summaryrefslogtreecommitdiffstats
path: root/apps/lib
AgeCommit message (Collapse)Author
2020-12-20Drop OPENSSL_NO_RSA everywhereRichard Levitte
The configuration option 'no-rsa' was dropped with OpenSSL 1.1.0, so this is simply a cleanup of the remains. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13700)
2020-12-15Skip unavailable digests and ciphers in -*-commandsDmitry Belyavskiy
Fixes #13594 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13669)
2020-12-10apps/{req,x509,ca}.c: Cleanup: move shared X509{,_REQ,_CRL} code to ↵Dr. David von Oheimb
apps/lib/apps.c Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13614)
2020-12-02APPS: Adapt load_key() and load_pubkey() for the engine: loaderRichard Levitte
These two functions react when the FORMAT_ENGINE format is given, and use the passed ENGINE |e| and the passed key argument to form a URI suitable for the engine: loader. Co-authored-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/13570)
2020-12-02APPS: Add OSSL_STORE loader for engine keysRichard Levitte
The idea is to be able to have our apps load engine keys using a URI: org.openssl.engine:{engineid}:{keyid} This is legacy, but added for the time being to support keys given to the application like this: -engine {engineid} -key {keyid} -keyform ENGINE This latter form is recognised internally, and rewritten into the URI form. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/13570)
2020-11-27Deprecate EVP_PKEY_assign_DH and other similar macrosMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13138)
2020-11-26Fix no-posix-ioMatt Caswell
The "multi" variable should only be used within HTTP_DAEMON guards. However there were a few spots where this was not the case, which causes no-posix-io builds to fail. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13498)
2020-11-26APPS: Make it possible for apps to set the base (fallback) UI_METHODRichard Levitte
The apps UI method acts as a proxy that bases its activity on a base (was called fallback) UI_METHOD, which defaults to UI_OpenSSL() under normal circumstances. However, some apps might want to have it based on another UI_METHOD, such as UI_null() to avoid prompting (typical for a -batch run). The new function set_base_ui_method() allows them to do precisely this. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13512)
2020-11-25Remove deprecation warning suppression from genpkeyMatt Caswell
genpkey was supressing deprecation warnings in order to support ENGINE functionality. We move all of that into a separate file so that we don't need to suppress the warnings anymore. Fixes #13118 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13454)
2020-11-25apps/cmp.c: fix crash with -batch option on OPENSSL_NO_UI_CONSOLEDr. David von Oheimb
Also make clear we cannot use get_ui_method() at this point. Fixes #13494 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13497)
2020-11-25APPS: Guard use of IPv6 functions and constants with a check of AF_INET6Richard Levitte
Fixes #13482 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13484)
2020-11-20apps.c: re-enable loading single certs and CRLs over HTTPDr. David von Oheimb
Fixes #13403 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13404)
2020-11-13CRYPTO: refactor ERR_raise()+ERR_add_error_data() to ERR_raise_data()Richard Levitte
This is not done absolutely everywhere, as there are places where the use of ERR_add_error_data() is quite complex, but at least the simple cases are done. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13318)
2020-11-13Convert all {NAME}err() in crypto/ to their corresponding ERR_raise() callRichard Levitte
This includes error reporting for libcrypto sub-libraries in surprising places. This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13318)
2020-11-10Remove some redundant error messages in the appsMatt Caswell
We change the load_key() and load_pubkey() functions to make them more consistent with the load_keyparams() function modified as a result of PR #13317. The error message on a NULL key is removed, because an error message has already been displayed by load_key_certs_crls(). Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13355)
2020-11-10Fix the reading of DSA parameters files using the dsaparam appMatt Caswell
DSA parameters files were failing to load correctly. We also fix a number of follow on issues which resulted in multiple similar errors messages being displayed for the same problem, as well as a seg-fault. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13317)
2020-10-26APPS: Remove the format argument where it's not usedRichard Levitte
Also, restore a behaviour change, where load_cert() would look at stdin when the input file name is NULL, and make sure to call load_cert_pass() with a corresponding argument where load_cert() was used in OpenSSL 1.1.1. Fixes #13235 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13236)
2020-10-22APPS: Implement load_keyparams() to load key parametersRichard Levitte
'openssl dsaparam' is affected as an obvious usage example. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13191)
2020-10-16Fix missing include of string.h in apps/lib/engine.c for strcmp.Randall S. Becker
This include is required for c99 on the NonStop TNS/X platform. CLA: trivial Fixes #13102 Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13103)
2020-10-15Update copyright yearMatt Caswell
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13144)
2020-10-15Rename OPENSSL_CTX prefix to OSSL_LIB_CTXDr. Matthias St. Pierre
Many of the new types introduced by OpenSSL 3.0 have an OSSL_ prefix, e.g., OSSL_CALLBACK, OSSL_PARAM, OSSL_ALGORITHM, OSSL_SERIALIZER. The OPENSSL_CTX type stands out a little by using a different prefix. For consistency reasons, this type is renamed to OSSL_LIB_CTX. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12621)
2020-10-04APPS: Reduce deprecation warning suppression - ENGINERichard Levitte
Some of our apps turn off deprecation warnings solely for the sake of ENGINE, and thereby shadowing other deprecations that we should take better care of. To solve this, all apps ENGINE functionality is move to one file, where deprecation warning suppression is activate, and the same suppression can then easily be removed in at least some of the apps. Any remaining suppression that we still need to deal with should happen as separate efforts. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13044)
2020-10-01Run the withlibctx.pl scriptMatt Caswell
Automatically rename all instances of _with_libctx() to _ex() as per our coding style. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12970)
2020-09-24load_key_certs_crls(): Restore output of fatal errorsDr. David von Oheimb
Also improve credentials loading diagnostics for many apps. Fixes #12840 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12893)
2020-09-24Use OPENSSL_SYS_TANDEM instead of OPENSSL_SYSNAME_TANDEMRichard Levitte
This streamlines with all other config targets, and draws from the 'sys_id' config attribute. Fixes #12858 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12933)
2020-09-23list: add capability to print details about the current DRBGsPauli
This allows a user to confirm that the DRBG their configuration specified is being used. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12931)
2020-09-16generate_cookie_callback: free temporary memory on an error pathPauli
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/12870)
2020-09-13Fix safestack issues in conf.hMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
2020-09-13Fix stacks of OPENSSL_STRING, OPENSSL_CSTRING and OPENSSL_BLOCKMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
2020-09-13Fix safestack issues in x509v3.hMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
2020-09-13Fix safestack issues in x509.hMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
2020-09-12NonStop port updates for 3.0.0.Randall S. Becker
HPE NonStop Port Changes for 3.0.0 Includes unthreaded, PUT, and SPT for OSS. The port changes include wrapping where necessary for FLOSS and appropriate configuration changes to support that. Two tests are excluded as being inappropriate for the platform. The changes are: * Added /usr/local/include to nonstop-nsx_spt_floss to load floss.h * Added SPT Floss variant for NonStop * Wrapped FLOSS definitions in OPENSSL_TANDEM_FLOSS to allow selective enablement. * SPT build configuration for NonStop * Skip tests not relevant for NonStop * PUT configuration changes required for NonStop platforms * Configurations/50-nonstop.conf: updates for TNS/X platform. * FLOSS instrumentation for HPE NonStop TNS/X and TNS/E platforms. * Configurations/50-nonstop.conf: modifications for non-PUT TNS/E platform b * Fix use of DELAY in ssltestlib.c for HPNS. * Fixed commit merge issues and added floss to http_server.c CLA: Permission is granted by the author to the OpenSSL team to use these modifications. Fixes #5087. Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12800)
2020-09-11apps/ca: allow CRL lastUpdate/nextUpdate fields to be specifiedChris Novakovic
When generating a CRL using the "ca" utility, allow values for the lastUpdate and nextUpdate fields to be specified using the command line options -crl_lastupdate and -crl_nextupdate respectively. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12784)
2020-09-10apps_ui.c: Correct password prompt for ui_methodDr. David von Oheimb
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12493)
2020-09-10apps_ui.c: Correct handling of empty password from -passinDr. David von Oheimb
This is done in analogy to commit ca3245a61989009a99931748723d12e30d0a66b2 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12493)
2020-09-10apps_ui.c: Improve error handling and return value of setup_ui_method()Dr. David von Oheimb
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12493)
2020-09-11Fix fipsinstall module pathShane Lontis
If a path is specified with the -module option it will use this path to load the library when the provider is activated, instead of also having to set the environment variable OPENSSL_MODULES. Added a platform specific opt_path_end() function that uses existing functionality used by opt_progname(). Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12761)
2020-09-10Add/harmonize multi-valued RDN support and doc of ca, cmp, req, storeutl, ↵Dr. David von Oheimb
and x509 apps Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12769)
2020-09-10app_load_config_bio(): fix crash on errorDr. David von Oheimb
It turns out that the CONF_modules_load(conf, NULL, 0) call is just wrong. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12817)
2020-09-10apps.c: Fix mem leaks on error in load_certs() and load_crls()Dr. David von Oheimb
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12823)
2020-09-10apps.c: Fix diagnostics and return value of load_key_certs_crls() on errorDr. David von Oheimb
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12824)
2020-09-08OSSL_HTTP_parse_url(): add optional port number return parameter and ↵Dr. David von Oheimb
strengthen documentation Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12786)
2020-08-27apps: -msg flag enhancement 1/2Marc
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12310)
2020-08-20Make better use of new load_cert_pass() variant of load_cert() in apps/Dr. David von Oheimb
allows loading password-protected PKCS#12 files in x509, ca, s_client, s_server Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12647)
2020-08-20apps: make use of OSSL_STORE for generalized certs and CRLs loadingDr. David von Oheimb
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12647)
2020-08-20STORE: Distinguish public keys from private keysRichard Levitte
While public keys and private keys use the same type (EVP_PKEY), just with different contents, callers still need to distinguish between the two to be able to know what functions to call with them (for example, to be able to choose between EVP_PKEY_print_private() and EVP_PKEY_print_public()). The OSSL_STORE backend knows what it loaded, so it has the capacity to inform. Note that the same as usual still applies, that a private key EVP_PKEY contains the public parts, but not necessarily the other way around. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12673)
2020-08-12Add public API for gettables and settables for keymanagement, signatures and ↵Shane Lontis
key exchange. The openssl provider app will now display these params. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12396)
2020-08-04apps: Correct and extend diagnostics of parse_name()Dr. David von Oheimb
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12296)
2020-07-24Add X509 related libctx changes.Shane Lontis
- In order to not add many X509_XXXX_with_libctx() functions the libctx and propq may be stored in the X509 object via a call to X509_new_with_libctx(). - Loading via PEM_read_bio_X509() or d2i_X509() should pass in a created cert using X509_new_with_libctx(). - Renamed some XXXX_ex() to XXX_with_libctx() for X509 API's. - Removed the extra parameters in check_purpose.. - X509_digest() has been modified so that it expects a const EVP_MD object() and then internally it does the fetch when it needs to (via ASN1_item_digest_with_libctx()). - Added API's that set the libctx when they load such as X509_STORE_new_with_libctx() so that the cert chains can be verified. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12153)
2020-07-23Test RSA oaep in fips modeShane Lontis
Added RSA oaep test that uses the pkeyutl application. Added an openssl application option to support loading a (fips) provider via the '-config' option. Added openssl application related environment variable 'OPENSSL_TEST_LIBCTX' (for testing purposes only), that creates a non default library context. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11948)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-06 19:38:12 +0000