aboutsummaryrefslogtreecommitdiff
path: root/apps
AgeCommit message (Collapse)AuthorFilesLines
2016-11-02Add the SSL_METHOD for TLSv1.3 and all other base changes requiredMatt Caswell5-6/+32
Includes addition of the various options to s_server/s_client. Also adds one of the new TLS1.3 ciphersuites. This isn't "real" TLS1.3!! It's identical to TLS1.2 apart from the protocol and the ciphersuite...and the ciphersuite is just a renamed TLS1.2 one (not a "real" TLS1.3 ciphersuite). Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-10-28Fix a double free in ca command lineMatt Caswell1-1/+0
Providing a spkac file with no default section causes a double free. Thanks to Brian Carpenter for reporting this issue. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-10-19apps: remove some #ifndef clutterRichard Levitte1-4/+0
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1643)
2016-10-19apps: instead of varying implementation, make setup_engine a function alwaysRichard Levitte2-5/+4
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1643)
2016-10-19If an engine comes up explicitely, it must also come down explicitelyRichard Levitte32-16/+63
In apps/apps.c, one can set up an engine with setup_engine(). However, we freed the structural reference immediately, which means that for engines that don't already have a structural reference somewhere else (because it's a built in engine), we end up returning an invalid reference. Instead, the function release_engine() is added, and called at the end of the routines that call setup_engine(). Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1643)
2016-10-19Fix not-c codeFdaSilvaYY1-1/+1
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1742)
2016-10-17Add Postgres support to -starttlsValentin Vidic1-1/+22
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-10-14Fix style issueFdaSilvaYY2-130/+130
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1694)
2016-10-14Constify command optionsFdaSilvaYY48-112/+112
Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1694)
2016-10-10Remove trailing whitespace from some files.David Benjamin3-4/+4
The prevailing style seems to not have trailing whitespace, but a few lines do. This is mostly in the perlasm files, but a few C files got them after the reformat. This is the result of: find . -name '*.pl' | xargs sed -E -i '' -e 's/( |'$'\t'')*$//' find . -name '*.c' | xargs sed -E -i '' -e 's/( |'$'\t'')*$//' find . -name '*.h' | xargs sed -E -i '' -e 's/( |'$'\t'')*$//' Then bn_prime.h was excluded since this is a generated file. Note mkerr.pl has some changes in a heredoc for some help output, but other lines there lack trailing whitespace too. Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-10-01fix memory leakDr. Stephen Henson1-0/+1
Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-09-29Add -item option to asn1parseDr. Stephen Henson1-6/+39
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-28apps/apps.c: initialize and de-initialize engine around key loadingRichard Levitte1-1/+4
Before loading a key from an engine, it may need to be initialized. When done loading the key, we must de-initialize the engine. (if the engine is already initialized somehow, only the reference counter will be incremented then decremented) Reviewed-by: Stephen Henson <steve@openssl.org>
2016-09-28Revert "Call ENGINE_init() before trying to use keys from engine"Rich Salz1-1/+1
This reverts commit 0a72002993b8619fd0642d19af3364bafbd9a06c. This fails to call ENGINE_finish; an alternate fix is forthcoming. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-09-28Call ENGINE_init() before trying to use keys from engineDavid Woodhouse1-1/+1
When I said before that s_client "used to work in 1.0.2" that was only partly true. It worked for engines which provided a default generic method for some key type, because it called ENGINE_set_default() and that ended up being an implicit initialisation and functional refcount. But an engine which doesn't provide generic methods doesn't get initialised, and then when you try to use it you get an error: cannot load client certificate private key file from engine 140688147056384:error:26096075:engine routines:ENGINE_load_private_key:not initialised:crypto/engine/eng_pkey.c:66: unable to load client certificate private key file cf. https://github.com/OpenSC/libp11/issues/107 (in which we discover that engine_pkcs11 *used* to provide generic methods that OpenSSL would try to use for ephemeral DH keys when negotiating ECDHE cipher suites in TLS, and that didn't work out very well.) Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1639)
2016-09-28Restore '-keyform engine' support for s_clientDavid Woodhouse1-3/+3
This used to work in 1.0.2 but disappeared when the argument parsing was revamped. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1639)
2016-09-22Add -Wswitch-enumRich Salz3-16/+27
Change code so when switching on an enumeration, have case's for all enumeration values. Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-09-20RT3669: dgst can only sign/verify one file.Rich Salz1-0/+4
Check arg count and print an error message. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-09-20apps/apps.c: include sys/socket.h to declare recv()Richard Levitte1-0/+2
Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-09-19Remove an option related to a deprecated flagFdaSilvaYY2-10/+2
CMS_NOOLDMIMETYPE and PKCS7_NOOLDMIMETYPE are unused in pkcs7/cms code. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1585)
2016-09-19Fix various missing option help messages ...FdaSilvaYY10-33/+38
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1585)
2016-09-19Fix no-ocspRichard Levitte2-2/+16
Some compilers complain about unused variables, and some tests do not run well without OCSP. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-15Refactor to avoid unnecessary preprocessor logicRichard Levitte4-78/+54
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-15Reformat to fit OpenSSL source code standardsRichard Levitte4-514/+493
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-15Add copyright and license on apps/vms_term_sock.[ch]Richard Levitte2-0/+18
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-15VSI submission: redirect terminal input through socketRichard Levitte4-12/+704
This is needed, because on VMS, select() can only be used on sockets. being able to use select() on all kinds of file descriptors is unique to Unix. So, the solution for VMS is to create a layer that translates input from standard input to socket communication. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-14GH1536: Install empty CT log listRich Salz1-34/+9
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-09-14Rather than one variable for each passwd type, use one enum variableRichard Levitte1-38/+49
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-14Add SHA256 and SHA512 based output for 'openssl passwd'Richard Levitte1-9/+311
RT#4674 issue 2 Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-14Add -h and -help for c_rehash script and appRich Salz1-0/+1
Resolves GH1515 and GH1509. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-09-14Fix 'openssl passwd' with arguments -1 or -apr1Richard Levitte1-0/+1
RT#4674 Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-09-13Fix some magic values about revocation info type...FdaSilvaYY2-55/+51
Add comments, document -valid option. Add some const qualifiers. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1560)
2016-09-13Add --missing-help to list commandRich Salz1-1/+24
Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-09-13s_client: avoid warning on Windows/MS-DOS systemsViktor Szakats1-0/+4
it appears when using gcc/mingw: ``` apps/s_client.c:815:9: warning: variable 'at_eof' set but not used [-Wunused-but-set-variable] int at_eof = 0; ^~~~~~ ``` Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1512)
2016-08-25Windows: UTF-8 opt-in for command-line arguments and console input.Andy Polyakov1-0/+3
User can make Windows openssl.exe to treat command-line arguments and console input as UTF-8 By setting OPENSSL_WIN32_UTF8 environment variable (to any value). This is likely to be required for data interchangeability with other OSes and PKCS#12 containers generated with Windows CryptoAPI. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-25Support broken PKCS#12 key generation.Dr. Stephen Henson1-4/+23
OpenSSL versions before 1.1.0 didn't convert non-ASCII UTF8 PKCS#12 passwords to Unicode correctly. To correctly decrypt older files, if MAC verification fails with the supplied password attempt to use the broken format which is compatible with earlier versions of OpenSSL. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-08-24Clarify the error messages in 08f6ae5b28Matt Caswell3-8/+8
Ensure it is clear to the user why there has been an error. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-24Trust RSA_check_key() to return correct valuesRichard Levitte1-4/+1
In apps/rsa.c, we were second guessing RSA_check_key() to leave error codes lying around without returning -1 properly. However, this also catches other errors that are lying around and that we should not care about. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-24Fix some resource leaks in the appsMatt Caswell4-1/+26
Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-08-22Closing output file from inside the loop who open itFdaSilvaYY1-2/+3
Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #1471
2016-08-22Fix loopargs_t object duplication into ASYNC contextFdaSilvaYY1-31/+34
Code was relying on an implicit data-sharing through duplication of loopargs_t pointer-members made by ASYNC_start_job(). Now share structure address instead of structure content. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-08-22Avoid more compiler warnings for use of uninitialised variablesRichard Levitte1-1/+1
Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-08-22Make 'openssl req -x509' more equivalent to 'openssl req -new'Richard Levitte1-1/+2
The following would fail, or rather, freeze: openssl genrsa -out rsa2048.pem 2048 openssl req -x509 -key rsa2048.pem -keyform PEM -out cert.pem In that case, the second command wants to read a certificate request from stdin, because -x509 wasn't fully flagged as being for creating something new. This changes makes it fully flagged. RT#4655 Reviewed-by: Andy Polyakov <appro@openssl.org>
2016-08-21Add X509_getm_notBefore, X509_getm_notAfterDr. Stephen Henson1-25/+11
Add mutable versions of X509_get0_notBefore and X509_get0_notAfter. Rename X509_SIG_get0_mutable to X509_SIG_getm. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-08-20Duplicate includesFdaSilvaYY1-1/+0
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1475)
2016-08-19fix warning about trailing commaDr. Stephen Henson1-1/+1
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-19Constify certificate and CRL time routines.Dr. Stephen Henson5-18/+18
Update certificate and CRL time routines to match new standard. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-19Add -dane_ee_no_namechecks s_client(1) optionViktor Dukhovni1-1/+9
The DANE API supports a DANE_FLAG_NO_DANE_EE_NAMECHECKS option, but there was no way to exercise/enable it via s_client. This commit addresses that gap. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-19Set certificate times in one function.Dr. Stephen Henson5-23/+44
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-19Allow to run all speed test when async_jobs activeFdaSilvaYY1-33/+54
... without any interruption. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1468)
generated by cgit v1.1 at 2024-07-14 05:27:19 +0000