summaryrefslogtreecommitdiffstats
path: root/apps
AgeCommit message (Collapse)Author
2021-12-09APPS/cmp: Fix use of OPENSSL_NO_SOCK: options like -server do not make sense ↵Dr. David von Oheimb
with no-sock Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17226) (cherry picked from commit 83b424c3f60a4401fa3e6e41ff7f08e85ee9df94)
2021-12-09APPS/cmp: fix -rspin option such that it works again without -reqinDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17222) (cherry picked from commit 7ee0954a086ee3b4e0a8c6736600e3d6362485c0)
2021-12-02s_cb.c: check the return value of X509_get0_pubkey()x2018
Check is done to prevent wrong memory access by EVP_PKEY_get0_asn1() Also fix wrong coding style in the s_cb.c file. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17176) (cherry picked from commit 5fae09f3d8da7c182c6cfb6a295dcfd15ae828ae)
2021-11-29Return -1 properly from do_X509_REQ_verify and do_X509_verifyPW Hu
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17001) (cherry picked from commit bc42cf51c8b2a22282bb3cdf6303e230dc7b7873)
2021-11-25check the return value of OPENSSL_strdup(CRYPTO_strdup) in ↵x2018
apps/lib/app_rand.c:32 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17124) (cherry picked from commit 3e0441520b9a349dc50662919ea18f03dfc0d624)
2021-11-25check the return value of OPENSSL_strdup(CRYPTO_strdup) to prevent potential ↵x2018
memory access error Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17113) (cherry picked from commit b9648f31a4917b8594caebda3e6d8d313514fe24)
2021-11-25check the return value of OPENSSL_strdup to prevent potential memory access ↵x2018
error Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17110) (cherry picked from commit dc7e42c6a12637bae1660561d3f4cef039001475)
2021-11-22SSL_export_keying_material: fix return checkPeiwei Hu
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17028) (cherry picked from commit 40649e36c4c0c9438f62e1bf2ccb983f6854c662)
2021-11-17Fix verbosity of CMP client diagnosticsDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16051)
2021-11-16EVP_PKEY_keygen_init: fix return checkPeiwei Hu
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17031) (cherry picked from commit bf4ceeded1497c79e72fba4f9ff15febae58108d)
2021-11-16EVP_PKEY_paramgen_init: fix return checkPeiwei Hu
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17030) (cherry picked from commit 6e0b05f3008a3f22105fd2bed9314b0bfa381f93)
2021-11-09Fix sigsize usage in apps/speed.cXiaofei Bai
In a recent upstream change (43da9a14f0e73f42f28ae34219929b44df5d1a11) the parameter sigsize become a read/write input in EVP_PKEY_sign(), and after signing, sigsize will be overwritten with the actual size and used in the verify step. As the speed program calls EVP_PKEY_sign() on the same context repeatedly, sigsize value is no longer the initial available size, and may fail in later buffer size checks. This fix adds a new buflen member in struct loopargs (which is only used within apps/speed.c), to save available buffer size and to be used as sigsize input in EVP_PKEY_sign() calls. Sigsize still contains the signature size for the verify step. Signed-off-by: Xiaofei Bai <xiaofei.bai@arm.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16991) (cherry picked from commit e7414634a59aa61c7917193a31382ced95d40eeb)
2021-11-08APPS/x509: Fix generation of AKID via v2i_AUTHORITY_KEYID()Dr. David von Oheimb
Fixes #16300 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16442) (cherry picked from commit 9bf1061c44c81059102cd4749f6078b6ce71da9d)
2021-10-27speed: range check the argument given to -multiPauli
For machines where sizeof(size_t) == sizeof(int) there is a possible overflow which could cause a crash. For machines where sizeof(size_t) > sizeof(int), the existing checks adequately detect the situation. Fixes #16899 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16904) (cherry picked from commit 7220085f22cf6c49933ea8287eb15db57f7ab0db)
2021-10-25cmp.c: Avoid dereference with negative index and use memcpyTomas Mraz
This prevents a compile-time warning on newer gcc. Also fix the related warning message. Fixes #16814 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16821) (cherry picked from commit 767db672c429aeb98a68b0e310dea15f1b48eb84)
2021-10-22Fix the s_server psk_server_cb for use in DTLSMatt Caswell
Commit 0007ff257c added a protocol version check to psk_server_cb but failed to take account of DTLS causing DTLS based psk connections to fail. Fixes #16707 Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/16838) (cherry picked from commit 8b09a9c76d873f62c2507fa9628a9c96c1d66d5c)
2021-10-22Clean up on failed BIO creationyuanjungong
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16316) (cherry picked from commit f11c01a666e9d5b97e859cbc74586802549dee00)
2021-10-11Bugfix: unsafe return check of EVP_PKEY_fromdataPW Hu
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16783) (cherry picked from commit d11cab47810715ba472070300b180944a1d93633)
2021-10-11Bugfix: unsafe return check of EVP_PKEY_fromdata_initPW Hu
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16783) (cherry picked from commit 5e199c356d09aca3b625b5ea16966b36d24b0201)
2021-10-09Bindhost/bindport should be freedDmitry Belyavskiy
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16775) (cherry picked from commit 0ce0c455862ed29bd7f2acdbddbe8d0b1783c1c9)
2021-10-08Fix unsafe BIO_get_md_ctx checkPW Hu
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16768) (cherry picked from commit 59a3e7b29574ff45f62e825f6e9923f45060f142)
2021-10-07apps/x509: Fix self-signed check to happen before setting issuer nameDr. David von Oheimb
Fixes #16720 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16747)
2021-10-01Fully initialise cipher/digest app handlesViktor Dukhovni
This avoids a crash in e.g. `openssl chacha20` as reported by Steffen Nurpmeso on openssl-users. Resolves: #16713 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16714) (cherry picked from commit a8cc0efe0d8fdd7bfa1d40b3c008d7d6ddf970db)
2021-09-30APPS/{x509,req}: Fix description and diagnostics of -key, -in, etc. optionsDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16618)
2021-09-17APPS/cmp.c: Move warning on overlong section name to make it effective againDr. David von Oheimb
Fixes #16585 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16586) (cherry picked from commit 39a8d4e13219580c8c89a234d6db5d261408cadb)
2021-09-14convert tabs to spaces in two distributed Perl scriptsViktor Szakats
Also fix indentation in c_rehash.in to 4 spaces, where a mixture of 4 and 8 spaces was used before, in addition to tabs. CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16459) (cherry picked from commit ea0d79db9be9066de350c44c160bd8b17f2be666)
2021-09-10Fix 'openssl speed' information printoutRichard Levitte
Most of all, this reduces the following: built on: built on: Wed Sep 8 19:41:55 2021 UTC to: built on: Wed Sep 8 19:41:55 2021 UTC Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/16563)
2021-08-31apps/pkcs12: Do not assume null termination of ASN1_UTF8STRINGTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/16433)
2021-08-26APPS/req: Fix AKID generation in case -CA option is usedDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16420)
2021-08-26APPS/req: Fix misconceptions on -CA, -CAkey, and -key options. -CA now ↵Dr. David von Oheimb
implies -x509 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16420)
2021-08-26APPS/x509: fix -extfile option, which was ignored with -x509toreqDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16417)
2021-08-25CMS app: Fix new -wrap optionDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/16396)
2021-08-25Avoid using undefined value in generate_stateless_cookie_callbackBernd Edlinger
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16384)
2021-08-25apps/ciphers: Fix wrong return value when using -convert parameterTianjia Zhang
Command 'openssl ciphers -convert <name>' always returns failure, this patch set the correct return value. Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16383)
2021-08-25APPS: Fix result type of dump_cert_text() and behavior of print_name() on ↵Dr. David von Oheimb
out==NULL Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16344)
2021-08-24rsa: Try legacy encoding functions for pubkeyTomas Mraz
If there are no suitable encoders it might mean the key is in an engine and thus it is a legacy key. Try legacy encoding routines to encode the public key. We do not attempt encoding a private key as it would be in most cases impossible anyway. Fixes #16256 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16289)
2021-08-20Get rid of warn_binaryDmitry Belyavskiy
Current implementation of warn_binary introduces a regression when the content is passed in /dev/stdin as an explicit file name and reads the file to be processed twice otherwise. I suggest to reimplement this functionality after 3.0 if necessary. Fixes #16359 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/16367)
2021-08-12Disclaimer about the default provider activation added to configDmitry Belyavskiy
Fixes #16249 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16280)
2021-08-12genpkey: -quiet doesn't take an argumentPauli
Fixes #16238 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16240)
2021-08-06Fix CMP app TLS connection not respecting vpm options like -crl_checkDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16225)
2021-08-05cms: Fix handling of -rctform optionTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/16216)
2021-08-05cms: Do not try to check binary format on stdinTomas Mraz
Fixes #16195 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/16216)
2021-08-05req: Avoid segfault when -modulus is usedTomas Mraz
Fixes #16196 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/16215)
2021-08-04apps/pkeyutl.c: call ERR_print_errors() on all errors, including Signature ↵Dr. David von Oheimb
Verification Failure Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16209)
2021-08-04Add config_diagnostics to our configuration files.Pauli
The change to a more configuration based approach to enable FIPS mode operation highlights a shortcoming in the default should do something approach we've taken for bad configuration files. Currently, a bad configuration file will be automatically loaded and once the badness is detected, it will silently stop processing the configuration and continue normal operations. This is good for remote servers, allowing changes to be made without bricking things. It's bad when a user thinks they've configured what they want but got something wrong and it still appears to work. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/16171)
2021-08-03If we have passed the private key, don't copy it implicitlyDmitry Belyavskiy
Fixes #16197 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16199)
2021-07-31Redefine getpid() -> _getpid() only for MSVCTanzinul Islam
This was introduced in 814b5133e for MSVC. C++Builder doesn't need it. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/16192)
2021-07-16apps: Use the first detected address family if IPv6 is not availableDaiki Ueno
This is a follow up of 15729bef385211bc2a0497e2d53a45c45d677d2c. Even when the host does not support IPv6 at all, BIO_lookup_ex may now return IN6ADDR_ANY in addition to INADDR_ANY, as the second element of the ai_next field. After eee8a40aa5e06841eed6fa8eb4f6109238d59aea, the do_server function prefers the IPv6 address and fails on the BIO_socket call. This adds a fallback code to retry with the IPv4 address returned as the first element to avoid the error. The failure had been partially avoided in the previous code with AI_ADDRCONFIG, because getaddrinfo returns only IPv4 address if no IPv6 address is associated with external interface. However, it would be still a problem if the external interface has an IPv6 address assigned, while the loopback interface doesn't. Signed-off-by: Daiki Ueno <dueno@redhat.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16074)
2021-07-14apps: avoid using POSIX IO macros and functions when built without them.Pauli
Fall back to stdio functions if not available. Fixes a daily run-checker failure (no-posix-io) Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16073)
2021-07-13Remove executable mode attributes of non-executable filesTianjia Zhang
Remove the executable attributes of some C code files and key files, change the file mode from 0755 to 0644. Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16045)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-13 01:48:32 +0000