summaryrefslogtreecommitdiffstats
path: root/apps/apps.c
AgeCommit message (Collapse)Author
2015-07-16Remove obsolete key formats.Rich Salz
Remove support for RSA_NET and Netscape key format (-keyform n). Also removed documentation of SGC. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2015-06-15RT2547: Tighten perms on generated privkey filesRich Salz
When generating a private key, try to make the output file be readable only by the owner. Put it in CHANGES file since it might be noticeable. Add "int private" flag to apps that write private keys, and check that it's set whenever we do write a private key. Checked via assert so that this bug (security-related) gets fixed. Thanks to Viktor for help in tracing the code-paths where private keys are written. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2015-05-29Restore module loadingRichard Levitte
The module loading feature got broken a while ago, so restore it, but have it a bit more explicit this time around. Reviewed-by: Stephen Henson <steve@openssl.org>
2015-05-28RT3876: Only load config when neededRich Salz
Create app_load_config(), a routine to load config file. Remove the "always load config" from the main app. Change the places that used to load config to call the new common routine. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-22Remove support for OPENSSL_NO_TLSEXTMatt Caswell
Given the pervasive nature of TLS extensions it is inadvisable to run OpenSSL without support for them. It also means that maintaining the OPENSSL_NO_TLSEXT option within the code is very invasive (and probably not well tested). Therefore it is being removed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-11Use p==NULL not !p (in if statements, mainly)Rich Salz
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-05-06Use "==0" instead of "!strcmp" etcRich Salz
For the various string-compare routines (strcmp, strcasecmp, str.*cmp) use "strcmp()==0" instead of "!strcmp()" Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-05-06Initialize potentially uninitialized local variablesGunnar Kudrjavets
Compiling OpenSSL code with MSVC and /W4 results in a number of warnings. One category of warnings is particularly interesting - C4701 (potentially uninitialized local variable 'name' used). This warning pretty much means that there's a code path which results in uninitialized variables being used or returned. Depending on compiler, its options, OS, values in registers and/or stack, the results can be nondeterministic. Cases like this are very hard to debug so it's rational to fix these issues. This patch contains a set of trivial fixes for all the C4701 warnings (just initializing variables to 0 or NULL or appropriate error code) to make sure that deterministic values will be returned from all the execution paths. RT#3835 Signed-off-by: Matt Caswell <matt@openssl.org> Matt's note: All of these appear to be bogus warnings, i.e. there isn't actually a code path where an unitialised variable could be used - its just that the compiler hasn't been able to figure that out from the logic. So this commit is just about silencing spurious warnings. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-05Fix windows buildMatt Caswell
Fix error in WIN32_rename() introduced by commit b4faea50c35. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-05-04Use safer sizeof variant in mallocRich Salz
For a local variable: TYPE *p; Allocations like this are "risky": p = OPENSSL_malloc(sizeof(TYPE)); if the type of p changes, and the malloc call isn't updated, you could get memory corruption. Instead do this: p = OPENSSL_malloc(sizeof(*p)); Also fixed a few memset() calls that I noticed while doing this. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-04more OSSL_NELEM casesDr. Stephen Henson
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-05-01free NULL cleanup -- codaRich Salz
After the finale, the "real" final part. :) Do a recursive grep with "-B1 -w [a-zA-Z0-9_]*_free" to see if any of the preceeding lines are an "if NULL" check that can be removed. Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-05-01free NULL cleanup 11Rich Salz
Don't check for NULL before calling free functions. This gets: ERR_STATE_free ENGINE_free DSO_free CMAC_CTX_free COMP_CTX_free CONF_free NCONF_free NCONF_free_data _CONF_free_data A sk_free use within OBJ_sigid_free TS_TST_INFO_free (rest of TS_ API was okay) Doc update for UI_free (all uses were fine) X509V3_conf_free X509V3_section_free X509V3_string_free Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-05-01free null cleanup finaleRich Salz
Don't check for NULL before calling OPENSSL_free Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-30free NULL cleanup 7Rich Salz
This gets BN_.*free: BN_BLINDING_free BN_CTX_free BN_FLG_FREE BN_GENCB_free BN_MONT_CTX_free BN_RECP_CTX_free BN_clear_free BN_free BUF_MEM_free Also fix a call to DSA_SIG_free to ccgost engine and remove some #ifdef'd dead code in engines/e_ubsec. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-30free cleanup 12Rich Salz
Don't check for NULL before calling free function. This gets: NAME_CONSTRAINTS_free GENERAL_SUBTREE_free ECDSA_METHOD_free JPAKE_CTX_free OCSP_REQ_CTX_free SCT_free SRP_VBASE_free SRP_gN_free SRP_user_pwd_free TXT_DB_free Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-30free cleanup almost the finaleRich Salz
Add OPENSSL_clear_free which merges cleanse and free. (Names was picked to be similar to BN_clear_free, etc.) Removed OPENSSL_freeFunc macro. Fixed the small simple ones that are left: CRYPTO_free CRYPTO_free_locked OPENSSL_free_locked Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-30In apps, malloc or dieRich Salz
No point in proceeding if you're out of memory. So change *all* OPENSSL_malloc calls in apps to use the new routine which prints a message and exits. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-30free NULL cleanup 5aRich Salz
Don't check for NULL before calling a free routine. This gets X509_.*free: x509_name_ex_free X509_policy_tree_free X509_VERIFY_PARAM_free X509_STORE_free X509_STORE_CTX_free X509_PKEY_free X509_OBJECT_free_contents X509_LOOKUP_free X509_INFO_free Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-30free NULL cleanup 8Rich Salz
Do not check for NULL before calling a free routine. This addresses: ASN1_BIT_STRING_free ASN1_GENERALIZEDTIME_free ASN1_INTEGER_free ASN1_OBJECT_free ASN1_OCTET_STRING_free ASN1_PCTX_free ASN1_SCTX_free ASN1_STRING_clear_free ASN1_STRING_free ASN1_TYPE_free ASN1_UTCTIME_free M_ASN1_free_of Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-30Fix windows buildMatt Caswell
The big apps cleanup broke the windows build. This commit fixes some miscellaneous issues so that it builds again. Reviewed-by: Andy Polyakov <appro@openssl.org>
2015-04-29Rewrite parse_nameRich Salz
Remove need for multiple arrays, parse the X509 name one RDN at a time. Thanks to Andy for careful review. Reviewed-by: Andy Polyakov <appro@openssl.org>
2015-04-29use isxdigit and apps_tohexRich Salz
Replace ad-hoc ascii->hex with isxdigit and new app_tohex. Reviewed-by: Andy Polyakov <appro@openssl.org>
2015-04-29Remove needless bio_err argumentRich Salz
Many functions had a BIO* parameter, and it was always called with bio_err. Remove the param and just use bio_err. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-28remove malloc castsRich Salz
Following ANSI C rules, remove the casts from calls to OPENSSL_malloc and OPENSSL_realloc. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-26Simplify parse_yesno; remove local variableRich Salz
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-04-24Big apps cleanup (option-parsing, etc)Rich Salz
This is merges the old "rsalz-monolith" branch over to master. The biggest change is that option parsing switch from cascasding 'else if strcmp("-foo")' to a utility routine and somethin akin to getopt. Also, an error in the command line no longer prints the full summary; use -help (or --help :) for that. There have been many other changes and code-cleanup, see bullet list below. Special thanks to Matt for the long and detailed code review. TEMPORARY: For now, comment out CRYPTO_mem_leaks() at end of main Tickets closed: RT3515: Use 3DES in pkcs12 if built with no-rc2 RT1766: s_client -reconnect and -starttls broke RT2932: Catch write errors RT2604: port should be 'unsigned short' RT2983: total_bytes undeclared #ifdef RENEG RT1523: Add -nocert to fix output in x509 app RT3508: Remove unused variable introduced by b09eb24 RT3511: doc fix; req default serial is random RT1325,2973: Add more extensions to c_rehash RT2119,3407: Updated to dgst.pod RT2379: Additional typo fix RT2693: Extra include of string.h RT2880: HFS is case-insensitive filenames RT3246: req command prints version number wrong Other changes; incompatibilities marked with *: Add SCSV support Add -misalign to speed command Make dhparam, dsaparam, ecparam, x509 output C in proper style Make some internal ocsp.c functions void Only display cert usages with -help in verify Use global bio_err, remove "BIO*err" parameter from functions For filenames, - always means stdin (or stdout as appropriate) Add aliases for -des/aes "wrap" ciphers. *Remove support for IISSGC (server gated crypto) *The undocumented OCSP -header flag is now "-header name=value" *Documented the OCSP -header flag Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-16Code style: space after 'if'Viktor Dukhovni
Reviewed-by: Matt Caswell <matt@openssl.org>
2015-04-11free NULL cleanup 9Rich Salz
Ongoing work to skip NULL check before calling free routine. This gets: ecp_nistz256_pre_comp_free nistp224_pre_comp_free nistp256_pre_comp_free nistp521_pre_comp_free PKCS7_free PKCS7_RECIP_INFO_free PKCS7_SIGNER_INFO_free sk_PKCS7_pop_free PKCS8_PRIV_KEY_INFO_free PKCS12_free PKCS12_SAFEBAG_free PKCS12_free sk_PKCS12_SAFEBAG_pop_free SSL_CONF_CTX_free SSL_CTX_free SSL_SESSION_free SSL_free ssl_cert_free ssl_sess_cert_free Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2015-03-25free NULL cleanupRich Salz
This commit handles BIO_ACCEPT_free BIO_CB_FREE BIO_CONNECT_free BIO_free BIO_free_all BIO_vfree Reviewed-by: Matt Caswell <matt@openssl.org>
2015-03-05Unchecked malloc fixesMatt Caswell
Miscellaneous unchecked malloc fixes. Also fixed some mem leaks on error paths as I spotted them along the way. Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-02-25Add -no_alt_chains option to apps to implement the newMatt Caswell
X509_V_FLAG_NO_ALT_CHAINS flag. Using this option means that when building certificate chains, the first chain found will be the one used. Without this flag, if the first chain found is not trusted then we will keep looking to see if we can build an alternative chain instead. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2015-02-10Fix hostname validation in the command-line tool to honour negative return ↵Emilia Kasper
values. Specifically, an ASN.1 NumericString in the certificate CN will fail UTF-8 conversion and result in a negative return value, which the "x509 -checkhost" command-line option incorrectly interpreted as success. Also update X509_check_host docs to reflect reality. Thanks to Sean Burford (Google) for reporting this issue. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-01-23ifdef cleanup part 3: OPENSSL_SYSNAMERich Salz
Rename OPENSSL_SYSNAME_xxx to OPENSSL_SYS_xxx Remove MS_STATIC; it's a relic from platforms <32 bits. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22ifdef cleanup, 2 remove OPENSSL_NO_SETVBUF_IONBFRich Salz
Use setbuf(fp, NULL) instead of setvbuf(). This removes some ifdef complexity because all of our platforms support setbuf. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-01-22Run util/openssl-format-source -v -c .Matt Caswell
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-22Move more comments that confuse indentMatt Caswell
Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-01-12RT3548: Remove unsupported platformsRich Salz
This last one for this ticket. Removes WIN16. So long, MS_CALLBACK and MS_FAR. We won't miss you. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-01-06Further comment amendments to preserve formatting prior to source reformatMatt Caswell
Reviewed-by: Tim Hudson <tjh@openssl.org>
2014-07-07Update API to use (char *) for email addresses and hostnamesViktor Dukhovni
Reduces number of silly casts in OpenSSL code and likely most applications. Consistent with (char *) for "peername" value from X509_check_host() and X509_VERIFY_PARAM_get0_peername().
2014-07-06Set optional peername when X509_check_host() succeeds.Viktor Dukhovni
Pass address of X509_VERIFY_PARAM_ID peername to X509_check_host(). Document modified interface.
2014-06-27Memory leak and NULL dereference fixes.Dr. Stephen Henson
PR#3403
2014-05-24Add an NSS output format to sess_id to export to export the session id and ↵Martin Kaiser
the master key in NSS keylog format. PR#3352
2014-04-04Use correct length when prompting for password.Dr. Stephen Henson
Use bufsiz - 1 not BUFSIZ - 1 when prompting for a password in the openssl utility. Thanks to Rob Mackinnon, Leviathan Security for reporting this issue.
2014-02-25Avoid Windows 8 Getversion deprecated errors.Dr. Stephen Henson
Windows 8 SDKs complain that GetVersion() is deprecated. We only use GetVersion like this: (GetVersion() < 0x80000000) which checks if the Windows version is NT based. Use a macro check_winnt() which uses GetVersion() on older SDK versions and true otherwise.
2013-11-14Fix compilation with no-nextprotoneg.Piotr Sikora
PR#3106
2013-01-19Improve WINCE support.Andy Polyakov
Submitted by: Pierre Delaage
2012-12-29make JPAKE work again, fix memory leaksDr. Stephen Henson
2012-12-13New verify flag to return success if we have any certificate in theDr. Stephen Henson
trusted store instead of the default which is to return an error if we can't build the complete chain.
2012-12-06Add code to download CRLs based on CRLDP extension.Dr. Stephen Henson
Just a sample, real world applications would have to be cleverer.
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-04 07:41:54 +0000