1 /* apps/s_cb.c */
2 /* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com)
3 * All rights reserved.
4 *
5 * This package is an SSL implementation written
6 * by Eric Young (eay@cryptsoft.com).
7 * The implementation was written so as to conform with Netscapes SSL.
8 *
9 * This library is free for commercial and non-commercial use as long as
10 * the following conditions are aheared to. The following conditions
11 * apply to all code found in this distribution, be it the RC4, RSA,
12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation
13 * included with this distribution is covered by the same copyright terms
14 * except that the holder is Tim Hudson (tjh@cryptsoft.com).
15 *
16 * Copyright remains Eric Young's, and as such any Copyright notices in
17 * the code are not to be removed.
18 * If this package is used in a product, Eric Young should be given attribution
19 * as the author of the parts of the library used.
20 * This can be in the form of a textual message at program startup or
21 * in documentation (online or textual) provided with the package.
22 *
23 * Redistribution and use in source and binary forms, with or without
24 * modification, are permitted provided that the following conditions
25 * are met:
26 * 1. Redistributions of source code must retain the copyright
27 * notice, this list of conditions and the following disclaimer.
28 * 2. Redistributions in binary form must reproduce the above copyright
29 * notice, this list of conditions and the following disclaimer in the
30 * documentation and/or other materials provided with the distribution.
31 * 3. All advertising materials mentioning features or use of this software
32 * must display the following acknowledgement:
33 * "This product includes cryptographic software written by
34 * Eric Young (eay@cryptsoft.com)"
35 * The word 'cryptographic' can be left out if the rouines from the library
36 * being used are not cryptographic related :-).
37 * 4. If you include any Windows specific code (or a derivative thereof) from
38 * the apps directory (application code) you must include an acknowledgement:
39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
40 *
41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
51 * SUCH DAMAGE.
52 *
53 * The licence and distribution terms for any publically available version or
54 * derivative of this code cannot be changed. i.e. this code cannot simply be
55 * copied and put under another distribution licence
56 * [including the GNU Public Licence.]
57 */
58
59 #include <stdio.h>
60 #include <stdlib.h>
61 #define USE_SOCKETS
62 #define NON_MAIN
63 #include "apps.h"
64 #undef NON_MAIN
65 #undef USE_SOCKETS
66 #include "openssl/err.h"
67 #include "openssl/x509.h"
68 #include "openssl/ssl.h"
69 #include "s_apps.h"
70
71 int verify_depth=0;
72 int verify_error=X509_V_OK;
73
74 /* should be X509 * but we can just have them as char *. */
verify_callback(ok,ctx)75 int MS_CALLBACK verify_callback(ok, ctx)
76 int ok;
77 X509_STORE_CTX *ctx;
78 {
79 char buf[256];
80 X509 *err_cert;
81 int err,depth;
82
83 err_cert=X509_STORE_CTX_get_current_cert(ctx);
84 err= X509_STORE_CTX_get_error(ctx);
85 depth= X509_STORE_CTX_get_error_depth(ctx);
86
87 X509_NAME_oneline(X509_get_subject_name(err_cert),buf,256);
88 BIO_printf(bio_err,"depth=%d %s\n",depth,buf);
89 if (!ok)
90 {
91 BIO_printf(bio_err,"verify error:num=%d:%s\n",err,
92 X509_verify_cert_error_string(err));
93 if (verify_depth >= depth)
94 {
95 ok=1;
96 verify_error=X509_V_OK;
97 }
98 else
99 {
100 ok=0;
101 verify_error=X509_V_ERR_CERT_CHAIN_TOO_LONG;
102 }
103 }
104 switch (ctx->error)
105 {
106 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
107 X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert),buf,256);
108 BIO_printf(bio_err,"issuer= %s\n",buf);
109 break;
110 case X509_V_ERR_CERT_NOT_YET_VALID:
111 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
112 BIO_printf(bio_err,"notBefore=");
113 ASN1_UTCTIME_print(bio_err,X509_get_notBefore(ctx->current_cert));
114 BIO_printf(bio_err,"\n");
115 break;
116 case X509_V_ERR_CERT_HAS_EXPIRED:
117 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
118 BIO_printf(bio_err,"notAfter=");
119 ASN1_UTCTIME_print(bio_err,X509_get_notAfter(ctx->current_cert));
120 BIO_printf(bio_err,"\n");
121 break;
122 }
123 BIO_printf(bio_err,"verify return:%d\n",ok);
124 return(ok);
125 }
126
set_cert_stuff(ctx,cert_file,key_file)127 int set_cert_stuff(ctx, cert_file, key_file)
128 SSL_CTX *ctx;
129 char *cert_file;
130 char *key_file;
131 {
132 if (cert_file != NULL)
133 {
134 SSL *ssl;
135 X509 *x509;
136
137 if (SSL_CTX_use_certificate_file(ctx,cert_file,
138 SSL_FILETYPE_PEM) <= 0)
139 {
140 BIO_printf(bio_err,"unable to set certificate file\n");
141 ERR_print_errors(bio_err);
142 return(0);
143 }
144 if (key_file == NULL) key_file=cert_file;
145 if (SSL_CTX_use_PrivateKey_file(ctx,key_file,
146 SSL_FILETYPE_PEM) <= 0)
147 {
148 BIO_printf(bio_err,"unable to set public key file\n");
149 ERR_print_errors(bio_err);
150 return(0);
151 }
152
153 ssl=SSL_new(ctx);
154 x509=SSL_get_certificate(ssl);
155
156 if (x509 != NULL)
157 EVP_PKEY_copy_parameters(X509_get_pubkey(x509),
158 SSL_get_privatekey(ssl));
159 SSL_free(ssl);
160
161 /* If we are using DSA, we can copy the parameters from
162 * the private key */
163
164
165 /* Now we know that a key and cert have been set against
166 * the SSL context */
167 if (!SSL_CTX_check_private_key(ctx))
168 {
169 BIO_printf(bio_err,"Private key does not match the certificate public key\n");
170 return(0);
171 }
172 }
173 return(1);
174 }
175
bio_dump_cb(bio,cmd,argp,argi,argl,ret)176 long MS_CALLBACK bio_dump_cb(bio,cmd,argp,argi,argl,ret)
177 BIO *bio;
178 int cmd;
179 char *argp;
180 int argi;
181 long argl;
182 long ret;
183 {
184 BIO *out;
185
186 out=(BIO *)BIO_get_callback_arg(bio);
187 if (out == NULL) return(ret);
188
189 if (cmd == (BIO_CB_READ|BIO_CB_RETURN))
190 {
191 BIO_printf(out,"read from %08X [%08lX] (%d bytes => %ld (0x%X))\n",
192 bio,argp,argi,ret,ret);
193 BIO_dump(out,argp,(int)ret);
194 return(ret);
195 }
196 else if (cmd == (BIO_CB_WRITE|BIO_CB_RETURN))
197 {
198 BIO_printf(out,"write to %08X [%08lX] (%d bytes => %ld (0x%X))\n",
199 bio,argp,argi,ret,ret);
200 BIO_dump(out,argp,(int)ret);
201 }
202 return(ret);
203 }
204
apps_ssl_info_callback(s,where,ret)205 void MS_CALLBACK apps_ssl_info_callback(s,where,ret)
206 SSL *s;
207 int where;
208 int ret;
209 {
210 char *str;
211 int w;
212
213 w=where& ~SSL_ST_MASK;
214
215 if (w & SSL_ST_CONNECT) str="SSL_connect";
216 else if (w & SSL_ST_ACCEPT) str="SSL_accept";
217 else str="undefined";
218
219 if (where & SSL_CB_LOOP)
220 {
221 BIO_printf(bio_err,"%s:%s\n",str,SSL_state_string_long(s));
222 }
223 else if (where & SSL_CB_ALERT)
224 {
225 str=(where & SSL_CB_READ)?"read":"write";
226 BIO_printf(bio_err,"SSL3 alert %s:%s:%s\n",
227 str,
228 SSL_alert_type_string_long(ret),
229 SSL_alert_desc_string_long(ret));
230 }
231 else if (where & SSL_CB_EXIT)
232 {
233 if (ret == 0)
234 BIO_printf(bio_err,"%s:failed in %s\n",
235 str,SSL_state_string_long(s));
236 else if (ret < 0)
237 {
238 BIO_printf(bio_err,"%s:error in %s\n",
239 str,SSL_state_string_long(s));
240 }
241 }
242 }
243
244