aboutsummaryrefslogtreecommitdiffstats
path: root/apps
Commit message (Collapse)AuthorAgeFilesLines
* Add some casts for %jRich Salz2017-08-142-4/+6
| | | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4160)
* Doc fixesRich Salz2017-08-141-18/+61
| | | | | | | | | | | | Write missing prime.pod and srp.pod Implement -c in find-doc-nits (for command options) Other fixes to some manpages Use B<-I<digest|cipher>> notation Split up multiple flags into a single entry in the synopsis. Add -1 and missing-help to list command. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4144)
* Clarify CLI OCSP documentationJohannes Bauer2017-08-111-1/+1
| | | | | | | | | | This fixes issue #3043, which ultimately was reported because documentation was not clear on the meaning of the "-ignore_err" option. Update both command line documentation and add this option to manpage. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4143)
* Fix some Typos and indentsFdaSilvaYY2017-08-111-1/+1
| | | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4108)
* Add missing HTML tag in www_body in s_server.cXiaoyin Liu2017-08-091-2/+3
| | | | | | | | | In the generated HTML document, the `<pre>` tag is not closed. This patch also has a trivial code-style improvement, unrelated to the bug fix. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4088)
* Fix building without scryptJohannes Bauer2017-08-081-0/+2
| | | | | | | | | Building without the scrypt KDF is now possible, the OPENSSL_NO_SCRYPT define is honored in code. Previous this lead to undefined references. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4116)
* Add a DRBG to each SSL objectRich Salz2017-08-031-2/+2
| | | | | | | | | | | Give each SSL object it's own DRBG, chained to the parent global DRBG which is used only as a source of randomness into the per-SSL DRBG. This is used for all session, ticket, and pre-master secret keys. It is NOT used for ECDH key generation which use only the global DRBG. (Doing that without changing the API is tricky, if not impossible.) Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4050)
* Switch from ossl_rand to DRBG randRich Salz2017-08-031-14/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | If RAND_add wraps around, XOR with existing. Add test to drbgtest that does the wrap-around. Re-order seeding and stop after first success. Add RAND_poll_ex() Use the DF and therefore lower RANDOMNESS_NEEDED. Also, for child DRBG's, mix in the address as the personalization bits. Centralize the entropy callbacks, from drbg_lib to rand_lib. (Conceptually, entropy is part of the enclosing application.) Thanks to Dr. Matthias St Pierre for the suggestion. Various code cleanups: -Make state an enum; inline RANDerr calls. -Add RAND_POLL_RETRIES (thanks Pauli for the idea) -Remove most RAND_seed calls from rest of library -Rename DRBG_CTX to RAND_DRBG, etc. -Move some code from drbg_lib to drbg_rand; drbg_lib is now only the implementation of NIST DRBG. -Remove blocklength Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4019)
* Allow use of long name for KDFsDr. Stephen Henson2017-08-031-2/+6
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4079)
* Add '-ext' option to display extensions in 'x509'Paul Yang2017-08-011-3/+101
| | | | | | | | | | | | | This is to address issue #3932. Support comma-separated string to specify what extensions to be displayed. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4016) Remove redundant variable [to be squashed]
* app_isdir() cleanupXiaoyin Liu2017-07-311-11/+9
| | | | | | | | | | | I think it's better to use `GetFileAttributes` to obtain the attributes of a file than `FindFirstFile`. If the input name contains `*`, this function should return failure rather than check whether the first match happens to be a file or a directory. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/3991)
* Add list -public-key-methodsDr. Stephen Henson2017-07-291-1/+23
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4015)
* Fix rsa -check optionPaul Yang2017-07-291-2/+2
| | | | | | | | | | original problem: if a private key is invaild, nothing outputted. the error filter in apps/rsa.c is not working any more. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4043)
* handle scrypt PBKDF in PKCS#12 files infoHubert Kario2017-07-261-0/+16
| | | | | | | | Print the parameters for scrypt PBKDF when used in PKCS#12 files. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1334)
* nicer formatting for MAC infoHubert Kario2017-07-261-2/+2
| | | | | | | | | The info printing for PBES2 already uses space after type and commas to separate items in the line so use the same format for MAC info too. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1334)
* more info about PKCS#12 structure MACHubert Kario2017-07-261-2/+10
| | | | | | | | | | report additional information about the MAC used over the PKCS#12 structure: size of mac and salt as well as the hash algorithm used for creating it Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1334)
* pkcs12.c better formatting for unsupported paramsHubert Kario2017-07-261-3/+3
| | | | | | | | | | since when we get to this point, other information was already printed, we should insert some whitespace between already printed data and this "unsupported parameters" error message Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1334)
* Fix potential use-after-free and memory leakPauli2017-07-261-6/+7
| | | | | | | | | | | | | In function wait_for_async(), allocated async fds is freed if `SSL_get_all_async_fds` fails, but later `fds` is used. Interestingly, it is not freed when everything succeeds. Rewrite the FD set loop to make it more readable and to not modify the allocated pointer so it can be freed. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3992)
* schlock global variable needs to be volatileXiaoyin Liu2017-07-241-1/+2
| | | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4000)
* Remove unused function prototypesXiaoyin Liu2017-07-231-3/+0
| | | | | | | | | `args_verify()` and `opt_reset()` are declared in `apps/apps.h`, but they are not referenced anywhere. So can we remove them from `apps.h`? Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3995)
* Add --with-rand-seedRich Salz2017-07-221-3/+35
| | | | | | | | | | | | | | | | | | | | | | | | Add a new config param to specify how the CSPRNG should be seeded. Illegal values or nonsensical combinations (e.g., anything other than "os" on VMS or HP VOS etc) result in build failures. Add RDSEED support. Add RDTSC but leave it disabled for now pending more investigation. Refactor and reorganization all seeding files (rand_unix/win/vms) so that they are simpler. Only require 128 bits of seeding material. Many document improvements, including why to not use RAND_add() and the limitations around using load_file/write_file. Document RAND_poll(). Cleanup Windows RAND_poll and return correct status More completely initialize the default DRBG. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3965)
* Support converting cipher name to RFC name and vice versaPaul Yang2017-07-211-10/+13
| | | | | | | | | | | | | | | Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
* Fix bogus use of BIO_sock_should_retry.Bernd Edlinger2017-07-171-1/+1
| | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3948)
* Fix use-after-freeRich Salz2017-07-171-3/+6
| | | | | | | Also fix a RANDerr call. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3947)
* Fix some pedantic warnings.Pauli2017-07-175-6/+6
| | | | | | | Introduced by #3862 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3944)
* Standardize apps use of -rand, etc.Rich Salz2017-07-1626-376/+251
| | | | | | | | | | | | | | | | | | | | Standardized the -rand flag and added a new one: -rand file... Always reads the specified files -writerand file Always writes to the file on exit For apps that use a config file, the RANDFILE config parameter reads the file at startup (to seed the RNG) and write to it on exit if the -writerand flag isn't used. Ensured that every app that took -rand also took -writerand, and made sure all of that agreed with all the documentation. Fix error reporting in write_file and -rand Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3862)
* Update PR#3925Roelof duToit2017-07-141-3/+9
| | | | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3925)
* Retry SSL_read on ERROR_WANT_READ.Roelof duToit2017-07-141-5/+5
| | | | | | | | | This resolves the retry issue in general, but also the specific case where a TLS 1.3 server sends a post-handshake NewSessionTicket message prior to appdata. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3925)
* Fix #946 Add -preserve_dates to x509 appTodd Short2017-07-141-9/+21
| | | | | | | | | | | Add the -preserve_dates dates option to preserve dates when signing a certificate. Prevent -days and -preserve_dates being used simultaneously Fixes #946 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/946)
* Fix s_client crash where the hostname is provided as a positional argMatt Caswell2017-07-071-1/+1
| | | | | | | | | | | If the hostname is provided as a positional arg then s_client crashes. The crash occurs as s_client exits (after either a successful or unsuccessful connection attempt). This issue was introduced by commit 729ef85611. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3881)
* Do not allow non-dhe kex_modes by defaultMatt Caswell2017-07-071-4/+8
| | | | | | | Allow that mode to be configured if desired. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3833)
* Fix memory leak when using PSK session filesMatt Caswell2017-07-072-0/+2
| | | | | | | | We were not freeing the session created when loading a PSK session file. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/3855)
* Bounds check string functions in apps.Pauli2017-07-064-39/+40
| | | | | | | | | This includes strcat, strcpy and sprintf. In the x509 app, the code has been cleaned up as well. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3868)
* Rework the append_buf functionPauli2017-07-061-18/+28
| | | | | | | | It won't overflow the buffer and will allocate new buffers sufficiently large to hold new strings longer than the expansion factor. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3847)
* Avoid buffer overruns in the req command line utility.Pauli2017-07-061-33/+53
| | | | | | | Clean up some of the formatting "return x" instead of "return (x)" mostly. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3848)
* Undo commit d420ac2Rich Salz2017-07-056-34/+33
| | | | | | | | | | | | | | | [extended tests] Original text: Use BUF_strlcpy() instead of strcpy(). Use BUF_strlcat() instead of strcat(). Use BIO_snprintf() instead of sprintf(). In some cases, keep better track of buffer lengths. This is part of a large change submitted by Markus Friedl <markus@openbsd.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3701)
* BN_pseudo_rand is really BN_randRich Salz2017-07-031-1/+1
| | | | | | | | And BN_pseudo_rand_range is really BN_rand_range. Document that we might deprecate those functions. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3743)
* Remove the possibility to disable the UI module entirelyRichard Levitte2017-07-036-33/+39
| | | | | | | | | | | | | | | | | Instead, make it possible to disable the console reader that's part of the UI module. This makes it possible to use the UI API and other UI methods in environments where the console reader isn't useful. To disable the console reader, configure with 'no-ui-console' / 'disable-ui-console'. 'no-ui' / 'disable-ui' is now an alias for 'no-ui-console' / 'disable-ui-console'. Fixes #3806 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3820)
* When apps_startup() fails, exit with a failure code and a messageRichard Levitte2017-07-011-1/+6
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3816)
* Cleanup some copyright stuffRich Salz2017-06-304-7/+4
| | | | | | | | | | | | | | Remove some incorrect copyright references. Move copyright to standard place Add OpenSSL copyright where missing. Remove copyrighted file that we don't use any more Remove Itanium assembler for RC4 and MD5 (assembler versions of old and weak algorithms for an old chip) Standardize apps/rehash copyright comment; approved by Timo Put dual-copyright notice on mkcert Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3691)
* Fix double array increment in s_client mysql connectSteven Danneman2017-06-291-2/+1
| | | | | | | | | | | | | | | | The packet parsing code for the server version string was incrementing the array index twice on every iteration. This meant that strings with an even number of characters would pass, but strings with an odd number (ex: 5.7.18-0ubuntu0.16.04.1) would cause the pos variable to get out of sync. This would cause a later failure with "MySQL packet is broken." CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3799)
* STORE 'file' scheme loader: refactor the treatment of matchesRichard Levitte2017-06-291-1/+1
| | | | | | | | | Sometimes, 'file_load' couldn't really distinguish if a file handler matched the data and produced an error or if it didn't match the data at all. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3542)
* engine app: print out information on STORE loaders and STORE FILE handlersRichard Levitte2017-06-291-0/+32
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3542)
* Add a simple store utility commandRichard Levitte2017-06-292-1/+200
| | | | | | | | This command can be used to view the contents of any supported type of information fetched from a URI, and output them in PEM format. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3542)
* Use randomness not entropyRich Salz2017-06-272-5/+6
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3773)
* Fix return value checking for BIO_sock_initPaul Yang2017-06-261-3/+3
| | | | | | | | | BIO_sock_init returns '-1' on error, not '0', so it's needed to check explicitly istead of using '!'. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/3766)
* tsget.in: remove call of WWW::Curl::Easy::global_cleanupRichard Levitte2017-06-251-1/+0
| | | | | | | | | | | This function is undocumented, but similarly named functions (such as 'curl_global_cleanup') are documented as internals that should not be called by scripts. Fixes #3765 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3768)
* PSK related tweaks based on review feedbackMatt Caswell2017-06-211-3/+1
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
* Use constants rather than macros for the cipher bytes in the appsMatt Caswell2017-06-213-6/+8
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
* Tweak the client side PSK callbackMatt Caswell2017-06-211-7/+14
| | | | | | | | Ensure that we properly distinguish between successful return (PSK provided), successful return (no PSK provided) and failure. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-17 15:48:56 +0000