summaryrefslogtreecommitdiffstats
path: root/apps
AgeCommit message (Collapse)Author
2022-05-27Fix the incorrect checks of EVP_CIPHER_CTX_rand_keyPeiwei Hu
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18397) (cherry picked from commit f15e3f3aa95df743f0da793da952f87370efb4ff)
2022-05-27Fix the incorrect checks of EVP_CIPHER_CTX_set_key_lengthPeiwei Hu
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18397) (cherry picked from commit 8d9fec1781751d2106d899c6076eeb3da6930bfe)
2022-05-24Fix check of EVP_CIPHER_CTX_ctrlPeiwei Hu
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18368) (cherry picked from commit d649c51a5388912277dffb56d921eb720db54be1)
2022-05-06s_serve: Report an error if init-connection fails without an attempt to read.Daniel Fiala
Fixes: openssl#18047. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18154) (cherry picked from commit a6d52f178c4cb4665d0bf235001b5c9c1ff03da7)
2022-05-05s_client -proxy / -starttls shouldn't be mutually exclusiveVita Batrla
The option -proxy of openssl s_client works fine. The option -starttls also works fine. However, try putting both of them on command line. It breaks, these options don't work together. The problem is that -proxy option is implemented using starttls_proto (the option parsing code sets it to PROTO_CONNECT) and -starttls option overwrites the same variable again based on argument value. The suggested fix is to independently handle -proxy option before -starttls so the s_client can connect through HTTP proxy server and then use STARTTLS command. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17925) (cherry picked from commit 802cacf34f2db9111becb4f0d3aa00460df13a19)
2022-05-04openssl: dhparam: Print warning if -in argument is ignoredDaniel Fiala
Fixes: openssl#18146 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18206) (cherry picked from commit 6d952291762246f6533e19ca413277390db4aae2)
2022-05-03Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2022-04-21str[n]casecmp => OPENSSL_strncasecmpDmitry Belyavskiy
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18103)
2022-04-21Fix a possible NULL pointer dereference in create_cert_store()Zhou Qingyang
In create_cert_store(), X509_STORE_new() is called and there is a dereference of it in following function X509_STORE_add_lookup() without check, which could lead to NULL pointer dereference. Fix this by adding a NULL check of X509_STORE_new() Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18057) (cherry picked from commit 3f075967f664aac12951a1d7aa3124d9235cd299)
2022-04-21Fix wild pointer dereference in make_ocsp_response()Zhou Qingyang
The function OCSP_basic_add1_status() will return NULL on malloc failure. However the return value is not checked before being passed to OCSP_SINGLERESP_add1_ext_i2d(), and there is a wild field pointer, which could lead to wild pointer dereference. Fix this by adding return value check Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18081) (cherry picked from commit 4d50a5467b0a208c61d163239a3544bae06343ea)
2022-04-01req, x509: Allow printing modulus of RSA-PSS keysTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17990) (cherry picked from commit e4cdcb8bc44250aa4e0893dc4a7d64668f0fb949)
2022-03-22Make `openssl check -rsa ...` to work for both RSA and RSA-PSS.Daniel Fiala
Fixes openssl#17167 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17920)
2022-03-15Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2022-03-14check return value of functions that call BIO_new() internallyxkernel
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17821)
2022-03-10Set protocol in init_client()Todd Short
If TCP is being used, protocol = 0 is passed to init_client(), then protocol == IPPROTO_TCP fails when attempting to set BIO_SOCK_NODELAY. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17838) (cherry picked from commit 54b6755702309487ea860e1cc3e60ccef4cf7878)
2022-03-10check the return value of BIO_new_file()xkernel
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17820) (cherry picked from commit 625b0990a069a18917341e2f0fbe36327b0883b7)
2022-03-04Enable openssl req -x509 to create certificates from CSRsHugo Landau
`openssl req -x509` has code allowing it to generate certificates from CSRs as a replacement for `openssl x509`, but a bug prevents it from working properly. -CA and -CAkey can now be passed to generate a CA-signed certificate as documented in openssl-req(1). Regression testing has been added to `openssl req`. Backport of #17782 to 3.0. Fixes #17736. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17805)
2022-03-03s_server: Do not use SSL_sendfile when KTLS is not being usedHugo Landau
Fix a bug in `openssl s_server -WWW` where it would attempt to invoke `SSL_sendfile` if `-ktls -sendfile` was passed on the command line, even if KTLS has not actually been enabled, for example because it is not supported by the host. Since `SSL_sendfile` is only supported when KTLS is actually being used, this resulted in a failure to serve requests. Fixes #17503. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17788) (cherry picked from commit aea68b0ddb7113b982ab503bf830d641e8425759)
2022-02-28check the return value of CRYPTO_strdup()xkernel
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17741) (cherry picked from commit 37be6feeebfec87733e5cb4762fc12bebba9f124)
2022-02-17apps/s_server: Add missing check for BIO_newJiasheng Jiang
As the potential failure of the BIO_new(), it should be better to check the return value and return error if fails in order to avoid the dereference of NULL pointer. And because 'bio_s_msg' is checked before being used everytime, which has no need to add the check. But 'bio_s_out' is not. And since the check 'if (bio_s_out == NULL)' is redundant, it can be removed to make the code succincter. Also the 'sbio' and so forth should be checked like the other places in the same file. Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17710) (cherry picked from commit ba0b60c632ae9c5590b59184281baaf0a39f0c24)
2022-02-17apps/ocsp: Add check for OPENSSL_strdupJiasheng Jiang
Just assert 'bn' to be non-NULL is not enough. The check for 'itmp' is still needed. If 'bn' is 0, the 'itmp' is assigned by OPENSSL_strdup(). Since OPENSSL_strdup() may fail because of the lack of memory, the 'itmp' will be NULL and be an valid parameter hashed in TXT_DB_get_by_index(), returning a wrong result. Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17677) (cherry picked from commit 8f084b43803d53e15d83ed130210f026f84679ff)
2022-02-17s_server: Add check for OPENSSL_strdupJiasheng Jiang
Since the OPENSSL_strdup() may return NULL if allocation fails, the 'port' could be NULL. And then it will be used in do_server(), which can accept NULL as an valid parameter. That means that the system could run with a wrong parameter. Therefore it should be better to check it, like the other memory allocation. Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17673) (cherry picked from commit 0c5905581e9d1d79d62cac56a0e3c2ed487afecf)
2022-02-14openssl rehash: add check for OPENSSL_strdupJiasheng Jiang
As the potential failure of the memory allocation, it should be better to check the return value of OPENSSL_strdup() and return error if fails. Also, we need to restore the 'ep' to be NULL if fails. Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17676) (cherry picked from commit 79cda38cff834224fb9d86dc7433b4f60688ce49)
2022-02-11Added checking for buflen overflow due to MAX_MISALIGNMENT.Kevin K Biju
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17646) (cherry picked from commit 4b3777c9ad4a2058a9b87afb26289039ebf4a6c1)
2022-02-09Send auxiliary messages to bio_err.Daniel
Fixes openssl#17613. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17650) (cherry picked from commit 2a6994cfa08368a710d66caaae4fc07ad35631bf)
2022-02-07Fix SIZE_MAX not defined on z/OS etcAnkit Das
Fixes openssl#17629 by including internal/numbers.h which defines SIZE_MAX CLA: trivial Fixes #17629 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17632) (cherry picked from commit 25a0a44dc6223e515f5e91e41798cccf09c5612b)
2022-02-03Fix copyrightsTodd Short
Add copyright to files that were missing it. Update license from OpenSSL to Apache as needed. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17606) (cherry picked from commit 9d987de3aabe54e65a55649a61953966f33b070b)
2022-02-02apps/progs.pl: use SOURCE_DATE_EPOCH if defined for copyright yearRoss Burton
As with 11d7d903, use SOURCE_DATE_EPOCH for the copyright year if it is defined, to avoid reproducibility problems. CLA: trivial Signed-off-by: Ross Burton <ross.burton@arm.com> Change-Id: I1bea19070411a69155c43de7082350fb2c499da3 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17601) (cherry picked from commit 27aca04e13ca8a9bead49de7bc380110ecb7064e)
2022-01-27Ensure ciphers command honours -propqueryMatt Caswell
Any propquery passed via the -propquery option to the ciphers command was being ignored. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17595) (cherry picked from commit 4ed381736b063284bdbd5d302988617aa4366a3f)
2022-01-24s_server: correctly handle 2^14 byte long recordsHubert Kario
as the code uses BIO_gets, and it always null terminates the strings it reads, when it reads a record 2^14 byte long, it actually returns 2^14-1 bytes to the calling application, in general it returns size-1 bytes to the caller This makes the code sub-optimal (as every 2^14 record will need two BIO_gets() calls) and makes it impossible to use -rev option to test all plaintext lengths (like in openssl#15706) Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17553)
2022-01-14coverity 1497107: dereference after null checkPauli
Add null checks to avoid dereferencing a pointer that could be null. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/17488)
2022-01-12pkeyutl: Fix regression with -kdflen optionTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17461) (cherry picked from commit b82fd89d8bae1445c89ec90d1a6145fe3216d2d7)
2022-01-11Fix: some patches related to error exitingPeiwei Hu
Signed-off-by: Peiwei Hu <jlu.hpw@foxmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17443)
2022-01-05apps/passwd.c: free before error exitingPeiwei Hu
use goto instead of returning directly while error handling Signed-off-by: Peiwei Hu <jlu.hpw@foxmail.com> Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17404) (cherry picked from commit ea4d16bc60dee53feb71997c1e78379eeb69b7ac)
2022-01-04app_http_tls_cb: Fix double-free in case TLS not usedDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17400) (cherry picked from commit 97b8c859c64bc60fcf5bb27ed51489c81fde41b3)
2022-01-04HTTP client: Work around HTTPS proxy use bug due to callback design flawDr. David von Oheimb
See discussion in #17088, where the real solution was postponed to 4.0. This preliminarily fixes the issue that the HTTP(S) proxy environment vars were neglected when determining whether a proxy should be used for HTTPS. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17310) (cherry picked from commit 068549f8db6d792a88bb888118001c4582f79074)
2021-12-29Ensure s_client sends SNI data when used with -proxyMatt Caswell
The use of -proxy prevented s_client from correctly sending the target hostname as SNI data. Fixes #17232 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17248) (cherry picked from commit ea24196ef224d3aa3aaecb8000004bb7a0a100a2)
2021-12-22HTTP client: Fix cleanup of TLS BIO via 'bio_update_fn' callback functionDr. David von Oheimb
Make app_http_tls_cb() tidy up on disconnect the SSL BIO it pushes on connect. Make OSSL_HTTP_close() respect this. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17318) (cherry picked from commit cdaf072f90399efb9e8e19ee4f387d1425f12274)
2021-12-15APPS/cmp: Fix logic and doc of mutually exclusive ↵Dr. David von Oheimb
-server/-use_mock_srv/-port/-rspin options Ignore -server with -rspin and exclude all of -use_mock_srv/-port/-rspin. On the other hand, -server is required if no -use_mock_srv/-port/-rspin is given. Ignore -tls_used with -use_mock_srv and -rspin; it is not supported with -port. If -server is not given, ignore -proxy, -no_proxy, and -tls_used. Also slightly improve the documentation of the two mock server variants. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17254) (cherry picked from commit a56bb5d64e7599140117f935eeeb34ba94c83aea)
2021-12-14Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2021-12-09APPS/cmp: Fix use of OPENSSL_NO_SOCK: options like -server do not make sense ↵Dr. David von Oheimb
with no-sock Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17226) (cherry picked from commit 83b424c3f60a4401fa3e6e41ff7f08e85ee9df94)
2021-12-09APPS/cmp: fix -rspin option such that it works again without -reqinDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17222) (cherry picked from commit 7ee0954a086ee3b4e0a8c6736600e3d6362485c0)
2021-12-02s_cb.c: check the return value of X509_get0_pubkey()x2018
Check is done to prevent wrong memory access by EVP_PKEY_get0_asn1() Also fix wrong coding style in the s_cb.c file. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17176) (cherry picked from commit 5fae09f3d8da7c182c6cfb6a295dcfd15ae828ae)
2021-11-29Return -1 properly from do_X509_REQ_verify and do_X509_verifyPW Hu
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17001) (cherry picked from commit bc42cf51c8b2a22282bb3cdf6303e230dc7b7873)
2021-11-25check the return value of OPENSSL_strdup(CRYPTO_strdup) in ↵x2018
apps/lib/app_rand.c:32 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17124) (cherry picked from commit 3e0441520b9a349dc50662919ea18f03dfc0d624)
2021-11-25check the return value of OPENSSL_strdup(CRYPTO_strdup) to prevent potential ↵x2018
memory access error Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17113) (cherry picked from commit b9648f31a4917b8594caebda3e6d8d313514fe24)
2021-11-25check the return value of OPENSSL_strdup to prevent potential memory access ↵x2018
error Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17110) (cherry picked from commit dc7e42c6a12637bae1660561d3f4cef039001475)
2021-11-22SSL_export_keying_material: fix return checkPeiwei Hu
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17028) (cherry picked from commit 40649e36c4c0c9438f62e1bf2ccb983f6854c662)
2021-11-17Fix verbosity of CMP client diagnosticsDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16051)
2021-11-16EVP_PKEY_keygen_init: fix return checkPeiwei Hu
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17031) (cherry picked from commit bf4ceeded1497c79e72fba4f9ff15febae58108d)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-04 18:24:36 +0000