GitHub/openssl
1
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2026-06-06 20:18:09 +00:00
Code Issues Packages Projects Releases Wiki Activity
39,018 Commits 39 Branches 433 Tags
feature/ech
Commit Graph
90 Commits
Author SHA1 Message Date
Viktor Dukhovni 6028c0654e Report truncation in oneshot openssl dgst -sign 
Previously input was silently truncated at 16MB, now if the input is
longer than limit, an error is reported.

The bio_to_mem() apps helper function was changed to return 0 or 1,
and return the size of the result via an output size_t pointer.

Fixes  CVE-2025-15469

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Jan 26 19:37:41 2026
 2026-01-26 20:37:35 +01:00
Dr. David von Oheimb 2f949642a1 apps/lib/apps.c: fix load_certs_multifile() and load_certstore() w.r.t. password source vs. actual password 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/28477)
 2026-01-07 12:56:15 +01:00
Viktor Dukhovni 473dff4781 New -encopt option for pkey(1) and genpkey(1) 
This allows setting the ML-KEM and ML-DSA output formats.
At the same fixing surprising lack of password encryption
of PKCS#8 private keys in DER output form in the CLI apps.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29324)
 2025-12-17 13:40:17 +01:00
Dmitry Belyavskiy d328874645 Document skey decoder 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Simo Sorce <simo@redhat.com>
(Merged from https://github.com/openssl/openssl/pull/28278)
 2025-12-10 12:20:44 -05:00
Dmitry Belyavskiy 1b0f21f055 Implementing store support for EVP_SKEY 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Simo Sorce <simo@redhat.com>
(Merged from https://github.com/openssl/openssl/pull/28278)
 2025-12-10 12:20:44 -05:00
Bob Beck 2fab90bb5e 4.0-POST-CLANG-FORMAT-WEBKIT 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29242)
 2025-12-09 00:28:19 -07:00
Milan Broz bf24dd887c Remove engine.h includes for internal code. 
This should no be used anywhere, as typedef for ENGINE is in types.h.

Only apps should include this header for compatibility stubs.

Signed-off-by: Milan Broz <gmazyland@gmail.com>

Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29305)
 2025-12-04 07:32:18 -05:00
Norbert Pocs 26b1723ed4 apps/: Remove engines 
Signed-off-by: Norbert Pocs <norbertp@openssl.org>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29305)
 2025-12-04 07:31:05 -05:00
Igor Ustinov bd91eb6658 dgst and mac apps: Added new ways for obtaining a MAC key 
Resolves #24584

It is now possible to obtain a MAC key from an environment variable,
a file or read it from the standard input.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28160)
 2025-09-09 09:58:10 +02:00
Eugene Syromiatnikov 3f77491cb3 apps: remove chopup_args() 
The last (and only?) user has been removed in commit eca4713913 "APPS:
Drop interactive mode in the 'openssl' program".

Complements: eca4713913 "APPS: Drop interactive mode in the 'openssl' program"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28441)
 2025-09-08 15:04:14 -04:00
Eugene Syromiatnikov 4f288b60e8 apps: introduce app_malloc_array() 
Similar to app_malloc(), provides a wrapper for OPENSSL_malloc_array()
that bails out when a NULL pointer is returned.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28444)
 2025-09-07 07:22:24 -04:00
Norbert Pocs af2aaf3271 Deprecate ASN1_METH internal usage 
Some of them are needed and were kept by adding `#include
"internal/deprecated"` and some had to be turned off.

Signed-off-by: Norbert Pocs <norbertp@openssl.org>

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27727)
 2025-07-17 11:25:18 -04:00
openssl-machine 0c679f5566 Copyright year updates 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Release: yes
 2025-03-12 13:35:59 +00:00
shridhar kalavagunta 21f72fa4c8 genpkey: Avoid leaving empty file if encryption passphrase does not match 
Fixes #25440

Reviewed-by: Hugo Landau <hlandau@devever.net>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26081)
 2025-01-15 13:26:41 +01:00
FdaSilvaYY 23b795d34f apps: directly inclusion of "e_os.h when needed 
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14344)
 2024-09-05 17:02:51 +02:00
Tomas Mraz 7ed6de997f Copyright year updates 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Release: yes
 2024-09-05 09:35:49 +02:00
Stephan Wurm 8120223773 apps: ca,req,x509: Add explicit start and end dates options 
- Added options `-not_before` (start date) and `-not-after` (end date)
  for explicit setting of the validity period of a certificate in the
  apps `ca`, `req` and `x509`
- The new options accept time strings or "today"
- In app `ca`, use the new options as aliases of the already existing
  options `-startdate` and `-enddate`
- When used in apps `req` and `x509`, the end date must be >= the start
  date, in app `ca` end date < start date is also accepted
- In any case, `-not-after` overrides the `-days` option
- Added helper function `check_cert_time_string` to validate given
  certificate time strings
- Use the new helper function in apps `ca`, `req` and `x509`
- Moved redundant code for time string checking into `set_cert_times`
  helper function.
- Added tests for explicit start and end dates in apps `req` and `x509`
- test: Added auxiliary functions for parsing fields from `-text`
  formatted output to `tconversion.pl`
- CHANGES: Added to new section 3.4

Signed-off-by: Stephan Wurm <atomisirsi@gsklan.de>

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21716)
 2024-04-09 20:13:31 +02:00
Matt Caswell da1c088f59 Copyright year updates 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Release: yes
 2023-09-07 09:59:15 +01:00
Dr. David von Oheimb b77826877b APPS: replace awkward and error-prone pattern by calls to new app_conf_try_number() 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/20971)
 2023-05-25 09:04:35 +02:00
Dr. David von Oheimb da7f81d393 APPS: replace awkward and error-prone pattern by calls to new app_conf_try_string() 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/20971)
 2023-05-25 09:04:35 +02:00
Tianjia Zhang a75f707fca apps: silent warning when loading CSR files with vfyopt option 
When verifying or signing a CSR file with the -vfyopt option,
a warning message similar to the following will appear:

  Warning: CSR self-signature does not match the contents

This happens especially when the SM2 algorithm is used and the
distid parameter is added. Pass the vfyopts parameter to the
do_X509_REQ_verify() function to eliminate the warning message.

Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20799)
 2023-05-03 09:48:17 +02:00
Dr. David von Oheimb 0e89b39619 apps/x509 etc.: allow private key input when public key is expected 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/19076)
 2023-03-14 17:26:49 +01:00
Dr. David von Oheimb 342e3652c7 APPS: generated certs bear X.509 V3, unless -x509v1 option of req app is given 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/19271)
 2023-01-24 15:16:47 +01:00
Dr. David von Oheimb 200d844782 APPS: Move load_csr_autofmt() from apps/cmp.c to apps.c and use it also for apps, too 
Also add related references to FR #15725.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
(Merged from https://github.com/openssl/openssl/pull/18900)
 2022-09-20 20:59:50 +02:00
Dr. David von Oheimb ec8a340948 APPS/x509: With -CA but both -CAserial and -CAcreateserial not given, use random serial. 
Also improve openssl-x509.pod.in and error handling of load_serial() in apps.c.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18373)
 2022-07-14 07:23:58 +01:00
Armin Fuerst 065121ff19 Add tests for do_updatedb 
Fixes #13944

Moved "opt_printf_stderr" out of apps.c to avoid duplicate definition in tests.

Added function "asn1_string_to_time_t" including tests.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/17645)
 2022-02-14 10:18:46 +01:00
Richard Levitte d5f9166bac Move e_os.h to include/internal 
Including e_os.h with a path from a header file doesn't work well on
certain exotic platform.  It simply fails to build.

Since we don't seem to be able to stop ourselves, the better move is
to move e_os.h to an include directory that's part of the inclusion
path given to the compiler.

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/17641)
 2022-02-05 05:31:09 +01:00
Philip Prindeville e1cd94f2dc Standardize progress callback for dhparam, dsaparam, etc. 
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/17359)
 2022-01-21 15:44:28 +01:00
Rami Khaldi 9567fd3819 x509: Return a nonzero exit code on error when checking ip/email/host 
In the x509 app when doing the ip/email/host validation of a
certificate we return nonzero exit code if the validation fails.

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/17022)
 2021-11-24 11:37:49 +01:00
Dr. David von Oheimb af16097feb Move more general parts of internal/cryptlib.h to new internal/common.h 
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15847)
 2021-11-17 15:48:37 +01:00
Dr. David von Oheimb 2ff286c26c Add and use HAS_PREFIX() and CHECK_AND_SKIP_PREFIX() for checking if string has literal prefix 
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15847)
 2021-11-17 15:48:34 +01:00
Dr. David von Oheimb adbd77f6d7 X509: Fix handling of AKID and SKID extensions according to configuration 
Fixes #16300

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/16342)
 2021-11-11 20:18:55 +01:00
Dr. David von Oheimb 32f7be2ab7 APPS: Fix result type of dump_cert_text() and behavior of print_name() on out==NULL 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/16344)
 2021-08-25 07:07:21 +02:00
Pauli 3334e039cf add libctx and property query to fetch functions 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15687)
 2021-06-15 18:26:47 +10:00
William Edmisten 8c5bff2220 Add support for ISO 8601 datetime format 
Fixes #5430

Added the configuration file option "date_opt" to the openssl applications ca,
crl and x509.
Added ASN1_TIME_print_ex which supports the new datetime format using the
flag ASN1_DTFLGS_ISO8601

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14384)
 2021-06-11 12:39:46 +02:00
Shane Lontis ef0449135c Fix s_server app to not report an error when using a non DH certificate. 
Fixes #15071

It always tries loading the cert as DH which previously did not produce
an error. The errors are not suppressed for these operations.
The output now matches previous versions of OpenSSL.

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15670)
 2021-06-10 17:58:27 +02:00
Dr. David von Oheimb a7e4ca5b4e Add warning to key/param generating apps on potential delay due to missing entropy 
This also introduces app_keygen() and app_paramgen() and cleans up err reporting.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12095)
 2021-05-25 15:16:54 +02:00
Dr. David von Oheimb 88d96983d8 apps/ocsp: Add -proxy and -no_proxy options 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15245)
 2021-05-18 11:08:10 +02:00
Dr. David von Oheimb 829902879e HTTP client API: Generalize to arbitrary request and response contents 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15053)
 2021-05-14 19:24:42 +02:00
Tomas Mraz d382e79632 Make the -inform option to be respected if possible 
Add OSSL_STORE_PARAM_INPUT_TYPE and make it possible to be
set when OSSL_STORE_open_ex() or OSSL_STORE_attach() is called.

The input type format is enforced only in case the file
type file store is used.

By default we use FORMAT_UNDEF meaning the input type
is not enforced.

Fixes #14569

Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15100)
 2021-05-06 11:43:32 +01:00
Petr Gotthard 91034b68b3 apps/ca,req,x509: Switch to EVP_DigestSignInit_ex 
Switch lib/apps.c do_sign_init() to use EVP_DigestSignInit_ex, so it
works with external providers.
Since EVP_DigestSignInit_ex requires a digest name instead of
an EVP_MD pointer, the apps using do_sign_init() had to be modified
to pass char* instead of EVP_MD*.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/15014)
 2021-04-30 21:02:59 +02:00
Shane Lontis e9d62da6c3 Fix CRL app so that stdin works. 
Fixes #15031

The maybe_stdin needed to be passed to load_key_certs_crls().

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15058)
 2021-04-30 16:04:52 +10:00
Dr. David von Oheimb ef203432f7 apps/cmp.c and APP_HTTP_TLS_INFO: Fix use-after-free and add proper free() function 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14971)
 2021-04-22 20:39:00 +02:00
Dr. David von Oheimb 3ad6030948 APPS: make apps strict on app_RAND_load() and app_RAND_write() failure 
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14840)
 2021-04-14 16:48:27 +02:00
Armin Fuerst b1c908f421 apps: fix warning about size_t / int conversion 
Windows builds show the following warning:
(..\apps\ca.c(2643): warning C4267: 'function': conversion
from 'size_t' to 'int', possible loss of data)

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14453)
 2021-04-09 16:20:47 +02:00
Tomas Mraz ea51096e51 apps: Add maybe_stdin argument to load_certs and set it in pkcs12 
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/14449)
 2021-03-15 13:29:57 +01:00
Dr. David von Oheimb f62846b703 apps/ts.c: Allow -untrusted arg to refer to multiple sources 
This requires moving generally useful functions from apps/cmp.c to apps/lib/apps.c

Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14504)
 2021-03-13 11:16:13 +01:00
Dr. David von Oheimb 46a11faf3b apps/x509.c: Improve print_name() and coding style of large print loop in x509_main() 
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14340)
 2021-02-28 11:46:34 +01:00
Rich Salz 51e5df0ed0 Load rand state after loading providers 
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14135)
 2021-02-12 08:34:17 +10:00
Petr Gotthard 7dc67708c8 apps/openssl: add -propquery command line option 
Fixes #13656. Right now all openssl commands use a NULL propq. This
patch adds a possibility to specify a custom propq.

The implementation follows the example of set_nameopt/get_nameopt.

Various tools had to be modified to call app_get0_propq after it has
been populated. Otherwise the -propquery has no effect.

The tests then verify the -propquery affects the tool behaviour by
requesting a non-existing property.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13707)
 2021-02-05 10:24:04 +10:00