ssl_check_chain

#!/usr/bin/perl

use warnings;
use strict;

my $copyright = << 'COPYRIGHT';
Copyright (C) 2021 Timothe Litt <litt at acm.org>
Use --man for license information.
COPYRIGHT

our $VERSION = '$Id$';

# License is in the POD at the end of this file.

use Config( qw/%Config/ );
use Cwd( qw/realpath/ );
use Date::Parse;
use Errno( qw/EAGAIN/ );
use Fcntl( qw/:seek/ );
use File::Basename;
use File::Spec;
use File::Temp;
use Getopt::Long( qw/:config bundling/ );
use POSIX( qw/strftime/ );
use Text::Abbrev;

my @signo;
defined $Config{sig_name} and @signo = ( split( ' ', $Config{sig_name} ) );
my $ostype = eval { require Perl::OSType; return Perl::OSType::os_type() } || 'Unix';
my $havepss;

my $tmpdir  = File::Spec->tmpdir || '.';
my $CAcerts = '';

# Environment variables that specify trusted CA locations

my %calocs = ( -CAfile => [qw/SSL_CERT_FILE CURL_CA_BUNDLE/],
               -CApath => [qw/SSL_CERT_DIR/],
             );
for my $opt ( keys %calocs ) {
    my $vars = $calocs{$opt};
    foreach my $var ( @$vars ) {
        if( my $val = $ENV{$var} ) {
            $CAcerts .= " $opt $val ";
            last;
        }
    }
}

# s_client supported list of starttls protocols => standard port
#<<<
my %starttls = (
    "xmpp-server" => 5269, "postgres" => 5432, "xmpp" => 5222, "sieve" => 2000,
    "mysql"       => 3306, "pop3"     => 110,  "imap" => 143,  "irc"   => 194,
    "nntp"        => 119,  "ldap"     => 389,  "ftp"  => 21,   "lmtp"  => 24,
    "smtp"        => 25,
               );
#>>>
my %starttlsAbbrev = abbrev( keys %starttls );

# Duplicate / @loop detection
my( %atfiles, %hosts );

# Option values => OpenSSL options

my %tlsver = ( '1.1' => '-tls1_1', '1.2' => '-tls1_2', '1.3' => '-tls1_3', );

# Option values
my(   $cafile, $cadir, $debug, $warn, $help, $man, $version, $starttls, $timeout, $tlsver,
      $type );

# Execute command & print unexpected errors

sub docmd {
    my( $cmd ) = join( '', @_ );
    printf( ">> %s", $cmd ) if( $debug );
    my $r = qx($cmd);

    if( $? != 0 ) {
        if( $? == -1 ) {
            printf STDERR ( "failed to execute %s: $!\n", $cmd );
        } elsif( $? & 127 ) {
            printf STDERR ( "%s died with signal %s (%d), %s coredump\n", $cmd,
                            ( $signo[ $? & 127 ] || '??' ), ( $? & 127 ),
                            ( $? & 128 ) ? 'with' : 'without' );
        } elsif( $_[1] ne 'verify' ) {
            printf STDERR ( "%s exited with value %d\n", $cmd, $? >> 8 );
        }
        return "$r";
    }
    return $r;
}

# Compute a time difference and return an approximate text representation

sub pdelta {
    my( $date, $now ) = @_;

    my $day   = 24 * 60 * 60;
    my $delta = $date - $now;
    my $d2g   = int( ( abs( $delta ) ) / $day );
    if( $d2g == 0 ) {
        return "today";
    }
    $d2g = int( ( abs( $delta ) + ( $day - 1 ) ) / $day );

    my $text = "in %d days%s, on %s";

    if( $delta < 0 ) {
        $text  = "%d days%s ago, on %s";
        $delta = -$delta;
    }
    my $y2g = "";
    if( $d2g > 366 ) {
        $y2g = sprintf( " (%.2f years)", $d2g / 365 );
    }
    return sprintf( $text, $d2g, $y2g,
                    strftime( '%a %d-%b-%Y at %T %Z', localtime( $date ) ) );
}

# Produce a string describing where something was specified

sub atloc {
    my( $at, $atl ) = @_;

    return sprintf( "in %s at line %u", $at, $atl )
        if( $at );
    return "in command arguments";
}

# Expand tildes in file names and return the realpath

sub tildename {
    my( $filename, $at, $atl ) = @_;

    if( $filename =~ s,^~([^/]*)/,, ) {
        if( $ostype eq 'Unix' ) {
            my $user = length $1 ? $1 : getlogin();
            my $dir  = ( getpwnam( $user ) )[7];
            die(  sprintf(
                        "~%s/%s: %s has no home directory, specified %s\n", $1, $filename,
                        $user,
                        atloc( $at, $atl ) ) )
                unless( $dir );
            $filename = File::Spec->catfile( $dir, $filename );
        }
    }
    return realpath( $filename );
}

# Read a PEM file and make sure it contains at least one certificate

sub readfile {
    my( $name, $header, $at, $atl ) = @_;

    $$header = 1;
    $name    = tildename( $name, $at, $atl );
    unless( defined $name ) {
        printf STDERR ( "Skipping unresolvable filename %s, specified %s\n", $_[0],
                        atloc( $at, $atl ) )
            if( $warn );
        return;
    }
    if( ( my $prev = $hosts{"$name:FILE"} ) ) {
        printf STDERR (
                "Skipping duplicate certificate file %s %s, previously specified in %s\n",
                $name, atloc( $at, $atl ), $prev )
            if( $warn );
        $hosts{"$name:FILE"} = atloc( $at, $atl );
        return;
    }
    $hosts{"$name:FILE"} = atloc( $at, $atl );
    printf( "open: $name\n" ) if( $debug );
    if( open( my $fh, '<', $name ) ) {
        my $chain = '';
        while( <$fh> ) {
            $chain .= $_;
        }
        close( $fh );
        unless( $chain =~ /^-{2,8}BEGIN (?:TRUSTED )?CERTIFICATE/m ) {
            die(  sprintf( "No certificates found in %s, specified %s\n", $name,
                           atloc( $at, $atl ) ) );
        }
        ( my $haskey ) = $chain =~ /^-{2,8}BEGIN (RSA|EC) PRIVATE KEY/m;
        return ( $chain, $haskey );
    }
    die( sprintf( "open: %s: %s %s\n", $name, $!, atloc( $at, $atl ) ) );
}

# Process an indirect file, which contains hosts, files, and/or more indirection

sub atfile {
    my( $host, $fn, $header, $first, $at, $atl ) = @_;

    $fn = tildename( $fn, $at, $atl );
    die(  sprintf( "Unresolvable \@filename %s, specified %s\n", $_[1], atloc( $at, $atl )
                 ) )
        unless( defined $fn );
    if( $atfiles{$fn} ) {
        printf STDERR (
                      "Skipping redundant use of %s => %s %s.  The previous use was %s\n",
                      $host, $fn, atloc( $at, $atl ), $atfiles{$fn} )
            if( $warn );
        $atfiles{$fn} = atloc( $at, $atl );
        return;
    }
    $atfiles{$fn} = atloc( $at, $atl );
    printf( "open: $fn\n" ) if( $debug );
    if( open( my $fh, '<', $fn ) ) {
        while( <$fh> ) {
            chomp $_;
            s/^\s*//;
            s/\s*$//;
            next                                 if( /^(?:#.*)?$/ );
            printf( "%s:%u: %s\n", $fn, $., $_ ) if( $debug );
            $$header = 1;
            checkhost( $_, $header, $first, $fn, $. );
        }
        close( $fh );
    } else {
        die( sprintf( "open: %s: %s %s\n", $fn, $!, atloc( $at, $atl ) ) );
    }
    return;
}

# Run the checks on each argument - indirect, host, or file

sub checkhost {
    my( $host, $header, $first, $at, $atl ) = @_;

    return atfile( $host, $1, $header, $first, $at, $atl ) if( $host =~ /^@(.*)$/ );

    my $text = '';
    my( $port, $chain, $haskey );
    if( $host =~ m,^[/.~], || $host =~ m,/, ) {
        $port = 'FILE';
        $host =~ s/:FILE$//;
        ( $chain, $haskey ) = readfile( $host, $header, $at, $atl );
        return unless( $chain );
    } elsif( ( my $name, $port, my $pn ) =
             $host =~ m,^(\[[[:xdigit:]:]\]|.*?):(?:([[:digit:]]+)|([[:alnum:].*_-]+))$, )
    {
        if( $pn ) {
            $port = getservbyname( $pn, 'tcp' );
            if( $port ) {
                $host = "$name:$port";
            } elsif( $pn =~ /^FILE$/ ) {
                $port = $pn;
                ( $chain, $haskey ) = readfile( $name, $header, $at, $atl );
                return unless( $chain );
            } else {
                die(  sprintf(
"\"%s\" is not a known port name for %s, specified %s, see /etc/services\n",
                          $pn, $name, atloc( $at, $atl ) ) );
            }
        }
    } elsif( $starttls =~ /^-starttls (.*)$/ && ( $port = $starttls{$1} ) ) {
        $host .= ":$port";
    } else {
        $port = 443;
        $host .= ":$port";
    }
    if( $port ne 'FILE' ) {
        if( ( my $prev = $hosts{$host} ) ) {
            printf STDERR (
                    "Skipping duplicate host \"%s\" %s, previously specified %s\n", $host,
                    atloc( $at, $atl ),                                             $prev
                          )
                if( $warn );
            $hosts{$host} = atloc( $at, $atl );
            return;
        }
        $hosts{$host} = atloc( $at, $atl );
    }

    unless( defined $chain ) {
        my $cmd =
            "openssl s_client $CAcerts $starttls -showcerts $tlsver $type -connect $host";
        printf STDERR ( ">> %s\n", $cmd ) if( $debug );
        my( $cpid, $waitpid );
        eval {
                my( $saveout, $saveerr );
                open( $saveout, ">&STDOUT" );
                open( $saveerr, ">&STDERR" );
                $chain = File::Temp->new(
                                       DIR    => $tmpdir, TEMPLATE => "checkchain-XXXXXX",
                                       SUFFIX => '.txt',  UNLINK   => 1 );
                open( STDOUT, ">&" . fileno( $chain ) ) or die( "open1: $!\n" );
                open( STDERR, ">&" . fileno( $chain ) ) or die( "open2: $!\n" );
                local $SIG{ALRM} = sub { kill 'KILL', $cpid; die( "timeout!\n" ) };
#<<<
            FORK:{
                    if( $cpid = fork ) {
                        close( STDOUT );
                        open( STDOUT, ">&" . fileno( $saveout ) );
                        close( $saveout );
                        close( STDERR );
                        open( STDERR, ">&" . fileno( $saveerr ) );
                        close( $saveerr );
                        last;
                    } elsif( defined $cpid ) {
                        close( STDIN );
                        open( STDIN, '<', '/dev/null' ) or die( "open3: $!\n" );
                        exec $cmd                       or die( "exec: $!\n" );
                    } elsif( $! == EAGAIN ) {
                        sleep 3;
                        redo FORK;
                    } else {
                        die( "Can't fork: $!\n" );
                    }
                }
#>>>
                alarm( $timeout );
                ( $waitpid = waitpid( $cpid, 0 ) ) == $cpid or die( "waitpid: $!\n" );
                alarm( 0 );
        };
        alarm( 0 );
        waitpid( $cpid, 0 ) if( $cpid && !$waitpid );
        if( $@ ) {
            undef $chain;
            die( "$@" ) unless( $@ eq "timeout!\n" );
            printf STDERR ( "Unable to connect to $host (timeout)\n" );
            return;
        } else {
            seek( $chain, 0, SEEK_SET );
            local $/;
            $chain = <$chain>;
        }
        unless( defined $chain && length $chain ) {
            printf STDERR ( "Unable to connect to $host\n" );
            return;
        }
        if( $chain =~ /\balert handshake failure\b/ || $? ) {
            if( $debug ) {
                print STDERR ( $chain ) if( $chain );
                if( $? ) {
                    if( $? == -1 ) {
                        printf STDERR ( "failed to execute %s: $!\n", $cmd );
                    } elsif( $? & 127 ) {
                        printf STDERR ("%s died with signal %s (%d), %s coredump\n", $cmd,
                                       ( $signo[ $? & 127 ] || '??' ), ( $? & 127 ),
                                       ( $? & 128 ) ? 'with' : 'without' );
                    } else {
                        printf STDERR ( "%s exited with value %d\n", $cmd, $? >> 8 );
                    }
                }
            }
            printf STDERR ( "TLS connection to %s was not successful\n", $host );
            return;
        }
        return unless( $chain );
    }

    my @chain = $chain =~ /(^-{2,8}BEGIN (?:TRUSTED )?CERTIFICATE.*?^-{2,8}END.*?\n)/msg;
    if( @chain ) {
        my %cert;
        my $now = time;

        my $untrusted = '';
        for( my $i = 0; $i < @chain; ++$i ) {
            my $file = File::Temp->new(
                                    DIR    => $tmpdir, TEMPLATE => "checkchain-$i-XXXXXX",
                                    SUFFIX => '.pem',  UNLINK   => 1 );
            $cert{$i}{file} = $file;
            print $file ( $chain[$i] );
            $file->flush;
            my $state = docmd( "openssl ",           "x509",
                               " -noout -text -in ", "$file\n" );
            $cert{$i}{subject} = $1 if( $state =~ /^\s*Subject:\s*(.*?)$/m );
            $cert{$i}{issuer}  = $1 if( $state =~ /^\s*Issuer:\s*(.*?)$/m );
            $cert{$i}{start}   = str2time( $1, 'GMT' )
                if( $state =~ /^\s*Not Before\s*:\s*(.*?)$/m );
            $cert{$i}{end} = str2time( $1, 'GMT' )
                if( $state =~ /^\s*Not After\s*:\s*(.*?)$/m );
            $cert{$i}{key} = uc $1
                if( $state =~
                /^\s*Public Key Algorithm\s*:\s*(?:id-)?(.*?)(?:PublicKey|Encryption)?$/m
                );
            $cert{$i}{klen} = $1 if( $state =~ /^\s*(?:RSA )?Public-Key\s*:\s*(.*?)$/m );

            $untrusted .= sprintf( " -untrusted %s", "$file" ) if( $i > 0 );
        }

        for( my $i = 0; $i < @chain; ++$i ) {
            $text .= "\n" if( $i > 0 );
            $text .= sprintf( "Contains private %s key\n\n", $haskey )
                if( $i == 0 && $haskey );
            $text .= sprintf(
                            "[%u] Subject: %s\n    Issuer : %s\n", $i, $cert{$i}{subject},
                            $cert{$i}{issuer} );
            $text .= sprintf( "    Type   : %s %s\n", $cert{$i}{key}, $cert{$i}{klen} );
            if( $now < $cert{$i}{start} || $now > $cert{$i}{end} ) {
                $text .= "    Certificate is NOT valid at this time\n";
            }
            if( $now < $cert{$i}{start} ) {
                $text .= sprintf( "    Certificate is not yet valid, will be %s\n",
                                  pdelta( $cert{$i}{start}, $now ) );
            } else {
                $text .= sprintf( "    Certificate became valid %s\n",
                                  pdelta( $cert{$i}{start}, $now ) );
            }
            if( $now > $cert{$i}{end} ) {
                $text .= sprintf( "    Certificate expired %s\n",
                                  pdelta( $cert{$i}{end}, $now ) );
            } else {
                $text .= sprintf( "    Certificate expires %s\n",
                                  pdelta( $cert{$i}{end}, $now ) );
            }

            my $state = docmd(
                           "openssl ", "verify", " $CAcerts $untrusted ", $cert{$i}{file},
                           " 2>&1\n" );
            chomp $state;

            if( my( $subj, $err, $depth, $text ) =
                  $state =~
                /\A(.*?)\nerror ([[:digit:]]+) at ([[:digit:]]+) depth lookup: (.*?)$/m )
            {
                if( $subj eq $cert{$i}{issuer} ) {
                    $state =
"Failed to verify issuer's certificate:\n  $subj\n  SSL error: $err : \"$text\" at depth $depth";
                }
            }
            $state =~ s,$tmpdir/.*?\.pem: ,,g;
            $state = "Verify result: " . $state;
            $state =~ s/^/    /gm;
            $text .= $state . "\n";
        }
    } else {
        $text = $chain;
    }
    if( $$header ) {
        $text =~ s/^/  /mg;

        $header = '';
        if( $$first ) {
            $$first = 0;
        } else {
            $header = "\n";
        }
        $header .= sprintf( "%s\n%s\n", $host, '-' x length( $host ) );
        $text = $header . $text;
    }

    print( $text );
}

# Main program - Process command line options

GetOptions( "CAfile=s"       => \$cafile,
            "CApath|CAdir=s" => \$cadir,
            "debug|d!"       => \$debug,
            "starttls=s"     => \$starttls,
            "timeout=i"      => \$timeout,
            "tlsversion=s"   => \$tlsver,
            "type=s"         => \$type,
            "warnings!"      => \$warn,
            'help|?|h'       => \$help,
            'man'            => \$man,
            'version'        => \$version,
          ) or die( "Command line error, --help for usage\n" );
if( $help || $man ) {
    eval {
            no warnings 'once';
            $Pod::Usage::Formatter = 'Pod::Text::Termcap';
            require Pod::Usage;
        } or
        die( "Install Pod::Usage or use 'perldoc $0'\n" );

    Pod::Usage::pod2usage( 1 )                            if( $help );
    Pod::Usage::pod2usage( -exitval => 0, -verbose => 2 ) if $man;
}
if( $version ) {
    printf( "%s version %s\n%s", basename( $0 ),
            join( '-', ( $VERSION =~ /([[:xdigit:]]{4})/g )[ -4 .. -1 ] ), $copyright );
    exit;
}
$warn = 1 unless( defined $warn );

# Default and/or convert option values for use

if( defined $cafile || defined $cadir ) {
    $CAcerts = '';
    $CAcerts .= " -CAfile $cafile"
        if( defined $cafile );
    $CAcerts .= " -CApath $cadir"
        if( defined $cadir );
}
if( defined $starttls ) {
    my $fullnm = $starttlsAbbrev{ lc $starttls };
    die "Unsupported STARTTLS protocol: \"$starttls\"\n" unless( $fullnm );
    $starttls = $fullnm;
    $starttls = "-starttls $starttls";
} else {
    $starttls = '';
}
if( defined $timeout ) {
    $timeout = abs( $timeout ) || 2;
} else {
    $timeout = 120;
}
if( defined $tlsver ) {
    die "Unsupported TLS version\n" unless( ( $tlsver = $tlsver{$tlsver} ) );
} else {
    $tlsver = '';
}
if( defined $type ) {
    $type = lc $type;

    my $cs;
    if( $type =~ /^ec(?:dsa)?$/ ) {
        $cs = 'ECDSA+SHA1:ECDSA+SHA224:ECDSA+SHA384:ECDSA+SHA256:ECDSA+SHA512';
    } elsif( $type eq 'rsa' ) {
        unless( defined $havepss ) {
            my $pkalgs = docmd( 'openssl ', 'list -public-key-algorithms' );
            $havepss = $pkalgs =~ /^\s*PEM\sstring:\s*RSA-PSS\b/m;
        }
        if( $tlsver =~ /1_[3-9]$/ ) {
            die( sprintf( "TLS 1.3 doesn't support '%s' certificates\n", uc $type ) );
        }
        $cs =
            $havepss
            ? 'RSA-PSS+SHA512:RSA-PSS+SHA384:RSA-PSS+SHA256:RSA+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA224:RSA+SHA1'
            : 'RSA+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA224:RSA+SHA1';
    }
    $type = "-sigalgs '$cs'";
} else {
    $type = '';
}

# Finally, process each command line argument (or complain if none)

unless( @ARGV >= 1 ) {
    eval { require Pod::Usage; } or die( "See " . basename( $0 ) . " --help\n" );
    Pod::Usage::pod2usage( 1 );
}

my $first  = 1;
my $header = @ARGV > 1 || grep { /^@/ } @ARGV;

foreach my $host ( @ARGV ) {
    checkhost( $host, \$header, \$first );
}
exit

__END__

=head1 SSL_CHECK_CHAIN

ssl_check_chain - check the certificate chain for hosts

=head1 SYNOPSIS

ssl_check_chain [options] [host[:port] ...] [file:FILE] [@file...]

 Options:
   --CAfile=file     Specify bundle file of trusted CA certificates for verification
   --CApath=dir      Specify a hashed directory containing trusted CA certificates for verification.
   --starttls=proto  Specify that STARTTLS should be used in the connection.
   --timeout=secs    Specify timeout for TLS connections
   --tlsversion=ver  Specify the version TLS to connect with
   --type=type       Specify the certificate type desired from the server
   --[no-]warnings   Display or suppress warnings
   --help            brief help message
   --man             full documentation

=head1 OPTIONS

=over 8

=item B<--CAfile>=I<file>

Specify a file containing one or more trusted CA certificates to verify the host's certificate chain.

If not specified, the environment variables SSL_CERT_FILE and CURL_CA_BUNDLE will be tried, and if neither of them is set, OpenSSL's default will be used.

=item B<--CApath>=I<file> B<--CAdir>=I<file>

Specify a directory containing hashed links to one or more trusted CA certificates to verify the host's certificate chain.

If not specified, the environment variable SSL_CERT_DIR will be tried.  If it is not set, OpenSSL's default will be used.

=item B<--starttls>=I<protocol>

Specifies that STARTTLS is required to make the TLS connection.

I<protocol> is one of the following:  "smtp", "pop3", "imap", "ftp", "xmpp",
           "xmpp-server", "irc", "postgres", "mysql", "lmtp", "nntp", "sieve", or "ldap"

=item B<--timeout>=I<secs> I<@file>

Speciries the maximum amount of time that I<ssl_check_chain> will wait for a TLS connection.

The default is 120 seconds.

=item B<--tlsversion>=I<version>

Specify the TLS protocol version to use: 1.1, 1.2, or 1.3.

=item B<--type>=I<type>

Specify that an I<ec> (I<ecdsa>) or I<rsa> certificate is desired.

=item B<--[no-]warnings>

Controls whether warning messages are displayed.  The default is B<--warnings>.

Warnings include duplicated files and hosts, which are skipped, and other recoverable conditions.

=item B<--help>

Print a brief help message and exits.

=item B<--man>

Prints the manual page and exits.

=back

When options require keyword values, the keyword may be abbreviated providing that the abbreviation is unique.

=head1 DESCRIPTION

B<ssl_check_chain> will connect to each host specified and obtain its certificate and any intermediate certificate chain.

Port can be numeric, or a service name (e.g. from /etc/services).

If a port is not specified: if --starttls is specified, the default port for the STARTTLS protocol is used, otherwise 443 (https) is assumed.

If the port is specified as I<FILE>, B<ssl_check_chain> will open the specified file and process it as if the certificates were received from a server.
The certificate chain must be in PEM format.  If a filename begins with '.', '/', or '~', or if it contains a '/', the I<:FILE> is inferred, since
no DNS hostname or IP address can have those forms.

If an argument is of the form I<@file>, the file is processed as a list of arguments, one per line, in any of the forms described previously.
I<@file>s can be nested, but attempting to process the same file more than once is an error.  In an I<@file>, blank lines and lines beginning with I<#> are ignored.

I<FILE> and I<@file> names support tilde expansion, but not wildcards.

The validity dates of each certificate returned will be verified, as will its chain.

To request the desired certificate from  dual-certificate servers, you can specify B<--type>=I<ec> or B<--type>=I<rsa>.
This is done by providing a list of acceptable signature algorithms; the connecion will fail if the server doesn't have a matching certificate.

You can also specify B<--tlsversion>=I<1.1>, B<--tlsversion>=I<1.2>, or B<--tlsversion>=I<1.3> to select the protocol version.

Each certificate is analyzed in the order received from the server or contained in the file, which should be from leaf (the server) toward the root (trusted CA).
The trust root is not sent by the server, but is located by OpenSSL via -CAfile or -CApath.

Any date or verification errors will be reported.

Note that if a trusted (root) certificate has expired, only the root name is available.

This automates the manual process of determining where and why a certificate chain is broken.

=head1 BUGS

Report any bugs, feature requests and/or patches on the issue tracker,
located at F<https://github.com/tlhackque/certtools/issues>.  In the
event that the project moves, contact the author directly.

=head1 AUTHOR

Timothe Litt  E<lt>litt@acm.orgE<gt>

=head1 COPYRIGHT and LICENSE

Copyright (c) 2021 Timothe Litt

Permission is hereby granted, free of charge, to any person obtaining a
copy of this software and associated documentation files (the "Software"),
to deal in the Software without restriction, including without limitation
the rights to use, copy, modify, merge, publish, distribute, sublicense,
and/or sell copies of the Software, and to permit persons to whom the
Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included
in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
DEALINGS IN THE SOFTWARE.

Except as contained in this notice, the name of the author shall not be
used in advertising or otherwise to promote the sale, use or other dealings
in this Software without prior written authorization from the author.

Any modifications to this software must be clearly documented by and
attributed to their author, who is responsible for their effects.

Bug reports, suggestions and patches are welcomed by the original author.

=head1 SEE ALSO

I<openssl(1)>

I<POD version $Id$>

=cut