The cert subdir is testing all combinations of certificate validation.

Having the three libraries, client and server certificates, missing
or invalid CA or certificates, and enforcing peer certificate results
in 1944 new test cases.

1 files changed, 51 insertions, 7 deletions

diff --git a/src/regress/lib/libssl/interop/client.c b/src/regress/lib/libssl/interop/client.c
index 60fb718fdb..c312d7ae8a 100644
--- a/src/regress/lib/libssl/interop/client.c
+++ b/src/regress/lib/libssl/interop/client.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: client.c,v 1.3 2018/11/07 19:09:01 bluhm Exp $        */
+/*      $OpenBSD: client.c,v 1.4 2018/11/09 06:30:41 bluhm Exp $        */
 /*
  * Copyright (c) 2018 Alexander Bluhm <bluhm@openbsd.org>
  *
@@ -34,7 +34,8 @@ void __dead usage(void);
 void __dead
 usage(void)
 {
-        fprintf(stderr, "usage: client host port");
+        fprintf(stderr,
+            "usage: client [-c] [-C CA] [-c crt -k key] host port");
         exit(2);
 }
 
@@ -46,19 +47,42 @@ main(int argc, char *argv[])
         SSL *ssl;
         BIO *bio;
         SSL_SESSION *session;
-        int error;
-        char buf[256];
+        int error, verify = 0;
+        char buf[256], ch;
+        char *ca = NULL, *crt = NULL, *key = NULL;
         char *host_port, *host, *port;
 
-        if (argc == 3) {
-                host = argv[1];
-                port = argv[2];
+        while ((ch = getopt(argc, argv, "C:c:k:v")) != -1) {
+                switch (ch) {
+                case 'C':
+                        ca = optarg;
+                        break;
+                case 'c':
+                        crt = optarg;
+                        break;
+                case 'k':
+                        key = optarg;
+                        break;
+                case 'v':
+                        verify = 1;
+                        break;
+                default:
+                        usage();
+                }
+        }
+        argc -= optind;
+        argv += optind;
+        if (argc == 2) {
+                host = argv[0];
+                port = argv[1];
         } else {
                 usage();
         }
         if (asprintf(&host_port, strchr(host, ':') ? "[%s]:%s" : "%s:%s",
             host, port) == -1)
                 err(1, "asprintf host port");
+        if ((crt == NULL && key != NULL) || (crt != NULL && key == NULL))
+                errx(1, "certificate and private key must be used together");
 
         SSL_library_init();
         SSL_load_error_strings();
@@ -78,6 +102,26 @@ main(int argc, char *argv[])
         if (ctx == NULL)
                 err_ssl(1, "SSL_CTX_new");
 
+        /* load client certificate */
+        if (crt != NULL) {
+                if (SSL_CTX_use_certificate_file(ctx, crt,
+                    SSL_FILETYPE_PEM) <= 0)
+                        err_ssl(1, "SSL_CTX_use_certificate_file");
+                if (SSL_CTX_use_PrivateKey_file(ctx, key,
+                    SSL_FILETYPE_PEM) <= 0)
+                        err_ssl(1, "SSL_CTX_use_PrivateKey_file");
+                if (SSL_CTX_check_private_key(ctx) <= 0)
+                        err_ssl(1, "SSL_CTX_check_private_key");
+        }
+
+        /* verify server certificate */
+        if (ca != NULL) {
+                if (SSL_CTX_load_verify_locations(ctx, ca, NULL) <= 0)
+                        err_ssl(1, "SSL_CTX_load_verify_locations");
+        }
+        SSL_CTX_set_verify(ctx, verify ? SSL_VERIFY_PEER : SSL_VERIFY_NONE,
+            verify_callback);
+
         /* setup ssl and bio for socket operations */
         ssl = SSL_new(ctx);
         if (ssl == NULL)