summaryrefslogtreecommitdiffstats
path: root/apps
AgeCommit message (Collapse)Author
2019-12-20Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10664)
2019-10-28Fix an s_server arbitrary file read issue on WindowsMatt Caswell
Running s_server in WWW mode on Windows can allow a client to read files outside the s_server directory by including backslashes in the name, e.g. GET /..\myfile.txt HTTP/1.0 There exists a check for this for Unix paths but it is not sufficient for Windows. Since s_server is a test tool no CVE is assigned. Thanks to Jobert Abma for reporting this. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10215) (cherry picked from commit 0a4d6c67480a4d2fce514e08d3efe571f2ee99c9)
2018-09-04openssl req: don't try to report bitsRichard Levitte
With the introduction of -pkeyopt, the number of bits may change without |newkey| being updated. Unfortunately, there is no API to retrieve the information from a EVP_PKEY_CTX either, so chances are that we report incorrect information. For the moment, it's better not to try to report the number of bits at all. Fixes #7086 Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7096) (cherry picked from commit 17147181bd3f97c53592e2a5c9319b854b954039)
2018-08-14Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6955)
2018-06-25Fix some more gcc-9 warnings [-Wstringop-truncation]Bernd Edlinger
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6586)
2018-05-31apps: when the 'compat' nameopt has been set, leave it beRichard Levitte
XN_FLAG_COMPAT has a unique property, its zero for value. This means it needs special treatment; if it has been set (which can only be determined indirectly) and set alone (*), no other flags should be set. (*) if any other nameopt flag has been set by the user, compatibility mode is blown away. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6382) (cherry picked from commit 3190d1dca43ecfd748c06aa06752de06af3768b9)
2018-05-13Fix memory leaks in CA related functions.Pavel Kopyl
(cherry picked from commit aebd0e5ca12d1ba0b229a4121a54afa5ea2d8aa1) Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6238)
2018-04-27s_server: fix warnings unused-but-set-variable (no-dh)Cristian Stoica
This patch fixes the following two warnings when OpenSSL is built with no-dh option: s_server.c: In function 's_server_main': s_server.c:1105:25: warning: variable 'no_dhe' set but not used [-Wunused-but-set-variable] int no_tmp_rsa = 0, no_dhe = 0, no_ecdhe = 0, nocert = 0; ^ s_server.c:1101:11: warning: variable 'dhfile' set but not used [-Wunused-but-set-variable] char *dhfile = NULL; ^ CLA: trivial Signed-off-by: Cristian Stoica <cristian.stoica@nxp.com> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6087)
2018-04-25Fix documentation for the -showcerts s_client optionMatt Caswell
This option shows the certificates as sent by the server. It is not the full verified chain. Fixes #4933 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6069)
2018-04-19apps/s_socket.c: Fix do_acceptRichard Levitte
do_accept() checked that the peer IP address had a PTR record, and would fail if not. The retrieved named was then never used, even though passed around. All this is unnecessary, so we remove it. Fixes #3407 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6018)
2018-04-19Fix ocsp app exit codeMatt Caswell
If we run the ocsp command line app and the responder returns a non-successful status code then the app should exit with a failure code. Based on an original patch by Tatsuhiro Tsujikawa. Fixes #2387 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5999) (cherry picked from commit 2add645dfc364cfc609e6138de1bf43c217bb557)
2018-04-03Change the "offset too large" message to more generic wordingBernd Edlinger
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/5826) (cherry picked from commit 1518c55a796b058eff01f3cbf177f4b726c01d7c)
2018-04-03Fix range checks with -offset and -length in asn1parseBernd Edlinger
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/5826) (cherry picked from commit 16e1eea6a67c85c9d786f3c4448182b1aca101b8)
2018-04-03Fix a crash in the asn1parse commandBernd Edlinger
Thanks to Sem Voigtländer for reporting this issue. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/5826) (cherry picked from commit 752837e0664e990b5edf6f0b69e1b4612efadce0)
2018-03-27Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2018-03-26Fix dsaparam -genkey with DER outformBernd Edlinger
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5744) (cherry picked from commit 5281435258b5d8201a00b4a9781bb724d99630f0)
2018-03-25Fix ecparam -genkey with point compression or DER outformBernd Edlinger
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5741) (cherry picked from commit 4bdc25b07f007d9c383fbad159f81543f2e95965)
2018-03-15Fix a memory leak in the ca applicationMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5445)
2018-03-15Allow multiple entries without a Subject even if unique_subject == yesMatt Caswell
It is quite likely for there to be multiple certificates with empty subjects, which are still distinct because of subjectAltName. Therefore we allow multiple certificates with an empty Subject even if unique_subject is set to yes. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5445)
2018-03-15Report a readable error on a duplicate cert in ca appMatt Caswell
Commit 87e8fec (16 years ago!) introduced a bug where if we are attempting to insert a cert with a duplicate subject name, and duplicate subject names are not allowed (which is the default), then we get an unhelpful error message back (error number 2). Prior to that commit we got a helpful error message which displayed details of the conflicting entry in the database. That commit was itself attempting to fix a bug with the noemailDN option where we were setting the subject field in the database too early (before extensions had made any amendments to it). This PR moves the check for a conflicting Subject name until after all changes to the Subject have been made by extensions etc. This also, co-incidentally Fixes the ca crashing bug described in issue 5109. Fixes #5109 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5445)
2018-03-15Revert "Don't crash on a missing Subject in index.txt"Matt Caswell
This reverts commit a3d684ffca282796511cb8f3593a59a80109eed8. Empty Subjects are permissible Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5445)
2018-03-15Revert "Don't allow an empty Subject when creating a Certificate"Matt Caswell
This reverts commit dd37f6f12cc14cc4710289746b112eb0fed3b0b7. Empty Subjects are permissible. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5445)
2018-02-21do_body: fix heap-use-after-free.Pavel Kopyl
The memory pointed to by the 'push' is freed by the X509_NAME_ENTRY_free() in do_body(). The second time it is referenced to (indirectly) in certify_cert:X509_REQ_free(). Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4896)
2018-01-22Don't crash on a missing Subject in index.txtMatt Caswell
An index.txt entry which has an empty Subject name field will cause ca to crash. Therefore check it when we load it to make sure its not empty. Fixes #5109 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5115)
2018-01-22Don't allow an empty Subject when creating a CertificateMatt Caswell
Misconfiguration (e.g. an empty policy section in the config file) can lead to an empty Subject. Since certificates should have unique Subjects this should not be allowed. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5115)
2018-01-05Corrected 'cms' exit status when key or certificate cannot be openedKonstantin Shemyak
A backport of #4997. Fixes #4996. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/5020)
2017-12-08Standardize syntax around sizeof(foo)Rich Salz
Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4875)
2017-11-13Resolve warnings in VC-WIN32 build, which allows to add /WX.Andy Polyakov
It's argued that /WX allows to keep better focus on new code, which motivates its comeback... Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4718)
2017-11-03Add error handling in dsa_main and ASN1_i2d_bio.Pavel Kopyl
CLA: trivial Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/4600) (cherry picked from commit a6f622bc99ffdc7b34199babb9d200b24a7a6431)
2017-09-26Make sure that a cert with extensions gets version number 2 (v3)Richard Levitte
Fixes #4419 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4421)
2017-08-09Add missing HTML tag in www_body in s_server.cXiaoyin Liu
In the generated HTML document, the `<pre>` tag is not closed. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4088) (cherry picked from commit 1a9f5cf0d58629ab8972f50e937d8ab78bf27b6f)
2017-07-24schlock global variable needs to be volatileXiaoyin Liu
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4000) (cherry picked from commit e0de4dd5a2b0c0dc27e6a6ab01fabe374d657d23)
2017-07-20Fix apps/s_client.c's XMPP clientRichard Levitte
When an error occurs during the starttls handskake, s_client gets stuck looping around zero bytes reads, because the server won't sent anything more after its error tag. Shutting down on the first zero byte read fixes this. Fixes #3980 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3981)
2017-06-25tsget: remove call of WWW::Curl::Easy::global_cleanupRichard Levitte
This function is undocumented, but similarly named functions (such as 'curl_global_cleanup') are documented as internals that should not be called by scripts. Fixes #3765 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3769)
2017-06-10Fix possible usage of NULL pointers in apps/spkac.cPaul Yang
Check return value of NETSCAPE_SPKI_new() and NETSCAPE_SPKI_b64_encode(), and also clean up coding style incidentally. Signed-off-by: Paul Yang <paulyang.inf@gmail.com> Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3647) (cherry picked from commit f2582f08d5167ee84b7b313fd1435fe91ee44880)
2017-06-09Fix speed command for alternation of ciphers and digests.Jonathan Protzenko
CLA: trivial Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3487) (cherry picked from commit 9ae4e664da0692f27bfe0d1a34db29ed815203c8)
2017-06-01Fix srp app missing NULL termination with password callbackDiego Santa Cruz
The password_callback() function does not necessarily NULL terminate the password buffer, the caller must use the returned length but the srp app uses this function as if it was doing NULL termination. This made the -passin and -passout options of "openssl srp" fail inexpicably and randomly or even crash. Fixed by enlarging the buffer by one, so that the maximum password length remains unchanged, and adding NULL termination upon return. [Rearrange code for coding style compliance in process.] This backport of 0e83981d61fc435f42d4bb4d774272b69556b7bc. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3579)
2017-05-17Fix regression in openssl req -x509 behaviour.Tomas Mraz
Allow conversion of existing requests to certificates again. Fixes the issue #3396 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3485)
2017-04-13pkeyutl exit with 0 if the verification succeededjunfx
If exiting non-zero, which not consistent with shell conventions, the shells/scripts treat the cmd as failed. CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3213)
2017-04-03Ensure dhparams can handle X9.42 params in DERMatt Caswell
dhparams correctly handles X9.42 params in PEM format. However it failed to correctly processes them when reading/writing DER format. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3112)
2017-03-29Free the compression methods in s_server and s_clientMatt Caswell
This causes a minor (64 bytes on my machine) mem leak in s_server/s_client. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3040)
2017-03-10make updateRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2889)
2017-03-10Fix apps/progs.pl to generate correctly formatted progs.hRichard Levitte
It was still generating EAY style source. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2889)
2017-03-09Make the output of enc -ciphers identicalPauli
even if run several times in a session. This amounts to moving the column counter so it isn't a function local static variable and reinitialising it each time. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2884) (cherry picked from commit 2b305ab02e0977ed71c255cc386ff75c397d7820)
2017-03-09Fix build problem with current 1.0.2 branch.Bernd Edlinger
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2883)
2017-03-08Limit the output of the enc -ciphers commandPauli
to just the ciphers enc can process. This means no AEAD ciphers and no XTS mode. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2876) (cherry picked from commit 777f1708a88f85569304caeca197c96ef912b236) (cherry picked from commit b97324dbcb12e8b509d513ded9ba3f71c14547d8)
2017-03-03Add missing usage hints how to generate primes.Bernd Edlinger
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2834)
2017-02-21Fix some more memory leaks with TXT_DB_insert.Bernd Edlinger
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2685)
2017-02-21Fix a few memleaks in TXT_DB.Bernd Edlinger
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2685)
2017-02-15Fix some realloc error handling issues.Bernd Edlinger
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2625)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-01 22:36:22 +0000