summaryrefslogtreecommitdiffstats
path: root/apps
AgeCommit message (Collapse)Author
2019-11-08Add "sections" to -help outputRich Salz
Remove "Valid options" label, since all commands have sections (and [almost] always the first one is "General options"). Have "list --options" ignore section headers Reformat ts's additional help Add output section Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9953)
2019-11-07Update source files for deprecation at 3.0Richard Levitte
Previous macros suggested that from 3.0, we're only allowed to deprecate things at a major version. However, there's no policy stating this, but there is for removal, saying that to remove something, it must have been deprecated for 5 years, and that removal can only happen at a major version. Meanwhile, the semantic versioning rule is that deprecation should trigger a MINOR version update, which is reflected in the macro names as of this change. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10364)
2019-11-04Fix no-sm2 issuePaul Yang
Some code is not covered by the macros. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10319)
2019-11-03Add -CAstore and similar to all openssl commands that have -CApathRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8442)
2019-10-30apps/dgst.c: allocate a new signature bufferPavel Karagodin
... if the fixed-size buffer is too small. Fixes #9732 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com> (Merged from https://github.com/openssl/openssl/pull/10276)
2019-10-28Fix an s_server arbitrary file read issue on WindowsMatt Caswell
Running s_server in WWW mode on Windows can allow a client to read files outside the s_server directory by including backslashes in the name, e.g. GET /..\myfile.txt HTTP/1.0 There exists a check for this for Unix paths but it is not sufficient for Windows. Since s_server is a test tool no CVE is assigned. Thanks to Jobert Abma for reporting this. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10215)
2019-10-28Cleanup hardcoded cipher suite codepoints in s_serverJohannes Bauer
The hardcoded code points for TLSv1.3 cipher suites are used in the TLS PSK server callback. However, they seem to have been refactored a while ago to use tls13_aes128gcmsha256_id, so these defines are not necessary within the s_server code anymore. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10243)
2019-10-18Update dgst.c to show a list of message digestsagnosticdev
Fixes #9893 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/9912)
2019-10-17Replace BUF_ string function calls with OPENSSL_ onesRich Salz
Deprecate the BUF_ string macros Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10207)
2019-10-17'openssl list' and 'openssl provider': adapt display of multiple namesRichard Levitte
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9979)
2019-10-16Fix typo and create compatibility macroAndreas Schnebinger
CLA:trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/9472)
2019-10-15Remove duplicated line in 'openssl list' outputRich Salz
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10150)
2019-10-14Add BN_check_prime()Kurt Roeckx
Add a new API to test for primes that can't be misused, deprecated the old APIs. Suggested by Jake Massimo and Kenneth Paterson Reviewed-by: Paul Dale <paul.dale@oracle.com> GH: #9272
2019-10-11Ignore empty ALPN elements in CLI argsViktor Dukhovni
Reviewed-by: Matt Caswell <matt@openssl.org>
2019-10-09Explicitly test against NULL; do not use !p or similarRich Salz
Also added blanks lines after declarations in a couple of places. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9916)
2019-10-09Refactor -passin/-passout documentationRich Salz
Always refer to openssl.pod instead of repeating the same description everywhere. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10126)
2019-10-07Support SM2 in apps/speedPaul Yang
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10053)
2019-10-06Also mention -- flag and ignore if undocumentedRich Salz
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10077)
2019-10-05Add missing help text for some optionsRich Salz
Fixes: #9952 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/9989)
2019-09-30Fix a bundle of mischecks of return valuesPaul Yang
Several EVP_PKEY_xxxx functions return 0 and a negative value for indicating errors. Some places call these functions with a zero return value check only, which misses the check for the negative scenarios. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10055)
2019-09-30Fix a return value bug in apps/speed.cPaul Yang
Those functions returns less than and equal to 0 to indicate an error occured. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10054)
2019-09-27Consistent naming for context gettable param queries .Pauli
All instances of EVP_*_CTX_gettable_params functions have been renamed to EVP_*_gettable_ctx_params. Except for the EVP_MD ones which were changed already. These functions do not take EVP_*_CTX arguments so their prior naming was misleading. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10052)
2019-09-29Fix a double free issue when signing SM2 certPaul Yang
If the SM2 ID value has not been passed correctly when signing an SM2 certificate/certificate request, a double free occurs. For instance: openssl req -x509 ... -sm2-id 1234567812345678 The '-sm2-id' should not be used in this scenario, while the '-sigopt' is the correct one to use. Documentation has also been updated to make the options more clear. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9958)
2019-09-28Fix header file include guard namesDr. Matthias St. Pierre
Make the include guards consistent by renaming them systematically according to the naming conventions below For the public header files (in the 'include/openssl' directory), the guard names try to match the path specified in the include directives, with all letters converted to upper case and '/' and '.' replaced by '_'. For the private header files files, an extra 'OSSL_' is added as prefix. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9333)
2019-09-28Reorganize public header files (part 1)Dr. Matthias St. Pierre
Rename <openssl/ossl_typ.h> to <openssl/types.h>. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9333)
2019-09-25Make EVP_MD_CTX_[gettable|settable]_params() take an EVP_MD_CTXMatt Caswell
EVP_MD_CTX_gettable_params() and EVP_MD_CTX_settable_params() were confusingly named because they did not take an EVP_MD_CTX parameter. In addition we add the functions EVP_MD_gettable_ctx_params() and EVP_MD_settable_ctx_params() which do the same thing but are passed an EVP_MD object instead. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9998)
2019-09-24Fix bugs in "info" commands flagsRich Salz
Remove -c/-e/-m aliases, OpenSSL commands don't do that. Fix typo's in the documentation. Fix -module flag to print the right thing. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9986)
2019-09-23Add TLS version options to s_timeraja-ashok
Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9947)
2019-09-19Add option grouping capability to appsJon Spillett
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9920)
2019-09-17apps/pkcs12: print multiple PKCS#12 safeBag attribute values if presentJon Spillett
Currently the pkcs12 app will only ever print the first value of a multi-value attribute. This is OK for some attributes (e.g. friendlyName, localKeyId) but may miss values for other attributes. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/9751)
2019-09-15Add fips module integrity checkShane Lontis
Add environment variable for setting CONF .include path Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9769)
2019-09-06App updates for KDF provider conversion.Pauli
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9662)
2019-09-04Move libapps.a source to apps/libRichard Levitte
This makes it clearer what's what. The 'openssl' application and its sub-commands remain in apps/ Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9723)
2019-09-04Suppress 'No server certificate CA names sent' messageBilly Brawner
Fixes #9080 Signed-off-by: Billy Brawner <billy@wbrawner.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9710)
2019-09-04New function EVP_CIPHER_free()Richard Levitte
This function re-implements EVP_CIPHER_meth_free(), but has a name that isn't encumbered by legacy EVP_CIPHER construction functionality. We also refactor most of EVP_CIPHER_meth_new() into an internal evp_cipher_new() that's used when creating fetched methods. EVP_CIPHER_meth_new() and EVP_CIPHER_meth_free() are rewritten in terms of evp_cipher_new() and EVP_CIPHER_free(). This means that at any time, we can deprecate all the EVP_CIPHER_meth_ functions with no harmful consequence. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9758)
2019-09-04New function EVP_MD_free()Richard Levitte
This function re-implements EVP_MD_meth_free(), but has a name that isn't encumbered by legacy EVP_MD construction functionality. We also refactor most of EVP_MD_meth_new() into an internal evp_md_new() that's used when creating fetched methods. EVP_MD_meth_new() and EVP_MD_meth_free() are rewritten in terms of evp_md_new() and EVP_MD_free(). This means that at any time, we can deprecate all the EVP_MD_meth_ functions with no harmful consequence. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9758)
2019-09-03Fix Coverity 1453452: Control flow issues (DEADCODE)Pauli
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9749)
2019-09-02Add CPU info to the speed command summaryBernd Edlinger
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9669)
2019-08-30Fix pkeyutl -verifyrecoverMatt Caswell
When performing a pkeyutl -verifyrecover operation the input file is not a hash - it is the signature itself. Therefore don't do the check to make sure it looks like a hash. Fixes #9658 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9731)
2019-08-29Allow an output indentation of zero in apps.Pauli
Previously, it would indent one space even if zero were specified. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9725)
2019-08-28openssl provider: New sub-command, for provider discoveryRichard Levitte
This command is somewhat similar to 'openssl engine', but displays what it can about the given providers. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9697)
2019-08-28Move print_param_types() to libapps, and give it indent argumentRichard Levitte
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9697)
2019-08-27Coverty fixes for MACsRichard Levitte
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9700)
2019-08-27OPENSSL_info(): add the item OPENSSL_INFO_SEED_SOURCE and use itRichard Levitte
'openssl version -r' prints the seed source based on compiler macros. This does not necessarily reflect the library's idea of what seed sources to use, so we reimplement the list of seed sources as a OPENSSL_info() item and display that instead. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9689)
2019-08-24Add app for fips installationShane Lontis
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9634)
2019-08-22openssl dgst, openssl enc: check for end of inputRichard Levitte
The input reading loop in 'openssl dgst' and 'openssl enc' doesn't check for end of input, and because of the way BIO works, it thereby won't detect that the end is reached before the read is an error. With the FILE BIO, an error occurs when trying to read past EOF, which is fairly much ok, except when the command is used interactively, at least on Unix. The result in that case is that the user has to press Ctrl-D twice for the command to terminate. The issue is further complicated because both these commands use filter BIOs on top of the FILE BIO, so a naïve attempt to check BIO_eof() doesn't quite solve it, since that only checks the state of the source/sink BIO, and the filter BIO may have some buffered data that still needs to be read. Fortunately, there's BIO_pending() that checks exactly that, if any filter BIO has pending data that needs to be processed. We end up having to check both BIO_pending() and BIO_eof(). Thanks to Zsigmond Lőrinczy for the initial effort and inspiration. Fixes #9355 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9668)
2019-08-19Get rid of using deprecated function isasciiDmitry Belyavskiy
Avoid using functions deprecated in some libcs (e.g. uClibc-ng). Fixes #9557 Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9628)
2019-08-15Re-implement 'openssl list -mac-algorithms'Richard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8877)
2019-08-15Adapt apps/mac.c to use provider based MACsRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8877)
2019-08-15Prepare EVP_MAC infrastructure for moving all MACs to providersRichard Levitte
Quite a few adaptations are needed, most prominently the added code to allow provider based MACs. As part of this, all the old information functions are gone, except for EVP_MAC_name(). Some of them will reappear later, for example EVP_MAC_do_all() in some form. MACs by EVP_PKEY was particularly difficult to deal with, as they need to allocate and deallocate EVP_MAC_CTXs "under the hood", and thereby implicitly fetch the corresponding EVP_MAC. This means that EVP_MACs can't be constant in a EVP_MAC_CTX, as their reference count may need to be incremented and decremented as part of the allocation or deallocation of the EVP_MAC_CTX. It may be that other provider based EVP operation types may need to be handled in a similar manner. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8877)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-22 14:55:32 +0000