1 /*! \file ssl/ssl_lib.c

     2  *  \brief Version independent SSL functions.

     3  */

     4 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)

     5  * All rights reserved.

     6  *

     7  * This package is an SSL implementation written

     8  * by Eric Young (eay@cryptsoft.com).

     9  * The implementation was written so as to conform with Netscapes SSL.

    10  * 

    11  * This library is free for commercial and non-commercial use as long as

    12  * the following conditions are aheared to.  The following conditions

    13  * apply to all code found in this distribution, be it the RC4, RSA,

    14  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation

    15  * included with this distribution is covered by the same copyright terms

    16  * except that the holder is Tim Hudson (tjh@cryptsoft.com).

    17  * 

    18  * Copyright remains Eric Young's, and as such any Copyright notices in

    19  * the code are not to be removed.

    20  * If this package is used in a product, Eric Young should be given attribution

    21  * as the author of the parts of the library used.

    22  * This can be in the form of a textual message at program startup or

    23  * in documentation (online or textual) provided with the package.

    24  * 

    25  * Redistribution and use in source and binary forms, with or without

    26  * modification, are permitted provided that the following conditions

    27  * are met:

    28  * 1. Redistributions of source code must retain the copyright

    29  *    notice, this list of conditions and the following disclaimer.

    30  * 2. Redistributions in binary form must reproduce the above copyright

    31  *    notice, this list of conditions and the following disclaimer in the

    32  *    documentation and/or other materials provided with the distribution.

    33  * 3. All advertising materials mentioning features or use of this software

    34  *    must display the following acknowledgement:

    35  *    "This product includes cryptographic software written by

    36  *     Eric Young (eay@cryptsoft.com)"

    37  *    The word 'cryptographic' can be left out if the rouines from the library

    38  *    being used are not cryptographic related :-).

    39  * 4. If you include any Windows specific code (or a derivative thereof) from 

    40  *    the apps directory (application code) you must include an acknowledgement:

    41  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"

    42  * 

    43  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND

    44  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

    45  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

    46  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE

    47  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

    48  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

    49  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

    50  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

    51  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

    52  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

    53  * SUCH DAMAGE.

    54  * 

    55  * The licence and distribution terms for any publically available version or

    56  * derivative of this code cannot be changed.  i.e. this code cannot simply be

    57  * copied and put under another distribution licence

    58  * [including the GNU Public Licence.]

    59  */

    60 /* ====================================================================

    61  * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.

    62  *

    63  * Redistribution and use in source and binary forms, with or without

    64  * modification, are permitted provided that the following conditions

    65  * are met:

    66  *

    67  * 1. Redistributions of source code must retain the above copyright

    68  *    notice, this list of conditions and the following disclaimer. 

    69  *

    70  * 2. Redistributions in binary form must reproduce the above copyright

    71  *    notice, this list of conditions and the following disclaimer in

    72  *    the documentation and/or other materials provided with the

    73  *    distribution.

    74  *

    75  * 3. All advertising materials mentioning features or use of this

    76  *    software must display the following acknowledgment:

    77  *    "This product includes software developed by the OpenSSL Project

    78  *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"

    79  *

    80  * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

    81  *    endorse or promote products derived from this software without

    82  *    prior written permission. For written permission, please contact

    83  *    openssl-core@openssl.org.

    84  *

    85  * 5. Products derived from this software may not be called "OpenSSL"

    86  *    nor may "OpenSSL" appear in their names without prior written

    87  *    permission of the OpenSSL Project.

    88  *

    89  * 6. Redistributions of any form whatsoever must retain the following

    90  *    acknowledgment:

    91  *    "This product includes software developed by the OpenSSL Project

    92  *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"

    93  *

    94  * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

    95  * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

    96  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

    97  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

    98  * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

    99  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

   100  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

   101  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

   102  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

   103  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

   104  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

   105  * OF THE POSSIBILITY OF SUCH DAMAGE.

   106  * ====================================================================

   107  *

   108  * This product includes cryptographic software written by Eric Young

   109  * (eay@cryptsoft.com).  This product includes software written by Tim

   110  * Hudson (tjh@cryptsoft.com).

   111  *

   112  */

   113 /* ====================================================================

   114  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.

   115  * ECC cipher suite support in OpenSSL originally developed by 

   116  * SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.

   117  */

   118 /*

   119  © Portions copyright (c) 2006 Nokia Corporation.  All rights reserved.

   120  */

   121  

   122 #ifdef REF_CHECK

   123 #  include <assert.h>

   124 #endif

   125 #include <stdio.h>

   126 #include "ssl_locl.h"

   127 #include "kssl_lcl.h"

   128 #include <openssl/objects.h>

   129 #include <openssl/lhash.h>

   130 #include <openssl/x509v3.h>

   131 #ifndef OPENSSL_NO_DH

   132 #include <openssl/dh.h>

   133 #endif

   134 

   135 #ifdef EMULATOR

   136 	#include "libssl_wsd.h"

   137 #endif

   138 

   139 const char *SSL_version_str=OPENSSL_VERSION_TEXT;

   140 

   141 #ifdef EMULATOR

   142 	GET_GLOBAL_VAR_FROM_TLS(ssl3_undef_enc_method,ssl_lib,SSL3_ENC_METHOD)

   143 	

   144 	#define ssl3_undef_enc_method (GET_WSD_VAR_NAME(ssl3_undef_enc_method,ssl_lib,g)())

   145 #endif

   146 

   147 #ifndef EMULATOR

   148 SSL3_ENC_METHOD ssl3_undef_enc_method={

   149 #else

   150 const SSL3_ENC_METHOD temp_ssl3_undef_enc_method={

   151 #endif

   152 	/* evil casts, but these functions are only called if there's a library bug */

   153 	(int (*)(SSL *,int))ssl_undefined_function,

   154 	(int (*)(SSL *, unsigned char *, int))ssl_undefined_function,

   155 	ssl_undefined_function,

   156 	(int (*)(SSL *, unsigned char *, unsigned char *, int))ssl_undefined_function,

   157 	(int (*)(SSL*, int))ssl_undefined_function,

   158 	(int (*)(SSL *, EVP_MD_CTX *, EVP_MD_CTX *, const char*, int, unsigned char *))ssl_undefined_function,

   159 	0,	/* finish_mac_length */

   160 	(int (*)(SSL *, EVP_MD_CTX *, unsigned char *))ssl_undefined_function,

   161 	NULL,	/* client_finished_label */

   162 	0,	/* client_finished_label_len */

   163 	NULL,	/* server_finished_label */

   164 	0,	/* server_finished_label_len */

   165 	(int (*)(int))ssl_undefined_function

   166 	};

   167 

   168 EXPORT_C int SSL_clear(SSL *s)

   169 	{

   170 

   171 	if (s->method == NULL)

   172 		{

   173 		SSLerr(SSL_F_SSL_CLEAR,SSL_R_NO_METHOD_SPECIFIED);

   174 		return(0);

   175 		}

   176 

   177 	if (ssl_clear_bad_session(s))

   178 		{

   179 		SSL_SESSION_free(s->session);

   180 		s->session=NULL;

   181 		}

   182 

   183 	s->error=0;

   184 	s->hit=0;

   185 	s->shutdown=0;

   186 

   187 #if 0 /* Disabled since version 1.10 of this file (early return not

   188        * needed because SSL_clear is not called when doing renegotiation) */

   189 	/* This is set if we are doing dynamic renegotiation so keep

   190 	 * the old cipher.  It is sort of a SSL_clear_lite :-) */

   191 	if (s->new_session) return(1);

   192 #else

   193 	if (s->new_session)

   194 		{

   195 		SSLerr(SSL_F_SSL_CLEAR,ERR_R_INTERNAL_ERROR);

   196 		return 0;

   197 		}

   198 #endif

   199 

   200 	s->type=0;

   201 

   202 	s->state=SSL_ST_BEFORE|((s->server)?SSL_ST_ACCEPT:SSL_ST_CONNECT);

   203 

   204 	s->version=s->method->version;

   205 	s->client_version=s->version;

   206 	s->rwstate=SSL_NOTHING;

   207 	s->rstate=SSL_ST_READ_HEADER;

   208 #if 0

   209 	s->read_ahead=s->ctx->read_ahead;

   210 #endif

   211 

   212 	if (s->init_buf != NULL)

   213 		{

   214 		BUF_MEM_free(s->init_buf);

   215 		s->init_buf=NULL;

   216 		}

   217 

   218 	ssl_clear_cipher_ctx(s);

   219 

   220 	s->first_packet=0;

   221 

   222 #if 1

   223 	/* Check to see if we were changed into a different method, if

   224 	 * so, revert back if we are not doing session-id reuse. */

   225 	if (!s->in_handshake && (s->session == NULL) && (s->method != s->ctx->method))

   226 		{

   227 		s->method->ssl_free(s);

   228 		s->method=s->ctx->method;

   229 		if (!s->method->ssl_new(s))

   230 			return(0);

   231 		}

   232 	else

   233 #endif

   234 		s->method->ssl_clear(s);

   235 	return(1);

   236 	}

   237 

   238 /** Used to change an SSL_CTXs default SSL method type */

   239 EXPORT_C int SSL_CTX_set_ssl_version(SSL_CTX *ctx,SSL_METHOD *meth)

   240 	{

   241 	STACK_OF(SSL_CIPHER) *sk;

   242 

   243 	ctx->method=meth;

   244 

   245 	sk=ssl_create_cipher_list(ctx->method,&(ctx->cipher_list),

   246 		&(ctx->cipher_list_by_id),SSL_DEFAULT_CIPHER_LIST);

   247 	if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0))

   248 		{

   249 		SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION,SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);

   250 		return(0);

   251 		}

   252 	return(1);

   253 	}

   254 

   255 EXPORT_C SSL *SSL_new(SSL_CTX *ctx)

   256 	{

   257 	SSL *s;

   258 

   259 	if (ctx == NULL)

   260 		{

   261 		SSLerr(SSL_F_SSL_NEW,SSL_R_NULL_SSL_CTX);

   262 		return(NULL);

   263 		}

   264 	if (ctx->method == NULL)

   265 		{

   266 		SSLerr(SSL_F_SSL_NEW,SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION);

   267 		return(NULL);

   268 		}

   269 

   270 	s=(SSL *)OPENSSL_malloc(sizeof(SSL));

   271 	if (s == NULL) goto err;

   272 	memset(s,0,sizeof(SSL));

   273 

   274 #ifndef	OPENSSL_NO_KRB5

   275 	s->kssl_ctx = kssl_ctx_new();

   276 #endif	/* OPENSSL_NO_KRB5 */

   277 

   278 	s->options=ctx->options;

   279 	s->mode=ctx->mode;

   280 	s->max_cert_list=ctx->max_cert_list;

   281 

   282 	if (ctx->cert != NULL)

   283 		{

   284 		/* Earlier library versions used to copy the pointer to

   285 		 * the CERT, not its contents; only when setting new

   286 		 * parameters for the per-SSL copy, ssl_cert_new would be

   287 		 * called (and the direct reference to the per-SSL_CTX

   288 		 * settings would be lost, but those still were indirectly

   289 		 * accessed for various purposes, and for that reason they

   290 		 * used to be known as s->ctx->default_cert).

   291 		 * Now we don't look at the SSL_CTX's CERT after having

   292 		 * duplicated it once. */

   293 

   294 		s->cert = ssl_cert_dup(ctx->cert);

   295 		if (s->cert == NULL)

   296 			goto err;

   297 		}

   298 	else

   299 		s->cert=NULL; /* Cannot really happen (see SSL_CTX_new) */

   300 

   301 	s->read_ahead=ctx->read_ahead;

   302 	s->msg_callback=ctx->msg_callback;

   303 	s->msg_callback_arg=ctx->msg_callback_arg;

   304 	s->verify_mode=ctx->verify_mode;

   305 #if 0

   306 	s->verify_depth=ctx->verify_depth;

   307 #endif

   308 	s->sid_ctx_length=ctx->sid_ctx_length;

   309 	OPENSSL_assert(s->sid_ctx_length <= sizeof s->sid_ctx);

   310 	memcpy(&s->sid_ctx,&ctx->sid_ctx,sizeof(s->sid_ctx));

   311 	s->verify_callback=ctx->default_verify_callback;

   312 	s->generate_session_id=ctx->generate_session_id;

   313 

   314 	s->param = X509_VERIFY_PARAM_new();

   315 	if (!s->param)

   316 		goto err;

   317 	X509_VERIFY_PARAM_inherit(s->param, ctx->param);

   318 #if 0

   319 	s->purpose = ctx->purpose;

   320 	s->trust = ctx->trust;

   321 #endif

   322 	s->quiet_shutdown=ctx->quiet_shutdown;

   323 

   324 	CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);

   325 	s->ctx=ctx;

   326 

   327 	s->verify_result=X509_V_OK;

   328 

   329 	s->method=ctx->method;

   330 

   331 	if (!s->method->ssl_new(s))

   332 		goto err;

   333 

   334 	s->references=1;

   335 	s->server=(ctx->method->ssl_accept == ssl_undefined_function)?0:1;

   336 

   337 	SSL_clear(s);

   338 

   339 	CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);

   340 

   341 	return(s);

   342 err:

   343 	if (s != NULL)

   344 		{

   345 		if (s->cert != NULL)

   346 			ssl_cert_free(s->cert);

   347 		if (s->ctx != NULL)

   348 			SSL_CTX_free(s->ctx); /* decrement reference count */

   349 		OPENSSL_free(s);

   350 		}

   351 	SSLerr(SSL_F_SSL_NEW,ERR_R_MALLOC_FAILURE);

   352 	return(NULL);

   353 	}

   354 

   355 EXPORT_C int SSL_CTX_set_session_id_context(SSL_CTX *ctx,const unsigned char *sid_ctx,

   356 				   unsigned int sid_ctx_len)

   357     {

   358     if(sid_ctx_len > sizeof ctx->sid_ctx)

   359 	{

   360 	SSLerr(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT,SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);

   361 	return 0;

   362 	}

   363     ctx->sid_ctx_length=sid_ctx_len;

   364     memcpy(ctx->sid_ctx,sid_ctx,sid_ctx_len);

   365 

   366     return 1;

   367     }

   368 

   369 EXPORT_C int SSL_set_session_id_context(SSL *ssl,const unsigned char *sid_ctx,

   370 			       unsigned int sid_ctx_len)

   371     {

   372     if(sid_ctx_len > SSL_MAX_SID_CTX_LENGTH)

   373 	{

   374 	SSLerr(SSL_F_SSL_SET_SESSION_ID_CONTEXT,SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);

   375 	return 0;

   376 	}

   377     ssl->sid_ctx_length=sid_ctx_len;

   378     memcpy(ssl->sid_ctx,sid_ctx,sid_ctx_len);

   379 

   380     return 1;

   381     }

   382 

   383 EXPORT_C int SSL_CTX_set_generate_session_id(SSL_CTX *ctx, GEN_SESSION_CB cb)

   384 	{

   385 	CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);

   386 	ctx->generate_session_id = cb;

   387 	CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);

   388 	return 1;

   389 	}

   390 

   391 EXPORT_C int SSL_set_generate_session_id(SSL *ssl, GEN_SESSION_CB cb)

   392 	{

   393 	CRYPTO_w_lock(CRYPTO_LOCK_SSL);

   394 	ssl->generate_session_id = cb;

   395 	CRYPTO_w_unlock(CRYPTO_LOCK_SSL);

   396 	return 1;

   397 	}

   398 

   399 EXPORT_C int SSL_has_matching_session_id(const SSL *ssl, const unsigned char *id,

   400 				unsigned int id_len)

   401 	{

   402 	/* A quick examination of SSL_SESSION_hash and SSL_SESSION_cmp shows how

   403 	 * we can "construct" a session to give us the desired check - ie. to

   404 	 * find if there's a session in the hash table that would conflict with

   405 	 * any new session built out of this id/id_len and the ssl_version in

   406 	 * use by this SSL. */

   407 	SSL_SESSION r, *p;

   408 

   409 	if(id_len > sizeof r.session_id)

   410 		return 0;

   411 

   412 	r.ssl_version = ssl->version;

   413 	r.session_id_length = id_len;

   414 	memcpy(r.session_id, id, id_len);

   415 	/* NB: SSLv2 always uses a fixed 16-byte session ID, so even if a

   416 	 * callback is calling us to check the uniqueness of a shorter ID, it

   417 	 * must be compared as a padded-out ID because that is what it will be

   418 	 * converted to when the callback has finished choosing it. */

   419 	if((r.ssl_version == SSL2_VERSION) &&

   420 			(id_len < SSL2_SSL_SESSION_ID_LENGTH))

   421 		{

   422 		memset(r.session_id + id_len, 0,

   423 			SSL2_SSL_SESSION_ID_LENGTH - id_len);

   424 		r.session_id_length = SSL2_SSL_SESSION_ID_LENGTH;

   425 		}

   426 

   427 	CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);

   428 	p = (SSL_SESSION *)lh_retrieve(ssl->ctx->sessions, &r);

   429 	CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);

   430 	return (p != NULL);

   431 	}

   432 

   433 EXPORT_C int SSL_CTX_set_purpose(SSL_CTX *s, int purpose)

   434 	{

   435 	return X509_VERIFY_PARAM_set_purpose(s->param, purpose);

   436 	}

   437 

   438 EXPORT_C int SSL_set_purpose(SSL *s, int purpose)

   439 	{

   440 	return X509_VERIFY_PARAM_set_purpose(s->param, purpose);

   441 	}

   442 

   443 EXPORT_C int SSL_CTX_set_trust(SSL_CTX *s, int trust)

   444 	{

   445 	return X509_VERIFY_PARAM_set_trust(s->param, trust);

   446 	}

   447 

   448 EXPORT_C int SSL_set_trust(SSL *s, int trust)

   449 	{

   450 	return X509_VERIFY_PARAM_set_trust(s->param, trust);

   451 	}

   452 

   453 EXPORT_C void SSL_free(SSL *s)

   454 	{

   455 	int i;

   456 

   457 	if(s == NULL)

   458 	    return;

   459 

   460 	i=CRYPTO_add(&s->references,-1,CRYPTO_LOCK_SSL);

   461 #ifdef REF_PRINT

   462 	REF_PRINT("SSL",s);

   463 #endif

   464 	if (i > 0) return;

   465 #ifdef REF_CHECK

   466 	if (i < 0)

   467 		{

   468 		fprintf(stderr,"SSL_free, bad reference count\n");

   469 		abort(); /* ok */

   470 		}

   471 #endif

   472 

   473 	if (s->param)

   474 		X509_VERIFY_PARAM_free(s->param);

   475 

   476 	CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);

   477 

   478 	if (s->bbio != NULL)

   479 		{

   480 		/* If the buffering BIO is in place, pop it off */

   481 		if (s->bbio == s->wbio)

   482 			{

   483 			s->wbio=BIO_pop(s->wbio);

   484 			}

   485 		BIO_free(s->bbio);

   486 		s->bbio=NULL;

   487 		}

   488 	if (s->rbio != NULL)

   489 		BIO_free_all(s->rbio);

   490 	if ((s->wbio != NULL) && (s->wbio != s->rbio))

   491 		BIO_free_all(s->wbio);

   492 

   493 	if (s->init_buf != NULL) BUF_MEM_free(s->init_buf);

   494 

   495 	/* add extra stuff */

   496 	if (s->cipher_list != NULL) sk_SSL_CIPHER_free(s->cipher_list);

   497 	if (s->cipher_list_by_id != NULL) sk_SSL_CIPHER_free(s->cipher_list_by_id);

   498 

   499 	/* Make the next call work :-) */

   500 	if (s->session != NULL)

   501 		{

   502 		ssl_clear_bad_session(s);

   503 		SSL_SESSION_free(s->session);

   504 		}

   505 

   506 	ssl_clear_cipher_ctx(s);

   507 

   508 	if (s->cert != NULL) ssl_cert_free(s->cert);

   509 	/* Free up if allocated */

   510 

   511 	if (s->ctx) SSL_CTX_free(s->ctx);

   512 	if (s->client_CA != NULL)

   513 		sk_X509_NAME_pop_free(s->client_CA,X509_NAME_free);

   514 

   515 	if (s->method != NULL) s->method->ssl_free(s);

   516 

   517 #ifndef	OPENSSL_NO_KRB5

   518 	if (s->kssl_ctx != NULL)

   519 		kssl_ctx_free(s->kssl_ctx);

   520 #endif	/* OPENSSL_NO_KRB5 */

   521 

   522 	OPENSSL_free(s);

   523 	}

   524 

   525 EXPORT_C void SSL_set_bio(SSL *s,BIO *rbio,BIO *wbio)

   526 	{

   527 	/* If the output buffering BIO is still in place, remove it

   528 	 */

   529 	if (s->bbio != NULL)

   530 		{

   531 		if (s->wbio == s->bbio)

   532 			{

   533 			s->wbio=s->wbio->next_bio;

   534 			s->bbio->next_bio=NULL;

   535 			}

   536 		}

   537 	if ((s->rbio != NULL) && (s->rbio != rbio))

   538 		BIO_free_all(s->rbio);

   539 	if ((s->wbio != NULL) && (s->wbio != wbio) && (s->rbio != s->wbio))

   540 		BIO_free_all(s->wbio);

   541 	s->rbio=rbio;

   542 	s->wbio=wbio;

   543 	}

   544 

   545 EXPORT_C BIO *SSL_get_rbio(const SSL *s)

   546 	{ return(s->rbio); }

   547 

   548 EXPORT_C BIO *SSL_get_wbio(const SSL *s)

   549 	{ return(s->wbio); }

   550 

   551 EXPORT_C int SSL_get_fd(const SSL *s)

   552 	{

   553 	return(SSL_get_rfd(s));

   554 	}

   555 

   556 EXPORT_C int SSL_get_rfd(const SSL *s)

   557 	{

   558 	int ret= -1;

   559 	BIO *b,*r;

   560 

   561 	b=SSL_get_rbio(s);

   562 	r=BIO_find_type(b,BIO_TYPE_DESCRIPTOR);

   563 	if (r != NULL)

   564 		BIO_get_fd(r,&ret);

   565 	return(ret);

   566 	}

   567 

   568 EXPORT_C int SSL_get_wfd(const SSL *s)

   569 	{

   570 	int ret= -1;

   571 	BIO *b,*r;

   572 

   573 	b=SSL_get_wbio(s);

   574 	r=BIO_find_type(b,BIO_TYPE_DESCRIPTOR);

   575 	if (r != NULL)

   576 		BIO_get_fd(r,&ret);

   577 	return(ret);

   578 	}

   579 

   580 #ifndef OPENSSL_NO_SOCK

   581 EXPORT_C int SSL_set_fd(SSL *s,int fd)

   582 	{

   583 	int ret=0;

   584 	BIO *bio=NULL;

   585 

   586 	bio=BIO_new(BIO_s_socket());

   587 

   588 	if (bio == NULL)

   589 		{

   590 		SSLerr(SSL_F_SSL_SET_FD,ERR_R_BUF_LIB);

   591 		goto err;

   592 		}

   593 	BIO_set_fd(bio,fd,BIO_NOCLOSE);

   594 	SSL_set_bio(s,bio,bio);

   595 	ret=1;

   596 err:

   597 	return(ret);

   598 	}

   599 

   600 EXPORT_C int SSL_set_wfd(SSL *s,int fd)

   601 	{

   602 	int ret=0;

   603 	BIO *bio=NULL;

   604 

   605 	if ((s->rbio == NULL) || (BIO_method_type(s->rbio) != BIO_TYPE_SOCKET)

   606 		|| ((int)BIO_get_fd(s->rbio,NULL) != fd))

   607 		{

   608 		bio=BIO_new(BIO_s_socket());

   609 

   610 		if (bio == NULL)

   611 			{ SSLerr(SSL_F_SSL_SET_WFD,ERR_R_BUF_LIB); goto err; }

   612 		BIO_set_fd(bio,fd,BIO_NOCLOSE);

   613 		SSL_set_bio(s,SSL_get_rbio(s),bio);

   614 		}

   615 	else

   616 		SSL_set_bio(s,SSL_get_rbio(s),SSL_get_rbio(s));

   617 	ret=1;

   618 err:

   619 	return(ret);

   620 	}

   621 

   622 EXPORT_C int SSL_set_rfd(SSL *s,int fd)

   623 	{

   624 	int ret=0;

   625 	BIO *bio=NULL;

   626 

   627 	if ((s->wbio == NULL) || (BIO_method_type(s->wbio) != BIO_TYPE_SOCKET)

   628 		|| ((int)BIO_get_fd(s->wbio,NULL) != fd))

   629 		{

   630 		bio=BIO_new(BIO_s_socket());

   631 

   632 		if (bio == NULL)

   633 			{

   634 			SSLerr(SSL_F_SSL_SET_RFD,ERR_R_BUF_LIB);

   635 			goto err;

   636 			}

   637 		BIO_set_fd(bio,fd,BIO_NOCLOSE);

   638 		SSL_set_bio(s,bio,SSL_get_wbio(s));

   639 		}

   640 	else

   641 		SSL_set_bio(s,SSL_get_wbio(s),SSL_get_wbio(s));

   642 	ret=1;

   643 err:

   644 	return(ret);

   645 	}

   646 #endif

   647 

   648 

   649 /* return length of latest Finished message we sent, copy to 'buf' */

   650 EXPORT_C size_t SSL_get_finished(const SSL *s, void *buf, size_t count)

   651 	{

   652 	size_t ret = 0;

   653 	

   654 	if (s->s3 != NULL)

   655 		{

   656 		ret = s->s3->tmp.finish_md_len;

   657 		if (count > ret)

   658 			count = ret;

   659 		memcpy(buf, s->s3->tmp.finish_md, count);

   660 		}

   661 	return ret;

   662 	}

   663 

   664 /* return length of latest Finished message we expected, copy to 'buf' */

   665 EXPORT_C size_t SSL_get_peer_finished(const SSL *s, void *buf, size_t count)

   666 	{

   667 	size_t ret = 0;

   668 	

   669 	if (s->s3 != NULL)

   670 		{

   671 		ret = s->s3->tmp.peer_finish_md_len;

   672 		if (count > ret)

   673 			count = ret;

   674 		memcpy(buf, s->s3->tmp.peer_finish_md, count);

   675 		}

   676 	return ret;

   677 	}

   678 

   679 

   680 EXPORT_C int SSL_get_verify_mode(const SSL *s)

   681 	{

   682 	return(s->verify_mode);

   683 	}

   684 

   685 EXPORT_C int SSL_get_verify_depth(const SSL *s)

   686 	{

   687 	return X509_VERIFY_PARAM_get_depth(s->param);

   688 	}

   689 

   690 EXPORT_C int (*SSL_get_verify_callback(const SSL *s))(int,X509_STORE_CTX *)

   691 	{

   692 	return(s->verify_callback);

   693 	}

   694 

   695 EXPORT_C int SSL_CTX_get_verify_mode(const SSL_CTX *ctx)

   696 	{

   697 	return(ctx->verify_mode);

   698 	}

   699 

   700 EXPORT_C int SSL_CTX_get_verify_depth(const SSL_CTX *ctx)

   701 	{

   702 	return X509_VERIFY_PARAM_get_depth(ctx->param);

   703 	}

   704 

   705 EXPORT_C int (*SSL_CTX_get_verify_callback(const SSL_CTX *ctx))(int,X509_STORE_CTX *)

   706 	{

   707 	return(ctx->default_verify_callback);

   708 	}

   709 

   710 EXPORT_C void SSL_set_verify(SSL *s,int mode,

   711 		    int (*callback)(int ok,X509_STORE_CTX *ctx))

   712 	{

   713 	s->verify_mode=mode;

   714 	if (callback != NULL)

   715 		s->verify_callback=callback;

   716 	}

   717 

   718 EXPORT_C void SSL_set_verify_depth(SSL *s,int depth)

   719 	{

   720 	X509_VERIFY_PARAM_set_depth(s->param, depth);

   721 	}

   722 

   723 EXPORT_C void SSL_set_read_ahead(SSL *s,int yes)

   724 	{

   725 	s->read_ahead=yes;

   726 	}

   727 

   728 EXPORT_C int SSL_get_read_ahead(const SSL *s)

   729 	{

   730 	return(s->read_ahead);

   731 	}

   732 

   733 EXPORT_C int SSL_pending(const SSL *s)

   734 	{

   735 	/* SSL_pending cannot work properly if read-ahead is enabled

   736 	 * (SSL_[CTX_]ctrl(..., SSL_CTRL_SET_READ_AHEAD, 1, NULL)),

   737 	 * and it is impossible to fix since SSL_pending cannot report

   738 	 * errors that may be observed while scanning the new data.

   739 	 * (Note that SSL_pending() is often used as a boolean value,

   740 	 * so we'd better not return -1.)

   741 	 */

   742 	return(s->method->ssl_pending(s));

   743 	}

   744 

   745 EXPORT_C X509 *SSL_get_peer_certificate(const SSL *s)

   746 	{

   747 	X509 *r;

   748 	

   749 	if ((s == NULL) || (s->session == NULL))

   750 		r=NULL;

   751 	else

   752 		r=s->session->peer;

   753 

   754 	if (r == NULL) return(r);

   755 

   756 	CRYPTO_add(&r->references,1,CRYPTO_LOCK_X509);

   757 

   758 	return(r);

   759 	}

   760 

   761 EXPORT_C STACK_OF(X509) *SSL_get_peer_cert_chain(const SSL *s)

   762 	{

   763 	STACK_OF(X509) *r;

   764 	

   765 	if ((s == NULL) || (s->session == NULL) || (s->session->sess_cert == NULL))

   766 		r=NULL;

   767 	else

   768 		r=s->session->sess_cert->cert_chain;

   769 

   770 	/* If we are a client, cert_chain includes the peer's own

   771 	 * certificate; if we are a server, it does not. */

   772 	

   773 	return(r);

   774 	}

   775 

   776 /* Now in theory, since the calling process own 't' it should be safe to

   777  * modify.  We need to be able to read f without being hassled */

   778 EXPORT_C void SSL_copy_session_id(SSL *t,const SSL *f)

   779 	{

   780 	CERT *tmp;

   781 

   782 	/* Do we need to to SSL locking? */

   783 	SSL_set_session(t,SSL_get_session(f));

   784 

   785 	/* what if we are setup as SSLv2 but want to talk SSLv3 or

   786 	 * vice-versa */

   787 	if (t->method != f->method)

   788 		{

   789 		t->method->ssl_free(t);	/* cleanup current */

   790 		t->method=f->method;	/* change method */

   791 		t->method->ssl_new(t);	/* setup new */

   792 		}

   793 

   794 	tmp=t->cert;

   795 	if (f->cert != NULL)

   796 		{

   797 		CRYPTO_add(&f->cert->references,1,CRYPTO_LOCK_SSL_CERT);

   798 		t->cert=f->cert;

   799 		}

   800 	else

   801 		t->cert=NULL;

   802 	if (tmp != NULL) ssl_cert_free(tmp);

   803 	SSL_set_session_id_context(t,f->sid_ctx,f->sid_ctx_length);

   804 	}

   805 

   806 /* Fix this so it checks all the valid key/cert options */

   807 EXPORT_C int SSL_CTX_check_private_key(const SSL_CTX *ctx)

   808 	{

   809 	if (	(ctx == NULL) ||

   810 		(ctx->cert == NULL) ||

   811 		(ctx->cert->key->x509 == NULL))

   812 		{

   813 		SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED);

   814 		return(0);

   815 		}

   816 	if 	(ctx->cert->key->privatekey == NULL)

   817 		{

   818 		SSLerr(SSL_F_SSL_CTX_CHECK_PRIVATE_KEY,SSL_R_NO_PRIVATE_KEY_ASSIGNED);

   819 		return(0);

   820 		}

   821 	return(X509_check_private_key(ctx->cert->key->x509, ctx->cert->key->privatekey));

   822 	}

   823 

   824 /* Fix this function so that it takes an optional type parameter */

   825 EXPORT_C int SSL_check_private_key(const SSL *ssl)

   826 	{

   827 	if (ssl == NULL)

   828 		{

   829 		SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,ERR_R_PASSED_NULL_PARAMETER);

   830 		return(0);

   831 		}

   832 	if (ssl->cert == NULL)

   833 		{

   834                 SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED);

   835 		return 0;

   836 		}

   837 	if (ssl->cert->key->x509 == NULL)

   838 		{

   839 		SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED);

   840 		return(0);

   841 		}

   842 	if (ssl->cert->key->privatekey == NULL)

   843 		{

   844 		SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_PRIVATE_KEY_ASSIGNED);

   845 		return(0);

   846 		}

   847 	return(X509_check_private_key(ssl->cert->key->x509,

   848 		ssl->cert->key->privatekey));

   849 	}

   850 

   851 EXPORT_C int SSL_accept(SSL *s)

   852 	{

   853 	if (s->handshake_func == 0)

   854 		/* Not properly initialized yet */

   855 		SSL_set_accept_state(s);

   856 

   857 	return(s->method->ssl_accept(s));

   858 	}

   859 

   860 EXPORT_C int SSL_connect(SSL *s)

   861 	{

   862 	if (s->handshake_func == 0)

   863 		/* Not properly initialized yet */

   864 		SSL_set_connect_state(s);

   865 

   866 	return(s->method->ssl_connect(s));

   867 	}

   868 

   869 EXPORT_C long SSL_get_default_timeout(const SSL *s)

   870 	{

   871 	return(s->method->get_timeout());

   872 	}

   873 

   874 EXPORT_C int SSL_read(SSL *s,void *buf,int num)

   875 	{

   876 	if (s->handshake_func == 0)

   877 		{

   878 		SSLerr(SSL_F_SSL_READ, SSL_R_UNINITIALIZED);

   879 		return -1;

   880 		}

   881 

   882 	if (s->shutdown & SSL_RECEIVED_SHUTDOWN)

   883 		{

   884 		s->rwstate=SSL_NOTHING;

   885 		return(0);

   886 		}

   887 	return(s->method->ssl_read(s,buf,num));

   888 	}

   889 

   890 EXPORT_C int SSL_peek(SSL *s,void *buf,int num)

   891 	{

   892 	if (s->handshake_func == 0)

   893 		{

   894 		SSLerr(SSL_F_SSL_PEEK, SSL_R_UNINITIALIZED);

   895 		return -1;

   896 		}

   897 

   898 	if (s->shutdown & SSL_RECEIVED_SHUTDOWN)

   899 		{

   900 		return(0);

   901 		}

   902 	return(s->method->ssl_peek(s,buf,num));

   903 	}

   904 

   905 EXPORT_C int SSL_write(SSL *s,const void *buf,int num)

   906 	{

   907 	if (s->handshake_func == 0)

   908 		{

   909 		SSLerr(SSL_F_SSL_WRITE, SSL_R_UNINITIALIZED);

   910 		return -1;

   911 		}

   912 

   913 	if (s->shutdown & SSL_SENT_SHUTDOWN)

   914 		{

   915 		s->rwstate=SSL_NOTHING;

   916 		SSLerr(SSL_F_SSL_WRITE,SSL_R_PROTOCOL_IS_SHUTDOWN);

   917 		return(-1);

   918 		}

   919 	return(s->method->ssl_write(s,buf,num));

   920 	}

   921 

   922 EXPORT_C int SSL_shutdown(SSL *s)

   923 	{

   924 	/* Note that this function behaves differently from what one might

   925 	 * expect.  Return values are 0 for no success (yet),

   926 	 * 1 for success; but calling it once is usually not enough,

   927 	 * even if blocking I/O is used (see ssl3_shutdown).

   928 	 */

   929 

   930 	if (s->handshake_func == 0)

   931 		{

   932 		SSLerr(SSL_F_SSL_SHUTDOWN, SSL_R_UNINITIALIZED);

   933 		return -1;

   934 		}

   935 

   936 	if ((s != NULL) && !SSL_in_init(s))

   937 		return(s->method->ssl_shutdown(s));

   938 	else

   939 		return(1);

   940 	}

   941 

   942 EXPORT_C int SSL_renegotiate(SSL *s)

   943 	{

   944 	if (s->new_session == 0)

   945 		{

   946 		s->new_session=1;

   947 		}

   948 	return(s->method->ssl_renegotiate(s));

   949 	}

   950 

   951 EXPORT_C int SSL_renegotiate_pending(SSL *s)

   952 	{

   953 	/* becomes true when negotiation is requested;

   954 	 * false again once a handshake has finished */

   955 	return (s->new_session != 0);

   956 	}

   957 

   958 EXPORT_C long SSL_ctrl(SSL *s,int cmd,long larg,void *parg)

   959 	{

   960 	long l;

   961 

   962 	switch (cmd)

   963 		{

   964 	case SSL_CTRL_GET_READ_AHEAD:

   965 		return(s->read_ahead);

   966 	case SSL_CTRL_SET_READ_AHEAD:

   967 		l=s->read_ahead;

   968 		s->read_ahead=larg;

   969 		return(l);

   970 

   971 	case SSL_CTRL_SET_MSG_CALLBACK_ARG:

   972 		s->msg_callback_arg = parg;

   973 		return 1;

   974 

   975 	case SSL_CTRL_OPTIONS:

   976 		return(s->options|=larg);

   977 	case SSL_CTRL_MODE:

   978 		return(s->mode|=larg);

   979 	case SSL_CTRL_GET_MAX_CERT_LIST:

   980 		return(s->max_cert_list);

   981 	case SSL_CTRL_SET_MAX_CERT_LIST:

   982 		l=s->max_cert_list;

   983 		s->max_cert_list=larg;

   984 		return(l);

   985 	case SSL_CTRL_SET_MTU:

   986 		if (SSL_version(s) == DTLS1_VERSION)

   987 			{

   988 			s->d1->mtu = larg;

   989 			return larg;

   990 			}

   991 		return 0;

   992 	default:

   993 		return(s->method->ssl_ctrl(s,cmd,larg,parg));

   994 		}

   995 	}

   996 

   997 EXPORT_C long SSL_callback_ctrl(SSL *s, int cmd, void (*fp)(void))

   998 	{

   999 	switch(cmd)

  1000 		{

  1001 	case SSL_CTRL_SET_MSG_CALLBACK:

  1002 		s->msg_callback = (void (*)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))(fp);

  1003 		return 1;

  1004 		

  1005 	default:

  1006 		return(s->method->ssl_callback_ctrl(s,cmd,fp));

  1007 		}

  1008 	}

  1009 

  1010 EXPORT_C struct lhash_st *SSL_CTX_sessions(SSL_CTX *ctx)

  1011 	{

  1012 	return ctx->sessions;

  1013 	}

  1014 

  1015 EXPORT_C long SSL_CTX_ctrl(SSL_CTX *ctx,int cmd,long larg,void *parg)

  1016 	{

  1017 	long l;

  1018 

  1019 	switch (cmd)

  1020 		{

  1021 	case SSL_CTRL_GET_READ_AHEAD:

  1022 		return(ctx->read_ahead);

  1023 	case SSL_CTRL_SET_READ_AHEAD:

  1024 		l=ctx->read_ahead;

  1025 		ctx->read_ahead=larg;

  1026 		return(l);

  1027 		

  1028 	case SSL_CTRL_SET_MSG_CALLBACK_ARG:

  1029 		ctx->msg_callback_arg = parg;

  1030 		return 1;

  1031 

  1032 	case SSL_CTRL_GET_MAX_CERT_LIST:

  1033 		return(ctx->max_cert_list);

  1034 	case SSL_CTRL_SET_MAX_CERT_LIST:

  1035 		l=ctx->max_cert_list;

  1036 		ctx->max_cert_list=larg;

  1037 		return(l);

  1038 

  1039 	case SSL_CTRL_SET_SESS_CACHE_SIZE:

  1040 		l=ctx->session_cache_size;

  1041 		ctx->session_cache_size=larg;

  1042 		return(l);

  1043 	case SSL_CTRL_GET_SESS_CACHE_SIZE:

  1044 		return(ctx->session_cache_size);

  1045 	case SSL_CTRL_SET_SESS_CACHE_MODE:

  1046 		l=ctx->session_cache_mode;

  1047 		ctx->session_cache_mode=larg;

  1048 		return(l);

  1049 	case SSL_CTRL_GET_SESS_CACHE_MODE:

  1050 		return(ctx->session_cache_mode);

  1051 

  1052 	case SSL_CTRL_SESS_NUMBER:

  1053 		return(ctx->sessions->num_items);

  1054 	case SSL_CTRL_SESS_CONNECT:

  1055 		return(ctx->stats.sess_connect);

  1056 	case SSL_CTRL_SESS_CONNECT_GOOD:

  1057 		return(ctx->stats.sess_connect_good);

  1058 	case SSL_CTRL_SESS_CONNECT_RENEGOTIATE:

  1059 		return(ctx->stats.sess_connect_renegotiate);

  1060 	case SSL_CTRL_SESS_ACCEPT:

  1061 		return(ctx->stats.sess_accept);

  1062 	case SSL_CTRL_SESS_ACCEPT_GOOD:

  1063 		return(ctx->stats.sess_accept_good);

  1064 	case SSL_CTRL_SESS_ACCEPT_RENEGOTIATE:

  1065 		return(ctx->stats.sess_accept_renegotiate);

  1066 	case SSL_CTRL_SESS_HIT:

  1067 		return(ctx->stats.sess_hit);

  1068 	case SSL_CTRL_SESS_CB_HIT:

  1069 		return(ctx->stats.sess_cb_hit);

  1070 	case SSL_CTRL_SESS_MISSES:

  1071 		return(ctx->stats.sess_miss);

  1072 	case SSL_CTRL_SESS_TIMEOUTS:

  1073 		return(ctx->stats.sess_timeout);

  1074 	case SSL_CTRL_SESS_CACHE_FULL:

  1075 		return(ctx->stats.sess_cache_full);

  1076 	case SSL_CTRL_OPTIONS:

  1077 		return(ctx->options|=larg);

  1078 	case SSL_CTRL_MODE:

  1079 		return(ctx->mode|=larg);

  1080 	default:

  1081 		return(ctx->method->ssl_ctx_ctrl(ctx,cmd,larg,parg));

  1082 		}

  1083 	}

  1084 

  1085 EXPORT_C long SSL_CTX_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))

  1086 	{

  1087 	switch(cmd)

  1088 		{

  1089 	case SSL_CTRL_SET_MSG_CALLBACK:

  1090 		ctx->msg_callback = (void (*)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg))(fp);

  1091 		return 1;

  1092 

  1093 	default:

  1094 		return(ctx->method->ssl_ctx_callback_ctrl(ctx,cmd,fp));

  1095 		}

  1096 	}

  1097 

  1098 int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b)

  1099 	{

  1100 	long l;

  1101 

  1102 	l=a->id-b->id;

  1103 	if (l == 0L)

  1104 		return(0);

  1105 	else

  1106 		return((l > 0)?1:-1);

  1107 	}

  1108 

  1109 int ssl_cipher_ptr_id_cmp(const SSL_CIPHER * const *ap,

  1110 			const SSL_CIPHER * const *bp)

  1111 	{

  1112 	long l;

  1113 

  1114 	l=(*ap)->id-(*bp)->id;

  1115 	if (l == 0L)

  1116 		return(0);

  1117 	else

  1118 		return((l > 0)?1:-1);

  1119 	}

  1120 

  1121 /** return a STACK of the ciphers available for the SSL and in order of

  1122  * preference */

  1123 EXPORT_C STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *s)

  1124 	{

  1125 	if (s != NULL)

  1126 		{

  1127 		if (s->cipher_list != NULL)

  1128 			{

  1129 			return(s->cipher_list);

  1130 			}

  1131 		else if ((s->ctx != NULL) &&

  1132 			(s->ctx->cipher_list != NULL))

  1133 			{

  1134 			return(s->ctx->cipher_list);

  1135 			}