New compile time option OPENSSL_SSL_TRACE_CRYPTO, when set this passes

[oweals/openssl.git] / apps / s_client.c

diff --git a/apps/s_client.c b/apps/s_client.c
index 8cbb46e540468671514d94409ba0aae7b8c51985..783a49e083d26f4f1726f7c77b29d153ba07148b 100644 (file)
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -217,6 +217,7 @@ static int ocsp_resp_cb(SSL *s, void *arg);
 static int audit_proof_cb(SSL *s, void *arg);
 #endif
 static BIO *bio_c_out=NULL;
+static BIO *bio_c_msg=NULL;
 static int c_quiet=0;
 static int c_ign_eof=0;
 
@@ -557,6 +558,8 @@ int MAIN(int, char **);
 int MAIN(int argc, char **argv)
        {
        unsigned int off=0, clr=0;
+       unsigned int cert_flags=0;
+       int build_chain = 0;
        SSL *con=NULL;
 #ifndef OPENSSL_NO_KRB5
        KSSL_CTX *kctx;
@@ -605,6 +608,8 @@ int MAIN(int argc, char **argv)
 #ifndef OPENSSL_NO_TLSEXT
        char *servername = NULL; 
        char *curves=NULL;
+       char *sigalgs=NULL;
+       char *client_sigalgs=NULL;
         tlsextctx tlsextcbp = 
         {NULL,0};
 # ifndef OPENSSL_NO_NEXTPROTONEG
@@ -625,6 +630,7 @@ int MAIN(int argc, char **argv)
        int srp_lateuser = 0;
        SRP_ARG srp_arg = {NULL,NULL,0,0,0,1024};
 #endif
+       SSL_EXCERT *exc = NULL;
 
        meth=SSLv23_client_method();
 
@@ -712,6 +718,12 @@ int MAIN(int argc, char **argv)
                        }
                else if (strcmp(*argv,"-verify_return_error") == 0)
                        verify_return_error = 1;
+               else if (args_excert(&argv, &argc, &badarg, bio_err, &exc))
+                       {
+                       if (badarg)
+                               goto bad;
+                       continue;
+                       }
                else if (strcmp(*argv,"-prexit") == 0)
                        prexit=1;
                else if (strcmp(*argv,"-crlf") == 0)
@@ -743,6 +755,15 @@ int MAIN(int argc, char **argv)
 #endif
                else if (strcmp(*argv,"-msg") == 0)
                        c_msg=1;
+               else if (strcmp(*argv,"-msgfile") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       bio_c_msg = BIO_new_file(*(++argv), "w");
+                       }
+#ifndef OPENSSL_NO_SSL_TRACE
+               else if (strcmp(*argv,"-trace") == 0)
+                       c_msg=2;
+#endif
                else if (strcmp(*argv,"-showcerts") == 0)
                        c_showcerts=1;
                else if (strcmp(*argv,"-nbio_test") == 0)
@@ -857,6 +878,8 @@ int MAIN(int argc, char **argv)
                        if (--argc < 1) goto bad;
                        CApath= *(++argv);
                        }
+               else if (strcmp(*argv,"-build_chain") == 0)
+                       build_chain = 1;
                else if (strcmp(*argv,"-CAfile") == 0)
                        {
                        if (--argc < 1) goto bad;
@@ -948,6 +971,16 @@ int MAIN(int argc, char **argv)
                        if (--argc < 1) goto bad;
                        curves= *(++argv);
                        }
+               else if (strcmp(*argv,"-sigalgs") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       sigalgs= *(++argv);
+                       }
+               else if (strcmp(*argv,"-client_sigalgs") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       client_sigalgs= *(++argv);
+                       }
 #endif
 #ifndef OPENSSL_NO_JPAKE
                else if (strcmp(*argv,"-jpake") == 0)
@@ -972,6 +1005,8 @@ int MAIN(int argc, char **argv)
                        keymatexportlen=atoi(*(++argv));
                        if (keymatexportlen == 0) goto bad;
                        }
+               else if (strcmp(*argv, "-cert_strict") == 0)
+                       cert_flags |= SSL_CERT_FLAG_TLS_STRICT;
                 else
                        {
                        BIO_printf(bio_err,"unknown option %s\n",*argv);
@@ -1077,6 +1112,9 @@ bad:
                        }
                }
 
+       if (!load_excert(&exc, bio_err))
+               goto end;
+
        if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL
                && !RAND_status())
                {
@@ -1152,6 +1190,8 @@ bad:
 
        if (clr)
                SSL_CTX_clear_options(ctx, clr);
+       if (cert_flags) SSL_CTX_set_cert_flags(ctx, cert_flags);
+       if (exc) ssl_ctx_set_excert(ctx, exc);
        /* DTLS: partial reads end up discarding unread UDP bytes :-( 
         * Setting read ahead solves this problem.
         */
@@ -1175,8 +1215,6 @@ bad:
 #endif
 
        SSL_CTX_set_verify(ctx,verify,verify_callback);
-       if (!set_cert_key_stuff(ctx,cert,key, NULL))
-               goto end;
 
        if ((!SSL_CTX_load_verify_locations(ctx,CAfile,CApath)) ||
                (!SSL_CTX_set_default_verify_paths(ctx)))
@@ -1186,6 +1224,9 @@ bad:
                /* goto end; */
                }
 
+       if (!set_cert_key_stuff(ctx,cert,key, NULL, build_chain))
+               goto end;
+
 #ifndef OPENSSL_NO_TLSEXT
        if (curves != NULL)
                if(!SSL_CTX_set1_curves_list(ctx,curves)) {
@@ -1193,6 +1234,18 @@ bad:
                ERR_print_errors(bio_err);
                goto end;
        }
+       if (sigalgs != NULL)
+               if(!SSL_CTX_set1_sigalgs_list(ctx,sigalgs)) {
+               BIO_printf(bio_err,"error setting signature algorithms list\n");
+               ERR_print_errors(bio_err);
+               goto end;
+       }
+       if (client_sigalgs != NULL)
+               if(!SSL_CTX_set1_client_sigalgs_list(ctx,client_sigalgs)) {
+               BIO_printf(bio_err,"error setting client signature algorithms list\n");
+               ERR_print_errors(bio_err);
+               goto end;
+       }
        if (servername != NULL)
                {
                tlsextcbp.biodebug = bio_err;
@@ -1348,8 +1401,13 @@ re_start:
                }
        if (c_msg)
                {
-               SSL_set_msg_callback(con, msg_cb);
-               SSL_set_msg_callback_arg(con, bio_c_out);
+#ifndef OPENSSL_NO_SSL_TRACE
+               if (c_msg == 2)
+                       SSL_set_msg_callback(con, SSL_trace);
+               else
+#endif
+                       SSL_set_msg_callback(con, msg_cb);
+               SSL_set_msg_callback_arg(con, bio_c_msg ? bio_c_msg : bio_c_out);
                }
 #ifndef OPENSSL_NO_TLSEXT
        if (c_tlsextdebug)
@@ -1911,6 +1969,10 @@ end:
                        print_stuff(bio_c_out,con,1);
                SSL_free(con);
                }
+#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
+       if (next_proto.data)
+               OPENSSL_free(next_proto.data);
+#endif
        if (ctx != NULL) SSL_CTX_free(ctx);
        if (cert)
                X509_free(cert);
@@ -1918,6 +1980,7 @@ end:
                EVP_PKEY_free(key);
        if (pass)
                OPENSSL_free(pass);
+       ssl_excert_free(exc);
        if (cbuf != NULL) { OPENSSL_cleanse(cbuf,BUFSIZZ); OPENSSL_free(cbuf); }
        if (sbuf != NULL) { OPENSSL_cleanse(sbuf,BUFSIZZ); OPENSSL_free(sbuf); }
        if (mbuf != NULL) { OPENSSL_cleanse(mbuf,BUFSIZZ); OPENSSL_free(mbuf); }
@@ -1926,6 +1989,11 @@ end:
                BIO_free(bio_c_out);
                bio_c_out=NULL;
                }
+       if (bio_c_msg != NULL)
+               {
+               BIO_free(bio_c_msg);
+               bio_c_msg=NULL;
+               }
        apps_shutdown();
        OPENSSL_EXIT(ret);
        }
@@ -2060,18 +2128,7 @@ static void print_stuff(BIO *bio, SSL *s, int full)
        BIO_printf(bio,"Expansion: %s\n",
                expansion ? SSL_COMP_get_name(expansion) : "NONE");
 #endif
-
-#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
-       if (next_proto.status != -1) {
-               const unsigned char *proto;
-               unsigned int proto_len;
-               SSL_get0_next_proto_negotiated(s, &proto, &proto_len);
-               BIO_printf(bio, "Next protocol: (%d) ", next_proto.status);
-               BIO_write(bio, proto, proto_len);
-               BIO_write(bio, "\n", 1);
-       }
-#endif
-
+ 
 #ifdef SSL_DEBUG
        {
        /* Print out local port of connection: useful for debugging */
@@ -2084,6 +2141,17 @@ static void print_stuff(BIO *bio, SSL *s, int full)
        }
 #endif
 
+#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
+       if (next_proto.status != -1) {
+               const unsigned char *proto;
+               unsigned int proto_len;
+               SSL_get0_next_proto_negotiated(s, &proto, &proto_len);
+               BIO_printf(bio, "Next protocol: (%d) ", next_proto.status);
+               BIO_write(bio, proto, proto_len);
+               BIO_write(bio, "\n", 1);
+       }
+#endif
+
        {
        SRTP_PROTECTION_PROFILE *srtp_profile=SSL_get_selected_srtp_profile(s);