1 files changed, 288 insertions, 87 deletions

diff --git a/src/lib/libssl/src/apps/s_server.c b/src/lib/libssl/src/apps/s_server.c
index 84b1b28461..1a06d19bb1 100644
--- a/src/lib/libssl/src/apps/s_server.c
+++ b/src/lib/libssl/src/apps/s_server.c
@@ -56,7 +56,7 @@
  * [including the GNU Public Licence.]
  */
 /* ====================================================================
- * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -113,6 +113,32 @@
  * ECC cipher suite support in OpenSSL originally developed by 
  * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
  */
+/* ====================================================================
+ * Copyright 2005 Nokia. All rights reserved.
+ *
+ * The portions of the attached software ("Contribution") is developed by
+ * Nokia Corporation and is licensed pursuant to the OpenSSL open source
+ * license.
+ *
+ * The Contribution, originally written by Mika Kousa and Pasi Eronen of
+ * Nokia Corporation, consists of the "PSK" (Pre-Shared Key) ciphersuites
+ * support (see RFC 4279) to OpenSSL.
+ *
+ * No patent licenses or other rights except those expressly stated in
+ * the OpenSSL open source license shall be deemed granted or received
+ * expressly, by implication, estoppel, or otherwise.
+ *
+ * No assurances are provided by Nokia that the Contribution does not
+ * infringe the patent or other intellectual property rights of any third
+ * party or that the license provides you with all the necessary rights
+ * to make use of the Contribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN
+ * ADDITION TO THE DISCLAIMERS INCLUDED IN THE LICENSE, NOKIA
+ * SPECIFICALLY DISCLAIMS ANY LIABILITY FOR CLAIMS BROUGHT BY YOU OR ANY
+ * OTHER ENTITY BASED ON INFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS OR
+ * OTHERWISE.
+ */
 
 /* Until the key-gen callbacks are modified to use newer prototypes, we allow
  * deprecated functions for openssl-internal code */
@@ -121,11 +147,11 @@
 #endif
 
 #include <assert.h>
+#include <ctype.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 
-#include <sys/stat.h>
 #include <openssl/e_os2.h>
 #ifdef OPENSSL_NO_STDIO
 #define APPS_WIN16
@@ -163,19 +189,15 @@ typedef unsigned int u_int;
 #include "s_apps.h"
 #include "timeouts.h"
 
-#ifdef OPENSSL_SYS_WINCE
-/* Windows CE incorrectly defines fileno as returning void*, so to avoid problems below... */
-#ifdef fileno
-#undef fileno
-#endif
-#define fileno(a) (int)_fileno(a)
-#endif
-
 #if (defined(OPENSSL_SYS_VMS) && __VMS_VER < 70000000)
 /* FIONBIO used as a switch to enable ioctl, and that isn't in VMS < 7.0 */
 #undef FIONBIO
 #endif
 
+#if defined(OPENSSL_SYS_BEOS_R5)
+#include <fcntl.h>
+#endif
+
 #ifndef OPENSSL_NO_RSA
 static RSA MS_CALLBACK *tmp_rsa_cb(SSL *s, int is_export, int keylength);
 #endif
@@ -196,14 +218,6 @@ static DH *get_dh512(void);
 static void s_server_init(void);
 #endif
 
-#ifndef S_ISDIR
-# if defined(_S_IFMT) && defined(_S_IFDIR)
-#  define S_ISDIR(a)    (((a) & _S_IFMT) == _S_IFDIR)
-# else
-#  define S_ISDIR(a)    (((a) & S_IFMT) == S_IFDIR)
-# endif
-#endif
-
 #ifndef OPENSSL_NO_DH
 static unsigned char dh512_p[]={
         0xDA,0x58,0x3C,0x16,0xD9,0x85,0x22,0x89,0xD0,0xE4,0xAF,0x75,
@@ -245,7 +259,7 @@ static int accept_socket= -1;
 #undef PROG
 #define PROG            s_server_main
 
-extern int verify_depth;
+extern int verify_depth, verify_return_error;
 
 static char *cipher=NULL;
 static int s_server_verify=SSL_VERIFY_NONE;
@@ -283,12 +297,77 @@ static char *engine_id=NULL;
 static const char *session_id_prefix=NULL;
 
 static int enable_timeouts = 0;
-#ifdef mtu
-#undef mtu
-#endif
-static long mtu;
+static long socket_mtu;
+#ifndef OPENSSL_NO_DTLS1
 static int cert_chain = 0;
+#endif
+
+#ifndef OPENSSL_NO_PSK
+static char *psk_identity="Client_identity";
+char *psk_key=NULL; /* by default PSK is not used */
+
+static unsigned int psk_server_cb(SSL *ssl, const char *identity,
+        unsigned char *psk, unsigned int max_psk_len)
+        {
+        unsigned int psk_len = 0;
+        int ret;
+        BIGNUM *bn = NULL;
 
+        if (s_debug)
+                BIO_printf(bio_s_out,"psk_server_cb\n");
+        if (!identity)
+                {
+                BIO_printf(bio_err,"Error: client did not send PSK identity\n");
+                goto out_err;
+                }
+        if (s_debug)
+                BIO_printf(bio_s_out,"identity_len=%d identity=%s\n",
+                        identity ? (int)strlen(identity) : 0, identity);
+
+        /* here we could lookup the given identity e.g. from a database */
+        if (strcmp(identity, psk_identity) != 0)
+                {
+                BIO_printf(bio_s_out, "PSK error: client identity not found"
+                           " (got '%s' expected '%s')\n", identity,
+                           psk_identity);
+                goto out_err;
+                }
+        if (s_debug)
+                BIO_printf(bio_s_out, "PSK client identity found\n");
+
+        /* convert the PSK key to binary */
+        ret = BN_hex2bn(&bn, psk_key);
+        if (!ret)
+                {
+                BIO_printf(bio_err,"Could not convert PSK key '%s' to BIGNUM\n", psk_key);
+                if (bn)
+                        BN_free(bn);
+                return 0;
+                }
+        if (BN_num_bytes(bn) > (int)max_psk_len)
+                {
+                BIO_printf(bio_err,"psk buffer of callback is too small (%d) for key (%d)\n",
+                        max_psk_len, BN_num_bytes(bn));
+                BN_free(bn);
+                return 0;
+                }
+
+        ret = BN_bn2bin(bn, psk);
+        BN_free(bn);
+
+        if (ret < 0)
+                goto out_err;
+        psk_len = (unsigned int)ret;
+
+        if (s_debug)
+                BIO_printf(bio_s_out, "fetched PSK len=%d\n", psk_len);
+        return psk_len;
+ out_err:
+        if (s_debug)
+                BIO_printf(bio_err, "Error in PSK server callback\n");
+        return 0;
+        }
+#endif
 
 #ifdef MONOLITH
 static void s_server_init(void)
@@ -353,7 +432,7 @@ static void sv_usage(void)
 #ifndef OPENSSL_NO_ECDH
         BIO_printf(bio_err," -named_curve arg  - Elliptic curve name to use for ephemeral ECDH keys.\n" \
                            "                 Use \"openssl ecparam -list_curves\" for all names\n" \
-                           "                 (default is sect163r2).\n");
+                           "                 (default is nistp256).\n");
 #endif
 #ifdef FIONBIO
         BIO_printf(bio_err," -nbio         - Run with non-blocking IO\n");
@@ -370,12 +449,19 @@ static void sv_usage(void)
         BIO_printf(bio_err," -serverpref   - Use server's cipher preferences\n");
         BIO_printf(bio_err," -quiet        - No server output\n");
         BIO_printf(bio_err," -no_tmp_rsa   - Do not generate a tmp RSA key\n");
+#ifndef OPENSSL_NO_PSK
+        BIO_printf(bio_err," -psk_hint arg - PSK identity hint to use\n");
+        BIO_printf(bio_err," -psk arg      - PSK in hex (without 0x)\n");
+# ifndef OPENSSL_NO_JPAKE
+        BIO_printf(bio_err," -jpake arg    - JPAKE secret to use\n");
+# endif
+#endif
         BIO_printf(bio_err," -ssl2         - Just talk SSLv2\n");
         BIO_printf(bio_err," -ssl3         - Just talk SSLv3\n");
         BIO_printf(bio_err," -tls1         - Just talk TLSv1\n");
         BIO_printf(bio_err," -dtls1        - Just talk DTLSv1\n");
         BIO_printf(bio_err," -timeout      - Enable timeouts\n");
-        BIO_printf(bio_err," -mtu          - Set MTU\n");
+        BIO_printf(bio_err," -mtu          - Set link layer MTU\n");
         BIO_printf(bio_err," -chain        - Read a certificate chain\n");
         BIO_printf(bio_err," -no_ssl2      - Just disable SSLv2\n");
         BIO_printf(bio_err," -no_ssl3      - Just disable SSLv3\n");
@@ -405,6 +491,7 @@ static void sv_usage(void)
         BIO_printf(bio_err,"                 not specified (default is %s)\n",TEST_CERT2);
         BIO_printf(bio_err," -tlsextdebug  - hex dump of all TLS extensions received\n");
         BIO_printf(bio_err," -no_ticket    - disable use of RFC4507bis session tickets\n");
+        BIO_printf(bio_err," -legacy_renegotiation - enable use of legacy renegotiation (dangerous)\n");
 #endif
         }
 
@@ -587,7 +674,7 @@ static int MS_CALLBACK ssl_servername_cb(SSL *s, int *ad, void *arg)
                         return p->extension_error;
                 if (ctx2)
                         {
-                        BIO_printf(p->biodebug,"Swiching server context.\n");
+                        BIO_printf(p->biodebug,"Switching server context.\n");
                         SSL_set_SSL_CTX(s,ctx2);
                         }     
                 }
@@ -626,7 +713,7 @@ static int cert_status_cb(SSL *s, void *arg)
         int use_ssl;
         unsigned char *rspder = NULL;
         int rspderlen;
-        STACK *aia = NULL;
+        STACK_OF(OPENSSL_STRING) *aia = NULL;
         X509 *x = NULL;
         X509_STORE_CTX inctx;
         X509_OBJECT obj;
@@ -648,7 +735,7 @@ BIO_printf(err, "cert_status: received %d ids\n", sk_OCSP_RESPID_num(ids));
         aia = X509_get1_ocsp(x);
         if (aia)
                 {
-                if (!OCSP_parse_url(sk_value(aia, 0),
+                if (!OCSP_parse_url(sk_OPENSSL_STRING_value(aia, 0),
                         &host, &port, &path, &use_ssl))
                         {
                         BIO_puts(err, "cert_status: can't parse AIA URL\n");
@@ -656,7 +743,7 @@ BIO_printf(err, "cert_status: received %d ids\n", sk_OCSP_RESPID_num(ids));
                         }
                 if (srctx->verbose)
                         BIO_printf(err, "cert_status: AIA URL: %s\n",
-                                        sk_value(aia, 0));
+                                        sk_OPENSSL_STRING_value(aia, 0));
                 }
         else
                 {
@@ -701,7 +788,7 @@ BIO_printf(err, "cert_status: received %d ids\n", sk_OCSP_RESPID_num(ids));
                 if (!OCSP_REQUEST_add_ext(req, ext, -1))
                         goto err;
                 }
-        resp = process_responder(err, req, host, path, port, use_ssl,
+        resp = process_responder(err, req, host, path, port, use_ssl, NULL,
                                         srctx->timeout);
         if (!resp)
                 {
@@ -740,6 +827,7 @@ BIO_printf(err, "cert_status: received %d ids\n", sk_OCSP_RESPID_num(ids));
         goto done;
         }
 #endif
+
 int MAIN(int, char **);
 
 #ifndef OPENSSL_NO_JPAKE
@@ -748,8 +836,8 @@ static char *jpake_secret = NULL;
 
 int MAIN(int argc, char *argv[])
         {
-        X509_STORE *store = NULL;
-        int vflags = 0;
+        X509_VERIFY_PARAM *vpm = NULL;
+        int badarg = 0;
         short port=PORT;
         char *CApath=NULL,*CAfile=NULL;
         unsigned char *context = NULL;
@@ -762,8 +850,8 @@ int MAIN(int argc, char *argv[])
         int off=0;
         int no_tmp_rsa=0,no_dhe=0,no_ecdhe=0,nocert=0;
         int state=0;
-        SSL_METHOD *meth=NULL;
-        int socket_type=SOCK_STREAM;
+        const SSL_METHOD *meth=NULL;
+        int socket_type=SOCK_STREAM;
         ENGINE *e=NULL;
         char *inrand=NULL;
         int s_cert_format = FORMAT_PEM, s_key_format = FORMAT_PEM;
@@ -772,6 +860,7 @@ int MAIN(int argc, char *argv[])
         int s_dcert_format = FORMAT_PEM, s_dkey_format = FORMAT_PEM;
         X509 *s_cert = NULL, *s_dcert = NULL;
         EVP_PKEY *s_key = NULL, *s_dkey = NULL;
+        int no_cache = 0;
 #ifndef OPENSSL_NO_TLSEXT
         EVP_PKEY *s_key2 = NULL;
         X509 *s_cert2 = NULL;
@@ -779,7 +868,10 @@ int MAIN(int argc, char *argv[])
 #ifndef OPENSSL_NO_TLSEXT
         tlsextctx tlsextcbp = {NULL, NULL, SSL_TLSEXT_ERR_ALERT_WARNING};
 #endif
-
+#ifndef OPENSSL_NO_PSK
+        /* by default do not send a PSK identity hint */
+        static char *psk_identity_hint=NULL;
+#endif
 #if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
         meth=SSLv23_server_method();
 #elif !defined(OPENSSL_NO_SSL3)
@@ -911,16 +1003,20 @@ int MAIN(int argc, char *argv[])
                         if (--argc < 1) goto bad;
                         CApath= *(++argv);
                         }
-                else if (strcmp(*argv,"-crl_check") == 0)
-                        {
-                        vflags |= X509_V_FLAG_CRL_CHECK;
-                        }
-                else if (strcmp(*argv,"-crl_check_all") == 0)
+                else if (strcmp(*argv,"-no_cache") == 0)
+                        no_cache = 1;
+                else if (args_verify(&argv, &argc, &badarg, bio_err, &vpm))
                         {
-                        vflags |= X509_V_FLAG_CRL_CHECK|X509_V_FLAG_CRL_CHECK_ALL;
+                        if (badarg)
+                                goto bad;
+                        continue;
                         }
+                else if (strcmp(*argv,"-verify_return_error") == 0)
+                        verify_return_error = 1;
                 else if (strcmp(*argv,"-serverpref") == 0)
                         { off|=SSL_OP_CIPHER_SERVER_PREFERENCE; }
+                else if (strcmp(*argv,"-legacy_renegotiation") == 0)
+                        off|=SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;
                 else if (strcmp(*argv,"-cipher") == 0)
                         {
                         if (--argc < 1) goto bad;
@@ -993,6 +1089,27 @@ int MAIN(int argc, char *argv[])
                         { no_dhe=1; }
                 else if (strcmp(*argv,"-no_ecdhe") == 0)
                         { no_ecdhe=1; }
+#ifndef OPENSSL_NO_PSK
+                else if (strcmp(*argv,"-psk_hint") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        psk_identity_hint= *(++argv);
+                        }
+                else if (strcmp(*argv,"-psk") == 0)
+                        {
+                        size_t i;
+
+                        if (--argc < 1) goto bad;
+                        psk_key=*(++argv);
+                        for (i=0; i<strlen(psk_key); i++)
+                                {
+                                if (isxdigit((int)psk_key[i]))
+                                        continue;
+                                BIO_printf(bio_err,"Not a hex number '%s'\n",*argv);
+                                goto bad;
+                                }
+                        }
+#endif
                 else if (strcmp(*argv,"-www") == 0)
                         { www=1; }
                 else if (strcmp(*argv,"-WWW") == 0)
@@ -1005,6 +1122,8 @@ int MAIN(int argc, char *argv[])
                         { off|=SSL_OP_NO_SSLv3; }
                 else if (strcmp(*argv,"-no_tls1") == 0)
                         { off|=SSL_OP_NO_TLSv1; }
+                else if (strcmp(*argv,"-no_comp") == 0)
+                        { off|=SSL_OP_NO_COMPRESSION; }
 #ifndef OPENSSL_NO_TLSEXT
                 else if (strcmp(*argv,"-no_ticket") == 0)
                         { off|=SSL_OP_NO_TICKET; }
@@ -1032,7 +1151,7 @@ int MAIN(int argc, char *argv[])
                 else if (strcmp(*argv,"-mtu") == 0)
                         {
                         if (--argc < 1) goto bad;
-                        mtu = atol(*(++argv));
+                        socket_mtu = atol(*(++argv));
                         }
                 else if (strcmp(*argv, "-chain") == 0)
                         cert_chain = 1;
@@ -1074,7 +1193,7 @@ int MAIN(int argc, char *argv[])
                         }
                         
 #endif
-#ifndef OPENSSL_NO_JPAKE
+#if !defined(OPENSSL_NO_JPAKE) && !defined(OPENSSL_NO_PSK)
                 else if (strcmp(*argv,"-jpake") == 0)
                         {
                         if (--argc < 1) goto bad;
@@ -1097,6 +1216,26 @@ bad:
                 goto end;
                 }
 
+#if !defined(OPENSSL_NO_JPAKE) && !defined(OPENSSL_NO_PSK)
+        if (jpake_secret)
+                {
+                if (psk_key)
+                        {
+                        BIO_printf(bio_err,
+                                   "Can't use JPAKE and PSK together\n");
+                        goto end;
+                        }
+                psk_identity = "JPAKE";
+                if (cipher)
+                        {
+                        BIO_printf(bio_err, "JPAKE sets cipher to PSK\n");
+                        goto end;
+                        }
+                cipher = "PSK";
+                }
+
+#endif
+
         SSL_load_error_strings();
         OpenSSL_add_ssl_algorithms();
 
@@ -1159,6 +1298,8 @@ bad:
                         }
 #endif
                 }
+
+
         if (s_dcert_file)
                 {
 
@@ -1253,8 +1394,10 @@ bad:
         if (socket_type == SOCK_DGRAM) SSL_CTX_set_read_ahead(ctx, 1);
 
         if (state) SSL_CTX_set_info_callback(ctx,apps_ssl_info_callback);
-
-        SSL_CTX_sess_set_cache_size(ctx,128);
+        if (no_cache)
+                SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
+        else
+                SSL_CTX_sess_set_cache_size(ctx,128);
 
 #if 0
         if (cipher == NULL) cipher=getenv("SSL_CIPHER");
@@ -1275,8 +1418,9 @@ bad:
                 ERR_print_errors(bio_err);
                 /* goto end; */
                 }
-        store = SSL_CTX_get_cert_store(ctx);
-        X509_STORE_set_flags(store, vflags);
+        if (vpm)
+                SSL_CTX_set1_param(ctx, vpm);
+
 #ifndef OPENSSL_NO_TLSEXT
         if (s_cert2)
                 {
@@ -1312,28 +1456,28 @@ bad:
                 if (bugs) SSL_CTX_set_options(ctx2,SSL_OP_ALL);
                 if (hack) SSL_CTX_set_options(ctx2,SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG);
                 SSL_CTX_set_options(ctx2,off);
-
                 /* DTLS: partial reads end up discarding unread UDP bytes :-( 
                  * Setting read ahead solves this problem.
                  */
                 if (socket_type == SOCK_DGRAM) SSL_CTX_set_read_ahead(ctx2, 1);
 
-
                 if (state) SSL_CTX_set_info_callback(ctx2,apps_ssl_info_callback);
 
-                SSL_CTX_sess_set_cache_size(ctx2,128);
+                if (no_cache)
+                        SSL_CTX_set_session_cache_mode(ctx2,SSL_SESS_CACHE_OFF);
+                else
+                        SSL_CTX_sess_set_cache_size(ctx2,128);
 
                 if ((!SSL_CTX_load_verify_locations(ctx2,CAfile,CApath)) ||
                         (!SSL_CTX_set_default_verify_paths(ctx2)))
                         {
                         ERR_print_errors(bio_err);
                         }
-                store = SSL_CTX_get_cert_store(ctx2);
-                X509_STORE_set_flags(store, vflags);
+                if (vpm)
+                        SSL_CTX_set1_param(ctx2, vpm);
                 }
 #endif 
 
-
 #ifndef OPENSSL_NO_DH
         if (!no_dhe)
                 {
@@ -1409,10 +1553,10 @@ bad:
                 else
                         {
                         BIO_printf(bio_s_out,"Using default temp ECDH parameters\n");
-                        ecdh = EC_KEY_new_by_curve_name(NID_sect163r2);
+                        ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
                         if (ecdh == NULL) 
                                 {
-                                BIO_printf(bio_err, "unable to create curve (sect163r2)\n");
+                                BIO_printf(bio_err, "unable to create curve (nistp256)\n");
                                 goto end;
                                 }
                         }
@@ -1447,7 +1591,7 @@ bad:
 #ifndef OPENSSL_NO_TLSEXT
                 if (ctx2) 
                         SSL_CTX_set_tmp_rsa_callback(ctx2,tmp_rsa_cb);
-#endif  
+#endif          
                 }
 #else
         if (!no_tmp_rsa && SSL_CTX_need_tmp_RSA(ctx))
@@ -1480,11 +1624,34 @@ bad:
 #endif
 #endif
 
-        if (cipher != NULL)
-                if(!SSL_CTX_set_cipher_list(ctx,cipher)) {
-                BIO_printf(bio_err,"error setting cipher list\n");
+#ifndef OPENSSL_NO_PSK
+#ifdef OPENSSL_NO_JPAKE
+        if (psk_key != NULL)
+#else
+        if (psk_key != NULL || jpake_secret)
+#endif
+                {
+                if (s_debug)
+                        BIO_printf(bio_s_out, "PSK key given or JPAKE in use, setting server callback\n");
+                SSL_CTX_set_psk_server_callback(ctx, psk_server_cb);
+                }
+
+        if (!SSL_CTX_use_psk_identity_hint(ctx, psk_identity_hint))
+                {
+                BIO_printf(bio_err,"error setting PSK identity hint to context\n");
                 ERR_print_errors(bio_err);
                 goto end;
+                }
+#endif
+
+        if (cipher != NULL)
+                {
+                if(!SSL_CTX_set_cipher_list(ctx,cipher))
+                        {
+                        BIO_printf(bio_err,"error setting cipher list\n");
+                        ERR_print_errors(bio_err);
+                        goto end;
+                        }
 #ifndef OPENSSL_NO_TLSEXT
                 if (ctx2 && !SSL_CTX_set_cipher_list(ctx2,cipher))
                         {
@@ -1493,11 +1660,15 @@ bad:
                         goto end;
                         }
 #endif
-        }
+                }
         SSL_CTX_set_verify(ctx,s_server_verify,verify_callback);
         SSL_CTX_set_session_id_context(ctx,(void*)&s_server_session_id_context,
                 sizeof s_server_session_id_context);
 
+        /* Set DTLS cookie generation and verification callbacks */
+        SSL_CTX_set_cookie_generate_cb(ctx, generate_cookie_callback);
+        SSL_CTX_set_cookie_verify_cb(ctx, verify_cookie_callback);
+
 #ifndef OPENSSL_NO_TLSEXT
         if (ctx2)
                 {
@@ -1512,6 +1683,7 @@ bad:
                 SSL_CTX_set_tlsext_servername_arg(ctx, &tlsextcbp);
                 }
 #endif
+
         if (CAfile != NULL)
                 {
                 SSL_CTX_set_client_CA_list(ctx,SSL_load_client_CA_file(CAfile));
@@ -1520,7 +1692,9 @@ bad:
                         SSL_CTX_set_client_CA_list(ctx2,SSL_load_client_CA_file(CAfile));
 #endif
                 }
+
         BIO_printf(bio_s_out,"ACCEPT\n");
+        (void)BIO_flush(bio_s_out);
         if (www)
                 do_server(port,socket_type,&accept_socket,www_body, context);
         else
@@ -1591,8 +1765,11 @@ static int sv_body(char *hostname, int s, unsigned char *context)
         unsigned long l;
         SSL *con=NULL;
         BIO *sbio;
-#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE)
+        struct timeval timeout;
+#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS) || defined(OPENSSL_SYS_NETWARE) || defined(OPENSSL_SYS_BEOS_R5)
         struct timeval tv;
+#else
+        struct timeval *timeoutp;
 #endif
 
         if ((buf=OPENSSL_malloc(bufsize)) == NULL)
@@ -1641,14 +1818,18 @@ static int sv_body(char *hostname, int s, unsigned char *context)
                                                  strlen((char *)context));
         }
         SSL_clear(con);
+#if 0
+#ifdef TLSEXT_TYPE_opaque_prf_input
+        SSL_set_tlsext_opaque_prf_input(con, "Test server", 11);
+#endif
+#endif
 
         if (SSL_version(con) == DTLS1_VERSION)
                 {
-                struct timeval timeout;
 
                 sbio=BIO_new_dgram(s,BIO_NOCLOSE);
 
-                if ( enable_timeouts)
+                if (enable_timeouts)
                         {
                         timeout.tv_sec = 0;
                         timeout.tv_usec = DGRAM_RCV_TIMEOUT;
@@ -1659,11 +1840,10 @@ static int sv_body(char *hostname, int s, unsigned char *context)
                         BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_SEND_TIMEOUT, 0, &timeout);
                         }
 
-                
-                if ( mtu > 0)
+                if (socket_mtu > 28)
                         {
                         SSL_set_options(con, SSL_OP_NO_QUERY_MTU);
-                        SSL_set_mtu(con, mtu);
+                        SSL_set_mtu(con, socket_mtu - 28);
                         }
                 else
                         /* want to do MTU discovery */
@@ -1722,10 +1902,10 @@ static int sv_body(char *hostname, int s, unsigned char *context)
                 if (!read_from_sslcon)
                         {
                         FD_ZERO(&readfds);
-#if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_NETWARE)
-                        FD_SET(fileno(stdin),&readfds);
+#if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_NETWARE) && !defined(OPENSSL_SYS_BEOS_R5)
+                        openssl_fdset(fileno(stdin),&readfds);
 #endif
-                        FD_SET(s,&readfds);
+                        openssl_fdset(s,&readfds);
                         /* Note: under VMS with SOCKETSHR the second parameter is
                          * currently of type (int *) whereas under other systems
                          * it is (void *) if you don't have a cast it will choke
@@ -1744,8 +1924,31 @@ static int sv_body(char *hostname, int s, unsigned char *context)
                         if((i < 0) || (!i && !_kbhit() ) )continue;
                         if(_kbhit())
                                 read_from_terminal = 1;
+#elif defined(OPENSSL_SYS_BEOS_R5)
+                        /* Under BeOS-R5 the situation is similar to DOS */
+                        tv.tv_sec = 1;
+                        tv.tv_usec = 0;
+                        (void)fcntl(fileno(stdin), F_SETFL, O_NONBLOCK);
+                        i=select(width,(void *)&readfds,NULL,NULL,&tv);
+                        if ((i < 0) || (!i && read(fileno(stdin), buf, 0) < 0))
+                                continue;
+                        if (read(fileno(stdin), buf, 0) >= 0)
+                                read_from_terminal = 1;
+                        (void)fcntl(fileno(stdin), F_SETFL, 0);
 #else
-                        i=select(width,(void *)&readfds,NULL,NULL,NULL);
+                        if ((SSL_version(con) == DTLS1_VERSION) &&
+                                DTLSv1_get_timeout(con, &timeout))
+                                timeoutp = &timeout;
+                        else
+                                timeoutp = NULL;
+
+                        i=select(width,(void *)&readfds,NULL,NULL,timeoutp);
+
+                        if ((SSL_version(con) == DTLS1_VERSION) && DTLSv1_handle_timeout(con) > 0)
+                                {
+                                BIO_printf(bio_err,"TIMEOUT occured\n");
+                                }
+
                         if (i <= 0) continue;
                         if (FD_ISSET(fileno(stdin),&readfds))
                                 read_from_terminal = 1;
@@ -1759,7 +1962,7 @@ static int sv_body(char *hostname, int s, unsigned char *context)
                                 {
                                 int j, lf_num;
 
-                                i=read(fileno(stdin), buf, bufsize/2);
+                                i=raw_read_stdin(buf, bufsize/2);
                                 lf_num = 0;
                                 /* both loops are skipped when i <= 0 */
                                 for (j = 0; j < i; j++)
@@ -1778,7 +1981,7 @@ static int sv_body(char *hostname, int s, unsigned char *context)
                                 assert(lf_num == 0);
                                 }
                         else
-                                i=read(fileno(stdin),buf,bufsize);
+                                i=raw_read_stdin(buf,bufsize);
                         if (!s_quiet)
                                 {
                                 if ((i <= 0) || (buf[0] == 'Q'))
@@ -1798,6 +2001,7 @@ static int sv_body(char *hostname, int s, unsigned char *context)
                                         ret= -11;*/
                                         goto err;
                                         }
+
                                 if ((buf[0] == 'r') && 
                                         ((buf[1] == '\n') || (buf[1] == '\r')))
                                         {
@@ -1894,7 +2098,7 @@ again:
 #ifdef CHARSET_EBCDIC
                                         ascii2ebcdic(buf,buf,i);
 #endif
-                                        write(fileno(stdout),buf,
+                                        raw_write_stdout(buf,
                                                 (unsigned int)i);
                                         if (SSL_pending(con)) goto again;
                                         break;
@@ -1918,13 +2122,16 @@ again:
                         }
                 }
 err:
-        BIO_printf(bio_s_out,"shutting down SSL\n");
+        if (con != NULL)
+                {
+                BIO_printf(bio_s_out,"shutting down SSL\n");
 #if 1
-        SSL_set_shutdown(con,SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
+                SSL_set_shutdown(con,SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
 #else
-        SSL_shutdown(con);
+                SSL_shutdown(con);
 #endif
-        if (con != NULL) SSL_free(con);
+                SSL_free(con);
+                }
         BIO_printf(bio_s_out,"CONNECTION CLOSED\n");
         if (buf != NULL)
                 {
@@ -2002,6 +2209,8 @@ static int init_ssl_connection(SSL *con)
                         con->kssl_ctx->client_princ);
                 }
 #endif /* OPENSSL_NO_KRB5 */
+        BIO_printf(bio_s_out, "Secure Renegotiation IS%s supported\n",
+                      SSL_get_secure_renegotiation_support(con) ? "" : " NOT");
         return(1);
         }
 
@@ -2046,9 +2255,8 @@ static int www_body(char *hostname, int s, unsigned char *context)
         char *buf=NULL;
         int ret=1;
         int i,j,k,blank,dot;
-        struct stat st_buf;
         SSL *con;
-        SSL_CIPHER *c;
+        const SSL_CIPHER *c;
         BIO *io,*ssl_bio,*sbio;
         long total_bytes;
 
@@ -2318,14 +2526,7 @@ static int www_body(char *hostname, int s, unsigned char *context)
 #endif
 
                         /* if a directory, do the index thang */
-                        if (stat(p,&st_buf) < 0)
-                                {
-                                BIO_puts(io,text);
-                                BIO_printf(io,"Error accessing '%s'\r\n",p);
-                                ERR_print_errors(io);
-                                break;
-                                }
-                        if (S_ISDIR(st_buf.st_mode))
+                        if (app_isdir(p)>0)
                                 {
 #if 0 /* must check buffer size */
                                 strcat(p,"/index.html");