wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
11320 commits 20 branches 302 tags 153 MiB
Commit graph

1533 commits

Author SHA1 Message Date
Tim Hudson
3e9a08ecb1 mark all block comments that need format preserving so that 
indent will not alter them when reformatting comments

(cherry picked from commit 1d97c84351)

Conflicts:
	crypto/bn/bn_lcl.h
	crypto/bn/bn_prime.c
	crypto/engine/eng_all.c
	crypto/rc4/rc4_utl.c
	crypto/sha/sha.h
	ssl/kssl.c
	ssl/t1_lib.c

Conflicts:
	crypto/rc4/rc4_enc.c
	crypto/x509v3/v3_scts.c
	crypto/x509v3/v3nametest.c
	ssl/d1_both.c
	ssl/s3_srvr.c
	ssl/ssl.h
	ssl/ssl_locl.h
	ssl/ssltest.c
	ssl/t1_lib.c

Reviewed-by: Tim Hudson <tjh@openssl.org>
 2015-01-22 09:33:23 +00:00
Dominik Neubauer
40fb8587ed typo in s_client 
Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Geoff Thorpe <geoff@openssl.org>
 2014-12-31 11:19:56 +01:00
Kurt Roeckx
c14a808c51 Make "run" volatile 
RT#3629

Reviewed-by: Richard Levitte <levitte@openssl.org>
 2014-12-30 17:00:47 +01:00
Thorsten Glaser
cdf42d7b43 Document openssl dgst -hmac option 
Signed-off-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>
 2014-12-30 17:00:23 +01:00
Kurt Roeckx
f14a6bf515 Fix memory leak in the apps 
The BIO_free() allocated ex_data again that we already freed.

Reviewed-by: Richard Levitte <levitte@openssl.org>
 2014-12-30 17:00:22 +01:00
Richard Levitte
b3147fcbe6 Clear warnings/errors within RL_DEBUG code sections (RL_DEBUG should be renamed) 
Reviewed-by: Andy Polyakov <appro@openssl.org>
(cherry picked from commit 8bc8450a26)
 2014-12-17 14:27:42 +01:00
Matt Caswell
d68aade28a Updates to s_client and s_server to remove the constant 28 (for IPv4 header 
and UDP header) when setting an mtu. This constant is not always correct (e.g.
if using IPv6). Use the new DTLS_CTRL functions instead.

Reviewed-by: Tim Hudson <tjh@openssl.org>
(cherry picked from commit 464ce92026)
 2014-12-03 09:35:25 +00:00
Kurt Roeckx
5004c22c25 Use the SSLv23 method by default 
If SSLv2 and SSLv3 are both disabled we still support SSL/TLS.

Reviewed-by: Richard Levitte <levitte@openssl.org>
 2014-12-02 11:29:07 +01:00
Matt Caswell
3f1d582f70 Remove duplicated code 
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
 2014-11-27 14:32:40 +00:00
Matt Caswell
8a2e5bf6b7 Tidy up ocsp help output 
Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit 5e31a40f47)

Conflicts:
	apps/ocsp.c

(cherry picked from commit e164582690)
 2014-11-27 14:18:45 +00:00
André Guerreiro
6c3d948723 Add documentation on -timeout option in the ocsp utility 
PR#3612

Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
(cherry picked from commit de87dd46c1)
(cherry picked from commit 4d3df37bc7)
 2014-11-27 14:18:45 +00:00
Dr. Stephen Henson
821bee4333 New option no-ssl3-method which removes SSLv3_*method 
When no-ssl3 is set only make SSLv3 disabled by default. Retain -ssl3
options for s_client/s_server/ssltest.

When no-ssl3-method is set SSLv3_*method() is removed and all -ssl3
options.

We should document this somewhere, e.g. wiki, FAQ or manual page.
Reviewed-by: Emilia Käsper <emilia@openssl.org>

(cherry picked from commit 3881d8106d)

Conflicts:
	util/mkdef.pl
 2014-11-19 22:57:51 +00:00
Richard Levitte
17d45dec4d Make sure that disabling the MAYLOSEDATA3 warning is only done when the compiler supports it. Otherwise, there are warnings about it lacking everywhere, which is quite tedious to read through while trying to check for other warnings. 
Reviewed-by: Tim Hudson <tjh@openssl.org>
 2014-10-15 10:47:12 +02:00
Bodo Moeller
6bfe55380a Support TLS_FALLBACK_SCSV. 
Reviewed-by: Rich Salz <rsalz@openssl.org>
 2014-10-15 04:05:42 +02:00
Matt Caswell
bf4519cde5 Disabled XTS mode in enc utility as it is not supported 
PR#3442

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(cherry picked from commit 2097a17c57)
 2014-07-16 21:05:10 +01:00
Dr. Stephen Henson
cd63f94d4d Don't allow -www etc options with DTLS. 
The options which emulate a web server don't make sense when doing DTLS.
Exit with an error if an attempt is made to use them.

PR#3453
(cherry picked from commit 58a2aaeade8bdecd0f9f0df41927f7cff3012547)
 2014-07-15 12:25:39 +01:00
Dr. Stephen Henson
ea0ceb11a0 Use case insensitive compare for servername. 
PR#3445
(cherry picked from commit 1c3e9a7c67)
 2014-07-15 00:00:03 +01:00
Dr. Stephen Henson
a07f514fc0 Usage for -hack and -prexit -verify_return_error 
(cherry picked from commit ee724df75d)
 2014-07-06 22:48:57 +01:00
Dr. Stephen Henson
b7c9762598 s_server usage for certificate status requests 
(cherry picked from commit a44f219c00)
 2014-07-06 22:45:44 +01:00
Dr. Stephen Henson
86f393ceb7 Show errors on CSR verification failure. 
If CSR verify fails in ca utility print out error messages.
Otherwise some errors give misleading output: for example
if the key size exceeds the library limit.

PR#2875
(cherry picked from commit a30bdb55d1)
 2014-06-29 13:34:44 +01:00
Dr. Stephen Henson
d6d324374e Make no-ssl3 no-ssl2 do more sensible things. 
(cherry picked from commit 7ae6a4b659)
 2014-06-29 03:05:37 +01:00
Dr. Stephen Henson
046e288edf Typo. 
PR#3107
(cherry picked from commit 7c206db928)
 2014-06-28 12:43:18 +01:00
Dr. Stephen Henson
0980992d44 Memory leak and NULL derefernce fixes. 
PR#3403
 2014-06-27 03:21:10 +01:00
Dr. Stephen Henson
b66f59adfa Fix compilation with no-comp 
(cherry picked from commit 7239a09c7b5757ed8d0e9869f3e9b03c0e11f4d1)
 2014-06-11 14:33:32 +01:00
Dr. Stephen Henson
19ce768c6b Recognise padding extension. 
(cherry picked from commit ea2bb861f0daaa20819bf9ac8c146f7593feacd4)

Conflicts:

	apps/s_cb.c
(cherry picked from commit 14dc83ca779e91a267701a1fb05b2bbcf2cb63c4)
 2014-06-01 16:50:37 +01:00
Dr. Stephen Henson
599fe418a1 Change default cipher in smime app to des3. 
PR#3357
(cherry picked from commit ca3ffd9670f2b589bf8cc04923f953e06d6fbc58)
 2014-05-21 11:14:33 +01:00
Dr. Stephen Henson
f9986e9abf Enc doesn't support AEAD ciphers. 2014-05-15 14:16:44 +01:00
Viktor Dukhovni
c3c6fc7855 Fix infinite loop. PR#3347 2014-05-11 21:13:18 +01:00
Tim Hudson
9e456a8537 coverity 966576 - close socket in error path 2014-05-08 23:19:19 +01:00
Tim Hudson
f179e2b899 PR#3342 fix resource leak coverity issue 966577 2014-05-08 23:18:44 +01:00
Dr. Stephen Henson
3d8f4f23af Fix free errors in ocsp utility. 
Keep copy of any host, path and port values allocated by
OCSP_parse_url and free as necessary.
(cherry picked from commit 5219d3dd35)
 2014-04-09 15:45:35 +01:00
Dr. Stephen Henson
f54167d1dc Use correct length when prompting for password. 
Use bufsiz - 1 not BUFSIZ - 1 when prompting for a password in
the openssl utility.

Thanks to Rob Mackinnon, Leviathan Security for reporting this issue.
(cherry picked from commit 7ba08a4d73)
 2014-04-04 13:07:17 +01:00
Tim Hudson
50522642a0 Add option to generate old hash format. 
New -hash_old to generate CRL hashes using old
(before OpenSSL 1.0.0) algorithm.
(cherry picked from commit de2d97cd79)
 2014-04-03 13:37:04 +01:00
Dr. Stephen Henson
caf55bfacf Avoid Windows 8 Getversion deprecated errors. 
Windows 8 SDKs complain that GetVersion() is deprecated.

We only use GetVersion like this:

	(GetVersion() < 0x80000000)

which checks if the Windows version is NT based. Use a macro check_winnt()
which uses GetVersion() on older SDK versions and true otherwise.
(cherry picked from commit a4cc3c8041)
 2014-02-25 13:42:25 +00:00
Kurt Roeckx
e420060ac9 Use defaults bits in req when not given 
If you use "-newkey rsa" it's supposed to read the default number of bits from the
config file.  However the value isn't used to generate the key, but it does
print it's generating such a key.  The set_keygen_ctx() doesn't call
EVP_PKEY_CTX_set_rsa_keygen_bits() and you end up with the default set in
pkey_rsa_init() (1024).  Afterwards the number of bits gets read from the config
file, but nothing is done with that anymore.

We now read the config first and use the value from the config file when no size
is given.

PR: 2592
(cherry picked from commit 3343220327)
 2014-02-14 22:35:39 +00:00
Scott Schaefer
040ed7b4d0 Fix various spelling errors 
(cherry picked from commit 2b4ffc659e)
 2014-02-14 22:35:39 +00:00
Dr. Stephen Henson
4eedf86a16 Use default digest implementation in dgst.c 
Use default instead of ENGINE version of digest. Without this
errors will occur if you use an ENGINE for a private key and
it doesn't implement the digest in question.
 2014-01-23 18:36:33 +00:00
Dr. Stephen Henson
c776a3f398 make update 2014-01-06 13:33:27 +00:00
Dr. Stephen Henson
60df657b3a make update 2013-12-08 13:23:14 +00:00
Dr. Stephen Henson
25370e93c6 Typo: don't call RAND_cleanup during app startup. 
(cherry picked from commit 90e7f983b5)
 2013-06-12 21:18:47 +01:00
Dr. Stephen Henson
cdb6c48445 Don't use RC2 with PKCS#12 files in FIPS mode. 2013-05-30 21:39:50 +01:00
Dr. Stephen Henson
944bc29f90 Call RAND_cleanup in openssl application. 2013-03-28 14:28:06 +00:00
Andy Polyakov
0898147090 ssl/*: fix linking errors with no-srtp. 2013-02-09 19:52:07 +01:00
Dr. Stephen Henson
1dcf520fe2 Change default bits to 1024 2013-01-07 16:18:57 +00:00
Dr. Stephen Henson
3ea1e13569 add missing \n 2012-12-23 18:19:28 +00:00
Ben Laurie
5bb6d96558 Make verify return errors. 2012-12-13 15:48:42 +00:00
Dr. Stephen Henson
a650314f72 check mval for NULL too 2012-12-04 17:26:13 +00:00
Dr. Stephen Henson
54fdc39a08 fix leak 2012-12-03 16:33:24 +00:00
Dr. Stephen Henson
eb3a3911fc PR: 2908 
Submitted by: Dmitry Belyavsky <beldmit@gmail.com>

Fix DH double free if parameter generation fails.
 2012-11-21 14:02:21 +00:00
Dr. Stephen Henson
540f7c75ef fix leaks 2012-11-20 00:28:56 +00:00
Dr. Stephen Henson
f929f201fb fix memory leak 2012-09-11 13:44:38 +00:00
Bodo Möller
12c1621523 Enable message names for TLS 1.1, 1.2 with -msg. 2012-08-16 13:43:37 +00:00
Dr. Stephen Henson
25da47c3c8 Fix memory leak. 
Always perform nexproto callback argument initialisation in s_server
otherwise we use uninitialised data if -nocert is specified.
 2012-07-03 16:36:10 +00:00
Dr. Stephen Henson
36b0719793 oops, add -debug_decrypt option which was accidenatally left out 2012-06-19 13:39:03 +00:00
Ben Laurie
af454b5bb0 Reduce version skew. 2012-06-08 09:18:47 +00:00
Dr. Stephen Henson
3bf4e14cc3 Always use SSLv23_{client,server}_method in s_client.c and s_server.c, 
the old code came from SSLeay days before TLS was even supported.
 2012-03-18 18:16:05 +00:00
Richard Levitte
49f6cb968f cipher should only be set to PSK if JPAKE is used. 2012-03-14 12:39:00 +00:00
Dr. Stephen Henson
267c950c5f Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr> 
Add more extension names in s_cb.c extension printing code.
 2012-03-09 18:37:41 +00:00
Dr. Stephen Henson
c714e43c8d PR: 2717 
Submitted by: Tim Rice <tim@multitalents.net>

Make compilation work on OpenServer 5.0.7
 2012-02-11 23:38:49 +00:00
Dr. Stephen Henson
cdf9d6f6ed PR: 2716 
Submitted by: Adam Langley <agl@google.com>

Fix handling of exporter return value and use OpenSSL indentation in
s_client, s_server.
 2012-02-11 23:21:09 +00:00
Andy Polyakov
69e9c69e70 apps/s_cb.c: recognize latest TLS versions [from HEAD]. 2012-02-11 13:31:16 +00:00
Dr. Stephen Henson
26c6857a59 PR: 2710 
Submitted by: Tomas Mraz <tmraz@redhat.com>

Check return codes for load_certs_crls.
 2012-02-10 19:54:46 +00:00
Dr. Stephen Henson
508bd3d1aa PR: 2714 
Submitted by: Tomas Mraz <tmraz@redhat.com>

Make no-srp work.
 2012-02-10 19:44:00 +00:00
Dr. Stephen Henson
c944a9696e add fips hmac option and fips blocking overrides to command line utilities 2012-02-10 16:46:19 +00:00
Andy Polyakov
9b2a29660b Sanitize usage of <ctype.h> functions. It's important that characters 
are passed zero-extended, not sign-extended [from HEAD].
PR: 2682
 2012-01-12 16:28:03 +00:00
Andy Polyakov
b9cbcaad58 speed.c: typo in pkey_print_message [from HEAD]. 
PR: 2681
Submitted by: Annie Yousar
 2012-01-11 21:49:16 +00:00
Bodo Möller
767d3e0054 Update for 0.9.8s and 1.0.0f. 
(While the 1.0.0f CHANGES entry on VOS PRNG seeding was missing
in the 1.0.1 branch, the actual code is here already.)
 2012-01-05 13:46:27 +00:00
Dr. Stephen Henson
bd6941cfaa PR: 2658 
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de>
Reviewed by: steve

Support for TLS/DTLS heartbeats.
 2011-12-31 23:00:36 +00:00
Dr. Stephen Henson
5c05f69450 make update 2011-12-27 14:38:27 +00:00
Dr. Stephen Henson
b300fb7734 PR: 1794 
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr>
Reviewed by: steve

- remove some unncessary SSL_err and permit
an srp user callback to allow a worker to obtain
a user verifier.

- cleanup and comments in s_server and demonstration
for asynchronous srp user lookup
 2011-12-27 14:23:22 +00:00
Andy Polyakov
1d05ff2779 apps/speed.c: fix typo in last commit. 2011-12-19 14:33:37 +00:00
Andy Polyakov
941811ccb9 apps/speed.c: Cygwin alarm() fails sometimes. 
PR: 2655
 2011-12-15 22:30:11 +00:00
Dr. Stephen Henson
b8a22c40e0 PR: 1794 
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr>
Reviewed by: steve

Remove unnecessary code for srp and to add some comments to
s_client.

- the callback to provide a user during client connect is
no longer necessary since rfc 5054 a connection attempt
with an srp cipher and no user is terminated when the
cipher is acceptable

- comments to indicate in s_client the (non-)usefulness of
th primalaty tests for non known group parameters.
 2011-12-14 22:18:03 +00:00
Dr. Stephen Henson
8173960305 remove old -attime code, new version includes all old functionality 2011-12-10 00:42:48 +00:00
Dr. Stephen Henson
f2e590942e implement -attime option as a verify parameter then it works with all relevant applications 2011-12-10 00:37:42 +00:00
Dr. Stephen Henson
97d0c596a1 Replace expired test server and client certificates with new ones. 2011-12-08 14:45:15 +00:00
Dr. Stephen Henson
5713411893 The default CN prompt message can be confusing when often the CN needs to 
be the server FQDN: change it.
[Reported by PSW Group]
 2011-12-06 00:00:51 +00:00
Ben Laurie
825e1a7c56 Fix warnings. 2011-12-02 14:39:41 +00:00
Dr. Stephen Henson
a310428527 Workaround so "make depend" works for fips builds. 2011-11-22 12:50:59 +00:00
Ben Laurie
b1d7429186 Add TLS exporter. 2011-11-15 23:51:22 +00:00
Ben Laurie
060a38a2c0 Add DTLS-SRTP. 2011-11-15 23:02:16 +00:00
Andy Polyakov
db896db5a7 speed.c: add ghash benchmark [from HEAD]. 2011-11-14 21:09:30 +00:00
Ben Laurie
68b33cc5c7 Add Next Protocol Negotiation. 2011-11-13 21:55:42 +00:00
Ben Laurie
4c02cf8ecc make depend. 2011-11-13 20:23:34 +00:00
Dr. Stephen Henson
efbb7ee432 PR: 1794 
Submitted by: Peter Sylvester <peter.sylvester@edelweb.fr>
Reviewed by: steve

Document unknown_psk_identify alert, remove pre-RFC 5054 string from
ssl_stat.c
 2011-11-13 13:13:14 +00:00
Dr. Stephen Henson
6bd173fced Don't disable TLS v1.2 by default any more. 2011-10-09 23:28:25 +00:00
Dr. Stephen Henson
9309ea6617 Backport PSS signature support from HEAD. 2011-10-09 23:13:50 +00:00
Dr. Stephen Henson
dc100d87b5 Backport of password based CMS support from HEAD. 2011-10-09 15:28:02 +00:00
Dr. Stephen Henson
1fe83b4afe use keyformat for -x509toreq, don't hard code PEM 2011-09-23 21:48:50 +00:00
Dr. Stephen Henson
370385571c PR: 2347 
Submitted by: Tomas Mraz <tmraz@redhat.com>
Reviewed by: steve

Fix usage message.
 2011-09-23 13:12:41 +00:00
Dr. Stephen Henson
e34a303ce1 make depend 2011-09-16 23:15:22 +00:00
Dr. Stephen Henson
0ae7c43fa5 Improved error checking for DRBG calls. 
New functionality to allow default DRBG type to be set during compilation
or during runtime.
 2011-09-16 23:08:57 +00:00
Dr. Stephen Henson
4a18d5c89b Don't add trailing slash to FIPSDIR: it causes problems with Windows builds. 2011-06-18 19:02:12 +00:00
Ben Laurie
be23b71e87 Add -attime. 2011-06-09 17:09:31 +00:00
Ben Laurie
78ef9b0205 Fix warnings. 2011-06-09 16:03:18 +00:00
Dr. Stephen Henson
c6fa97a6d6 FIPS low level blocking for AES, RC4 and Camellia. This is complicated by 
use of assembly language routines: rename the assembly language function
to the private_* variant unconditionally and perform tests from a small
C wrapper.
 2011-06-05 17:36:44 +00:00
Dr. Stephen Henson
916bcab28e Prohibit low level cipher APIs in FIPS mode. 
Not complete: ciphers with assembly language key setup are not
covered yet.
 2011-06-01 16:54:06 +00:00
Dr. Stephen Henson
7207eca1ee The first of many changes to make OpenSSL 1.0.1 FIPS capable. 
Add static build support to openssl utility.

Add new "fips" option to Configure.

Make use of installed fipsld and fips_standalone_sha1

Initialise FIPS error callbacks, locking and DRBG.

Doesn't do anything much yet: no crypto is redirected to the FIPS module.

Doesn't completely build either but the openssl utility can enter FIPS mode:
which doesn't do anything much either.
 2011-05-26 14:19:19 +00:00
Dr. Stephen Henson
565c15363c PR: 2527 
Submitted by: Marcus Meissner <meissner@suse.de>
Reviewed by: steve

Set cnf to NULL to avoid possible double free.
 2011-05-25 15:05:56 +00:00
Dr. Stephen Henson
57dd2ea808 add FIPS support to openssl utility (backport from HEAD) 2011-05-19 18:23:24 +00:00