aboutsummaryrefslogtreecommitdiffstats
path: root/apps
Commit message (Collapse)AuthorAgeFilesLines
* APPS: Reduce deprecation warning suppression - ENGINERichard Levitte2020-10-046-102/+162
| | | | | | | | | | | | | | | Some of our apps turn off deprecation warnings solely for the sake of ENGINE, and thereby shadowing other deprecations that we should take better care of. To solve this, all apps ENGINE functionality is move to one file, where deprecation warning suppression is activate, and the same suppression can then easily be removed in at least some of the apps. Any remaining suppression that we still need to deal with should happen as separate efforts. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13044)
* Run the withlibctx.pl scriptMatt Caswell2020-10-0110-39/+32
| | | | | | | | Automatically rename all instances of _with_libctx() to _ex() as per our coding style. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12970)
* Fix bug in EDDSA speed testShane Lontis2020-09-261-0/+1
| | | | | | | | | | | | | | | | The pkey created in one loop was being fed into the keygen of the next loop - since it was not set to NULL after the free. This meant that the 2 EVP_MD_CTX objects that still had ref counts to this key were getting confused. All other tests clear the key after freeing the key if they loop (some do this by declaring/initing the pkey inside the loop). The offending code is a recent addition to the speed app. This was found using the -async_jobs option. Similar code was tried for an RSA key using 111 which resulted in the same issue. Found while trying to test issue #128867 (It is not known if this will fix that issue yet). Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12975)
* en EVP_PKEY_CTX_set_rsa_keygen_pubexp() BIGNUM managementjwalch2020-09-261-1/+1
| | | | | | | | | | | | Fixes #12635 As discussed in the issue, supporting the set0-like semantics long-term is not necessarily desirable, although necessary for short-term compatibility concerns. So I've deprecated the original method and added an equivalent that is explicitly labelled as set1. I tried to audit existing usages of the (now-deprecated) API and update them to use set1 if that appeared to align with their expectations. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12917)
* Remove openssl provider appShane Lontis2020-09-262-383/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12943)
* Update openssl list to support new provider objects.Shane Lontis2020-09-261-69/+432
| | | | | | | | Added Keymanager, signatures, kem, asymciphers and keyexchange. Added -select option so that specific algorithms are easier to view when using -verbose Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12943)
* apps/ca.c: Rename confusing variable 'req' to 'template_cert' in certify_cert()Dr. David von Oheimb2020-09-241-7/+7
| | | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12893)
* load_key_certs_crls(): Restore output of fatal errorsDr. David von Oheimb2020-09-2415-56/+82
| | | | | | | | | | Also improve credentials loading diagnostics for many apps. Fixes #12840 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12893)
* Use OPENSSL_SYS_TANDEM instead of OPENSSL_SYSNAME_TANDEMRichard Levitte2020-09-242-2/+2
| | | | | | | | | | This streamlines with all other config targets, and draws from the 'sys_id' config attribute. Fixes #12858 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12933)
* list: add capability to print details about the current DRBGsPauli2020-09-233-2/+116
| | | | | | | | This allows a user to confirm that the DRBG their configuration specified is being used. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12931)
* apps/ocsp: Return non zero exit code with invalid certIDTomas Mraz2020-09-211-6/+12
| | | | | | | Fixes #7151 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12916)
* Add option to fipsinstall to disable fips security checks at run time.Shane Lontis2020-09-181-11/+23
| | | | | | | Changes merged from a patch by @richsalz. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12745)
* Add error message to genpkey app for the '-genparam' optionShane Lontis2020-09-181-1/+5
| | | | | | | The ordering of this option is important so inform the user if they do it incorrectly. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12745)
* FIX strncpy warning in apps/cmp.c.Xiaofei Bai2020-09-171-1/+1
| | | | | | | | | | | | | bugfix: #12872 strncpy here has compiling warning of -Wstringop-truncation, change into BIO_snprintf as before. Change-Id: I362872c4ad328cadd4c7a5a5da3165655fa26c0d Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/12889)
* Correctly display the signing/hmac algorithm in the dgst appMatt Caswell2020-09-171-7/+2
| | | | | | | | | | | | | | | | | | | In OpenSSL 1.1.1 doing an HMAC operation with (say) SHA1 would produce output like this: HMAC-SHA1(README.md)= 553154e4c0109ddc320bb495735906ad7135c2f1 Prior to this change master would instead display this like so: SHA1(README.md)= 553154e4c0109ddc320bb495735906ad7135c2f1 The problem is that dgst was using EVP_PKEY_asn1_get0_info() to get the algorithm name from the EVP_PKEY. This doesn't work with provider based keys. Instead we introduce a new EVP_PKEY_get0_first_alg_name() function, and an equivalent EVP_KEYMGMT_get0_first_name() function. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12850)
* Don't send -1 as the length of the hmac keyMatt Caswell2020-09-171-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | The dgst app was using an undocumented behaviour in the EVP_PKEY_new_raw_private_key() function when setting a key length for a MAC. The old EVP_PKEY to MAC bridge, probably by accident, converts a -1 length to a strlen() call, by virtue of the fact that it eventually calls ASN1_STRING_set() which has this feature. As noted above this is undocumented, and unexpected since the len parameter to EVP_PKEY_new_raw_private_key() is an unsigned value (size_t). In the old bridge it was later (silently) cast to an int, and therefore the original -1 value was restored. This only works because sizeof(int) <= sizeof(size_t). If we ever run on a platform where sizeof(int) > sizeof(size_t) then it would have failed. The behaviour also doesn't hold for EVP_PKEY_new_raw_private_key() in general - only when the old MAC bridge was in use. Rather than restore the original behaviour I think it is best to simply fix the dgst app to not assume it exists. We should not bake in this backwards and inconsistent behaviour. Fixes #12837 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12850)
* generate_cookie_callback: free temporary memory on an error pathPauli2020-09-161-0/+1
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/12870)
* Fix safestack issues in pkcs12.hMatt Caswell2020-09-131-2/+0
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
* Fix safestack issues in conf.hMatt Caswell2020-09-134-7/+0
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
* Fix safestack issues in ct.hMatt Caswell2020-09-131-2/+0
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
* Fix safestack issues in pkcs7.hMatt Caswell2020-09-131-1/+0
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
* Fix safestack issues in ocsp.hMatt Caswell2020-09-131-1/+0
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
* Fix safestack issues in cms.hMatt Caswell2020-09-131-2/+0
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
* Fix safestack issues in cmp.hMatt Caswell2020-09-132-4/+0
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
* Fix safestack issues in asn1.hMatt Caswell2020-09-133-5/+0
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
* Fix stacks of OPENSSL_STRING, OPENSSL_CSTRING and OPENSSL_BLOCKMatt Caswell2020-09-1324-40/+0
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
* Fix safestack issues in x509v3.hMatt Caswell2020-09-132-5/+0
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
* Fix safestack issues in x509.hMatt Caswell2020-09-1317-35/+0
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
* Fix safestack issues in ssl.hMatt Caswell2020-09-132-3/+0
| | | | | | | | | | | | | | | | | | | | | We fix 3 problems with safestack: - Including an openssl header file without linking against libcrypto can cause compilation failures (even if the app does not otherwise need to link against libcrypto). See issue #8102 - Recent changes means that applications in no-deprecated builds will need to include additional macro calls in the source code for all stacks that they need to use - which is an API break. This changes avoids that necessity. - It is not possible to write code using stacks that works in both a no-deprecated and a normal build of OpenSSL. See issue #12707. Fixes #12707 Contains a partial fix for #8102. A similar PR will be needed for hash to fully fix. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
* NonStop port updates for 3.0.0.Randall S. Becker2020-09-128-1/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | HPE NonStop Port Changes for 3.0.0 Includes unthreaded, PUT, and SPT for OSS. The port changes include wrapping where necessary for FLOSS and appropriate configuration changes to support that. Two tests are excluded as being inappropriate for the platform. The changes are: * Added /usr/local/include to nonstop-nsx_spt_floss to load floss.h * Added SPT Floss variant for NonStop * Wrapped FLOSS definitions in OPENSSL_TANDEM_FLOSS to allow selective enablement. * SPT build configuration for NonStop * Skip tests not relevant for NonStop * PUT configuration changes required for NonStop platforms * Configurations/50-nonstop.conf: updates for TNS/X platform. * FLOSS instrumentation for HPE NonStop TNS/X and TNS/E platforms. * Configurations/50-nonstop.conf: modifications for non-PUT TNS/E platform b * Fix use of DELAY in ssltestlib.c for HPNS. * Fixed commit merge issues and added floss to http_server.c CLA: Permission is granted by the author to the OpenSSL team to use these modifications. Fixes #5087. Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12800)
* keygen: add FIPS error state management to conditional self testsShane Lontis2020-09-121-16/+32
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12801)
* Fix coverity issue: CID 1466479 - Resource leak in apps/pkcs12.cShane Lontis2020-09-121-3/+5
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12847)
* apps/ca: allow CRL lastUpdate/nextUpdate fields to be specifiedChris Novakovic2020-09-113-13/+78
| | | | | | | | | | When generating a CRL using the "ca" utility, allow values for the lastUpdate and nextUpdate fields to be specified using the command line options -crl_lastupdate and -crl_nextupdate respectively. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12784)
* apps/cmp.c: Improve example given for -geninfo option (also in man page)Dr. David von Oheimb2020-09-111-1/+1
| | | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12825)
* apps/cmp.c: Improve user guidance on missing -subject etc. optionsDr. David von Oheimb2020-09-111-2/+3
| | | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12825)
* apps/cmp.c: Improve documentation of -extracerts, -untrusted, and -otherpassDr. David von Oheimb2020-09-111-1/+3
| | | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12825)
* apps/cmp.c: Improve documentation of -secret, -cert, and -key optionsDr. David von Oheimb2020-09-111-7/+9
| | | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12825)
* apps/cmp.c: Improve safeguard assertion on consistency of cmp_options[] and ↵Dr. David von Oheimb2020-09-111-4/+9
| | | | | | | cmp_vars[] Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12836)
* apps_ui.c: Correct password prompt for ui_methodDr. David von Oheimb2020-09-101-0/+13
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12493)
* apps_ui.c: Correct handling of empty password from -passinDr. David von Oheimb2020-09-101-2/+2
| | | | | | | This is done in analogy to commit ca3245a61989009a99931748723d12e30d0a66b2 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12493)
* apps_ui.c: Improve error handling and return value of setup_ui_method()Dr. David von Oheimb2020-09-102-6/+8
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12493)
* Fix fipsinstall module pathShane Lontis2020-09-113-10/+48
| | | | | | | | | | If a path is specified with the -module option it will use this path to load the library when the provider is activated, instead of also having to set the environment variable OPENSSL_MODULES. Added a platform specific opt_path_end() function that uses existing functionality used by opt_progname(). Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12761)
* Add/harmonize multi-valued RDN support and doc of ca, cmp, req, storeutl, ↵Dr. David von Oheimb2020-09-105-9/+14
| | | | | | | and x509 apps Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12769)
* app_load_config_bio(): fix crash on errorDr. David von Oheimb2020-09-101-1/+0
| | | | | | | It turns out that the CONF_modules_load(conf, NULL, 0) call is just wrong. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12817)
* bugfix in apps/cmp.c and cmp_client.c: inconsistencies on retrieving ↵Dr. David von Oheimb2020-09-101-18/+22
| | | | | | | extraCerts in code and doc Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12822)
* apps.c: Fix mem leaks on error in load_certs() and load_crls()Dr. David von Oheimb2020-09-101-4/+20
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12823)
* apps/cmp.c: clear leftover errors on loading libengines.so etc.Dr. David von Oheimb2020-09-101-0/+1
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12824)
* apps.c: Fix diagnostics and return value of load_key_certs_crls() on errorDr. David von Oheimb2020-09-101-13/+16
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12824)
* Clean up CMP chain building for CMP signer, TLS client, and newly enrolled certsDr. David von Oheimb2020-09-101-142/+113
| | | | | | | | | | * Use strenghtened cert chain building, verifying chain using optional trust store while making sure that no certificate status (e.g., CRL) checks are done * Use OSSL_CMP_certConf_cb() by default and move its doc to OSSL_CMP_CTX_new.pod * Simplify certificate and cert store loading in apps/cmp.c Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12741)
* Support writing RSA keys using the traditional format againKurt Roeckx2020-09-092-8/+29
| | | | | | | Fixes: #6855 Reviewed-by: Richard Levitte <levitte@openssl.org> GH: #8743
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-20 18:51:11 +0000