summaryrefslogtreecommitdiffstats
path: root/apps/s_cb.c
AgeCommit message (Collapse)Author
2017-06-21Print Ed25519 in s_client/s_serverDr. Stephen Henson
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3585)
2017-06-12Clean up a bundle of codingstyle stuff in apps directoryPaul Yang
Mostly braces and NULL pointer check and also copyright year bump Signed-off-by: Paul Yang <paulyang.inf@gmail.com> Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3657)
2017-04-25Switch command-line utils to new nameopt API.Dmitry Belyavskiy
The CA names should be printed according to user's decision print_name instead of set of BIO_printf dump_cert_text instead of set of BIO_printf Testing cyrillic output of X509_CRL_print_ex Write and use X509_CRL_print_ex Reduce usage of X509_NAME_online Using X509_REQ_print_ex instead of X509_REQ_print Fix nameopt processing. Make dump_cert_text nameopt-friendly Move nameopt getter/setter to apps/apps.c Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3262)
2017-04-03Print CA names in s_server, add -requestCAfile to s_clientDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3015)
2017-04-03Add extensions to debug listDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3015)
2017-03-30apps/*.c: switch to platform-neutral format modifiers in BIO_print calls.Andy Polyakov
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3083)
2017-03-16Add TLSv1.3 draft-19 messages to traceTodd Short
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2970)
2017-03-10Add HelloRetryRequest text to s_client/s_serverTodd Short
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2900)
2017-03-08Add some TLS13 values to s_client/s_serverTodd Short
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2882)
2017-02-28Remove some commented out code in the appsMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2774)
2017-02-26Print signature type to out, not bio_errDr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2747)
2017-02-21Provided support for the -nameopt flag in s_client, s_server and s_timeDmitry Belyavskiy
commands. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2695)
2017-02-14Make -xcert work again.Dr. Stephen Henson
When a certificate is prepended update the list pointer. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2628)
2017-02-09SSL_get_shared_sigalgs: handle negative idx parameterPeter Wu
When idx is negative (as is the case with do_print_sigalgs in apps/s_cb.c), AddressSanitizer complains about a buffer overflow (read). Even if the pointer is not dereferenced, this is undefined behavior. Change the user not to use "-1" as index since the function is documented to return 0 on out-of-range values. Tested with `openssl s_server` and `curl -k https://localhost:4433`. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2349)
2017-02-07apps: Add support for writing a keylog filePeter Wu
The server and client demos (s_client and s_server) are extended with a -keylogfile option. This is similar as setting the SSLKEYLOGFILE environment variable for NSS and creates a keylog file which is suitable for Wireshark. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2343)
2017-01-30fix style issuesDr. Stephen Henson
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2301)
2017-01-30Add SSL_get_peer_signature_type_nid() function.Dr. Stephen Henson
Add function to retrieve signature type: in the case of RSA keys the signature type can be EVP_PKEY_RSA or EVP_PKEY_RSA_PSS. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2301)
2017-01-30More complete PSS support.Dr. Stephen Henson
Extend support for PSS key signatures by using the EVP_PKEY_RSA_PSS type to distinguish them from PKCS1 signature types. Allow setting of PSS signature algorithms using the string "PSS" or "RSA-PSS". Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2301)
2016-11-15Revert "Remove heartbeats completely"Richard Levitte
Done too soon, this is for future OpenSSL 1.2.0 This reverts commit 6c62f9e1639a7d1a879f363a99882920104dfedb. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-15Remove heartbeats completelyRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1669)
2016-11-10Rename the Elliptic Curves extension to supported_groupsMatt Caswell
This is a skin deep change, which simply renames most places where we talk about curves in a TLS context to groups. This is because TLS1.3 has renamed the extension, and it can now include DH groups too. We still only support curves, but this rename should pave the way for a future extension for DH groups. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-11-02Add the SSL_METHOD for TLSv1.3 and all other base changes requiredMatt Caswell
Includes addition of the various options to s_server/s_client. Also adds one of the new TLS1.3 ciphersuites. This isn't "real" TLS1.3!! It's identical to TLS1.2 apart from the protocol and the ciphersuite...and the ciphersuite is just a renamed TLS1.2 one (not a "real" TLS1.3 ciphersuite). Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-19Constify certificate and CRL time routines.Dr. Stephen Henson
Update certificate and CRL time routines to match new standard. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-13Print out names of other temp key algorithms.Dr. Stephen Henson
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-08-04Pack globals variables used to control apps/verify_callback()FdaSilvaYY
into a structure , to avoid any accident . Plus some few cleanups Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-17Copyright consolidation 01/10Rich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-04-21Remove some dead codeMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-10Fix warnings exposed by clang-3.8Emilia Kasper
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-04-09Make DH opaqueMatt Caswell
Move the dh_st structure into an internal header file and provide relevant accessors for the internal fields. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-21Fix no-sockMatt Caswell
Misc fixes for no-sock Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-17Bugfix: Encode the requested length in s_cb.c:hexencode()Viktor Dukhovni
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-03-09Constify security callbacksKurt Roeckx
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
2016-03-04Extends s_client to allow a basic CT policy to be enabledRob Percival
Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-27Drop support for printing SSLv2 ciphers names.Kurt Roeckx
Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #2083
2016-02-22Remove unused parameters from internal functionsRich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-02-17Remove JPAKERich Salz
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-02-08Suppress DANE TLSA reflection when verification failsViktor Dukhovni
As documented both SSL_get0_dane_authority() and SSL_get0_dane_tlsa() are expected to return a negative match depth and nothing else when verification fails. However, this only happened when verification failed during chain construction. Errors in verification of the constructed chain did not have the intended effect on these functions. This commit updates the functions to check for verify_result == X509_V_OK, and no longer erases any accumulated match information when chain construction fails. Sophisticated developers can, with care, use SSL_set_verify_result(ssl, X509_V_OK) to "peek" at TLSA info even when verification fail. They must of course first check and save the real error, and restore the original error as quickly as possible. Hiding by default seems to be the safer interface. Introduced X509_V_ERR_DANE_NO_MATCH code to signal failure to find matching TLSA records. Previously reported via X509_V_ERR_CERT_UNTRUSTED. This also changes the "-brief" output from s_client to include verification results and TLSA match information. Mentioned session resumption in code example in SSL_CTX_dane_enable(3). Also mentioned that depths returned are relative to the verified chain which is now available via SSL_get0_verified_chain(3). Added a few more test-cases to danetest, that exercise the new code. Resolved thread safety issue in use of static buffer in X509_verify_cert_error_string(). Fixed long-stating issue in apps/s_cb.c which always sets verify_error to either X509_V_OK or "chain to long", code elsewhere (e.g. s_time.c), seems to expect the actual error. [ The new chain construction code is expected to correctly generate "chain too long" errors, so at some point we need to drop the work-arounds, once SSL_set_verify_depth() is also fixed to propagate the depth to X509_STORE_CTX reliably. ] Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-02-05GH601: Various spelling fixes.FdaSilvaYY
Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2016-02-04RT2887: Add more packet and handshake typesDaniel Black
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-02-03Refactoring BIO: Adapt BIO_s_datagram and all that depends on itRichard Levitte
The control commands that previously took a struct sockaddr * have been changed to take a BIO_ADDR * instead. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2016-02-01constify PACKETEmilia Kasper
PACKET contents should be read-only. To achieve this, also - constify two user callbacks - constify BUF_reverse. Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-01-20Refactor apps load_certs/load_crls to work incrementallyViktor Dukhovni
Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-12-23Refactor DTLS cookie generation and verificationRichard Levitte
DTLS cookie generation and verification were exact copies of each other save the last few lines. This refactors them to avoid code copying. Reviewed-by: Matt Caswell <matt@openssl.org>
2015-12-15Fix s_server problem with no-ecMatt Caswell
s_server was trying to set the ECDH curve when no-ec was defined. This also highlighted the fact that the -no_ecdhe option to s_server is broken, and doesn't make any sense any more (ECDHE is on by default and the only way it can be disabled is through the cipherstring). Therefore this commit removes the option. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2015-12-14New function X509_get0_pubkeyDr. Stephen Henson
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2015-11-09Continue standardisation of malloc handling in appsMatt Caswell
continue on from previous commits but in the apps directory Reviewed-by: Kurt Roeckx <kurt@openssl.org>
2015-10-09DTLS: remove unused cookie fieldEmilia Kasper
Note that this commit constifies a user callback parameter and therefore will break compilation for applications using this callback. But unless they are abusing write access to the buffer, the fix is trivial. Reviewed-by: Andy Polyakov <appro@openssl.org>
2015-09-28Print debug info for extended master secret extensionAlessandro Ghedini
Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-09-20make no-dh workDr. Stephen Henson
Reviewed-by: Richard Levitte <levitte@openssl.org>
2015-09-11Enable -Wmissing-variable-declarations andBen Laurie
-Wincompatible-pointer-types-discards-qualifiers (the latter did not require any code changes). Reviewed-by: Rich Salz <rsalz@openssl.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-05 05:36:55 +0000