summaryrefslogtreecommitdiffstats
path: root/apps
AgeCommit message (Collapse)Author
2021-03-18apps: fix coverity 966560: division by zeroPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14586)
2021-03-18TS and CMS CAdES-BES: Refactor check_signing_certs() funcs into common ESS funcDr. David von Oheimb
Also constify related CMS/PKCS7 functions and improve error codes thrown. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14503)
2021-03-18apps.c: Fix missing newline in warn_cert_msg() outputDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14503)
2021-03-17apps/crl: Print just the hash value if printing just hashTomas Mraz
This partially reverts the output format change for openssl crl -hash output. Fixes #14546 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14553)
2021-03-15apps: Make load_key_certs_crls to read only what is expectedTomas Mraz
The load_key_certs_crls tried to read the whole input stream instead of returning once expected data is obtained. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14449)
2021-03-15apps: Add maybe_stdin argument to load_certs and set it in pkcs12Tomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14449)
2021-03-14Fix option description for PKCS#12 exportTobias Nießen
Refs: https://github.com/openssl/openssl/pull/4930 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14520)
2021-03-13apps/ts.c: Allow -untrusted arg to refer to multiple sourcesDr. David von Oheimb
This requires moving generally useful functions from apps/cmp.c to apps/lib/apps.c Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14504)
2021-03-12Don't crash if the pkeyopt doesn't have a valueMatt Caswell
All pkeyopt's must have a ":" and a value for the option. Not supplying one can cause a crash Fixes #14494 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14496)
2021-03-12apps: support param argument to init functionsPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14383)
2021-03-11openssl-cmp.pod.in and apps/cmp.c: Various minor do improvementsDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14493)
2021-03-11Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14512)
2021-03-11Check SSL_set1_chain error in set_cert_cbpanda
CLA: trivial Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14469)
2021-03-10Change default algorithms in PKCS12_create() and PKCS12_set_mac()Tomas Mraz
Use the modern defaults as now set in the pkcs12 app. This also allows modifying the application to not override the default values when calling the API. Fixes #14034 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/14450)
2021-03-09apps/pkcs12: Allow continuing on absent macTomas Mraz
Just print a warning in that case. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14445)
2021-03-09apps/pkcs12: Detect missing PKCS12KDF support on importTomas Mraz
Report error message with hint to use -nomacver if MAC verification is not required. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14445)
2021-03-09apps/pkcs12: Properly detect MAC setup failureTomas Mraz
The MAC requires PKCS12KDF support which is not present in FIPS provider as it is not an approved KDF algorithm. Suggest using -nomac if MAC is not required. Fixes #14057 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14445)
2021-03-06apps/x509.c: Rename -signkey to -key for consistency with the req appDr. David von Oheimb
Also because this better reflects that usually also the public portion is used. Retaining the old -signkey as an alias for backward compatibility. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14007)
2021-03-03APPS: Modify 'fipsinstall' to output all notifications on stderrRichard Levitte
The actual output of the 'fipsinstall' is the config file it outputs. It should be possible to output that to standard output, and diverse notification messages shouldn't be mixed in. Therefore, we output them to standard error instead. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14320)
2021-03-02CMP: On NULL-DN subject or issuer input omit field in cert templateDr. David von Oheimb
Also improve diagnostics on inconsistent cert request input in apps/cmp.c, add trace output for transactionIDs on new sessions, and update the documentation in openssl-cmp.pod.in. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14018)
2021-03-01Remove RSA SSLv23 padding modeRich Salz
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14248)
2021-03-01OSSL_HTTP_parse_url(): Handle any userinfo, query, and fragment componentsDr. David von Oheimb
Now handle [http[s]://][userinfo@]host[:port][/path][?query][#frag] by optionally providing any userinfo, query, and frag components. All usages of this function, which are client-only, silently ignore userinfo and frag components, while the query component is taken as part of the path. Update and extend the unit tests and all affected documentation. Document and deprecat OCSP_parse_url(). Fixes an issue that came up when discussing FR #14001. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14009)
2021-02-28apps/x509.c: Fix mem leaks in processing of -next_serial in print loopDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14340)
2021-02-28apps/x509.c: Improve print_name() and coding style of large print loop in ↵Dr. David von Oheimb
x509_main() Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14340)
2021-02-28apps/x509.c: Improve indentation of the large print loop in x509_main()Dr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14340)
2021-02-28apps/x509.c: Fix too eager call to X509_set_issuer_name() introduced recentlyDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14340)
2021-02-28apps: add addition argument to KDF derive callPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14310)
2021-02-28apps: update speed to use the additional arguments to MAC_initPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14310)
2021-02-28apps: updates for the new additional MAC_init argumentsPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14310)
2021-02-28apps: update mac to work with additional MAC_init arguments. This doesn't ↵Pauli
include the creation of new 'key' arguments. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14310)
2021-02-28apps: update fipsinstall to work with additional MAC_init argumentsPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14310)
2021-02-25Don't hold a lock when calling a callback in ossl_namemap_doall_namesMatt Caswell
We don't want to hold a read lock when calling a user supplied callback. That callback could do anything so the risk of a deadlock is high. Instead we collect all the names first inside the read lock, and then subsequently call the user callback outside the read lock. Fixes #14225 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14250)
2021-02-24speed: Drop deprecated <ALG>_options() callsTomas Mraz
Also correction of some code format issues. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14228)
2021-02-24speed: Use EVP for ciphers, cmac, ghash, rsa, dsa, and ecdsaTomas Mraz
Fixes #13909 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14228)
2021-02-24speed: Adapt digests and hmac to always use non-deprecated APIsTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14228)
2021-02-24speed: Drop code to handle platforms without SIGALRMTomas Mraz
(except for Windows where a separate thread stops the looping) Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14228)
2021-02-22Fix -pkeyopt handling in apps/pkeyutl -rawinPetr Gotthard
The EVP_DigestSignInit and EVP_DigestVerifyInit actually have to be initialized before EVP_PKEY_CTX_ctrl_str is invoked. Otherwise, when the ctx not initialized, the ctrl command fails. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13828)
2021-02-22Handle NULL result of ERR_reason_error_string() in some appsDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13920)
2021-02-19CMP: Fix total_timeout behavior; small doc and diagnostic improvementsDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14019)
2021-02-19Fix speed sm2 bugChenglong Zhang
Should create PKEY CTX with EVP_PKEY_SM2; each job should have its own sm2_pkey; loopargs[i].sigsize should be set after EVP_DigestSign(). Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14144)
2021-02-18Don't forget the type of thing we are loadingMatt Caswell
The apps helper function load_key_certs_crls() is a general purpose function for loading different types of objects from a given URI. It sets up an OSSL_STORE and calls OSSL_STORE_expect() so that the store knows what type of thing to expect to load. Unfortunately this wasn't working and was always setting "expect" to 0 - which means "anything". Fixes #13709 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14191)
2021-02-18Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14235)
2021-02-17apps/cmp.c: Improve initialization of ext_ctx structure w.r.t. CSRDr. David von Oheimb
Also improve doc how the -reqexts option affects the CSR given with the -csr option. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/14181)
2021-02-17apps/ca.c: Make sure ext_ctx structure gets initializedDr. David von Oheimb
Fixes #14175 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/14181)
2021-02-17Rename OSSL_ENCODER_CTX_new_by_EVP_PKEY and OSSL_DECODER_CTX_new_by_EVP_PKEYTomas Mraz
Additional renames done in encoder and decoder implementation to follow the style. Fixes #13622 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14155)
2021-02-17Replace SSL_CTX_new by SSL_CTX_new_ex in apps/s_server + s_clientPetr Gotthard
The `openssl s_server` and `openssl s_client` currently ignore the `-propquery` parameter. Fix patch fixes this. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14195)
2021-02-13passwd.c: use the actual ROUNDS_DEFAULT macroDisconnect3d
Before this commit, the `ROUNDS_DEFAULT` macro was not used at all, while defined in the source code. Instead, a `unsigned int rounds = 5000;` was set, which uses the same value. This commit changes the `5000` to `ROUNDS_DEFAULT`. CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14156)
2021-02-12Deprecate the libssl level SRP APIsMatt Caswell
The low level SRP implementation has been deprecated with no replacement. Therefore the libssl level APIs need to be similarly deprecated. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14132)
2021-02-12Deprecate the low level SRP APIsMatt Caswell
The OTC decided that all low level APIs should be deprecated. This extends to SRP, even though at the current time there is no "EVP" interface to it. This could be added in a future release. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14132)
2021-02-12Allow -rand to be repeatedRich Salz
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14135)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-23 17:07:07 +0000