Fix auto-discovery of ENGINEs. See the CHANGES entry for details (and/or

[openssl.git] / apps / s_client.c

diff --git a/apps/s_client.c b/apps/s_client.c
index 2d234a69262a5e274375169f480e63c9b9715b75..ad8760cce53ab5e6dd5ad5c07dc346dd15263044 100644 (file)
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -161,6 +161,8 @@ typedef unsigned int u_int;
 #include <openssl/err.h>
 #include <openssl/pem.h>
 #include <openssl/rand.h>
+#include <openssl/ocsp.h>
+#include <openssl/bn.h>
 #include "s_apps.h"
 #include "timeouts.h"
 
@@ -196,12 +198,14 @@ static int c_Pause=0;
 static int c_debug=0;
 #ifndef OPENSSL_NO_TLSEXT
 static int c_tlsextdebug=0;
+static int c_status_req=0;
 #endif
 static int c_msg=0;
 static int c_showcerts=0;
 
 static void sc_usage(void);
 static void print_stuff(BIO *berr,SSL *con,int full);
+static int ocsp_resp_cb(SSL *s, void *arg);
 static BIO *bio_c_out=NULL;
 static int c_quiet=0;
 static int c_ign_eof=0;
@@ -324,8 +328,13 @@ static void sc_usage(void)
        BIO_printf(bio_err," -engine id    - Initialise and use the specified engine\n");
 #endif
        BIO_printf(bio_err," -rand file%cfile%c...\n", LIST_SEPARATOR_CHAR, LIST_SEPARATOR_CHAR);
+       BIO_printf(bio_err," -sess_out arg - file to write SSL session to\n");
+       BIO_printf(bio_err," -sess_in arg  - file to read SSL session from\n");
 #ifndef OPENSSL_NO_TLSEXT
        BIO_printf(bio_err," -servername host  - Set TLS extension servername in ClientHello\n");
+       BIO_printf(bio_err," -tlsextdebug      - hex dump of all TLS extensions received\n");
+       BIO_printf(bio_err," -status           - request certificate status from server\n");
+       BIO_printf(bio_err," -no_ticket        - disable use of RFC4507bis session tickets\n");
 #endif
        }
 
@@ -524,6 +533,8 @@ int MAIN(int argc, char **argv)
 #ifndef OPENSSL_NO_TLSEXT
                else if (strcmp(*argv,"-tlsextdebug") == 0)
                        c_tlsextdebug=1;
+               else if (strcmp(*argv,"-status") == 0)
+                       c_status_req=1;
 #endif
 #ifdef WATT32
                else if (strcmp(*argv,"-wdebug") == 0)
@@ -855,6 +866,11 @@ bad:
                }
 #endif /* OPENSSL_NO_KRB5  */
 /*     SSL_set_cipher_list(con,"RC4-MD5"); */
+#if 0
+#ifdef TLSEXT_TYPE_opaque_prf_input
+       SSL_set_tlsext_opaque_prf_input(con, "Test client", 11);
+#endif
+#endif
 
 re_start:
 
@@ -893,7 +909,7 @@ re_start:
                        goto end;
                        }
 
-               BIO_ctrl_set_connected(sbio, 1, &peer);
+               (void)BIO_ctrl_set_connected(sbio, 1, &peer);
 
                if (enable_timeouts)
                        {
@@ -945,6 +961,23 @@ re_start:
                SSL_set_tlsext_debug_callback(con, tlsext_cb);
                SSL_set_tlsext_debug_arg(con, bio_c_out);
                }
+       if (c_status_req)
+               {
+               SSL_set_tlsext_status_type(con, TLSEXT_STATUSTYPE_ocsp);
+               SSL_CTX_set_tlsext_status_cb(ctx, ocsp_resp_cb);
+               SSL_CTX_set_tlsext_status_arg(ctx, bio_c_out);
+#if 0
+{
+STACK_OF(OCSP_RESPID) *ids = sk_OCSP_RESPID_new_null();
+OCSP_RESPID *id = OCSP_RESPID_new();
+id->value.byKey = ASN1_OCTET_STRING_new();
+id->type = V_OCSP_RESPID_KEY;
+ASN1_STRING_set(id->value.byKey, "Hello World", -1);
+sk_OCSP_RESPID_push(ids, id);
+SSL_set_tlsext_status_ids(con, ids);
+}
+#endif
+               }
 #endif
 
        SSL_set_bio(con,sbio,sbio);
@@ -984,7 +1017,7 @@ re_start:
                while (mbuf_len>3 && mbuf[3]=='-');
                /* STARTTLS command requires EHLO... */
                BIO_printf(fbio,"EHLO openssl.client.net\r\n");
-               BIO_flush(fbio);
+               (void)BIO_flush(fbio);
                /* wait for multi-line response to end EHLO SMTP response */
                do
                        {
@@ -993,7 +1026,7 @@ re_start:
                                foundit=1;
                        }
                while (mbuf_len>3 && mbuf[3]=='-');
-               BIO_flush(fbio);
+               (void)BIO_flush(fbio);
                BIO_pop(fbio);
                BIO_free(fbio);
                if (!foundit)
@@ -1017,7 +1050,7 @@ re_start:
                BIO_gets(fbio,mbuf,BUFSIZZ);
                /* STARTTLS command requires CAPABILITY... */
                BIO_printf(fbio,". CAPABILITY\r\n");
-               BIO_flush(fbio);
+               (void)BIO_flush(fbio);
                /* wait for multi-line CAPABILITY response */
                do
                        {
@@ -1026,7 +1059,7 @@ re_start:
                                foundit=1;
                        }
                while (mbuf_len>3 && mbuf[0]!='.');
-               BIO_flush(fbio);
+               (void)BIO_flush(fbio);
                BIO_pop(fbio);
                BIO_free(fbio);
                if (!foundit)
@@ -1046,7 +1079,7 @@ re_start:
                        mbuf_len = BIO_gets(fbio,mbuf,BUFSIZZ);
                        }
                while (mbuf_len>3 && mbuf[3]=='-');
-               BIO_flush(fbio);
+               (void)BIO_flush(fbio);
                BIO_pop(fbio);
                BIO_free(fbio);
                BIO_printf(sbio,"AUTH TLS\r\n");
@@ -1069,11 +1102,13 @@ re_start:
                        if (in_init)
                                {
                                in_init=0;
+#if 0 /* This test doesn't really work as intended (needs to be fixed) */
 #ifndef OPENSSL_NO_TLSEXT
                                if (servername != NULL && !SSL_session_reused(con))
                                        {
                                        BIO_printf(bio_c_out,"Server did %sacknowledge servername extension.\n",tlsextcbp.ack?"":"not ");
                                        }
+#endif
 #endif
                                if (sess_out)
                                        {
@@ -1244,6 +1279,7 @@ re_start:
                                if (cbuf_len != 0)
                                        {
                                        BIO_printf(bio_c_out,"shutdown\n");
+                                       ret = 0;
                                        goto shut;
                                        }
                                else
@@ -1286,6 +1322,7 @@ re_start:
                        if (i <= 0)
                                {
                                BIO_printf(bio_c_out,"DONE\n");
+                               ret = 0;
                                goto shut;
                                /* goto end; */
                                }
@@ -1340,10 +1377,12 @@ printf("read=%d pending=%d peek=%d\n",k,SSL_pending(con),SSL_peek(con,zbuf,10240
                                BIO_printf(bio_c_out,"read X BLOCK\n");
                                break;
                        case SSL_ERROR_SYSCALL:
-                               BIO_printf(bio_err,"read:errno=%d\n",get_last_socket_error());
+                               ret=get_last_socket_error();
+                               BIO_printf(bio_err,"read:errno=%d\n",ret);
                                goto shut;
                        case SSL_ERROR_ZERO_RETURN:
                                BIO_printf(bio_c_out,"closed\n");
+                               ret=0;
                                goto shut;
                        case SSL_ERROR_SSL:
                                ERR_print_errors(bio_err);
@@ -1394,6 +1433,7 @@ printf("read=%d pending=%d peek=%d\n",k,SSL_pending(con),SSL_peek(con,zbuf,10240
                        if ((!c_ign_eof) && ((i <= 0) || (cbuf[0] == 'Q')))
                                {
                                BIO_printf(bio_err,"DONE\n");
+                               ret=0;
                                goto shut;
                                }
 
@@ -1416,12 +1456,13 @@ printf("read=%d pending=%d peek=%d\n",k,SSL_pending(con),SSL_peek(con,zbuf,10240
                        read_tty=0;
                        }
                }
+
+       ret=0;
 shut:
        if (in_init)
                print_stuff(bio_c_out,con,full_log);
        SSL_shutdown(con);
        SHUTDOWN(SSL_get_fd(con));
-       ret=0;
 end:
        if (con != NULL)
                {
@@ -1578,6 +1619,31 @@ static void print_stuff(BIO *bio, SSL *s, int full)
        if (peer != NULL)
                X509_free(peer);
        /* flush, or debugging output gets mixed with http response */
-       BIO_flush(bio);
+       (void)BIO_flush(bio);
        }
 
+static int ocsp_resp_cb(SSL *s, void *arg)
+       {
+       const unsigned char *p;
+       int len;
+       OCSP_RESPONSE *rsp;
+       len = SSL_get_tlsext_status_ocsp_resp(s, &p);
+       BIO_puts(arg, "OCSP response: ");
+       if (!p)
+               {
+               BIO_puts(arg, "no response sent\n");
+               return 1;
+               }
+       rsp = d2i_OCSP_RESPONSE(NULL, &p, len);
+       if (!rsp)
+               {
+               BIO_puts(arg, "response parse error\n");
+               BIO_dump_indent(arg, (char *)p, len, 4);
+               return 0;
+               }
+       BIO_puts(arg, "\n======================================\n");
+       OCSP_RESPONSE_print(arg, rsp, 0);
+       BIO_puts(arg, "======================================\n");
+       OCSP_RESPONSE_free(rsp);
+       return 1;
+       }