Integrate J-PAKE and TLS-PSK. Increase PSK buffer size. Fix memory leaks.

[openssl.git] / apps / s_client.c

diff --git a/apps/s_client.c b/apps/s_client.c
index 12e5c40b7d2deef53d4a5b0f3f357a69e9d73cc9..05ebff1f679573ffcddb20045973aa6f6b31df51 100644 (file)
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -215,7 +215,7 @@ static int c_ign_eof=0;
 #ifndef OPENSSL_NO_PSK
 /* Default PSK identity and key */
 static char *psk_identity="Client_identity";
-static char *psk_key=NULL; /* by default PSK is not used */
+/*char *psk_key=NULL;  by default PSK is not used */
 
 static unsigned int psk_client_cb(SSL *ssl, const char *hint, char *identity,
        unsigned int max_identity_len, unsigned char *psk,
@@ -308,9 +308,13 @@ static void sc_usage(void)
        BIO_printf(bio_err," -crlf         - convert LF from terminal into CRLF\n");
        BIO_printf(bio_err," -quiet        - no s_client output\n");
        BIO_printf(bio_err," -ign_eof      - ignore input eof (default when -quiet)\n");
+       BIO_printf(bio_err," -no_ign_eof   - don't ignore input eof\n");
 #ifndef OPENSSL_NO_PSK
        BIO_printf(bio_err," -psk_identity arg - PSK identity\n");
        BIO_printf(bio_err," -psk arg      - PSK in hex (without 0x)\n");
+# ifdef OPENSSL_EXPERIMENTAL_JPAKE
+       BIO_printf(bio_err," -jpake arg    - JPAKE secret to use\n");
+# endif
 #endif
        BIO_printf(bio_err," -ssl2         - just use SSLv2\n");
        BIO_printf(bio_err," -ssl3         - just use SSLv3\n");
@@ -325,7 +329,8 @@ static void sc_usage(void)
        BIO_printf(bio_err," -starttls prot - use the STARTTLS command before starting TLS\n");
        BIO_printf(bio_err,"                 for those protocols that support it, where\n");
        BIO_printf(bio_err,"                 'prot' defines which one to assume.  Currently,\n");
-       BIO_printf(bio_err,"                 only \"smtp\", \"pop3\", \"imap\", and \"ftp\" are supported.\n");
+       BIO_printf(bio_err,"                 only \"smtp\", \"pop3\", \"imap\", \"ftp\" and \"xmpp\"\n");
+       BIO_printf(bio_err,"                 are supported.\n");
 #ifndef OPENSSL_NO_ENGINE
        BIO_printf(bio_err," -engine id    - Initialise and use the specified engine\n");
 #endif
@@ -368,7 +373,8 @@ enum
        PROTO_SMTP,
        PROTO_POP3,
        PROTO_IMAP,
-       PROTO_FTP
+       PROTO_FTP,
+       PROTO_XMPP
 };
 
 int MAIN(int, char **);
@@ -415,7 +421,6 @@ int MAIN(int argc, char **argv)
        int stdin_set = 0;
 #endif
 #endif
-
 #ifndef OPENSSL_NO_TLSEXT
        char *servername = NULL; 
         tlsextctx tlsextcbp = 
@@ -427,6 +432,9 @@ int MAIN(int argc, char **argv)
        int peerlen = sizeof(peer);
        int enable_timeouts = 0 ;
        long socket_mtu = 0;
+#ifdef OPENSSL_EXPERIMENTAL_JPAKE
+       char *jpake_secret = NULL;
+#endif
 
 #if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
        meth=SSLv23_client_method();
@@ -529,6 +537,8 @@ int MAIN(int argc, char **argv)
                        }
                else if (strcmp(*argv,"-ign_eof") == 0)
                        c_ign_eof=1;
+               else if (strcmp(*argv,"-no_ign_eof") == 0)
+                       c_ign_eof=0;
                else if (strcmp(*argv,"-pause") == 0)
                        c_Pause=1;
                else if (strcmp(*argv,"-debug") == 0)
@@ -664,6 +674,8 @@ int MAIN(int argc, char **argv)
                                starttls_proto = PROTO_IMAP;
                        else if (strcmp(*argv,"ftp") == 0)
                                starttls_proto = PROTO_FTP;
+                       else if (strcmp(*argv, "xmpp") == 0)
+                               starttls_proto = PROTO_XMPP;
                        else
                                goto bad;
                        }
@@ -691,6 +703,13 @@ int MAIN(int argc, char **argv)
                        servername= *(++argv);
                        /* meth=TLSv1_client_method(); */
                        }
+#endif
+#ifdef OPENSSL_EXPERIMENTAL_JPAKE
+               else if (strcmp(*argv,"-jpake") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       jpake_secret = *++argv;
+                       }
 #endif
                else
                        {
@@ -708,6 +727,26 @@ bad:
                goto end;
                }
 
+#if defined(OPENSSL_EXPERIMENTAL_JPAKE) && !defined(OPENSSL_NO_PSK)
+       if (jpake_secret)
+               {
+               if (psk_key)
+                       {
+                       BIO_printf(bio_err,
+                                  "Can't use JPAKE and PSK together\n");
+                       goto end;
+                       }
+               psk_identity = "JPAKE";
+               }
+
+       if (cipher)
+               {
+               BIO_printf(bio_err, "JPAKE sets cipher to PSK\n");
+               goto end;
+               }
+       cipher = "PSK";
+#endif
+
        OpenSSL_add_ssl_algorithms();
        SSL_load_error_strings();
 
@@ -806,10 +845,10 @@ bad:
 #endif
 
 #ifndef OPENSSL_NO_PSK
-       if (psk_key != NULL)
+       if (psk_key != NULL || jpake_secret)
                {
                if (c_debug)
-                       BIO_printf(bio_c_out, "PSK key given, setting client callback\n");
+                       BIO_printf(bio_c_out, "PSK key given or JPAKE in use, setting client callback\n");
                SSL_CTX_set_psk_client_callback(ctx, psk_client_cb);
                }
 #endif
@@ -967,8 +1006,6 @@ re_start:
        else
                sbio=BIO_new_socket(s,BIO_NOCLOSE);
 
-
-
        if (nbio_test)
                {
                BIO *test;
@@ -1012,6 +1049,10 @@ SSL_set_tlsext_status_ids(con, ids);
 #endif
                }
 #endif
+#ifdef OPENSSL_EXPERIMENTAL_JPAKE
+       if (jpake_secret)
+               jpake_client_auth(bio_c_out, sbio, jpake_secret);
+#endif
 
        SSL_set_bio(con,sbio,sbio);
        SSL_set_connect_state(con);
@@ -1118,6 +1159,28 @@ SSL_set_tlsext_status_ids(con, ids);
                BIO_printf(sbio,"AUTH TLS\r\n");
                BIO_read(sbio,sbuf,BUFSIZZ);
                }
+       if (starttls_proto == PROTO_XMPP)
+               {
+               int seen = 0;
+               BIO_printf(sbio,"<stream:stream "
+                   "xmlns:stream='http://etherx.jabber.org/streams' "
+                   "xmlns='jabber:client' to='%s' version='1.0'>", host);
+               seen = BIO_read(sbio,mbuf,BUFSIZZ);
+               mbuf[seen] = 0;
+               while (!strstr(mbuf, "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'"))
+                       {
+                       if (strstr(mbuf, "/stream:features>"))
+                               goto shut;
+                       seen = BIO_read(sbio,mbuf,BUFSIZZ);
+                       mbuf[seen] = 0;
+                       }
+               BIO_printf(sbio, "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>");
+               seen = BIO_read(sbio,sbuf,BUFSIZZ);
+               sbuf[seen] = 0;
+               if (!strstr(sbuf, "<proceed"))
+                       goto shut;
+               mbuf[0] = 0;
+               }
 
        for (;;)
                {