Fix for EXP-RC2-CBC-MD5

[openssl.git] / apps / s_client.c

diff --git a/apps/s_client.c b/apps/s_client.c
index 14841ca1e3c0ef30c844fcb61abf02ba2c6fcdeb..841395db16bcee0e8de923a1ee81dc87f2d3cfa4 100644 (file)
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -293,10 +293,6 @@ static void sc_usage(void)
        BIO_printf(bio_err," -host host     - use -connect instead\n");
        BIO_printf(bio_err," -port port     - use -connect instead\n");
        BIO_printf(bio_err," -connect host:port - who to connect to (default is %s:%s)\n",SSL_HOST_NAME,PORT_STR);
-       BIO_printf(bio_err," -checkhost host - check peer certificate matches \"host\"\n");
-       BIO_printf(bio_err," -checkemail email - check peer certificate matches \"email\"\n");
-       BIO_printf(bio_err," -checkip ipaddr - check peer certificate matches \"ipaddr\"\n");
-
        BIO_printf(bio_err," -verify arg   - turn on peer certificate verification\n");
        BIO_printf(bio_err," -cert arg     - certificate file to use, PEM format assumed\n");
        BIO_printf(bio_err," -certform arg - certificate format (PEM or DER) PEM default\n");
@@ -575,11 +571,12 @@ int MAIN(int argc, char **argv)
        short port=PORT;
        int full_log=1;
        char *host=SSL_HOST_NAME;
-       char *cert_file=NULL,*key_file=NULL;
+       char *cert_file=NULL,*key_file=NULL,*chain_file=NULL;
        int cert_format = FORMAT_PEM, key_format = FORMAT_PEM;
        char *passarg = NULL, *pass = NULL;
        X509 *cert = NULL;
        EVP_PKEY *key = NULL;
+       STACK_OF(X509) *chain = NULL;
        char *CApath=NULL,*CAfile=NULL;
        char *chCApath=NULL,*chCAfile=NULL;
        char *vfyCApath=NULL,*vfyCAfile=NULL;
@@ -625,7 +622,10 @@ int MAIN(int argc, char **argv)
        int enable_timeouts = 0 ;
        long socket_mtu = 0;
 #ifndef OPENSSL_NO_JPAKE
-       char *jpake_secret = NULL;
+static char *jpake_secret = NULL;
+#define no_jpake !jpake_secret
+#else
+#define no_jpake 1
 #endif
 #ifndef OPENSSL_NO_SRP
        char * srppass = NULL;
@@ -634,13 +634,12 @@ int MAIN(int argc, char **argv)
 #endif
        SSL_EXCERT *exc = NULL;
 
-       unsigned char *checkhost = NULL, *checkemail = NULL;
-       char *checkip = NULL;
        SSL_CONF_CTX *cctx = NULL;
        STACK_OF(OPENSSL_STRING) *ssl_args = NULL;
 
        char *crl_file = NULL;
        int crl_format = FORMAT_PEM;
+       int crl_download = 0;
        STACK_OF(X509_CRL) *crls = NULL;
 
        meth=SSLv23_client_method();
@@ -717,6 +716,8 @@ int MAIN(int argc, char **argv)
                        if (--argc < 1) goto bad;
                        crl_file= *(++argv);
                        }
+               else if (strcmp(*argv,"-crl_download") == 0)
+                       crl_download = 1;
                else if (strcmp(*argv,"-sess_out") == 0)
                        {
                        if (--argc < 1) goto bad;
@@ -903,6 +904,11 @@ int MAIN(int argc, char **argv)
                        if (--argc < 1) goto bad;
                        passarg = *(++argv);
                        }
+               else if (strcmp(*argv,"-cert_chain") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       chain_file= *(++argv);
+                       }
                else if (strcmp(*argv,"-key") == 0)
                        {
                        if (--argc < 1) goto bad;
@@ -999,21 +1005,6 @@ int MAIN(int argc, char **argv)
                        /* meth=TLSv1_client_method(); */
                        }
 #endif
-               else if (strcmp(*argv,"-checkhost") == 0)
-                       {
-                       if (--argc < 1) goto bad;
-                       checkhost=(unsigned char *)*(++argv);
-                       }
-               else if (strcmp(*argv,"-checkemail") == 0)
-                       {
-                       if (--argc < 1) goto bad;
-                       checkemail=(unsigned char *)*(++argv);
-                       }
-               else if (strcmp(*argv,"-checkip") == 0)
-                       {
-                       if (--argc < 1) goto bad;
-                       checkip=*(++argv);
-                       }
 #ifndef OPENSSL_NO_JPAKE
                else if (strcmp(*argv,"-jpake") == 0)
                        {
@@ -1064,13 +1055,6 @@ bad:
                        }
                psk_identity = "JPAKE";
                }
-
-       if (cipher)
-               {
-               BIO_printf(bio_err, "JPAKE sets cipher to PSK\n");
-               goto end;
-               }
-       cipher = "PSK";
 #endif
 
        OpenSSL_add_ssl_algorithms();
@@ -1142,6 +1126,14 @@ bad:
                        }
                }
 
+       if (chain_file)
+               {
+               chain = load_certs(bio_err, chain_file,FORMAT_PEM,
+                                       NULL, e, "client certificate chain");
+               if (!chain)
+                       goto end;
+               }
+
        if (crl_file)
                {
                X509_CRL *crl;
@@ -1207,13 +1199,14 @@ bad:
        if (vpm)
                SSL_CTX_set1_param(ctx, vpm);
 
-       if (!args_ssl_call(ctx, bio_err, cctx, ssl_args, 1))
+       if (!args_ssl_call(ctx, bio_err, cctx, ssl_args, 1, no_jpake))
                {
                ERR_print_errors(bio_err);
                goto end;
                }
 
-       if (!ssl_load_stores(ctx, vfyCApath, vfyCAfile, chCApath, chCAfile, crls))
+       if (!ssl_load_stores(ctx, vfyCApath, vfyCAfile, chCApath, chCAfile,
+                                               crls, crl_download))
                {
                BIO_printf(bio_err, "Error loading store locations\n");
                ERR_print_errors(bio_err);
@@ -1275,9 +1268,9 @@ bad:
                /* goto end; */
                }
 
-       ssl_ctx_add_crls(ctx, crls);
+       ssl_ctx_add_crls(ctx, crls, crl_download);
 
-       if (!set_cert_key_stuff(ctx,cert,key, NULL, build_chain))
+       if (!set_cert_key_stuff(ctx,cert,key,chain,build_chain))
                goto end;
 
 #ifndef OPENSSL_NO_TLSEXT
@@ -1648,8 +1641,6 @@ SSL_set_tlsext_status_ids(con, ids);
                                                "CONNECTION ESTABLISHED\n");
                                        print_ssl_summary(bio_err, con);
                                        }
-                               print_ssl_cert_checks(bio_err, con, checkhost,
-                                                       checkemail, checkip);
                                print_stuff(bio_c_out,con,full_log);
                                if (full_log > 0) full_log--;
 
@@ -1912,7 +1903,7 @@ printf("read=%d pending=%d peek=%d\n",k,SSL_pending(con),SSL_peek(con,zbuf,10240
                                break;
                        case SSL_ERROR_SYSCALL:
                                ret=get_last_socket_error();
-                               if (ret == 0)
+                               if (c_brief)
                                        BIO_puts(bio_err, "CONNECTION CLOSED BY SERVER\n");
                                else
                                        BIO_printf(bio_err,"read:errno=%d\n",ret);
@@ -2026,6 +2017,8 @@ end:
                sk_X509_CRL_pop_free(crls, X509_CRL_free);
        if (key)
                EVP_PKEY_free(key);
+       if (chain)
+               sk_X509_pop_free(chain, X509_free);
        if (pass)
                OPENSSL_free(pass);
        if (vpm)
@@ -2035,6 +2028,10 @@ end:
                sk_OPENSSL_STRING_free(ssl_args);
        if (cctx)
                SSL_CONF_CTX_free(cctx);
+#ifndef OPENSSL_NO_JPAKE
+       if (jpake_secret && psk_key)
+               OPENSSL_free(psk_key);
+#endif
        if (cbuf != NULL) { OPENSSL_cleanse(cbuf,BUFSIZZ); OPENSSL_free(cbuf); }
        if (sbuf != NULL) { OPENSSL_cleanse(sbuf,BUFSIZZ); OPENSSL_free(sbuf); }
        if (mbuf != NULL) { OPENSSL_cleanse(mbuf,BUFSIZZ); OPENSSL_free(mbuf); }