Print out Suite B status.

When using the -xcert option to test certificate validity print out
if we pass Suite B compliance. We print out "not tested" if we aren't
in Suite B mode.
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 7d4cdededc371854eb36e773ed18204593e994e1)

diff --git a/apps/s_cb.c b/apps/s_cb.c
index c6c721ebe1abe34a32b46f4c670c4efd87dd636c..4b0e85d85d9b83dd3654b7d2990e8cf75bfba64d 100644 (file)
--- a/apps/s_cb.c
+++ b/apps/s_cb.c
@@ -1250,7 +1250,7 @@ struct chain_flags chain_flags_list[] =
        };
 
 
-static void print_chain_flags(BIO *out, int flags)
+static void print_chain_flags(BIO *out, SSL *s, int flags)
        {
        struct chain_flags *ctmp = chain_flags_list;
        while(ctmp->name)
@@ -1259,6 +1259,11 @@ static void print_chain_flags(BIO *out, int flags)
                                flags & ctmp->flag ? "OK" : "NOT OK");
                ctmp++;
                }
+       BIO_printf(out, "\tSuite B: ");
+       if (SSL_set_cert_flags(s, 0) & SSL_CERT_FLAG_SUITEB_128_LOS)
+               BIO_puts(out, flags & CERT_PKEY_SUITEB ? "OK\n" : "NOT OK\n");
+       else
+               BIO_printf(out, "not tested\n");
        }
 
 /* Very basic selection callback: just use any certificate chain
@@ -1301,7 +1306,7 @@ static int set_cert_cb(SSL *ssl, void *arg)
                                                        XN_FLAG_ONELINE);
                BIO_puts(bio_err, "\n");
                
-               print_chain_flags(bio_err, rv);
+               print_chain_flags(bio_err, ssl, rv);
                if (rv & CERT_PKEY_VALID)
                        {
                        SSL_use_certificate(ssl, exc->cert);