New -valid option to add a certificate to the ca index.txt that is valid and not...

[oweals/openssl.git] / apps / s_client.c

diff --git a/apps/s_client.c b/apps/s_client.c
index 42e0e2412754da35123e2088c306afb9b4325da4..90b6af80cb5ff0ecd8dddc91317b484cf2f87051 100644 (file)
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -557,6 +557,8 @@ int MAIN(int, char **);
 int MAIN(int argc, char **argv)
        {
        unsigned int off=0, clr=0;
+       unsigned int cert_flags=0;
+       int build_chain = 0;
        SSL *con=NULL;
 #ifndef OPENSSL_NO_KRB5
        KSSL_CTX *kctx;
@@ -606,6 +608,7 @@ int MAIN(int argc, char **argv)
        char *servername = NULL; 
        char *curves=NULL;
        char *sigalgs=NULL;
+       char *client_sigalgs=NULL;
         tlsextctx tlsextcbp = 
         {NULL,0};
 # ifndef OPENSSL_NO_NEXTPROTONEG
@@ -626,6 +629,7 @@ int MAIN(int argc, char **argv)
        int srp_lateuser = 0;
        SRP_ARG srp_arg = {NULL,NULL,0,0,0,1024};
 #endif
+       SSL_EXCERT *exc = NULL;
 
        meth=SSLv23_client_method();
 
@@ -713,6 +717,12 @@ int MAIN(int argc, char **argv)
                        }
                else if (strcmp(*argv,"-verify_return_error") == 0)
                        verify_return_error = 1;
+               else if (args_excert(&argv, &argc, &badarg, bio_err, &exc))
+                       {
+                       if (badarg)
+                               goto bad;
+                       continue;
+                       }
                else if (strcmp(*argv,"-prexit") == 0)
                        prexit=1;
                else if (strcmp(*argv,"-crlf") == 0)
@@ -858,6 +868,8 @@ int MAIN(int argc, char **argv)
                        if (--argc < 1) goto bad;
                        CApath= *(++argv);
                        }
+               else if (strcmp(*argv,"-build_chain") == 0)
+                       build_chain = 1;
                else if (strcmp(*argv,"-CAfile") == 0)
                        {
                        if (--argc < 1) goto bad;
@@ -954,6 +966,11 @@ int MAIN(int argc, char **argv)
                        if (--argc < 1) goto bad;
                        sigalgs= *(++argv);
                        }
+               else if (strcmp(*argv,"-client_sigalgs") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       client_sigalgs= *(++argv);
+                       }
 #endif
 #ifndef OPENSSL_NO_JPAKE
                else if (strcmp(*argv,"-jpake") == 0)
@@ -978,6 +995,8 @@ int MAIN(int argc, char **argv)
                        keymatexportlen=atoi(*(++argv));
                        if (keymatexportlen == 0) goto bad;
                        }
+               else if (strcmp(*argv, "-cert_strict") == 0)
+                       cert_flags |= SSL_CERT_FLAG_TLS_STRICT;
                 else
                        {
                        BIO_printf(bio_err,"unknown option %s\n",*argv);
@@ -1082,6 +1101,9 @@ bad:
                        }
                }
 
+       if (!load_excert(&exc, bio_err))
+               goto end;
+
        if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL
                && !RAND_status())
                {
@@ -1157,6 +1179,8 @@ bad:
 
        if (clr)
                SSL_CTX_clear_options(ctx, clr);
+       if (cert_flags) SSL_CTX_set_cert_flags(ctx, cert_flags);
+       if (exc) ssl_ctx_set_excert(ctx, exc);
        /* DTLS: partial reads end up discarding unread UDP bytes :-( 
         * Setting read ahead solves this problem.
         */
@@ -1180,8 +1204,6 @@ bad:
 #endif
 
        SSL_CTX_set_verify(ctx,verify,verify_callback);
-       if (!set_cert_key_stuff(ctx,cert,key, NULL))
-               goto end;
 
        if ((!SSL_CTX_load_verify_locations(ctx,CAfile,CApath)) ||
                (!SSL_CTX_set_default_verify_paths(ctx)))
@@ -1191,6 +1213,9 @@ bad:
                /* goto end; */
                }
 
+       if (!set_cert_key_stuff(ctx,cert,key, NULL, build_chain))
+               goto end;
+
 #ifndef OPENSSL_NO_TLSEXT
        if (curves != NULL)
                if(!SSL_CTX_set1_curves_list(ctx,curves)) {
@@ -1204,6 +1229,12 @@ bad:
                ERR_print_errors(bio_err);
                goto end;
        }
+       if (client_sigalgs != NULL)
+               if(!SSL_CTX_set1_client_sigalgs_list(ctx,client_sigalgs)) {
+               BIO_printf(bio_err,"error setting client signature algorithms list\n");
+               ERR_print_errors(bio_err);
+               goto end;
+       }
        if (servername != NULL)
                {
                tlsextcbp.biodebug = bio_err;
@@ -1933,6 +1964,7 @@ end:
                EVP_PKEY_free(key);
        if (pass)
                OPENSSL_free(pass);
+       ssl_excert_free(exc);
        if (vpm)
                X509_VERIFY_PARAM_free(vpm);
        if (cbuf != NULL) { OPENSSL_cleanse(cbuf,BUFSIZZ); OPENSSL_free(cbuf); }