aboutsummaryrefslogtreecommitdiff
path: root/apps
AgeCommit message (Collapse)AuthorFilesLines
2018-12-06Following the license change, modify the boilerplates in apps/Richard Levitte65-66/+66
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7765)
2018-12-06Switch to MAJOR.MINOR.PATCH versioning and version 3.0.0-devRichard Levitte2-3/+4
We're strictly use version numbers of the form MAJOR.MINOR.PATCH. Letter releases are things of days past. The most central change is that we now express the version number with three macros, one for each part of the version number: OPENSSL_VERSION_MAJOR OPENSSL_VERSION_MINOR OPENSSL_VERSION_PATCH We also provide two additional macros to express pre-release and build metadata information (also specified in semantic versioning): OPENSSL_VERSION_PRE_RELEASE OPENSSL_VERSION_BUILD_METADATA To get the library's idea of all those values, we introduce the following functions: unsigned int OPENSSL_version_major(void); unsigned int OPENSSL_version_minor(void); unsigned int OPENSSL_version_patch(void); const char *OPENSSL_version_pre_release(void); const char *OPENSSL_version_build_metadata(void); Additionally, for shared library versioning (which is out of scope in semantic versioning, but that we still need): OPENSSL_SHLIB_VERSION We also provide a macro that contains the release date. This is not part of the version number, but is extra information that we want to be able to display: OPENSSL_RELEASE_DATE Finally, also provide the following convenience functions: const char *OPENSSL_version_text(void); const char *OPENSSL_version_text_full(void); The following macros and functions are deprecated, and while currently existing for backward compatibility, they are expected to disappear: OPENSSL_VERSION_NUMBER OPENSSL_VERSION_TEXT OPENSSL_VERSION OpenSSL_version_num() OpenSSL_version() Also, this function is introduced to replace OpenSSL_version() for all indexes except for OPENSSL_VERSION: OPENSSL_info() For configuration, the option 'newversion-only' is added to disable all the macros and functions that are mentioned as deprecated above. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7724)
2018-11-21openssl s_server: don't use sendto() with connected UDP socketMatthew Hodgson1-0/+2
Fixes #7675 On macOS, if you call `connect()` on a UDP socket you cannot then call `sendto()` with a destination, otherwise it fails with Err#56 ('socket is already connected'). By calling `BIO_ctrl_set_connected()` on the wbio we can tell it that the socket has been connected and make it call `send()` rather than `sendto()`. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7676)
2018-11-20Update copyright yearMatt Caswell1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7668)
2018-11-18Add option to read pkeyopts interactivelyJohannes Bauer1-2/+53
This patch adds the ability to interactively enter passphrases for the pkeyutl application. For example, you could use $ openssl pkeyutl -kdf TLS1-PRF -kdflen 8 -pkeyopt md:md5 -pkeyopt_passin secret -pkeyopt_passin seed To have the "secret" and "seed" values read interactively from keyboard (with hidden input). Alternatively, the pass phrase argument syntax is also supported, e.g.: $ openssl pkeyutl -kdf TLS1-PRF -kdflen 8 -pkeyopt md:md5 -pkeyopt_passin secret:stdin -pkeyopt_passin seed:env:SEEDVAR To have "secret" read from stdin and "seed" from the environment variable SEEDVAR. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5697)
2018-11-12Added missing signature algorithm reflection functionsViktor Dukhovni1-1/+2
SSL_get_signature_nid() -- local signature algorithm SSL_get_signature_type_nid() -- local signature algorithm key type SSL_get_peer_tmp_key() -- Peer key-exchange public key SSL_get_tmp_key -- local key exchange public key Aliased pre-existing SSL_get_server_tmp_key(), which was formerly just for clients, to SSL_get_peer_tmp_key(). Changed internal calls to use the new name. Reviewed-by: Matt Caswell <matt@openssl.org>
2018-11-10Check return value of EVP_PKEY_newMansour Ahmadi1-0/+3
Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7427)
2018-11-02apps: Stop pretending to care about Netscape keysRichard Levitte4-8/+7
The documentation says some commands care, but the code says differently. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7440)
2018-11-02openssl list -mac-algorithms support.Pauli1-1/+20
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7541)
2018-10-29apps/rehash.c: Convert ISO-8859-1 to UTF-8Richard Levitte1-1/+1
Believe it or not, the VMS C compiler is remarking on this Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7194)
2018-10-19Don't complain and fail about unknown TLSv1.3 PSK identities in s_serverMatt Caswell1-3/+2
An unknown PSK identity could be because its actually a session resumption attempt. Sessions resumptions and external PSKs are indistinguishable so the callbacks need to fail gracefully if they don't recognise the identity. Fixes #7433 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7434)
2018-10-17Fix: 'openssl ca' command crashes when used with 'rand_serial' optionDr. Matthias St. Pierre1-9/+10
Commit ffb46830e2df introduced the 'rand_serial' option. When it is used, the 'serialfile' does not get initialized, i.e. it remains a NULL pointer. This causes a crash when the NULL pointer is passed to the rotate_serial() call. This commit fixes the crash and unifies the pointer checking before calling the rotate_serial() and save_serial() commands. Fixes #7412 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7417)
2018-10-13Fix copy&paste error found in Coverity scanTomas Mraz1-1/+1
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7377)
2018-10-08apps: allow empty attribute values with -subjBenjamin Kaduk1-0/+6
Historically (i.e., OpenSSL 1.0.x), the openssl applications would allow for empty subject attributes to be passed via the -subj argument, e.g., `opensl req -subj '/CN=joe/O=/OU=local' ...`. Commit db4c08f0194d58c6192f0d8311bf3f20e251cf4f applied a badly needed rewrite to the parse_name() helper function that parses these strings, but in the process dropped a check that would skip attributes with no associated value. As a result, such strings are now treated as hard errors and the operation fails. Restore the check to skip empty attribute values and restore the historical behavior. Document the behavior for empty subject attribute values in the corresponding applications' manual pages. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7349)
2018-10-02Fix a mem leak in the ocsp appMatt Caswell1-0/+2
Free memory allocated in the parent process that is not needed in the child. We also free it in the parent. Technically this isn't really required since we end up calling exit() soon afterwards - but to prevent false positives we free it anyway. Fixes a Coverity issue. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7335)
2018-10-01'openssl list': add option -objects to list built in objectsRichard Levitte1-1/+57
Related to #6696 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6702)
2018-09-23Create the .rnd file it it does not existBernd Edlinger3-5/+0
It's a bit annoying, since some commands try to read a .rnd file, and print an error message if the file does not exist. But previously a .rnd file was created on exit, and that does no longer happen. Fixed by continuing in app_RAND_load_conf regardless of the error in RAND_load_file. If the random number generator is still not initalized on exit, the function RAND_write_file will fail and no .rnd file would be created. Remove RANDFILE from openssl.cnf Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/7217)
2018-09-21typo-fixes: miscellaneous typo fixesagnosticdev1-1/+1
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7277)
2018-09-13Don't allow -early_data with other options where it doesn't workMatt Caswell1-0/+5
-early_data is not compatible with -www, -WWW, -HTTP or -rev. Fixes #7200 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7206)
2018-09-12Speed for HMACs.Pauli1-4/+56
Add support for HMAC over any evp supported digest. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6945)
2018-09-10Don't cast an int * to a size_t *Matt Caswell1-8/+9
If sizeof(int) != sizeof(size_t) this may not work correctly. Fixes a Coverity issue. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7168)
2018-09-07Support EdDSA in apps/speedPaul Yang1-2/+226
This addresses issue #6922. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7073)
2018-09-05New openssl subject parser hard to debugEric Curtin1-1/+7
-subj 'subject=C = US, ST = A, L = root, O = Hewlett Packard Enterprise Company, OU = Remote Device Access, CN = Hewlett Packard Enterprise Remote Device Access Test Local CA, emailAddress = rda@hpe.com' was a valid subject in openssl 1.0. Error received in 1.1 is: problems making Certificate Request Not very informative, I only figured this out because I compiled the code and added logging. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7098)
2018-09-04openssl req: don't try to report bitsRichard Levitte1-2/+1
With the introduction of -pkeyopt, the number of bits may change without |newkey| being updated. Unfortunately, there is no API to retrieve the information from a EVP_PKEY_CTX either, so chances are that we report incorrect information. For the moment, it's better not to try to report the number of bits at all. Fixes #7086 Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7096)
2018-08-30Free SSL object on an error pathMatt Caswell1-2/+6
Thanks to @fangang190 for reporting this Fixes #7061 Reviewed-by: Paul Yang <yang.yang@baishancloud.com> (Merged from https://github.com/openssl/openssl/pull/7065)
2018-08-24Do not ignore EVP_PKEY_print_public/EVP_PKEY_print_private return valuesDmitry Belyavskiy1-12/+20
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/7007)
2018-08-22Ignore the digest in req app if using EdDSAMatt Caswell1-1/+10
This follows on from the previous commit, and makes the same change to ignore the digest if we are using EdDSA. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6901)
2018-08-22Improve the usability of the ca app using EdDSAMatt Caswell1-9/+13
Previously you had to supply "null" as the digest to use EdDSA. This changes things so that any digest is ignored. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6901)
2018-08-20Change Post Handshake auth so that it is opt-inMatt Caswell1-7/+7
Having post handshake auth automatically switched on breaks some applications written for TLSv1.2. This changes things so that an explicit function call is required for a client to indicate support for post-handshake auth. Fixes #6933. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6938)
2018-07-31Use the new non-curve type specific EC functions internallyMatt Caswell1-1/+1
Fixes #6646 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6815)
2018-07-30apps/dsaparam.c generates code that is intended to be pasted or includedBeat Bolli2-31/+15
into an existing source file: the function is static, and the code doesn't include dsa.h. Match the generated C source style of dsaparam. Adjust apps/dhparam.c to match, and rename the BIGNUMs to their more usual single-letter names. Add an error return in the generated C source. both: simplify the callback function Signed-off-by: Beat Bolli <dev@drbeat.li> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6797)
2018-07-26apps/apps.c: harmonize print_bignum_var output with coding style.Andy Polyakov1-4/+3
Reviewed-by: Rich Salz <rsalz@openssl.org>
2018-07-25apps/dsaparam.c: make dsaparam -C output strict-warnings-friendly.Andy Polyakov1-1/+1
Reviewed-by: Rich Salz <rsalz@openssl.org>
2018-07-23Make sure the 'tsget' script is called 'tsget.pl' everywhereRichard Levitte1-4/+3
The result is that we don't have to produce different names on different platforms, and we won't have confusion on Windows depending on if the script was built with mingw or with MSVC. Partial fix for #3254 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6764)
2018-07-22apps/dsaparam.c: fix -C output.Andy Polyakov1-12/+15
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6758)
2018-07-12apps/speed.c: let EVP_Update_loop_ccm behave more like EVP_Update_loopPatrick Steuer1-7/+15
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5246)
2018-07-09Add tests for the "req" command, -addext flagRich Salz1-0/+1
Also fixed a memory leak found by the test. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6681)
2018-07-09apps/req.c: fix -addext option.Andy Polyakov1-14/+11
Address even Coverity nit. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6671)
2018-07-06Don't fail if the PSK identity doesn't matchMatt Caswell1-2/+5
In 1.1.0 s_server if the PSK identity doesn't match what we have then a warning is printed and we continue the connection anyway. In 1.1.1, if TLSv1.3 is used and the identity doesn't match then we abort the connection. We should really be consistent with the old behaviour. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6659)
2018-07-06Add the ability to configure recv_max_early_data via s_serverMatt Caswell1-4/+15
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6655)
2018-07-05Reject duplicate -addext parametersRich Salz1-3/+77
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6636)
2018-07-02Add the ability to configure anti-replay via SSL_CONFMatt Caswell1-0/+5
This also adds the ability to control this through s_server Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6469)
2018-06-26Only dump session data after we have received itMatt Caswell1-15/+39
s_client was dumping session data at the end of the handshake. In TLSv1.3 we don't have session data until receipt of a NewSessionTicket message which happens post-handshake. Therefore we delay dumping the session data until that message has arrived if TLSv1.3 has been negotiated. Fixes #6482 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6590)
2018-06-24apps/speed.c: add missing checks for RAND_bytes()捷成吴1-2/+4
Function RAND_bytes() may return 0 or -1 on error, simply goto end label when it fails. Fixes #6567 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6582)
2018-06-24Support directories with "." in x509_load_serial()Ana María Martínez Gómez1-1/+1
Use `strrchr` to get a pointer to the last occurrence of `.` in the path string, instead of the first one with `strchr`. This prevent the path to be wrongly split if it contains several `.`, and not only the one for the extension. Fixes https://github.com/openssl/openssl/issues/6489. CLA: trivial Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6566)
2018-06-21apps/ca: fix useless get before delete.FdaSilvaYY1-3/+3
Small simplification by skipping effectively redundant step and not resuming search from point past deletion. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6195)
2018-06-21openssl ca: open the output file as late as possibleRichard Levitte1-4/+12
Fixes #6544 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6546)
2018-06-18add 'unsupported cipher mode' diagnostics to evp_lib.c and genpkey.cDavid von Oheimb1-0/+7
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6217)
2018-06-07Fix no-dsaMatt Caswell1-0/+2
Broken by 0336df2fa. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6427)
2018-06-05Issue warnings for large DSA and RSA keysGeorg Schmidt4-0/+30
Issue a warning when generating DSA or RSA keys of size greater than OPENSSL_DSA_MAX_MODULUS_BITS resp. OPENSSL_RSA_MAX_MODULUS_BITS. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6380)
generated by cgit v1.1 at 2024-07-14 02:17:43 +0000