diff options
| author | Matt Caswell <matt@openssl.org> | 2016-07-07 11:05:31 +0100 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2016-07-08 16:20:59 +0100 |
| commit | 4bbd4ba66dec4ca35502b8fac0315b447fde4d7a (patch) | |
| tree | a691cad44820d09910e0d93cb1ed78966189c16b /apps/s_client.c | |
| parent | 3503549ee8bd59d23d00b9dbbc2444e91fc44746 (diff) | |
Disallow multiple protocol flags to s_server and s_client
We shouldn't allow both "-tls1" and "-tls1_2", or "-tls1" and "-no_tls1_2".
The only time multiple flags are allowed is where they are all "-no_<prot>".
This fixes Github Issue #1268
Reviewed-by: Rich Salz <rsalz@openssl.org>
Diffstat (limited to 'apps/s_client.c')
| -rw-r--r-- | apps/s_client.c | 19 |
1 files changed, 18 insertions, 1 deletions
diff --git a/apps/s_client.c b/apps/s_client.c index e79cf7e496..69e225cef6 100644 --- a/apps/s_client.c +++ b/apps/s_client.c @@ -768,6 +768,10 @@ static const OPT_PAIR services[] = { (o == OPT_4 || o == OPT_6 || o == OPT_HOST || o == OPT_PORT || o == OPT_CONNECT) #define IS_UNIX_FLAG(o) (o == OPT_UNIX) +#define IS_PROT_FLAG(o) \ + (o == OPT_SSL3 || o == OPT_TLS1 || o == OPT_TLS1_1 || o == OPT_TLS1_2 \ + || o == OPT_DTLS || o == OPT_DTLS1 || o == OPT_DTLS1_2) + /* Free |*dest| and optionally set it to a copy of |source|. */ static void freeandcopy(char **dest, const char *source) { @@ -851,7 +855,7 @@ int s_client_main(int argc, char **argv) char *ctlog_file = NULL; int ct_validation = 0; #endif - int min_version = 0, max_version = 0; + int min_version = 0, max_version = 0, prot_opt = 0, no_prot_opt = 0; int async = 0; unsigned int split_send_fragment = 0; unsigned int max_pipelines = 0; @@ -905,6 +909,19 @@ int s_client_main(int argc, char **argv) prog); goto end; } + + if (IS_PROT_FLAG(o) && ++prot_opt > 1) { + BIO_printf(bio_err, "Cannot supply multiple protocol flags\n"); + goto end; + } + if (IS_NO_PROT_FLAG(o)) + no_prot_opt++; + if (prot_opt == 1 && no_prot_opt) { + BIO_printf(bio_err, "Cannot supply both a protocol flag and " + "\"-no_<prot>\"\n"); + goto end; + } + switch (o) { case OPT_EOF: case OPT_ERR: |