aboutsummaryrefslogtreecommitdiff
path: root/apps
AgeCommit message (Collapse)AuthorFilesLines
2018-02-01Fix of prefix bio filter (bf_prefix.c): rely on the given lengthRichard Levitte1-2/+3
The assumption that the received buffer has to be NUL-terminated was faulty. Fault found in #5224 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5239)
2018-02-01Add TLSv1.3 post-handshake authentication (PHA)Todd Short3-0/+23
Add SSL_verify_client_post_handshake() for servers to initiate PHA Add SSL_force_post_handshake_auth() for clients that don't have certificates initially configured, but use a certificate callback. Update SSL_CTX_set_verify()/SSL_set_verify() mode: * Add SSL_VERIFY_POST_HANDSHAKE to postpone client authentication until after the initial handshake. * Update SSL_VERIFY_CLIENT_ONCE now only sends out one CertRequest regardless of when the certificate authentication takes place; either initial handshake, re-negotiation, or post-handshake authentication. Add 'RequestPostHandshake' and 'RequirePostHandshake' SSL_CONF options that add the SSL_VERIFY_POST_HANDSHAKE to the 'Request' and 'Require' options Add support to s_client: * Enabled automatically when cert is configured * Can be forced enabled via -force_pha Add support to s_server: * Use 'c' to invoke PHA in s_server * Remove some dead code Update documentation Update unit tests: * Illegal use of PHA extension * TLSv1.3 certificate tests DTLS and TLS behave ever-so-slightly differently. So, when DTLS1.3 is implemented, it's PHA support state machine may need to be different. Add a TODO and a #error Update handshake context to deal with PHA. The handshake context for TLSv1.3 post-handshake auth is up through the ClientFinish message, plus the CertificateRequest message. Subsequent Certificate, CertificateVerify, and Finish messages are based on this handshake context (not the Certificate message per se, but it's included after the hash). KeyUpdate, NewSessionTicket, and prior Certificate Request messages are not included in post-handshake authentication. After the ClientFinished message is processed, save off the digest state for future post-handshake authentication. When post-handshake auth occurs, copy over the saved handshake context into the "main" handshake digest. This effectively discards the any KeyUpdate or NewSessionTicket messages and any prior post-handshake authentication. This, of course, assumes that the ID-22 did not mean to include any previous post-handshake authentication into the new handshake transcript. This is implied by section 4.4.1 that lists messages only up to the first ClientFinished. Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4964)
2018-02-01Remove bad commentsTodd Short1-11/+0
Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4964)
2018-02-01ocsp.c doesn't free the whole output chain, maybe causing a memory leakRichard Levitte1-1/+1
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5224)
2018-02-01Make sure that apps/openssl prefixes its output with '# ' during testsRichard Levitte3-1/+26
The reason to do this is that some output might start with an 'ok', which TAP catches and takes for TAP output. The TAP compatible way is to make all output it shouldn't catch look like comments. We do this by setting the environment variable HARNESS_OSSL_PREFIX during tests. When that is set, apps/openssl uses BIO_f_linebuffer and sets its prefix to the content of that environment variable. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5224)
2018-02-01Add an apps internal BIO filter for prefixing output linesRichard Levitte3-2/+186
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5224)
2018-01-31Apps: divide the modules in direct command modules, support library and initRichard Levitte1-11/+17
Most modules are direct implementations of openssl application sub-commands, but some constitute a support library, which can be used by more than one program (and is, incidently, by test/uitest). For practical purposes, we place the support library modules in a private, static library. Finally, there are some modules that don't have direct references in the rest of the apps code, but are still crucial. See them as some kind of extra crt0 or similar for your platform. Inspiration from David von Oheimb Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5222)
2018-01-31apps: Don't include progs.h in apps.hRichard Levitte48-3/+48
Everything in apps includes apps.h, because that one declares apps internal library routines. However, progs.h doesn't declare library routines, but rather the main commands and their options, and there's no reason why the library modules should include it. So, remove the inclusion of progs.h from apps.h and add that inclusion in all command source files. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5222)
2018-01-26Fix some style nits in commit eee8a40Bernd Edlinger1-6/+8
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5173)
2018-01-25Make the s_server command listen on IPv6 only when requestedBernd Edlinger1-3/+24
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5152)
2018-01-24Make editorial changes suggested by Matt Caswell and fixed Travis failures.David Cooper1-3/+3
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4190)
2018-01-24Make editorial changes suggested by Rich Salz and add the -rsigopt option to ↵David Cooper1-4/+3
the man page for the ocsp command. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4190)
2018-01-24Add -rsigopt option to ocsp commandDavid Cooper1-6/+37
Add a -rsigopt option to the ocsp command that allows signature parameters to be provided for the signing of OCSP responses. The parameters that may be provided to -rsigopt are the same as may be provided to -sigopt in the ca, req, and x509 commands. This PR also defines a OCSP_basic_sign_ctx() function, which functions in the same way as OCSP_basic_sign(), except that it accepts a EVP_MD_CTX rather than a key and digest. The OCSP_basic_sign_ctx() function is used to implement the -rsigopt option in the ocsp command. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4190)
2018-01-24Add the ability for s_server to operate statelesslyMatt Caswell1-52/+68
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4435)
2018-01-24Enable the cookie callbacks to work even in TLS in the appsMatt Caswell3-12/+33
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4435)
2018-01-23Fix no-ec --strict-warnings buildsBenjamin Kaduk1-0/+2
The 'loop' variable is only used if EC is available. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5149)
2018-01-22Don't attempt to use X25519 for ECDSA in speedMatt Caswell1-8/+9
Fixes #5090 Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/5097)
2018-01-22Don't crash on a missing Subject in index.txtMatt Caswell1-0/+4
An index.txt entry which has an empty Subject name field will cause ca to crash. Therefore check it when we load it to make sure its not empty. Fixes #5109 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5114)
2018-01-22Don't allow an empty Subject when creating a CertificateMatt Caswell1-0/+10
Misconfiguration (e.g. an empty policy section in the config file) can lead to an empty Subject. Since certificates should have unique Subjects this should not be allowed. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5114)
2018-01-19Copyright update of more files that have changed this yearRichard Levitte5-6/+6
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/5110)
2018-01-15Fix intermittent Windows and Cygwin failures in s_serverRichard Levitte1-0/+14
The same kind of failure that has already been observed on the s_client can sometimes also be observed on s_server, so we need to add the same kind of 50ms delay as was previously added on s_client. Ref: git commit cb2e10f257a464c6b475b321dd9e4769df84dbf6: Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/5079)
2018-01-14Fix intermittent Cygwin failures in s_clientRichard Levitte1-1/+5
This was identified for Windows almost two years ago for VC and msys/mingw. It seems that Cygwin suffers from the same issue, and since Cygwin doesn't define OPENSSL_SYS_WINDOWS, we need to make a special case to have a 50ms pause before closing the TLS connection. Ref: git commit cb2e10f257a464c6b475b321dd9e4769df84dbf6 Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/5074)
2018-01-14Use constant value 1 instead of SHUT_WR in do_serverBernd Edlinger1-7/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5072)
2018-01-14Explicitly shut the socket down in s_clientBernd Edlinger1-0/+11
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5072)
2018-01-12Change the name of the SEC typedef to openssl_speed_sec_t.Pauli1-6/+7
This to avoid a clash with a #defined symbol on Solaris from time.h. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5064)
2018-01-09Update copyright years on all files merged since Jan 1st 2018Richard Levitte3-3/+3
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5038)
2018-01-09Various small build improvements on mkdef.pl, progs.pl, crypto/init.c, ↵David von Oheimb1-1/+1
crypto/mem.c Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4994)
2018-01-08Clarify error for unrecognized arguments.Jacob Hoffman-Andrews1-2/+2
Many of the sub-commands under apps/ accept cipher or digest arguments like "-sha256". These are implemented using a catchall flag that runs the result through opt_md() or opt_cipher(). That means any unrecognized flag, including typos, gets sent to those two functions, producing confusing error messages like below: $ ./apps/openssl req -x590 req: Unrecognized digest x590 req: Use -help for summary. This change switches these two functions to say "Unrecognized flag X" instead. The new message deliberately leaves off the "-" from the flag name, because there are some cases where opt_md() and opt_cipher() are passed a flag value instead (for instance, openssl ca -md). I think the new message is generic enough that it can serve both cases with improved clarity. CLA: trivial Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4972)
2018-01-07Remove remaining NETWARE ifdef'sRich Salz1-15/+0
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5028)
2018-01-06Add the possibility to do 'openssl help [command]'Richard Levitte1-0/+10
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5002)
2018-01-06apps: make sure prog_init only calculates onceRichard Levitte1-2/+9
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5002)
2018-01-06Corrected 'cms' exit status when key or certificate cannot be openedKonstantin Shemyak1-2/+6
Fixes #4996. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4997)
2017-12-28Add 'openssl req' option to specify extension values on command lineRichard Levitte3-10/+58
The idea is to be able to add extension value lines directly on the command line instead of through the config file, for example: openssl req -new -extension 'subjectAltName = DNS:dom.ain, DNS:oth.er' \ -extension 'certificatePolicies = 1.2.3.4' Fixes #3311 Thank you Jacob Hoffman-Andrews for the inspiration Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4986)
2017-12-14Merge HRR into ServerHelloMatt Caswell1-1/+0
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4701)
2017-12-14Implement session id TLSv1.3 middlebox compatibility modeMatt Caswell1-3/+5
Clients will send a "fake" session id and servers must echo it back. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4701)
2017-12-11Fix typo in commentBenjamin Kaduk1-1/+1
The one in rsa.c was overlooked when fixing the same comment in pkey.c as part of eff1752b66cb7bf6ca8af816eb10ead26910d025. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4902)
2017-12-09Useless conf != NULL testFdaSilvaYY1-21/+14
check is already made 10 line above. clean commented code Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4885)
2017-12-09apps/speed.c: initialize buffersPatrick Steuer1-6/+7
Stop valgrind's complaints about uninitialized values. Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4842)
2017-12-09apps/speed.c: generate evp_cipher keys implicitlyPatrick Steuer1-9/+22
Generate keys using EVP_CIPHER's key generation routine to support keys of a specific form. Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4842)
2017-12-08In apps_startup(), call OPENSSL_init_ssl() rather than OPENSSL_init_crypto()Richard Levitte1-2/+2
Otherwise, any command that relies on ssl modules may fail, because SSL_add_ssl_module() will be called after the config file has already been loaded. Fixes #4788 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4792)
2017-12-08Fix some issues in apps/reqPaul Yang1-2/+6
1. the 'ignore -days' warning should not be printed without '-x509' 2. the 'ignore -days' warning should terminate with new-line Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4767)
2017-12-07Consistent formatting for sizeof(foo)Rich Salz18-101/+101
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4872)
2017-12-05apps/speed.c: detect evp cipher 32-bit ctr overflow and reset ivPatrick Steuer1-7/+14
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4846)
2017-12-04key_A and key_B had 3 references, only 2 were freed.Patrick Steuer1-0/+2
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4837)
2017-12-04apps/speed.c: use 32 byte key material as defaultPatrick Steuer1-2/+2
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4834)
2017-12-04apps/speed.c: add -seconds and -bytes optionsPatrick Steuer1-99/+146
Add speed tool options to run cipher, digest and rand benchmarks for a single buffer size specified by -bytes over a time interval specified by -seconds. Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4834)
2017-12-03Adjusted Argument IndicesMarkus Sauermann1-3/+3
CLA: trivial Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4835)
2017-11-30Use ChaCha only if prioritized by clntTodd Short1-0/+4
IFF the client has ChaCha first, and server cipher priority is used, and the new SSL_OP_PRIORITIZE_CHACHA_FOR_MOBILE option is used, then reprioritize ChaCha above everything else. This way, A matching ChaCha cipher will be selected if there is a match. If no ChaCha ciphers match, then the other ciphers are used. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4436)
2017-11-22Add SM3/SM4 to openssl command-line toolRonald Tse1-7/+9
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4773)
2017-11-21Provide a more information early_data message in s_serverMatt Caswell1-3/+7
s_server reported early_data not being sent and early_data being rejected in the same way, i.e. "No early data received". This is slightly misleading so this commit provides a different error message if the early data is rejected. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4738)
generated by cgit v1.1 at 2024-07-13 13:05:19 +0000