Convert openssl(1) s_client option handling

suggestions and ok beck@ jsing@ tb@

1 files changed, 770 insertions, 450 deletions

diff --git a/src/usr.bin/openssl/s_client.c b/src/usr.bin/openssl/s_client.c
index cc886b11e6..2b47bf7ff9 100644
--- a/src/usr.bin/openssl/s_client.c
+++ b/src/usr.bin/openssl/s_client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s_client.c,v 1.46 2020/05/23 12:52:54 tb Exp $ */
+/* $OpenBSD: s_client.c,v 1.47 2020/07/09 12:48:19 inoguchi Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -170,87 +170,674 @@
 
 #define BUFSIZZ 1024*8
 
-static int c_nbio = 0;
-static int c_Pause = 0;
-static int c_debug = 0;
-static int c_tlsextdebug = 0;
-static int c_status_req = 0;
-static int c_msg = 0;
-static int c_showcerts = 0;
-
-static char *keymatexportlabel = NULL;
-static int keymatexportlen = 20;
-
 static void sc_usage(void);
 static void print_stuff(BIO * berr, SSL * con, int full);
 static int ocsp_resp_cb(SSL * s, void *arg);
 static BIO *bio_c_out = NULL;
-static int c_quiet = 0;
-static int c_ign_eof = 0;
 
+enum {
+        PROTO_OFF = 0,
+        PROTO_SMTP,
+        PROTO_LMTP,
+        PROTO_POP3,
+        PROTO_IMAP,
+        PROTO_FTP,
+        PROTO_XMPP,
+};
 
-static void
-sc_usage(void)
+static struct {
+        int af;
+        char *alpn_in;
+        int bugs;
+        char *CAfile;
+        char *CApath;
+        int c_debug;
+        int c_ign_eof;
+        int c_msg;
+        int c_nbio;
+        int c_Pause;
+        int c_quiet;
+        int c_showcerts;
+        int c_status_req;
+        int c_tlsextdebug;
+        char *cert_file;
+        int cert_format;
+        char *cipher;
+        unsigned int clr;
+        char *connect;
+        int crlf;
+        int enable_timeouts;
+        const char *errstr;
+        char *groups_in;
+        char *host;
+        char *key_file;
+        int key_format;
+        char *keymatexportlabel;
+        int keymatexportlen;
+        uint16_t max_version;
+        uint16_t min_version;
+        const SSL_METHOD *meth;
+        int nbio_test;
+        char *npn_in;
+        unsigned int off;
+        char *passarg;
+        int peekaboo;
+        char *port;
+        int prexit;
+        char *proxy;
+        int reconnect;
+        char *servername;
+        char *sess_in;
+        char *sess_out;
+        int socket_type;
+        long socket_mtu;
+#ifndef OPENSSL_NO_SRTP
+        char *srtp_profiles;
+#endif
+        int starttls_proto;
+        int state;
+        int verify;
+        X509_VERIFY_PARAM *vpm;
+        char *xmpphost;
+} s_client_config;
+
+static int
+s_client_opt_keymatexportlen(char *arg)
 {
-        BIO_printf(bio_err, "usage: s_client args\n");
-        BIO_printf(bio_err, "\n");
-        BIO_printf(bio_err, " -4            - Force IPv4\n");
-        BIO_printf(bio_err, " -6            - Force IPv6\n");
-        BIO_printf(bio_err, " -host host     - use -connect instead\n");
-        BIO_printf(bio_err, " -port port     - use -connect instead\n");
-        BIO_printf(bio_err, " -connect host:port - who to connect to (default is %s:%s)\n", SSL_HOST_NAME, PORT_STR);
-        BIO_printf(bio_err, " -proxy host:port - connect to http proxy\n");
-
-        BIO_printf(bio_err, " -verify arg   - turn on peer certificate verification\n");
-        BIO_printf(bio_err, " -cert arg     - certificate file to use, PEM format assumed\n");
-        BIO_printf(bio_err, " -certform arg - certificate format (PEM or DER) PEM default\n");
-        BIO_printf(bio_err, " -key arg      - Private key file to use, in cert file if\n");
-        BIO_printf(bio_err, "                 not specified but cert file is.\n");
-        BIO_printf(bio_err, " -keyform arg  - key format (PEM or DER) PEM default\n");
-        BIO_printf(bio_err, " -pass arg     - private key file pass phrase source\n");
-        BIO_printf(bio_err, " -CApath arg   - PEM format directory of CA's\n");
-        BIO_printf(bio_err, " -CAfile arg   - PEM format file of CA's\n");
-        BIO_printf(bio_err, " -reconnect    - Drop and re-make the connection with the same Session-ID\n");
-        BIO_printf(bio_err, " -pause        - sleep(1) after each read(2) and write(2) system call\n");
-        BIO_printf(bio_err, " -showcerts    - show all certificates in the chain\n");
-        BIO_printf(bio_err, " -debug        - extra output\n");
-        BIO_printf(bio_err, " -msg          - Show protocol messages\n");
-        BIO_printf(bio_err, " -nbio_test    - more ssl protocol testing\n");
-        BIO_printf(bio_err, " -state        - print the 'ssl' states\n");
-        BIO_printf(bio_err, " -nbio         - Run with non-blocking IO\n");
-        BIO_printf(bio_err, " -crlf         - convert LF from terminal into CRLF\n");
-        BIO_printf(bio_err, " -quiet        - no s_client output\n");
-        BIO_printf(bio_err, " -ign_eof      - ignore input eof (default when -quiet)\n");
-        BIO_printf(bio_err, " -no_ign_eof   - don't ignore input eof\n");
-        BIO_printf(bio_err, " -tls1_3       - just use TLSv1.3\n");
-        BIO_printf(bio_err, " -tls1_2       - just use TLSv1.2\n");
-        BIO_printf(bio_err, " -tls1_1       - just use TLSv1.1\n");
-        BIO_printf(bio_err, " -tls1         - just use TLSv1\n");
-        BIO_printf(bio_err, " -dtls1        - just use DTLSv1\n");
-        BIO_printf(bio_err, " -mtu          - set the link layer MTU\n");
-        BIO_printf(bio_err, " -no_tls1_3/-no_tls1_2/-no_tls1_1/-no_tls1 - turn off that protocol\n");
-        BIO_printf(bio_err, " -bugs         - Switch on all SSL implementation bug workarounds\n");
-        BIO_printf(bio_err, " -cipher       - preferred cipher to use, use the 'openssl ciphers'\n");
-        BIO_printf(bio_err, "                 command to see what is available\n");
-        BIO_printf(bio_err, " -starttls prot - use the STARTTLS command before starting TLS\n");
-        BIO_printf(bio_err, "                 for those protocols that support it, where\n");
-        BIO_printf(bio_err, "                 'prot' defines which one to assume.  Currently,\n");
-        BIO_printf(bio_err, "                 only \"smtp\", \"lmtp\", \"pop3\", \"imap\", \"ftp\" and \"xmpp\"\n");
-        BIO_printf(bio_err, "                 are supported.\n");
-        BIO_printf(bio_err, " -xmpphost host - connect to this virtual host on the xmpp server\n");
-        BIO_printf(bio_err, " -sess_out arg - file to write SSL session to\n");
-        BIO_printf(bio_err, " -sess_in arg  - file to read SSL session from\n");
-        BIO_printf(bio_err, " -servername host  - Set TLS extension servername in ClientHello\n");
-        BIO_printf(bio_err, " -tlsextdebug      - hex dump of all TLS extensions received\n");
-        BIO_printf(bio_err, " -status           - request certificate status from server\n");
-        BIO_printf(bio_err, " -no_ticket        - disable use of RFC4507bis session tickets\n");
-        BIO_printf(bio_err, " -alpn arg         - enable ALPN extension, considering named protocols supported (comma-separated list)\n");
-        BIO_printf(bio_err, " -groups arg       - specify EC groups (colon-separated list)\n");
+        s_client_config.keymatexportlen = strtonum(arg, 1, INT_MAX,
+            &s_client_config.errstr);
+        if (s_client_config.errstr != NULL) {
+                BIO_printf(bio_err, "invalid argument %s: %s\n",
+                    arg, s_client_config.errstr);
+                return (1);
+        }
+        return (0);
+}
+
+#ifndef OPENSSL_NO_DTLS1
+static int
+s_client_opt_mtu(char *arg)
+{
+        s_client_config.socket_mtu = strtonum(arg, 0, LONG_MAX,
+            &s_client_config.errstr);
+        if (s_client_config.errstr != NULL) {
+                BIO_printf(bio_err, "invalid argument %s: %s\n",
+                    arg, s_client_config.errstr);
+                return (1);
+        }
+        return (0);
+}
+#endif
+
+static int
+s_client_opt_port(char *arg)
+{
+        if (*arg == '\0')
+                return (1);
+
+        s_client_config.port = arg;
+        return (0);
+}
+
+#ifndef OPENSSL_NO_DTLS1
+static int
+s_client_opt_protocol_version_dtls1(void)
+{
+        s_client_config.meth = DTLS_client_method();
+        s_client_config.socket_type = SOCK_DGRAM;
+        return (0);
+}
+#endif
+
+static int
+s_client_opt_protocol_version_tls1(void)
+{
+        s_client_config.min_version = TLS1_VERSION;
+        s_client_config.max_version = TLS1_VERSION;
+        return (0);
+}
+
+static int
+s_client_opt_protocol_version_tls1_1(void)
+{
+        s_client_config.min_version = TLS1_1_VERSION;
+        s_client_config.max_version = TLS1_1_VERSION;
+        return (0);
+}
+
+static int
+s_client_opt_protocol_version_tls1_2(void)
+{
+        s_client_config.min_version = TLS1_2_VERSION;
+        s_client_config.max_version = TLS1_2_VERSION;
+        return (0);
+}
+
+static int
+s_client_opt_protocol_version_tls1_3(void)
+{
+        s_client_config.min_version = TLS1_3_VERSION;
+        s_client_config.max_version = TLS1_3_VERSION;
+        return (0);
+}
+
+static int
+s_client_opt_quiet(void)
+{
+        s_client_config.c_quiet = 1;
+        s_client_config.c_ign_eof = 1;
+        return (0);
+}
+
+static int
+s_client_opt_starttls(char *arg)
+{
+        if (strcmp(arg, "smtp") == 0)
+                s_client_config.starttls_proto = PROTO_SMTP;
+        else if (strcmp(arg, "lmtp") == 0)
+                s_client_config.starttls_proto = PROTO_LMTP;
+        else if (strcmp(arg, "pop3") == 0)
+                s_client_config.starttls_proto = PROTO_POP3;
+        else if (strcmp(arg, "imap") == 0)
+                s_client_config.starttls_proto = PROTO_IMAP;
+        else if (strcmp(arg, "ftp") == 0)
+                s_client_config.starttls_proto = PROTO_FTP;
+        else if (strcmp(arg, "xmpp") == 0)
+                s_client_config.starttls_proto = PROTO_XMPP;
+        else
+                return (1);
+        return (0);
+}
+
+static int
+s_client_opt_verify(char *arg)
+{
+        s_client_config.verify = SSL_VERIFY_PEER;
+
+        verify_depth = strtonum(arg, 0, INT_MAX, &s_client_config.errstr);
+        if (s_client_config.errstr != NULL) {
+                BIO_printf(bio_err, "invalid argument %s: %s\n",
+                    arg, s_client_config.errstr);
+                return (1);
+        }
+        BIO_printf(bio_err, "verify depth is %d\n", verify_depth);
+        return (0);
+}
+
+static int
+s_client_opt_verify_param(int argc, char **argv, int *argsused)
+{
+        char **pargs = argv;
+        int pargc = argc;
+        int badarg = 0;
+
+        if (!args_verify(&pargs, &pargc, &badarg, bio_err,
+            &s_client_config.vpm)) {
+                BIO_printf(bio_err, "unknown option %s\n", *argv);
+                return (1);
+        }
+        if (badarg)
+                return (1);
+
+        *argsused = argc - pargc;
+        return (0);
+}
+
+static const struct option s_client_options[] = {
+        {
+                .name = "4",
+                .desc = "Use IPv4 only",
+                .type = OPTION_VALUE,
+                .opt.value = &s_client_config.af,
+                .value = AF_INET,
+        },
+        {
+                .name = "6",
+                .desc = "Use IPv6 only",
+                .type = OPTION_VALUE,
+                .opt.value = &s_client_config.af,
+                .value = AF_INET6,
+        },
+        {
+                .name = "alpn",
+                .argname = "protocols",
+                .desc = "Set the advertised protocols for ALPN"
+                        " (comma-separated list)",
+                .type = OPTION_ARG,
+                .opt.arg = &s_client_config.alpn_in,
+        },
+        {
+                .name = "bugs",
+                .desc = "Enable various workarounds for buggy implementations",
+                .type = OPTION_FLAG,
+                .opt.flag = &s_client_config.bugs,
+        },
+        {
+                .name = "CAfile",
+                .argname = "file",
+                .desc = "PEM format file of CA certificates",
+                .type = OPTION_ARG,
+                .opt.arg = &s_client_config.CAfile,
+        },
+        {
+                .name = "CApath",
+                .argname = "directory",
+                .desc = "PEM format directory of CA certificates",
+                .type = OPTION_ARG,
+                .opt.arg = &s_client_config.CApath,
+        },
+        {
+                .name = "cert",
+                .argname = "file",
+                .desc = "Certificate file to use, PEM format assumed",
+                .type = OPTION_ARG,
+                .opt.arg = &s_client_config.cert_file,
+        },
+        {
+                .name = "certform",
+                .argname = "fmt",
+                .desc = "Certificate format (PEM or DER) PEM default",
+                .type = OPTION_ARG_FORMAT,
+                .opt.value = &s_client_config.cert_format,
+        },
+        {
+                .name = "cipher",
+                .argname = "cipherlist",
+                .desc = "Preferred cipher to use (see 'openssl ciphers')",
+                .type = OPTION_ARG,
+                .opt.arg = &s_client_config.cipher,
+        },
+        {
+                .name = "connect",
+                .argname = "host:port",
+                .desc = "Who to connect to (default is localhost:4433)",
+                .type = OPTION_ARG,
+                .opt.arg = &s_client_config.connect,
+        },
+        {
+                .name = "crlf",
+                .desc = "Convert LF from terminal into CRLF",
+                .type = OPTION_FLAG,
+                .opt.flag = &s_client_config.crlf,
+        },
+        {
+                .name = "debug",
+                .desc = "Print extensive debugging information",
+                .type = OPTION_FLAG,
+                .opt.flag = &s_client_config.c_debug,
+        },
+#ifndef OPENSSL_NO_DTLS1
+        {
+                .name = "dtls1",
+                .desc = "Just use DTLSv1",
+                .type = OPTION_FUNC,
+                .opt.func = s_client_opt_protocol_version_dtls1,
+        },
+#endif
+        {
+                .name = "groups",
+                .argname = "list",
+                .desc = "Specify EC groups (colon-separated list)",
+                .type = OPTION_ARG,
+                .opt.arg = &s_client_config.groups_in,
+        },
+        {
+                .name = "host",
+                .argname = "host",
+                .desc = "Use -connect instead",
+                .type = OPTION_ARG,
+                .opt.arg = &s_client_config.host,
+        },
+        {
+                .name = "ign_eof",
+                .desc = "Ignore input EOF (default when -quiet)",
+                .type = OPTION_VALUE,
+                .opt.value = &s_client_config.c_ign_eof,
+                .value = 1,
+        },
+        {
+                .name = "key",
+                .argname = "file",
+                .desc = "Private key file to use, if not, -cert file is used",
+                .type = OPTION_ARG,
+                .opt.arg = &s_client_config.key_file,
+        },
+        {
+                .name = "keyform",
+                .argname = "fmt",
+                .desc = "Key format (PEM or DER) PEM default",
+                .type = OPTION_ARG_FORMAT,
+                .opt.value = &s_client_config.key_format,
+        },
+        {
+                .name = "keymatexport",
+                .argname = "label",
+                .desc = "Export keying material using label",
+                .type = OPTION_ARG,
+                .opt.arg = &s_client_config.keymatexportlabel,
+        },
+        {
+                .name = "keymatexportlen",
+                .argname = "len",
+                .desc = "Export len bytes of keying material (default 20)",
+                .type = OPTION_ARG_FUNC,
+                .opt.argfunc = s_client_opt_keymatexportlen,
+        },
+        {
+                .name = "legacy_renegotiation",
+                .type = OPTION_DISCARD,
+        },
+        {
+                .name = "legacy_server_connect",
+                .desc = "Allow initial connection to servers that don't support RI",
+                .type = OPTION_VALUE_OR,
+                .opt.value = &s_client_config.off,
+                .value = SSL_OP_LEGACY_SERVER_CONNECT,
+        },
+        {
+                .name = "msg",
+                .desc = "Show all protocol messages with hex dump",
+                .type = OPTION_FLAG,
+                .opt.flag = &s_client_config.c_msg,
+        },
+#ifndef OPENSSL_NO_DTLS1
+        {
+                .name = "mtu",
+                .argname = "mtu",
+                .desc = "Set the link layer MTU on DTLS connections",
+                .type = OPTION_ARG_FUNC,
+                .opt.argfunc = s_client_opt_mtu,
+        },
+#endif
+        {
+                .name = "nbio",
+                .desc = "Turn on non-blocking I/O",
+                .type = OPTION_FLAG,
+                .opt.flag = &s_client_config.c_nbio,
+        },
+        {
+                .name = "nbio_test",
+                .desc = "Test non-blocking I/O",
+                .type = OPTION_FLAG,
+                .opt.flag = &s_client_config.nbio_test,
+        },
+        {
+                .name = "nextprotoneg",
+                .argname = "protocols",
+                .type = OPTION_ARG,
+                .opt.arg = &s_client_config.npn_in, /* Ignored. */
+        },
+        {
+                .name = "no_comp",
+                .type = OPTION_VALUE_OR,
+                .opt.value = &s_client_config.off,
+                .value = SSL_OP_NO_COMPRESSION,
+        },
+        {
+                .name = "no_ign_eof",
+                .desc = "Don't ignore input EOF",
+                .type = OPTION_VALUE,
+                .opt.value = &s_client_config.c_ign_eof,
+                .value = 0,
+        },
+        {
+                .name = "no_legacy_server_connect",
+                .desc = "Disallow initial connection to servers that don't support RI",
+                .type = OPTION_VALUE_OR,
+                .opt.value = &s_client_config.clr,
+                .value = SSL_OP_LEGACY_SERVER_CONNECT,
+        },
+        {
+                .name = "no_ssl2",
+                .type = OPTION_VALUE_OR,
+                .opt.value = &s_client_config.off,
+                .value = SSL_OP_NO_SSLv2,
+        },
+        {
+                .name = "no_ssl3",
+                .type = OPTION_VALUE_OR,
+                .opt.value = &s_client_config.off,
+                .value = SSL_OP_NO_SSLv3,
+        },
+        {
+                .name = "no_ticket",
+                .desc = "Disable use of RFC4507 session ticket support",
+                .type = OPTION_VALUE_OR,
+                .opt.value = &s_client_config.off,
+                .value = SSL_OP_NO_TICKET,
+        },
+        {
+                .name = "no_tls1",
+                .desc = "Disable the use of TLSv1",
+                .type = OPTION_VALUE_OR,
+                .opt.value = &s_client_config.off,
+                .value = SSL_OP_NO_TLSv1,
+        },
+        {
+                .name = "no_tls1_1",
+                .desc = "Disable the use of TLSv1.1",
+                .type = OPTION_VALUE_OR,
+                .opt.value = &s_client_config.off,
+                .value = SSL_OP_NO_TLSv1_1,
+        },
+        {
+                .name = "no_tls1_2",
+                .desc = "Disable the use of TLSv1.2",
+                .type = OPTION_VALUE_OR,
+                .opt.value = &s_client_config.off,
+                .value = SSL_OP_NO_TLSv1_2,
+        },
+        {
+                .name = "no_tls1_3",
+                .desc = "Disable the use of TLSv1.3",
+                .type = OPTION_VALUE_OR,
+                .opt.value = &s_client_config.off,
+                .value = SSL_OP_NO_TLSv1_3,
+        },
+        {
+                .name = "pass",
+                .argname = "arg",
+                .desc = "Private key file pass phrase source",
+                .type = OPTION_ARG,
+                .opt.arg = &s_client_config.passarg,
+        },
+        {
+                .name = "pause",
+                .desc = "Pause 1 second between each read and write call",
+                .type = OPTION_FLAG,
+                .opt.flag = &s_client_config.c_Pause,
+        },
+        {
+                .name = "peekaboo",
+                .type = OPTION_FLAG,
+                .opt.flag = &s_client_config.peekaboo,
+        },
+        {
+                .name = "port",
+                .argname = "port",
+                .desc = "Use -connect instead",
+                .type = OPTION_ARG_FUNC,
+                .opt.argfunc = s_client_opt_port,
+        },
+        {
+                .name = "prexit",
+                .desc = "Print session information when the program exits",
+                .type = OPTION_FLAG,
+                .opt.flag = &s_client_config.prexit,
+        },
+        {
+                .name = "proxy",
+                .argname = "host:port",
+                .desc = "Connect to http proxy",
+                .type = OPTION_ARG,
+                .opt.arg = &s_client_config.proxy,
+        },
+        {
+                .name = "quiet",
+                .desc = "Inhibit printing of session and certificate info",
+                .type = OPTION_FUNC,
+                .opt.func = s_client_opt_quiet,
+        },
+        {
+                .name = "reconnect",
+                .desc = "Drop and re-make the connection with the same Session-ID",
+                .type = OPTION_VALUE,
+                .opt.value = &s_client_config.reconnect,
+                .value = 5,
+        },
+        {
+                .name = "servername",
+                .argname = "name",
+                .desc = "Set TLS extension servername in ClientHello (SNI)",
+                .type = OPTION_ARG,
+                .opt.arg = &s_client_config.servername,
+        },
+        {
+                .name = "serverpref",
+                .desc = "Use server's cipher preferences",
+                .type = OPTION_VALUE_OR,
+                .opt.value = &s_client_config.off,
+                .value = SSL_OP_CIPHER_SERVER_PREFERENCE,
+        },
+        {
+                .name = "sess_in",
+                .argname = "file",
+                .desc = "File to read TLS session from",
+                .type = OPTION_ARG,
+                .opt.arg = &s_client_config.sess_in,
+        },
+        {
+                .name = "sess_out",
+                .argname = "file",
+                .desc = "File to write TLS session to",
+                .type = OPTION_ARG,
+                .opt.arg = &s_client_config.sess_out,
+        },
+        {
+                .name = "showcerts",
+                .desc = "Show all server certificates in the chain",
+                .type = OPTION_FLAG,
+                .opt.flag = &s_client_config.c_showcerts,
+        },
+        {
+                .name = "starttls",
+                .argname = "protocol",
+                .desc = "Use the STARTTLS command before starting TLS,\n"
+                        "smtp, lmtp, pop3, imap, ftp and xmpp are supported.",
+                .type = OPTION_ARG_FUNC,
+                .opt.argfunc = s_client_opt_starttls,
+        },
+        {
+                .name = "state",
+                .desc = "Print the TLS session states",
+                .type = OPTION_FLAG,
+                .opt.flag = &s_client_config.state,
+        },
+        {
+                .name = "status",
+                .desc = "Send a certificate status request to the server (OCSP)",
+                .type = OPTION_FLAG,
+                .opt.flag = &s_client_config.c_status_req,
+        },
+#ifndef OPENSSL_NO_DTLS1
+        {
+                .name = "timeout",
+                .desc = "Enable send/receive timeout on DTLS connections",
+                .type = OPTION_FLAG,
+                .opt.flag = &s_client_config.enable_timeouts,
+        },
+#endif
+        {
+                .name = "tls1",
+                .desc = "Just use TLSv1",
+                .type = OPTION_FUNC,
+                .opt.func = s_client_opt_protocol_version_tls1,
+        },
+        {
+                .name = "tls1_1",
+                .desc = "Just use TLSv1.1",
+                .type = OPTION_FUNC,
+                .opt.func = s_client_opt_protocol_version_tls1_1,
+        },
+        {
+                .name = "tls1_2",
+                .desc = "Just use TLSv1.2",
+                .type = OPTION_FUNC,
+                .opt.func = s_client_opt_protocol_version_tls1_2,
+        },
+        {
+                .name = "tls1_3",
+                .desc = "Just use TLSv1.3",
+                .type = OPTION_FUNC,
+                .opt.func = s_client_opt_protocol_version_tls1_3,
+        },
+        {
+                .name = "tlsextdebug",
+                .desc = "Hex dump of all TLS extensions received",
+                .type = OPTION_FLAG,
+                .opt.flag = &s_client_config.c_tlsextdebug,
+        },
 #ifndef OPENSSL_NO_SRTP
-        BIO_printf(bio_err, " -use_srtp profiles - Offer SRTP key management with a colon-separated profile list\n");
+        {
+                .name = "use_srtp",
+                .argname = "profiles",
+                .desc = "Offer SRTP key management with a colon-separated profiles",
+                .type = OPTION_ARG,
+                .opt.arg = &s_client_config.srtp_profiles,
+        },
 #endif
-        BIO_printf(bio_err, " -keymatexport label   - Export keying material using label\n");
-        BIO_printf(bio_err, " -keymatexportlen len  - Export len bytes of keying material (default 20)\n");
+        {
+                .name = "verify",
+                .argname = "depth",
+                .desc = "Turn on peer certificate verification, with a max of depth",
+                .type = OPTION_ARG_FUNC,
+                .opt.argfunc = s_client_opt_verify,
+        },
+        {
+                .name = "verify_return_error",
+                .desc = "Return verification error",
+                .type = OPTION_FLAG,
+                .opt.flag = &verify_return_error,
+        },
+        {
+                .name = "xmpphost",
+                .argname = "host",
+                .desc = "Connect to this virtual host on the xmpp server",
+                .type = OPTION_ARG,
+                .opt.arg = &s_client_config.xmpphost,
+        },
+        {
+                .name = NULL,
+                .desc = "",
+                .type = OPTION_ARGV_FUNC,
+                .opt.argvfunc = s_client_opt_verify_param,
+        },
+        { NULL },
+};
+
+static void
+sc_usage(void)
+{
+        fprintf(stderr, "usage: s_client "
+            "[-4 | -6] [-alpn protocols] [-bugs] [-CAfile file]\n"
+            "    [-CApath directory] [-cert file] [-certform der | pem] [-check_ss_sig]\n"
+            "    [-cipher cipherlist] [-connect host[:port]] [-crl_check]\n"
+            "    [-crl_check_all] [-crlf] [-debug] [-dtls1] [-extended_crl]\n"
+            "    [-groups list] [-host host] [-ign_eof] [-ignore_critical]\n"
+            "    [-issuer_checks] [-key keyfile] [-keyform der | pem]\n"
+            "    [-keymatexport label] [-keymatexportlen len] [-legacy_server_connect]\n"
+            "    [-msg] [-mtu mtu] [-nbio] [-nbio_test] [-no_comp] [-no_ign_eof]\n"
+            "    [-no_legacy_server_connect] [-no_ticket] [-no_tls1] [-no_tls1_1]\n"
+            "    [-no_tls1_2] [-no_tls1_3] [-pass arg] [-pause] [-policy_check]\n"
+            "    [-port port] [-prexit] [-proxy host:port] [-quiet] [-reconnect]\n"
+            "    [-servername name] [-serverpref] [-sess_in file] [-sess_out file]\n"
+            "    [-showcerts] [-starttls protocol] [-state] [-status] [-timeout]\n"
+            "    [-tls1] [-tls1_1] [-tls1_2] [-tls1_3] [-tlsextdebug]\n"
+            "    [-use_srtp profiles] [-verify depth] [-verify_return_error]\n"
+            "    [-x509_strict] [-xmpphost host]\n");
+        fprintf(stderr, "\n");
+        options_usage(s_client_options);
+        fprintf(stderr, "\n");
 }
 
 
@@ -274,68 +861,29 @@ ssl_servername_cb(SSL * s, int *ad, void *arg)
         return SSL_TLSEXT_ERR_OK;
 }
 
-#ifndef OPENSSL_NO_SRTP
-char *srtp_profiles = NULL;
-#endif
-
-enum {
-        PROTO_OFF = 0,
-        PROTO_SMTP,
-        PROTO_LMTP,
-        PROTO_POP3,
-        PROTO_IMAP,
-        PROTO_FTP,
-        PROTO_XMPP
-};
-
 int
 s_client_main(int argc, char **argv)
 {
-        unsigned int off = 0, clr = 0;
         SSL *con = NULL;
-        int s, k, p = 0, pending = 0, state = 0, af = AF_UNSPEC;
+        int s, k, p = 0, pending = 0;
         char *cbuf = NULL, *sbuf = NULL, *mbuf = NULL, *pbuf = NULL;
         int cbuf_len, cbuf_off;
         int sbuf_len, sbuf_off;
         int pbuf_len, pbuf_off;
-        char *port = PORT_STR;
         int full_log = 1;
-        char *host = SSL_HOST_NAME;
-        char *xmpphost = NULL;
-        char *proxy = NULL, *connect = NULL;
-        char *cert_file = NULL, *key_file = NULL;
-        int cert_format = FORMAT_PEM, key_format = FORMAT_PEM;
-        char *passarg = NULL, *pass = NULL;
+        char *pass = NULL;
         X509 *cert = NULL;
         EVP_PKEY *key = NULL;
-        char *CApath = NULL, *CAfile = NULL, *cipher = NULL;
-        int reconnect = 0, badop = 0, verify = SSL_VERIFY_NONE, bugs = 0;
-        int crlf = 0;
+        int badop = 0;
         int write_tty, read_tty, write_ssl, read_ssl, tty_on, ssl_pending;
         SSL_CTX *ctx = NULL;
-        int ret = 1, in_init = 1, i, nbio_test = 0;
-        int starttls_proto = PROTO_OFF;
-        int prexit = 0;
-        int peekaboo = 0;
-        X509_VERIFY_PARAM *vpm = NULL;
-        int badarg = 0;
-        const SSL_METHOD *meth = NULL;
-        int socket_type = SOCK_STREAM;
+        int ret = 1, in_init = 1, i;
         BIO *sbio;
         int mbuf_len = 0;
         struct timeval timeout;
-        const char *errstr = NULL;
-        char *servername = NULL;
         tlsextctx tlsextcbp = {NULL, 0};
-        const char *alpn_in = NULL;
-        const char *groups_in = NULL;
-        char *sess_in = NULL;
-        char *sess_out = NULL;
         struct sockaddr_storage peer;
         int peerlen = sizeof(peer);
-        int enable_timeouts = 0;
-        long socket_mtu = 0;
-        uint16_t min_version = 0, max_version = 0;
 
         if (single_execution) {
                 if (pledge("stdio cpath wpath rpath inet dns tty", NULL) == -1) {
@@ -344,14 +892,17 @@ s_client_main(int argc, char **argv)
                 }
         }
 
-        meth = TLS_client_method();
-
-        c_Pause = 0;
-        c_quiet = 0;
-        c_ign_eof = 0;
-        c_debug = 0;
-        c_msg = 0;
-        c_showcerts = 0;
+        memset(&s_client_config, 0, sizeof(s_client_config));
+        s_client_config.af = AF_UNSPEC;
+        s_client_config.cert_format = FORMAT_PEM;
+        s_client_config.host = SSL_HOST_NAME;
+        s_client_config.key_format = FORMAT_PEM;
+        s_client_config.keymatexportlen = 20;
+        s_client_config.meth = TLS_client_method();
+        s_client_config.port = PORT_STR;
+        s_client_config.socket_type = SOCK_STREAM;
+        s_client_config.starttls_proto = PROTO_OFF;
+        s_client_config.verify = SSL_VERIFY_NONE;
 
         if (((cbuf = malloc(BUFSIZZ)) == NULL) ||
             ((sbuf = malloc(BUFSIZZ)) == NULL) ||
@@ -361,277 +912,46 @@ s_client_main(int argc, char **argv)
                 goto end;
         }
         verify_depth = 0;
-        c_nbio = 0;
-
-        argc--;
-        argv++;
-        while (argc >= 1) {
-                if (strcmp(*argv, "-host") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        host = *(++argv);
-                } else if (strcmp(*argv, "-port") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        port = *(++argv);
-                        if (port == NULL || *port == '\0')
-                                goto bad;
-                } else if (strcmp(*argv, "-connect") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        connect = *(++argv);
-                } else if (strcmp(*argv, "-proxy") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        proxy = *(++argv);
-                } else if (strcmp(*argv,"-xmpphost") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        xmpphost= *(++argv);
-                } else if (strcmp(*argv, "-verify") == 0) {
-                        verify = SSL_VERIFY_PEER;
-                        if (--argc < 1)
-                                goto bad;
-                        verify_depth = strtonum(*(++argv), 0, INT_MAX, &errstr);
-                        if (errstr)
-                                goto bad;
-                        BIO_printf(bio_err, "verify depth is %d\n", verify_depth);
-                } else if (strcmp(*argv, "-cert") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        cert_file = *(++argv);
-                } else if (strcmp(*argv, "-sess_out") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        sess_out = *(++argv);
-                } else if (strcmp(*argv, "-sess_in") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        sess_in = *(++argv);
-                } else if (strcmp(*argv, "-certform") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        cert_format = str2fmt(*(++argv));
-                } else if (args_verify(&argv, &argc, &badarg, bio_err, &vpm)) {
-                        if (badarg)
-                                goto bad;
-                        continue;
-                } else if (strcmp(*argv, "-verify_return_error") == 0)
-                        verify_return_error = 1;
-                else if (strcmp(*argv, "-prexit") == 0)
-                        prexit = 1;
-                else if (strcmp(*argv, "-peekaboo") == 0)
-                        peekaboo = 1;
-                else if (strcmp(*argv, "-crlf") == 0)
-                        crlf = 1;
-                else if (strcmp(*argv, "-quiet") == 0) {
-                        c_quiet = 1;
-                        c_ign_eof = 1;
-                } else if (strcmp(*argv, "-ign_eof") == 0)
-                        c_ign_eof = 1;
-                else if (strcmp(*argv, "-no_ign_eof") == 0)
-                        c_ign_eof = 0;
-                else if (strcmp(*argv, "-pause") == 0)
-                        c_Pause = 1;
-                else if (strcmp(*argv, "-debug") == 0)
-                        c_debug = 1;
-                else if (strcmp(*argv, "-tlsextdebug") == 0)
-                        c_tlsextdebug = 1;
-                else if (strcmp(*argv, "-status") == 0)
-                        c_status_req = 1;
-                else if (strcmp(*argv, "-msg") == 0)
-                        c_msg = 1;
-                else if (strcmp(*argv, "-showcerts") == 0)
-                        c_showcerts = 1;
-                else if (strcmp(*argv, "-nbio_test") == 0)
-                        nbio_test = 1;
-                else if (strcmp(*argv, "-state") == 0)
-                        state = 1;
-                else if (strcmp(*argv, "-tls1_3") == 0) {
-                        min_version = TLS1_3_VERSION;
-                        max_version = TLS1_3_VERSION;
-                } else if (strcmp(*argv, "-tls1_2") == 0) {
-                        min_version = TLS1_2_VERSION;
-                        max_version = TLS1_2_VERSION;
-                } else if (strcmp(*argv, "-tls1_1") == 0) {
-                        min_version = TLS1_1_VERSION;
-                        max_version = TLS1_1_VERSION;
-                } else if (strcmp(*argv, "-tls1") == 0) {
-                        min_version = TLS1_VERSION;
-                        max_version = TLS1_VERSION;
-#ifndef OPENSSL_NO_DTLS1
-                } else if (strcmp(*argv, "-dtls1") == 0) {
-                        meth = DTLS_client_method();
-                        socket_type = SOCK_DGRAM;
-                } else if (strcmp(*argv, "-timeout") == 0)
-                        enable_timeouts = 1;
-                else if (strcmp(*argv, "-mtu") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        socket_mtu = strtonum(*(++argv), 0, LONG_MAX, &errstr);
-                        if (errstr)
-                                goto bad;
-                }
-#endif
-                else if (strcmp(*argv, "-bugs") == 0)
-                        bugs = 1;
-                else if (strcmp(*argv, "-keyform") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        key_format = str2fmt(*(++argv));
-                } else if (strcmp(*argv, "-pass") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        passarg = *(++argv);
-                } else if (strcmp(*argv, "-key") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        key_file = *(++argv);
-                } else if (strcmp(*argv, "-reconnect") == 0) {
-                        reconnect = 5;
-                } else if (strcmp(*argv, "-CApath") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        CApath = *(++argv);
-                } else if (strcmp(*argv, "-CAfile") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        CAfile = *(++argv);
-                } else if (strcmp(*argv, "-no_tls1_3") == 0)
-                        off |= SSL_OP_NO_TLSv1_3;
-                else if (strcmp(*argv, "-no_tls1_2") == 0)
-                        off |= SSL_OP_NO_TLSv1_2;
-                else if (strcmp(*argv, "-no_tls1_1") == 0)
-                        off |= SSL_OP_NO_TLSv1_1;
-                else if (strcmp(*argv, "-no_tls1") == 0)
-                        off |= SSL_OP_NO_TLSv1;
-                else if (strcmp(*argv, "-no_ssl3") == 0)
-                        off |= SSL_OP_NO_SSLv3;
-                else if (strcmp(*argv, "-no_ssl2") == 0)
-                        off |= SSL_OP_NO_SSLv2;
-                else if (strcmp(*argv, "-no_comp") == 0) {
-                        off |= SSL_OP_NO_COMPRESSION;
-                } else if (strcmp(*argv, "-no_ticket") == 0) {
-                        off |= SSL_OP_NO_TICKET;
-                } else if (strcmp(*argv, "-nextprotoneg") == 0) {
-                        /* Ignored. */
-                        if (--argc < 1)
-                                goto bad;
-                        ++argv;
-                } else if (strcmp(*argv, "-alpn") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        alpn_in = *(++argv);
-                } else if (strcmp(*argv, "-groups") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        groups_in = *(++argv);
-                } else if (strcmp(*argv, "-serverpref") == 0)
-                        off |= SSL_OP_CIPHER_SERVER_PREFERENCE;
-                else if (strcmp(*argv, "-legacy_renegotiation") == 0)
-                        ; /* no-op */
-                else if (strcmp(*argv, "-legacy_server_connect") == 0) {
-                        off |= SSL_OP_LEGACY_SERVER_CONNECT;
-                } else if (strcmp(*argv, "-no_legacy_server_connect") == 0) {
-                        clr |= SSL_OP_LEGACY_SERVER_CONNECT;
-                } else if (strcmp(*argv, "-cipher") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        cipher = *(++argv);
-                }
-                else if (strcmp(*argv, "-nbio") == 0) {
-                        c_nbio = 1;
-                }
-                else if (strcmp(*argv, "-starttls") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        ++argv;
-                        if (strcmp(*argv, "smtp") == 0)
-                                starttls_proto = PROTO_SMTP;
-                        else if (strcmp(*argv, "lmtp") == 0)
-                                starttls_proto = PROTO_LMTP;
-                        else if (strcmp(*argv, "pop3") == 0)
-                                starttls_proto = PROTO_POP3;
-                        else if (strcmp(*argv, "imap") == 0)
-                                starttls_proto = PROTO_IMAP;
-                        else if (strcmp(*argv, "ftp") == 0)
-                                starttls_proto = PROTO_FTP;
-                        else if (strcmp(*argv, "xmpp") == 0)
-                                starttls_proto = PROTO_XMPP;
-                        else
-                                goto bad;
-                } else if (strcmp(*argv, "-4") == 0) {
-                        af = AF_INET;
-                } else if (strcmp(*argv, "-6") == 0) {
-                        af = AF_INET6;
-                } else if (strcmp(*argv, "-servername") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        servername = *(++argv);
-                }
-#ifndef OPENSSL_NO_SRTP
-                else if (strcmp(*argv, "-use_srtp") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        srtp_profiles = *(++argv);
-                }
-#endif
-                else if (strcmp(*argv, "-keymatexport") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        keymatexportlabel = *(++argv);
-                } else if (strcmp(*argv, "-keymatexportlen") == 0) {
-                        if (--argc < 1)
-                                goto bad;
-                        keymatexportlen = strtonum(*(++argv), 1, INT_MAX, &errstr);
-                        if (errstr)
-                                goto bad;
-                } else {
-                        BIO_printf(bio_err, "unknown option %s\n", *argv);
-                        badop = 1;
-                        break;
-                }
-                argc--;
-                argv++;
+
+        if (options_parse(argc, argv, s_client_options, NULL, NULL) != 0) {
+                badop = 1;
+                goto bad;
         }
-        if (proxy != NULL) {
-                if (!extract_host_port(proxy, &host, NULL, &port))
+        if (s_client_config.proxy != NULL) {
+                if (!extract_host_port(s_client_config.proxy, &s_client_config.host, NULL, &s_client_config.port))
                         goto bad;
-                if (connect == NULL)
-                        connect = SSL_HOST_NAME;
-        } else if (connect != NULL) {
-                if (!extract_host_port(connect, &host, NULL, &port))
+                if (s_client_config.connect == NULL)
+                        s_client_config.connect = SSL_HOST_NAME;
+        } else if (s_client_config.connect != NULL) {
+                if (!extract_host_port(s_client_config.connect, &s_client_config.host, NULL, &s_client_config.port))
                         goto bad;
         }
         if (badop) {
  bad:
-                if (errstr)
-                        BIO_printf(bio_err, "invalid argument %s: %s\n",
-                            *argv, errstr);
-                else
+                if (s_client_config.errstr == NULL)
                         sc_usage();
                 goto end;
         }
 
-        if (!app_passwd(bio_err, passarg, NULL, &pass, NULL)) {
+        if (!app_passwd(bio_err, s_client_config.passarg, NULL, &pass, NULL)) {
                 BIO_printf(bio_err, "Error getting password\n");
                 goto end;
         }
-        if (key_file == NULL)
-                key_file = cert_file;
+        if (s_client_config.key_file == NULL)
+                s_client_config.key_file = s_client_config.cert_file;
 
 
-        if (key_file) {
+        if (s_client_config.key_file) {
 
-                key = load_key(bio_err, key_file, key_format, 0, pass,
+                key = load_key(bio_err, s_client_config.key_file, s_client_config.key_format, 0, pass,
                     "client certificate private key file");
                 if (!key) {
                         ERR_print_errors(bio_err);
                         goto end;
                 }
         }
-        if (cert_file) {
-                cert = load_cert(bio_err, cert_file, cert_format,
+        if (s_client_config.cert_file) {
+                cert = load_cert(bio_err, s_client_config.cert_file, s_client_config.cert_format,
                     NULL, "client certificate file");
 
                 if (!cert) {
@@ -640,7 +960,7 @@ s_client_main(int argc, char **argv)
                 }
         }
         if (bio_c_out == NULL) {
-                if (c_quiet && !c_debug && !c_msg) {
+                if (s_client_config.c_quiet && !s_client_config.c_debug && !s_client_config.c_msg) {
                         bio_c_out = BIO_new(BIO_s_null());
                 } else {
                         if (bio_c_out == NULL)
@@ -648,7 +968,7 @@ s_client_main(int argc, char **argv)
                 }
         }
 
-        ctx = SSL_CTX_new(meth);
+        ctx = SSL_CTX_new(s_client_config.meth);
         if (ctx == NULL) {
                 ERR_print_errors(bio_err);
                 goto end;
@@ -656,35 +976,35 @@ s_client_main(int argc, char **argv)
 
         SSL_CTX_clear_mode(ctx, SSL_MODE_AUTO_RETRY);
 
-        if (vpm)
-                SSL_CTX_set1_param(ctx, vpm);
+        if (s_client_config.vpm)
+                SSL_CTX_set1_param(ctx, s_client_config.vpm);
 
-        if (!SSL_CTX_set_min_proto_version(ctx, min_version))
+        if (!SSL_CTX_set_min_proto_version(ctx, s_client_config.min_version))
                 goto end;
-        if (!SSL_CTX_set_max_proto_version(ctx, max_version))
+        if (!SSL_CTX_set_max_proto_version(ctx, s_client_config.max_version))
                 goto end;
 
 #ifndef OPENSSL_NO_SRTP
-        if (srtp_profiles != NULL)
-                SSL_CTX_set_tlsext_use_srtp(ctx, srtp_profiles);
+        if (s_client_config.srtp_profiles != NULL)
+                SSL_CTX_set_tlsext_use_srtp(ctx, s_client_config.srtp_profiles);
 #endif
-        if (bugs)
-                SSL_CTX_set_options(ctx, SSL_OP_ALL | off);
+        if (s_client_config.bugs)
+                SSL_CTX_set_options(ctx, SSL_OP_ALL | s_client_config.off);
         else
-                SSL_CTX_set_options(ctx, off);
+                SSL_CTX_set_options(ctx, s_client_config.off);
 
-        if (clr)
-                SSL_CTX_clear_options(ctx, clr);
+        if (s_client_config.clr)
+                SSL_CTX_clear_options(ctx, s_client_config.clr);
         /*
          * DTLS: partial reads end up discarding unread UDP bytes :-( Setting
          * read ahead solves this problem.
          */
-        if (socket_type == SOCK_DGRAM)
+        if (s_client_config.socket_type == SOCK_DGRAM)
                 SSL_CTX_set_read_ahead(ctx, 1);
 
-        if (alpn_in) {
+        if (s_client_config.alpn_in) {
                 unsigned short alpn_len;
-                unsigned char *alpn = next_protos_parse(&alpn_len, alpn_in);
+                unsigned char *alpn = next_protos_parse(&alpn_len, s_client_config.alpn_in);
 
                 if (alpn == NULL) {
                         BIO_printf(bio_err, "Error parsing -alpn argument\n");
@@ -693,47 +1013,47 @@ s_client_main(int argc, char **argv)
                 SSL_CTX_set_alpn_protos(ctx, alpn, alpn_len);
                 free(alpn);
         }
-        if (groups_in != NULL) {
-                if (SSL_CTX_set1_groups_list(ctx, groups_in) != 1) {
+        if (s_client_config.groups_in != NULL) {
+                if (SSL_CTX_set1_groups_list(ctx, s_client_config.groups_in) != 1) {
                         BIO_printf(bio_err, "Failed to set groups '%s'\n",
-                            groups_in);
+                            s_client_config.groups_in);
                         goto end;
                 }
         }
 
-        if (state)
+        if (s_client_config.state)
                 SSL_CTX_set_info_callback(ctx, apps_ssl_info_callback);
-        if (cipher != NULL)
-                if (!SSL_CTX_set_cipher_list(ctx, cipher)) {
+        if (s_client_config.cipher != NULL)
+                if (!SSL_CTX_set_cipher_list(ctx, s_client_config.cipher)) {
                         BIO_printf(bio_err, "error setting cipher list\n");
                         ERR_print_errors(bio_err);
                         goto end;
                 }
 
-        SSL_CTX_set_verify(ctx, verify, verify_callback);
+        SSL_CTX_set_verify(ctx, s_client_config.verify, verify_callback);
         if (!set_cert_key_stuff(ctx, cert, key))
                 goto end;
 
-        if ((CAfile || CApath)
-            && !SSL_CTX_load_verify_locations(ctx, CAfile, CApath))
+        if ((s_client_config.CAfile || s_client_config.CApath)
+            && !SSL_CTX_load_verify_locations(ctx, s_client_config.CAfile, s_client_config.CApath))
                 ERR_print_errors(bio_err);
 
         if (!SSL_CTX_set_default_verify_paths(ctx))
                 ERR_print_errors(bio_err);
 
-        if (servername != NULL) {
+        if (s_client_config.servername != NULL) {
                 tlsextcbp.biodebug = bio_err;
                 SSL_CTX_set_tlsext_servername_callback(ctx, ssl_servername_cb);
                 SSL_CTX_set_tlsext_servername_arg(ctx, &tlsextcbp);
         }
 
         con = SSL_new(ctx);
-        if (sess_in) {
+        if (s_client_config.sess_in) {
                 SSL_SESSION *sess;
-                BIO *stmp = BIO_new_file(sess_in, "r");
+                BIO *stmp = BIO_new_file(s_client_config.sess_in, "r");
                 if (!stmp) {
                         BIO_printf(bio_err, "Can't open session file %s\n",
-                            sess_in);
+                            s_client_config.sess_in);
                         ERR_print_errors(bio_err);
                         goto end;
                 }
@@ -741,15 +1061,15 @@ s_client_main(int argc, char **argv)
                 BIO_free(stmp);
                 if (!sess) {
                         BIO_printf(bio_err, "Can't open session file %s\n",
-                            sess_in);
+                            s_client_config.sess_in);
                         ERR_print_errors(bio_err);
                         goto end;
                 }
                 SSL_set_session(con, sess);
                 SSL_SESSION_free(sess);
         }
-        if (servername != NULL) {
-                if (!SSL_set_tlsext_host_name(con, servername)) {
+        if (s_client_config.servername != NULL) {
+                if (!SSL_set_tlsext_host_name(con, s_client_config.servername)) {
                         BIO_printf(bio_err, "Unable to set TLS servername extension.\n");
                         ERR_print_errors(bio_err);
                         goto end;
@@ -759,21 +1079,21 @@ s_client_main(int argc, char **argv)
 
 re_start:
 
-        if (init_client(&s, host, port, socket_type, af) == 0) {
+        if (init_client(&s, s_client_config.host, s_client_config.port, s_client_config.socket_type, s_client_config.af) == 0) {
                 BIO_printf(bio_err, "connect:errno=%d\n", errno);
                 goto end;
         }
         BIO_printf(bio_c_out, "CONNECTED(%08X)\n", s);
 
-        if (c_nbio) {
-                if (!c_quiet)
+        if (s_client_config.c_nbio) {
+                if (!s_client_config.c_quiet)
                         BIO_printf(bio_c_out, "turning on non blocking io\n");
                 if (!BIO_socket_nbio(s, 1)) {
                         ERR_print_errors(bio_err);
                         goto end;
                 }
         }
-        if (c_Pause & 0x01)
+        if (s_client_config.c_Pause & 0x01)
                 SSL_set_debug(con, 1);
 
         if (SSL_version(con) == DTLS1_VERSION) {
@@ -789,7 +1109,7 @@ re_start:
                 }
                 (void) BIO_ctrl_set_connected(sbio, 1, &peer);
 
-                if (enable_timeouts) {
+                if (s_client_config.enable_timeouts) {
                         timeout.tv_sec = 0;
                         timeout.tv_usec = DGRAM_RCV_TIMEOUT;
                         BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_RECV_TIMEOUT, 0, &timeout);
@@ -798,35 +1118,35 @@ re_start:
                         timeout.tv_usec = DGRAM_SND_TIMEOUT;
                         BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_SEND_TIMEOUT, 0, &timeout);
                 }
-                if (socket_mtu > 28) {
+                if (s_client_config.socket_mtu > 28) {
                         SSL_set_options(con, SSL_OP_NO_QUERY_MTU);
-                        SSL_set_mtu(con, socket_mtu - 28);
+                        SSL_set_mtu(con, s_client_config.socket_mtu - 28);
                 } else
                         /* want to do MTU discovery */
                         BIO_ctrl(sbio, BIO_CTRL_DGRAM_MTU_DISCOVER, 0, NULL);
         } else
                 sbio = BIO_new_socket(s, BIO_NOCLOSE);
 
-        if (nbio_test) {
+        if (s_client_config.nbio_test) {
                 BIO *test;
 
                 test = BIO_new(BIO_f_nbio_test());
                 sbio = BIO_push(test, sbio);
         }
-        if (c_debug) {
+        if (s_client_config.c_debug) {
                 SSL_set_debug(con, 1);
                 BIO_set_callback(sbio, bio_dump_callback);
                 BIO_set_callback_arg(sbio, (char *) bio_c_out);
         }
-        if (c_msg) {
+        if (s_client_config.c_msg) {
                 SSL_set_msg_callback(con, msg_cb);
                 SSL_set_msg_callback_arg(con, bio_c_out);
         }
-        if (c_tlsextdebug) {
+        if (s_client_config.c_tlsextdebug) {
                 SSL_set_tlsext_debug_callback(con, tlsext_cb);
                 SSL_set_tlsext_debug_arg(con, bio_c_out);
         }
-        if (c_status_req) {
+        if (s_client_config.c_status_req) {
                 SSL_set_tlsext_status_type(con, TLSEXT_STATUSTYPE_ocsp);
                 SSL_CTX_set_tlsext_status_cb(ctx, ocsp_resp_cb);
                 SSL_CTX_set_tlsext_status_arg(ctx, bio_c_out);
@@ -857,7 +1177,7 @@ re_start:
          * push a buffering BIO into the chain that is removed again later on
          * to not disturb the rest of the s_client operation.
          */
-        if (starttls_proto == PROTO_SMTP || starttls_proto == PROTO_LMTP) {
+        if (s_client_config.starttls_proto == PROTO_SMTP || s_client_config.starttls_proto == PROTO_LMTP) {
                 int foundit = 0;
                 BIO *fbio = BIO_new(BIO_f_buffer());
                 BIO_push(fbio, sbio);
@@ -868,7 +1188,7 @@ re_start:
                 while (mbuf_len > 3 && mbuf[3] == '-');
                 /* STARTTLS command requires EHLO... */
                 BIO_printf(fbio, "%cHLO openssl.client.net\r\n",
-                           starttls_proto == PROTO_SMTP ? 'E' : 'L');
+                           s_client_config.starttls_proto == PROTO_SMTP ? 'E' : 'L');
                 (void) BIO_flush(fbio);
                 /* wait for multi-line response to end EHLO SMTP response */
                 do {
@@ -886,7 +1206,7 @@ re_start:
                             " try anyway...\n");
                 BIO_printf(sbio, "STARTTLS\r\n");
                 BIO_read(sbio, sbuf, BUFSIZZ);
-        } else if (starttls_proto == PROTO_POP3) {
+        } else if (s_client_config.starttls_proto == PROTO_POP3) {
                 mbuf_len = BIO_read(sbio, mbuf, BUFSIZZ);
                 if (mbuf_len == -1) {
                         BIO_printf(bio_err, "BIO_read failed\n");
@@ -894,7 +1214,7 @@ re_start:
                 }
                 BIO_printf(sbio, "STLS\r\n");
                 BIO_read(sbio, sbuf, BUFSIZZ);
-        } else if (starttls_proto == PROTO_IMAP) {
+        } else if (s_client_config.starttls_proto == PROTO_IMAP) {
                 int foundit = 0;
                 BIO *fbio = BIO_new(BIO_f_buffer());
                 BIO_push(fbio, sbio);
@@ -918,7 +1238,7 @@ re_start:
                             " try anyway...\n");
                 BIO_printf(sbio, ". STARTTLS\r\n");
                 BIO_read(sbio, sbuf, BUFSIZZ);
-        } else if (starttls_proto == PROTO_FTP) {
+        } else if (s_client_config.starttls_proto == PROTO_FTP) {
                 BIO *fbio = BIO_new(BIO_f_buffer());
                 BIO_push(fbio, sbio);
                 /* wait for multi-line response to end from FTP */
@@ -931,11 +1251,11 @@ re_start:
                 BIO_free(fbio);
                 BIO_printf(sbio, "AUTH TLS\r\n");
                 BIO_read(sbio, sbuf, BUFSIZZ);
-        } else if (starttls_proto == PROTO_XMPP) {
+        } else if (s_client_config.starttls_proto == PROTO_XMPP) {
                 int seen = 0;
                 BIO_printf(sbio, "<stream:stream "
                     "xmlns:stream='http://etherx.jabber.org/streams' "
-                    "xmlns='jabber:client' to='%s' version='1.0'>", xmpphost ? xmpphost : host);
+                    "xmlns='jabber:client' to='%s' version='1.0'>", s_client_config.xmpphost ? s_client_config.xmpphost : s_client_config.host);
                 seen = BIO_read(sbio, mbuf, BUFSIZZ);
 
                 if (seen <= 0)
@@ -957,8 +1277,8 @@ re_start:
                 if (!strstr(sbuf, "<proceed"))
                         goto shut;
                 mbuf[0] = 0;
-        } else if (proxy != NULL) {
-                BIO_printf(sbio, "CONNECT %s HTTP/1.0\r\n\r\n", connect);
+        } else if (s_client_config.proxy != NULL) {
+                BIO_printf(sbio, "CONNECT %s HTTP/1.0\r\n\r\n", s_client_config.connect);
                 mbuf_len = BIO_read(sbio, mbuf, BUFSIZZ);
                 if (mbuf_len == -1) {
                         BIO_printf(bio_err, "BIO_read failed\n");
@@ -980,25 +1300,25 @@ re_start:
                         tty_on = 1;
                         if (in_init) {
                                 in_init = 0;
-                                if (sess_out) {
-                                        BIO *stmp = BIO_new_file(sess_out, "w");
+                                if (s_client_config.sess_out) {
+                                        BIO *stmp = BIO_new_file(s_client_config.sess_out, "w");
                                         if (stmp) {
                                                 PEM_write_bio_SSL_SESSION(stmp, SSL_get_session(con));
                                                 BIO_free(stmp);
                                         } else
-                                                BIO_printf(bio_err, "Error writing session file %s\n", sess_out);
+                                                BIO_printf(bio_err, "Error writing session file %s\n", s_client_config.sess_out);
                                 }
                                 print_stuff(bio_c_out, con, full_log);
                                 if (full_log > 0)
                                         full_log--;
 
-                                if (starttls_proto) {
+                                if (s_client_config.starttls_proto) {
                                         BIO_write(bio_err, mbuf, mbuf_len);
                                         /* We don't need to know any more */
-                                        starttls_proto = PROTO_OFF;
+                                        s_client_config.starttls_proto = PROTO_OFF;
                                 }
-                                if (reconnect) {
-                                        reconnect--;
+                                if (s_client_config.reconnect) {
+                                        s_client_config.reconnect--;
                                         BIO_printf(bio_c_out, "drop connection and then reconnect\n");
                                         SSL_shutdown(con);
                                         SSL_set_connect_state(con);
@@ -1137,7 +1457,7 @@ re_start:
                                 }
                         }
 #endif
-                        if (peekaboo) {
+                        if (s_client_config.peekaboo) {
                                 k = p = SSL_peek(con, pbuf, 1024 /* BUFSIZZ */ );
                                 pending = SSL_pending(con);
                                 if (SSL_get_error(con, p) == SSL_ERROR_NONE) {
@@ -1158,7 +1478,7 @@ re_start:
                                         goto end;
                                 sbuf_off = 0;
                                 sbuf_len = k;
-                                if (peekaboo) {
+                                if (s_client_config.peekaboo) {
                                         if (p != pending) {
                                                 ret = -1;
                                                 BIO_printf(bio_err,
@@ -1215,7 +1535,7 @@ re_start:
                                 BIO_printf(bio_err, "poll error");
                                 goto shut;
                         }
-                        if (crlf) {
+                        if (s_client_config.crlf) {
                                 int j, lf_num;
 
                                 i = read(fileno(stdin), cbuf, BUFSIZZ / 2);
@@ -1236,12 +1556,12 @@ re_start:
                         } else
                                 i = read(fileno(stdin), cbuf, BUFSIZZ);
 
-                        if ((!c_ign_eof) && ((i <= 0) || (cbuf[0] == 'Q'))) {
+                        if ((!s_client_config.c_ign_eof) && ((i <= 0) || (cbuf[0] == 'Q'))) {
                                 BIO_printf(bio_err, "DONE\n");
                                 ret = 0;
                                 goto shut;
                         }
-                        if ((!c_ign_eof) && (cbuf[0] == 'R')) {
+                        if ((!s_client_config.c_ign_eof) && (cbuf[0] == 'R')) {
                                 BIO_printf(bio_err, "RENEGOTIATING\n");
                                 SSL_renegotiate(con);
                                 cbuf_len = 0;
@@ -1264,7 +1584,7 @@ re_start:
         close(SSL_get_fd(con));
  end:
         if (con != NULL) {
-                if (prexit != 0)
+                if (s_client_config.prexit != 0)
                         print_stuff(bio_c_out, con, 1);
                 SSL_free(con);
         }
@@ -1272,7 +1592,7 @@ re_start:
         X509_free(cert);
         EVP_PKEY_free(key);
         free(pass);
-        X509_VERIFY_PARAM_free(vpm);
+        X509_VERIFY_PARAM_free(s_client_config.vpm);
         freezero(cbuf, BUFSIZZ);
         freezero(sbuf, BUFSIZZ);
         freezero(mbuf, BUFSIZZ);
@@ -1315,7 +1635,7 @@ print_stuff(BIO * bio, SSL * s, int full)
                                 X509_NAME_oneline(X509_get_issuer_name(
                                         sk_X509_value(sk, i)), buf, sizeof buf);
                                 BIO_printf(bio, "   i:%s\n", buf);
-                                if (c_showcerts)
+                                if (s_client_config.c_showcerts)
                                         PEM_write_bio_X509(bio, sk_X509_value(sk, i));
                         }
                 }
@@ -1323,7 +1643,7 @@ print_stuff(BIO * bio, SSL * s, int full)
                 peer = SSL_get_peer_certificate(s);
                 if (peer != NULL) {
                         BIO_printf(bio, "Server certificate\n");
-                        if (!(c_showcerts && got_a_chain))      /* Redundant if we
+                        if (!(s_client_config.c_showcerts && got_a_chain))      /* Redundant if we
                                                                  * showed the whole
                                                                  * chain */
                                 PEM_write_bio_X509(bio, peer);
@@ -1434,21 +1754,21 @@ print_stuff(BIO * bio, SSL * s, int full)
 #endif
 
         SSL_SESSION_print(bio, SSL_get_session(s));
-        if (keymatexportlabel != NULL) {
+        if (s_client_config.keymatexportlabel != NULL) {
                 BIO_printf(bio, "Keying material exporter:\n");
-                BIO_printf(bio, "    Label: '%s'\n", keymatexportlabel);
-                BIO_printf(bio, "    Length: %i bytes\n", keymatexportlen);
-                exportedkeymat = malloc(keymatexportlen);
+                BIO_printf(bio, "    Label: '%s'\n", s_client_config.keymatexportlabel);
+                BIO_printf(bio, "    Length: %i bytes\n", s_client_config.keymatexportlen);
+                exportedkeymat = malloc(s_client_config.keymatexportlen);
                 if (exportedkeymat != NULL) {
                         if (!SSL_export_keying_material(s, exportedkeymat,
-                                keymatexportlen,
-                                keymatexportlabel,
-                                strlen(keymatexportlabel),
+                                s_client_config.keymatexportlen,
+                                s_client_config.keymatexportlabel,
+                                strlen(s_client_config.keymatexportlabel),
                                 NULL, 0, 0)) {
                                 BIO_printf(bio, "    Error\n");
                         } else {
                                 BIO_printf(bio, "    Keying material: ");
-                                for (i = 0; i < keymatexportlen; i++)
+                                for (i = 0; i < s_client_config.keymatexportlen; i++)
                                         BIO_printf(bio, "%02X",
                                             exportedkeymat[i]);
                                 BIO_printf(bio, "\n");