aboutsummaryrefslogtreecommitdiffstats
path: root/apps
Commit message (Collapse)AuthorAgeFilesLines
* RT 3854: Update apps/reqEmilia Kasper2016-02-121-2/+2
| | | | | | Change the default keysize to 2048 bits, and the minimum to 512 bits. Reviewed-by: Rich Salz <rsalz@openssl.org>
* make generateRichard Levitte2016-02-121-12/+12
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Generate progs.h from a bunch of files instead of internal knowledgeRichard Levitte2016-02-123-23/+27
| | | | | | | | | | | | apps/progs.pl counted on the caller to provide the exact command files. The unified build doesn't have that knowledge, and the easier and more flexible thing to do is to feed it all the apps/*.c files and let it figure out the command names by looking inside (looking for /int ([a-z0-9][a-z0-9_]*)_main\(int argc,/). Also, add it to the generate command, since it's a versioned file. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Perl's chop / chomp considered bad, use a regexp insteadRichard Levitte2016-02-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Once upon a time, there was chop, which somply chopped off the last character of $_ or a given variable, and it was used to take off the EOL character (\n) of strings. ... but then, you had to check for the presence of such character. So came chomp, the better chop which checks for \n before chopping it off. And this worked well, as long as Perl made internally sure that all EOLs were converted to \n. These days, though, there seems to be a mixture of perls, so lines from files in the "wrong" environment might have \r\n as EOL, or just \r (Mac OS, unless I'm misinformed). So it's time we went for the more generic variant and use s|\R$||, the better chomp which recognises all kinds of known EOLs and chops them off. A few chops were left alone, as they are use as surgical tools to remove one last slash or one last comma. NOTE: \R came with perl 5.10.0. It means that from now on, our scripts will fail with any older version. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove TLS heartbeat, disable DTLS heartbeatRich Salz2016-02-111-0/+3
| | | | | | | | | To enable heartbeats for DTLS, configure with enable-heartbeats. Heartbeats for TLS have been completely removed. This addresses RT 3647 Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix engine key support in cms and req utilities.Dr. Stephen Henson2016-02-112-5/+5
| | | | | | PR#4246 and PR#4266 Reviewed-by: Rich Salz <rsalz@openssl.org>
* The protocol variable has lost its use, remove itRichard Levitte2016-02-111-12/+2
| | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Fix errstr error code parsingMatt Caswell2016-02-111-1/+1
| | | | | | | | Error codes are printed in hex, and previous OpenSSL versions expected the error codes to be provided to errstr in hex. In 1.1.0, for some reason, it was expecting them to be decimal. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Use the protocol we know rather than BIO_ADDRINFO_protocol(res)Richard Levitte2016-02-101-2/+2
| | | | | | | Because some platforms won't will in any value in ai_protocol, there's no point using it if we already know what it should be. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Don't assert protocol equalityRichard Levitte2016-02-101-4/+2
| | | | | | | | | It seems that some platforms' getaddrinfo don't fill in the ai_protocol field properly. On those, the assertion 'protocol == BIO_ADDRINFO_protocol(res)' will fail. Best to remove it. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* typoDr. Stephen Henson2016-02-101-2/+2
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Make it possible to get ENGINESDIR info from OpenSSL_versionsRichard Levitte2016-02-101-0/+7
| | | | | | | | Have apps/openssl display the result along with OPENSSLDIR As part of this, add ENGINESDIR in util/mk1mf.pl Reviewed-by: Rich Salz <rsalz@openssl.org>
* Attempt to log an error if init failedMatt Caswell2016-02-101-0/+5
| | | | | | | | | If init failed we'd like to set an error code to indicate that. But if init failed then when the error system tries to load its strings its going to fail again. We could get into an infinite loop. Therefore we just set a single error the first time around. After that no error is set. Reviewed-by: Rich Salz <rsalz@openssl.org>
* The new init functions can now fail so shouldn't be voidMatt Caswell2016-02-101-2/+3
| | | | | | | The new init functions can fail if the library has already been stopped. We should be able to indicate failure with a 0 return value. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Improve recent option help string additionsViktor Dukhovni2016-02-101-27/+30
| | | | | | Make these more correct, concise and less tautological. Reviewed-by: Stephen Henson <steve@openssl.org>
* Deprecate the -issuer_checks debugging optionViktor Dukhovni2016-02-102-3/+2
| | | | | | | | | | | | This was a developer debugging feature and was never a useful public interface. Added all missing X509 error codes to the verify(1) manpage, but many still need a description beyond the associated text string. Sorted the errors in x509_txt.c by error number. Reviewed-by: Stephen Henson <steve@openssl.org>
* Rename INIT funtions, deprecate old ones.Rich Salz2016-02-101-2/+2
| | | | | | Man, there were a lot of renamings :) Reviewed-by: Richard Levitte <levitte@openssl.org>
* clean away old VMS cruftRichard Levitte2016-02-103-1497/+0
| | | | | | | | | | | | The old building scripts get removed, they are hopelessly gone in bit rot by now. Also remove the old symbol hacks. They were needed needed to shorten some names to 31 characters, and to resolve other symbol clashes. Because we now compile with /NAMES=(AS_IS,SHORTENED), this is no longer required. Reviewed-by: Rich Salz <rsalz@openssl.org>
* unified build scheme: add a "unified" template for VMS descrip.mmsRichard Levitte2016-02-101-1/+2
| | | | | | | | | | | | | | | | | | | As part of this, change util/mkdef.pl to stop adding libraries to depend on in its output. mkdef.pl should ONLY output a symbol vector. Because symbol names can't be longer than 31 characters, we use the compiler to shorten those that are longer down to 23 characters plus an 8 character CRC. To make sure users of our header files will pick up on that automatically, add the DEC C supported extra headers files __decc_include_prologue.h and __decc_include_epilogue.h. Furthermore, we add a config.com, so VMS people can configure just as comfortably as any Unix folks, thusly: @config Reviewed-by: Rich Salz <rsalz@openssl.org>
* unified build scheme: add a "unified" template for Unix MakefileRichard Levitte2016-02-101-0/+6
| | | | | | This also adds all the raw sections needed for some files. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Simplify the specification of include dirs in the build dirRichard Levitte2016-02-101-2/+2
| | | | | | | | | In build.info files, make the include directory in the build directory absolute, or Configure will think it should be added to the source directory top. Configure will turn it into a relative path if possible. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Use NON_EMPTY_TRANSLATION_UNIT, consistently.Rich Salz2016-02-0911-99/+61
| | | | | | This also closes RT 4123 Reviewed-by: Richard Levitte <levitte@openssl.org>
* GH646: Update help for s_server command.A J Mohan Rao2016-02-092-81/+128
| | | | | | | | | | | | * added missing help option messages * ecdh_single option is removed as it is a no-op and not an option supported in earlier versions * ssl_ctx_security_debug() was invoked before ctx check for NULL * trusted_first option can be removed, as it is always enabled in 1.1. But not removed the option, require confirmation. Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Updates for auto init/deinit review commentsMatt Caswell2016-02-091-1/+1
| | | | | | Fixes for the auto-init/deinit code based on review comments Reviewed-by: Richard Levitte <levitte@openssl.org>
* Get the apps to use auto-init/de-initMatt Caswell2016-02-091-30/+4
| | | | | | Clean up the apps so that we make use of the new auto-init/de-init feature. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Auto init/deinit libcryptoMatt Caswell2016-02-092-8/+0
| | | | | | | This builds on the previous commit to auto initialise/deinitialise libcrypto. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Suppress DANE TLSA reflection when verification failsViktor Dukhovni2016-02-083-16/+79
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As documented both SSL_get0_dane_authority() and SSL_get0_dane_tlsa() are expected to return a negative match depth and nothing else when verification fails. However, this only happened when verification failed during chain construction. Errors in verification of the constructed chain did not have the intended effect on these functions. This commit updates the functions to check for verify_result == X509_V_OK, and no longer erases any accumulated match information when chain construction fails. Sophisticated developers can, with care, use SSL_set_verify_result(ssl, X509_V_OK) to "peek" at TLSA info even when verification fail. They must of course first check and save the real error, and restore the original error as quickly as possible. Hiding by default seems to be the safer interface. Introduced X509_V_ERR_DANE_NO_MATCH code to signal failure to find matching TLSA records. Previously reported via X509_V_ERR_CERT_UNTRUSTED. This also changes the "-brief" output from s_client to include verification results and TLSA match information. Mentioned session resumption in code example in SSL_CTX_dane_enable(3). Also mentioned that depths returned are relative to the verified chain which is now available via SSL_get0_verified_chain(3). Added a few more test-cases to danetest, that exercise the new code. Resolved thread safety issue in use of static buffer in X509_verify_cert_error_string(). Fixed long-stating issue in apps/s_cb.c which always sets verify_error to either X509_V_OK or "chain to long", code elsewhere (e.g. s_time.c), seems to expect the actual error. [ The new chain construction code is expected to correctly generate "chain too long" errors, so at some point we need to drop the work-arounds, once SSL_set_verify_depth() is also fixed to propagate the depth to X509_STORE_CTX reliably. ] Reviewed-by: Rich Salz <rsalz@openssl.org>
* fix various formatting issuesDr. Stephen Henson2016-02-081-1/+3
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Use new namesDr. Stephen Henson2016-02-081-4/+4
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Use accessors in pkcs12 app.Dr. Stephen Henson2016-02-081-11/+19
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Deprecate undocumented SSL_cache_hit().Dr. Stephen Henson2016-02-082-3/+3
| | | | | | | Deprecate undocumented SSL_cache_hit(). Make SSL_session_reused() into a real function. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix engine key support in utilities.Dr. Stephen Henson2016-02-087-15/+14
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* more doc fixesRich Salz2016-02-074-15/+18
| | | | | | | | | | | | | | | | | dgst: using digest instead of specific digest commands the digest list specified in man dgst may be inaccurate, hence using digest and referring to the list in digest-commands 'sha' as a digest name is no longer supported dgst,pkeyutl cmds help cleanup - In dgst, pkeyutl cmds, some options help was missing. - fixed a minor typo in openssl.pod, that fixes make install. - digest-commands was showing ‘sha’, which is not a supported digest anymore. Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
* commands help cleanupA J Mohan Rao2016-02-064-8/+14
| | | | | | | | opt_valtype 0 is same as '-' while printing cmd usage asn1parse/ca/ciphers help cleanup Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Enhance and clear the support of linker flagsRichard Levitte2016-02-061-2/+3
| | | | | | | | | | | | | | | | | | | | | | | Some time ago, we had a ex_libs configuration setting that could be divided into lflags and ex_libs. These got divided in two settings, lflags and ex_libs, and the former was interpreted to be general linking flags. Unfortunately, that conclusion wasn't entirely accurate. Most of those linking were meant to end up in a very precise position on the linking command line, just before the spec of libraries the linking depends on. Back to the drawing board, we're diving things further, now having lflags, which are linking flags that aren't depending on command line position, plib_lflags, which are linking flags that should show up just before the spec of libraries to depend on, and finally ex_libs, which is the spec of extra libraries to depend on. Also, documentation is changed in Configurations/README. This was previously forgotten. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* GH634: fix potential memory leakInsu Yun2016-02-061-0/+1
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* RT4194: Restore old engine parameter parsing.Rich Salz2016-02-061-22/+42
| | | | | | | | | Allow initial engine names as first parameters before flags. Also add engine param to help summary Wrote manpage Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* GH601: Various spelling fixes.FdaSilvaYY2016-02-052-2/+2
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Make DTLSv1_listen a first class function and change its typeMatt Caswell2016-02-051-1/+1
| | | | | | | | | The DTLSv1_listen function exposed details of the underlying BIO abstraction and did not properly allow for IPv6. This commit changes the "peer" argument to be a BIO_ADDR and makes it a first class function (rather than a ctrl) to ensure proper type checking. Reviewed-by: Richard Levitte <levitte@openssl.org>
* If memory debugging enabled return error on leaks.Dr. Stephen Henson2016-02-051-1/+2
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Restore -no_comp switch for backwards compatible behaviourViktor Dukhovni2016-02-051-2/+4
| | | | Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Fix pkeyutl inability to directly access keys on hardware tokensMouse2016-02-041-5/+18
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add ec -check optionDr. Stephen Henson2016-02-041-2/+15
| | | | Reviewed-by: Andy Polyakov <appro@openssl.org>
* RT2887: Add more packet and handshake typesDaniel Black2016-02-041-0/+7
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Refactoring BIO: Adapt s_client and s_serverRichard Levitte2016-02-034-605/+364
| | | | | | | | | | | | | | | | | | | s_socket.c gets brutally cleaned out and now consists of only two functions, one for client and the other for server. They both handle AF_INET, AF_INET6 and additionally AF_UNIX where supported. The rest is just easy adaptation. Both s_client and s_server get the new flags -4 and -6 to force the use of IPv4 or IPv6 only. Also, the default host "localhost" in s_client is removed. It's not certain that this host is set up for both IPv4 and IPv6. For example, Debian has "ip6-localhost" as the default hostname for [::1]. The better way is to default |host| to NULL and rely on BIO_lookup() to return a BIO_ADDRINFO with the appropriate loopback address for IPv4 or IPv6 as indicated by the |family| parameter. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Refactoring BIO: Adapt BIO_s_datagram and all that depends on itRichard Levitte2016-02-032-47/+27
| | | | | | | The control commands that previously took a struct sockaddr * have been changed to take a BIO_ADDR * instead. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* RT3234: disable compressionEmilia Kasper2016-02-031-3/+3
| | | | | | | | | | | | | | | | | CRIME protection: disable compression by default, even if OpenSSL is compiled with zlib enabled. Applications can still enable compression by calling SSL_CTX_clear_options(ctx, SSL_OP_NO_COMPRESSION), or by using the SSL_CONF library to configure compression. SSL_CONF continues to work as before: SSL_CONF_cmd(ctx, "Options", "Compression") enables compression. SSL_CONF_cmd(ctx, "Options", "-Compression") disables compression (now no-op by default). The command-line switch has changed from -no_comp to -comp. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix pkeyutl/rsautl empty encrypt-input/decrypt-output handlingViktor Dukhovni2016-02-025-68/+119
| | | | | | | | | | | | | Also fix option processing in pkeyutl to allow use of (formerly) "out-of-order" switches that were needless implementation limitations. Handle documented "ENGINE" form with -keyform and -peerform. Better handling of OPENSSL_NO_ENGINE and OPENSSL_NO_RSA. RT2018 Reviewed-by: Rich Salz <rsalz@openssl.org>
* constify PACKETEmilia Kasper2016-02-013-4/+4
| | | | | | | | PACKET contents should be read-only. To achieve this, also - constify two user callbacks - constify BUF_reverse. Reviewed-by: Rich Salz <rsalz@openssl.org>
* add option to exclude public key from EC keysDr. Stephen Henson2016-02-011-1/+10
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-01 06:03:33 +0000