servername_cb(SSL * s, int *ad, void *arg)
358 {
359 	tlsextctx *p = (tlsextctx *) arg;
360 	const char *servername = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
361 	if (servername && p->biodebug)
362 		BIO_printf(p->biodebug, "Hostname in TLS extension: \"%s\"\n", servername);
363 
364 	if (!p->servername)
365 		return SSL_TLSEXT_ERR_NOACK;
366 
367 	if (servername) {
368 		if (strcmp(servername, p->servername))
369 			return p->extension_error;
370 		if (ctx2) {
371 			BIO_printf(p->biodebug, "Switching server context.\n");
372 			SSL_set_SSL_CTX(s, ctx2);
373 		}
374 	}
375 	return SSL_TLSEXT_ERR_OK;
376 }
377 
378 /* Structure passed to cert status callback */
379 
380 typedef struct tlsextstatusctx_st {
381 	/* Default responder to use */
382 	char *host, *path, *port;
383 	int use_ssl;
384 	int timeout;
385 	BIO *err;
386 	int verbose;
387 } tlsextstatusctx;
388 
389 static tlsextstatusctx tlscstatp = {NULL, NULL, NULL, 0, -1, NULL, 0};
390 
391 /* Certificate Status callback. This is called when a client includes a
392  * certificate status request extension.
393  *
394  * This is a simplified version. It examines certificates each time and
395  * makes one OCSP responder query for each request.
396  *
397  * A full version would store details such as the OCSP certificate IDs and
398  * minimise the number of OCSP responses by caching them until they were
399  * considered "expired".
400  */
401 
402 static int
403 cert_status_cb(SSL * s, void *arg)
404 {
405 	tlsextstatusctx *srctx = arg;
406 	BIO *err = srctx->err;
407 	char *host = NULL, *port = NULL, *path = NULL;
408 	int use_ssl;
409 	unsigned char *rspder = NULL;
410 	int rspderlen;
411 	STACK_OF(OPENSSL_STRING) * aia = NULL;
412 	X509 *x = NULL;
413 	X509_STORE_CTX inctx;
414 	X509_OBJECT obj;
415 	OCSP_REQUEST *req = NULL;
416 	OCSP_RESPONSE *resp = NULL;
417 	OCSP_CERTID *id = NULL;
418 	STACK_OF(X509_EXTENSION) * exts;
419 	int ret = SSL_TLSEXT_ERR_NOACK;
420 	int i;
421 
422 	if (srctx->verbose)
423 		BIO_puts(err, "cert_status: callback called\n");
424 	/* Build up OCSP query from server certificate */
425 	x = SSL_get_certificate(s);
426 	aia = X509_get1_ocsp(x);
427 	if (aia) {
428 		if (!OCSP_parse_url(sk_OPENSSL_STRING_value(aia, 0),
429 			&host, &port, &path, &use_ssl)) {
430 			BIO_puts(err, "cert_status: can't parse AIA URL\n");
431 			goto err;
432 		}
433 		if (srctx->verbose)
434 			BIO_printf(err, "cert_status: AIA URL: %s\n",
435 			    sk_OPENSSL_STRING_value(aia, 0));
436 	} else {
437 		if (!srctx->host) {
438 			BIO_puts(srctx->err, "cert_status: no AIA and no default responder URL\n");
439 			goto done;
440 		}
441 		host = srctx->host;
442 		path = srctx->path;
443 		port = srctx->port;
444 		use_ssl = srctx->use_ssl;
445 	}
446 
447 	if (!X509_STORE_CTX_init(&inctx,
448 		SSL_CTX_get_cert_store(SSL_get_SSL_CTX(s)),
449 		NULL, NULL))
450 		goto err;
451 	if (X509_STORE_get_by_subject(&inctx, X509_LU_X509,
452 		X509_get_issuer_name(x), &obj) <= 0) {
453 		BIO_puts(err, "cert_status: Can't retrieve issuer certificate.\n");
454 		X509_STORE_CTX_cleanup(&inctx);
455 		goto done;
456 	}
457 	req = OCSP_REQUEST_new();
458 	if (!req)
459 		goto err;
460 	id = OCSP_cert_to_id(NULL, x, obj.data.x509);
461 	X509_free(obj.data.x509);
462 	X509_STORE_CTX_cleanup(&inctx);
463 	if (!id)
464 		goto err;
465 	if (!OCSP_request_add0_id(req, id))
466 		goto err;
467 	id = NULL;
468 	/* Add any extensions to the request */
469 	SSL_get_tlsext_status_exts(s, &exts);
470 	for (i = 0; i < sk_X509_EXTENSION_num(exts); i++) {
471 		X509_EXTENSION *ext = sk_X509_EXTENSION_value(exts, i);
472 		if (!OCSP_REQUEST_add_ext(req, ext, -1))
473 			goto err;
474 	}
475 	resp = process_responder(err, req, host, path, port, use_ssl, NULL,
476 	    srctx->timeout);
477 	if (!resp) {
478 		BIO_puts(err, "cert_status: error querying responder\n");
479 		goto done;
480 	}
481 	rspderlen = i2d_OCSP_RESPONSE(resp, &rspder);
482 	if (rspderlen <= 0)
483 		goto err;
484 	SSL_set_tlsext_status_ocsp_resp(s, rspder, rspderlen);
485 	if (srctx->verbose) {
486 		BIO_puts(err, "cert_status: ocsp response sent:\n");
487 		OCSP_RESPONSE_print(err, resp, 2);
488 	}
489 	ret = SSL_TLSEXT_ERR_OK;
490  done:
491 	if (ret != SSL_TLSEXT_ERR_OK)
492 		ERR_print_errors(err);
493 	if (aia) {
494 		free(host);
495 		free(path);
496 		free(port);
497 		X509_email_free(aia);
498 	}
499 	if (id)
500 		OCSP_CERTID_free(id);
501 	if (req)
502 		OCSP_REQUEST_free(req);
503 	if (resp)
504 		OCSP_RESPONSE_free(resp);
505 	return ret;
506  err:
507 	ret = SSL_TLSEXT_ERR_ALERT_FATAL;
508 	goto done;
509 }
510 
511 /* This the context that we pass to alpn_cb */
512 typedef struct tlsextalpnctx_st {
513 	unsigned char *data;
514 	unsigned short len;
515 } tlsextalpnctx;
516 
517 static int
518 alpn_cb(SSL *s, const unsigned char **out, unsigned char *outlen,
519     const unsigned char *in, unsigned int inlen, void *arg)
520 {
521 	tlsextalpnctx *alpn_ctx = arg;
522 
523 	if (!s_quiet) {
524 		/* We can assume that in is syntactically valid. */
525 		unsigned i;
526 
527 		BIO_printf(bio_s_out,
528 		    "ALPN protocols advertised by the client: ");
529 		for (i = 0; i < inlen; ) {
530 			if (i)
531 				BIO_write(bio_s_out, ", ", 2);
532 			BIO_write(bio_s_out, &in[i + 1], in[i]);
533 			i += in[i] + 1;
534 		}
535 		BIO_write(bio_s_out, "\n", 1);
536 	}
537 
538 	if (SSL_select_next_proto((unsigned char**)out, outlen, alpn_ctx->data,
539 	    alpn_ctx->len, in, inlen) != OPENSSL_NPN_NEGOTIATED)
540 		return (SSL_TLSEXT_ERR_NOACK);
541 
542 	if (!s_quiet) {
543 		BIO_printf(bio_s_out, "ALPN protocols selected: ");
544 		BIO_write(bio_s_out, *out, *outlen);
545 		BIO_write(bio_s_out, "\n", 1);
546 	}
547 
548 	return (SSL_TLSEXT_ERR_OK);
549 }
550 
551 #ifndef OPENSSL_NO_SRTP
552 static char *srtp_profiles = NULL;
553 #endif
554 
555 int
556 s_server_main(int argc, char *argv[])
557 {
558 	X509_VERIFY_PARAM *vpm = NULL;
559 	int badarg = 0;
560 	short port = PORT;
561 	char *CApath = NULL, *CAfile = NULL;
562 	unsigned char *context = NULL;
563 	char *dhfile = NULL;
564 	char *named_curve = NULL;
565 	int badop = 0, bugs = 0;
566 	int ret = 1;
567 	int off = 0;
568 	int no_dhe = 0, no_ecdhe = 0, nocert = 0;
569 	int state = 0;
570 	const SSL_METHOD *meth = NULL;
571 	int socket_type = SOCK_STREAM;
572 	int s_cert_format = FORMAT_PEM, s_key_format = FORMAT_PEM;
573 	char *passarg = NULL, *pass = NULL;
574 	char *dpassarg = NULL, *dpass = NULL;
575 	int s_dcert_format = FORMAT_PEM, s_dkey_format = FORMAT_PEM;
576 	X509 *s_cert = NULL, *s_dcert = NULL;
577 	EVP_PKEY *s_key = NULL, *s_dkey = NULL;
578 	int no_cache = 0;
579 	const char *errstr = NULL;
580 	EVP_PKEY *s_key2 = NULL;
581 	X509 *s_cert2 = NULL;
582 	tlsextctx tlsextcbp = {NULL, NULL, SSL_TLSEXT_ERR_ALERT_WARNING};
583 	const char *alpn_in = NULL;
584 	const char *groups_in = NULL;
585 	tlsextalpnctx alpn_ctx = { NULL, 0 };
586 	uint16_t min_version = 0, max_version = 0;
587 
588 	if (single_execution) {
589 		if (pledge("stdio rpath inet dns tty", NULL) == -1) {
590 			perror("pledge");
591 			exit(1);
592 		}
593 	}
594 
595 	meth = TLS_server_method();
596 
597 	local_argc = argc;
598 	local_argv = argv;
599 
600 	s_server_init();
601 
602 	verify_depth = 0;
603 	s_nbio = 0;
604 	s_nbio_test = 0;
605 
606 	argc--;
607 	argv++;
608 
609 	while (argc >= 1) {
610 		if ((strcmp(*argv, "-port") == 0) ||
611 		    (strcmp(*argv, "-accept") == 0)) {
612 			if (--argc < 1)
613 				goto bad;
614 			if (!extract_port(*(++argv), &port))
615 				goto bad;
616 		} else if (strcmp(*argv, "-verify") == 0) {
617 			s_server_verify = SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE;
618 			if (--argc < 1)
619 				goto bad;
620 			verify_depth = strtonum(*(++argv), 0, INT_MAX, &errstr);
621 			if (errstr)
622 				goto bad;
623 			BIO_printf(bio_err, "verify depth is %d\n", verify_depth);
624 		} else if (strcmp(*argv, "-Verify") == 0) {
625 			s_server_verify = SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT |
626 			    SSL_VERIFY_CLIENT_ONCE;
627 			if (--argc < 1)
628 				goto bad;
629 			verify_depth = strtonum(*(++argv), 0, INT_MAX, &errstr);
630 			if (errstr)
631 				goto bad;
632 			BIO_printf(bio_err, "verify depth is %d, must return a certificate\n", verify_depth);
633 		} else if (strcmp(*argv, "-context") == 0) {
634 			if (--argc < 1)
635 				goto bad;
636 			context = (unsigned char *) *(++argv);
637 		} else if (strcmp(*argv, "-cert") == 0) {
638 			if (--argc < 1)
639 				goto bad;
640 			s_cert_file = *(++argv);
641 		} else if (strcmp(*argv, "-certform") == 0) {
642 			if (--argc < 1)
643 				goto bad;
644 			s_cert_format = str2fmt(*(++argv));
645 		} else if (strcmp(*argv, "-key") == 0) {
646 			if (--argc < 1)
647 				goto bad;
648 			s_key_file = *(++argv);
649 		} else if (strcmp(*argv, "-keyform") == 0) {
650 			if (--argc < 1)
651 				goto bad;
652 			s_key_format = str2fmt(*(++argv));
653 		} else if (strcmp(*argv, "-pass") == 0) {
654 			if (--argc < 1)
655 				goto bad;
656 			passarg = *(++argv);
657 		} else if (strcmp(*argv, "-dhparam") == 0) {
658 			if (--argc < 1)
659 				goto bad;
660 			dhfile = *(++argv);
661 		} else if (strcmp(*argv, "-named_curve") == 0) {
662 			if (--argc < 1)
663 				goto bad;
664 			named_curve = *(++argv);
665 		} else if (strcmp(*argv, "-dcertform") == 0) {
666 			if (--argc < 1)
667 				goto bad;
668 			s_dcert_format = str2fmt(*(++argv));
669 		} else if (strcmp(*argv, "-dcert") == 0) {
670 			if (--argc < 1)
671 				goto bad;
672 			s_dcert_file = *(++argv);
673 		} else if (strcmp(*argv, "-dkeyform") == 0) {
674 			if (--argc < 1)
675 				goto bad;
676 			s_dkey_format = str2fmt(*(++argv));
677 		} else if (strcmp(*argv, "-dpass") == 0) {
678 			if (--argc < 1)
679 				goto bad;
680 			dpassarg = *(++argv);
681 		} else if (strcmp(*argv, "-dkey") == 0) {
682 			if (--argc < 1)
683 				goto bad;
684 			s_dkey_file = *(++argv);
685 		} else if (strcmp(*argv, "-nocert") == 0) {
686 			nocert = 1;
687 		} else if (strcmp(*argv, "-CApath") == 0) {
688 			if (--argc < 1)
689 				goto bad;
690 			CApath = *(++argv);
691 		} else if (strcmp(*argv, "-no_cache") == 0)
692 			no_cache = 1;
693 		else if (args_verify(&argv, &argc, &badarg, bio_err, &vpm)) {
694 			if (badarg)
695 				goto bad;
696 			continue;
697 		} else if (strcmp(*argv, "-verify_return_error") == 0)
698 			verify_return_error = 1;
699 		else if (strcmp(*argv, "-serverpref") == 0) {
700 			off |= SSL_OP_CIPHER_SERVER_PREFERENCE;
701 		} else if (strcmp(*argv, "-legacy_renegotiation") == 0)
702 			; /* no-op */
703 		else if (strcmp(*argv, "-cipher") == 0) {
704 			if (--argc < 1)
705 				goto bad;
706 			cipher = *(++argv);
707 		} else if (strcmp(*argv, "-CAfile") == 0) {
708 			if (--argc < 1)
709 				goto bad;
710 			CAfile = *(++argv);
711 		}
712 		else if (strcmp(*argv, "-nbio") == 0) {
713 			s_nbio = 1;
714 		}
715 		else if (strcmp(*argv, "-nbio_test") == 0) {
716 			s_nbio = 1;
717 			s_nbio_test = 1;
718 		} else if (strcmp(*argv, "-debug") == 0) {
719 			s_debug = 1;
720 		}
721 		else if (strcmp(*argv, "-tlsextdebug") == 0)
722 			s_tlsextdebug = 1;
723 		else if (strcmp(*argv, "-status") == 0)
724 			s_tlsextstatus = 1;
725 		else if (strcmp(*argv, "-status_verbose") == 0) {
726 			s_tlsextstatus = 1;
727 			tlscstatp.verbose = 1;
728 		} else if (!strcmp(*argv, "-status_timeout")) {
729 			s_tlsextstatus = 1;
730 			if (--argc < 1)
731 				goto bad;
732 			tlscstatp.timeout = strtonum(*(++argv), 0, INT_MAX, &errstr);
733 			if (errstr)
734 				goto bad;
735 		} else if (!strcmp(*argv, "-status_url")) {
736 			s_tlsextstatus = 1;
737 			if (--argc < 1)
738 				goto bad;
739 			if (!OCSP_parse_url(*(++argv),
740 				&tlscstatp.host,
741 				&tlscstatp.port,
742 				&tlscstatp.path,
743 				&tlscstatp.use_ssl)) {
744 				BIO_printf(bio_err, "Error parsing URL\n");
745 				goto bad;
746 			}
747 		}
748 		else if (strcmp(*argv, "-msg") == 0) {
749 			s_msg = 1;
750 		} else if (strcmp(*argv, "-state") == 0) {
751 			state = 1;
752 		} else if (strcmp(*argv, "-crlf") == 0) {
753 			s_crlf = 1;
754 		} else if (strcmp(*argv, "-quiet") == 0) {
755 			s_quiet = 1;
756 		} else if (strcmp(*argv, "-bugs") == 0) {
757 			bugs = 1;
758 		} else if (strcmp(*argv, "-no_tmp_rsa") == 0) {
759 			/* No-op. */
760 		} else if (strcmp(*argv, "-no_dhe") == 0) {
761 			no_dhe = 1;
762 		} else if (strcmp(*argv, "-no_ecdhe") == 0) {
763 			no_ecdhe = 1;
764 		} else if (strcmp(*argv, "-www") == 0) {
765 			www = 1;
766 		} else if (strcmp(*argv, "-WWW") == 0) {
767 			www = 2;
768 		} else if (strcmp(*argv, "-HTTP") == 0) {
769 			www = 3;
770 		} else if (strcmp(*argv, "-no_ssl2") == 0) {
771 			off |= SSL_OP_NO_SSLv2;
772 		} else if (strcmp(*argv, "-no_ssl3") == 0) {
773 			off |= SSL_OP_NO_SSLv3;
774 		} else if (strcmp(*argv, "-no_tls1") == 0) {
775 			off |= SSL_OP_NO_TLSv1;
776 		} else if (strcmp(*argv, "-no_tls1_1") == 0) {
777 			off |= SSL_OP_NO_TLSv1_1;
778 		} else if (strcmp(*argv, "-no_tls1_2") == 0) {
779 			off |= SSL_OP_NO_TLSv1_2;
780 		} else if (strcmp(*argv, "-no_tls1_3") == 0) {
781 			off |= SSL_OP_NO_TLSv1_3;
782 		} else if (strcmp(*argv, "-no_comp") == 0) {
783 			off |= SSL_OP_NO_COMPRESSION;
784 		} else if (strcmp(*argv, "-no_ticket") == 0) {
785 			off |= SSL_OP_NO_TICKET;
786 		} else if (strcmp(*argv, "-tls1") == 0) {
787 			min_version = TLS1_VERSION;
788 			max_version = TLS1_VERSION;
789 		} else if (strcmp(*argv, "-tls1_1") == 0) {
790 			min_version = TLS1_1_VERSION;
791 			max_version = TLS1_1_VERSION;
792 		} else if (strcmp(*argv, "-tls1_2") == 0) {
793 			min_version = TLS1_2_VERSION;
794 			max_version = TLS1_2_VERSION;
795 		} else if (strcmp(*argv, "-tls1_3") == 0) {
796 			min_version = TLS1_3_VERSION;
797 			max_version = TLS1_3_VERSION;
798 		}
799 #ifndef OPENSSL_NO_DTLS1
800 		else if (strcmp(*argv, "-dtls1") == 0) {
801 			meth = DTLS_server_method();
802 			socket_type = SOCK_DGRAM;
803 		} else if (strcmp(*argv, "-timeout") == 0)
804 			enable_timeouts = 1;
805 		else if (strcmp(*argv, "-mtu") == 0) {
806 			if (--argc < 1)
807 				goto bad;
808 			socket_mtu = strtonum(*(++argv), 0, LONG_MAX, &errstr);
809 			if (errstr)
810 				goto bad;
811 		} else if (strcmp(*argv, "-chain") == 0)
812 			cert_chain = 1;
813 #endif
814 		else if (strcmp(*argv, "-id_prefix") == 0) {
815 			if (--argc < 1)
816 				goto bad;
817 			session_id_prefix = *(++argv);
818 		}
819 		else if (strcmp(*argv, "-servername") == 0) {
820 			if (--argc < 1)
821 				goto bad;
822 			tlsextcbp.servername = *(++argv);
823 		} else if (strcmp(*argv, "-servername_fatal") == 0) {
824 			tlsextcbp.extension_error = SSL_TLSEXT_ERR_ALERT_FATAL;
825 		} else if (strcmp(*argv, "-cert2") == 0) {
826 			if (--argc < 1)
827 				goto bad;
828 			s_cert_file2 = *(++argv);
829 		} else if (strcmp(*argv, "-key2") == 0) {
830 			if (--argc < 1)
831 				goto bad;
832 			s_key_file2 = *(++argv);
833 		} else if (strcmp(*argv, "-nextprotoneg") == 0) {
834 			/* Ignored. */
835 			if (--argc < 1)
836 				goto bad;
837 			++argv;
838 		} else if (strcmp(*argv,"-alpn") == 0) {
839 			if (--argc < 1)
840 				goto bad;
841 			alpn_in = *(++argv);
842 		} else if (strcmp(*argv, "-groups") == 0) {
843 			if (--argc < 1)
844 				goto bad;
845 			groups_in = *(++argv);
846 		}
847 #ifndef OPENSSL_NO_SRTP
848 		else if (strcmp(*argv, "-use_srtp") == 0) {
849 			if (--argc < 1)
850 				goto bad;
851 			srtp_profiles = *(++argv);
852 		}
853 #endif
854 		else if (strcmp(*argv, "-keymatexport") == 0) {
855 			if (--argc < 1)
856 				goto bad;
857 			keymatexportlabel = *(++argv);
858 		} else if (strcmp(*argv, "-keymatexportlen") == 0) {
859 			if (--argc < 1)
860 				goto bad;
861 			keymatexportlen = strtonum(*(++argv), 1, INT_MAX, &errstr);
862 			if (errstr)
863 				goto bad;
864 		} else {
865 			BIO_printf(bio_err, "unknown option %s\n", *argv);
866 			badop = 1;
867 			break;
868 		}
869 		argc--;
870 		argv++;
871 	}
872 	if (badop) {
873  bad:
874 		if (errstr)
875 			BIO_printf(bio_err, "invalid argument %s: %s\n",
876 			    *argv, errstr);
877 		else
878 			sv_usage();
879 		goto end;
880 	}
881 
882 	if (!app_passwd(bio_err, passarg, dpassarg, &pass, &dpass)) {
883 		BIO_printf(bio_err, "Error getting password\n");
884 		goto end;
885 	}
886 	if (s_key_file == NULL)
887 		s_key_file = s_cert_file;
888 	if (s_key_file2 == NULL)
889 		s_key_file2 = s_cert_file2;
890 
891 	if (nocert == 0) {
892 		s_key = load_key(bio_err, s_key_file, s_key_format, 0, pass,
893 		    "server certificate private key file");
894 		if (!s_key) {
895 			ERR_print_errors(bio_err);
896 			goto end;
897 		}
898 		s_cert = load_cert(bio_err, s_cert_file, s_cert_format,
899 		    NULL, "server certificate file");
900 
901 		if (!s_cert) {
902 			ERR_print_errors(bio_err);
903 			goto end;
904 		}
905 		if (tlsextcbp.servername) {
906 			s_key2 = load_key(bio_err, s_key_file2, s_key_format, 0, pass,
907 			    "second server certificate private key file");
908 			if (!s_key2) {
909 				ERR_print_errors(bio_err);
910 				goto end;
911 			}
912 			s_cert2 = load_cert(bio_err, s_cert_file2, s_cert_format,
913 			    NULL, "second server certificate file");
914 
915 			if (!s_cert2) {
916 				ERR_print_errors(bio_err);
917 				goto end;
918 			}
919 		}
920 	}
921 	alpn_ctx.data = NULL;
922 	if (alpn_in) {
923 		unsigned short len;
924 		alpn_ctx.data = next_protos_parse(&len, alpn_in);
925 		if (alpn_ctx.data == NULL)
926 			goto end;
927 		alpn_ctx.len = len;
928 	}
929 
930 	if (s_dcert_file) {
931 
932 		if (s_dkey_file == NULL)
933 			s_dkey_file = s_dcert_file;
934 
935 		s_dkey = load_key(bio_err, s_dkey_file, s_dkey_format,
936 		    0, dpass, "second certificate private key file");
937 		if (!s_dkey) {
938 			ERR_print_errors(bio_err);
939 			goto end;
940 		}
941 		s_dcert = load_cert(bio_err, s_dcert_file, s_dcert_format,
942 		    NULL, "second server certificate file");
943 
944 		if (!s_dcert) {
945 			ERR_print_errors(bio_err);
946 			goto end;
947 		}
948 	}
949 	if (bio_s_out == NULL) {
950 		if (s_quiet && !s_debug && !s_msg) {
951 			bio_s_out = BIO_new(BIO_s_null());
952 		} else {
953 			if (bio_s_out == NULL)
954 				bio_s_out = BIO_new_fp(stdout, BIO_NOCLOSE);
955 		}
956 	}
957 	if (nocert) {
958 		s_cert_file = NULL;
959 		s_key_file = NULL;
960 		s_dcert_file = NULL;
961 		s_dkey_file = NULL;
962 		s_cert_file2 = NULL;
963 		s_key_file2 = NULL;
964 	}
965 	ctx = SSL_CTX_new(meth);
966 	if (ctx == NULL) {
967 		ERR_print_errors(bio_err);
968 		goto end;
969 	}
970 
971 	SSL_CTX_clear_mode(ctx, SSL_MODE_AUTO_RETRY);
972 
973 	if (!SSL_CTX_set_min_proto_version(ctx, min_version))
974 		goto end;
975 	if (!SSL_CTX_set_max_proto_version(ctx, max_version))
976 		goto end;
977 
978 	if (session_id_prefix) {
979 		if (strlen(session_id_prefix) >= 32)
980 			BIO_printf(bio_err,
981 			    "warning: id_prefix is too long, only one new session will be possible\n");
982 		else if (strlen(session_id_prefix) >= 16)
983 			BIO_printf(bio_err,
984 			    "warning: id_prefix is too long if you use SSLv2\n");
985 		if (!SSL_CTX_set_generate_session_id(ctx, generate_session_id)) {
986 			BIO_printf(bio_err, "error setting 'id_prefix'\n");
987 			ERR_print_errors(bio_err);
988 			goto end;
989 		}
990 		BIO_printf(bio_err, "id_prefix '%s' set.\n", session_id_prefix);
991 	}
992 	SSL_CTX_set_quiet_shutdown(ctx, 1);
993 	if (bugs)
994 		SSL_CTX_set_options(ctx, SSL_OP_ALL);
995 	SSL_CTX_set_options(ctx, off);
996 	/*
997 	 * DTLS: partial reads end up discarding unread UDP bytes :-( Setting
998 	 * read ahead solves this problem.
999 	 */
1000 	if (socket_type == SOCK_DGRAM)
1001 		SSL_CTX_set_read_ahead(ctx, 1);
1002 
1003 	if (state)
1004 		SSL_CTX_set_info_callback(ctx, apps_ssl_info_callback);
1005 	if (no_cache)
1006 		SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
1007 	else
1008 		SSL_CTX_sess_set_cache_size(ctx, 128);
1009 
1010 #ifndef OPENSSL_NO_SRTP
1011 	if (srtp_profiles != NULL)
1012 		SSL_CTX_set_tlsext_use_srtp(ctx, srtp_profiles);
1013 #endif
1014 
1015 
1016 	if ((!SSL_CTX_load_verify_locations(ctx, CAfile, CApath)) ||
1017 	    (!SSL_CTX_set_default_verify_paths(ctx))) {
1018 		/* BIO_printf(bio_err,"X509_load_verify_locations\n"); */
1019 		ERR_print_errors(bio_err);
1020 		/* goto end; */
1021 	}
1022 	if (vpm)
1023 		SSL_CTX_set1_param(ctx, vpm);
1024 
1025 	if (s_cert2) {
1026 		ctx2 = SSL_CTX_new(meth);
1027 		if (ctx2 == NULL) {
1028 			ERR_print_errors(bio_err);
1029 			goto end;
1030 		}
1031 
1032 		if (!SSL_CTX_set_min_proto_version(ctx2, min_version))
1033 			goto end;
1034 		if (!SSL_CTX_set_max_proto_version(ctx2, max_version))
1035 			goto end;
1036 		SSL_CTX_clear_mode(ctx2, SSL_MODE_AUTO_RETRY);
1037 	}
1038 	if (ctx2) {
1039 		BIO_printf(bio_s_out, "Setting secondary ctx parameters\n");
1040 
1041 		if (session_id_prefix) {
1042 			if (strlen(session_id_prefix) >= 32)
1043 				BIO_printf(bio_err,
1044 				    "warning: id_prefix is too long, only one new session will be possible\n");
1045 			else if (strlen(session_id_prefix) >= 16)
1046 				BIO_printf(bio_err,
1047 				    "warning: id_prefix is too long if you use SSLv2\n");
1048 			if (!SSL_CTX_set_generate_session_id(ctx2, generate_session_id)) {
1049 				BIO_printf(bio_err, "error setting 'id_prefix'\n");
1050 				ERR_print_errors(bio_err);
1051 				goto end;
1052 			}
1053 			BIO_printf(bio_err, "id_prefix '%s' set.\n", session_id_prefix);
1054 		}
1055 		SSL_CTX_set_quiet_shutdown(ctx2, 1);
1056 		if (bugs)
1057 			SSL_CTX_set_options(ctx2, SSL_OP_ALL);
1058 		SSL_CTX_set_options(ctx2, off);
1059 		/*
1060 		 * DTLS: partial reads end up discarding unread UDP bytes :-(
1061 		 * Setting read ahead solves this problem.
1062 		 */
1063 		if (socket_type == SOCK_DGRAM)
1064 			SSL_CTX_set_read_ahead(ctx2, 1);
1065 
1066 		if (state)
1067 			SSL_CTX_set_info_callback(ctx2, apps_ssl_info_callback);
1068 
1069 		if (no_cache)
1070 			SSL_CTX_set_session_cache_mode(ctx2, SSL_SESS_CACHE_OFF);
1071 		else
1072 			SSL_CTX_sess_set_cache_size(ctx2, 128);
1073 
1074 		if ((!SSL_CTX_load_verify_locations(ctx2, CAfile, CApath)) ||
1075 		    (!SSL_CTX_set_default_verify_paths(ctx2))) {
1076 			ERR_print_errors(bio_err);
1077 		}
1078 		if (vpm)
1079 			SSL_CTX_set1_param(ctx2, vpm);
1080 	}
1081 	if (alpn_ctx.data)
1082 		SSL_CTX_set_alpn_select_cb(ctx, alpn_cb, &alpn_ctx);
1083 
1084 	if (groups_in != NULL) {
1085 		if (SSL_CTX_set1_groups_list(ctx, groups_in) != 1) {
1086 			BIO_printf(bio_err, "Failed to set groups '%s'\n",
1087 			    groups_in);
1088 			goto end;
1089 		}
1090 	}
1091 
1092 #ifndef OPENSSL_NO_DH
1093 	if (!no_dhe) {
1094 		DH *dh = NULL;
1095 
1096 		if (dhfile)
1097 			dh = load_dh_param(dhfile);
1098 		else if (s_cert_file)
1099 			dh = load_dh_param(s_cert_file);
1100 
1101 		if (dh != NULL)
1102 			BIO_printf(bio_s_out, "Setting temp DH parameters\n");
1103 		else
1104 			BIO_printf(bio_s_out, "Using auto DH parameters\n");
1105 		(void) BIO_flush(bio_s_out);
1106 
1107 		if (dh == NULL)
1108 			SSL_CTX_set_dh_auto(ctx, 1);
1109 		else if (!SSL_CTX_set_tmp_dh(ctx, dh)) {
1110 			BIO_printf(bio_err,
1111 			    "Error setting temp DH parameters\n");
1112 			ERR_print_errors(bio_err);
1113 			DH_free(dh);
1114 			goto end;
1115 		}
1116 
1117 		if (ctx2) {
1118 			if (!dhfile) {
1119 				DH *dh2 = NULL;
1120 
1121 				if (s_cert_file2 != NULL)
1122 					dh2 = load_dh_param(s_cert_file2);
1123 				if (dh2 != NULL) {
1124 					BIO_printf(bio_s_out, "Setting temp DH parameters\n");
1125 					(void) BIO_flush(bio_s_out);
1126 
1127 					DH_free(dh);
1128 					dh = dh2;
1129 				}
1130 			}
1131 			if (dh == NULL)
1132 				SSL_CTX_set_dh_auto(ctx2, 1);
1133 			else if (!SSL_CTX_set_tmp_dh(ctx2, dh)) {
1134 				BIO_printf(bio_err,
1135 				    "Error setting temp DH parameters\n");
1136 				ERR_print_errors(bio_err);
1137 				DH_free(dh);
1138 				goto end;
1139 			}
1140 		}
1141 		DH_free(dh);
1142 	}
1143 #endif
1144 
1145 	if (!no_ecdhe && named_curve != NULL) {
1146 		EC_KEY *ecdh = NULL;
1147 		int nid;
1148 
1149 		if ((nid = OBJ_sn2nid(named_curve)) == 0) {
1150 			BIO_printf(bio_err, "unknown curve name (%s)\n",
1151 			    named_curve);
1152 			goto end;
1153 		}
1154 		if ((ecdh = EC_KEY_new_by_curve_name(nid)) == NULL) {
1155 			BIO_printf(bio_err, "unable to create curve (%s)\n",
1156 			    named_curve);
1157 			goto end;
1158 		}
1159 		BIO_printf(bio_s_out, "Setting temp ECDH parameters\n");
1160 		(void) BIO_flush(bio_s_out);
1161 
1162 		SSL_CTX_set_tmp_ecdh(ctx, ecdh);
1163 		if (ctx2)
1164 			SSL_CTX_set_tmp_ecdh(ctx2, ecdh);
1165 		EC_KEY_free(ecdh);
1166 	}
1167 
1168 	if (!set_cert_key_stuff(ctx, s_cert, s_key))
1169 		goto end;
1170 	if (ctx2 && !set_cert_key_stuff(ctx2, s_cert2, s_key2))
1171 		goto end;
1172 	if (s_dcert != NULL) {
1173 		if (!set_cert_key_stuff(ctx, s_dcert, s_dkey))
1174 			goto end;
1175 	}
1176 
1177 	if (cipher != NULL) {
1178 		if (!SSL_CTX_set_cipher_list(ctx, cipher)) {
1179 			BIO_printf(bio_err, "error setting cipher list\n");
1180 			ERR_print_errors(bio_err);
1181 			goto end;
1182 		}
1183 		if (ctx2 && !SSL_CTX_set_cipher_list(ctx2, cipher)) {
1184 			BIO_printf(bio_err, "error setting cipher list\n");
1185 			ERR_print_errors(bio_err);
1186 			goto end;
1187 		}
1188 	}
1189 	SSL_CTX_set_verify(ctx, s_server_verify, verify_callback);
1190 	SSL_CTX_set_session_id_context(ctx, (void *) &s_server_session_id_context,
1191 	    sizeof s_server_session_id_context);
1192 
1193 	/* Set DTLS cookie generation and verification callbacks */
1194 	SSL_CTX_set_cookie_generate_cb(ctx, generate_cookie_callback);
1195 	SSL_CTX_set_cookie_verify_cb(ctx, verify_cookie_callback);
1196 
1197 	if (ctx2) {
1198 		SSL_CTX_set_verify(ctx2, s_server_verify, verify_callback);
1199 		SSL_CTX_set_session_id_context(ctx2, (void *) &s_server_session_id_context,
1200 		    sizeof s_server_session_id_context);
1201 
1202 		tlsextcbp.biodebug = bio_s_out;
1203 		SSL_CTX_set_tlsext_servername_callback(ctx2, ssl_servername_cb);
1204 		SSL_CTX_set_tlsext_servername_arg(ctx2, &tlsextcbp);
1205 		SSL_CTX_set_tlsext_servername_callback(ctx, ssl_servername_cb);
1206 		SSL_CTX_set_tlsext_servername_arg(ctx, &tlsextcbp);
1207 	}
1208 
1209 	if (CAfile != NULL) {
1210 		SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(CAfile));
1211 		if (ctx2)
1212 			SSL_CTX_set_client_CA_list(ctx2, SSL_load_client_CA_file(CAfile));
1213 	}
1214 	BIO_printf(bio_s_out, "ACCEPT\n");
1215 	(void) BIO_flush(bio_s_out);
1216 	if (www)
1217 		do_server(port, socket_type, &accept_socket, www_body, context);
1218 	else
1219 		do_server(port, socket_type, &accept_socket, sv_body, context);
1220 	print_stats(bio_s_out, ctx);
1221 	ret = 0;
1222  end:
1223 	SSL_CTX_free(ctx);
1224 	X509_free(s_cert);
1225 	X509_free(s_dcert);
1226 	EVP_PKEY_free(s_key);
1227 	EVP_PKEY_free(s_dkey);
1228 	free(pass);
1229 	free(dpass);
1230 	X509_VERIFY_PARAM_free(vpm);
1231 	free(tlscstatp.host);
1232 	free(tlscstatp.port);
1233 	free(tlscstatp.path);
1234 	SSL_CTX_free(ctx2);
1235 	X509_free(s_cert2);
1236 	EVP_PKEY_free(s_key2);
1237 	free(alpn_ctx.data);
1238 	if (bio_s_out != NULL) {
1239 		BIO_free(bio_s_out);
1240 		bio_s_out = NULL;
1241 	}
1242 
1243 	return (ret);
1244 }
1245 
1246 static void
1247 print_stats(BIO * bio, SSL_CTX * ssl_ctx)
1248 {
1249 	BIO_printf(bio, "%4ld items in the session cache\n",
1250 	    SSL_CTX_sess_number(ssl_ctx));
1251 	BIO_printf(bio, "%4ld client connects (SSL_connect())\n",
1252 	    SSL_CTX_sess_connect(ssl_ctx));
1253 	BIO_printf(bio, "%4ld client renegotiates (SSL_connect())\n",
1254 	    SSL_CTX_sess_connect_renegotiate(ssl_ctx));
1255 	BIO_printf(bio, "%4ld client connects that finished\n",
1256 	    SSL_CTX_sess_connect_good(ssl_ctx));
1257 	BIO_printf(bio, "%4ld server accepts (SSL_accept())\n",
1258 	    SSL_CTX_sess_accept(ssl_ctx));
1259 	BIO_printf(bio, "%4ld server renegotiates (SSL_accept())\n",
1260 	    SSL_CTX_sess_accept_renegotiate(ssl_ctx));
1261 	BIO_printf(bio, "%4ld server accepts that finished\n",
1262 	    SSL_CTX_sess_accept_good(ssl_ctx));
1263 	BIO_printf(bio, "%4ld session cache hits\n", SSL_CTX_sess_hits(ssl_ctx));
1264 	BIO_printf(bio, "%4ld session cache misses\n", SSL_CTX_sess_misses(ssl_ctx));
1265 	BIO_printf(bio, "%4ld session cache timeouts\n", SSL_CTX_sess_timeouts(ssl_ctx));
1266 	BIO_printf(bio, "%4ld callback cache hits\n", SSL_CTX_sess_cb_hits(ssl_ctx));
1267 	BIO_printf(bio, "%4ld cache full overflows (%ld allowed)\n",
1268 	    SSL_CTX_sess_cache_full(ssl_ctx),
1269 	    SSL_CTX_sess_get_cache_size(ssl_ctx));
1270 }
1271 
1272 static int
1273 sv_body(char *hostname, int s, unsigned char *context)
1274 {
1275 	char *buf = NULL;
1276 	int ret = 1;
1277 	int k, i;
1278 	unsigned long l;
1279 	SSL *con = NULL;
1280 	BIO *sbio;
1281 	struct timeval timeout;
1282 
1283 	if ((buf = malloc(bufsize)) == NULL) {
1284 		BIO_printf(bio_err, "out of memory\n");
1285 		goto err;
1286 	}
1287 	if (s_nbio) {
1288 		if (!s_quiet)
1289 			BIO_printf(bio_err, "turning on non blocking io\n");
1290 		if (!BIO_socket_nbio(s, 1))
1291 			ERR_print_errors(bio_err);
1292 	}
1293 
1294 	if (con == NULL) {
1295 		con = SSL_new(ctx);
1296 		if (s_tlsextdebug) {
1297 			SSL_set_tlsext_debug_callback(con, tlsext_cb);
1298 			SSL_set_tlsext_debug_arg(con, bio_s_out);
1299 		}
1300 		if (s_tlsextstatus) {
1301 			SSL_CTX_set_tlsext_status_cb(ctx, cert_status_cb);
1302 			tlscstatp.err = bio_err;
1303 			SSL_CTX_set_tlsext_status_arg(ctx, &tlscstatp);
1304 		}
1305 		if (context)
1306 			SSL_set_session_id_context(con, context,
1307 			    strlen((char *) context));
1308 	}
1309 	SSL_clear(con);
1310 
1311 	if (SSL_version(con) == DTLS1_VERSION) {
1312 
1313 		sbio = BIO_new_dgram(s, BIO_NOCLOSE);
1314 
1315 		if (enable_timeouts) {
1316 			timeout.tv_sec = 0;
1317 			timeout.tv_usec = DGRAM_RCV_TIMEOUT;
1318 			BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_RECV_TIMEOUT, 0, &timeout);
1319 
1320 			timeout.tv_sec = 0;
1321 			timeout.tv_usec = DGRAM_SND_TIMEOUT;
1322 			BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_SEND_TIMEOUT, 0, &timeout);
1323 		}
1324 		if (socket_mtu > 28) {
1325 			SSL_set_options(con, SSL_OP_NO_QUERY_MTU);
1326 			SSL_set_mtu(con, socket_mtu - 28);
1327 		} else
1328 			/* want to do MTU discovery */
1329 			BIO_ctrl(sbio, BIO_CTRL_DGRAM_MTU_DISCOVER, 0, NULL);
1330 
1331 		/* turn on cookie exchange */
1332 		SSL_set_options(con, SSL_OP_COOKIE_EXCHANGE);
1333 	} else
1334 		sbio = BIO_new_socket(s, BIO_NOCLOSE);
1335 
1336 	if (s_nbio_test) {
1337 		BIO *test;
1338 
1339 		test = BIO_new(BIO_f_nbio_test());
1340 		sbio = BIO_push(test, sbio);
1341 	}
1342 
1343 	SSL_set_bio(con, sbio, sbio);
1344 	SSL_set_accept_state(con);
1345 	/* SSL_set_fd(con,s); */
1346 
1347 	if (s_debug) {
1348 		SSL_set_debug(con, 1);
1349 		BIO_set_callback(SSL_get_rbio(con), bio_dump_callback);
1350 		BIO_set_callback_arg(SSL_get_rbio(con), (char *) bio_s_out);
1351 	}
1352 	if (s_msg) {
1353 		SSL_set_msg_callback(con, msg_cb);
1354 		SSL_set_msg_callback_arg(con, bio_s_out);
1355 	}
1356 	if (s_tlsextdebug) {
1357 		SSL_set_tlsext_debug_callback(con, tlsext_cb);
1358 		SSL_set_tlsext_debug_arg(con, bio_s_out);
1359 	}
1360 
1361 	for (;;) {
1362 		int read_from_terminal;
1363 		int read_from_sslcon;
1364 		struct pollfd pfd[2];
1365 		int ptimeout;
1366 
1367 		read_from_terminal = 0;
1368 		read_from_sslcon = SSL_pending(con);
1369 
1370 		if (!read_from_sslcon) {
1371 			pfd[0].fd = fileno(stdin);
1372 			pfd[0].events = POLLIN;
1373 			pfd[1].fd = s;
1374 			pfd[1].events = POLLIN;
1375 
1376 			if ((SSL_version(con) == DTLS1_VERSION) &&
1377 			    DTLSv1_get_timeout(con, &timeout))
1378 				ptimeout = timeout.tv_sec * 1000 +
1379 				    timeout.tv_usec / 1000;
1380 			else
1381 				ptimeout = -1;
1382 
1383 			i = poll(pfd, 2, ptimeout);
1384 
1385 			if ((SSL_version(con) == DTLS1_VERSION) && DTLSv1_handle_timeout(con) > 0) {
1386 				BIO_printf(bio_err, "TIMEOUT occured\n");
1387 			}
1388 			if (i <= 0)
1389 				continue;
1390 			if (pfd[0].revents) {
1391 				if ((pfd[0].revents & (POLLERR|POLLNVAL)))
1392 					continue;
1393 				read_from_terminal = 1;
1394 			}
1395 			if (pfd[1].revents) {
1396 				if ((pfd[1].revents & (POLLERR|POLLNVAL)))
1397 					continue;
1398 				read_from_sslcon = 1;
1399 			}
1400 		}
1401 		if (read_from_terminal) {
1402 			if (s_crlf) {
1403 				int j, lf_num;
1404 
1405 				i = read(fileno(stdin), buf, bufsize / 2);
1406 				lf_num = 0;
1407 				/* both loops are skipped when i <= 0 */
1408 				for (j = 0; j < i; j++)
1409 					if (buf[j] == '\n')
1410 						lf_num++;
1411 				for (j = i - 1; j >= 0; j--) {
1412 					buf[j + lf_num] = buf[j];
1413 					if (buf[j] == '\n') {
1414 						lf_num--;
1415 						i++;
1416 						buf[j + lf_num] = '\r';
1417 					}
1418 				}
1419 				assert(lf_num == 0);
1420 			} else
1421 				i = read(fileno(stdin), buf, bufsize);
1422 			if (!s_quiet) {
1423 				if ((i <= 0) || (buf[0] == 'Q')) {
1424 					BIO_printf(bio_s_out, "DONE\n");
1425 					shutdown(s, SHUT_RD);
1426 					close(s);
1427 					close_accept_socket();
1428 					ret = -11;
1429 					goto err;
1430 				}
1431 				if ((i <= 0) || (buf[0] == 'q')) {
1432 					BIO_printf(bio_s_out, "DONE\n");
1433 					if (SSL_version(con) != DTLS1_VERSION) {
1434 						shutdown(s, SHUT_RD);
1435 						close(s);
1436 					}
1437 					/*
1438 					 * close_accept_socket(); ret= -11;
1439 					 */
1440 					goto err;
1441 				}
1442 				if ((buf[0] == 'r') &&
1443 				    ((buf[1] == '\n') || (buf[1] == '\r'))) {
1444 					SSL_renegotiate(con);
1445 					i = SSL_do_handshake(con);
1446 					printf("SSL_do_handshake -> %d\n", i);
1447 					i = 0;	/* 13; */
1448 					continue;
1449 					/*
1450 					 * RE-NEGOTIATE\n");
1451 					 */
1452 				}
1453 				if ((buf[0] == 'R') &&
1454 				    ((buf[1] == '\n') || (buf[1] == '\r'))) {
1455 					SSL_set_verify(con,
1456 					    SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, NULL);
1457 					SSL_renegotiate(con);
1458 					i = SSL_do_handshake(con);
1459 					printf("SSL_do_handshake -> %d\n", i);
1460 					i = 0;	/* 13; */
1461 					continue;
1462 					/*
1463 					 * RE-NEGOTIATE asking for client
1464 					 * cert\n");
1465 					 */
1466 				}
1467 				if (buf[0] == 'P') {
1468 					static const char *str = "Lets print some clear text\n";
1469 					BIO_write(SSL_get_wbio(con), str, strlen(str));
1470 				}
1471 				if (buf[0] == 'S') {
1472 					print_stats(bio_s_out, SSL_get_SSL_CTX(con));
1473 				}
1474 			}
1475 			l = k = 0;
1476 			for (;;) {
1477 				/* should do a select for the write */
1478 #ifdef RENEG
1479 				{
1480 					static count = 0;
1481 					if (++count == 100) {
1482 						count = 0;
1483 						SSL_renegotiate(con);
1484 					}
1485 				}
1486 #endif
1487 				k = SSL_write(con, &(buf[l]), (unsigned int) i);
1488 				switch (SSL_get_error(con, k)) {
1489 				case SSL_ERROR_NONE:
1490 					break;
1491 				case SSL_ERROR_WANT_WRITE:
1492 				case SSL_ERROR_WANT_READ:
1493 				case SSL_ERROR_WANT_X509_LOOKUP:
1494 					BIO_printf(bio_s_out, "Write BLOCK\n");
1495 					break;
1496 				case SSL_ERROR_SYSCALL:
1497 				case SSL_ERROR_SSL:
1498 					BIO_printf(bio_s_out, "ERROR\n");
1499 					ERR_print_errors(bio_err);
1500 					ret = 1;
1501 					goto err;
1502 					/* break; */
1503 				case SSL_ERROR_ZERO_RETURN:
1504 					BIO_printf(bio_s_out, "DONE\n");
1505 					ret = 1;
1506 					goto err;
1507 				}
1508 				if (k <= 0)
1509 					continue;
1510 				l += k;
1511 				i -= k;
1512 				if (i <= 0)
1513 					break;
1514 			}
1515 		}
1516 		if (read_from_sslcon) {
1517 			if (!SSL_is_init_finished(con)) {
1518 				i = init_ssl_connection(con);
1519 
1520 				if (i < 0) {
1521 					ret = 0;
1522 					goto err;
1523 				} else if (i == 0) {
1524 					ret = 1;
1525 					goto err;
1526 				}
1527 			} else {
1528 		again:
1529 				i = SSL_read(con, (char *) buf, bufsize);
1530 				switch (SSL_get_error(con, i)) {
1531 				case SSL_ERROR_NONE: {
1532 						int len, n;
1533 						for (len = 0; len < i;) {
1534 							do {
1535 								n = write(fileno(stdout), buf + len, i - len);
1536 							} while (n == -1 && errno == EINTR);
1537 
1538 							if (n == -1) {
1539 								BIO_printf(bio_s_out, "ERROR\n");
1540 								goto err;
1541 							}
1542 							len += n;
1543 						}
1544 					}
1545 					if (SSL_pending(con))
1546 						goto again;
1547 					break;
1548 				case SSL_ERROR_WANT_WRITE:
1549 				case SSL_ERROR_WANT_READ:
1550 					BIO_printf(bio_s_out, "Read BLOCK\n");
1551 					break;
1552 				case SSL_ERROR_SYSCALL:
1553 				case SSL_ERROR_SSL:
1554 					BIO_printf(bio_s_out, "ERROR\n");
1555 					ERR_print_errors(bio_err);
1556 					ret = 1;
1557 					goto err;
1558 				case SSL_ERROR_ZERO_RETURN:
1559 					BIO_printf(bio_s_out, "DONE\n");
1560 					ret = 1;
1561 					goto err;
1562 				}
1563 			}
1564 		}
1565 	}
1566  err:
1567 	if (con != NULL) {
1568 		BIO_printf(bio_s_out, "shutting down SSL\n");
1569 		SSL_set_shutdown(con, SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN);
1570 		SSL_free(con);
1571 	}
1572 	BIO_printf(bio_s_out, "CONNECTION CLOSED\n");
1573 	freezero(buf, bufsize);
1574 	if (ret >= 0)
1575 		BIO_printf(bio_s_out, "ACCEPT\n");
1576 	return (ret);
1577 }
1578 
1579 static void
1580 close_accept_socket(void)
1581 {
1582 	BIO_printf(bio_err, "shutdown accept socket\n");
1583 	if (accept_socket >= 0) {
1584 		shutdown(accept_socket, SHUT_RDWR);
1585 		close(accept_socket);
1586 	}
1587 }
1588 
1589 static int
1590 init_ssl_connection(SSL * con)
1591 {
1592 	int i;
1593 	const char *str;
1594 	X509 *peer;
1595 	long verify_error;
1596 	char buf[BUFSIZ];
1597 	unsigned char *exportedkeymat;
1598 
1599 	i = SSL_accept(con);
1600 	if (i <= 0) {
1601 		if (BIO_sock_should_retry(i)) {
1602 			BIO_printf(bio_s_out, "DELAY\n");
1603 			return (1);
1604 		}
1605 		BIO_printf(bio_err, "ERROR\n");
1606 		verify_error = SSL_get_verify_result(con);
1607 		if (verify_error != X509_V_OK) {
1608 			BIO_printf(bio_err, "verify error:%s\n",
1609 			    X509_verify_cert_error_string(verify_error));
1610 		} else
1611 			ERR_print_errors(bio_err);
1612 		return (0);
1613 	}
1614 	PEM_write_bio_SSL_SESSION(bio_s_out, SSL_get_session(con));
1615 
1616 	peer = SSL_get_peer_certificate(con);
1617 	if (peer != NULL) {
1618 		BIO_printf(bio_s_out, "Client certificate\n");
1619 		PEM_write_bio_X509(bio_s_out, peer);
1620 		X509_NAME_oneline(X509_get_subject_name(peer), buf, sizeof buf);
1621 		BIO_printf(bio_s_out, "subject=%s\n", buf);
1622 		X509_NAME_oneline(X509_get_issuer_name(peer), buf, sizeof buf);
1623 		BIO_printf(bio_s_out, "issuer=%s\n", buf);
1624 		X509_free(peer);
1625 	}
1626 	if (SSL_get_shared_ciphers(con, buf, sizeof buf) != NULL)
1627 		BIO_printf(bio_s_out, "Shared ciphers:%s\n", buf);
1628 	str = SSL_CIPHER_get_name(SSL_get_current_cipher(con));
1629 	BIO_printf(bio_s_out, "CIPHER is %s\n", (str != NULL) ? str : "(NONE)");
1630 
1631 #ifndef OPENSSL_NO_SRTP
1632 	{
1633 		SRTP_PROTECTION_PROFILE *srtp_profile
1634 		= SSL_get_selected_srtp_profile(con);
1635 
1636 		if (srtp_profile)
1637 			BIO_printf(bio_s_out, "SRTP Extension negotiated, profile=%s\n",
1638 			    srtp_profile->name);
1639 	}
1640 #endif
1641 	if (SSL_cache_hit(con))
1642 		BIO_printf(bio_s_out, "Reused session-id\n");
1643 	BIO_printf(bio_s_out, "Secure Renegotiation IS%s supported\n",
1644 	    SSL_get_secure_renegotiation_support(con) ? "" : " NOT");
1645 	if (keymatexportlabel != NULL) {
1646 		BIO_printf(bio_s_out, "Keying material exporter:\n");
1647 		BIO_printf(bio_s_out, "    Label: '%s'\n", keymatexportlabel);
1648 		BIO_printf(bio_s_out, "    Length: %i bytes\n",
1649 		    keymatexportlen);
1650 		exportedkeymat = malloc(keymatexportlen);
1651 		if (exportedkeymat != NULL) {
1652 			if (!SSL_export_keying_material(con, exportedkeymat,
1653 				keymatexportlen,
1654 				keymatexportlabel,
1655 				strlen(keymatexportlabel),
1656 				NULL, 0, 0)) {
1657 				BIO_printf(bio_s_out, "    Error\n");
1658 			} else {
1659 				BIO_printf(bio_s_out, "    Keying material: ");
1660 				for (i = 0; i < keymatexportlen; i++)
1661 					BIO_printf(bio_s_out, "%02X",
1662 					    exportedkeymat[i]);
1663 				BIO_printf(bio_s_out, "\n");
1664 			}
1665 			free(exportedkeymat);
1666 		}
1667 	}
1668 	return (1);
1669 }
1670 
1671 #ifndef OPENSSL_NO_DH
1672 static DH *
1673 load_dh_param(const char *dhfile)
1674 {
1675 	DH *ret = NULL;
1676 	BIO *bio;
1677 
1678 	if ((bio = BIO_new_file(dhfile, "r")) == NULL)
1679 		goto err;
1680 	ret = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
1681  err:
1682 	BIO_free(bio);
1683 	return (ret);
1684 }
1685 #endif
1686 
1687 static int
1688 www_body(char *hostname, int s, unsigned char *context)
1689 {
1690 	char *buf = NULL;
1691 	int ret = 1;
1692 	int i, j, k, dot;
1693 	SSL *con;
1694 	const SSL_CIPHER *c;
1695 	BIO *io, *ssl_bio, *sbio;
1696 
1697 	buf = malloc(bufsize);
1698 	if (buf == NULL)
1699 		return (0);
1700 	io = BIO_new(BIO_f_buffer());
1701 	ssl_bio = BIO_new(BIO_f_ssl());
1702 	if ((io == NULL) || (ssl_bio == NULL))
1703 		goto err;
1704 
1705 	if (s_nbio) {
1706 		if (!s_quiet)
1707 			BIO_printf(bio_err, "turning on non blocking io\n");
1708 		if (!BIO_socket_nbio(s, 1))
1709 			ERR_print_errors(bio_err);
1710 	}
1711 
1712 	/* lets make the output buffer a reasonable size */
1713 	if (!BIO_set_write_buffer_size(io, bufsize))
1714 		goto err;
1715 
1716 	if ((con = SSL_new(ctx)) == NULL)
1717 		goto err;
1718 	if (s_tlsextdebug) {
1719 		SSL_set_tlsext_debug_callback(con, tlsext_cb);
1720 		SSL_set_tlsext_debug_arg(con, bio_s_out);
1721 	}
1722 	if (context)
1723 		SSL_set_session_id_context(con, context,
1724 		    strlen((char *) context));
1725 
1726 	sbio = BIO_new_socket(s, BIO_NOCLOSE);
1727 	if (s_nbio_test) {
1728 		BIO *test;
1729 
1730 		test = BIO_new(BIO_f_nbio_test());
1731 		sbio = BIO_push(test, sbio);
1732 	}
1733 	SSL_set_bio(con, sbio, sbio);
1734 	SSL_set_accept_state(con);
1735 
1736 	/* SSL_set_fd(con,s); */
1737 	BIO_set_ssl(ssl_bio, con, BIO_CLOSE);
1738 	BIO_push(io, ssl_bio);
1739 
1740 	if (s_debug) {
1741 		SSL_set_debug(con, 1);
1742 		BIO_set_callback(SSL_get_rbio(con), bio_dump_callback);
1743 		BIO_set_callback_arg(SSL_get_rbio(con), (char *) bio_s_out);
1744 	}
1745 	if (s_msg) {
1746 		SSL_set_msg_callback(con, msg_cb);
1747 		SSL_set_msg_callback_arg(con, bio_s_out);
1748 	}
1749 	for (;;) {
1750 		i = BIO_gets(io, buf, bufsize - 1);
1751 		if (i < 0) {	/* error */
1752 			if (!BIO_should_retry(io)) {
1753 				if (!s_quiet)
1754 					ERR_print_errors(bio_err);
1755 				goto err;
1756 			} else {
1757 				if (s_debug)  {
1758 					BIO_printf(bio_s_out, "read R BLOCK\n");
1759 					sleep(1);
1760 				}
1761 				continue;
1762 			}
1763 		} else if (i == 0) {	/* end of input */
1764 			ret = 1;
1765 			goto end;
1766 		}
1767 		/* else we have data */
1768 		if (((www == 1) && (strncmp("GET ", buf, 4) == 0)) ||
1769 		    ((www == 2) && (strncmp("GET /stats ", buf, 11) == 0))) {
1770 			char *p;
1771 			X509 *peer;
1772 			STACK_OF(SSL_CIPHER) * sk;
1773 			static const char *space = "                          ";
1774 
1775 			BIO_puts(io, "HTTP/1.0 200 ok\r\nContent-type: text/html\r\n\r\n");
1776 			BIO_puts(io, "<HTML><BODY BGCOLOR=\"#ffffff\">\n");
1777 			BIO_puts(io, "<pre>\n");
1778 /*			BIO_puts(io,SSLeay_version(SSLEAY_VERSION));*/
1779 			BIO_puts(io, "\n");
1780 			for (i = 0; i < local_argc; i++) {
1781 				BIO_puts(io, local_argv[i]);
1782 				BIO_write(io, " ", 1);
1783 			}
1784 			BIO_puts(io, "\n");
1785 
1786 			BIO_printf(io,
1787 			    "Secure Renegotiation IS%s supported\n",
1788 			    SSL_get_secure_renegotiation_support(con) ?
1789 			    "" : " NOT");
1790 
1791 			/*
1792 			 * The following is evil and should not really be
1793 			 * done
1794 			 */
1795 			BIO_printf(io, "Ciphers supported in s_server binary\n");
1796 			sk = SSL_get_ciphers(con);
1797 			j = sk_SSL_CIPHER_num(sk);
1798 			for (i = 0; i < j; i++) {
1799 				c = sk_SSL_CIPHER_value(sk, i);
1800 				BIO_printf(io, "%-11s:%-25s",
1801 				    SSL_CIPHER_get_version(c),
1802 				    SSL_CIPHER_get_name(c));
1803 				if ((((i + 1) % 2) == 0) && (i + 1 != j))
1804 					BIO_puts(io, "\n");
1805 			}
1806 			BIO_puts(io, "\n");
1807 			p = SSL_get_shared_ciphers(con, buf, bufsize);
1808 			if (p != NULL) {
1809 				BIO_printf(io, "---\nCiphers common between both SSL end points:\n");
1810 				j = i = 0;
1811 				while (*p) {
1812 					if (*p == ':') {
1813 						BIO_write(io, space, 26 - j);
1814 						i++;
1815 						j = 0;
1816 						BIO_write(io, ((i % 3) ? " " : "\n"), 1);
1817 					} else {
1818 						BIO_write(io, p, 1);
1819 						j++;
1820 					}
1821 					p++;
1822 				}
1823 				BIO_puts(io, "\n");
1824 			}
1825 			BIO_printf(io, (SSL_cache_hit(con)
1826 				? "---\nReused, "
1827 				: "---\nNew, "));
1828 			c = SSL_get_current_cipher(con);
1829 			BIO_printf(io, "%s, Cipher is %s\n",
1830 			    SSL_CIPHER_get_version(c),
1831 			    SSL_CIPHER_get_name(c));
1832 			SSL_SESSION_print(io, SSL_get_session(con));
1833 			BIO_printf(io, "---\n");
1834 			print_stats(io, SSL_get_SSL_CTX(con));
1835 			BIO_printf(io, "---\n");
1836 			peer = SSL_get_peer_certificate(con);
1837 			if (peer != NULL) {
1838 				BIO_printf(io, "Client certificate\n");
1839 				X509_print(io, peer);
1840 				PEM_write_bio_X509(io, peer);
1841 			} else
1842 				BIO_puts(io, "no client certificate available\n");
1843 			BIO_puts(io, "</BODY></HTML>\r\n\r\n");
1844 			break;
1845 		} else if ((www == 2 || www == 3)
1846 		    && (strncmp("GET /", buf, 5) == 0)) {
1847 			BIO *file;
1848 			char *p, *e;
1849 			static const char *text = "HTTP/1.0 200 ok\r\nContent-type: text/plain\r\n\r\n";
1850 
1851 			/* skip the '/' */
1852 			p = &(buf[5]);
1853 
1854 			dot = 1;
1855 			for (e = p; *e != '\0'; e++) {
1856 				if (e[0] == ' ')
1857 					break;
1858 
1859 				switch (dot) {
1860 				case 1:
1861 					dot = (e[0] == '.') ? 2 : 0;
1862 					break;
1863 				case 2:
1864 					dot = (e[0] == '.') ? 3 : 0;
1865 					break;
1866 				case 3:
1867 					dot = (e[0] == '/' || e[0] == '\\') ? -1 : 0;
1868 					break;
1869 				}
1870 				if (dot == 0)
1871 					dot = (e[0] == '/' || e[0] == '\\') ? 1 : 0;
1872 			}
1873 			dot = (dot == 3) || (dot == -1);	/* filename contains
1874 								 * ".." component */
1875 
1876 			if (*e == '\0') {
1877 				BIO_puts(io, text);
1878 				BIO_printf(io, "'%s' is an invalid file name\r\n", p);
1879 				break;
1880 			}
1881 			*e = '\0';
1882 
1883 			if (dot) {
1884 				BIO_puts(io, text);
1885 				BIO_printf(io, "'%s' contains '..' reference\r\n", p);
1886 				break;
1887 			}
1888 			if (*p == '/') {
1889 				BIO_puts(io, text);
1890 				BIO_printf(io, "'%s' is an invalid path\r\n", p);
1891 				break;
1892 			}
1893 			/* if a directory, do the index thang */
1894 			if (app_isdir(p) > 0) {
1895 				BIO_puts(io, text);
1896 				BIO_printf(io, "'%s' is a directory\r\n", p);
1897 				break;
1898 			}
1899 			if ((file = BIO_new_file(p, "r")) == NULL) {
1900 				BIO_puts(io, text);
1901 				BIO_printf(io, "Error opening '%s'\r\n", p);
1902 				ERR_print_errors(io);
1903 				break;
1904 			}
1905 			if (!s_quiet)
1906 				BIO_printf(bio_err, "FILE:%s\n", p);
1907 
1908 			if (www == 2) {
1909 				i = strlen(p);
1910 				if (((i > 5) && (strcmp(&(p[i - 5]), ".html") == 0)) ||
1911 				    ((i > 4) && (strcmp(&(p[i - 4]), ".php") == 0)) ||
1912 				    ((i > 4) && (strcmp(&(p[i - 4]), ".htm") == 0)))
1913 					BIO_puts(io, "HTTP/1.0 200 ok\r\nContent-type: text/html\r\n\r\n");
1914 				else
1915 					BIO_puts(io, "HTTP/1.0 200 ok\r\nContent-type: text/plain\r\n\r\n");
1916 			}
1917 			/* send the file */
1918 			for (;;) {
1919 				i = BIO_read(file, buf, bufsize);
1920 				if (i <= 0)
1921 					break;
1922 
1923 #ifdef RENEG
1924 				total_bytes += i;
1925 				fprintf(stderr, "%d\n", i);
1926 				if (total_bytes > 3 * 1024) {
1927 					total_bytes = 0;
1928 					fprintf(stderr, "RENEGOTIATE\n");
1929 					SSL_renegotiate(con);
1930 				}
1931 #endif
1932 
1933 				for (j = 0; j < i;) {
1934 #ifdef RENEG
1935 					{
1936 						static count = 0;
1937 						if (++count == 13) {
1938 							SSL_renegotiate(con);
1939 						}
1940 					}
1941 #endif
1942 					k = BIO_write(io, &(buf[j]), i - j);
1943 					if (k <= 0) {
1944 						if (!BIO_should_retry(io))
1945 							goto write_error;
1946 						else {
1947 							BIO_printf(bio_s_out, "rwrite W BLOCK\n");
1948 						}
1949 					} else {
1950 						j += k;
1951 					}
1952 				}
1953 			}
1954 	write_error:
1955 			BIO_free(file);
1956 			break;
1957 		}
1958 	}
1959 
1960 	for (;;) {
1961 		i = (int) BIO_flush(io);
1962 		if (i <= 0) {
1963 			if (!BIO_should_retry(io))
1964 				break;
1965 		} else
1966 			break;
1967 	}
1968  end:
1969 	/* make sure we re-use sessions */
1970 	SSL_set_shutdown(con, SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN);
1971 
1972  err:
1973 
1974 	if (ret >= 0)
1975 		BIO_printf(bio_s_out, "ACCEPT\n");
1976 
1977 	free(buf);
1978 	BIO_free_all(io);
1979 /*	if (ssl_bio != NULL) BIO_free(ssl_bio);*/
1980 	return (ret);
1981 }
1982 
1983 #define MAX_SESSION_ID_ATTEMPTS 10
1984 static int
1985 generate_session_id(const SSL * ssl, unsigned char *id,
1986     unsigned int *id_len)
1987 {
1988 	unsigned int count = 0;
1989 	do {
1990 		arc4random_buf(id, *id_len);
1991 		/*
1992 		 * Prefix the session_id with the required prefix. NB: If our
1993 		 * prefix is too long, clip it - but there will be worse
1994 		 * effects anyway, eg. the server could only possibly create
1995 		 * 1 session ID (ie. the prefix!) so all future session
1996 		 * negotiations will fail due to conflicts.
1997 		 */
1998 		memcpy(id, session_id_prefix,
1999 		    (strlen(session_id_prefix) < *id_len) ?
2000 		    strlen(session_id_prefix) : *id_len);
2001 	}
2002 	while (SSL_has_matching_session_id(ssl, id, *id_len) &&
2003 	    (++count < MAX_SESSION_ID_ATTEMPTS));
2004 	if (count >= MAX_SESSION_ID_ATTEMPTS)
2005 		return 0;
2006 	return 1;
2007 }
2008