aboutsummaryrefslogtreecommitdiffstats
path: root/apps/opt.c
Commit message (Collapse)AuthorAgeFilesLines
* Allow proxy certs to be present when verifying a chainRichard Levitte2016-06-201-0/+3
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
* Spelling fixesFdaSilvaYY2016-06-161-2/+2
| | | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1219)
* Copyright consolidation 01/10Rich Salz2016-05-171-46/+6
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Fix signer option and support format SMIME.Dr. Stephen Henson2016-05-131-1/+3
| | | | | | | | | | | | Fix -signer option in smime utility to output signer certificates when verifying. Add support for format SMIME for -inform and -outform with cms and smime utilities. PR#4215 Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* fix tab-space mixed indentationFdaSilvaYY2016-05-091-2/+2
| | | | | | | No code change Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix no-ocsp on Windows (and probably VMS)Matt Caswell2016-04-211-0/+1
| | | | | | | | | The ocsp.h file did not have appropriate guards causing link failures on Windows. GH Issue 900 Reviewed-by: Richard Levitte <levitte@openssl.org>
* After saving errno clear it before calls to strtol et. al.Viktor Dukhovni2016-04-031-0/+4
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Move peer chain security checks into x509_vfy.cViktor Dukhovni2016-04-031-0/+5
| | | | | | | | | | | | | | | | | | | A new X509_VERIFY_PARAM_set_auth_level() function sets the authentication security level. For verification of SSL peers, this is automatically set from the SSL security level. Otherwise, for now, the authentication security level remains at (effectively) 0 by default. The new "-auth_level" verify(1) option is available in all the command-line tools that support the standard verify(1) options. New verify(1) tests added to check enforcement of chain signature and public key security levels. Also added new tests of enforcement of the verify_depth limit. Updated documentation. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* apps/opt.c: next was only used when NDEBUG undefined, move it inside guardRichard Levitte2016-04-021-1/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove Netware and OS/2Rich Salz2016-03-171-6/+1
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Deprecate the -issuer_checks debugging optionViktor Dukhovni2016-02-101-1/+1
| | | | | | | | | | | | This was a developer debugging feature and was never a useful public interface. Added all missing X509 error codes to the verify(1) manpage, but many still need a description beyond the associated text string. Sorted the errors in x509_txt.c by error number. Reviewed-by: Stephen Henson <steve@openssl.org>
* commands help cleanupA J Mohan Rao2016-02-061-0/+1
| | | | | | | | opt_valtype 0 is same as '-' while printing cmd usage asn1parse/ca/ciphers help cleanup Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix pkeyutl/rsautl empty encrypt-input/decrypt-output handlingViktor Dukhovni2016-02-021-8/+19
| | | | | | | | | | | | | Also fix option processing in pkeyutl to allow use of (formerly) "out-of-order" switches that were needless implementation limitations. Handle documented "ENGINE" form with -keyform and -peerform. Better handling of OPENSSL_NO_ENGINE and OPENSSL_NO_RSA. RT2018 Reviewed-by: Rich Salz <rsalz@openssl.org>
* Check chain extensions also for trusted certificatesViktor Dukhovni2016-01-311-1/+12
| | | | | | | | | This includes basic constraints, key usages, issuer EKUs and auxiliary trust OIDs (given a trust suitably related to the intended purpose). Added tests and updated documentation. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Make opt_imax visible in all appsViktor Dukhovni2016-01-291-6/+0
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* For stro[ui]max require both C99 and UINTMAX_MAX/INTMAX_MAXViktor Dukhovni2016-01-131-2/+4
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* For stroimax need C99 inttypes.hViktor Dukhovni2016-01-131-2/+2
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Maximize time_t when intmax_t is availableViktor Dukhovni2016-01-121-11/+97
| | | | | | | Well, I'm not actually changing time_t, just changing how time_t valued opt values are converted from string to time_t. Reviewed-by: Rich Salz <rsalz@openssl.org>
* RT4227: Range-check in apps.Rich Salz2016-01-121-69/+57
| | | | | | | | Implement range-checking in all counts in apps. Turns out only a couple of cases were missing. And make the range-checking code more strict. Replace almost all opt_ulong() calls with opt_long() Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Fix faulty check in the VMS version of opt_prognameRichard Levitte2015-12-301-1/+1
| | | | Reviewed-by: Stephen Henson <steve@openssl.org>
* Address Windows warnings in apps/.Andy Polyakov2015-10-051-2/+1
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* RT3951: Add X509_V_FLAG_NO_CHECK_TIME to suppress time checkDavid Woodhouse2015-09-051-0/+4
| | | | | | | | In some environments, such as firmware, the current system time is entirely meaningless. Provide a clean mechanism to suppress the checks against it. Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove obsolete key formats.Rich Salz2015-07-161-9/+5
| | | | | | | | Remove support for RSA_NET and Netscape key format (-keyform n). Also removed documentation of SGC. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* RT2547: Tighten perms on generated privkey filesRich Salz2015-06-151-1/+0
| | | | | | | | | | | | When generating a private key, try to make the output file be readable only by the owner. Put it in CHANGES file since it might be noticeable. Add "int private" flag to apps that write private keys, and check that it's set whenever we do write a private key. Checked via assert so that this bug (security-related) gets fixed. Thanks to Viktor for help in tracing the code-paths where private keys are written. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* memset, memcpy, sizeof consistency fixesRich Salz2015-05-051-2/+2
| | | | | | | | Just as with the OPENSSL_malloc calls, consistently use sizeof(*ptr) for memset and memcpy. Remove needless casts for those functions. For memset, replace alternative forms of zero with 0. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix windows buildMatt Caswell2015-04-301-4/+4
| | | | | | | The big apps cleanup broke the windows build. This commit fixes some miscellaneous issues so that it builds again. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Fix main build breakage.Rich Salz2015-04-261-4/+5
| | | | | | | | | A variable declaration got dropped during a merge. And if a compiler inlines strcmp() and you put a strcmp in an assert message, the resultant stringification exceeds ANSI string limits. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Big apps cleanup (option-parsing, etc)Rich Salz2015-04-241-0/+915
This is merges the old "rsalz-monolith" branch over to master. The biggest change is that option parsing switch from cascasding 'else if strcmp("-foo")' to a utility routine and somethin akin to getopt. Also, an error in the command line no longer prints the full summary; use -help (or --help :) for that. There have been many other changes and code-cleanup, see bullet list below. Special thanks to Matt for the long and detailed code review. TEMPORARY: For now, comment out CRYPTO_mem_leaks() at end of main Tickets closed: RT3515: Use 3DES in pkcs12 if built with no-rc2 RT1766: s_client -reconnect and -starttls broke RT2932: Catch write errors RT2604: port should be 'unsigned short' RT2983: total_bytes undeclared #ifdef RENEG RT1523: Add -nocert to fix output in x509 app RT3508: Remove unused variable introduced by b09eb24 RT3511: doc fix; req default serial is random RT1325,2973: Add more extensions to c_rehash RT2119,3407: Updated to dgst.pod RT2379: Additional typo fix RT2693: Extra include of string.h RT2880: HFS is case-insensitive filenames RT3246: req command prints version number wrong Other changes; incompatibilities marked with *: Add SCSV support Add -misalign to speed command Make dhparam, dsaparam, ecparam, x509 output C in proper style Make some internal ocsp.c functions void Only display cert usages with -help in verify Use global bio_err, remove "BIO*err" parameter from functions For filenames, - always means stdin (or stdout as appropriate) Add aliases for -des/aes "wrap" ciphers. *Remove support for IISSGC (server gated crypto) *The undocumented OCSP -header flag is now "-header name=value" *Documented the OCSP -header flag Reviewed-by: Matt Caswell <matt@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-26 18:23:26 +0000