add support for separate verify can chain stores to s_client (backport from HEAD)

diff --git a/apps/s_apps.h b/apps/s_apps.h
index 74e5a2f872f56d6710de1d14d0a2d0e3779b6381..9bc61cea3a68130d2b04e128a074b824e879dc36 100644 (file)
--- a/apps/s_apps.h
+++ b/apps/s_apps.h
@@ -196,4 +196,7 @@ int args_ssl(char ***pargs, int *pargc, SSL_CONF_CTX *cctx,
                        int *badarg, BIO *err, STACK_OF(OPENSSL_STRING) **pstr);
 int args_ssl_call(SSL_CTX *ctx, BIO *err, SSL_CONF_CTX *cctx,
                STACK_OF(OPENSSL_STRING) *str, int no_ecdhe, int no_jpake);
+int ssl_load_stores(SSL_CTX *sctx,
+                       const char *vfyCApath, const char *vfyCAfile,
+                       const char *chCApath, const char *chCAfile);
 #endif

diff --git a/apps/s_cb.c b/apps/s_cb.c
index e760289f9df8596ef07e32aaf4a41eff985ca189..c876adf3e95d85358354279e332b067897d90871 100644 (file)
--- a/apps/s_cb.c
+++ b/apps/s_cb.c
@@ -1599,3 +1599,33 @@ int args_ssl_call(SSL_CTX *ctx, BIO *err, SSL_CONF_CTX *cctx,
 #endif
        return 1;
        }
+
+int ssl_load_stores(SSL_CTX *ctx,
+                       const char *vfyCApath, const char *vfyCAfile,
+                       const char *chCApath, const char *chCAfile)
+       {
+       X509_STORE *vfy = NULL, *ch = NULL;
+       int rv = 0;
+       if (vfyCApath || vfyCAfile)
+               {
+               vfy = X509_STORE_new();
+               if (!X509_STORE_load_locations(vfy, vfyCAfile, vfyCApath))
+                       goto err;
+               SSL_CTX_set1_verify_cert_store(ctx, vfy);
+               }
+       if (chCApath || chCAfile)
+               {
+               ch = X509_STORE_new();
+               if (!X509_STORE_load_locations(ch, chCAfile, chCApath))
+                       goto err;
+               /*X509_STORE_set_verify_cb(ch, verify_callback);*/
+               SSL_CTX_set1_chain_cert_store(ctx, ch);
+               }
+       rv = 1;
+       err:
+       if (vfy)
+               X509_STORE_free(vfy);
+       if (ch)
+               X509_STORE_free(ch);
+       return rv;
+       }

diff --git a/apps/s_client.c b/apps/s_client.c
index 6df4e92a4da7efc849d4e9bc215ca9d959446a4d..1be3028cfce593139cb0951813d405ae5bb11185 100644 (file)
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -577,6 +577,8 @@ int MAIN(int argc, char **argv)
        EVP_PKEY *key = NULL;
        STACK_OF(X509) *chain = NULL;
        char *CApath=NULL,*CAfile=NULL;
+       char *chCApath=NULL,*chCAfile=NULL;
+       char *vfyCApath=NULL,*vfyCAfile=NULL;
        int reconnect=0,badop=0,verify=SSL_VERIFY_NONE;
        int crlf=0;
        int write_tty,read_tty,write_ssl,read_ssl,tty_on,ssl_pending;
@@ -895,6 +897,16 @@ static char *jpake_secret = NULL;
                        if (--argc < 1) goto bad;
                        CApath= *(++argv);
                        }
+               else if (strcmp(*argv,"-chainCApath") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       chCApath= *(++argv);
+                       }
+               else if (strcmp(*argv,"-verifyCApath") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       vfyCApath= *(++argv);
+                       }
                else if (strcmp(*argv,"-build_chain") == 0)
                        build_chain = 1;
                else if (strcmp(*argv,"-CAfile") == 0)
@@ -902,6 +914,16 @@ static char *jpake_secret = NULL;
                        if (--argc < 1) goto bad;
                        CAfile= *(++argv);
                        }
+               else if (strcmp(*argv,"-chainCAfile") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       chCAfile= *(++argv);
+                       }
+               else if (strcmp(*argv,"-verifyCAfile") == 0)
+                       {
+                       if (--argc < 1) goto bad;
+                       vfyCAfile= *(++argv);
+                       }
 #ifndef OPENSSL_NO_TLSEXT
 # ifndef OPENSSL_NO_NEXTPROTONEG
                else if (strcmp(*argv,"-nextprotoneg") == 0)
@@ -1137,6 +1159,13 @@ bad:
                goto end;
                }
 
+       if (!ssl_load_stores(ctx, vfyCApath, vfyCAfile, chCApath, chCAfile))
+               {
+               BIO_printf(bio_err, "Error loading store locations\n");
+               ERR_print_errors(bio_err);
+               goto end;
+               }
+
 #ifndef OPENSSL_NO_ENGINE
        if (ssl_client_engine)
                {

diff --git a/apps/s_server.c b/apps/s_server.c
index 9abeec93b3dc973355db2e449eb956c93253ece9..2b8754bbf524ddd6f5a56c939c0b42b3645d3159 100644 (file)
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -212,9 +212,6 @@ static int init_ssl_connection(SSL *s);
 static void print_stats(BIO *bp,SSL_CTX *ctx);
 static int generate_session_id(const SSL *ssl, unsigned char *id,
                                unsigned int *id_len);
-static int ssl_load_stores(SSL_CTX *sctx,
-                       const char *vfyCApath, const char *vfyCAfile,
-                       const char *chCApath, const char *chCAfile);
 #ifndef OPENSSL_NO_DH
 static DH *load_dh_param(const char *dhfile);
 static DH *get_dh512(void);
@@ -3122,33 +3119,3 @@ static int generate_session_id(const SSL *ssl, unsigned char *id,
                return 0;
        return 1;
        }
-
-static int ssl_load_stores(SSL_CTX *sctx,
-                       const char *vfyCApath, const char *vfyCAfile,
-                       const char *chCApath, const char *chCAfile)
-       {
-       X509_STORE *vfy = NULL, *ch = NULL;
-       int rv = 0;
-       if (vfyCApath || vfyCAfile)
-               {
-               vfy = X509_STORE_new();
-               if (!X509_STORE_load_locations(vfy, vfyCAfile, vfyCApath))
-                       goto err;
-               SSL_CTX_set1_verify_cert_store(ctx, vfy);
-               }
-       if (chCApath || chCAfile)
-               {
-               ch = X509_STORE_new();
-               if (!X509_STORE_load_locations(ch, chCAfile, chCApath))
-                       goto err;
-               /*X509_STORE_set_verify_cb(ch, verify_callback);*/
-               SSL_CTX_set1_chain_cert_store(ctx, ch);
-               }
-       rv = 1;
-       err:
-       if (vfy)
-               X509_STORE_free(vfy);
-       if (ch)
-               X509_STORE_free(ch);
-       return rv;
-       }