add additional checks + cleanup

[oweals/openssl.git] / apps / s_client.c

diff --git a/apps/s_client.c b/apps/s_client.c
index 5679b09cf1e50026bee1f4bdf35e0bbfaf930fe5..50e27a07328d0038de6593ed508a5155d5aa2baa 100644 (file)
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -56,7 +56,7 @@
  * [including the GNU Public Licence.]
  */
 /* ====================================================================
- * Copyright (c) 1998-2001 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -222,8 +222,32 @@ static void sc_usage(void)
        BIO_printf(bio_err," -engine id    - Initialise and use the specified engine\n");
 #endif
        BIO_printf(bio_err," -rand file%cfile%c...\n", LIST_SEPARATOR_CHAR, LIST_SEPARATOR_CHAR);
+#ifndef OPENSSL_NO_TLSEXT
+       BIO_printf(bio_err," -servername host  - Set TLS extension servername in ClientHello\n");
+#endif
+       }
+
+#ifndef OPENSSL_NO_TLSEXT
+
+/* This is a context that we pass to callbacks */
+typedef struct tlsextctx_st {
+   BIO * biodebug;
+   int ack;
+} tlsextctx;
 
+
+static int MS_CALLBACK ssl_servername_cb(SSL *s, int *ad, void *arg)
+       {
+       tlsextctx * p = (tlsextctx *) arg;
+       const char * hn= SSL_get_servername(s, TLSEXT_NAMETYPE_host_name);
+       if (SSL_get_servername_type(s) != -1) 
+               p->ack = !SSL_session_reused(s) && hn != NULL;
+       else 
+               BIO_printf(bio_err,"Can't use SSL_get_servername\n");
+       
+       return SSL_TLSEXT_ERR_OK;
        }
+#endif
 
 int MAIN(int, char **);
 
@@ -254,10 +278,7 @@ int MAIN(int argc, char **argv)
        int starttls_proto = 0;
        int prexit = 0, vflags = 0;
        const SSL_METHOD *meth=NULL;
-#ifdef sock_type
-#undef sock_type
-#endif
-       int sock_type=SOCK_STREAM;
+       int socket_type=SOCK_STREAM;
        BIO *sbio;
        char *inrand=NULL;
 #ifndef OPENSSL_NO_ENGINE
@@ -268,10 +289,15 @@ int MAIN(int argc, char **argv)
        struct timeval tv;
 #endif
 
+#ifndef OPENSSL_NO_TLSEXT
+       char *servername = NULL; 
+        tlsextctx tlsextcbp = 
+        {NULL,0};
+#endif
        struct sockaddr peer;
        int peerlen = sizeof(peer);
        int enable_timeouts = 0 ;
-       long mtu = 0;
+       long socket_mtu = 0;
 
 #if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
        meth=SSLv23_client_method();
@@ -394,14 +420,14 @@ int MAIN(int argc, char **argv)
                else if (strcmp(*argv,"-dtls1") == 0)
                        {
                        meth=DTLSv1_client_method();
-                       sock_type=SOCK_DGRAM;
+                       socket_type=SOCK_DGRAM;
                        }
                else if (strcmp(*argv,"-timeout") == 0)
                        enable_timeouts=1;
                else if (strcmp(*argv,"-mtu") == 0)
                        {
                        if (--argc < 1) goto bad;
-                       mtu = atol(*(++argv));
+                       socket_mtu = atol(*(++argv));
                        }
 #endif
                else if (strcmp(*argv,"-bugs") == 0)
@@ -477,6 +503,14 @@ int MAIN(int argc, char **argv)
                        if (--argc < 1) goto bad;
                        inrand= *(++argv);
                        }
+#ifndef OPENSSL_NO_TLSEXT
+               else if (strcmp(*argv,"-servername") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       servername= *(++argv);
+                       /* meth=TLSv1_client_method(); */
+                       }
+#endif
                else
                        {
                        BIO_printf(bio_err,"unknown option %s\n",*argv);
@@ -572,7 +606,7 @@ bad:
        /* DTLS: partial reads end up discarding unread UDP bytes :-( 
         * Setting read ahead solves this problem.
         */
-       if (sock_type == SOCK_DGRAM) SSL_CTX_set_read_ahead(ctx, 1);
+       if (socket_type == SOCK_DGRAM) SSL_CTX_set_read_ahead(ctx, 1);
 
        if (state) SSL_CTX_set_info_callback(ctx,apps_ssl_info_callback);
        if (cipher != NULL)
@@ -600,8 +634,27 @@ bad:
 
        store = SSL_CTX_get_cert_store(ctx);
        X509_STORE_set_flags(store, vflags);
+#ifndef OPENSSL_NO_TLSEXT
+       if (servername != NULL)
+               {
+               tlsextcbp.biodebug = bio_err;
+               SSL_CTX_set_tlsext_servername_callback(ctx, ssl_servername_cb);
+               SSL_CTX_set_tlsext_servername_arg(ctx, &tlsextcbp);
+               }
+#endif
 
        con=SSL_new(ctx);
+#ifndef OPENSSL_NO_TLSEXT
+       if (servername != NULL)
+               {
+               if (!SSL_set_tlsext_host_name(con,servername))
+                       {
+                       BIO_printf(bio_err,"Unable to set TLS servername extension.\n");
+                       ERR_print_errors(bio_err);
+                       goto end;
+                       }
+               }
+#endif
 #ifndef OPENSSL_NO_KRB5
        if (con  &&  (con->kssl_ctx = kssl_ctx_new()) != NULL)
                 {
@@ -612,7 +665,7 @@ bad:
 
 re_start:
 
-       if (init_client(&s,host,port,sock_type) == 0)
+       if (init_client(&s,host,port,socket_type) == 0)
                {
                BIO_printf(bio_err,"connect:errno=%d\n",get_last_socket_error());
                SHUTDOWN(s);
@@ -649,7 +702,7 @@ re_start:
 
                BIO_ctrl_set_connected(sbio, 1, &peer);
 
-               if ( enable_timeouts)
+               if (enable_timeouts)
                        {
                        timeout.tv_sec = 0;
                        timeout.tv_usec = DGRAM_RCV_TIMEOUT;
@@ -660,10 +713,10 @@ re_start:
                        BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_SEND_TIMEOUT, 0, &timeout);
                        }
 
-               if ( mtu > 0)
+               if (socket_mtu > 0)
                        {
                        SSL_set_options(con, SSL_OP_NO_QUERY_MTU);
-                       SSL_set_mtu(con, mtu);
+                       SSL_set_mtu(con, socket_mtu);
                        }
                else
                        /* want to do MTU discovery */
@@ -741,6 +794,12 @@ re_start:
                        if (in_init)
                                {
                                in_init=0;
+#ifndef OPENSSL_NO_TLSEXT
+       if (servername != NULL && !SSL_session_reused(con))
+               {
+               BIO_printf(bio_c_out,"Server did %sacknowledge servername extension.\n",tlsextcbp.ack?"":"not ");
+               }
+#endif
                                print_stuff(bio_c_out,con,full_log);
                                if (full_log > 0) full_log--;