summaryrefslogtreecommitdiffstats
path: root/apps
AgeCommit message (Collapse)Author
2018-10-19Don't complain and fail about unknown TLSv1.3 PSK identities in s_serverMatt Caswell
An unknown PSK identity could be because its actually a session resumption attempt. Sessions resumptions and external PSKs are indistinguishable so the callbacks need to fail gracefully if they don't recognise the identity. Fixes #7433 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7434)
2018-10-17Fix: 'openssl ca' command crashes when used with 'rand_serial' optionDr. Matthias St. Pierre
Commit ffb46830e2df introduced the 'rand_serial' option. When it is used, the 'serialfile' does not get initialized, i.e. it remains a NULL pointer. This causes a crash when the NULL pointer is passed to the rotate_serial() call. This commit fixes the crash and unifies the pointer checking before calling the rotate_serial() and save_serial() commands. Fixes #7412 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7417)
2018-10-13Fix copy&paste error found in Coverity scanTomas Mraz
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7377)
2018-10-08apps: allow empty attribute values with -subjBenjamin Kaduk
Historically (i.e., OpenSSL 1.0.x), the openssl applications would allow for empty subject attributes to be passed via the -subj argument, e.g., `opensl req -subj '/CN=joe/O=/OU=local' ...`. Commit db4c08f0194d58c6192f0d8311bf3f20e251cf4f applied a badly needed rewrite to the parse_name() helper function that parses these strings, but in the process dropped a check that would skip attributes with no associated value. As a result, such strings are now treated as hard errors and the operation fails. Restore the check to skip empty attribute values and restore the historical behavior. Document the behavior for empty subject attribute values in the corresponding applications' manual pages. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7349)
2018-10-02Fix a mem leak in the ocsp appMatt Caswell
Free memory allocated in the parent process that is not needed in the child. We also free it in the parent. Technically this isn't really required since we end up calling exit() soon afterwards - but to prevent false positives we free it anyway. Fixes a Coverity issue. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7335)
2018-10-01'openssl list': add option -objects to list built in objectsRichard Levitte
Related to #6696 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6702)
2018-09-23Create the .rnd file it it does not existBernd Edlinger
It's a bit annoying, since some commands try to read a .rnd file, and print an error message if the file does not exist. But previously a .rnd file was created on exit, and that does no longer happen. Fixed by continuing in app_RAND_load_conf regardless of the error in RAND_load_file. If the random number generator is still not initalized on exit, the function RAND_write_file will fail and no .rnd file would be created. Remove RANDFILE from openssl.cnf Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/7217)
2018-09-21typo-fixes: miscellaneous typo fixesagnosticdev
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7277)
2018-09-13Don't allow -early_data with other options where it doesn't workMatt Caswell
-early_data is not compatible with -www, -WWW, -HTTP or -rev. Fixes #7200 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7206)
2018-09-12Speed for HMACs.Pauli
Add support for HMAC over any evp supported digest. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6945)
2018-09-10Don't cast an int * to a size_t *Matt Caswell
If sizeof(int) != sizeof(size_t) this may not work correctly. Fixes a Coverity issue. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7168)
2018-09-07Support EdDSA in apps/speedPaul Yang
This addresses issue #6922. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7073)
2018-09-05New openssl subject parser hard to debugEric Curtin
-subj 'subject=C = US, ST = A, L = root, O = Hewlett Packard Enterprise Company, OU = Remote Device Access, CN = Hewlett Packard Enterprise Remote Device Access Test Local CA, emailAddress = rda@hpe.com' was a valid subject in openssl 1.0. Error received in 1.1 is: problems making Certificate Request Not very informative, I only figured this out because I compiled the code and added logging. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7098)
2018-09-04openssl req: don't try to report bitsRichard Levitte
With the introduction of -pkeyopt, the number of bits may change without |newkey| being updated. Unfortunately, there is no API to retrieve the information from a EVP_PKEY_CTX either, so chances are that we report incorrect information. For the moment, it's better not to try to report the number of bits at all. Fixes #7086 Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/7096)
2018-08-30Free SSL object on an error pathMatt Caswell
Thanks to @fangang190 for reporting this Fixes #7061 Reviewed-by: Paul Yang <yang.yang@baishancloud.com> (Merged from https://github.com/openssl/openssl/pull/7065)
2018-08-24Do not ignore EVP_PKEY_print_public/EVP_PKEY_print_private return valuesDmitry Belyavskiy
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/7007)
2018-08-22Ignore the digest in req app if using EdDSAMatt Caswell
This follows on from the previous commit, and makes the same change to ignore the digest if we are using EdDSA. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6901)
2018-08-22Improve the usability of the ca app using EdDSAMatt Caswell
Previously you had to supply "null" as the digest to use EdDSA. This changes things so that any digest is ignored. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6901)
2018-08-20Change Post Handshake auth so that it is opt-inMatt Caswell
Having post handshake auth automatically switched on breaks some applications written for TLSv1.2. This changes things so that an explicit function call is required for a client to indicate support for post-handshake auth. Fixes #6933. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6938)
2018-07-31Use the new non-curve type specific EC functions internallyMatt Caswell
Fixes #6646 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6815)
2018-07-30apps/dsaparam.c generates code that is intended to be pasted or includedBeat Bolli
into an existing source file: the function is static, and the code doesn't include dsa.h. Match the generated C source style of dsaparam. Adjust apps/dhparam.c to match, and rename the BIGNUMs to their more usual single-letter names. Add an error return in the generated C source. both: simplify the callback function Signed-off-by: Beat Bolli <dev@drbeat.li> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6797)
2018-07-26apps/apps.c: harmonize print_bignum_var output with coding style.Andy Polyakov
Reviewed-by: Rich Salz <rsalz@openssl.org>
2018-07-25apps/dsaparam.c: make dsaparam -C output strict-warnings-friendly.Andy Polyakov
Reviewed-by: Rich Salz <rsalz@openssl.org>
2018-07-23Make sure the 'tsget' script is called 'tsget.pl' everywhereRichard Levitte
The result is that we don't have to produce different names on different platforms, and we won't have confusion on Windows depending on if the script was built with mingw or with MSVC. Partial fix for #3254 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6764)
2018-07-22apps/dsaparam.c: fix -C output.Andy Polyakov
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6758)
2018-07-12apps/speed.c: let EVP_Update_loop_ccm behave more like EVP_Update_loopPatrick Steuer
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5246)
2018-07-09Add tests for the "req" command, -addext flagRich Salz
Also fixed a memory leak found by the test. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6681)
2018-07-09apps/req.c: fix -addext option.Andy Polyakov
Address even Coverity nit. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6671)
2018-07-06Don't fail if the PSK identity doesn't matchMatt Caswell
In 1.1.0 s_server if the PSK identity doesn't match what we have then a warning is printed and we continue the connection anyway. In 1.1.1, if TLSv1.3 is used and the identity doesn't match then we abort the connection. We should really be consistent with the old behaviour. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6659)
2018-07-06Add the ability to configure recv_max_early_data via s_serverMatt Caswell
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6655)
2018-07-05Reject duplicate -addext parametersRich Salz
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6636)
2018-07-02Add the ability to configure anti-replay via SSL_CONFMatt Caswell
This also adds the ability to control this through s_server Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6469)
2018-06-26Only dump session data after we have received itMatt Caswell
s_client was dumping session data at the end of the handshake. In TLSv1.3 we don't have session data until receipt of a NewSessionTicket message which happens post-handshake. Therefore we delay dumping the session data until that message has arrived if TLSv1.3 has been negotiated. Fixes #6482 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6590)
2018-06-24apps/speed.c: add missing checks for RAND_bytes()捷成吴
Function RAND_bytes() may return 0 or -1 on error, simply goto end label when it fails. Fixes #6567 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6582)
2018-06-24Support directories with "." in x509_load_serial()Ana María Martínez Gómez
Use `strrchr` to get a pointer to the last occurrence of `.` in the path string, instead of the first one with `strchr`. This prevent the path to be wrongly split if it contains several `.`, and not only the one for the extension. Fixes https://github.com/openssl/openssl/issues/6489. CLA: trivial Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6566)
2018-06-21apps/ca: fix useless get before delete.FdaSilvaYY
Small simplification by skipping effectively redundant step and not resuming search from point past deletion. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6195)
2018-06-21openssl ca: open the output file as late as possibleRichard Levitte
Fixes #6544 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6546)
2018-06-18add 'unsupported cipher mode' diagnostics to evp_lib.c and genpkey.cDavid von Oheimb
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6217)
2018-06-07Fix no-dsaMatt Caswell
Broken by 0336df2fa. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6427)
2018-06-05Issue warnings for large DSA and RSA keysGeorg Schmidt
Issue a warning when generating DSA or RSA keys of size greater than OPENSSL_DSA_MAX_MODULUS_BITS resp. OPENSSL_RSA_MAX_MODULUS_BITS. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6380)
2018-05-31Don't call setsockopt with an invalid fdMatt Caswell
This is probably a "should not happen" scenario, but better check anyway. Found by Coverity. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6373)
2018-05-31Fix a memory leak in an error pathMatt Caswell
Found by Coverity Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6373)
2018-05-31Free a variableMatt Caswell
Fix a memory leak in storeutl. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6373)
2018-05-31Free a variable on an error pathMatt Caswell
Issue found by Coverity. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6373)
2018-05-31Only set TCP_NODELAY if the protocol is TCPMatt Caswell
This doesn't apply if we're doing DTLS, or using UNIX domain sockets. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6373)
2018-05-31apps: when the 'compat' nameopt has been set, leave it beRichard Levitte
XN_FLAG_COMPAT has a unique property, its zero for value. This means it needs special treatment; if it has been set (which can only be determined indirectly) and set alone (*), no other flags should be set. (*) if any other nameopt flag has been set by the user, compatibility mode is blown away. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6382)
2018-05-30apps/speed.c: address asan failure with small -bytes and large -misalign.Andy Polyakov
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6311)
2018-05-30apps/speed.c: add -aead flag.Andy Polyakov
Goal is to exercise AEAD ciphers in TLS-like sequence, i.e. 13-byte AAD followed by payload. Update doc/man1/speed.pod accordingly. [While we are at it, address even some styling and readability issues.] Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6311)
2018-05-30apps/speed.c: clean up SIGARM handling.Andy Polyakov
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6311)
2018-05-30Text description of GOST signature algorithmsDmitry Belyavskiy
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6168)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-22 23:49:13 +0000