summaryrefslogtreecommitdiffstats
path: root/apps/opt.c
AgeCommit message (Collapse)Author
2016-05-17Copyright consolidation 01/10Rich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-05-13Fix signer option and support format SMIME.Dr. Stephen Henson
Fix -signer option in smime utility to output signer certificates when verifying. Add support for format SMIME for -inform and -outform with cms and smime utilities. PR#4215 Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-05-09fix tab-space mixed indentationFdaSilvaYY
No code change Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-04-21Fix no-ocsp on Windows (and probably VMS)Matt Caswell
The ocsp.h file did not have appropriate guards causing link failures on Windows. GH Issue 900 Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-03After saving errno clear it before calls to strtol et. al.Viktor Dukhovni
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-03Move peer chain security checks into x509_vfy.cViktor Dukhovni
A new X509_VERIFY_PARAM_set_auth_level() function sets the authentication security level. For verification of SSL peers, this is automatically set from the SSL security level. Otherwise, for now, the authentication security level remains at (effectively) 0 by default. The new "-auth_level" verify(1) option is available in all the command-line tools that support the standard verify(1) options. New verify(1) tests added to check enforcement of chain signature and public key security levels. Also added new tests of enforcement of the verify_depth limit. Updated documentation. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-04-02apps/opt.c: next was only used when NDEBUG undefined, move it inside guardRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-17Remove Netware and OS/2Rich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-10Deprecate the -issuer_checks debugging optionViktor Dukhovni
This was a developer debugging feature and was never a useful public interface. Added all missing X509 error codes to the verify(1) manpage, but many still need a description beyond the associated text string. Sorted the errors in x509_txt.c by error number. Reviewed-by: Stephen Henson <steve@openssl.org>
2016-02-06commands help cleanupA J Mohan Rao
opt_valtype 0 is same as '-' while printing cmd usage asn1parse/ca/ciphers help cleanup Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-02-02Fix pkeyutl/rsautl empty encrypt-input/decrypt-output handlingViktor Dukhovni
Also fix option processing in pkeyutl to allow use of (formerly) "out-of-order" switches that were needless implementation limitations. Handle documented "ENGINE" form with -keyform and -peerform. Better handling of OPENSSL_NO_ENGINE and OPENSSL_NO_RSA. RT2018 Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-31Check chain extensions also for trusted certificatesViktor Dukhovni
This includes basic constraints, key usages, issuer EKUs and auxiliary trust OIDs (given a trust suitably related to the intended purpose). Added tests and updated documentation. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-01-29Make opt_imax visible in all appsViktor Dukhovni
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-13For stro[ui]max require both C99 and UINTMAX_MAX/INTMAX_MAXViktor Dukhovni
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-01-13For stroimax need C99 inttypes.hViktor Dukhovni
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-12Maximize time_t when intmax_t is availableViktor Dukhovni
Well, I'm not actually changing time_t, just changing how time_t valued opt values are converted from string to time_t. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-12RT4227: Range-check in apps.Rich Salz
Implement range-checking in all counts in apps. Turns out only a couple of cases were missing. And make the range-checking code more strict. Replace almost all opt_ulong() calls with opt_long() Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2015-12-30Fix faulty check in the VMS version of opt_prognameRichard Levitte
Reviewed-by: Stephen Henson <steve@openssl.org>
2015-10-05Address Windows warnings in apps/.Andy Polyakov
Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-09-05RT3951: Add X509_V_FLAG_NO_CHECK_TIME to suppress time checkDavid Woodhouse
In some environments, such as firmware, the current system time is entirely meaningless. Provide a clean mechanism to suppress the checks against it. Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-07-16Remove obsolete key formats.Rich Salz
Remove support for RSA_NET and Netscape key format (-keyform n). Also removed documentation of SGC. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2015-06-15RT2547: Tighten perms on generated privkey filesRich Salz
When generating a private key, try to make the output file be readable only by the owner. Put it in CHANGES file since it might be noticeable. Add "int private" flag to apps that write private keys, and check that it's set whenever we do write a private key. Checked via assert so that this bug (security-related) gets fixed. Thanks to Viktor for help in tracing the code-paths where private keys are written. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2015-05-05memset, memcpy, sizeof consistency fixesRich Salz
Just as with the OPENSSL_malloc calls, consistently use sizeof(*ptr) for memset and memcpy. Remove needless casts for those functions. For memset, replace alternative forms of zero with 0. Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-04-30Fix windows buildMatt Caswell
The big apps cleanup broke the windows build. This commit fixes some miscellaneous issues so that it builds again. Reviewed-by: Andy Polyakov <appro@openssl.org>
2015-04-26Fix main build breakage.Rich Salz
A variable declaration got dropped during a merge. And if a compiler inlines strcmp() and you put a strcmp in an assert message, the resultant stringification exceeds ANSI string limits. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2015-04-24Big apps cleanup (option-parsing, etc)Rich Salz
This is merges the old "rsalz-monolith" branch over to master. The biggest change is that option parsing switch from cascasding 'else if strcmp("-foo")' to a utility routine and somethin akin to getopt. Also, an error in the command line no longer prints the full summary; use -help (or --help :) for that. There have been many other changes and code-cleanup, see bullet list below. Special thanks to Matt for the long and detailed code review. TEMPORARY: For now, comment out CRYPTO_mem_leaks() at end of main Tickets closed: RT3515: Use 3DES in pkcs12 if built with no-rc2 RT1766: s_client -reconnect and -starttls broke RT2932: Catch write errors RT2604: port should be 'unsigned short' RT2983: total_bytes undeclared #ifdef RENEG RT1523: Add -nocert to fix output in x509 app RT3508: Remove unused variable introduced by b09eb24 RT3511: doc fix; req default serial is random RT1325,2973: Add more extensions to c_rehash RT2119,3407: Updated to dgst.pod RT2379: Additional typo fix RT2693: Extra include of string.h RT2880: HFS is case-insensitive filenames RT3246: req command prints version number wrong Other changes; incompatibilities marked with *: Add SCSV support Add -misalign to speed command Make dhparam, dsaparam, ecparam, x509 output C in proper style Make some internal ocsp.c functions void Only display cert usages with -help in verify Use global bio_err, remove "BIO*err" parameter from functions For filenames, - always means stdin (or stdout as appropriate) Add aliases for -des/aes "wrap" ciphers. *Remove support for IISSGC (server gated crypto) *The undocumented OCSP -header flag is now "-header name=value" *Documented the OCSP -header flag Reviewed-by: Matt Caswell <matt@openssl.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-06 04:54:01 +0000