summaryrefslogtreecommitdiffstats
path: root/apps/apps.c
AgeCommit message (Collapse)Author
2019-09-04Move libapps.a source to apps/libRichard Levitte
This makes it clearer what's what. The 'openssl' application and its sub-commands remain in apps/ Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9723)
2019-08-24Add app for fips installationShane Lontis
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9634)
2019-08-02Replace FUNCerr with ERR_raise_dataRich Salz
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9496)
2019-07-24Remove HEADER_X509_H and HEADER_SSL_H include detectors from appsDr. Matthias St. Pierre
The HEADER_X509_H check is redundant, because <openssl/x509.h> is already included. Instead of of checking for HEADER_SSL_H, include <openssl/ssl.h> explicitly in "s_apps.h" and don't include "s_apps.h" where it's not necessary. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/9364)
2019-07-22Deprecate SYSerr, add new FUNCerr macroRich Salz
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9072)
2019-07-22Add ERR_put_func_error, and use it.Rich Salz
Change SYSerr to have the function name; remove SYS_F_xxx defines Add a test and documentation. Use get_last_socket_err, which removes some ifdef's in OpenSSL code. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9072)
2019-03-19Add -new and -subj options to x509 app for direct cert generationDavid von Oheimb
Complete and improve error output of parse_name() in apps/apps.c Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8193)
2019-03-13prevent app_get_pass() from revealing cleartext password on syntax errorDavid von Oheimb
When the argument for '-pass' was badly formed, that argument got displayed in full. This turns out to not be such a good idea if the user simply forgot to start the argument with 'pass:', or spellt the prefix incorrectly. We therefore change the display to say that a colon is missing or only showing the incorrect prefix. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6218)
2019-03-06apps/openssl.c: Adapt to enable tracing outputRichard Levitte
Use the environment variables OPENSSL_TRACE to determine what's going to be enabled. The value of this variables is a comma separated list of trace and debugging names, which correspond to the trace category macros defined in include/openssl/trace.h. For example, setting OPENSSL_DEBUG=TRACE,SSL will enable debugging output for the types OSSL_TRACE_CATEGORY_TRACE and OSSL_TRACE_CATEGORY_SSL. This also slightly changes the handling of the prefix method in apps/apps.c. This is for the better, as the prefix method pointer was unneccessarily stored in two places. Co-authored-by: Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8198)
2019-02-11Updated test command line parsing to support commmon commandsShane Lontis
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6975)
2019-01-24Cleanup vxworks support to be able to compile for VxWorks 7Klotz, Tobias
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7569)
2019-01-21Make ca command silently use default if .attr file does not existBernd Edlinger
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7286)
2018-12-19Some code-cleanup/simplification in appsRich Salz
Remove some casts on password callback by adding a wrapper function. Remove level of indent by doing an early-return on failure. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7873)
2018-12-06Following the license change, modify the boilerplates in apps/Richard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7765)
2018-10-08apps: allow empty attribute values with -subjBenjamin Kaduk
Historically (i.e., OpenSSL 1.0.x), the openssl applications would allow for empty subject attributes to be passed via the -subj argument, e.g., `opensl req -subj '/CN=joe/O=/OU=local' ...`. Commit db4c08f0194d58c6192f0d8311bf3f20e251cf4f applied a badly needed rewrite to the parse_name() helper function that parses these strings, but in the process dropped a check that would skip attributes with no associated value. As a result, such strings are now treated as hard errors and the operation fails. Restore the check to skip empty attribute values and restore the historical behavior. Document the behavior for empty subject attribute values in the corresponding applications' manual pages. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7349)
2018-09-05New openssl subject parser hard to debugEric Curtin
-subj 'subject=C = US, ST = A, L = root, O = Hewlett Packard Enterprise Company, OU = Remote Device Access, CN = Hewlett Packard Enterprise Remote Device Access Test Local CA, emailAddress = rda@hpe.com' was a valid subject in openssl 1.0. Error received in 1.1 is: problems making Certificate Request Not very informative, I only figured this out because I compiled the code and added logging. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7098)
2018-07-26apps/apps.c: harmonize print_bignum_var output with coding style.Andy Polyakov
Reviewed-by: Rich Salz <rsalz@openssl.org>
2018-05-31apps: when the 'compat' nameopt has been set, leave it beRichard Levitte
XN_FLAG_COMPAT has a unique property, its zero for value. This means it needs special treatment; if it has been set (which can only be determined indirectly) and set alone (*), no other flags should be set. (*) if any other nameopt flag has been set by the user, compatibility mode is blown away. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6382)
2018-05-11Use void in all function definitions that do not take any argumentsKurt Roeckx
Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #6208
2018-04-25Revert "Check directory is able to create files for various -out option"Richard Levitte
This reverts commit 555c94a0db9661428da0a45cb32b9f002324eefd. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6033)
2018-04-25Revert "Add VMS version of app_dirname()"Richard Levitte
This reverts commit 215a6730f1eaf53b01a4eb10d75bd09fd74f70cc. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6033)
2018-04-18Add missing index_index() when reloading OCSP responderViktor Dukhovni
Also, future-proof index_index() return codes by requiring success to return a positive value. Reviewed-by: Rich Salz <rsalz@openssl.org>
2018-03-07Prepare to detect index changes in OCSP responder.Viktor Dukhovni
Retain open file handle and previous stat data for the CA index file, enabling detection and index reload (upcoming commit). Check requirements before entering accept loop. Reviewed-by: Matt Caswell <matt@openssl.org>
2018-02-28Add VMS version of app_dirname()Richard Levitte
Related to #3709 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4008)
2018-02-28Check directory is able to create files for various -out optionPaul Yang
This is to address issue #3404, only works in Unix-like platforms Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3709)
2018-02-01Make sure that apps/openssl prefixes its output with '# ' during testsRichard Levitte
The reason to do this is that some output might start with an 'ok', which TAP catches and takes for TAP output. The TAP compatible way is to make all output it shouldn't catch look like comments. We do this by setting the environment variable HARNESS_OSSL_PREFIX during tests. When that is set, apps/openssl uses BIO_f_linebuffer and sets its prefix to the content of that environment variable. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5224)
2017-12-28Add 'openssl req' option to specify extension values on command lineRichard Levitte
The idea is to be able to add extension value lines directly on the command line instead of through the config file, for example: openssl req -new -extension 'subjectAltName = DNS:dom.ain, DNS:oth.er' \ -extension 'certificatePolicies = 1.2.3.4' Fixes #3311 Thank you Jacob Hoffman-Andrews for the inspiration Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4986)
2017-12-07Consistent formatting for sizeof(foo)Rich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4872)
2017-11-13Resolve warnings in VC-WIN32 build, which allows to add /WX.Andy Polyakov
It's argued that /WX allows to keep better focus on new code, which motivates its comeback... Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4721)
2017-10-18Remove parentheses of return.KaoruToda
Since return is inconsistent, I removed unnecessary parentheses and unified them. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4541)
2017-10-09Since return is inconsistent, I removed unnecessary parentheses andKaoruToda
unified them. - return (0); -> return 0; - return (1); -> return 1; - return (-1); -> return -1; Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4500)
2017-08-25NO_SYS_TYPES_H isn't defined anywhere, stop using it as a guardRichard Levitte
This is a vestige from pre-1.1.0 OpenSSL Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4256)
2017-08-22Add random serial# support.Rich Salz
Add -rand_serial to CA command and "serial_rand" config option. Up RAND_BITS to 159, and comment why: now confirms to CABForum guidelines (Ballot 164) as well as IETF RFC 5280 (PKIX). Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4185)
2017-08-19Fix ui_write in apps/apps.cRichard Levitte
It used the default UI reader as fallback instead of the UI writer. Fixes #4147 Fixes #4195 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/4198)
2017-07-31app_isdir() cleanupXiaoyin Liu
I think it's better to use `GetFileAttributes` to obtain the attributes of a file than `FindFirstFile`. If the input name contains `*`, this function should return failure rather than check whether the first match happens to be a file or a directory. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/3991)
2017-07-26Fix potential use-after-free and memory leakPauli
In function wait_for_async(), allocated async fds is freed if `SSL_get_all_async_fds` fails, but later `fds` is used. Interestingly, it is not freed when everything succeeds. Rewrite the FD set loop to make it more readable and to not modify the allocated pointer so it can be freed. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3992)
2017-07-03BN_pseudo_rand is really BN_randRich Salz
And BN_pseudo_rand_range is really BN_rand_range. Document that we might deprecate those functions. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3743)
2017-07-03Remove the possibility to disable the UI module entirelyRichard Levitte
Instead, make it possible to disable the console reader that's part of the UI module. This makes it possible to use the UI API and other UI methods in environments where the console reader isn't useful. To disable the console reader, configure with 'no-ui-console' / 'disable-ui-console'. 'no-ui' / 'disable-ui' is now an alias for 'no-ui-console' / 'disable-ui-console'. Fixes #3806 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3820)
2017-06-12Clean up a bundle of codingstyle stuff in apps directoryPaul Yang
Mostly braces and NULL pointer check and also copyright year bump Signed-off-by: Paul Yang <paulyang.inf@gmail.com> Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3657)
2017-06-11Introduce ASN1_TIME_set_string_X509 APIRich Salz
Make funcs to deal with non-null-term'd string in both asn1_generalizedtime_to_tm() and asn1_utctime_to_tm(). Fixes issue #3444. This one is used to enforce strict format (RFC 5280) check and to convert GeneralizedTime to UTCTime. apps/ca has been changed to use the new API. Test cases and documentation are updated/added Signed-off-by: Paul Yang <paulyang.inf@gmail.com> Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3566)
2017-06-01Remove unnecessary if condition from apps.cAashil Patel
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3596)
2017-04-25Switch command-line utils to new nameopt API.Dmitry Belyavskiy
The CA names should be printed according to user's decision print_name instead of set of BIO_printf dump_cert_text instead of set of BIO_printf Testing cyrillic output of X509_CRL_print_ex Write and use X509_CRL_print_ex Reduce usage of X509_NAME_online Using X509_REQ_print_ex instead of X509_REQ_print Fix nameopt processing. Make dump_cert_text nameopt-friendly Move nameopt getter/setter to apps/apps.c Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3262)
2017-02-14Add Sieve support (RFC 5804) to s_client ("-starttls sieve")Robert Scheck
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2300)
2017-01-11Enable apps to get a UI_METHOD for the default prompterRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2204)
2016-12-08Make sure that password_callback exercises UIRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2040)
2016-10-19apps: instead of varying implementation, make setup_engine a function alwaysRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1643)
2016-10-19If an engine comes up explicitely, it must also come down explicitelyRichard Levitte
In apps/apps.c, one can set up an engine with setup_engine(). However, we freed the structural reference immediately, which means that for engines that don't already have a structural reference somewhere else (because it's a built in engine), we end up returning an invalid reference. Instead, the function release_engine() is added, and called at the end of the routines that call setup_engine(). Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1643)
2016-09-28apps/apps.c: initialize and de-initialize engine around key loadingRichard Levitte
Before loading a key from an engine, it may need to be initialized. When done loading the key, we must de-initialize the engine. (if the engine is already initialized somehow, only the reference counter will be incremented then decremented) Reviewed-by: Stephen Henson <steve@openssl.org>
2016-09-28Revert "Call ENGINE_init() before trying to use keys from engine"Rich Salz
This reverts commit 0a72002993b8619fd0642d19af3364bafbd9a06c. This fails to call ENGINE_finish; an alternate fix is forthcoming. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-09-28Call ENGINE_init() before trying to use keys from engineDavid Woodhouse
When I said before that s_client "used to work in 1.0.2" that was only partly true. It worked for engines which provided a default generic method for some key type, because it called ENGINE_set_default() and that ended up being an implicit initialisation and functional refcount. But an engine which doesn't provide generic methods doesn't get initialised, and then when you try to use it you get an error: cannot load client certificate private key file from engine 140688147056384:error:26096075:engine routines:ENGINE_load_private_key:not initialised:crypto/engine/eng_pkey.c:66: unable to load client certificate private key file cf. https://github.com/OpenSC/libp11/issues/107 (in which we discover that engine_pkcs11 *used* to provide generic methods that OpenSSL would try to use for ephemeral DH keys when negotiating ECDHE cipher suites in TLS, and that didn't work out very well.) Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1639)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-23 04:43:05 +0000