summaryrefslogtreecommitdiffstats
path: root/apps
AgeCommit message (Collapse)Author
2018-04-25openssl rehash: exit 0 on warnings, same as c_rehashRichard Levitte
Fixes #6083 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6084)
2018-04-25Fix documentation for the -showcerts s_client optionMatt Caswell
This option shows the certificates as sent by the server. It is not the full verified chain. Fixes #4933 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6067)
2018-04-25apps/opt.c: Remove the access checks of input and output filesRichard Levitte
open() will take care of the checks anyway Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6033)
2018-04-25Better check of return values from app_isdir and app_accessRichard Levitte
[extended tests] Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6033)
2018-04-25Revert "Check directory is able to create files for various -out option"Richard Levitte
This reverts commit 555c94a0db9661428da0a45cb32b9f002324eefd. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6033)
2018-04-25Revert "Add VMS version of app_dirname()"Richard Levitte
This reverts commit 215a6730f1eaf53b01a4eb10d75bd09fd74f70cc. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6033)
2018-04-25Revert "Check on VMS as well"Richard Levitte
This reverts commit f6d765988f37c43edb1056ab83165f2569182e9d. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6033)
2018-04-23Fix openssl ca, to correctly make output file binary when using -spkacRichard Levitte
On Unix, this doesn't matter, but on other platforms, it may. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6050)
2018-04-23Fix late opening of output fileRichard Levitte
For 'openssl dhparams', the output file was opened after calculations were made, which is a waste of cycles and time if the output file turns out not to be writable. Fixes #3404 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6051)
2018-04-19Enable all implemented digestsRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6025)
2018-04-19correct spelling errors detected by Debian lintianA. Schulze
CLA: trivial Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5801)
2018-04-19Fix ocsp app exit codeMatt Caswell
If we run the ocsp command line app and the responder returns a non-successful status code then the app should exit with a failure code. Based on an original patch by Tatsuhiro Tsujikawa. Fixes #2387 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5998)
2018-04-18Add missing index_index() when reloading OCSP responderViktor Dukhovni
Also, future-proof index_index() return codes by requiring success to return a positive value. Reviewed-by: Rich Salz <rsalz@openssl.org>
2018-04-18apps/s_socket.c: fix memory sanitizer problem in ACCEPT printout.Andy Polyakov
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5994)
2018-04-17apps/s_socket.c: print only dynamically allocated port in do_server.Andy Polyakov
For formal backward compatibility print original "ACCEPT" message for fixed port and "ACCEPT host:port" for dynamically allocated. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5956)
2018-04-12openssl rehash: use libcrypto variables for default dirRichard Levitte
X509_get_default_cert_dir_env() returns the default environment variable to check for certificate directories. X509_get_default_cert_dir() returns the default configured certificate directory. Use these instead of hard coding our own values, and thereby be more integrated with the rest of OpenSSL. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5937)
2018-04-08apps/{s_client.c|s_socket}.c: omit usleep calls.Andy Polyakov
Even though removed calls were oiriginally added on Windows, problem they tried to mitigate is not Windows-specific. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5887)
2018-04-08apps/s_socket.c: disable the Nagle algorithm.Andy Polyakov
Without TCP_NODELAY alerts risk to be dropped between shutdown and close. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5887)
2018-04-06Duplicate code refactoredKaoru Toda
add_attribute_object and add_DN_object have similar code, so move it into a common function build_data. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4566)
2018-04-06Add a note and better error if using Ed25519/Ed448 in dgstMatt Caswell
Fixes #5873 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5880)
2018-04-04openssl s_server: print the accepting address and socketRichard Levitte
The line saying ACCEPT is extended with a space followed by the the address and port combination on which s_server accepts connections. The address is written in such a way that s_client should be able to accepts as argument for the '-connect' option. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5843)
2018-04-03Change the "offset too large" message to more generic wordingBernd Edlinger
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/5826)
2018-04-03Remove an unnecessary cast in the param to BUF_MEM_growBernd Edlinger
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/5826)
2018-04-03Fix range checks with -offset and -length in asn1parseBernd Edlinger
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/5826)
2018-04-03Use strtol instead of atoi in asn1parseBernd Edlinger
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/5826)
2018-04-03Improve diagnostics for invalid arguments in asn1parse -strparseBernd Edlinger
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/5826)
2018-04-03Fix a crash in the asn1parse commandBernd Edlinger
Thanks to Sem Voigtländer for reporting this issue. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/5826)
2018-03-26Previously this x509 command line was working, restore thatBernd Edlinger
openssl x509 -in server.pem -signkey privkey.pem -out server.pem Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5746)
2018-03-26Fix dsaparam -genkey with DER outformBernd Edlinger
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5744)
2018-03-25Fix ecparam -genkey with point compression or DER outformBernd Edlinger
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5741)
2018-03-22Fix resource filesRich Salz
Add it to apps as well as libraries. Fix the copyright year generation. Thanks to user RTT for pointing this out. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5704)
2018-03-22Don't call strsignal, just print the signal number.Pauli
The strsignal call is not supported by some machines, so avoid its use. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5658)
2018-03-21Unify s_client/s_server srtp profiles option handlingFdaSilvaYY
Add missing guards around STRP-related fields Remove two unneeded global variables: my 2'cents to #4679 Merge definition and instantiation of srpsrvparm global. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4908)
2018-03-21Cleanup the s_time command.Bernd Edlinger
Various code-cleanups. Use SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY) insead of handling SSL_ERROR_WANT_READ everywhere. Turn off the linger option on connected sockets to avoid failure. Add BIO_set_conn_mode(conn, BIO_SOCK_NODELAY) to improve thruput. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3952)
2018-03-21aix compat fixes for ocsp.cEric Covener
WCOREDUMP and vsyslog are not portable Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5657)
2018-03-20Make pkeyutl a bit more user-friendlyJohannes Bauer
Give meaningful error messages when the user incorrectly uses pkeyutl. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3987)
2018-03-20Fix the OCSP responder modeMatt Caswell
Broken by commit 3e3c7c36. Fixes #5681 Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/5688)
2018-03-20Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5689)
2018-03-19s_client, s_server: do generic SSL configuration first, specialization afterRichard Levitte
We did the SSL_CONF_cmd() pass last of all things that could affect the SSL ctx. However, the results of this, for example: -max_protocol TLSv1.3 -tls1_2 ... would mean that the protocol min got set to TLSv1.2 and the protocol max to TLSv1.3, when they should clearly both be TLSv1.2. However, if we see the SSL_CONF_cmd() switches as generic and those internal to s_client and s_server as specialisations, we get something that makes a little more sense. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5679)
2018-03-19Support "-min_protocol" and "-max_protocol" in s_server and s_clientRichard Levitte
If for nothing else, they are needed when doing a regression test Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5663)
2018-03-19Fix no-posix-io compile failureMatt Caswell
The fix in conf_include_test.c seems to be required because some compilers give an error if you give an empty string for the second argument to strpbrk(). It doesn't really make sense to send an empty string for this argument anyway, so make sure it has at least one character in it. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/5666)
2018-03-19Add SM2 signature and ECIES schemesJack Lloyd
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4793)
2018-03-15VMS: add alias macros to avoid 31 character symbol name limit warningRichard Levitte
Affected symbol names: generate_stateless_cookie_callback verify_stateless_cookie_callback Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5633)
2018-03-15Fix a memory leak in the ca applicationMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5444)
2018-03-15Allow multiple entries without a Subject even if unique_subject == yesMatt Caswell
It is quite likely for there to be multiple certificates with empty subjects, which are still distinct because of subjectAltName. Therefore we allow multiple certificates with an empty Subject even if unique_subject is set to yes. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5444)
2018-03-15Report a readable error on a duplicate cert in ca appMatt Caswell
Commit 87e8feca (16 years ago!) introduced a bug where if we are attempting to insert a cert with a duplicate subject name, and duplicate subject names are not allowed (which is the default), then we get an unhelpful error message back (error number 2). Prior to that commit we got a helpful error message which displayed details of the conflicting entry in the database. That commit was itself attempting to fix a bug with the noemailDN option where we were setting the subject field in the database too early (before extensions had made any amendments to it). This PR moves the check for a conflicting Subject name until after all changes to the Subject have been made by extensions etc. This also, co-incidentally fixes the ca crashing bug described in issue 5109. Fixes #5109 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5444)
2018-03-15Revert "Don't allow an empty Subject when creating a Certificate"Matt Caswell
This reverts commit e505f1e86874acfd98826d64c53bf2ddfd9c1399. Empty Subjects should be permissible. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5444)
2018-03-15Revert "Don't crash on a missing Subject in index.txt"Matt Caswell
This reverts commit 1e05c6d07ff963107286d028f6778d2ccc863a9a. Empty subjects should be permissible. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5444)
2018-03-15Rename EVP_PKEY_new_private_key()/EVP_PKEY_new_public_key()Matt Caswell
Renamed to EVP_PKEY_new_raw_private_key()/EVP_new_raw_public_key() as per feedback. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5520)
2018-03-15Add support for setting raw private HMAC keysMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5520)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-14 18:26:03 +0000