Commit graph

863 commits

Author SHA1 Message Date
Ben Laurie
461f00dd53 Handle read failures better. 2002-06-11 11:41:26 +00:00
Lutz Jänicke
3b66e34e74 Make sure that settings are passed back and forth when walking around
in the tree during build.
Reinstall default PERL settings in Makefiles, as the real reason for the
failure was that the settings were not passed.
Submitted by:
Reviewed by:
PR:
2002-06-06 10:14:16 +00:00
Lutz Jänicke
5795665a7d The correct PERL interpreter is passed via commandline.
Submitted by:
Reviewed by:
PR:
2002-06-05 07:01:39 +00:00
Richard Levitte
2640aec227 CAformat should not be used for CA key format. 2002-05-30 16:24:26 +00:00
Richard Levitte
9634acedaf Remove the duplicate description of -out.
PR: 28
2002-05-30 06:24:46 +00:00
Richard Levitte
b093ef7445 There is a chance that the input string is larger than size, and on VMS,
this wasn't checked and could possibly be exploitable (slim chance, but still)
2002-05-29 08:31:45 +00:00
Richard Levitte
7d2ff3f081 Allow the use of the TCP/IP stack keyword TCPIP and NONE 2002-05-22 11:37:02 +00:00
Richard Levitte
1522c23470 Remove warnings about unused symbols when configured with no-rsa. 2002-05-22 07:53:53 +00:00
Dr. Stephen Henson
7448f5e5ed Reorganise -subj option code, fix buffer overrun. 2002-05-19 16:32:21 +00:00
Richard Levitte
14ef32631c Generate an error if rewinding wasn't possible.
Notified by Ken Hirsch <kenhirsch@myself.com>.
PR: 23
2002-05-08 15:12:49 +00:00
Dr. Stephen Henson
b27dfeacc9 Add apps_startup and bio_err init code to smime.c 2002-05-01 20:06:24 +00:00
Lutz Jänicke
fb0f53b2e0 Fix escaping when using the -subj option of "openssl req", document
'hidden' -nameopt support. (Robert Joop <joop@fokus.gmd.de>)
Submitted by:
Reviewed by:
PR: #2
2002-04-30 12:10:10 +00:00
Richard Levitte
b23b3272dc Potential memory leak removed. Notified by <threaded@totalise.co.uk> 2002-04-25 10:11:08 +00:00
Bodo Möller
7729bc2634 fix usage (no 'key') 2002-04-23 13:55:56 +00:00
Bodo Möller
d4a67e3186 check return values
Submitted by: Nils Larsch
2002-04-17 09:31:02 +00:00
Bodo Möller
e1f4319279 harmonize capitalization 2002-04-09 12:42:15 +00:00
Richard Levitte
248252682c make update 2002-04-06 19:15:27 +00:00
Richard Levitte
cc3586028e Allow longer program names (VMS allows up to 39 characters).
Submitted by Compaq.
2002-04-06 18:59:57 +00:00
Richard Levitte
ddba94214f Use the more modern DES API in the openssl subcommands. 2002-03-22 02:36:58 +00:00
Dr. Stephen Henson
b74dfe6e8e Initialize cipher context in KRB5
("D. Russell" <russelld@aol.net>)

Allow HMAC functions to use an alternative ENGINE.
2002-03-14 18:16:49 +00:00
Bodo Möller
d80f6e0f8c Fixes for 'no-hw' combined with 'no-SOME_CIPHER'.
Fix dsaparam usage output.

Submitted by: Nils Larsch (for 0.9.8-dev; backported to 0.9.7-dev)
2002-03-14 09:53:30 +00:00
Dr. Stephen Henson
a1a4e8b6bb typo 2002-03-08 19:12:38 +00:00
Dr. Stephen Henson
25f350a058 Fix the Win32_rename() function so it correctly
returns an error code. Use the same code in Win9X
and NT.

Fix some ca.c options so they work under Win32:
unlink/rename wont work under Win32 unless the file
is closed.
2002-03-08 19:06:36 +00:00
Dr. Stephen Henson
c913cf446f ENGINE module additions.
Add "init" command to control ENGINE
initialization.

Call ENGINE_finish on initialized ENGINEs on exit.

Reorder shutdown in apps.c: modules should be shut
down first.

Add test private key loader to openssl ENGINE: this
just loads a private key in PEM format.

Fix print format for dh length parameter.
2002-03-06 14:09:46 +00:00
Bodo Möller
1a8f4b57a9 fix printf call 2002-03-05 15:05:17 +00:00
Richard Levitte
421d474332 Increase internal security when using strncpy, by making sure the resulting string is NUL-terminated 2002-02-28 12:44:05 +00:00
Richard Levitte
3d59821134 make update 2002-02-26 14:37:25 +00:00
Dr. Stephen Henson
cae111287b Fix new -aes command argument handling 2002-02-26 13:45:19 +00:00
Dr. Stephen Henson
3f7cf29124 Update from main branch. 2002-02-23 01:47:59 +00:00
Dr. Stephen Henson
cfe1c195c4 non-Monolith fixes.
Submitted by Andrew W. Gray <agray@iconsinc.com>
2002-02-22 21:27:47 +00:00
Dr. Stephen Henson
0cd8572b2d Config code updates.
CONF_modules_unload() now calls CONF_modules_finish()
automatically.

Default use of section openssl_conf moved to
CONF_modules_load()

Load config file in several openssl utilities.

Most utilities now load modules from the config file,
though in a few (such as version) this isn't done
because it couldn't be used for anything.

In the case of ca and req the config file used is
the same as the utility itself: that is the -config
command line option can be used to specify an
alternative file.
2002-02-22 13:58:15 +00:00
Richard Levitte
9f0a373b51 Add AES support in the applications that support -des and -des3. 2002-02-20 18:04:17 +00:00
Dr. Stephen Henson
9c75b2d931 Use default openssl.cnf if config filename set to NULL and
openssl_conf if appname NULL.
2002-02-19 23:25:18 +00:00
Richard Levitte
fb67f40f04 Add the configuration target VxWorks. 2002-02-14 16:23:55 +00:00
Richard Levitte
de2f6e4dae 'make update' 2002-02-05 17:34:58 +00:00
Lutz Jänicke
f701551f36 HP-UX 32bit:
* When linking against shared libraries, the absolute path is remembered.
  - When linking against -L.., '..' is remembered inside the executable,
    so it will fail after "make install" or when not called from inside the
    "apps/" subdirectory of the build tree.
  - When using the "+cdp" option of "ld", the ".." information can be
    exchanged against $(INSTALL_TOP)/lib. In this case the executable
    will however refuse to work before "make install" has been called.
    This makes testing the 'openssl' executable a problem.
* Solution 1:
  Relink the "openssl" executable, when "make install" is called.
  This would however require significant changes to the toplevel Makefile
  and the apps/ Makefile.
* Solution 2:
  Statically link against libssl and libcrypto, so that the "openssl"
  executable is no longer dependant on the openssl shared libraries.

Select option 2 for HP-UX 32bit, as this requires the smallest change.
2002-01-29 16:32:40 +00:00
Richard Levitte
1199e2d8cf Apply patch from Toomas Kiisk <vix@cyber.ee> and complete it. 2002-01-29 12:36:01 +00:00
Richard Levitte
80bb905d3d Apply the following changes by Toomas Kiisk <vix@cyber.ee>:
* make openssl rsa work with -engine chil
* misc changes, including debug-linux-ppro Configure target
  and FORMAT_NETSCAPE-aware load_{,pub}key()

This completes the application of his changes.
2002-01-25 19:43:52 +00:00
Richard Levitte
404dcc5e8e I must learn to compile before I commit... 2002-01-25 17:35:19 +00:00
Richard Levitte
17bcb8d465 Add -keyform. Document -engine. 2002-01-25 16:51:46 +00:00
Ben Laurie
45d87a1ffe Prototype info function. 2002-01-12 15:56:13 +00:00
Richard Levitte
015fbde807 make update 2002-01-02 17:31:23 +00:00
Richard Levitte
ba1b888384 Implement speed measurement for AES.
Submitted by Stephen Sprunk <stephen@sprunk.org> as part of his AES
integration patch.
2002-01-02 16:57:57 +00:00
Richard Levitte
47cc5525a2 RSA counter should only be defined of RSA is available. 2002-01-02 12:40:38 +00:00
Richard Levitte
206eb6a11d Change pkcs12 so the certificates coming from -in do not get tossed if
-certfile is given as well.
2001-12-12 16:49:02 +00:00
Ben Laurie
ff3fa48fc7 Improve back compatibility. 2001-12-09 21:53:31 +00:00
Bodo Möller
87166e1fb6 fix warnings (one of them was clearly justified) 2001-12-07 17:02:01 +00:00
Dr. Stephen Henson
21a85f1977 Add -pubkey option to req command. 2001-12-01 23:03:30 +00:00
Bodo Möller
4f94d1a8b1 check OPENSSL_NO_... before including header files that might be
disabled
2001-11-22 11:13:10 +00:00
Geoff Thorpe
308f028e28 In this particular error condition, the structural reference wasn't being
released.
2001-11-22 09:20:08 +00:00
Richard Levitte
83c40e7fc0 Make it possible to give digest names as -evp arguments. 2001-11-15 20:19:40 +00:00
Richard Levitte
e1a00d7d1d If an engine isn't built in, try loading it as a shareable library
instead.  This also makes it possible for users to simply give said
shareable library as argument for the -engine option.
2001-11-15 18:48:42 +00:00
Richard Levitte
b476df64a1 make update
perl util/mkerr.pl -recurse -write -rebuild
2001-11-15 12:25:14 +00:00
Richard Levitte
817dfc18a3 Change the order of events so the capabilities of loaded engines can
get listed as well.
2001-11-14 22:30:17 +00:00
Richard Levitte
135c0af1bb Implement STARTTLS for certain protocols, currently only supporting SMTP. 2001-11-14 13:57:52 +00:00
Bodo Möller
29e0c30c2a more output for SSL 2.0 in our msg_callback 2001-11-10 01:17:02 +00:00
Dr. Stephen Henson
b83eddc578 Win32 fixes. 2001-11-06 13:40:27 +00:00
Dr. Stephen Henson
6229a5607c Fix email address delete code. 2001-11-06 01:44:21 +00:00
Richard Levitte
f559f31bef DOS and Windows do not like unistd.h 2001-11-05 12:43:17 +00:00
Ben Laurie
3210b4fd14 If verify fails, say why. 2001-11-02 13:29:14 +00:00
Richard Levitte
a7b42009c4 Change the shared library support so the shared libraries get built
sooner and the programs get built against the shared libraries.

This requires a bit more work.  Things like -rpath and the possibility
to still link the programs statically should be included.  Some
cleanup is also needed.  This will be worked on.
2001-10-30 08:00:59 +00:00
Richard Levitte
7b5ffd6834 Addapt VMS scripts to the newer disk layout system ODS-5, which allows more than one period and mixed size characters in file names 2001-10-29 13:05:28 +00:00
Dr. Stephen Henson
9b55da73ca Another noemailDN fix. 2001-10-27 17:53:06 +00:00
Dr. Stephen Henson
e7156ff2e8 Allow ca to certify requests containing BMPStrings and UTF8Strings. 2001-10-27 17:04:47 +00:00
Dr. Stephen Henson
437db75b94 Bugfixes for noemailDN option. Make it use the
correct name (instead of NULL) if nomailDN is
not set, fix memory leaks and retain DN structure
when deleting emailAddress.
2001-10-27 17:03:20 +00:00
Dr. Stephen Henson
1fc6d41bf6 New options to allow req to accept UTF8 strings as input. 2001-10-26 12:40:38 +00:00
Richard Levitte
66d3e7481e Make sure openssl speed is compilable on systems where fork() doesn't
exist.  For now, that's all the ones we "support" except Unix.
2001-10-25 16:08:17 +00:00
Ben Laurie
0e21156333 Add paralellism to speed - note that this currently causes a weird memory leak. 2001-10-25 14:27:17 +00:00
Bodo Möller
89da653fa6 Add '-noemailDN' option to 'openssl ca'. This prevents inclusion of
the e-mail address in the DN (i.e., it will go into a certificate
extension only).  The new configuration file option 'email_in_dn = no'
has the same effect.

Submitted by: Massimiliano Pala madwolf@openca.org
2001-10-25 08:25:19 +00:00
Richard Levitte
c2e4f17c1a Due to an increasing number of clashes between modern OpenSSL and
libdes (which is still used out there) or other des implementations,
the OpenSSL DES functions are renamed to begin with DES_ instead of
des_.  Compatibility routines are provided and declared by including
openssl/des_old.h.  Those declarations are the same as were in des.h
when the OpenSSL project started, which is exactly how libdes looked
at that time, and hopefully still looks today.

The compatibility functions will be removed in some future release, at
the latest in version 1.0.
2001-10-24 21:21:12 +00:00
Dr. Stephen Henson
f1558bb424 Reject certificates with unhandled critical extensions. 2001-10-21 02:09:15 +00:00
Dr. Stephen Henson
6ca487992b Stop spurious "unable to load config info" errors in req 2001-10-21 01:05:53 +00:00
Bodo Möller
a661b65357 New functions SSL[_CTX]_set_msg_callback().
New macros SSL[_CTX]_set_msg_callback_arg().

Message callback imlementation for SSL 3.0/TLS 1.0 (no SSL 2.0 yet).

New '-msg' option for 'openssl s_client' and 'openssl s_server'
that enable a message callback that displays all protocol messages.


In ssl3_get_client_hello (ssl/s3_srvr.c), generate a fatal alert if
client_version is smaller than the protocol version in use.
Also change ssl23_get_client_hello (ssl/s23_srvr.c) to select TLS 1.0
if the client demanded SSL 3.0 but only TLS 1.0 is enabled; then the
client will at least see that alert.

Fix SSL[_CTX]_ctrl prototype (void * instead of char * for generic
pointer).

Add/update some OpenSSL copyright notices.
2001-10-20 17:56:36 +00:00
Dr. Stephen Henson
cecd263878 Add missing EVP_CIPHER_CTX_{init,cleanup} 2001-10-20 16:18:03 +00:00
Dr. Stephen Henson
581f1c8494 Modify EVP cipher behaviour in a similar way
to digests to retain compatibility.
2001-10-17 00:37:12 +00:00
Lutz Jänicke
41ebed27fa Flush buffers to prevent mixed output (Adam Back <adam@cypherspace.org>). 2001-10-16 14:24:46 +00:00
Dr. Stephen Henson
20d2186c87 Retain compatibility of EVP_DigestInit() and EVP_DigestFinal()
with existing code.

Modify library to use digest *_ex() functions.
2001-10-16 01:24:29 +00:00
Richard Levitte
dd5e774664 Add support for md4WithRSAEncryption. 2001-10-10 21:37:45 +00:00
Richard Levitte
712557128b 'make update' 2001-10-10 08:27:52 +00:00
Richard Levitte
b30245dae0 'make update' 2001-10-10 07:56:20 +00:00
Richard Levitte
f8000b9345 'make update' 2001-10-04 07:49:09 +00:00
Richard Levitte
2aa9043ad3 Because there's chances we clash with the system's types.h, rename our
types.h to ossl_typ.h.
2001-10-04 07:32:46 +00:00
Richard Levitte
3d90a32429 sch isn't an array, how did this pass through gcc? 2001-10-02 11:49:55 +00:00
Geoff Thorpe
4ba163cbf9 Make "openssl engine -c" list any supported digests as well as supported
ciphers.
2001-10-01 15:41:31 +00:00
Richard Levitte
a4a8f7b3ef Change HZ in speed to rely on sysconf() if the clock tick is available
that way.  Synchronise s_time with these changes.
2001-09-28 10:34:48 +00:00
Geoff Thorpe
34c66925aa ENGINE_register_all_complete() will register all implementations of all
algorithms present in all loaded ENGINEs. The result is that if any of
those ENGINEs successfully initialises, and the ENGINE_TABLE_FLAG_NOINIT
flag isn't set, then they will always be used (and cached as defaults) in
preference to software implementations. Ie. accidental auto-detection of
acceleration hardware :-)

This change stops all implementations being automatically registered in
"openssl" sub-commands, so that the "setup_engine()" handler in apps.c
controls which ENGINEs are registered for use. A special case has been
added that will revert to this "auto-detect" logic, ie. if the "-engine"
switch is used as;
   -engine auto
2001-09-28 02:25:14 +00:00
Richard Levitte
7876e4488f Stop thinking arguments starting with - are algorithm identifiers.
Show timing parameters and timing functions used.
It looks like some Linuxen have very weird settings for CLK_TCK.  I'm
very unsure about this change and will investigate further.
2001-09-27 15:43:55 +00:00
Geoff Thorpe
0b4b9a11f5 Put the cipher info back into the "openssl engine" command. 2001-09-25 21:45:03 +00:00
Geoff Thorpe
6dc5d570d0 Make necessary tweaks to apps/ files due to recent ENGINE surgery. See
crypto/engine/README for details.
2001-09-25 20:35:01 +00:00
Geoff Thorpe
10b2328fea "make update" 2001-09-24 17:42:35 +00:00
Bodo Möller
c404ff7955 make update 2001-09-20 22:52:19 +00:00
Geoff Thorpe
8ce2912fbc Updated dependencies from "make update" 2001-09-12 02:43:22 +00:00
Geoff Thorpe
1372965e2e Reduce the header dependencies on engine.h in apps/. 2001-09-12 02:39:06 +00:00
Geoff Thorpe
51ac0cfe44 make update 2001-09-10 21:18:11 +00:00
Geoff Thorpe
16e819e1d8 Put all "common" initialisation in the apps_startup() and apps_shutdown()
macros in apps.h.
2001-09-10 21:04:14 +00:00
Bodo Möller
c2222c2ea2 restore previous revision -- memory leak should be fixed in mem.c 2001-09-10 18:47:33 +00:00
Bodo Möller
336da5642d fix memory leak 2001-09-10 18:13:16 +00:00
Bodo Möller
a52c2fb296 exclude disabled message digests 2001-09-10 17:18:56 +00:00
Bodo Möller
41450b27f2 add AES ciphers 2001-09-10 17:12:31 +00:00
Bodo Möller
e72d5983f2 Update so that progs.h can indeed be automatically generated
(Working file: progs.h
     revision 1.24

     date: 2001/02/19 16:06:03;  author: levitte;  state: Exp;  lines: +59 -59
     Make all configuration macros available for application by making
     sure they are available in opensslconf.h, by giving them names starting
     with "OPENSSL_" to avoid conflicts with other packages and by making
     sure e_os2.h will cover all platform-specific cases together with
     opensslconf.h.

     [...])
2001-09-10 17:00:28 +00:00
Bodo Möller
384eff877c Fix apps/openssl.c and ssl/ssltest.c so that they use
CRYPTO_set_mem_debug_options() instead of CRYPTO_dbg_set_options(),
which is the default implementation of the former and should usually
not be directly used by applications (at least if we assume that the
options accepted by the default implementation will also be meaningful
to any other implementations).

Also fix apps/openssl.c and ssl/ssltest such that environment variable
setting 'OPENSSL_DEBUG_MEMORY=off' actively disables the compiled-in
library defaults (i.e. such that CRYPTO_MDEBUG is ignored in this
case).
2001-09-10 09:50:30 +00:00
Ben Laurie
7d34470458 Look up MD5 by name. 2001-09-07 11:45:42 +00:00
Ulf Möller
9d07fd03e3 Use GCC 2.95/3.0 optimization 2001-09-05 02:18:40 +00:00
Geoff Thorpe
79aa04ef27 Make the necessary changes to work with the recent "ex_data" overhaul.
See the commit log message for that for more information.

NB: X509_STORE_CTX's use of "ex_data" support was actually misimplemented
(initialisation by "memset" won't/can't/doesn't work). This fixes that but
requires that X509_STORE_CTX_init() be able to handle errors - so its
prototype has been changed to return 'int' rather than 'void'. All uses of
that function throughout the source code have been tracked down and
adjusted.
2001-09-01 20:02:13 +00:00
Ulf Möller
de73cca923 make update 2001-09-01 04:25:50 +00:00
Lutz Jänicke
faacb092f8 -passin argument not used when actually loading the key
(found by Massimiliano Pala <madwolf@hackmasters.net>).
2001-08-24 13:33:15 +00:00
Dr. Stephen Henson
b439a74620 Load OCSP responder key before waiting for an incoming
connection so it can prompt for pass phrase on startup
instead of after the first connection.

Add -port switch to usage message.
2001-08-23 23:54:11 +00:00
Ben Laurie
354c3ace73 Add first cut symmetric crypto support. 2001-08-18 10:22:54 +00:00
Dr. Stephen Henson
b65f851318 Make -passin -passout etc work again.
Fix leak in ca.c when using -passin.
2001-08-17 01:09:54 +00:00
Dr. Stephen Henson
35bf35411c Add CRL utility functions to allow CRLs to be
built up without accessing structures directly.

Update ca.c to use new functions.

Fix ca.c so it now build CRLs correctly again.
2001-08-17 00:33:43 +00:00
Ben Laurie
d66ace9da5 Start to reduce some of the header bloat. 2001-08-05 18:02:16 +00:00
Lutz Jänicke
e9eb000c53 Oops, one SSL_OP_NON_EXPORT_FIRST was left. 2001-08-03 13:05:44 +00:00
Richard Levitte
99ecb90a99 make update 2001-07-31 06:40:10 +00:00
Ben Laurie
dbad169019 Really add the EVP and all of the DES changes. 2001-07-30 23:57:25 +00:00
Dr. Stephen Henson
534a1ed0cb Allow OCSP server to handle multiple requests.
Document new OCSP options.
2001-07-13 13:13:44 +00:00
Dr. Stephen Henson
ee306a1332 Initial OCSP server support, using index.txt format.
This can process internal requests or behave like a
mini responder.

Todo: documentation, update usage info.
2001-07-12 20:41:51 +00:00
Geoff Thorpe
af436bc158 openssl speed is quite useful for testing hardware support (among other
things), especially as the RSA keys are fixed. However, DSA only fixes the
DSA parameters and then generates the public and private components on the
fly each time - this commit hard-codes some sampled key values so that this
is no longer the case.
2001-07-11 18:59:25 +00:00
Richard Levitte
567671e291 make update 2001-07-10 21:00:37 +00:00
Richard Levitte
2a1ef75435 Patches from Vern Staats <staatsvr@asc.hpc.mil> to get Kerberos 5 in
SSL according to RFC 2712.  His comment is:

This is a patch to openssl-SNAP-20010702 to support Kerberized SSL
authentication.  I'm expecting to have the full kssl-0.5 kit up on
sourceforge by the end of the week.  The full kit includes patches
for mod-ssl, apache, and a few text clients.  The sourceforge URL
is http://sourceforge.net/projects/kssl/ .

Thanks to a note from Simon Wilkinson I've replaced my KRB5 AP_REQ
message with a real KerberosWrapper struct.  I think this is fully
RFC 2712 compliant now, including support for the optional
authenticator field.  I also added openssl-style ASN.1 macros for
a few Kerberos structs; see crypto/krb5/ if you're interested.
2001-07-09 21:46:58 +00:00
Ben Laurie
f82197ad75 Don't update argc, argv for decrypt flag! 2001-07-08 12:58:10 +00:00
Ben Laurie
3f37e73bae Speed test decrypt EVP operations. 2001-07-08 12:14:41 +00:00
Lutz Jänicke
43f9391bcc When only the key is given to "enc", the IV is undefined
(found by Andy Brown <logic@warthog.com>).
2001-07-03 10:31:11 +00:00
Ben Laurie
a169e82065 Fix warning. 2001-07-02 12:50:30 +00:00
Dr. Stephen Henson
b7a26e6daf Modify apps to use NCONF code instead of old CONF code.
Add new extension functions which work with NCONF.

Tidy up extension config routines and remove redundant code.

Fix NCONF_get_number().

Todo: more testing of apps to see they still work...
2001-06-28 11:41:50 +00:00
Richard Levitte
ce16450a89 Make better use of load_cert, load_certs and load_key. 2001-06-27 09:12:43 +00:00
Richard Levitte
7953b8ff1b Make better use of load_cert, load_certs and load_key. 2001-06-25 14:23:36 +00:00
Richard Levitte
5abc8ae6f9 Make better use of load_cert, load_certs and load_key. 2001-06-25 14:00:47 +00:00
Richard Levitte
3d5e97f560 Call apps_shutdown() to take down what apps_startup() set up. 2001-06-25 08:35:59 +00:00
Richard Levitte
55dcfa421c make update 2001-06-23 16:43:03 +00:00
Richard Levitte
c04f8cf44a Use apps_shutdown() in all applications, in case someone decides not
to go the monolith way (does anyone do that these days?).

NOTE: a few applications are missing in this commit.  I've a few more
changes in them that I haven't tested yet.
2001-06-23 16:37:32 +00:00
Richard Levitte
870d986131 apps_startup() needs a corresponding apps_shutdown(). 2001-06-23 16:31:41 +00:00
Richard Levitte
4f272c17f5 Make use of new features in UI's. Among others, the application
password callbak doesn't need to check for sizes any more.
2001-06-23 16:30:14 +00:00
Dr. Stephen Henson
2c7bc88d78 Fix UI leak in apps. 2001-06-23 12:48:46 +00:00
Richard Levitte
2cd3ad9bdd Modify "openssl engine" to handle and display internal control
commands appropriately.
2001-06-20 06:35:46 +00:00
Dr. Stephen Henson
323f289c48 Change all calls to low level digest routines in the library and
applications to use EVP. Add missing calls to HMAC_cleanup() and
don't assume HMAC_CTX can be copied using memcpy().

Note: this is almost identical to the patch submitted to openssl-dev
by Verdon Walker <VWalker@novell.com> except some redundant
EVP_add_digest_()/EVP_cleanup() calls were removed and some changes
made to avoid compiler warnings.
2001-06-19 22:30:40 +00:00
Dr. Stephen Henson
a45e4a5537 Fix memory leaks. 2001-06-19 17:13:48 +00:00
Richard Levitte
6dcd1c9109 Do a proof of concept. "openssl genrsa" will make the name of the
file part of the password prompt unless it's standard input...

More will be added...
2001-06-19 16:34:53 +00:00
Richard Levitte
2fe5adc36c Change the common application routines to use a UI_METHOD for password
prompting, even when done through the callback.
2001-06-19 16:26:30 +00:00
Dr. Stephen Henson
a3376fe8fc make apps compile again 2001-06-19 00:23:47 +00:00
Richard Levitte
c6c0035ea5 One feature wasn't quite commited yet 2001-06-18 06:30:12 +00:00
Richard Levitte
531d630b5c Provide an application-common setup function for engines and use it
everywhere.
2001-06-18 06:22:33 +00:00
Dr. Stephen Henson
f2a253e0dd Add support for MS CSP Name PKCS#12 attribute. 2001-06-11 00:43:20 +00:00
Richard Levitte
2b49dd1e8f 'make update' 2001-06-05 20:32:36 +00:00
Richard Levitte
30b4c2724e Extend all the loading functions to take an engine pointer, a pass
string (some engines may have certificates protected by a PIN!) and
a description to put into error messages.

Also, have our own password callback that we can send both a password
and some prompt info to.  The default password callback in EVP assumes
that the passed parameter is a password, which isn't always the right
thing, and the ENGINE code (at least the nCipher one) makes other
assumptions...

Also, in spite of having the functions to load keys, some utilities
did the loading all by themselves...  That's changed too.
2001-05-30 15:29:28 +00:00
Richard Levitte
98405f240b VMS doesn't support more than on period in a file name 2001-05-22 12:47:38 +00:00
Dr. Stephen Henson
bdee69f718 Allow various X509_STORE_CTX properties to be
inherited from X509_STORE.

Add CRL checking options to other applications.
2001-05-09 00:30:39 +00:00
Dr. Stephen Henson
b545dc6775 Initial CRL based revocation checking. 2001-05-07 22:52:50 +00:00
Dr. Stephen Henson
c2e45f6ddf Win32 fixes:
define LLONG properly for VC++.

stop compiler complaining about signed/unsigned mismatch in apps/engine.c
2001-04-29 16:30:59 +00:00
Richard Levitte
21023745e2 Clean up ENGINE before exiting. 2001-04-26 16:08:10 +00:00
Geoff Thorpe
f11bc84080 Changes to "openssl engine" to support the new control command code in
ENGINE.

 * Extra verbosity can be added with more "v"'s, eg. '-vvv' gives
   information about input flags and descriptions for each control command
   in each ENGINE. Check the output of "openssl engine -vvv" for example.

 * '-pre <cmd>' and '-post <cmd>' can be used to invoke control commands on
   the specified ENGINE (or on all of them if no engine id is specified,
   although that usually gets pretty ugly). '-post' commands are only
   attempted if '-t' is specified and the engine successfully initialises.
   '-pre' commands are always attempted whether or not '-t' causes an
   initialisation to be tried afterwards. Multiple '-pre' and/or '-post'
   commands can be specified and they will be called in the order they
   occur on the command line.

Parameterised commands (the normal case, there are currently no
unparameterised ones) are split into command and argument via a separating
colon. Eg. "openssl engine -pre SO_PATH:/lib/libdriver.so <id>" results in
the call;
    ENGINE_ctrl_cmd_string(e, "SO_PATH", "/lib/libdriver.so", 0);

Application code should similarly allow arbitrary name-value string pairs
to be passed into ENGINEs in a manner matching that in apps/engine.c,
either using the same colon-separated format, or entered as two distinct
strings. Eg. as stored in a registry. The last parameter of
ENGINE_ctrl_cmd_string can be changed from 0 to 1 if the command should
only be attempted if it's supported by the specified ENGINE (eg. for
commands like "FORK_CHECK:1" that may or may not apply to the run-time
ENGINE).
2001-04-19 02:08:26 +00:00
Richard Levitte
9237ba8b66 Correct typo. 2001-04-11 14:14:54 +00:00
Richard Levitte
95874603b0 Add -keyform. 2001-04-11 14:11:55 +00:00
Richard Levitte
ed2e24d564 Show an example of moving the emailAddress object from the subkect DN
to subjectAltName when signing a certificate.
2001-04-11 13:04:20 +00:00
Richard Levitte
c3bdbcf639 NetBSD and OpenBSD use TOD as well 2001-04-11 10:06:02 +00:00
Lutz Jänicke
93f117003e Add forgotten "-passin" option to smime.c usage help. 2001-04-08 10:51:14 +00:00
Richard Levitte
967d95f096 Incorporate some changes that make OpenSSL compilable in CygWin. 2001-04-04 15:50:30 +00:00
Bodo Möller
50b8ba0201 avoid buffer overflow 2001-03-31 07:48:07 +00:00
Bodo Möller
b10ae320f7 this time *really* fix the /../ check ... 2001-03-30 14:55:50 +00:00
Bodo Möller
5d3ab9b096 For -WWW, fix test for ".." directory references (and avoid warning for
index -1).
2001-03-30 10:47:21 +00:00
Richard Levitte
812cb5638c make update 2001-03-24 12:39:59 +00:00
Bodo Möller
f89aebb1c4 Add missing '#ifndef OPENSSL_NO_DSA'. 2001-03-22 15:06:19 +00:00
Richard Levitte
51740b12ae Correct a typo which might have lead to a dump.
Noted by Martin Kraemer <Martin.Kraemer@Fujitsu-Siemens.com>
2001-03-16 10:30:10 +00:00
Dr. Stephen Henson
791bd0cd2b Add copy_extensions option to 'ca' utility. 2001-03-16 02:04:17 +00:00
Dr. Stephen Henson
e890dcdb19 Add 'align' option to nameopt.
Add default values for display by the 'ca' utility
to openssl.cnf

Update docs.
2001-03-15 22:45:20 +00:00
Dr. Stephen Henson
535d79da63 Overhaul the display of certificate details in
the 'ca' utility. This can now be extensively
customised in the configuration file and handles
multibyte strings and extensions properly.

This is required when extensions copying from
certificate requests is supported: the user
must be able to view the extensions before
allowing a certificate to be issued.
2001-03-15 19:13:40 +00:00
Dr. Stephen Henson
0a3ea5d34a Document the -certopt option to the x509 utility.
Add no_issuer option.

Fix X509_print_ex() so it prints out newlines when
certain fields are omitted.
2001-03-15 01:15:54 +00:00
Bodo Möller
cad4b840c8 Fix: return 0 if no error occured. 2001-03-13 22:17:10 +00:00
Bodo Möller
10654d3a74 Forcibly enable memory leak checking during "make test" 2001-03-11 14:49:46 +00:00
Richard Levitte
251cb4cfed For some experiments, it is sometimes nice to serve files with complete
HTTP responses.
2001-03-10 16:20:52 +00:00
Dr. Stephen Henson
1358835050 Change the EVP_somecipher() and EVP_somedigest()
functions to return constant EVP_MD and EVP_CIPHER
pointers.

Update docs.
2001-03-09 02:51:02 +00:00
Bodo Möller
a75d8bebd2 Bugfix: previously the serial number file could turn negative
because an incompletely initialized ASN1_INTEGER was used.
2001-03-08 19:13:24 +00:00
Bodo Möller
3285076c8e Integrate ec_err.[co].
"make depend"
2001-03-08 12:30:12 +00:00
Richard Levitte
70d70a3c81 Code for better build under Darwin (MacOS X).
Submitted by Brad Dominy <jdominy@darwinuser.org>
2001-03-07 10:04:00 +00:00
Bodo Möller
65e8167079 Move ec.h to ec2.h because it is not compatible with what we will use.
Add EC vaporware: change relevant Makefiles and add some empty source
files.

"make update".
2001-03-05 20:13:37 +00:00
Bodo Möller
bad4058574 New option '-subj arg' for 'openssl req' and 'openssl ca'. This
sets the subject name for a new request or supersedes the
subject name in a given request.

Add options '-batch' and '-verbose' to 'openssl req'.

Submitted by: Massimiliano Pala <madwolf@hackmasters.net>
Reviewed by: Bodo Moeller
2001-03-05 11:09:43 +00:00
Bodo Möller
d8c2adae57 increase emailAddress_max 2001-03-04 01:33:55 +00:00
Richard Levitte
7f19d42e9d MacOSX doesn't have ftime().
Spotted by Pieter Bowman <bowman@math.utah.edu>
2001-02-27 08:14:32 +00:00
Dr. Stephen Henson
f196522159 New function and options to check OCSP response validity. 2001-02-24 13:50:06 +00:00
Geoff Thorpe
e3a9164073 I missed one. 2001-02-23 00:09:50 +00:00
Richard Levitte
41d2a336ee e_os.h does not belong with the exported headers. Do not put it there
and make all files the depend on it include it without prefixing it
with openssl/.

This means that all Makefiles will have $(TOP) as one of the include
directories.
2001-02-22 14:45:02 +00:00
Richard Levitte
19f2192136 Windows does not know of strigs.h or strcasecmp, so when in Windows,
make strcasecmp a macro to _stricmp.
2001-02-22 14:21:06 +00:00
Geoff Thorpe
1aa0d94781 This adds command-line support to s_server for controlling the generation
of session IDs. Namely, passing "-id_prefix <text>" will set a
generate_session_id() callback that generates session IDs as random data
with <text> block-copied over the top of the start of the ID. This can be
viewed by watching the session ID s_client's output when it connects.

This is mostly useful for testing any SSL/TLS code (eg. proxies) that wish
to deal with multiple servers, when each of which might be generating a
unique range of session IDs (eg. with a certain prefix).
2001-02-21 18:38:48 +00:00
Richard Levitte
14565bedaf Some functions, like strdup() and strcasecmp(), are defined in
strings.h according to X/Open.
2001-02-20 19:05:59 +00:00
Richard Levitte
02cc82ff8a I forgot there was a reason why the inclusions and definition of u_int
was made in a certain sequence.  This change restores the earlier
"chain of command".
2001-02-20 17:37:02 +00:00
Richard Levitte
38f3b3e29c OpenVMS catches up. 2001-02-20 17:14:30 +00:00
Richard Levitte
be1bd9239f Get e_os2.h to get all the system definitions correctly. 2001-02-20 14:07:03 +00:00
Dr. Stephen Henson
569afce4b0 Fix typo. 2001-02-20 13:30:28 +00:00
Richard Levitte
56dde3ebe6 Include opensslconf.h or the like early to make sure system macros get
correctly defined.
2001-02-20 13:11:54 +00:00
Bodo Möller
ff055b5c89 honour '-no_tmp_rsa' 2001-02-20 12:59:48 +00:00
Richard Levitte
bc36ee6227 Use new-style system-id macros everywhere possible. I hope I haven't
missed any.

This compiles and runs on Linux, and external applications have no
problems with it.  The definite test will be to build this on VMS.
2001-02-20 08:13:47 +00:00
Ulf Möller
28143c66e1 Fix warning. 2001-02-20 00:43:03 +00:00
Richard Levitte
cf1b7d9664 Make all configuration macros available for application by making
sure they are available in opensslconf.h, by giving them names starting
with "OPENSSL_" to avoid conflicts with other packages and by making
sure e_os2.h will cover all platform-specific cases together with
opensslconf.h.

I've checked fairly well that nothing breaks with this (apart from
external software that will adapt if they have used something like
NO_KRB5), but I can't guarantee it completely, so a review of this
change would be a good thing.
2001-02-19 16:06:34 +00:00
Richard Levitte
07247321c6 make update 2001-02-19 14:00:38 +00:00
Dr. Stephen Henson
acba75c59d New -set_serial options to 'req' and 'x509'.
Remove the old broken bio read of serial numbers in the 'ca' index
file. This would choke if a revoked certificate was specified with
a negative serial number.

Fix typo in uid.c
2001-02-19 13:38:32 +00:00
Dr. Stephen Henson
a6b7ffddac New options to 'ca' utility to support CRL entry extensions.
Add revelant new X509V3 extensions.

Add OIDs.

Fix ASN1 memory leak code to pop info if external allocation used.
2001-02-16 01:35:44 +00:00
Lutz Jänicke
52b621db88 Add "-rand" option to s_client and s_server. 2001-02-15 10:22:07 +00:00
Dr. Stephen Henson
f2e5ca84d4 Option to disable standard block padding with EVP API.
Add -nopad option to enc command.

Update docs.
2001-02-14 02:11:52 +00:00
Dr. Stephen Henson
cdc7b8cc60 Initial OCSP SSL support. 2001-02-14 01:12:41 +00:00
Dr. Stephen Henson
67c1801924 New function OCSP_parse_url() and -url option for ocsp utility.
Doesn't handle SSL URLs yet.
2001-02-13 00:37:44 +00:00
Dr. Stephen Henson
46a58ab946 Modify OCSP nonce behaviour. 2001-02-12 23:28:45 +00:00