summaryrefslogtreecommitdiffstats
path: root/apps
AgeCommit message (Collapse)Author
2018-02-27Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2018-02-23Adapt storeutl to allow search for specific objectsRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2688)
2018-02-23Adapt storeutl to allow looking for a specific info typeRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2688)
2018-02-22initialise dc variable to satisfy old compilers.Steve Linsell
When compiling with -Wall on a machine with an old compiler it gives a false positive that the dc variable which is a structure of type DISPLAY_COLUMNS could be used uninitialised. In fact the dc variable's members will always get set in the case it is used, otherwise it is left uninitialised. This fix just causes the dc variable's members to always get initialised to 0 at declaration, so the false positive will not get flagged. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5337)
2018-02-21Add support for PBKDF2 for enc commandEasySec
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2083)
2018-02-21do_body: fix heap-use-after-free.Pavel Kopyl
The memory pointed to by the 'push' is freed by the X509_NAME_ENTRY_free() in do_body(). The second time it is referenced to (indirectly) in certify_cert:X509_REQ_free(). Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4698)
2018-02-19Add BIO_bind function to bind local address for a socket.John Hughes
Add -bind option to s_client application to allow specification of local address for connection. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5272)
2018-02-15Check the return code from ASN1_TIME_diff()Matt Caswell
The function can fail so we should check the return code. Found by Coverity Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/5339)
2018-02-15The function X509_gmtime_adj() can failMatt Caswell
Check for a failure and free a_tm as appropriate. Found by Coverity Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/5339)
2018-02-14Ignore an s_client psk in TLSv1.3 if not TLSv1.3 suitableMatt Caswell
The s_client psk_use_session_cb callback has a comment stating that we should ignore a key that isn't suitable for TLSv1.3. However we were actually causing the connection to fail. Changing the return value fixes the issue. Also related to this is that the early_data extension was not marked as TLSv1.3 only which it should be. Fixes #5202 Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/5205)
2018-02-13Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2018-02-01Fix of prefix bio filter (bf_prefix.c): rely on the given lengthRichard Levitte
The assumption that the received buffer has to be NUL-terminated was faulty. Fault found in #5224 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5239)
2018-02-01Add TLSv1.3 post-handshake authentication (PHA)Todd Short
Add SSL_verify_client_post_handshake() for servers to initiate PHA Add SSL_force_post_handshake_auth() for clients that don't have certificates initially configured, but use a certificate callback. Update SSL_CTX_set_verify()/SSL_set_verify() mode: * Add SSL_VERIFY_POST_HANDSHAKE to postpone client authentication until after the initial handshake. * Update SSL_VERIFY_CLIENT_ONCE now only sends out one CertRequest regardless of when the certificate authentication takes place; either initial handshake, re-negotiation, or post-handshake authentication. Add 'RequestPostHandshake' and 'RequirePostHandshake' SSL_CONF options that add the SSL_VERIFY_POST_HANDSHAKE to the 'Request' and 'Require' options Add support to s_client: * Enabled automatically when cert is configured * Can be forced enabled via -force_pha Add support to s_server: * Use 'c' to invoke PHA in s_server * Remove some dead code Update documentation Update unit tests: * Illegal use of PHA extension * TLSv1.3 certificate tests DTLS and TLS behave ever-so-slightly differently. So, when DTLS1.3 is implemented, it's PHA support state machine may need to be different. Add a TODO and a #error Update handshake context to deal with PHA. The handshake context for TLSv1.3 post-handshake auth is up through the ClientFinish message, plus the CertificateRequest message. Subsequent Certificate, CertificateVerify, and Finish messages are based on this handshake context (not the Certificate message per se, but it's included after the hash). KeyUpdate, NewSessionTicket, and prior Certificate Request messages are not included in post-handshake authentication. After the ClientFinished message is processed, save off the digest state for future post-handshake authentication. When post-handshake auth occurs, copy over the saved handshake context into the "main" handshake digest. This effectively discards the any KeyUpdate or NewSessionTicket messages and any prior post-handshake authentication. This, of course, assumes that the ID-22 did not mean to include any previous post-handshake authentication into the new handshake transcript. This is implied by section 4.4.1 that lists messages only up to the first ClientFinished. Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4964)
2018-02-01Remove bad commentsTodd Short
Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4964)
2018-02-01ocsp.c doesn't free the whole output chain, maybe causing a memory leakRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5224)
2018-02-01Make sure that apps/openssl prefixes its output with '# ' during testsRichard Levitte
The reason to do this is that some output might start with an 'ok', which TAP catches and takes for TAP output. The TAP compatible way is to make all output it shouldn't catch look like comments. We do this by setting the environment variable HARNESS_OSSL_PREFIX during tests. When that is set, apps/openssl uses BIO_f_linebuffer and sets its prefix to the content of that environment variable. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5224)
2018-02-01Add an apps internal BIO filter for prefixing output linesRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5224)
2018-01-31Apps: divide the modules in direct command modules, support library and initRichard Levitte
Most modules are direct implementations of openssl application sub-commands, but some constitute a support library, which can be used by more than one program (and is, incidently, by test/uitest). For practical purposes, we place the support library modules in a private, static library. Finally, there are some modules that don't have direct references in the rest of the apps code, but are still crucial. See them as some kind of extra crt0 or similar for your platform. Inspiration from David von Oheimb Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5222)
2018-01-31apps: Don't include progs.h in apps.hRichard Levitte
Everything in apps includes apps.h, because that one declares apps internal library routines. However, progs.h doesn't declare library routines, but rather the main commands and their options, and there's no reason why the library modules should include it. So, remove the inclusion of progs.h from apps.h and add that inclusion in all command source files. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5222)
2018-01-26Fix some style nits in commit eee8a40Bernd Edlinger
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5173)
2018-01-25Make the s_server command listen on IPv6 only when requestedBernd Edlinger
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5152)
2018-01-24Make editorial changes suggested by Matt Caswell and fixed Travis failures.David Cooper
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4190)
2018-01-24Make editorial changes suggested by Rich Salz and add the -rsigopt option to ↵David Cooper
the man page for the ocsp command. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4190)
2018-01-24Add -rsigopt option to ocsp commandDavid Cooper
Add a -rsigopt option to the ocsp command that allows signature parameters to be provided for the signing of OCSP responses. The parameters that may be provided to -rsigopt are the same as may be provided to -sigopt in the ca, req, and x509 commands. This PR also defines a OCSP_basic_sign_ctx() function, which functions in the same way as OCSP_basic_sign(), except that it accepts a EVP_MD_CTX rather than a key and digest. The OCSP_basic_sign_ctx() function is used to implement the -rsigopt option in the ocsp command. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4190)
2018-01-24Add the ability for s_server to operate statelesslyMatt Caswell
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4435)
2018-01-24Enable the cookie callbacks to work even in TLS in the appsMatt Caswell
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4435)
2018-01-23Fix no-ec --strict-warnings buildsBenjamin Kaduk
The 'loop' variable is only used if EC is available. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5149)
2018-01-22Don't attempt to use X25519 for ECDSA in speedMatt Caswell
Fixes #5090 Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/5097)
2018-01-22Don't crash on a missing Subject in index.txtMatt Caswell
An index.txt entry which has an empty Subject name field will cause ca to crash. Therefore check it when we load it to make sure its not empty. Fixes #5109 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5114)
2018-01-22Don't allow an empty Subject when creating a CertificateMatt Caswell
Misconfiguration (e.g. an empty policy section in the config file) can lead to an empty Subject. Since certificates should have unique Subjects this should not be allowed. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5114)
2018-01-19Copyright update of more files that have changed this yearRichard Levitte
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/5110)
2018-01-15Fix intermittent Windows and Cygwin failures in s_serverRichard Levitte
The same kind of failure that has already been observed on the s_client can sometimes also be observed on s_server, so we need to add the same kind of 50ms delay as was previously added on s_client. Ref: git commit cb2e10f257a464c6b475b321dd9e4769df84dbf6: Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/5079)
2018-01-14Fix intermittent Cygwin failures in s_clientRichard Levitte
This was identified for Windows almost two years ago for VC and msys/mingw. It seems that Cygwin suffers from the same issue, and since Cygwin doesn't define OPENSSL_SYS_WINDOWS, we need to make a special case to have a 50ms pause before closing the TLS connection. Ref: git commit cb2e10f257a464c6b475b321dd9e4769df84dbf6 Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/5074)
2018-01-14Use constant value 1 instead of SHUT_WR in do_serverBernd Edlinger
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5072)
2018-01-14Explicitly shut the socket down in s_clientBernd Edlinger
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5072)
2018-01-12Change the name of the SEC typedef to openssl_speed_sec_t.Pauli
This to avoid a clash with a #defined symbol on Solaris from time.h. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5064)
2018-01-09Update copyright years on all files merged since Jan 1st 2018Richard Levitte
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5038)
2018-01-09Various small build improvements on mkdef.pl, progs.pl, crypto/init.c, ↵David von Oheimb
crypto/mem.c Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4994)
2018-01-08Clarify error for unrecognized arguments.Jacob Hoffman-Andrews
Many of the sub-commands under apps/ accept cipher or digest arguments like "-sha256". These are implemented using a catchall flag that runs the result through opt_md() or opt_cipher(). That means any unrecognized flag, including typos, gets sent to those two functions, producing confusing error messages like below: $ ./apps/openssl req -x590 req: Unrecognized digest x590 req: Use -help for summary. This change switches these two functions to say "Unrecognized flag X" instead. The new message deliberately leaves off the "-" from the flag name, because there are some cases where opt_md() and opt_cipher() are passed a flag value instead (for instance, openssl ca -md). I think the new message is generic enough that it can serve both cases with improved clarity. CLA: trivial Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4972)
2018-01-07Remove remaining NETWARE ifdef'sRich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5028)
2018-01-06Add the possibility to do 'openssl help [command]'Richard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5002)
2018-01-06apps: make sure prog_init only calculates onceRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5002)
2018-01-06Corrected 'cms' exit status when key or certificate cannot be openedKonstantin Shemyak
Fixes #4996. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4997)
2017-12-28Add 'openssl req' option to specify extension values on command lineRichard Levitte
The idea is to be able to add extension value lines directly on the command line instead of through the config file, for example: openssl req -new -extension 'subjectAltName = DNS:dom.ain, DNS:oth.er' \ -extension 'certificatePolicies = 1.2.3.4' Fixes #3311 Thank you Jacob Hoffman-Andrews for the inspiration Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4986)
2017-12-14Merge HRR into ServerHelloMatt Caswell
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4701)
2017-12-14Implement session id TLSv1.3 middlebox compatibility modeMatt Caswell
Clients will send a "fake" session id and servers must echo it back. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4701)
2017-12-11Fix typo in commentBenjamin Kaduk
The one in rsa.c was overlooked when fixing the same comment in pkey.c as part of eff1752b66cb7bf6ca8af816eb10ead26910d025. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4902)
2017-12-09Useless conf != NULL testFdaSilvaYY
check is already made 10 line above. clean commented code Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4885)
2017-12-09apps/speed.c: initialize buffersPatrick Steuer
Stop valgrind's complaints about uninitialized values. Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4842)
2017-12-09apps/speed.c: generate evp_cipher keys implicitlyPatrick Steuer
Generate keys using EVP_CIPHER's key generation routine to support keys of a specific form. Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4842)
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-26 14:07:21 +0000