Bug Summary

File:out/../deps/openssl/openssl/apps/lib/s_cb.c
Warning:line 1177, column 10
Although the value stored to 'mdpth' is used in the enclosing expression, the value is never actually read from 'mdpth'

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name s_cb.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/home/maurizio/node-v18.6.0/out -resource-dir /usr/local/lib/clang/16.0.0 -D V8_DEPRECATION_WARNINGS -D V8_IMMINENT_DEPRECATION_WARNINGS -D _GLIBCXX_USE_CXX11_ABI=1 -D NODE_OPENSSL_CONF_NAME=nodejs_conf -D NODE_OPENSSL_HAS_QUIC -D __STDC_FORMAT_MACROS -D OPENSSL_NO_PINSHARED -D OPENSSL_THREADS -D OPENSSL_API_COMPAT=0x10100001L -D NDEBUG -D OPENSSL_USE_NODELETE -D L_ENDIAN -D OPENSSL_BUILDING_OPENSSL -D AES_ASM -D BSAES_ASM -D CMLL_ASM -D ECP_NISTZ256_ASM -D GHASH_ASM -D KECCAK1600_ASM -D MD5_ASM -D OPENSSL_BN_ASM_GF2m -D OPENSSL_BN_ASM_MONT -D OPENSSL_BN_ASM_MONT5 -D OPENSSL_CPUID_OBJ -D OPENSSL_IA32_SSE2 -D PADLOCK_ASM -D POLY1305_ASM -D SHA1_ASM -D SHA256_ASM -D SHA512_ASM -D VPAES_ASM -D WHIRLPOOL_ASM -D X25519_ASM -D OPENSSL_PIC -D OPENSSLDIR="/etc/ssl" -D ENGINESDIR="/dev/null" -D TERMIOS -I ../deps/openssl/openssl/apps/include -I ../deps/openssl/openssl -I ../deps/openssl/openssl/include -I ../deps/openssl/openssl/crypto -I ../deps/openssl/openssl/crypto/include -I ../deps/openssl/openssl/crypto/modes -I ../deps/openssl/openssl/crypto/ec/curve448 -I ../deps/openssl/openssl/crypto/ec/curve448/arch_32 -I ../deps/openssl/openssl/providers/common/include -I ../deps/openssl/openssl/providers/implementations/include -I ../deps/openssl/config -I ../deps/openssl/config/archs/linux-x86_64/asm/include -I ../deps/openssl/openssl/include -I ../deps/openssl/openssl/crypto/include -I ../deps/openssl/config/archs/linux-x86_64/asm -internal-isystem /usr/local/lib/clang/16.0.0/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-redhat-linux/8/../../../../x86_64-redhat-linux/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -O3 -Wno-unused-parameter -Wno-missing-field-initializers -Wno-old-style-declaration -fdebug-compilation-dir=/home/maurizio/node-v18.6.0/out -ferror-limit 19 -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/scan-build-2022-08-22-142216-507842-1 -x c ../deps/openssl/openssl/apps/lib/s_cb.c
1/*
2 * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10/* callback functions used by s_client, s_server, and s_time */
11#include <stdio.h>
12#include <stdlib.h>
13#include <string.h> /* for memcpy() and strcmp() */
14#include "apps.h"
15#include <openssl/core_names.h>
16#include <openssl/params.h>
17#include <openssl/err.h>
18#include <openssl/rand.h>
19#include <openssl/x509.h>
20#include <openssl/ssl.h>
21#include <openssl/bn.h>
22#ifndef OPENSSL_NO_DH
23# include <openssl/dh.h>
24#endif
25#include "s_apps.h"
26
27#define COOKIE_SECRET_LENGTH16 16
28
29VERIFY_CB_ARGS verify_args = { -1, 0, X509_V_OK0, 0 };
30
31#ifndef OPENSSL_NO_SOCK
32static unsigned char cookie_secret[COOKIE_SECRET_LENGTH16];
33static int cookie_initialized = 0;
34#endif
35static BIO *bio_keylog = NULL((void*)0);
36
37static const char *lookup(int val, const STRINT_PAIR* list, const char* def)
38{
39 for ( ; list->name; ++list)
40 if (list->retval == val)
41 return list->name;
42 return def;
43}
44
45int verify_callback(int ok, X509_STORE_CTX *ctx)
46{
47 X509 *err_cert;
48 int err, depth;
49
50 err_cert = X509_STORE_CTX_get_current_cert(ctx);
51 err = X509_STORE_CTX_get_error(ctx);
52 depth = X509_STORE_CTX_get_error_depth(ctx);
53
54 if (!verify_args.quiet || !ok) {
55 BIO_printf(bio_err, "depth=%d ", depth);
56 if (err_cert != NULL((void*)0)) {
57 X509_NAME_print_ex(bio_err,
58 X509_get_subject_name(err_cert),
59 0, get_nameopt());
60 BIO_puts(bio_err, "\n");
61 } else {
62 BIO_puts(bio_err, "<no cert>\n");
63 }
64 }
65 if (!ok) {
66 BIO_printf(bio_err, "verify error:num=%d:%s\n", err,
67 X509_verify_cert_error_string(err));
68 if (verify_args.depth < 0 || verify_args.depth >= depth) {
69 if (!verify_args.return_error)
70 ok = 1;
71 verify_args.error = err;
72 } else {
73 ok = 0;
74 verify_args.error = X509_V_ERR_CERT_CHAIN_TOO_LONG22;
75 }
76 }
77 switch (err) {
78 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT2:
79 BIO_puts(bio_err, "issuer= ");
80 X509_NAME_print_ex(bio_err, X509_get_issuer_name(err_cert),
81 0, get_nameopt());
82 BIO_puts(bio_err, "\n");
83 break;
84 case X509_V_ERR_CERT_NOT_YET_VALID9:
85 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD13:
86 BIO_printf(bio_err, "notBefore=");
87 ASN1_TIME_print(bio_err, X509_get0_notBefore(err_cert));
88 BIO_printf(bio_err, "\n");
89 break;
90 case X509_V_ERR_CERT_HAS_EXPIRED10:
91 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD14:
92 BIO_printf(bio_err, "notAfter=");
93 ASN1_TIME_print(bio_err, X509_get0_notAfter(err_cert));
94 BIO_printf(bio_err, "\n");
95 break;
96 case X509_V_ERR_NO_EXPLICIT_POLICY43:
97 if (!verify_args.quiet)
98 policies_print(ctx);
99 break;
100 }
101 if (err == X509_V_OK0 && ok == 2 && !verify_args.quiet)
102 policies_print(ctx);
103 if (ok && !verify_args.quiet)
104 BIO_printf(bio_err, "verify return:%d\n", ok);
105 return ok;
106}
107
108int set_cert_stuff(SSL_CTX *ctx, char *cert_file, char *key_file)
109{
110 if (cert_file != NULL((void*)0)) {
111 if (SSL_CTX_use_certificate_file(ctx, cert_file,
112 SSL_FILETYPE_PEM1) <= 0) {
113 BIO_printf(bio_err, "unable to get certificate from '%s'\n",
114 cert_file);
115 ERR_print_errors(bio_err);
116 return 0;
117 }
118 if (key_file == NULL((void*)0))
119 key_file = cert_file;
120 if (SSL_CTX_use_PrivateKey_file(ctx, key_file, SSL_FILETYPE_PEM1) <= 0) {
121 BIO_printf(bio_err, "unable to get private key from '%s'\n",
122 key_file);
123 ERR_print_errors(bio_err);
124 return 0;
125 }
126
127 /*
128 * If we are using DSA, we can copy the parameters from the private
129 * key
130 */
131
132 /*
133 * Now we know that a key and cert have been set against the SSL
134 * context
135 */
136 if (!SSL_CTX_check_private_key(ctx)) {
137 BIO_printf(bio_err,
138 "Private key does not match the certificate public key\n");
139 return 0;
140 }
141 }
142 return 1;
143}
144
145int set_cert_key_stuff(SSL_CTX *ctx, X509 *cert, EVP_PKEY *key,
146 STACK_OF(X509)struct stack_st_X509 *chain, int build_chain)
147{
148 int chflags = chain ? SSL_BUILD_CHAIN_FLAG_CHECK0x4 : 0;
149
150 if (cert == NULL((void*)0))
151 return 1;
152 if (SSL_CTX_use_certificate(ctx, cert) <= 0) {
153 BIO_printf(bio_err, "error setting certificate\n");
154 ERR_print_errors(bio_err);
155 return 0;
156 }
157
158 if (SSL_CTX_use_PrivateKey(ctx, key) <= 0) {
159 BIO_printf(bio_err, "error setting private key\n");
160 ERR_print_errors(bio_err);
161 return 0;
162 }
163
164 /*
165 * Now we know that a key and cert have been set against the SSL context
166 */
167 if (!SSL_CTX_check_private_key(ctx)) {
168 BIO_printf(bio_err,
169 "Private key does not match the certificate public key\n");
170 return 0;
171 }
172 if (chain && !SSL_CTX_set1_chain(ctx, chain)SSL_CTX_ctrl(ctx,88,1,(char *)(chain))) {
173 BIO_printf(bio_err, "error setting certificate chain\n");
174 ERR_print_errors(bio_err);
175 return 0;
176 }
177 if (build_chain && !SSL_CTX_build_cert_chain(ctx, chflags)SSL_CTX_ctrl(ctx,105, chflags, ((void*)0))) {
178 BIO_printf(bio_err, "error building certificate chain\n");
179 ERR_print_errors(bio_err);
180 return 0;
181 }
182 return 1;
183}
184
185static STRINT_PAIR cert_type_list[] = {
186 {"RSA sign", TLS_CT_RSA_SIGN1},
187 {"DSA sign", TLS_CT_DSS_SIGN2},
188 {"RSA fixed DH", TLS_CT_RSA_FIXED_DH3},
189 {"DSS fixed DH", TLS_CT_DSS_FIXED_DH4},
190 {"ECDSA sign", TLS_CT_ECDSA_SIGN64},
191 {"RSA fixed ECDH", TLS_CT_RSA_FIXED_ECDH65},
192 {"ECDSA fixed ECDH", TLS_CT_ECDSA_FIXED_ECDH66},
193 {"GOST01 Sign", TLS_CT_GOST01_SIGN22},
194 {"GOST12 Sign", TLS_CT_GOST12_IANA_SIGN67},
195 {NULL((void*)0)}
196};
197
198static void ssl_print_client_cert_types(BIO *bio, SSL *s)
199{
200 const unsigned char *p;
201 int i;
202 int cert_type_num = SSL_get0_certificate_types(s, &p)SSL_ctrl(s, 103, 0, (char *)(&p));
203
204 if (!cert_type_num)
205 return;
206 BIO_puts(bio, "Client Certificate Types: ");
207 for (i = 0; i < cert_type_num; i++) {
208 unsigned char cert_type = p[i];
209 const char *cname = lookup((int)cert_type, cert_type_list, NULL((void*)0));
210
211 if (i)
212 BIO_puts(bio, ", ");
213 if (cname != NULL((void*)0))
214 BIO_puts(bio, cname);
215 else
216 BIO_printf(bio, "UNKNOWN (%d),", cert_type);
217 }
218 BIO_puts(bio, "\n");
219}
220
221static const char *get_sigtype(int nid)
222{
223 switch (nid) {
224 case EVP_PKEY_RSA6:
225 return "RSA";
226
227 case EVP_PKEY_RSA_PSS912:
228 return "RSA-PSS";
229
230 case EVP_PKEY_DSA116:
231 return "DSA";
232
233 case EVP_PKEY_EC408:
234 return "ECDSA";
235
236 case NID_ED255191087:
237 return "Ed25519";
238
239 case NID_ED4481088:
240 return "Ed448";
241
242 case NID_id_GostR3410_2001811:
243 return "gost2001";
244
245 case NID_id_GostR3410_2012_256979:
246 return "gost2012_256";
247
248 case NID_id_GostR3410_2012_512980:
249 return "gost2012_512";
250
251 default:
252 return NULL((void*)0);
253 }
254}
255
256static int do_print_sigalgs(BIO *out, SSL *s, int shared)
257{
258 int i, nsig, client;
259
260 client = SSL_is_server(s) ? 0 : 1;
261 if (shared)
262 nsig = SSL_get_shared_sigalgs(s, 0, NULL((void*)0), NULL((void*)0), NULL((void*)0), NULL((void*)0), NULL((void*)0));
263 else
264 nsig = SSL_get_sigalgs(s, -1, NULL((void*)0), NULL((void*)0), NULL((void*)0), NULL((void*)0), NULL((void*)0));
265 if (nsig == 0)
266 return 1;
267
268 if (shared)
269 BIO_puts(out, "Shared ");
270
271 if (client)
272 BIO_puts(out, "Requested ");
273 BIO_puts(out, "Signature Algorithms: ");
274 for (i = 0; i < nsig; i++) {
275 int hash_nid, sign_nid;
276 unsigned char rhash, rsign;
277 const char *sstr = NULL((void*)0);
278 if (shared)
279 SSL_get_shared_sigalgs(s, i, &sign_nid, &hash_nid, NULL((void*)0),
280 &rsign, &rhash);
281 else
282 SSL_get_sigalgs(s, i, &sign_nid, &hash_nid, NULL((void*)0), &rsign, &rhash);
283 if (i)
284 BIO_puts(out, ":");
285 sstr = get_sigtype(sign_nid);
286 if (sstr)
287 BIO_printf(out, "%s", sstr);
288 else
289 BIO_printf(out, "0x%02X", (int)rsign);
290 if (hash_nid != NID_undef0)
291 BIO_printf(out, "+%s", OBJ_nid2sn(hash_nid));
292 else if (sstr == NULL((void*)0))
293 BIO_printf(out, "+0x%02X", (int)rhash);
294 }
295 BIO_puts(out, "\n");
296 return 1;
297}
298
299int ssl_print_sigalgs(BIO *out, SSL *s)
300{
301 int nid;
302
303 if (!SSL_is_server(s))
304 ssl_print_client_cert_types(out, s);
305 do_print_sigalgs(out, s, 0);
306 do_print_sigalgs(out, s, 1);
307 if (SSL_get_peer_signature_nid(s, &nid)SSL_ctrl(s,108,0,&nid) && nid != NID_undef0)
308 BIO_printf(out, "Peer signing digest: %s\n", OBJ_nid2sn(nid));
309 if (SSL_get_peer_signature_type_nid(s, &nid))
310 BIO_printf(out, "Peer signature type: %s\n", get_sigtype(nid));
311 return 1;
312}
313
314#ifndef OPENSSL_NO_EC
315int ssl_print_point_formats(BIO *out, SSL *s)
316{
317 int i, nformats;
318 const char *pformats;
319
320 nformats = SSL_get0_ec_point_formats(s, &pformats)SSL_ctrl(s,111,0,&pformats);
321 if (nformats <= 0)
322 return 1;
323 BIO_puts(out, "Supported Elliptic Curve Point Formats: ");
324 for (i = 0; i < nformats; i++, pformats++) {
325 if (i)
326 BIO_puts(out, ":");
327 switch (*pformats) {
328 case TLSEXT_ECPOINTFORMAT_uncompressed0:
329 BIO_puts(out, "uncompressed");
330 break;
331
332 case TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime1:
333 BIO_puts(out, "ansiX962_compressed_prime");
334 break;
335
336 case TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char22:
337 BIO_puts(out, "ansiX962_compressed_char2");
338 break;
339
340 default:
341 BIO_printf(out, "unknown(%d)", (int)*pformats);
342 break;
343
344 }
345 }
346 BIO_puts(out, "\n");
347 return 1;
348}
349
350int ssl_print_groups(BIO *out, SSL *s, int noshared)
351{
352 int i, ngroups, *groups, nid;
353
354 ngroups = SSL_get1_groups(s, NULL)SSL_ctrl(s,90,0,(int*)(((void*)0)));
355 if (ngroups <= 0)
356 return 1;
357 groups = app_malloc(ngroups * sizeof(int), "groups to print");
358 SSL_get1_groups(s, groups)SSL_ctrl(s,90,0,(int*)(groups));
359
360 BIO_puts(out, "Supported groups: ");
361 for (i = 0; i < ngroups; i++) {
362 if (i)
363 BIO_puts(out, ":");
364 nid = groups[i];
365 BIO_printf(out, "%s", SSL_group_to_name(s, nid));
366 }
367 OPENSSL_free(groups)CRYPTO_free(groups, "../deps/openssl/openssl/apps/lib/s_cb.c"
, 367);
368 if (noshared) {
369 BIO_puts(out, "\n");
370 return 1;
371 }
372 BIO_puts(out, "\nShared groups: ");
373 ngroups = SSL_get_shared_group(s, -1)SSL_ctrl(s,93,-1,((void*)0));
374 for (i = 0; i < ngroups; i++) {
375 if (i)
376 BIO_puts(out, ":");
377 nid = SSL_get_shared_group(s, i)SSL_ctrl(s,93,i,((void*)0));
378 BIO_printf(out, "%s", SSL_group_to_name(s, nid));
379 }
380 if (ngroups == 0)
381 BIO_puts(out, "NONE");
382 BIO_puts(out, "\n");
383 return 1;
384}
385#endif
386
387int ssl_print_tmp_key(BIO *out, SSL *s)
388{
389 EVP_PKEY *key;
390
391 if (!SSL_get_peer_tmp_key(s, &key)SSL_ctrl(s,109,0,&key))
392 return 1;
393 BIO_puts(out, "Server Temp Key: ");
394 switch (EVP_PKEY_get_id(key)) {
395 case EVP_PKEY_RSA6:
396 BIO_printf(out, "RSA, %d bits\n", EVP_PKEY_get_bits(key));
397 break;
398
399 case EVP_PKEY_DH28:
400 BIO_printf(out, "DH, %d bits\n", EVP_PKEY_get_bits(key));
401 break;
402#ifndef OPENSSL_NO_EC
403 case EVP_PKEY_EC408:
404 {
405 char name[80];
406 size_t name_len;
407
408 if (!EVP_PKEY_get_utf8_string_param(key, OSSL_PKEY_PARAM_GROUP_NAME"group",
409 name, sizeof(name), &name_len))
410 strcpy(name, "?");
411 BIO_printf(out, "ECDH, %s, %d bits\n", name, EVP_PKEY_get_bits(key));
412 }
413 break;
414#endif
415 default:
416 BIO_printf(out, "%s, %d bits\n", OBJ_nid2sn(EVP_PKEY_get_id(key)),
417 EVP_PKEY_get_bits(key));
418 }
419 EVP_PKEY_free(key);
420 return 1;
421}
422
423long bio_dump_callback(BIO *bio, int cmd, const char *argp, size_t len,
424 int argi, long argl, int ret, size_t *processed)
425{
426 BIO *out;
427
428 out = (BIO *)BIO_get_callback_arg(bio);
429 if (out == NULL((void*)0))
430 return ret;
431
432 if (cmd == (BIO_CB_READ0x02 | BIO_CB_RETURN0x80)) {
433 if (ret > 0 && processed != NULL((void*)0)) {
434 BIO_printf(out, "read from %p [%p] (%zu bytes => %zu (0x%zX))\n",
435 (void *)bio, (void *)argp, len, *processed, *processed);
436 BIO_dump(out, argp, (int)*processed);
437 } else {
438 BIO_printf(out, "read from %p [%p] (%zu bytes => %d)\n",
439 (void *)bio, (void *)argp, len, ret);
440 }
441 } else if (cmd == (BIO_CB_WRITE0x03 | BIO_CB_RETURN0x80)) {
442 if (ret > 0 && processed != NULL((void*)0)) {
443 BIO_printf(out, "write to %p [%p] (%zu bytes => %zu (0x%zX))\n",
444 (void *)bio, (void *)argp, len, *processed, *processed);
445 BIO_dump(out, argp, (int)*processed);
446 } else {
447 BIO_printf(out, "write to %p [%p] (%zu bytes => %d)\n",
448 (void *)bio, (void *)argp, len, ret);
449 }
450 }
451 return ret;
452}
453
454void apps_ssl_info_callback(const SSL *s, int where, int ret)
455{
456 const char *str;
457 int w;
458
459 w = where & ~SSL_ST_MASK0x0FFF;
460
461 if (w & SSL_ST_CONNECT0x1000)
462 str = "SSL_connect";
463 else if (w & SSL_ST_ACCEPT0x2000)
464 str = "SSL_accept";
465 else
466 str = "undefined";
467
468 if (where & SSL_CB_LOOP0x01) {
469 BIO_printf(bio_err, "%s:%s\n", str, SSL_state_string_long(s));
470 } else if (where & SSL_CB_ALERT0x4000) {
471 str = (where & SSL_CB_READ0x04) ? "read" : "write";
472 BIO_printf(bio_err, "SSL3 alert %s:%s:%s\n",
473 str,
474 SSL_alert_type_string_long(ret),
475 SSL_alert_desc_string_long(ret));
476 } else if (where & SSL_CB_EXIT0x02) {
477 if (ret == 0)
478 BIO_printf(bio_err, "%s:failed in %s\n",
479 str, SSL_state_string_long(s));
480 else if (ret < 0)
481 BIO_printf(bio_err, "%s:error in %s\n",
482 str, SSL_state_string_long(s));
483 }
484}
485
486static STRINT_PAIR ssl_versions[] = {
487 {"SSL 3.0", SSL3_VERSION0x0300},
488 {"TLS 1.0", TLS1_VERSION0x0301},
489 {"TLS 1.1", TLS1_1_VERSION0x0302},
490 {"TLS 1.2", TLS1_2_VERSION0x0303},
491 {"TLS 1.3", TLS1_3_VERSION0x0304},
492 {"DTLS 1.0", DTLS1_VERSION0xFEFF},
493 {"DTLS 1.0 (bad)", DTLS1_BAD_VER0x0100},
494 {NULL((void*)0)}
495};
496
497static STRINT_PAIR alert_types[] = {
498 {" close_notify", 0},
499 {" end_of_early_data", 1},
500 {" unexpected_message", 10},
501 {" bad_record_mac", 20},
502 {" decryption_failed", 21},
503 {" record_overflow", 22},
504 {" decompression_failure", 30},
505 {" handshake_failure", 40},
506 {" bad_certificate", 42},
507 {" unsupported_certificate", 43},
508 {" certificate_revoked", 44},
509 {" certificate_expired", 45},
510 {" certificate_unknown", 46},
511 {" illegal_parameter", 47},
512 {" unknown_ca", 48},
513 {" access_denied", 49},
514 {" decode_error", 50},
515 {" decrypt_error", 51},
516 {" export_restriction", 60},
517 {" protocol_version", 70},
518 {" insufficient_security", 71},
519 {" internal_error", 80},
520 {" inappropriate_fallback", 86},
521 {" user_canceled", 90},
522 {" no_renegotiation", 100},
523 {" missing_extension", 109},
524 {" unsupported_extension", 110},
525 {" certificate_unobtainable", 111},
526 {" unrecognized_name", 112},
527 {" bad_certificate_status_response", 113},
528 {" bad_certificate_hash_value", 114},
529 {" unknown_psk_identity", 115},
530 {" certificate_required", 116},
531 {NULL((void*)0)}
532};
533
534static STRINT_PAIR handshakes[] = {
535 {", HelloRequest", SSL3_MT_HELLO_REQUEST0},
536 {", ClientHello", SSL3_MT_CLIENT_HELLO1},
537 {", ServerHello", SSL3_MT_SERVER_HELLO2},
538 {", HelloVerifyRequest", DTLS1_MT_HELLO_VERIFY_REQUEST3},
539 {", NewSessionTicket", SSL3_MT_NEWSESSION_TICKET4},
540 {", EndOfEarlyData", SSL3_MT_END_OF_EARLY_DATA5},
541 {", EncryptedExtensions", SSL3_MT_ENCRYPTED_EXTENSIONS8},
542 {", Certificate", SSL3_MT_CERTIFICATE11},
543 {", ServerKeyExchange", SSL3_MT_SERVER_KEY_EXCHANGE12},
544 {", CertificateRequest", SSL3_MT_CERTIFICATE_REQUEST13},
545 {", ServerHelloDone", SSL3_MT_SERVER_DONE14},
546 {", CertificateVerify", SSL3_MT_CERTIFICATE_VERIFY15},
547 {", ClientKeyExchange", SSL3_MT_CLIENT_KEY_EXCHANGE16},
548 {", Finished", SSL3_MT_FINISHED20},
549 {", CertificateUrl", SSL3_MT_CERTIFICATE_URL21},
550 {", CertificateStatus", SSL3_MT_CERTIFICATE_STATUS22},
551 {", SupplementalData", SSL3_MT_SUPPLEMENTAL_DATA23},
552 {", KeyUpdate", SSL3_MT_KEY_UPDATE24},
553#ifndef OPENSSL_NO_NEXTPROTONEG
554 {", NextProto", SSL3_MT_NEXT_PROTO67},
555#endif
556 {", MessageHash", SSL3_MT_MESSAGE_HASH254},
557 {NULL((void*)0)}
558};
559
560void msg_cb(int write_p, int version, int content_type, const void *buf,
561 size_t len, SSL *ssl, void *arg)
562{
563 BIO *bio = arg;
564 const char *str_write_p = write_p ? ">>>" : "<<<";
565 char tmpbuf[128];
566 const char *str_version, *str_content_type = "", *str_details1 = "", *str_details2 = "";
567 const unsigned char* bp = buf;
568
569 if (version == SSL3_VERSION0x0300 ||
570 version == TLS1_VERSION0x0301 ||
571 version == TLS1_1_VERSION0x0302 ||
572 version == TLS1_2_VERSION0x0303 ||
573 version == TLS1_3_VERSION0x0304 ||
574 version == DTLS1_VERSION0xFEFF || version == DTLS1_BAD_VER0x0100) {
575 str_version = lookup(version, ssl_versions, "???");
576 switch (content_type) {
577 case SSL3_RT_CHANGE_CIPHER_SPEC20:
578 /* type 20 */
579 str_content_type = ", ChangeCipherSpec";
580 break;
581 case SSL3_RT_ALERT21:
582 /* type 21 */
583 str_content_type = ", Alert";
584 str_details1 = ", ???";
585 if (len == 2) {
586 switch (bp[0]) {
587 case 1:
588 str_details1 = ", warning";
589 break;
590 case 2:
591 str_details1 = ", fatal";
592 break;
593 }
594 str_details2 = lookup((int)bp[1], alert_types, " ???");
595 }
596 break;
597 case SSL3_RT_HANDSHAKE22:
598 /* type 22 */
599 str_content_type = ", Handshake";
600 str_details1 = "???";
601 if (len > 0)
602 str_details1 = lookup((int)bp[0], handshakes, "???");
603 break;
604 case SSL3_RT_APPLICATION_DATA23:
605 /* type 23 */
606 str_content_type = ", ApplicationData";
607 break;
608 case SSL3_RT_HEADER0x100:
609 /* type 256 */
610 str_content_type = ", RecordHeader";
611 break;
612 case SSL3_RT_INNER_CONTENT_TYPE0x101:
613 /* type 257 */
614 str_content_type = ", InnerContent";
615 break;
616 default:
617 BIO_snprintf(tmpbuf, sizeof(tmpbuf)-1, ", Unknown (content_type=%d)", content_type);
618 str_content_type = tmpbuf;
619 }
620 } else {
621 BIO_snprintf(tmpbuf, sizeof(tmpbuf)-1, "Not TLS data or unknown version (version=%d, content_type=%d)", version, content_type);
622 str_version = tmpbuf;
623 }
624
625 BIO_printf(bio, "%s %s%s [length %04lx]%s%s\n", str_write_p, str_version,
626 str_content_type, (unsigned long)len, str_details1,
627 str_details2);
628
629 if (len > 0) {
630 size_t num, i;
631
632 BIO_printf(bio, " ");
633 num = len;
634 for (i = 0; i < num; i++) {
635 if (i % 16 == 0 && i > 0)
636 BIO_printf(bio, "\n ");
637 BIO_printf(bio, " %02x", ((const unsigned char *)buf)[i]);
638 }
639 if (i < len)
640 BIO_printf(bio, " ...");
641 BIO_printf(bio, "\n");
642 }
643 (void)BIO_flush(bio)(int)BIO_ctrl(bio,11,0,((void*)0));
644}
645
646static STRINT_PAIR tlsext_types[] = {
647 {"server name", TLSEXT_TYPE_server_name0},
648 {"max fragment length", TLSEXT_TYPE_max_fragment_length1},
649 {"client certificate URL", TLSEXT_TYPE_client_certificate_url2},
650 {"trusted CA keys", TLSEXT_TYPE_trusted_ca_keys3},
651 {"truncated HMAC", TLSEXT_TYPE_truncated_hmac4},
652 {"status request", TLSEXT_TYPE_status_request5},
653 {"user mapping", TLSEXT_TYPE_user_mapping6},
654 {"client authz", TLSEXT_TYPE_client_authz7},
655 {"server authz", TLSEXT_TYPE_server_authz8},
656 {"cert type", TLSEXT_TYPE_cert_type9},
657 {"supported_groups", TLSEXT_TYPE_supported_groups10},
658 {"EC point formats", TLSEXT_TYPE_ec_point_formats11},
659 {"SRP", TLSEXT_TYPE_srp12},
660 {"signature algorithms", TLSEXT_TYPE_signature_algorithms13},
661 {"use SRTP", TLSEXT_TYPE_use_srtp14},
662 {"session ticket", TLSEXT_TYPE_session_ticket35},
663 {"renegotiation info", TLSEXT_TYPE_renegotiate0xff01},
664 {"signed certificate timestamps", TLSEXT_TYPE_signed_certificate_timestamp18},
665 {"TLS padding", TLSEXT_TYPE_padding21},
666#ifdef TLSEXT_TYPE_next_proto_neg13172
667 {"next protocol", TLSEXT_TYPE_next_proto_neg13172},
668#endif
669#ifdef TLSEXT_TYPE_encrypt_then_mac22
670 {"encrypt-then-mac", TLSEXT_TYPE_encrypt_then_mac22},
671#endif
672#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation16
673 {"application layer protocol negotiation",
674 TLSEXT_TYPE_application_layer_protocol_negotiation16},
675#endif
676#ifdef TLSEXT_TYPE_extended_master_secret23
677 {"extended master secret", TLSEXT_TYPE_extended_master_secret23},
678#endif
679 {"key share", TLSEXT_TYPE_key_share51},
680 {"supported versions", TLSEXT_TYPE_supported_versions43},
681 {"psk", TLSEXT_TYPE_psk41},
682 {"psk kex modes", TLSEXT_TYPE_psk_kex_modes45},
683 {"certificate authorities", TLSEXT_TYPE_certificate_authorities47},
684 {"post handshake auth", TLSEXT_TYPE_post_handshake_auth49},
685 {NULL((void*)0)}
686};
687
688/* from rfc8446 4.2.3. + gost (https://tools.ietf.org/id/draft-smyshlyaev-tls12-gost-suites-04.html) */
689static STRINT_PAIR signature_tls13_scheme_list[] = {
690 {"rsa_pkcs1_sha1", 0x0201 /* TLSEXT_SIGALG_rsa_pkcs1_sha1 */},
691 {"ecdsa_sha1", 0x0203 /* TLSEXT_SIGALG_ecdsa_sha1 */},
692/* {"rsa_pkcs1_sha224", 0x0301 TLSEXT_SIGALG_rsa_pkcs1_sha224}, not in rfc8446 */
693/* {"ecdsa_sha224", 0x0303 TLSEXT_SIGALG_ecdsa_sha224} not in rfc8446 */
694 {"rsa_pkcs1_sha256", 0x0401 /* TLSEXT_SIGALG_rsa_pkcs1_sha256 */},
695 {"ecdsa_secp256r1_sha256", 0x0403 /* TLSEXT_SIGALG_ecdsa_secp256r1_sha256 */},
696 {"rsa_pkcs1_sha384", 0x0501 /* TLSEXT_SIGALG_rsa_pkcs1_sha384 */},
697 {"ecdsa_secp384r1_sha384", 0x0503 /* TLSEXT_SIGALG_ecdsa_secp384r1_sha384 */},
698 {"rsa_pkcs1_sha512", 0x0601 /* TLSEXT_SIGALG_rsa_pkcs1_sha512 */},
699 {"ecdsa_secp521r1_sha512", 0x0603 /* TLSEXT_SIGALG_ecdsa_secp521r1_sha512 */},
700 {"rsa_pss_rsae_sha256", 0x0804 /* TLSEXT_SIGALG_rsa_pss_rsae_sha256 */},
701 {"rsa_pss_rsae_sha384", 0x0805 /* TLSEXT_SIGALG_rsa_pss_rsae_sha384 */},
702 {"rsa_pss_rsae_sha512", 0x0806 /* TLSEXT_SIGALG_rsa_pss_rsae_sha512 */},
703 {"ed25519", 0x0807 /* TLSEXT_SIGALG_ed25519 */},
704 {"ed448", 0x0808 /* TLSEXT_SIGALG_ed448 */},
705 {"rsa_pss_pss_sha256", 0x0809 /* TLSEXT_SIGALG_rsa_pss_pss_sha256 */},
706 {"rsa_pss_pss_sha384", 0x080a /* TLSEXT_SIGALG_rsa_pss_pss_sha384 */},
707 {"rsa_pss_pss_sha512", 0x080b /* TLSEXT_SIGALG_rsa_pss_pss_sha512 */},
708 {"gostr34102001", 0xeded /* TLSEXT_SIGALG_gostr34102001_gostr3411 */},
709 {"gostr34102012_256", 0xeeee /* TLSEXT_SIGALG_gostr34102012_256_gostr34112012_256 */},
710 {"gostr34102012_512", 0xefef /* TLSEXT_SIGALG_gostr34102012_512_gostr34112012_512 */},
711 {NULL((void*)0)}
712};
713
714/* from rfc5246 7.4.1.4.1. */
715static STRINT_PAIR signature_tls12_alg_list[] = {
716 {"anonymous", TLSEXT_signature_anonymous0 /* 0 */},
717 {"RSA", TLSEXT_signature_rsa1 /* 1 */},
718 {"DSA", TLSEXT_signature_dsa2 /* 2 */},
719 {"ECDSA", TLSEXT_signature_ecdsa3 /* 3 */},
720 {NULL((void*)0)}
721};
722
723/* from rfc5246 7.4.1.4.1. */
724static STRINT_PAIR signature_tls12_hash_list[] = {
725 {"none", TLSEXT_hash_none0 /* 0 */},
726 {"MD5", TLSEXT_hash_md51 /* 1 */},
727 {"SHA1", TLSEXT_hash_sha12 /* 2 */},
728 {"SHA224", TLSEXT_hash_sha2243 /* 3 */},
729 {"SHA256", TLSEXT_hash_sha2564 /* 4 */},
730 {"SHA384", TLSEXT_hash_sha3845 /* 5 */},
731 {"SHA512", TLSEXT_hash_sha5126 /* 6 */},
732 {NULL((void*)0)}
733};
734
735void tlsext_cb(SSL *s, int client_server, int type,
736 const unsigned char *data, int len, void *arg)
737{
738 BIO *bio = arg;
739 const char *extname = lookup(type, tlsext_types, "unknown");
740
741 BIO_printf(bio, "TLS %s extension \"%s\" (id=%d), len=%d\n",
742 client_server ? "server" : "client", extname, type, len);
743 BIO_dump(bio, (const char *)data, len);
744 (void)BIO_flush(bio)(int)BIO_ctrl(bio,11,0,((void*)0));
745}
746
747#ifndef OPENSSL_NO_SOCK
748int generate_stateless_cookie_callback(SSL *ssl, unsigned char *cookie,
749 size_t *cookie_len)
750{
751 unsigned char *buffer = NULL((void*)0);
752 size_t length = 0;
753 unsigned short port;
754 BIO_ADDR *lpeer = NULL((void*)0), *peer = NULL((void*)0);
755 int res = 0;
756
757 /* Initialize a random secret */
758 if (!cookie_initialized) {
759 if (RAND_bytes(cookie_secret, COOKIE_SECRET_LENGTH16) <= 0) {
760 BIO_printf(bio_err, "error setting random cookie secret\n");
761 return 0;
762 }
763 cookie_initialized = 1;
764 }
765
766 if (SSL_is_dtls(ssl)) {
767 lpeer = peer = BIO_ADDR_new();
768 if (peer == NULL((void*)0)) {
769 BIO_printf(bio_err, "memory full\n");
770 return 0;
771 }
772
773 /* Read peer information */
774 (void)BIO_dgram_get_peer(SSL_get_rbio(ssl), peer)(int)BIO_ctrl(SSL_get_rbio(ssl), 46, 0, (char *)(peer));
775 } else {
776 peer = ourpeer;
777 }
778
779 /* Create buffer with peer's address and port */
780 if (!BIO_ADDR_rawaddress(peer, NULL((void*)0), &length)) {
781 BIO_printf(bio_err, "Failed getting peer address\n");
782 BIO_ADDR_free(lpeer);
783 return 0;
784 }
785 OPENSSL_assert(length != 0)(void)((length != 0) ? 0 : (OPENSSL_die("assertion failed: " "length != 0"
, "../deps/openssl/openssl/apps/lib/s_cb.c", 785), 1));
786 port = BIO_ADDR_rawport(peer);
787 length += sizeof(port);
788 buffer = app_malloc(length, "cookie generate buffer");
789
790 memcpy(buffer, &port, sizeof(port));
791 BIO_ADDR_rawaddress(peer, buffer + sizeof(port), NULL((void*)0));
792
793 if (EVP_Q_mac(NULL((void*)0), "HMAC", NULL((void*)0), "SHA1", NULL((void*)0),
794 cookie_secret, COOKIE_SECRET_LENGTH16, buffer, length,
795 cookie, DTLS1_COOKIE_LENGTH255, cookie_len) == NULL((void*)0)) {
796 BIO_printf(bio_err,
797 "Error calculating HMAC-SHA1 of buffer with secret\n");
798 goto end;
799 }
800 res = 1;
801end:
802 OPENSSL_free(buffer)CRYPTO_free(buffer, "../deps/openssl/openssl/apps/lib/s_cb.c"
, 802);
803 BIO_ADDR_free(lpeer);
804
805 return res;
806}
807
808int verify_stateless_cookie_callback(SSL *ssl, const unsigned char *cookie,
809 size_t cookie_len)
810{
811 unsigned char result[EVP_MAX_MD_SIZE64];
812 size_t resultlength;
813
814 /* Note: we check cookie_initialized because if it's not,
815 * it cannot be valid */
816 if (cookie_initialized
817 && generate_stateless_cookie_callback(ssl, result, &resultlength)
818 && cookie_len == resultlength
819 && memcmp(result, cookie, resultlength) == 0)
820 return 1;
821
822 return 0;
823}
824
825int generate_cookie_callback(SSL *ssl, unsigned char *cookie,
826 unsigned int *cookie_len)
827{
828 size_t temp = 0;
829 int res = generate_stateless_cookie_callback(ssl, cookie, &temp);
830
831 if (res != 0)
832 *cookie_len = (unsigned int)temp;
833 return res;
834}
835
836int verify_cookie_callback(SSL *ssl, const unsigned char *cookie,
837 unsigned int cookie_len)
838{
839 return verify_stateless_cookie_callback(ssl, cookie, cookie_len);
840}
841
842#endif
843
844/*
845 * Example of extended certificate handling. Where the standard support of
846 * one certificate per algorithm is not sufficient an application can decide
847 * which certificate(s) to use at runtime based on whatever criteria it deems
848 * appropriate.
849 */
850
851/* Linked list of certificates, keys and chains */
852struct ssl_excert_st {
853 int certform;
854 const char *certfile;
855 int keyform;
856 const char *keyfile;
857 const char *chainfile;
858 X509 *cert;
859 EVP_PKEY *key;
860 STACK_OF(X509)struct stack_st_X509 *chain;
861 int build_chain;
862 struct ssl_excert_st *next, *prev;
863};
864
865static STRINT_PAIR chain_flags[] = {
866 {"Overall Validity", CERT_PKEY_VALID0x1},
867 {"Sign with EE key", CERT_PKEY_SIGN0x2},
868 {"EE signature", CERT_PKEY_EE_SIGNATURE0x10},
869 {"CA signature", CERT_PKEY_CA_SIGNATURE0x20},
870 {"EE key parameters", CERT_PKEY_EE_PARAM0x40},
871 {"CA key parameters", CERT_PKEY_CA_PARAM0x80},
872 {"Explicitly sign with EE key", CERT_PKEY_EXPLICIT_SIGN0x100},
873 {"Issuer Name", CERT_PKEY_ISSUER_NAME0x200},
874 {"Certificate Type", CERT_PKEY_CERT_TYPE0x400},
875 {NULL((void*)0)}
876};
877
878static void print_chain_flags(SSL *s, int flags)
879{
880 STRINT_PAIR *pp;
881
882 for (pp = chain_flags; pp->name; ++pp)
883 BIO_printf(bio_err, "\t%s: %s\n",
884 pp->name,
885 (flags & pp->retval) ? "OK" : "NOT OK");
886 BIO_printf(bio_err, "\tSuite B: ");
887 if (SSL_set_cert_flags(s, 0)SSL_ctrl((s),99,(0),((void*)0)) & SSL_CERT_FLAG_SUITEB_128_LOS0x30000)
888 BIO_puts(bio_err, flags & CERT_PKEY_SUITEB0x800 ? "OK\n" : "NOT OK\n");
889 else
890 BIO_printf(bio_err, "not tested\n");
891}
892
893/*
894 * Very basic selection callback: just use any certificate chain reported as
895 * valid. More sophisticated could prioritise according to local policy.
896 */
897static int set_cert_cb(SSL *ssl, void *arg)
898{
899 int i, rv;
900 SSL_EXCERT *exc = arg;
901#ifdef CERT_CB_TEST_RETRY
902 static int retry_cnt;
903
904 if (retry_cnt < 5) {
905 retry_cnt++;
906 BIO_printf(bio_err,
907 "Certificate callback retry test: count %d\n",
908 retry_cnt);
909 return -1;
910 }
911#endif
912 SSL_certs_clear(ssl);
913
914 if (exc == NULL((void*)0))
915 return 1;
916
917 /*
918 * Go to end of list and traverse backwards since we prepend newer
919 * entries this retains the original order.
920 */
921 while (exc->next != NULL((void*)0))
922 exc = exc->next;
923
924 i = 0;
925
926 while (exc != NULL((void*)0)) {
927 i++;
928 rv = SSL_check_chain(ssl, exc->cert, exc->key, exc->chain);
929 BIO_printf(bio_err, "Checking cert chain %d:\nSubject: ", i);
930 X509_NAME_print_ex(bio_err, X509_get_subject_name(exc->cert), 0,
931 get_nameopt());
932 BIO_puts(bio_err, "\n");
933 print_chain_flags(ssl, rv);
934 if (rv & CERT_PKEY_VALID0x1) {
935 if (!SSL_use_certificate(ssl, exc->cert)
936 || !SSL_use_PrivateKey(ssl, exc->key)) {
937 return 0;
938 }
939 /*
940 * NB: we wouldn't normally do this as it is not efficient
941 * building chains on each connection better to cache the chain
942 * in advance.
943 */
944 if (exc->build_chain) {
945 if (!SSL_build_cert_chain(ssl, 0)SSL_ctrl(ssl,105, 0, ((void*)0)))
946 return 0;
947 } else if (exc->chain != NULL((void*)0)) {
948 if (!SSL_set1_chain(ssl, exc->chain)SSL_ctrl(ssl,88,1,(char *)(exc->chain)))
949 return 0;
950 }
951 }
952 exc = exc->prev;
953 }
954 return 1;
955}
956
957void ssl_ctx_set_excert(SSL_CTX *ctx, SSL_EXCERT *exc)
958{
959 SSL_CTX_set_cert_cb(ctx, set_cert_cb, exc);
960}
961
962static int ssl_excert_prepend(SSL_EXCERT **pexc)
963{
964 SSL_EXCERT *exc = app_malloc(sizeof(*exc), "prepend cert");
965
966 memset(exc, 0, sizeof(*exc));
967
968 exc->next = *pexc;
969 *pexc = exc;
970
971 if (exc->next) {
972 exc->certform = exc->next->certform;
973 exc->keyform = exc->next->keyform;
974 exc->next->prev = exc;
975 } else {
976 exc->certform = FORMAT_PEM(5 | 0x8000);
977 exc->keyform = FORMAT_PEM(5 | 0x8000);
978 }
979 return 1;
980
981}
982
983void ssl_excert_free(SSL_EXCERT *exc)
984{
985 SSL_EXCERT *curr;
986
987 if (exc == NULL((void*)0))
988 return;
989 while (exc) {
990 X509_free(exc->cert);
991 EVP_PKEY_free(exc->key);
992 sk_X509_pop_free(exc->chain, X509_free)OPENSSL_sk_pop_free(ossl_check_X509_sk_type(exc->chain),ossl_check_X509_freefunc_type
(X509_free));
993 curr = exc;
994 exc = exc->next;
995 OPENSSL_free(curr)CRYPTO_free(curr, "../deps/openssl/openssl/apps/lib/s_cb.c", 995
);
996 }
997}
998
999int load_excert(SSL_EXCERT **pexc)
1000{
1001 SSL_EXCERT *exc = *pexc;
1002
1003 if (exc == NULL((void*)0))
1004 return 1;
1005 /* If nothing in list, free and set to NULL */
1006 if (exc->certfile == NULL((void*)0) && exc->next == NULL((void*)0)) {
1007 ssl_excert_free(exc);
1008 *pexc = NULL((void*)0);
1009 return 1;
1010 }
1011 for (; exc; exc = exc->next) {
1012 if (exc->certfile == NULL((void*)0)) {
1013 BIO_printf(bio_err, "Missing filename\n");
1014 return 0;
1015 }
1016 exc->cert = load_cert(exc->certfile, exc->certform,load_cert_pass(exc->certfile, exc->certform, 1, ((void*
)0), "Server Certificate")
1017 "Server Certificate")load_cert_pass(exc->certfile, exc->certform, 1, ((void*
)0), "Server Certificate");
1018 if (exc->cert == NULL((void*)0))
1019 return 0;
1020 if (exc->keyfile != NULL((void*)0)) {
1021 exc->key = load_key(exc->keyfile, exc->keyform,
1022 0, NULL((void*)0), NULL((void*)0), "server key");
1023 } else {
1024 exc->key = load_key(exc->certfile, exc->certform,
1025 0, NULL((void*)0), NULL((void*)0), "server key");
1026 }
1027 if (exc->key == NULL((void*)0))
1028 return 0;
1029 if (exc->chainfile != NULL((void*)0)) {
1030 if (!load_certs(exc->chainfile, 0, &exc->chain, NULL((void*)0), "server chain"))
1031 return 0;
1032 }
1033 }
1034 return 1;
1035}
1036
1037enum range { OPT_X_ENUMOPT_X__FIRST=1000, OPT_X_KEY, OPT_X_CERT, OPT_X_CHAIN, OPT_X_CHAIN_BUILD
, OPT_X_CERTFORM, OPT_X_KEYFORM, OPT_X__LAST };
1038
1039int args_excert(int opt, SSL_EXCERT **pexc)
1040{
1041 SSL_EXCERT *exc = *pexc;
1042
1043 assert(opt > OPT_X__FIRST)((void) (0));
1044 assert(opt < OPT_X__LAST)((void) (0));
1045
1046 if (exc == NULL((void*)0)) {
1047 if (!ssl_excert_prepend(&exc)) {
1048 BIO_printf(bio_err, " %s: Error initialising xcert\n",
1049 opt_getprog());
1050 goto err;
1051 }
1052 *pexc = exc;
1053 }
1054
1055 switch ((enum range)opt) {
1056 case OPT_X__FIRST:
1057 case OPT_X__LAST:
1058 return 0;
1059 case OPT_X_CERT:
1060 if (exc->certfile != NULL((void*)0) && !ssl_excert_prepend(&exc)) {
1061 BIO_printf(bio_err, "%s: Error adding xcert\n", opt_getprog());
1062 goto err;
1063 }
1064 *pexc = exc;
1065 exc->certfile = opt_arg();
1066 break;
1067 case OPT_X_KEY:
1068 if (exc->keyfile != NULL((void*)0)) {
1069 BIO_printf(bio_err, "%s: Key already specified\n", opt_getprog());
1070 goto err;
1071 }
1072 exc->keyfile = opt_arg();
1073 break;
1074 case OPT_X_CHAIN:
1075 if (exc->chainfile != NULL((void*)0)) {
1076 BIO_printf(bio_err, "%s: Chain already specified\n",
1077 opt_getprog());
1078 goto err;
1079 }
1080 exc->chainfile = opt_arg();
1081 break;
1082 case OPT_X_CHAIN_BUILD:
1083 exc->build_chain = 1;
1084 break;
1085 case OPT_X_CERTFORM:
1086 if (!opt_format(opt_arg(), OPT_FMT_ANY( (1L << 1) | (1L << 2) | (1L << 3) | (1L <<
4) | (1L << 5) | (1L << 7) | (1L << 8) | (
1L << 9) | (1L << 10)), &exc->certform))
1087 return 0;
1088 break;
1089 case OPT_X_KEYFORM:
1090 if (!opt_format(opt_arg(), OPT_FMT_ANY( (1L << 1) | (1L << 2) | (1L << 3) | (1L <<
4) | (1L << 5) | (1L << 7) | (1L << 8) | (
1L << 9) | (1L << 10)), &exc->keyform))
1091 return 0;
1092 break;
1093 }
1094 return 1;
1095
1096 err:
1097 ERR_print_errors(bio_err);
1098 ssl_excert_free(exc);
1099 *pexc = NULL((void*)0);
1100 return 0;
1101}
1102
1103static void print_raw_cipherlist(SSL *s)
1104{
1105 const unsigned char *rlist;
1106 static const unsigned char scsv_id[] = { 0, 0xFF };
1107 size_t i, rlistlen, num;
1108
1109 if (!SSL_is_server(s))
1110 return;
1111 num = SSL_get0_raw_cipherlist(s, NULL)SSL_ctrl(s,110,0,((void*)0));
1112 OPENSSL_assert(num == 2)(void)((num == 2) ? 0 : (OPENSSL_die("assertion failed: " "num == 2"
, "../deps/openssl/openssl/apps/lib/s_cb.c", 1112), 1));
1113 rlistlen = SSL_get0_raw_cipherlist(s, &rlist)SSL_ctrl(s,110,0,&rlist);
1114 BIO_puts(bio_err, "Client cipher list: ");
1115 for (i = 0; i < rlistlen; i += num, rlist += num) {
1116 const SSL_CIPHER *c = SSL_CIPHER_find(s, rlist);
1117 if (i)
1118 BIO_puts(bio_err, ":");
1119 if (c != NULL((void*)0)) {
1120 BIO_puts(bio_err, SSL_CIPHER_get_name(c));
1121 } else if (memcmp(rlist, scsv_id, num) == 0) {
1122 BIO_puts(bio_err, "SCSV");
1123 } else {
1124 size_t j;
1125 BIO_puts(bio_err, "0x");
1126 for (j = 0; j < num; j++)
1127 BIO_printf(bio_err, "%02X", rlist[j]);
1128 }
1129 }
1130 BIO_puts(bio_err, "\n");
1131}
1132
1133/*
1134 * Hex encoder for TLSA RRdata, not ':' delimited.
1135 */
1136static char *hexencode(const unsigned char *data, size_t len)
1137{
1138 static const char *hex = "0123456789abcdef";
1139 char *out;
1140 char *cp;
1141 size_t outlen = 2 * len + 1;
1142 int ilen = (int) outlen;
1143
1144 if (outlen < len || ilen < 0 || outlen != (size_t)ilen) {
1145 BIO_printf(bio_err, "%s: %zu-byte buffer too large to hexencode\n",
1146 opt_getprog(), len);
1147 exit(1);
1148 }
1149 cp = out = app_malloc(ilen, "TLSA hex data buffer");
1150
1151 while (len-- > 0) {
1152 *cp++ = hex[(*data >> 4) & 0x0f];
1153 *cp++ = hex[*data++ & 0x0f];
1154 }
1155 *cp = '\0';
1156 return out;
1157}
1158
1159void print_verify_detail(SSL *s, BIO *bio)
1160{
1161 int mdpth;
1162 EVP_PKEY *mspki;
1163 long verify_err = SSL_get_verify_result(s);
1164
1165 if (verify_err == X509_V_OK0) {
1166 const char *peername = SSL_get0_peername(s);
1167
1168 BIO_printf(bio, "Verification: OK\n");
1169 if (peername != NULL((void*)0))
1170 BIO_printf(bio, "Verified peername: %s\n", peername);
1171 } else {
1172 const char *reason = X509_verify_cert_error_string(verify_err);
1173
1174 BIO_printf(bio, "Verification error: %s\n", reason);
1175 }
1176
1177 if ((mdpth = SSL_get0_dane_authority(s, NULL((void*)0), &mspki)) >= 0) {
Although the value stored to 'mdpth' is used in the enclosing expression, the value is never actually read from 'mdpth'
1178 uint8_t usage, selector, mtype;
1179 const unsigned char *data = NULL((void*)0);
1180 size_t dlen = 0;
1181 char *hexdata;
1182
1183 mdpth = SSL_get0_dane_tlsa(s, &usage, &selector, &mtype, &data, &dlen);
1184
1185 /*
1186 * The TLSA data field can be quite long when it is a certificate,
1187 * public key or even a SHA2-512 digest. Because the initial octets of
1188 * ASN.1 certificates and public keys contain mostly boilerplate OIDs
1189 * and lengths, we show the last 12 bytes of the data instead, as these
1190 * are more likely to distinguish distinct TLSA records.
1191 */
1192#define TLSA_TAIL_SIZE12 12
1193 if (dlen > TLSA_TAIL_SIZE12)
1194 hexdata = hexencode(data + dlen - TLSA_TAIL_SIZE12, TLSA_TAIL_SIZE12);
1195 else
1196 hexdata = hexencode(data, dlen);
1197 BIO_printf(bio, "DANE TLSA %d %d %d %s%s %s at depth %d\n",
1198 usage, selector, mtype,
1199 (dlen > TLSA_TAIL_SIZE12) ? "..." : "", hexdata,
1200 (mspki != NULL((void*)0)) ? "signed the certificate" :
1201 mdpth ? "matched TA certificate" : "matched EE certificate",
1202 mdpth);
1203 OPENSSL_free(hexdata)CRYPTO_free(hexdata, "../deps/openssl/openssl/apps/lib/s_cb.c"
, 1203);
1204 }
1205}
1206
1207void print_ssl_summary(SSL *s)
1208{
1209 const SSL_CIPHER *c;
1210 X509 *peer;
1211
1212 BIO_printf(bio_err, "Protocol version: %s\n", SSL_get_version(s));
1213 print_raw_cipherlist(s);
1214 c = SSL_get_current_cipher(s);
1215 BIO_printf(bio_err, "Ciphersuite: %s\n", SSL_CIPHER_get_name(c));
1216 do_print_sigalgs(bio_err, s, 0);
1217 peer = SSL_get0_peer_certificate(s);
1218 if (peer != NULL((void*)0)) {
1219 int nid;
1220
1221 BIO_puts(bio_err, "Peer certificate: ");
1222 X509_NAME_print_ex(bio_err, X509_get_subject_name(peer),
1223 0, get_nameopt());
1224 BIO_puts(bio_err, "\n");
1225 if (SSL_get_peer_signature_nid(s, &nid)SSL_ctrl(s,108,0,&nid))
1226 BIO_printf(bio_err, "Hash used: %s\n", OBJ_nid2sn(nid));
1227 if (SSL_get_peer_signature_type_nid(s, &nid))
1228 BIO_printf(bio_err, "Signature type: %s\n", get_sigtype(nid));
1229 print_verify_detail(s, bio_err);
1230 } else {
1231 BIO_puts(bio_err, "No peer certificate\n");
1232 }
1233#ifndef OPENSSL_NO_EC
1234 ssl_print_point_formats(bio_err, s);
1235 if (SSL_is_server(s))
1236 ssl_print_groups(bio_err, s, 1);
1237 else
1238 ssl_print_tmp_key(bio_err, s);
1239#else
1240 if (!SSL_is_server(s))
1241 ssl_print_tmp_key(bio_err, s);
1242#endif
1243}
1244
1245int config_ctx(SSL_CONF_CTX *cctx, STACK_OF(OPENSSL_STRING)struct stack_st_OPENSSL_STRING *str,
1246 SSL_CTX *ctx)
1247{
1248 int i;
1249
1250 SSL_CONF_CTX_set_ssl_ctx(cctx, ctx);
1251 for (i = 0; i < sk_OPENSSL_STRING_num(str)OPENSSL_sk_num(ossl_check_const_OPENSSL_STRING_sk_type(str)); i += 2) {
1252 const char *flag = sk_OPENSSL_STRING_value(str, i)((char *)OPENSSL_sk_value(ossl_check_const_OPENSSL_STRING_sk_type
(str), (i)));
1253 const char *arg = sk_OPENSSL_STRING_value(str, i + 1)((char *)OPENSSL_sk_value(ossl_check_const_OPENSSL_STRING_sk_type
(str), (i + 1)));
1254
1255 if (SSL_CONF_cmd(cctx, flag, arg) <= 0) {
1256 BIO_printf(bio_err, "Call to SSL_CONF_cmd(%s, %s) failed\n",
1257 flag, arg == NULL((void*)0) ? "<NULL>" : arg);
1258 ERR_print_errors(bio_err);
1259 return 0;
1260 }
1261 }
1262 if (!SSL_CONF_CTX_finish(cctx)) {
1263 BIO_puts(bio_err, "Error finishing context\n");
1264 ERR_print_errors(bio_err);
1265 return 0;
1266 }
1267 return 1;
1268}
1269
1270static int add_crls_store(X509_STORE *st, STACK_OF(X509_CRL)struct stack_st_X509_CRL *crls)
1271{
1272 X509_CRL *crl;
1273 int i, ret = 1;
1274
1275 for (i = 0; i < sk_X509_CRL_num(crls)OPENSSL_sk_num(ossl_check_const_X509_CRL_sk_type(crls)); i++) {
1276 crl = sk_X509_CRL_value(crls, i)((X509_CRL *)OPENSSL_sk_value(ossl_check_const_X509_CRL_sk_type
(crls), (i)));
1277 if (!X509_STORE_add_crl(st, crl))
1278 ret = 0;
1279 }
1280 return ret;
1281}
1282
1283int ssl_ctx_add_crls(SSL_CTX *ctx, STACK_OF(X509_CRL)struct stack_st_X509_CRL *crls, int crl_download)
1284{
1285 X509_STORE *st;
1286
1287 st = SSL_CTX_get_cert_store(ctx);
1288 add_crls_store(st, crls);
1289 if (crl_download)
1290 store_setup_crl_download(st);
1291 return 1;
1292}
1293
1294int ssl_load_stores(SSL_CTX *ctx,
1295 const char *vfyCApath, const char *vfyCAfile,
1296 const char *vfyCAstore,
1297 const char *chCApath, const char *chCAfile,
1298 const char *chCAstore,
1299 STACK_OF(X509_CRL)struct stack_st_X509_CRL *crls, int crl_download)
1300{
1301 X509_STORE *vfy = NULL((void*)0), *ch = NULL((void*)0);
1302 int rv = 0;
1303
1304 if (vfyCApath != NULL((void*)0) || vfyCAfile != NULL((void*)0) || vfyCAstore != NULL((void*)0)) {
1305 vfy = X509_STORE_new();
1306 if (vfy == NULL((void*)0))
1307 goto err;
1308 if (vfyCAfile != NULL((void*)0) && !X509_STORE_load_file(vfy, vfyCAfile))
1309 goto err;
1310 if (vfyCApath != NULL((void*)0) && !X509_STORE_load_path(vfy, vfyCApath))
1311 goto err;
1312 if (vfyCAstore != NULL((void*)0) && !X509_STORE_load_store(vfy, vfyCAstore))
1313 goto err;
1314 add_crls_store(vfy, crls);
1315 SSL_CTX_set1_verify_cert_store(ctx, vfy)SSL_CTX_ctrl(ctx,106,1,(char *)(vfy));
1316 if (crl_download)
1317 store_setup_crl_download(vfy);
1318 }
1319 if (chCApath != NULL((void*)0) || chCAfile != NULL((void*)0) || chCAstore != NULL((void*)0)) {
1320 ch = X509_STORE_new();
1321 if (ch == NULL((void*)0))
1322 goto err;
1323 if (chCAfile != NULL((void*)0) && !X509_STORE_load_file(ch, chCAfile))
1324 goto err;
1325 if (chCApath != NULL((void*)0) && !X509_STORE_load_path(ch, chCApath))
1326 goto err;
1327 if (chCAstore != NULL((void*)0) && !X509_STORE_load_store(ch, chCAstore))
1328 goto err;
1329 SSL_CTX_set1_chain_cert_store(ctx, ch)SSL_CTX_ctrl(ctx,107,1,(char *)(ch));
1330 }
1331 rv = 1;
1332 err:
1333 X509_STORE_free(vfy);
1334 X509_STORE_free(ch);
1335 return rv;
1336}
1337
1338/* Verbose print out of security callback */
1339
1340typedef struct {
1341 BIO *out;
1342 int verbose;
1343 int (*old_cb) (const SSL *s, const SSL_CTX *ctx, int op, int bits, int nid,
1344 void *other, void *ex);
1345} security_debug_ex;
1346
1347static STRINT_PAIR callback_types[] = {
1348 {"Supported Ciphersuite", SSL_SECOP_CIPHER_SUPPORTED(1 | (1 << 16))},
1349 {"Shared Ciphersuite", SSL_SECOP_CIPHER_SHARED(2 | (1 << 16))},
1350 {"Check Ciphersuite", SSL_SECOP_CIPHER_CHECK(3 | (1 << 16))},
1351#ifndef OPENSSL_NO_DH
1352 {"Temp DH key bits", SSL_SECOP_TMP_DH(7 | (4 << 16))},
1353#endif
1354 {"Supported Curve", SSL_SECOP_CURVE_SUPPORTED(4 | (2 << 16))},
1355 {"Shared Curve", SSL_SECOP_CURVE_SHARED(5 | (2 << 16))},
1356 {"Check Curve", SSL_SECOP_CURVE_CHECK(6 | (2 << 16))},
1357 {"Supported Signature Algorithm", SSL_SECOP_SIGALG_SUPPORTED(11 | (5 << 16))},
1358 {"Shared Signature Algorithm", SSL_SECOP_SIGALG_SHARED(12 | (5 << 16))},
1359 {"Check Signature Algorithm", SSL_SECOP_SIGALG_CHECK(13 | (5 << 16))},
1360 {"Signature Algorithm mask", SSL_SECOP_SIGALG_MASK(14 | (5 << 16))},
1361 {"Certificate chain EE key", SSL_SECOP_EE_KEY(16 | (6 << 16))},
1362 {"Certificate chain CA key", SSL_SECOP_CA_KEY(17 | (6 << 16))},
1363 {"Peer Chain EE key", SSL_SECOP_PEER_EE_KEY((16 | (6 << 16)) | 0x1000)},
1364 {"Peer Chain CA key", SSL_SECOP_PEER_CA_KEY((17 | (6 << 16)) | 0x1000)},
1365 {"Certificate chain CA digest", SSL_SECOP_CA_MD(18 | (6 << 16))},
1366 {"Peer chain CA digest", SSL_SECOP_PEER_CA_MD((18 | (6 << 16)) | 0x1000)},
1367 {"SSL compression", SSL_SECOP_COMPRESSION(15 | 0)},
1368 {"Session ticket", SSL_SECOP_TICKET(10 | 0)},
1369 {NULL((void*)0)}
1370};
1371
1372static int security_callback_debug(const SSL *s, const SSL_CTX *ctx,
1373 int op, int bits, int nid,
1374 void *other, void *ex)
1375{
1376 security_debug_ex *sdb = ex;
1377 int rv, show_bits = 1, cert_md = 0;
1378 const char *nm;
1379 int show_nm;
1380
1381 rv = sdb->old_cb(s, ctx, op, bits, nid, other, ex);
1382 if (rv == 1 && sdb->verbose < 2)
1383 return 1;
1384 BIO_puts(sdb->out, "Security callback: ");
1385
1386 nm = lookup(op, callback_types, NULL((void*)0));
1387 show_nm = nm != NULL((void*)0);
1388 switch (op) {
1389 case SSL_SECOP_TICKET(10 | 0):
1390 case SSL_SECOP_COMPRESSION(15 | 0):
1391 show_bits = 0;
1392 show_nm = 0;
1393 break;
1394 case SSL_SECOP_VERSION(9 | 0):
1395 BIO_printf(sdb->out, "Version=%s", lookup(nid, ssl_versions, "???"));
1396 show_bits = 0;
1397 show_nm = 0;
1398 break;
1399 case SSL_SECOP_CA_MD(18 | (6 << 16)):
1400 case SSL_SECOP_PEER_CA_MD((18 | (6 << 16)) | 0x1000):
1401 cert_md = 1;
1402 break;
1403 case SSL_SECOP_SIGALG_SUPPORTED(11 | (5 << 16)):
1404 case SSL_SECOP_SIGALG_SHARED(12 | (5 << 16)):
1405 case SSL_SECOP_SIGALG_CHECK(13 | (5 << 16)):
1406 case SSL_SECOP_SIGALG_MASK(14 | (5 << 16)):
1407 show_nm = 0;
1408 break;
1409 }
1410 if (show_nm)
1411 BIO_printf(sdb->out, "%s=", nm);
1412
1413 switch (op & SSL_SECOP_OTHER_TYPE0xffff0000) {
1414
1415 case SSL_SECOP_OTHER_CIPHER(1 << 16):
1416 BIO_puts(sdb->out, SSL_CIPHER_get_name(other));
1417 break;
1418
1419#ifndef OPENSSL_NO_EC
1420 case SSL_SECOP_OTHER_CURVE(2 << 16):
1421 {
1422 const char *cname;
1423 cname = EC_curve_nid2nist(nid);
1424 if (cname == NULL((void*)0))
1425 cname = OBJ_nid2sn(nid);
1426 BIO_puts(sdb->out, cname);
1427 }
1428 break;
1429#endif
1430 case SSL_SECOP_OTHER_CERT(6 << 16):
1431 {
1432 if (cert_md) {
1433 int sig_nid = X509_get_signature_nid(other);
1434
1435 BIO_puts(sdb->out, OBJ_nid2sn(sig_nid));
1436 } else {
1437 EVP_PKEY *pkey = X509_get0_pubkey(other);
1438
1439 if (pkey == NULL((void*)0)) {
1440 BIO_printf(sdb->out, "Public key missing");
1441 } else {
1442 const char *algname = "";
1443
1444 EVP_PKEY_asn1_get0_info(NULL((void*)0), NULL((void*)0), NULL((void*)0), NULL((void*)0),
1445 &algname, EVP_PKEY_get0_asn1(pkey));
1446 BIO_printf(sdb->out, "%s, bits=%d",
1447 algname, EVP_PKEY_get_bits(pkey));
1448 }
1449 }
1450 break;
1451 }
1452 case SSL_SECOP_OTHER_SIGALG(5 << 16):
1453 {
1454 const unsigned char *salg = other;
1455 const char *sname = NULL((void*)0);
1456 int raw_sig_code = (salg[0] << 8) + salg[1]; /* always big endian (msb, lsb) */
1457 /* raw_sig_code: signature_scheme from tls1.3, or signature_and_hash from tls1.2 */
1458
1459 if (nm != NULL((void*)0))
1460 BIO_printf(sdb->out, "%s", nm);
1461 else
1462 BIO_printf(sdb->out, "s_cb.c:security_callback_debug op=0x%x", op);
1463
1464 sname = lookup(raw_sig_code, signature_tls13_scheme_list, NULL((void*)0));
1465 if (sname != NULL((void*)0)) {
1466 BIO_printf(sdb->out, " scheme=%s", sname);
1467 } else {
1468 int alg_code = salg[1];
1469 int hash_code = salg[0];
1470 const char *alg_str = lookup(alg_code, signature_tls12_alg_list, NULL((void*)0));
1471 const char *hash_str = lookup(hash_code, signature_tls12_hash_list, NULL((void*)0));
1472
1473 if (alg_str != NULL((void*)0) && hash_str != NULL((void*)0))
1474 BIO_printf(sdb->out, " digest=%s, algorithm=%s", hash_str, alg_str);
1475 else
1476 BIO_printf(sdb->out, " scheme=unknown(0x%04x)", raw_sig_code);
1477 }
1478 }
1479
1480 }
1481
1482 if (show_bits)
1483 BIO_printf(sdb->out, ", security bits=%d", bits);
1484 BIO_printf(sdb->out, ": %s\n", rv ? "yes" : "no");
1485 return rv;
1486}
1487
1488void ssl_ctx_security_debug(SSL_CTX *ctx, int verbose)
1489{
1490 static security_debug_ex sdb;
1491
1492 sdb.out = bio_err;
1493 sdb.verbose = verbose;
1494 sdb.old_cb = SSL_CTX_get_security_callback(ctx);
1495 SSL_CTX_set_security_callback(ctx, security_callback_debug);
1496 SSL_CTX_set0_security_ex_data(ctx, &sdb);
1497}
1498
1499static void keylog_callback(const SSL *ssl, const char *line)
1500{
1501 if (bio_keylog == NULL((void*)0)) {
1502 BIO_printf(bio_err, "Keylog callback is invoked without valid file!\n");
1503 return;
1504 }
1505
1506 /*
1507 * There might be concurrent writers to the keylog file, so we must ensure
1508 * that the given line is written at once.
1509 */
1510 BIO_printf(bio_keylog, "%s\n", line);
1511 (void)BIO_flush(bio_keylog)(int)BIO_ctrl(bio_keylog,11,0,((void*)0));
1512}
1513
1514int set_keylog_file(SSL_CTX *ctx, const char *keylog_file)
1515{
1516 /* Close any open files */
1517 BIO_free_all(bio_keylog);
1518 bio_keylog = NULL((void*)0);
1519
1520 if (ctx == NULL((void*)0) || keylog_file == NULL((void*)0)) {
1521 /* Keylogging is disabled, OK. */
1522 return 0;
1523 }
1524
1525 /*
1526 * Append rather than write in order to allow concurrent modification.
1527 * Furthermore, this preserves existing keylog files which is useful when
1528 * the tool is run multiple times.
1529 */
1530 bio_keylog = BIO_new_file(keylog_file, "a");
1531 if (bio_keylog == NULL((void*)0)) {
1532 BIO_printf(bio_err, "Error writing keylog file %s\n", keylog_file);
1533 return 1;
1534 }
1535
1536 /* Write a header for seekable, empty files (this excludes pipes). */
1537 if (BIO_tell(bio_keylog)(int)BIO_ctrl(bio_keylog,133,0,((void*)0)) == 0) {
1538 BIO_puts(bio_keylog,
1539 "# SSL/TLS secrets log file, generated by OpenSSL\n");
1540 (void)BIO_flush(bio_keylog)(int)BIO_ctrl(bio_keylog,11,0,((void*)0));
1541 }
1542 SSL_CTX_set_keylog_callback(ctx, keylog_callback);
1543 return 0;
1544}
1545
1546void print_ca_names(BIO *bio, SSL *s)
1547{
1548 const char *cs = SSL_is_server(s) ? "server" : "client";
1549 const STACK_OF(X509_NAME)struct stack_st_X509_NAME *sk = SSL_get0_peer_CA_list(s);
1550 int i;
1551
1552 if (sk == NULL((void*)0) || sk_X509_NAME_num(sk)OPENSSL_sk_num(ossl_check_const_X509_NAME_sk_type(sk)) == 0) {
1553 if (!SSL_is_server(s))
1554 BIO_printf(bio, "---\nNo %s certificate CA names sent\n", cs);
1555 return;
1556 }
1557
1558 BIO_printf(bio, "---\nAcceptable %s certificate CA names\n",cs);
1559 for (i = 0; i < sk_X509_NAME_num(sk)OPENSSL_sk_num(ossl_check_const_X509_NAME_sk_type(sk)); i++) {
1560 X509_NAME_print_ex(bio, sk_X509_NAME_value(sk, i)((X509_NAME *)OPENSSL_sk_value(ossl_check_const_X509_NAME_sk_type
(sk), (i))), 0, get_nameopt());
1561 BIO_write(bio, "\n", 1);
1562 }
1563}