aboutsummaryrefslogtreecommitdiffstats
path: root/apps/s_cb.c
Commit message (Collapse)AuthorAgeFilesLines
* Copyright consolidation 01/10Rich Salz2016-05-171-107/+6
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Remove some dead codeMatt Caswell2016-04-211-4/+0
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix warnings exposed by clang-3.8Emilia Kasper2016-04-101-2/+2
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Make DH opaqueMatt Caswell2016-04-091-1/+1
| | | | | | | Move the dh_st structure into an internal header file and provide relevant accessors for the internal fields. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix no-sockMatt Caswell2016-03-211-0/+4
| | | | | | Misc fixes for no-sock Reviewed-by: Richard Levitte <levitte@openssl.org>
* Bugfix: Encode the requested length in s_cb.c:hexencode()Viktor Dukhovni2016-03-171-1/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Constify security callbacksKurt Roeckx2016-03-091-2/+2
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
* Extends s_client to allow a basic CT policy to be enabledRob Percival2016-03-041-0/+1
| | | | | Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Drop support for printing SSLv2 ciphers names.Kurt Roeckx2016-02-271-2/+3
| | | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #2083
* Remove unused parameters from internal functionsRich Salz2016-02-221-2/+2
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove JPAKERich Salz2016-02-171-16/+1
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Suppress DANE TLSA reflection when verification failsViktor Dukhovni2016-02-081-1/+77
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As documented both SSL_get0_dane_authority() and SSL_get0_dane_tlsa() are expected to return a negative match depth and nothing else when verification fails. However, this only happened when verification failed during chain construction. Errors in verification of the constructed chain did not have the intended effect on these functions. This commit updates the functions to check for verify_result == X509_V_OK, and no longer erases any accumulated match information when chain construction fails. Sophisticated developers can, with care, use SSL_set_verify_result(ssl, X509_V_OK) to "peek" at TLSA info even when verification fail. They must of course first check and save the real error, and restore the original error as quickly as possible. Hiding by default seems to be the safer interface. Introduced X509_V_ERR_DANE_NO_MATCH code to signal failure to find matching TLSA records. Previously reported via X509_V_ERR_CERT_UNTRUSTED. This also changes the "-brief" output from s_client to include verification results and TLSA match information. Mentioned session resumption in code example in SSL_CTX_dane_enable(3). Also mentioned that depths returned are relative to the verified chain which is now available via SSL_get0_verified_chain(3). Added a few more test-cases to danetest, that exercise the new code. Resolved thread safety issue in use of static buffer in X509_verify_cert_error_string(). Fixed long-stating issue in apps/s_cb.c which always sets verify_error to either X509_V_OK or "chain to long", code elsewhere (e.g. s_time.c), seems to expect the actual error. [ The new chain construction code is expected to correctly generate "chain too long" errors, so at some point we need to drop the work-arounds, once SSL_set_verify_depth() is also fixed to propagate the depth to X509_STORE_CTX reliably. ] Reviewed-by: Rich Salz <rsalz@openssl.org>
* GH601: Various spelling fixes.FdaSilvaYY2016-02-051-1/+1
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* RT2887: Add more packet and handshake typesDaniel Black2016-02-041-0/+7
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Refactoring BIO: Adapt BIO_s_datagram and all that depends on itRichard Levitte2016-02-031-42/+18
| | | | | | | The control commands that previously took a struct sockaddr * have been changed to take a BIO_ADDR * instead. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* constify PACKETEmilia Kasper2016-02-011-2/+2
| | | | | | | | PACKET contents should be read-only. To achieve this, also - constify two user callbacks - constify BUF_reverse. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Refactor apps load_certs/load_crls to work incrementallyViktor Dukhovni2016-01-201-3/+2
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Refactor DTLS cookie generation and verificationRichard Levitte2015-12-231-66/+11
| | | | | | | | DTLS cookie generation and verification were exact copies of each other save the last few lines. This refactors them to avoid code copying. Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix s_server problem with no-ecMatt Caswell2015-12-151-16/+1
| | | | | | | | | | s_server was trying to set the ECDH curve when no-ec was defined. This also highlighted the fact that the -no_ecdhe option to s_server is broken, and doesn't make any sense any more (ECDHE is on by default and the only way it can be disabled is through the cipherstring). Therefore this commit removes the option. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* New function X509_get0_pubkeyDr. Stephen Henson2015-12-141-2/+1
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Continue standardisation of malloc handling in appsMatt Caswell2015-11-091-2/+6
| | | | | | continue on from previous commits but in the apps directory Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* DTLS: remove unused cookie fieldEmilia Kasper2015-10-091-1/+1
| | | | | | | | Note that this commit constifies a user callback parameter and therefore will break compilation for applications using this callback. But unless they are abusing write access to the buffer, the fix is trivial. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Print debug info for extended master secret extensionAlessandro Ghedini2015-09-281-0/+3
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
* make no-dh workDr. Stephen Henson2015-09-201-1/+2
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Enable -Wmissing-variable-declarations andBen Laurie2015-09-111-2/+2
| | | | | | | -Wincompatible-pointer-types-discards-qualifiers (the latter did not require any code changes). Reviewed-by: Rich Salz <rsalz@openssl.org>
* remove 0 assignments.Rich Salz2015-09-031-8/+1
| | | | | | | After openssl_zalloc, cleanup more "set to 0/NULL" assignments. Many are from github feedback. Reviewed-by: Tim Hudson <tjh@openssl.org>
* GH371: Print debug info for ALPN extensionAlessandro Ghedini2015-08-261-0/+4
| | | | | | Also known as RT 4106 Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Matt Caswell <matt@openssl.org>
* Remove Gost94 signature algorithm.Rich Salz2015-08-111-1/+0
| | | | | | | This was obsolete in 2001. This is not the same as Gost94 digest. Thanks to Dmitry Belyavsky <beldmit@gmail.com> for review and advice. Reviewed-by: Matt Caswell <matt@openssl.org>
* RT2547: Tighten perms on generated privkey filesRich Salz2015-06-151-1/+0
| | | | | | | | | | | | When generating a private key, try to make the output file be readable only by the owner. Put it in CHANGES file since it might be noticeable. Add "int private" flag to apps that write private keys, and check that it's set whenever we do write a private key. Checked via assert so that this bug (security-related) gets fixed. Thanks to Viktor for help in tracing the code-paths where private keys are written. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Use bio_err not stderr in apps.Rich Salz2015-06-091-2/+3
| | | | | | Except for VMS startup code. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Replace switch/assignments with table lookupRich Salz2015-05-201-386/+166
| | | | | | | | Typedef STRINT_PAIR to be the same as OPT_PAIR, and use that structure and a bunch of tables instead of switch statements to lookup various values out of the SSL/TLS message buffers. Shrinks a bunch of code. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix for memcpy() and strcmp() being undefined.Bjoern D. Rasmussen2015-05-111-0/+1
| | | | | | | | clang says: "s_cb.c:958:9: error: implicitly declaring library function 'memcpy'" Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Use "==0" instead of "!strcmp" etcRich Salz2015-05-061-2/+2
| | | | | | | For the various string-compare routines (strcmp, strcasecmp, str.*cmp) use "strcmp()==0" instead of "!strcmp()" Reviewed-by: Tim Hudson <tjh@openssl.org>
* Use safer sizeof variant in mallocRich Salz2015-05-041-1/+1
| | | | | | | | | | | | | For a local variable: TYPE *p; Allocations like this are "risky": p = OPENSSL_malloc(sizeof(TYPE)); if the type of p changes, and the malloc call isn't updated, you could get memory corruption. Instead do this: p = OPENSSL_malloc(sizeof(*p)); Also fixed a few memset() calls that I noticed while doing this. Reviewed-by: Richard Levitte <levitte@openssl.org>
* free NULL cleanup -- codaRich Salz2015-05-011-2/+4
| | | | | | | | After the finale, the "real" final part. :) Do a recursive grep with "-B1 -w [a-zA-Z0-9_]*_free" to see if any of the preceeding lines are an "if NULL" check that can be removed. Reviewed-by: Tim Hudson <tjh@openssl.org>
* In apps, malloc or dieRich Salz2015-04-301-21/+5
| | | | | | | | No point in proceeding if you're out of memory. So change *all* OPENSSL_malloc calls in apps to use the new routine which prints a message and exits. Reviewed-by: Richard Levitte <levitte@openssl.org>
* free NULL cleanup 5aRich Salz2015-04-301-10/+5
| | | | | | | | | Don't check for NULL before calling a free routine. This gets X509_.*free: x509_name_ex_free X509_policy_tree_free X509_VERIFY_PARAM_free X509_STORE_free X509_STORE_CTX_free X509_PKEY_free X509_OBJECT_free_contents X509_LOOKUP_free X509_INFO_free Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove needless bio_err argumentRich Salz2015-04-291-35/+36
| | | | | | | Many functions had a BIO* parameter, and it was always called with bio_err. Remove the param and just use bio_err. Reviewed-by: Matt Caswell <matt@openssl.org>
* Big apps cleanup (option-parsing, etc)Rich Salz2015-04-241-160/+80
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is merges the old "rsalz-monolith" branch over to master. The biggest change is that option parsing switch from cascasding 'else if strcmp("-foo")' to a utility routine and somethin akin to getopt. Also, an error in the command line no longer prints the full summary; use -help (or --help :) for that. There have been many other changes and code-cleanup, see bullet list below. Special thanks to Matt for the long and detailed code review. TEMPORARY: For now, comment out CRYPTO_mem_leaks() at end of main Tickets closed: RT3515: Use 3DES in pkcs12 if built with no-rc2 RT1766: s_client -reconnect and -starttls broke RT2932: Catch write errors RT2604: port should be 'unsigned short' RT2983: total_bytes undeclared #ifdef RENEG RT1523: Add -nocert to fix output in x509 app RT3508: Remove unused variable introduced by b09eb24 RT3511: doc fix; req default serial is random RT1325,2973: Add more extensions to c_rehash RT2119,3407: Updated to dgst.pod RT2379: Additional typo fix RT2693: Extra include of string.h RT2880: HFS is case-insensitive filenames RT3246: req command prints version number wrong Other changes; incompatibilities marked with *: Add SCSV support Add -misalign to speed command Make dhparam, dsaparam, ecparam, x509 output C in proper style Make some internal ocsp.c functions void Only display cert usages with -help in verify Use global bio_err, remove "BIO*err" parameter from functions For filenames, - always means stdin (or stdout as appropriate) Add aliases for -des/aes "wrap" ciphers. *Remove support for IISSGC (server gated crypto) *The undocumented OCSP -header flag is now "-header name=value" *Documented the OCSP -header flag Reviewed-by: Matt Caswell <matt@openssl.org>
* Code style: space after 'if'Viktor Dukhovni2015-04-161-2/+2
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* free NULL cleanupRich Salz2015-03-281-2/+1
| | | | | | | | | EVP_.*free; this gets: EVP_CIPHER_CTX_free EVP_PKEY_CTX_free EVP_PKEY_asn1_free EVP_PKEY_asn1_set_free EVP_PKEY_free EVP_PKEY_free_it EVP_PKEY_meth_free; and also EVP_CIPHER_CTX_cleanup Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* RAND_bytes updatesMatt Caswell2015-03-251-1/+1
| | | | | | | Ensure RAND_bytes return value is checked correctly, and that we no longer use RAND_pseudo_bytes. Reviewed-by: Richard Levitte <levitte@openssl.org>
* apps return value checksMatt Caswell2015-03-231-2/+4
| | | | | | | Ensure that all libssl functions called from within the apps have their return values checked where appropriate. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Merge OPENSSL_NO_EC{DH,DSA} into OPENSSL_NO_ECRich Salz2015-03-111-1/+1
| | | | | | Suggested by John Foley <foleyj@cisco.com>. Reviewed-by: Matt Caswell <matt@openssl.org>
* Unchecked malloc fixesMatt Caswell2015-03-051-0/+5
| | | | | | | Miscellaneous unchecked malloc fixes. Also fixed some mem leaks on error paths as I spotted them along the way. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Dead code clean: #if 0 removal in appsRich Salz2015-01-301-4/+0
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove support for opaque-prfRich Salz2015-01-281-5/+0
| | | | | | | An expired IETF Internet-Draft (seven years old) that nobody implements, and probably just as good as NSA DRBG work. Reviewed-by: Richard Levitte <levitte@openssl.org>
* More comment realignmentmaster-post-reformatMatt Caswell2015-01-221-4/+4
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Re-align some comments after running the reformat script.Matt Caswell2015-01-221-14/+14
| | | | | | | This should be a one off operation (subsequent invokation of the script should not move them) Reviewed-by: Tim Hudson <tjh@openssl.org>
* Run util/openssl-format-source -v -c .Matt Caswell2015-01-221-1676/+1547
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-23 06:12:43 +0000