aboutsummaryrefslogtreecommitdiffstats
path: root/apps
Commit message (Collapse)AuthorAgeFilesLines
...
* more info about PKCS#12 structure MACHubert Kario2017-07-261-2/+10
| | | | | | | | | | report additional information about the MAC used over the PKCS#12 structure: size of mac and salt as well as the hash algorithm used for creating it Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1334)
* pkcs12.c better formatting for unsupported paramsHubert Kario2017-07-261-3/+3
| | | | | | | | | | since when we get to this point, other information was already printed, we should insert some whitespace between already printed data and this "unsupported parameters" error message Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1334)
* Fix potential use-after-free and memory leakPauli2017-07-261-6/+7
| | | | | | | | | | | | | In function wait_for_async(), allocated async fds is freed if `SSL_get_all_async_fds` fails, but later `fds` is used. Interestingly, it is not freed when everything succeeds. Rewrite the FD set loop to make it more readable and to not modify the allocated pointer so it can be freed. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3992)
* schlock global variable needs to be volatileXiaoyin Liu2017-07-241-1/+2
| | | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4000)
* Remove unused function prototypesXiaoyin Liu2017-07-231-3/+0
| | | | | | | | | `args_verify()` and `opt_reset()` are declared in `apps/apps.h`, but they are not referenced anywhere. So can we remove them from `apps.h`? Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3995)
* Add --with-rand-seedRich Salz2017-07-221-3/+35
| | | | | | | | | | | | | | | | | | | | | | | | Add a new config param to specify how the CSPRNG should be seeded. Illegal values or nonsensical combinations (e.g., anything other than "os" on VMS or HP VOS etc) result in build failures. Add RDSEED support. Add RDTSC but leave it disabled for now pending more investigation. Refactor and reorganization all seeding files (rand_unix/win/vms) so that they are simpler. Only require 128 bits of seeding material. Many document improvements, including why to not use RAND_add() and the limitations around using load_file/write_file. Document RAND_poll(). Cleanup Windows RAND_poll and return correct status More completely initialize the default DRBG. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3965)
* Support converting cipher name to RFC name and vice versaPaul Yang2017-07-211-10/+13
| | | | | | | | | | | | | | | Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
* Fix bogus use of BIO_sock_should_retry.Bernd Edlinger2017-07-171-1/+1
| | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3948)
* Fix use-after-freeRich Salz2017-07-171-3/+6
| | | | | | | Also fix a RANDerr call. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3947)
* Fix some pedantic warnings.Pauli2017-07-175-6/+6
| | | | | | | Introduced by #3862 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3944)
* Standardize apps use of -rand, etc.Rich Salz2017-07-1626-376/+251
| | | | | | | | | | | | | | | | | | | | Standardized the -rand flag and added a new one: -rand file... Always reads the specified files -writerand file Always writes to the file on exit For apps that use a config file, the RANDFILE config parameter reads the file at startup (to seed the RNG) and write to it on exit if the -writerand flag isn't used. Ensured that every app that took -rand also took -writerand, and made sure all of that agreed with all the documentation. Fix error reporting in write_file and -rand Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3862)
* Update PR#3925Roelof duToit2017-07-141-3/+9
| | | | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3925)
* Retry SSL_read on ERROR_WANT_READ.Roelof duToit2017-07-141-5/+5
| | | | | | | | | This resolves the retry issue in general, but also the specific case where a TLS 1.3 server sends a post-handshake NewSessionTicket message prior to appdata. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3925)
* Fix #946 Add -preserve_dates to x509 appTodd Short2017-07-141-9/+21
| | | | | | | | | | | Add the -preserve_dates dates option to preserve dates when signing a certificate. Prevent -days and -preserve_dates being used simultaneously Fixes #946 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/946)
* Fix s_client crash where the hostname is provided as a positional argMatt Caswell2017-07-071-1/+1
| | | | | | | | | | | If the hostname is provided as a positional arg then s_client crashes. The crash occurs as s_client exits (after either a successful or unsuccessful connection attempt). This issue was introduced by commit 729ef85611. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3881)
* Do not allow non-dhe kex_modes by defaultMatt Caswell2017-07-071-4/+8
| | | | | | | Allow that mode to be configured if desired. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3833)
* Fix memory leak when using PSK session filesMatt Caswell2017-07-072-0/+2
| | | | | | | | We were not freeing the session created when loading a PSK session file. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/3855)
* Bounds check string functions in apps.Pauli2017-07-064-39/+40
| | | | | | | | | This includes strcat, strcpy and sprintf. In the x509 app, the code has been cleaned up as well. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3868)
* Rework the append_buf functionPauli2017-07-061-18/+28
| | | | | | | | It won't overflow the buffer and will allocate new buffers sufficiently large to hold new strings longer than the expansion factor. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3847)
* Avoid buffer overruns in the req command line utility.Pauli2017-07-061-33/+53
| | | | | | | Clean up some of the formatting "return x" instead of "return (x)" mostly. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3848)
* Undo commit d420ac2Rich Salz2017-07-056-34/+33
| | | | | | | | | | | | | | | [extended tests] Original text: Use BUF_strlcpy() instead of strcpy(). Use BUF_strlcat() instead of strcat(). Use BIO_snprintf() instead of sprintf(). In some cases, keep better track of buffer lengths. This is part of a large change submitted by Markus Friedl <markus@openbsd.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3701)
* BN_pseudo_rand is really BN_randRich Salz2017-07-031-1/+1
| | | | | | | | And BN_pseudo_rand_range is really BN_rand_range. Document that we might deprecate those functions. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3743)
* Remove the possibility to disable the UI module entirelyRichard Levitte2017-07-036-33/+39
| | | | | | | | | | | | | | | | | Instead, make it possible to disable the console reader that's part of the UI module. This makes it possible to use the UI API and other UI methods in environments where the console reader isn't useful. To disable the console reader, configure with 'no-ui-console' / 'disable-ui-console'. 'no-ui' / 'disable-ui' is now an alias for 'no-ui-console' / 'disable-ui-console'. Fixes #3806 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3820)
* When apps_startup() fails, exit with a failure code and a messageRichard Levitte2017-07-011-1/+6
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3816)
* Cleanup some copyright stuffRich Salz2017-06-304-7/+4
| | | | | | | | | | | | | | Remove some incorrect copyright references. Move copyright to standard place Add OpenSSL copyright where missing. Remove copyrighted file that we don't use any more Remove Itanium assembler for RC4 and MD5 (assembler versions of old and weak algorithms for an old chip) Standardize apps/rehash copyright comment; approved by Timo Put dual-copyright notice on mkcert Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3691)
* Fix double array increment in s_client mysql connectSteven Danneman2017-06-291-2/+1
| | | | | | | | | | | | | | | | The packet parsing code for the server version string was incrementing the array index twice on every iteration. This meant that strings with an even number of characters would pass, but strings with an odd number (ex: 5.7.18-0ubuntu0.16.04.1) would cause the pos variable to get out of sync. This would cause a later failure with "MySQL packet is broken." CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3799)
* STORE 'file' scheme loader: refactor the treatment of matchesRichard Levitte2017-06-291-1/+1
| | | | | | | | | Sometimes, 'file_load' couldn't really distinguish if a file handler matched the data and produced an error or if it didn't match the data at all. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3542)
* engine app: print out information on STORE loaders and STORE FILE handlersRichard Levitte2017-06-291-0/+32
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3542)
* Add a simple store utility commandRichard Levitte2017-06-292-1/+200
| | | | | | | | This command can be used to view the contents of any supported type of information fetched from a URI, and output them in PEM format. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3542)
* Use randomness not entropyRich Salz2017-06-272-5/+6
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3773)
* Fix return value checking for BIO_sock_initPaul Yang2017-06-261-3/+3
| | | | | | | | | BIO_sock_init returns '-1' on error, not '0', so it's needed to check explicitly istead of using '!'. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/3766)
* tsget.in: remove call of WWW::Curl::Easy::global_cleanupRichard Levitte2017-06-251-1/+0
| | | | | | | | | | | This function is undocumented, but similarly named functions (such as 'curl_global_cleanup') are documented as internals that should not be called by scripts. Fixes #3765 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3768)
* PSK related tweaks based on review feedbackMatt Caswell2017-06-211-3/+1
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
* Use constants rather than macros for the cipher bytes in the appsMatt Caswell2017-06-213-6/+8
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
* Tweak the client side PSK callbackMatt Caswell2017-06-211-7/+14
| | | | | | | | Ensure that we properly distinguish between successful return (PSK provided), successful return (no PSK provided) and failure. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
* Fix no-pskMatt Caswell2017-06-213-17/+7
| | | | | | | Broken through previous PSK related commits Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
* Add the ability to set a TLSv1.3 PSK via just the key bytesMatt Caswell2017-06-212-9/+97
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
* Add the ability to use a server side TLSv1.3 external PSK in s_serverMatt Caswell2017-06-211-3/+39
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
* Add the ability to use a client side TLSv1.3 external PSK in s_clientMatt Caswell2017-06-211-0/+45
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3670)
* Print Ed25519 in s_client/s_serverDr. Stephen Henson2017-06-211-6/+9
| | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3585)
* Merge Nokia copyright notice into standardRich Salz2017-06-212-54/+2
| | | | | | | This is done with the kind permission of Nokia. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3722)
* Reformat progs.pl; add ARIA supportRich Salz2017-06-211-68/+78
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3726)
* Ensure a space after colon in enc -vRich Salz2017-06-201-2/+2
| | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3725)
* Modify Sun copyright to follow OpenSSL styleRich Salz2017-06-203-33/+3
| | | | | | | Approved by Oracle. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/3585)
* Make clear error message if opt_<number> failsPaul Yang2017-06-201-8/+28
| | | | | | | | for opt_long(opt_int)/opt_ulong/opt_imax/opt_umax Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3653)
* s_client accepts host/port as positional argument.Cory Benfield2017-06-191-3/+17
| | | | | | | | | | | | | | | | | This allows the user to provide the target host and optional port to openssl s_client as an optional positional argument, rather than as the argument to the -connect flag. This rationalises the user experience of s_client: given that the only logical purpose of s_client is to connect to a host, it is difficult to understand why there is an (effectively mandatory) command option to pass to make that happen. This patch forbids providing *both* -connect and the positional argument, because it would likely be too difficult to reconcile. Otherwise, using the positional argument behaves exactly the same as using -connect does. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1171)
* Forbid to specify -nextprotoneg if -tls1_3 is enabledPaul Yang2017-06-162-0/+12
| | | | | | | | | | | This applies both to s_client and s_server app. Reaction to Issue #3665. Signed-off-by: Paul Yang <paulyang.inf@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3697)
* Build apps/progs.h dynamicallyRichard Levitte2017-06-153-431/+28
| | | | | | | | | Because apps/progs.h isn't configuration agnostic, it's not at all suited for 'make update' or being versioned, so change it to be dynamically generated. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3688)
* Update copyright on progs.hRich Salz2017-06-131-2/+2
| | | | | | | The generating script got updated, but the generated file did not. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3668)
* Make SNI behavior more clear in s_client doc & helpPaul Yang2017-06-131-1/+1
| | | | | | | | | Update s_client -help and pod file. Signed-off-by: Paul Yang <paulyang.inf@gmail.com> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3654)
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-20 07:02:30 +0000