aboutsummaryrefslogtreecommitdiff
path: root/apps
AgeCommit message (Collapse)AuthorFilesLines
2018-10-13Fix copy&paste error found in Coverity scanTomas Mraz1-1/+1
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7377)
2018-10-08apps: allow empty attribute values with -subjBenjamin Kaduk1-0/+6
Historically (i.e., OpenSSL 1.0.x), the openssl applications would allow for empty subject attributes to be passed via the -subj argument, e.g., `opensl req -subj '/CN=joe/O=/OU=local' ...`. Commit db4c08f0194d58c6192f0d8311bf3f20e251cf4f applied a badly needed rewrite to the parse_name() helper function that parses these strings, but in the process dropped a check that would skip attributes with no associated value. As a result, such strings are now treated as hard errors and the operation fails. Restore the check to skip empty attribute values and restore the historical behavior. Document the behavior for empty subject attribute values in the corresponding applications' manual pages. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7349)
2018-10-02Fix a mem leak in the ocsp appMatt Caswell1-0/+2
Free memory allocated in the parent process that is not needed in the child. We also free it in the parent. Technically this isn't really required since we end up calling exit() soon afterwards - but to prevent false positives we free it anyway. Fixes a Coverity issue. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7335)
2018-10-01'openssl list': add option -objects to list built in objectsRichard Levitte1-1/+57
Related to #6696 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6702)
2018-09-23Create the .rnd file it it does not existBernd Edlinger3-5/+0
It's a bit annoying, since some commands try to read a .rnd file, and print an error message if the file does not exist. But previously a .rnd file was created on exit, and that does no longer happen. Fixed by continuing in app_RAND_load_conf regardless of the error in RAND_load_file. If the random number generator is still not initalized on exit, the function RAND_write_file will fail and no .rnd file would be created. Remove RANDFILE from openssl.cnf Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/7217)
2018-09-21typo-fixes: miscellaneous typo fixesagnosticdev1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7277)
2018-09-13Don't allow -early_data with other options where it doesn't workMatt Caswell1-0/+5
-early_data is not compatible with -www, -WWW, -HTTP or -rev. Fixes #7200 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7206)
2018-09-12Speed for HMACs.Pauli1-4/+56
Add support for HMAC over any evp supported digest. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6945)
2018-09-10Don't cast an int * to a size_t *Matt Caswell1-8/+9
If sizeof(int) != sizeof(size_t) this may not work correctly. Fixes a Coverity issue. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7168)
2018-09-07Support EdDSA in apps/speedPaul Yang1-2/+226
This addresses issue #6922. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7073)
2018-09-05New openssl subject parser hard to debugEric Curtin1-1/+7
-subj 'subject=C = US, ST = A, L = root, O = Hewlett Packard Enterprise Company, OU = Remote Device Access, CN = Hewlett Packard Enterprise Remote Device Access Test Local CA, emailAddress = rda@hpe.com' was a valid subject in openssl 1.0. Error received in 1.1 is: problems making Certificate Request Not very informative, I only figured this out because I compiled the code and added logging. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7098)
2018-09-04openssl req: don't try to report bitsRichard Levitte1-2/+1
With the introduction of -pkeyopt, the number of bits may change without |newkey| being updated. Unfortunately, there is no API to retrieve the information from a EVP_PKEY_CTX either, so chances are that we report incorrect information. For the moment, it's better not to try to report the number of bits at all. Fixes #7086 Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7096)
2018-08-30Free SSL object on an error pathMatt Caswell1-2/+6
Thanks to @fangang190 for reporting this Fixes #7061 Reviewed-by: Paul Yang <yang.yang@baishancloud.com> (Merged from https://github.com/openssl/openssl/pull/7065)
2018-08-24Do not ignore EVP_PKEY_print_public/EVP_PKEY_print_private return valuesDmitry Belyavskiy1-12/+20
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/7007)
2018-08-22Ignore the digest in req app if using EdDSAMatt Caswell1-1/+10
This follows on from the previous commit, and makes the same change to ignore the digest if we are using EdDSA. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6901)
2018-08-22Improve the usability of the ca app using EdDSAMatt Caswell1-9/+13
Previously you had to supply "null" as the digest to use EdDSA. This changes things so that any digest is ignored. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6901)
2018-08-20Change Post Handshake auth so that it is opt-inMatt Caswell1-7/+7
Having post handshake auth automatically switched on breaks some applications written for TLSv1.2. This changes things so that an explicit function call is required for a client to indicate support for post-handshake auth. Fixes #6933. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6938)
2018-07-31Use the new non-curve type specific EC functions internallyMatt Caswell1-1/+1
Fixes #6646 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6815)
2018-07-30apps/dsaparam.c generates code that is intended to be pasted or includedBeat Bolli2-31/+15
into an existing source file: the function is static, and the code doesn't include dsa.h. Match the generated C source style of dsaparam. Adjust apps/dhparam.c to match, and rename the BIGNUMs to their more usual single-letter names. Add an error return in the generated C source. both: simplify the callback function Signed-off-by: Beat Bolli <dev@drbeat.li> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6797)
2018-07-26apps/apps.c: harmonize print_bignum_var output with coding style.Andy Polyakov1-4/+3
Reviewed-by: Rich Salz <rsalz@openssl.org>
2018-07-25apps/dsaparam.c: make dsaparam -C output strict-warnings-friendly.Andy Polyakov1-1/+1
Reviewed-by: Rich Salz <rsalz@openssl.org>
2018-07-23Make sure the 'tsget' script is called 'tsget.pl' everywhereRichard Levitte1-4/+3
The result is that we don't have to produce different names on different platforms, and we won't have confusion on Windows depending on if the script was built with mingw or with MSVC. Partial fix for #3254 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6764)
2018-07-22apps/dsaparam.c: fix -C output.Andy Polyakov1-12/+15
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6758)
2018-07-12apps/speed.c: let EVP_Update_loop_ccm behave more like EVP_Update_loopPatrick Steuer1-7/+15
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5246)
2018-07-09Add tests for the "req" command, -addext flagRich Salz1-0/+1
Also fixed a memory leak found by the test. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6681)
2018-07-09apps/req.c: fix -addext option.Andy Polyakov1-14/+11
Address even Coverity nit. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6671)
2018-07-06Don't fail if the PSK identity doesn't matchMatt Caswell1-2/+5
In 1.1.0 s_server if the PSK identity doesn't match what we have then a warning is printed and we continue the connection anyway. In 1.1.1, if TLSv1.3 is used and the identity doesn't match then we abort the connection. We should really be consistent with the old behaviour. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6659)
2018-07-06Add the ability to configure recv_max_early_data via s_serverMatt Caswell1-4/+15
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6655)
2018-07-05Reject duplicate -addext parametersRich Salz1-3/+77
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6636)
2018-07-02Add the ability to configure anti-replay via SSL_CONFMatt Caswell1-0/+5
This also adds the ability to control this through s_server Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6469)
2018-06-26Only dump session data after we have received itMatt Caswell1-15/+39
s_client was dumping session data at the end of the handshake. In TLSv1.3 we don't have session data until receipt of a NewSessionTicket message which happens post-handshake. Therefore we delay dumping the session data until that message has arrived if TLSv1.3 has been negotiated. Fixes #6482 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6590)
2018-06-24apps/speed.c: add missing checks for RAND_bytes()捷成吴1-2/+4
Function RAND_bytes() may return 0 or -1 on error, simply goto end label when it fails. Fixes #6567 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6582)
2018-06-24Support directories with "." in x509_load_serial()Ana María Martínez Gómez1-1/+1
Use `strrchr` to get a pointer to the last occurrence of `.` in the path string, instead of the first one with `strchr`. This prevent the path to be wrongly split if it contains several `.`, and not only the one for the extension. Fixes https://github.com/openssl/openssl/issues/6489. CLA: trivial Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6566)
2018-06-21apps/ca: fix useless get before delete.FdaSilvaYY1-3/+3
Small simplification by skipping effectively redundant step and not resuming search from point past deletion. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6195)
2018-06-21openssl ca: open the output file as late as possibleRichard Levitte1-4/+12
Fixes #6544 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6546)
2018-06-18add 'unsupported cipher mode' diagnostics to evp_lib.c and genpkey.cDavid von Oheimb1-0/+7
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6217)
2018-06-07Fix no-dsaMatt Caswell1-0/+2
Broken by 0336df2fa. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6427)
2018-06-05Issue warnings for large DSA and RSA keysGeorg Schmidt4-0/+30
Issue a warning when generating DSA or RSA keys of size greater than OPENSSL_DSA_MAX_MODULUS_BITS resp. OPENSSL_RSA_MAX_MODULUS_BITS. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6380)
2018-05-31Don't call setsockopt with an invalid fdMatt Caswell1-2/+5
This is probably a "should not happen" scenario, but better check anyway. Found by Coverity. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6373)
2018-05-31Fix a memory leak in an error pathMatt Caswell1-0/+1
Found by Coverity Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6373)
2018-05-31Free a variableMatt Caswell1-0/+1
Fix a memory leak in storeutl. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6373)
2018-05-31Free a variable on an error pathMatt Caswell1-0/+1
Issue found by Coverity. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6373)
2018-05-31Only set TCP_NODELAY if the protocol is TCPMatt Caswell1-1/+1
This doesn't apply if we're doing DTLS, or using UNIX domain sockets. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6373)
2018-05-31apps: when the 'compat' nameopt has been set, leave it beRichard Levitte1-1/+2
XN_FLAG_COMPAT has a unique property, its zero for value. This means it needs special treatment; if it has been set (which can only be determined indirectly) and set alone (*), no other flags should be set. (*) if any other nameopt flag has been set by the user, compatibility mode is blown away. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6382)
2018-05-30apps/speed.c: address asan failure with small -bytes and large -misalign.Andy Polyakov1-1/+4
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6311)
2018-05-30apps/speed.c: add -aead flag.Andy Polyakov1-42/+113
Goal is to exercise AEAD ciphers in TLS-like sequence, i.e. 13-byte AAD followed by payload. Update doc/man1/speed.pod accordingly. [While we are at it, address even some styling and readability issues.] Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6311)
2018-05-30apps/speed.c: clean up SIGARM handling.Andy Polyakov1-24/+18
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6311)
2018-05-30Text description of GOST signature algorithmsDmitry Belyavskiy1-0/+9
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6168)
2018-05-29Replace strdup() with OPENSSL_strdup()Todd Short1-5/+9
It's freed with OPENSSL_free() Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6331)
2018-05-24Add a sanity check on the length of pkeyutl inputsMatt Caswell1-1/+11
When signing or verifying a file using pkeyutl the input is supposed to be a hash. Some algorithms sanity check the length of the input, while others don't and silently truncate. To avoid accidents we check that the length of the input looks sane. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6284)
generated by cgit v1.1 at 2024-07-13 06:57:17 +0000