aboutsummaryrefslogtreecommitdiffstats
path: root/apps/s_apps.h
Commit message (Collapse)AuthorAgeFilesLines
* Copyright consolidation 01/10Rich Salz2016-05-171-107/+7
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Remove Netware and OS/2Rich Salz2016-03-171-4/+0
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove unused parameters from internal functionsRich Salz2016-02-221-3/+3
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove JPAKERich Salz2016-02-171-2/+1
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Suppress DANE TLSA reflection when verification failsViktor Dukhovni2016-02-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As documented both SSL_get0_dane_authority() and SSL_get0_dane_tlsa() are expected to return a negative match depth and nothing else when verification fails. However, this only happened when verification failed during chain construction. Errors in verification of the constructed chain did not have the intended effect on these functions. This commit updates the functions to check for verify_result == X509_V_OK, and no longer erases any accumulated match information when chain construction fails. Sophisticated developers can, with care, use SSL_set_verify_result(ssl, X509_V_OK) to "peek" at TLSA info even when verification fail. They must of course first check and save the real error, and restore the original error as quickly as possible. Hiding by default seems to be the safer interface. Introduced X509_V_ERR_DANE_NO_MATCH code to signal failure to find matching TLSA records. Previously reported via X509_V_ERR_CERT_UNTRUSTED. This also changes the "-brief" output from s_client to include verification results and TLSA match information. Mentioned session resumption in code example in SSL_CTX_dane_enable(3). Also mentioned that depths returned are relative to the verified chain which is now available via SSL_get0_verified_chain(3). Added a few more test-cases to danetest, that exercise the new code. Resolved thread safety issue in use of static buffer in X509_verify_cert_error_string(). Fixed long-stating issue in apps/s_cb.c which always sets verify_error to either X509_V_OK or "chain to long", code elsewhere (e.g. s_time.c), seems to expect the actual error. [ The new chain construction code is expected to correctly generate "chain too long" errors, so at some point we need to drop the work-arounds, once SSL_set_verify_depth() is also fixed to propagate the depth to X509_STORE_CTX reliably. ] Reviewed-by: Rich Salz <rsalz@openssl.org>
* Refactoring BIO: Adapt s_client and s_serverRichard Levitte2016-02-031-17/+6
| | | | | | | | | | | | | | | | | | | s_socket.c gets brutally cleaned out and now consists of only two functions, one for client and the other for server. They both handle AF_INET, AF_INET6 and additionally AF_UNIX where supported. The rest is just easy adaptation. Both s_client and s_server get the new flags -4 and -6 to force the use of IPv4 or IPv6 only. Also, the default host "localhost" in s_client is removed. It's not certain that this host is set up for both IPv4 and IPv6. For example, Debian has "ip6-localhost" as the default hostname for [::1]. The better way is to default |host| to NULL and rely on BIO_lookup() to return a BIO_ADDRINFO with the appropriate loopback address for IPv4 or IPv6 as indicated by the |family| parameter. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* constify PACKETEmilia Kasper2016-02-011-1/+1
| | | | | | | | PACKET contents should be read-only. To achieve this, also - constify two user callbacks - constify BUF_reverse. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove /* foo.c */ commentsRich Salz2016-01-261-1/+0
| | | | | | | | | | | | This was done by the following find . -name '*.[ch]' | /tmp/pl where /tmp/pl is the following three-line script: print unless $. == 1 && m@/\* .*\.[ch] \*/@; close ARGV if eof; # Close file to reset $. And then some hand-editing of other files. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Fix s_server problem with no-ecMatt Caswell2015-12-151-1/+1
| | | | | | | | | | s_server was trying to set the ECDH curve when no-ec was defined. This also highlighted the fact that the -no_ecdhe option to s_server is broken, and doesn't make any sense any more (ECDHE is on by default and the only way it can be disabled is through the cipherstring). Therefore this commit removes the option. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* DTLS: remove unused cookie fieldEmilia Kasper2015-10-091-1/+1
| | | | | | | | Note that this commit constifies a user callback parameter and therefore will break compilation for applications using this callback. But unless they are abusing write access to the buffer, the fix is trivial. Reviewed-by: Andy Polyakov <appro@openssl.org>
* memset, memcpy, sizeof consistency fixesRich Salz2015-05-051-1/+1
| | | | | | | | Just as with the OPENSSL_malloc calls, consistently use sizeof(*ptr) for memset and memcpy. Remove needless casts for those functions. For memset, replace alternative forms of zero with 0. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove needless bio_err argumentRich Salz2015-04-291-2/+2
| | | | | | | Many functions had a BIO* parameter, and it was always called with bio_err. Remove the param and just use bio_err. Reviewed-by: Matt Caswell <matt@openssl.org>
* Big apps cleanup (option-parsing, etc)Rich Salz2015-04-241-9/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is merges the old "rsalz-monolith" branch over to master. The biggest change is that option parsing switch from cascasding 'else if strcmp("-foo")' to a utility routine and somethin akin to getopt. Also, an error in the command line no longer prints the full summary; use -help (or --help :) for that. There have been many other changes and code-cleanup, see bullet list below. Special thanks to Matt for the long and detailed code review. TEMPORARY: For now, comment out CRYPTO_mem_leaks() at end of main Tickets closed: RT3515: Use 3DES in pkcs12 if built with no-rc2 RT1766: s_client -reconnect and -starttls broke RT2932: Catch write errors RT2604: port should be 'unsigned short' RT2983: total_bytes undeclared #ifdef RENEG RT1523: Add -nocert to fix output in x509 app RT3508: Remove unused variable introduced by b09eb24 RT3511: doc fix; req default serial is random RT1325,2973: Add more extensions to c_rehash RT2119,3407: Updated to dgst.pod RT2379: Additional typo fix RT2693: Extra include of string.h RT2880: HFS is case-insensitive filenames RT3246: req command prints version number wrong Other changes; incompatibilities marked with *: Add SCSV support Add -misalign to speed command Make dhparam, dsaparam, ecparam, x509 output C in proper style Make some internal ocsp.c functions void Only display cert usages with -help in verify Use global bio_err, remove "BIO*err" parameter from functions For filenames, - always means stdin (or stdout as appropriate) Add aliases for -des/aes "wrap" ciphers. *Remove support for IISSGC (server gated crypto) *The undocumented OCSP -header flag is now "-header name=value" *Documented the OCSP -header flag Reviewed-by: Matt Caswell <matt@openssl.org>
* Run util/openssl-format-source -v -c .Matt Caswell2015-01-221-46/+54
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Move more comments that confuse indentMatt Caswell2015-01-221-1/+2
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* RT3548: Remove unsupported platformsRich Salz2015-01-121-7/+7
| | | | | | | This last one for this ticket. Removes WIN16. So long, MS_CALLBACK and MS_FAR. We won't miss you. Reviewed-by: Richard Levitte <levitte@openssl.org>
* s_client/s_server: support unix domain socketsGeoff Thorpe2014-05-081-1/+11
| | | | | | | | | | | | | | | | | | | | | | The "-unix <path>" argument allows s_server and s_client to use a unix domain socket in the filesystem instead of IPv4 ("-connect", "-port", "-accept", etc). If s_server exits gracefully, such as when "-naccept" is used and the requested number of SSL/TLS connections have occurred, then the domain socket file is removed. On ctrl-C, it is likely that the stale socket file will be left over, such that s_server would normally fail to restart with the same arguments. For this reason, s_server also supports an "-unlink" option, which will clean up any stale socket file before starting. If you have any reason to want encrypted IPC within an O/S instance, this concept might come in handy. Otherwise it just demonstrates that there is nothing about SSL/TLS that limits it to TCP/IP in any way. (There might also be benchmarking and profiling use in this path, as unix domain sockets are much lower overhead than connecting over local IP addresses). Signed-off-by: Geoff Thorpe <geoff@openssl.org>
* apps: constify some string parametersGeoff Thorpe2014-04-251-2/+2
| | | | | | | There are certainly many more constifiable strings in the various interfaces, which I hope to get to eventually. Signed-off-by: Geoff Thorpe <geoff@openssl.org>
* Security callback debug print out.Dr. Stephen Henson2014-03-281-0/+1
| | | | | Add a debugging security callback option to s_client/s_server. This will print out each security parameter as it is accepted or rejected.
* Add callbacks supporting generation and retrieval of supplemental data ↵Scott Deboy2013-09-061-4/+0
| | | | | | | | entries, facilitating RFC 5878 (TLS auth extensions) Removed prior audit proof logic - audit proof support was implemented using the generic TLS extension API Tests exercising the new supplemental data registration and callback api can be found in ssltest.c. Implemented changes to s_server and s_client to exercise supplemental data callbacks via the -auth argument, as well as additional flags to exercise supplemental data being sent only during renegotiation.
* Provisional DTLS 1.2 support.Dr. Stephen Henson2013-03-261-1/+1
| | | | | | | | Add correct flags for DTLS 1.2, update s_server and s_client to handle DTLS 1.2 methods. Currently no support for version negotiation: i.e. if client/server selects DTLS 1.2 it is that or nothing.
* make JPAKE work again, fix memory leaksDr. Stephen Henson2012-12-291-1/+1
|
* Add code to download CRLs based on CRLDP extension.Dr. Stephen Henson2012-12-061-2/+2
| | | | Just a sample, real world applications would have to be cleverer.
* remove print_ssl_cert_checks() from openssl application: it is no longer usedDr. Stephen Henson2012-12-061-4/+0
|
* New option to add CRLs for s_client and s_server.Dr. Stephen Henson2012-12-021-1/+3
|
* Don't display messages about verify depth in s_server if -quiet it set.Dr. Stephen Henson2012-11-231-0/+3
| | | | Add support for separate verify and chain stores in s_client.
* Add support for printing out and retrieving EC point formats extension.Dr. Stephen Henson2012-11-221-0/+1
|
* only use a default curve if not already setDr. Stephen Henson2012-11-211-1/+1
|
* add -naccept <n> option to s_server to automatically exit after <n> connectionsDr. Stephen Henson2012-11-181-1/+1
|
* Delegate command line handling for many common options in s_client/s_serverDr. Stephen Henson2012-11-171-0/+6
| | | | | | | | to the SSL_CONF APIs. This is complicated a little because the SSL_CTX structure is not available when the command line is processed: so just check syntax of commands initially and store them, ready to apply later.
* New functions to check a hostname email or IP address against aDr. Stephen Henson2012-10-081-0/+4
| | | | | certificate. Add options to s_client, s_server and x509 utilities to print results of checks.
* Add -brief option to s_client and s_server to summarise connection details.Dr. Stephen Henson2012-09-121-1/+2
| | | | | New option -verify_quiet to shut up the verify callback unless there is an error.
* new ctrl to retrive value of received temporary key in server key exchange ↵Dr. Stephen Henson2012-09-081-0/+1
| | | | message, print out details in s_client
* Add support for certificate stores in CERT structure. This makes itDr. Stephen Henson2012-07-231-1/+1
| | | | | | | | | | | | possible to have different stores per SSL structure or one store in the parent SSL_CTX. Include distint stores for certificate chain verification and chain building. New ctrl SSL_CTRL_BUILD_CERT_CHAIN to build and store a certificate chain in CERT structure: returing an error if the chain cannot be built: this will allow applications to test if a chain is correctly configured. Note: if the CERT based stores are not set then the parent SSL_CTX store is used to retain compatibility with existing behaviour.
* Add new ctrl to retrieve client certificate types, print outDr. Stephen Henson2012-07-081-1/+1
| | | | | | | | | | | | details in s_client. Also add ctrl to set client certificate types. If not used sensible values will be included based on supported signature algorithms: for example if we don't include any DSA signing algorithms the DSA certificate type is omitted. Fix restriction in old code where certificate types would be truncated if it exceeded TLS_CT_NUMBER.
* Add certificate callback. If set this is called whenever a certificateDr. Stephen Henson2012-06-291-0/+8
| | | | | | | | | is required by client or server. An application can decide which certificate chain to present based on arbitrary criteria: for example supported signature algorithms. Add very simple example to s_server. This fixes many of the problems and restrictions of the existing client certificate callback: for example you can now clear existing certificates and specify the whole chain.
* Reorganise supported signature algorithm extension processing.Dr. Stephen Henson2012-06-251-1/+1
| | | | | | Only store encoded versions of peer and configured signature algorithms. Determine shared signature algorithms and cache the result along with NID equivalents of each algorithm.
* RFC 5878 support.Ben Laurie2012-05-301-0/+4
|
* Add options to set additional type specific certificate chains toDr. Stephen Henson2012-04-111-1/+2
| | | | s_server.
* New ctrls to retrieve supported signature algorithms and curves andDr. Stephen Henson2012-03-061-0/+2
| | | | | | extensions to s_client and s_server to print out retrieved valued. Extend CERT structure to cache supported signature algorithm data.
* PR: 2028Dr. Stephen Henson2009-09-041-0/+3
| | | | | | | Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Approved by: steve@openssl.org Fix DTLS cookie management bugs.
* Incidentally http://cvs.openssl.org/chngview?cn=17710 also made it possibleAndy Polyakov2008-12-221-1/+1
| | | | | | to build the library without -D_CRT_NONSTDC_NO_DEPRECATE. This commit expands it even to apps catalog and actually omits the macro in question from Configure.
* Aftermath of a clashing size_t fix (now only format changes).Ben Laurie2008-11-131-1/+1
|
* Revert the size_t modifications from HEAD that had led to moreGeoff Thorpe2008-11-121-6/+3
| | | | | | knock-on work than expected - they've been extracted into a patch series that can be completed elsewhere, or in a different branch, before merging back to HEAD.
* size_tification.Ben Laurie2008-11-011-3/+6
|
* RFC4507 (including RFC4507bis) TLS stateless session resumption supportDr. Stephen Henson2007-08-111-0/+3
| | | | for OpenSSL.
* Fixes for signed/unsigned warnings and shadows.Dr. Stephen Henson2005-04-261-1/+1
|
* Add DTLS support.Ben Laurie2005-04-261-2/+2
|
* Give everything prototypes (well, everything that's actually used).Ben Laurie2005-03-311-1/+1
|
* PR: 910Dr. Stephen Henson2004-11-161-0/+1
| | | | | | | | Add command line options -certform, -keyform and -pass to s_client and s_server. This supports the use of alternative passphrase sources, key formats and keys handled by an ENGINE. Update docs.
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-23 09:07:08 +0000