summaryrefslogtreecommitdiffstats
path: root/apps
AgeCommit message (Collapse)Author
2024-03-15apps/x509.c: No warning reading from stdin if redirectedTomas Mraz
Fixes #22893 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23526)
2024-03-12Use the untrusted certificate chain to create a valid certificate ID for ↵olszomal
OCSP_request Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22192)
2024-03-06apps/cmp: improve -reqin option to read fallback public key from first ↵Dr. David von Oheimb
request message file given Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/21660)
2024-03-06apps/cmp: extend documentation and diagnostics for using -reqin in special ↵Dr. David von Oheimb
situations Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/21660)
2024-03-06apps/cmp: add -reqout_only option for dumping/saving just the initial CMP ↵Dr. David von Oheimb
request message Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/21660)
2024-03-06apps/cmp.c: refactor to fix some coding style nits and more convenient ↵Dr. David von Oheimb
source-level debugging Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/21660)
2024-02-25apps/engine: add EC to list of capabilitiesMartin Oliveira
openssl engine -c wasn't showing if an engine implemented EC cla: trivial Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23538)
2024-02-22s_cb.c: Add missing return value checksMrRurikov
Return value of function 'SSL_CTX_ctrl', that is called from SSL_CTX_set1_verify_cert_store() and SSL_CTX_set1_chain_cert_store(), is not checked, but it is usually checked for this function. CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23647) (cherry picked from commit 6f794b461c6e16c8afb996ee190e084cbbddb6b8)
2024-02-06Add a missing space in an error messageVincent Lefèvre
CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23481)
2024-01-25replace strstr() with strchr() for single charactersrilysh
strstr() is used to match multiple characters in the haystack, whereas strchr() is used to matched only single character. CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23347)
2024-01-25Add appropriate NULL checks in EVP_CIPHER apiNeil Horman
The EVP_CIPHER api currently assumes that calls made into several APIs have already initalized the cipher in a given context via a call to EVP_CipherInit[_ex[2]]. If that hasnt been done, instead of an error, the result is typically a SIGSEGV. Correct that by adding missing NULL checks in the apropriate apis prior to using ctx->cipher Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22995)
2024-01-24Fix a possible memory leak in req_mainBernd Edlinger
if the private key is output to stdout using the HARNESS_OSSL_PREFIX, out is a stack of BIOs and must therefore free'd using BIO_free_all. Steps to reproduce: $ HARNESS_OSSL_PREFIX=x OPENSSL_CONF=apps/openssl.cnf util/shlib_wrap.sh apps/openssl req -new -keyout - -passout pass: </dev/null [...] Direct leak of 128 byte(s) in 1 object(s) allocated from: #0 0x7f6f692b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69 #1 0x7f6f686eda00 in CRYPTO_malloc crypto/mem.c:202 #2 0x7f6f686edba0 in CRYPTO_zalloc crypto/mem.c:222 #3 0x7f6f68471bdf in BIO_new_ex crypto/bio/bio_lib.c:83 #4 0x7f6f68491a8f in BIO_new_fp crypto/bio/bss_file.c:95 #5 0x555c5f58b378 in dup_bio_out apps/lib/apps.c:3014 #6 0x555c5f58f9ac in bio_open_default_ apps/lib/apps.c:3175 #7 0x555c5f58f9ac in bio_open_default apps/lib/apps.c:3203 #8 0x555c5f528537 in req_main apps/req.c:683 #9 0x555c5f50e315 in do_cmd apps/openssl.c:426 #10 0x555c5f4c5575 in main apps/openssl.c:307 #11 0x7f6f680461c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 SUMMARY: AddressSanitizer: 128 byte(s) leaked in 1 allocation(s). Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23365)
2024-01-17CMP app and doc: add -no_cache_extracerts option / ↵Dr. David von Oheimb
OSSL_CMP_OPT_NO_CACHE_EXTRACERTS Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19948)
2024-01-17CMP app: make -ignore_keyusage apply also for mock serverDr. David von Oheimb
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19948)
2024-01-16Add missing genpkey -rand supportViktor Dukhovni
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23294)
2024-01-15Remove receiving of unused return valueDrokov Pavel
CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23277)
2024-01-15Error in s_server when -rev option is used with dtls.Frederik Wedel-Heinen
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23278)
2024-01-15Add apps/x509 -set_issuer & -set_subject option to override issuer & subjectJob Snijders
This changeset adds the counterpart to the '-subj' option to allow overriding the Issuer. For consistency, the `-subj` option is aliased to `-set_subject`. The issuer can be specified as following apps/openssl x509 -new -set_issuer '/CN=example-nro-ta' -subj '/CN=2a7dd1d787d793e4c8af56e197d4eed92af6ba13' ... This is useful in constructing specific test-cases or rechaining PKI trees Joint work with George Michaelson (@geeohgeegeeoh) Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23257)
2023-12-29apps: Don't print hostname on bio_out during connect.Sebastian Andrzej Siewior
Printing the hostname on bio_out clutters the output and breaks pipe like forwarding via openssl. Print the hostname via bio_err. Fixes #23013 Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23056)
2023-12-21cmp_server.c,apps/lib/cmp_mock_srv.c: move polling state checks to cmp_server.cRajeev Ranjan
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/20727)
2023-12-21crypto/cmp/,apps/lib/cmp_mock_srv.c: various improvements on delayed deliveryDr. David von Oheimb
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/20727)
2023-12-21crypto/cmp/,apps/lib/cmp_mock_srv.c: add delayed delivery for all types of ↵Rajeev Ranjan
responses Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/20727)
2023-12-19CMP app: make -geninfo option accept multiple ITAVs and support string ↵Dr. David von Oheimb
values besides integers Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/21281)
2023-12-19CMP lib and app: add optional certProfile request message header and ↵Dr. David von Oheimb
respective -profile option Also add missing getter functionss OSSL_CMP_{CTX,HDR}_get0_geninfo_ITAVs() to CMP API. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/21281)
2023-12-13Harden asn1 oid loader to invalid inputsNeil Horman
In the event that a config file contains this sequence: ======= openssl_conf = openssl_init config_diagnostics = 1 [openssl_init] oid_section = oids [oids] testoid1 = 1.2.3.4.1 testoid2 = A Very Long OID Name, 1.2.3.4.2 testoid3 = ,1.2.3.4.3 ====== The leading comma in testoid3 can cause a heap buffer overflow, as the parsing code will move the string pointer back 1 character, thereby pointing to an invalid memory space correct the parser to detect this condition and handle it by treating it as if the comma doesn't exist (i.e. an empty long oid name) Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22957)
2023-12-13Fix genstr/genconf option in asn1parseNeil Horman
At some point the asn1parse applet was changed to default the inform to PEM, and defalt input file to stdin. Doing so broke the -genstr|conf options, in that, before we attempt to generate an ASN1 block from the provided genstr string, we attempt to read a PEM input from stdin. As a result, this command: openssl asn1parse -genstr OID:1.2.3.4 hangs because we are attempting a blocking read on stdin, waiting for data that never arrives Fix it by giving priority to genstr|genconf, such that, if set, will just run do_generate on that string and exit Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22957)
2023-12-13pkcs12: Do not forcibly load the config fileTomas Mraz
This was added as part of commit e869c86 but later it was made unnecessary by commit 21f7a09. Fixes #22994 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23005)
2023-12-12Fix a possible memleak in opt_verifyBernd Edlinger
The ASN1_OBJECT otmp was leaked if X509_VERIFY_PARAM_add0_policy fails. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22922)
2023-12-12Fix a possible memleak in apps/rehash.cBernd Edlinger
The OPENSSL_DIR_end was missing in case of error. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22920)
2023-12-12Fix a possible memleak in smime_mainBernd Edlinger
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22919)
2023-12-12Fix a possible memleak in cms_mainBernd Edlinger
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22918)
2023-12-12Fix some invalid use of sscanfMatt Caswell
sscanf can return -1 on an empty input string. We need to appropriately handle such an invalid case. The instance in OSSL_HTTP_parse_url could cause an uninitialised read of sizeof(unsigned int) bytes (typically 4). In many cases this uninit read will immediately fail on the following check (i.e. if the read value >65535). If the top 2 bytes of a 4 byte unsigned int are zero then the value will be <=65535 and the uninitialised value will be returned to the caller and could represent arbitrary data on the application stack. The OpenSSL security team has assessed this issue and consider it to be a bug only (i.e. not a CVE). Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/22961)
2023-12-05rehash.c: Do not use NAME_MAX limitTomas Mraz
On some systems it is too small although the system allows longer filenames. Fixes #22886 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22889)
2023-12-04Make 'openssl list' less sensitive for providers without paramsRichard Levitte
When a provider can't return parameters, make that a warning instead of an error, and continue to list further providers. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/22866)
2023-12-01Fix a possible memory leak in make_receipt_requestBernd Edlinger
When the CMS_ReceiptRequest cannot be created, the rct_to and rct_from may be leaked. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22742)
2023-11-24Add option `SSL_OP_PREFER_NO_DHE_KEX`, allowing the server to prefer non-dhe ↵Markus Minichmayr
psk key exchange over psk with dhe (config file option `PreferNoDHEKEX`, server option `prefer_no_dhe_kex`). Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22794)
2023-11-24openssl-speed: support KMAC128 & KMAC256, refactor mac setup/teardownJames Muir
Add ability to measure performance of the two kmac algorithms, and reduce code duplication in mac testing by introducing mac_setup() and mac_teardown(). Also, start accepting "cmac" as an algorithm string (similar to how "hmac" is accepted). We can now compare the performance of KMAC128, KMAC256 (mac algs) to KECCAK-KMAC128, KECCAK-KMAC256 (digest/xof algs). Fixes #22619 Testing: $ LD_LIBRARY_PATH=. ./apps/openssl speed kmac cmac hmac $ LD_LIBRARY_PATH=. ./apps/openssl speed kmac256 $ LD_LIBRARY_PATH=. ./apps/openssl speed -evp KECCAK-KMAC256 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22764)
2023-11-23speed: make hmac(sha256) the default hmacJames Muir
prefer hmac(sha256) rather than hmac(md5). Also, drop the "skip_hmac" label. If we are supposed to do hmac(hash_func) and hash_func cannot be found, then error out immediately. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22793)
2023-11-13Augment rand argument parsing to allow scalingNeil Horman
Instead of just accepting a number of bytes, allows openssl rand to accept a k|m|g suffix to scale to kbytes/mbytes/gbytes Fixes #22622 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22624)
2023-11-10apps/list.c: Check the result of inserting a provider into provider's stackAlexey Fofanov
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22492) (cherry picked from commit 15b83e04a5e125ab873ace1e474790a4a5b44647)
2023-11-08apps/rehash.c: avoid printf format warning [-Wformat]Matthias St. Pierre
The `aarch64-linux-android33-clang` cross-compiler (v14.0.6) complains twice about an unsupported '%n' format specifier, preventing a successful `--strict-warnings` build: error: '%n' specifier not supported on this platform [-Werror,-Wformat] BIO_snprintf(buf, buflen, "%s%s%n%08x.%s%d", This is a false positive, because BIO_snprintf() implements its own format parsing (which is implemented in the _dopr() function). This commit fixes the problem by rewriting the code to dispense with the dubious '%n' format specifier. As a side-effect, the code becomes a little bit more comprehensible and self-explaining. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22511)
2023-11-01Don't error if s_client receives exactly BUFSIZZ dataMatt Caswell
We should accept that many bytes without failing Fixes #22551 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/22558)
2023-10-25Don't wait in select if we have data to writeMatt Caswell
In s_client, when using quic, if we have data from the user to write then we shouldn't hang in "select" waiting for something to happen. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22480)
2023-10-25Make s_client -quic -debug workMatt Caswell
The callback that makes -debug print the data sent/received needed extending for the new QUIC callback codes. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22480)
2023-10-25speed: Correct handling of async_jobs for KEM and signature algosIngo Franzki
Setup the loopargs array for all jobs, not only for the very first one. It may fail with "Could not allocate 0 bytes for sig sign loop" and/or will cause the loop functions to fail silently, because they operate on a NULL PKEY context when "-async_jobs <n>" is specified. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/22399)
2023-10-25speed: Fix memory leaksIngo Franzki
Free the PKEYs created for KEM and signature algorithms. Free the encrypt/decrypt PKEY contexts for RSA. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/22399)
2023-10-20Convert jdkTrustedKeyUsage to be a pkcs12 cmd line optionNeil Horman
Creating JDK compatible pkcs12 files requires a bit more than just adding the Trusted Key Usage OID to a certbag in the pkcs12 file. Additionally the JDK currently requires that pkcs12 files setting this oid _not_ contain any additional keys, and in response will produce unpredictable results. This could be solved by implying --nokeys when the pkcs12 utility is run and the config option is set, but thatcould confuse users who didn't specify nokeys on the command line. As such, remove the config file setting for this feature, and replace it with a -jdktrust command line option, that is documented to assert nokeys when a users specifies the new command line option. Fixes #22215 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22422)
2023-10-19apps.c: Remove a redundant error print-outTomas Mraz
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22318)
2023-10-19apps: Print out a proper message when a store cannot be openedTomas Mraz
Fixes #22306 Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22318)
2023-10-10CMP: fix OSSL_CMP_MSG_http_perform() by adding option OSSL_CMP_OPT_USE_TLSDr. David von Oheimb
Fixes #21120 Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21176)
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-23 04:11:37 +0000