import of OpenSSL 0.9.8h

1 files changed, 209 insertions, 47 deletions

diff --git a/src/lib/libssl/src/ssl/ssltest.c b/src/lib/libssl/src/ssl/ssltest.c
index 9845ef99ed..517657c024 100644
--- a/src/lib/libssl/src/ssl/ssltest.c
+++ b/src/lib/libssl/src/ssl/ssltest.c
@@ -108,6 +108,11 @@
  * Hudson (tjh@cryptsoft.com).
  *
  */
+/* ====================================================================
+ * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
+ * ECC cipher suite support in OpenSSL originally developed by 
+ * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
+ */
 
 #define _BSD_SOURCE 1           /* Or gethostname won't be declared properly
                                    on Linux and GNU platforms. */
@@ -138,7 +143,16 @@
 #endif
 #include <openssl/err.h>
 #include <openssl/rand.h>
-#include <openssl/fips.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#ifndef OPENSSL_NO_DSA
+#include <openssl/dsa.h>
+#endif
+#ifndef OPENSSL_NO_DH
+#include <openssl/dh.h>
+#endif
+#include <openssl/bn.h>
 
 #define _XOPEN_SOURCE_EXTENDED  1 /* Or gethostname won't be declared properly
                                      on Compaq platforms (at least with DEC C).
@@ -158,6 +172,9 @@
 #elif defined(OPENSSL_SYS_WINCE)
 #  define TEST_SERVER_CERT "\\OpenSSL\\server.pem"
 #  define TEST_CLIENT_CERT "\\OpenSSL\\client.pem"
+#elif defined(OPENSSL_SYS_NETWARE)
+#  define TEST_SERVER_CERT "\\openssl\\apps\\server.pem"
+#  define TEST_CLIENT_CERT "\\openssl\\apps\\client.pem"
 #else
 #  define TEST_SERVER_CERT "../apps/server.pem"
 #  define TEST_CLIENT_CERT "../apps/client.pem"
@@ -165,8 +182,8 @@
 
 /* There is really no standard for this, so let's assign some tentative
    numbers.  In any case, these numbers are only for this test */
-#define COMP_RLE        1
-#define COMP_ZLIB       2
+#define COMP_RLE        255
+#define COMP_ZLIB       1
 
 static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
 #ifndef OPENSSL_NO_RSA
@@ -207,13 +224,11 @@ static const char rnd_seed[] = "string to make the random number generator think
 
 int doit_biopair(SSL *s_ssl,SSL *c_ssl,long bytes,clock_t *s_time,clock_t *c_time);
 int doit(SSL *s_ssl,SSL *c_ssl,long bytes);
+static int do_test_cipherlist(void);
 static void sv_usage(void)
         {
         fprintf(stderr,"usage: ssltest [args ...]\n");
         fprintf(stderr,"\n");
-#ifdef OPENSSL_FIPS
-        fprintf(stderr,"-F             - run test in FIPS mode\n");
-#endif
         fprintf(stderr," -server_auth  - check server certificate\n");
         fprintf(stderr," -client_auth  - do client authentication\n");
         fprintf(stderr," -proxy        - allow proxy certificates\n");
@@ -229,6 +244,9 @@ static void sv_usage(void)
         fprintf(stderr," -dhe1024dsa   - use 1024 bit key (with 160-bit subprime) for DHE\n");
         fprintf(stderr," -no_dhe       - disable DHE\n");
 #endif
+#ifndef OPENSSL_NO_ECDH
+        fprintf(stderr," -no_ecdhe     - disable ECDHE\n");
+#endif
 #ifndef OPENSSL_NO_SSL2
         fprintf(stderr," -ssl2         - use SSLv2\n");
 #endif
@@ -249,7 +267,13 @@ static void sv_usage(void)
         fprintf(stderr," -f            - Test even cases that can't work\n");
         fprintf(stderr," -time         - measure processor time used by client and server\n");
         fprintf(stderr," -zlib         - use zlib compression\n");
-        fprintf(stderr," -time         - use rle compression\n");
+        fprintf(stderr," -rle          - use rle compression\n");
+#ifndef OPENSSL_NO_ECDH
+        fprintf(stderr," -named_curve arg  - Elliptic curve name to use for ephemeral ECDH keys.\n" \
+                       "                 Use \"openssl ecparam -list_curves\" for all names\n"  \
+                       "                 (default is sect163r2).\n");
+#endif
+        fprintf(stderr," -test_cipherlist - verifies the order of the ssl cipher lists\n");
         }
 
 static void print_details(SSL *c_ssl, const char *prefix)
@@ -359,6 +383,7 @@ static void lock_dbg_cb(int mode, int type, const char *file, int line)
                 }
         }
 
+
 int main(int argc, char *argv[])
         {
         char *CApath=NULL,*CAfile=NULL;
@@ -374,24 +399,32 @@ int main(int argc, char *argv[])
         char *server_key=NULL;
         char *client_cert=TEST_CLIENT_CERT;
         char *client_key=NULL;
+#ifndef OPENSSL_NO_ECDH
+        char *named_curve = NULL;
+#endif
         SSL_CTX *s_ctx=NULL;
         SSL_CTX *c_ctx=NULL;
         SSL_METHOD *meth=NULL;
         SSL *c_ssl,*s_ssl;
         int number=1,reuse=0;
-        long bytes=1L;
+        long bytes=256L;
 #ifndef OPENSSL_NO_DH
         DH *dh;
         int dhe1024 = 0, dhe1024dsa = 0;
 #endif
+#ifndef OPENSSL_NO_ECDH
+        EC_KEY *ecdh = NULL;
+#endif
         int no_dhe = 0;
+        int no_ecdhe = 0;
         int print_time = 0;
         clock_t s_time = 0, c_time = 0;
         int comp = 0;
+#ifndef OPENSSL_NO_COMP
         COMP_METHOD *cm = NULL;
-#ifdef OPENSSL_FIPS
-        int fips_mode=0;
 #endif
+        STACK_OF(SSL_COMP) *ssl_comp_methods = NULL;
+        int test_cipherlist = 0;
 
         verbose = 0;
         debug = 0;
@@ -423,16 +456,7 @@ int main(int argc, char *argv[])
 
         while (argc >= 1)
                 {
-                if(!strcmp(*argv,"-F"))
-                        {
-#ifdef OPENSSL_FIPS
-                        fips_mode=1;
-#else
-                        fprintf(stderr,"not compiled with FIPS support, so exitting without running.\n");
-                        EXIT(0);
-#endif
-                        }
-                else if (strcmp(*argv,"-server_auth") == 0)
+                if      (strcmp(*argv,"-server_auth") == 0)
                         server_auth=1;
                 else if (strcmp(*argv,"-client_auth") == 0)
                         client_auth=1;
@@ -470,6 +494,8 @@ int main(int argc, char *argv[])
                         }
                 else if (strcmp(*argv,"-no_dhe") == 0)
                         no_dhe=1;
+                else if (strcmp(*argv,"-no_ecdhe") == 0)
+                        no_ecdhe=1;
                 else if (strcmp(*argv,"-ssl2") == 0)
                         ssl2=1;
                 else if (strcmp(*argv,"-tls1") == 0)
@@ -556,6 +582,16 @@ int main(int argc, char *argv[])
                         {
                         comp = COMP_RLE;
                         }
+                else if (strcmp(*argv,"-named_curve") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+#ifndef OPENSSL_NO_ECDH         
+                        named_curve = *(++argv);
+#else
+                        fprintf(stderr,"ignoring -named_curve, since I'm compiled without ECDH\n");
+                        ++argv;
+#endif
+                        }
                 else if (strcmp(*argv,"-app_verify") == 0)
                         {
                         app_verify_arg.app_verify = 1;
@@ -564,6 +600,10 @@ int main(int argc, char *argv[])
                         {
                         app_verify_arg.allow_proxy_certs = 1;
                         }
+                else if (strcmp(*argv,"-test_cipherlist") == 0)
+                        {
+                        test_cipherlist = 1;
+                        }
                 else
                         {
                         fprintf(stderr,"unknown option %s\n",*argv);
@@ -580,6 +620,14 @@ bad:
                 goto end;
                 }
 
+        if (test_cipherlist == 1)
+                {
+                /* ensure that the cipher list are correctly sorted and exit */
+                if (do_test_cipherlist() == 0)
+                        EXIT(1);
+                ret = 0;
+                goto end;
+                }
 
         if (!ssl2 && !ssl3 && !tls1 && number > 1 && !reuse && !force)
                 {
@@ -590,20 +638,6 @@ bad:
                 EXIT(1);
                 }
 
-#ifdef OPENSSL_FIPS
-        if(fips_mode)
-                {
-                if(!FIPS_mode_set(1))
-                        {
-                        ERR_load_crypto_strings();
-                        ERR_print_errors(BIO_new_fp(stderr,BIO_NOCLOSE));
-                        EXIT(1);
-                        }
-                else
-                        fprintf(stderr,"*** IN FIPS MODE ***\n");
-                }
-#endif
-
         if (print_time)
                 {
                 if (!bio_pair)
@@ -620,6 +654,7 @@ bad:
         SSL_library_init();
         SSL_load_error_strings();
 
+#ifndef OPENSSL_NO_COMP
         if (comp == COMP_ZLIB) cm = COMP_zlib();
         if (comp == COMP_RLE) cm = COMP_rle();
         if (cm != NULL)
@@ -643,6 +678,20 @@ bad:
                         ERR_print_errors_fp(stderr);
                         }
                 }
+        ssl_comp_methods = SSL_COMP_get_compression_methods();
+        fprintf(stderr, "Available compression methods:\n");
+        {
+        int j, n = sk_SSL_COMP_num(ssl_comp_methods);
+        if (n == 0)
+                fprintf(stderr, "  NONE\n");
+        else
+                for (j = 0; j < n; j++)
+                        {
+                        SSL_COMP *c = sk_SSL_COMP_value(ssl_comp_methods, j);
+                        fprintf(stderr, "  %d: %s\n", c->id, c->name);
+                        }
+        }
+#endif
 
 #if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
         if (ssl2)
@@ -697,6 +746,38 @@ bad:
         (void)no_dhe;
 #endif
 
+#ifndef OPENSSL_NO_ECDH
+        if (!no_ecdhe)
+                {
+                int nid;
+
+                if (named_curve != NULL)
+                        {
+                        nid = OBJ_sn2nid(named_curve);
+                        if (nid == 0)
+                        {
+                                BIO_printf(bio_err, "unknown curve name (%s)\n", named_curve);
+                                goto end;
+                                }
+                        }
+                else
+                        nid = NID_sect163r2;
+
+                ecdh = EC_KEY_new_by_curve_name(nid);
+                if (ecdh == NULL)
+                        {
+                        BIO_printf(bio_err, "unable to create curve\n");
+                        goto end;
+                        }
+
+                SSL_CTX_set_tmp_ecdh(s_ctx, ecdh);
+                SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_ECDH_USE);
+                EC_KEY_free(ecdh);
+                }
+#else
+        (void)no_ecdhe;
+#endif
+
 #ifndef OPENSSL_NO_RSA
         SSL_CTX_set_tmp_rsa_callback(s_ctx,tmp_rsa_cb);
 #endif
@@ -833,6 +914,7 @@ end:
         CRYPTO_mem_leaks(bio_err);
         if (bio_err != NULL) BIO_free(bio_err);
         EXIT(ret);
+        return ret;
         }
 
 int doit_biopair(SSL *s_ssl, SSL *c_ssl, long count,
@@ -1323,8 +1405,8 @@ int doit(SSL *s_ssl, SSL *c_ssl, long count)
                         {
                         if (c_write)
                                 {
-                                j=(cw_num > (long)sizeof(cbuf))
-                                        ?sizeof(cbuf):(int)cw_num;
+                                j = (cw_num > (long)sizeof(cbuf)) ?
+                                        (int)sizeof(cbuf) : (int)cw_num;
                                 i=BIO_write(c_bio,cbuf,j);
                                 if (i < 0)
                                         {
@@ -1454,8 +1536,8 @@ int doit(SSL *s_ssl, SSL *c_ssl, long count)
                                 }
                         else
                                 {
-                                j=(sw_num > (long)sizeof(sbuf))?
-                                        sizeof(sbuf):(int)sw_num;
+                                j = (sw_num > (long)sizeof(sbuf)) ?
+                                        (int)sizeof(sbuf) : (int)sw_num;
                                 i=BIO_write(s_bio,sbuf,j);
                                 if (i < 0)
                                         {
@@ -1642,7 +1724,7 @@ static int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx)
                                         fprintf(stderr, "  Certificate proxy rights = %*.*s", i, i, s);
                                         while(i-- > 0)
                                                 {
-                                                char c = *s++;
+                                                int c = *s++;
                                                 if (isascii(c) && isalpha(c))
                                                         {
                                                         if (islower(c))
@@ -1703,11 +1785,11 @@ static int process_proxy_cond_adders(unsigned int letters[26],
 static int process_proxy_cond_val(unsigned int letters[26],
         const char *cond, const char **cond_end, int *pos, int indent)
         {
-        char c;
+        int c;
         int ok = 1;
         int negate = 0;
 
-        while(isspace(*cond))
+        while(isspace((int)*cond))
                 {
                 cond++; (*pos)++;
                 }
@@ -1722,7 +1804,7 @@ static int process_proxy_cond_val(unsigned int letters[26],
                 {
                 negate = !negate;
                 cond++; (*pos)++;
-                while(isspace(*cond))
+                while(isspace((int)*cond))
                         {
                         cond++; (*pos)++;
                         }
@@ -1737,7 +1819,7 @@ static int process_proxy_cond_val(unsigned int letters[26],
                 cond = *cond_end;
                 if (ok < 0)
                         goto end;
-                while(isspace(*cond))
+                while(isspace((int)*cond))
                         {
                         cond++; (*pos)++;
                         }
@@ -1797,7 +1879,7 @@ static int process_proxy_cond_multipliers(unsigned int letters[26],
 
         while(ok >= 0)
                 {
-                while(isspace(*cond))
+                while(isspace((int)*cond))
                         {
                         cond++; (*pos)++;
                         }
@@ -1864,7 +1946,7 @@ static int process_proxy_cond_adders(unsigned int letters[26],
 
         while(ok >= 0)
                 {
-                while(isspace(*cond))
+                while(isspace((int)*cond))
                         {
                         cond++; (*pos)++;
                         }
@@ -1947,7 +2029,7 @@ static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg)
                         letters[i] = 0;
                 for(sp = cb_arg->proxy_auth; *sp; sp++)
                         {
-                        char c = *sp;
+                        int c = *sp;
                         if (isascii(c) && isalpha(c))
                                 {
                                 if (islower(c))
@@ -1977,7 +2059,15 @@ static int MS_CALLBACK app_verify_callback(X509_STORE_CTX *ctx, void *arg)
                 }
 
 #ifndef OPENSSL_NO_X509_VERIFY
+# ifdef OPENSSL_FIPS
+        if(s->version == TLS1_VERSION)
+                FIPS_allow_md5(1);
+# endif
         ok = X509_verify_cert(ctx);
+# ifdef OPENSSL_FIPS
+        if(s->version == TLS1_VERSION)
+                FIPS_allow_md5(0);
+# endif
 #endif
 
         if (cb_arg->proxy_auth)
@@ -2012,14 +2102,29 @@ static RSA *rsa_tmp=NULL;
 
 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength)
         {
+        BIGNUM *bn = NULL;
         if (rsa_tmp == NULL)
                 {
+                bn = BN_new();
+                rsa_tmp = RSA_new();
+                if(!bn || !rsa_tmp || !BN_set_word(bn, RSA_F4))
+                        {
+                        BIO_printf(bio_err, "Memory error...");
+                        goto end;
+                        }
                 BIO_printf(bio_err,"Generating temp (%d bit) RSA key...",keylength);
                 (void)BIO_flush(bio_err);
-                rsa_tmp=RSA_generate_key(keylength,RSA_F4,NULL,NULL);
+                if(!RSA_generate_key_ex(rsa_tmp,keylength,bn,NULL))
+                        {
+                        BIO_printf(bio_err, "Error generating key.");
+                        RSA_free(rsa_tmp);
+                        rsa_tmp = NULL;
+                        }
+end:
                 BIO_printf(bio_err,"\n");
                 (void)BIO_flush(bio_err);
                 }
+        if(bn) BN_free(bn);
         return(rsa_tmp);
         }
 
@@ -2130,3 +2235,60 @@ static DH *get_dh1024dsa()
         return(dh);
         }
 #endif
+
+static int do_test_cipherlist(void)
+        {
+        int i = 0;
+        const SSL_METHOD *meth;
+        SSL_CIPHER *ci, *tci = NULL;
+
+#ifndef OPENSSL_NO_SSL2
+        fprintf(stderr, "testing SSLv2 cipher list order: ");
+        meth = SSLv2_method();
+        while ((ci = meth->get_cipher(i++)) != NULL)
+                {
+                if (tci != NULL)
+                        if (ci->id >= tci->id)
+                                {
+                                fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
+                                return 0;
+                                }
+                tci = ci;
+                }
+        fprintf(stderr, "ok\n");
+#endif
+#ifndef OPENSSL_NO_SSL3
+        fprintf(stderr, "testing SSLv3 cipher list order: ");
+        meth = SSLv3_method();
+        tci = NULL;
+        while ((ci = meth->get_cipher(i++)) != NULL)
+                {
+                if (tci != NULL)
+                        if (ci->id >= tci->id)
+                                {
+                                fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
+                                return 0;
+                                }
+                tci = ci;
+                }
+        fprintf(stderr, "ok\n");
+#endif
+#ifndef OPENSSL_NO_TLS1
+        fprintf(stderr, "testing TLSv1 cipher list order: ");
+        meth = TLSv1_method();
+        tci = NULL;
+        while ((ci = meth->get_cipher(i++)) != NULL)
+                {
+                if (tci != NULL)
+                        if (ci->id >= tci->id)
+                                {
+                                fprintf(stderr, "failed %lx vs. %lx\n", ci->id, tci->id);
+                                return 0;
+                                }
+                tci = ci;
+                }
+        fprintf(stderr, "ok\n");
+#endif
+
+        return 1;
+        }