GitHub/openssl
1
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2026-06-06 20:18:09 +00:00
Code Issues Packages Projects Releases Wiki Activity
39,018 Commits 39 Branches 433 Tags
feature/ech
Commit Graph
393 Commits
Author SHA1 Message Date
Stephen Farrell aea91042d3 ECH build artefacts and a bit of code 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/25193)
 2026-02-16 15:27:06 +00:00
Norbert Pocs d2f54e1b40 windows: Remove redundant include 
The functions malloc, realloc and free are included from stdlib,
therefore no need for redundant malloc.h include.

Signed-off-by: Norbert Pocs <norbertp@openssl.org>

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Feb 13 15:13:13 2026
(Merged from https://github.com/openssl/openssl/pull/29989)
 2026-02-13 16:13:04 +01:00
Philip Prindeville 7b6c638dd5 Cleanup of printing in apps 
Don't use BIO_printf() where BIO_puts() will do.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Feb 13 15:05:38 2026
(Merged from https://github.com/openssl/openssl/pull/29677)
 2026-02-13 16:05:36 +01:00
Milan Broz 7c75acfedc Fix const spec in apps 
This patch fixes several const specifiers
(visible with non-default const-qual warning).

 - Functions like SSL_set_tlsext_host_name takes
   non-cost hostname parameter.

 - packet buffer is read in BIO_read, so it
   cannot be const

The rest is missing const specifiers where casting
to non-cost is not needed.

Signed-off-by: Milan Broz <gmazyland@gmail.com>

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Wed Feb  4 19:49:15 2026
(Merged from https://github.com/openssl/openssl/pull/29796)
 2026-02-04 14:49:08 -05:00
Viktor Dukhovni 6028c0654e Report truncation in oneshot openssl dgst -sign 
Previously input was silently truncated at 16MB, now if the input is
longer than limit, an error is reported.

The bio_to_mem() apps helper function was changed to return 0 or 1,
and return the size of the result via an output size_t pointer.

Fixes  CVE-2025-15469

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Mon Jan 26 19:37:41 2026
 2026-01-26 20:37:35 +01:00
Dr. David von Oheimb 2f949642a1 apps/lib/apps.c: fix load_certs_multifile() and load_certstore() w.r.t. password source vs. actual password 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/28477)
 2026-01-07 12:56:15 +01:00
Dr. David von Oheimb 48d4c8fb8b apps/lib/apps.c load_key_certs_crls() refactor uidata use and tweak error message 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/28477)
 2026-01-07 12:56:15 +01:00
Dr. David von Oheimb 7123614134 apps.c: fix next_item() to correctly handle space(s) before comma separators 
* Modified the parsing logic to handle space-followed-by-comma patterns
* Updated the separator skipping logic to process at most one comma while allowing multiple spaces
* Added a test case with a mixed DNS and IP SAN entry that includes the problematic spacing pattern

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28471)
 2026-01-06 21:02:20 +01:00
Bernd Edlinger c0a7890b62 Fix a memory leak in sctp code 
There is a memory leak of the addrinfo struct when
`./openssl s_server -dtls -sctp -accept 127.0.0.1:4433`
is used, but `sysctl -w net.sctp.auth_enable=1`
is not done before.
Additionally this fixes an oversight, when
`./openssl s_client -dtls -sctp -connect localhost:4433`
is used to connect to above server.
The first connect attempt is to IPv6 ::1, which might fail,
but the second attempt might still succeed, so continue to
try all addesses even when the SCTP socket fails for one of them.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29541)
 2026-01-06 07:56:14 -05:00
Kurt Roeckx 60c15b2aff Remove support for SSLv3 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29338)
 2025-12-23 10:54:06 -05:00
Bob Beck 4036f4b0e3 Add new public API for checking certificate times. 
Fixes: #1631

This changes the previously internal ossl_x509_check_certificate_times()
to be the public X509_check_certificate_times(). It adds documentation
for the new function and marks X509_cmp_time, X509_cmp_timeframe,
and X509_cmp_current_time as deprecated in 4.0, as discussed in #1631.

Since the function is now public, we can replace the remaining
uses of deprecated stuff with this function.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29152)
 2025-12-18 13:34:58 -05:00
Richard Levitte 92d1ea3bf2 Missed a spot! 
For some reason, source reformatting didn't catch everything.

Reviewed-by: Paul Yang <paulyang.inf@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29383)
 2025-12-17 10:19:43 -05:00
Viktor Dukhovni 473dff4781 New -encopt option for pkey(1) and genpkey(1) 
This allows setting the ML-KEM and ML-DSA output formats.
At the same fixing surprising lack of password encryption
of PKCS#8 private keys in DER output form in the CLI apps.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29324)
 2025-12-17 13:40:17 +01:00
Dmitry Belyavskiy d328874645 Document skey decoder 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Simo Sorce <simo@redhat.com>
(Merged from https://github.com/openssl/openssl/pull/28278)
 2025-12-10 12:20:44 -05:00
Dmitry Belyavskiy 1b0f21f055 Implementing store support for EVP_SKEY 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Simo Sorce <simo@redhat.com>
(Merged from https://github.com/openssl/openssl/pull/28278)
 2025-12-10 12:20:44 -05:00
Bob Beck 2fab90bb5e 4.0-POST-CLANG-FORMAT-WEBKIT 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29242)
 2025-12-09 00:28:19 -07:00
Norbert Pocs 4e96426a8d apps: Remove opt_legacy_okay function 
The function used to check for ENGINEs to determine if a legacy code
path is available, but it makes no sense to keep it after the ENGINE
removal, as the legacy path will always fail.

Signed-off-by: Norbert Pocs <norbertp@openssl.org>

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29305)
 2025-12-04 07:32:18 -05:00
Norbert Pocs 9425238145 apps/: Remove "-keyform engine" 
Resolves: https://github.com/openssl/project/issues/1354

Signed-off-by: Norbert Pocs <norbertp@openssl.org>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29305)
 2025-12-04 07:31:06 -05:00
Norbert Pocs 26b1723ed4 apps/: Remove engines 
Signed-off-by: Norbert Pocs <norbertp@openssl.org>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29305)
 2025-12-04 07:31:05 -05:00
Beat Bolli 8ca421f881 Change hexdump width to a multiple of 8 bytes 
10, 15 and 18 seem quite unnatural byte counts in the context of hex
dumps. Standardize on 24 bytes for signatures (to stay within the 80
characters limit) and 16 bytes for everything else.

Adjust all test cert dumps to match the new output format.

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29266)
 2025-12-03 17:45:15 +01:00
Dr. David von Oheimb 3aea6c37f6 APPS/load_key_certs_crls(): prevent mem leaks on error w.r.t. any leftover credentials 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28005)
 2025-12-03 16:01:43 +01:00
Jiasheng Jiang ae4d37e3fb apps/lib/log.c: Add check for BIO_new() 
Add check for the return value of BIO_new() to avoid potential NULL pointer dereference.

Fixes: 8a2ec00d7f ("apps/lib/http_server.{c,h}: clean up logging and move it to log.{c,h}")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>

Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27918)
 2025-12-01 11:30:00 +01:00
Joshua Rogers 3005b9bc86 apps/s_socket: fix FD and addrinfo leak on SCTP failure in init_client 
If BIO_new_dgram_sctp(*sock, BIO_NOCLOSE) fails we returned 0 directly,
skipping the out: cleanup and leaking the just created socket plus the
addrinfo lists.

Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/28917)
 2025-11-18 17:59:50 +01:00
Joshua Rogers 76b4fa346c apps/s_socket: fix double close of listening socket when naccept==0 
Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28813)
 2025-10-17 19:05:15 +02:00
Joshua Rogers 3aa2f3a456 Fix off-by-one overflow in the AST resubmit 
Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28811)
 2025-10-17 19:02:26 +02:00
Bob Beck 48a2d1e448 Put an appropriate warning in the apps code for now 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28623)
 2025-10-16 09:16:06 -04:00
Joshua Rogers 694b4159ba s_socket: continue in loop, on bind fail 
Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28814)
 2025-10-14 17:55:41 +02:00
Norbert Pocs 7fb9163586 Check return code of BIO_ADDR_rawaddress 
Fixes coverity issue: https://scan5.scan.coverity.com/#/project-view/64471/10222?selectedIssue=1666584
Thank you for the report!

Signed-off-by: Norbert Pocs <norbertp@openssl.org>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/28751)
 2025-10-07 12:30:09 -04:00
Bob Beck e70d3b1886 Add util/codespell-check.sh and run it 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28639)
 2025-09-26 07:58:44 -04:00
Igor Ustinov bd91eb6658 dgst and mac apps: Added new ways for obtaining a MAC key 
Resolves #24584

It is now possible to obtain a MAC key from an environment variable,
a file or read it from the standard input.

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28160)
 2025-09-09 09:58:10 +02:00
Eugene Syromiatnikov 3f77491cb3 apps: remove chopup_args() 
The last (and only?) user has been removed in commit eca4713913 "APPS:
Drop interactive mode in the 'openssl' program".

Complements: eca4713913 "APPS: Drop interactive mode in the 'openssl' program"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>

Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28441)
 2025-09-08 15:04:14 -04:00
Eugene Syromiatnikov ddee212bab apps: use app_malloc_array() 
Replace app_malloc() calls where app_malloc_array() ones where
appropriate.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28444)
 2025-09-07 07:22:24 -04:00
Eugene Syromiatnikov 4f288b60e8 apps: introduce app_malloc_array() 
Similar to app_malloc(), provides a wrapper for OPENSSL_malloc_array()
that bails out when a NULL pointer is returned.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28444)
 2025-09-07 07:22:24 -04:00
openssl-machine e66332418f Copyright year updates 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Release: yes
 2025-09-02 13:05:45 +00:00
Eugene Syromiatnikov f3a4d05c58 apps, fuzz, providers: use array memory (re)allocation routines 
Co-Authored-by: Alexandr Nedvedicky <sashan@openssl.org>
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28059)
 2025-08-08 12:22:10 -04:00
Eugene Syromiatnikov 082a81404c apps/lib/apps.c: remove HARNESS_OSSL_PREFIX envvar handling 
As the environment variable is no longer used by the test harness,
its support can be removed from the openssl command, along
with the possible unintended consequences of prefixing the standard
output of the openssl command with an arbitrary string set
in the environment.

Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28025)
 2025-07-29 13:12:10 -04:00
martin b1b4b154fd Add support for TLS 1.3 OCSP multi-stapling for server certs 
Co-authored-by: Michael Krueger

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20945)
 2025-07-25 17:24:37 +02:00
Norbert Pocs af2aaf3271 Deprecate ASN1_METH internal usage 
Some of them are needed and were kept by adding `#include
"internal/deprecated"` and some had to be turned off.

Signed-off-by: Norbert Pocs <norbertp@openssl.org>

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27727)
 2025-07-17 11:25:18 -04:00
Tomas Mraz bb86c43fa8 libapps + libcrypto: Silence warnings on Win64 builds 
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27806)
 2025-07-02 17:26:26 +02:00
Jiasheng Jiang 2fccd17e8f apps/lib/apps.c: Add check for BIO_new() 
Add checks for the return value of BIO_new() to guarantee successful
allocation, consistent with other usages.

Fixes: a412b89 ("dup_bio_* and bio_open_* are utility functions and belong in apps.c")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27894)
 2025-07-01 19:31:54 +02:00
AntonMoryakov 3161f460fa apps: lib: Prevent potential NULL dereference in init_client() 
apps: lib: Simplify ba_ret handling in init_client()

Simplify logic around ba_ret assignment:
- Fail early if ba_ret == NULL
- Assign directly otherwise, without checking *ba_ret

This avoids extra nesting and matches OpenSSL's conventions.

CLA: trivial
Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
Co-authored-by: Tomas Mraz <tomas@openssl.org>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26783)
 2025-05-29 16:37:41 +02:00
Pauli fad8c04ded commands: fix parameter value output 
The parameter value output library routine was incorrect.  It used the
incorrect length when printing fetched parameter sizes.  It also printed
a string which was potentially not zero terminated.  Both of these are
addressed here.

Additionally, octet strings have their initial bytes printed in hex.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27221)
 2025-04-18 15:23:42 +01:00
fangming.fang 86408fa8de Implement interleaving aes-cbc-hmac-sha on aarch64 
This is to implement #19932, it adds enc-then-mac aes-cbc-hmac-sha1/256,
aes-cbc and hmac-sha1/256 are interleaved to achieve better performance.
It only supports non-padding mode that means the length of input data
should be multiple of 16 bytes.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/22949)
 2025-04-14 14:53:30 +01:00
JiashengJiang 930c645e6b apps/lib/apps.c: Add a check for OPENSSL_strdup() 
Add a check for the return value of OPENSSL_strdup() to guarantee the success of allocation, similar to the other call sites.

Fixes: c7d5ea2670 ("Prepare to detect index changes in OCSP responder.")
Signed-off-by: JiashengJiang <jiasheng@purdue.edu>

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27172)
 2025-03-28 11:40:02 +01:00
Viktor Dukhovni 60f2a71400 Fix goto label indents to match style 
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27175)
 2025-03-28 11:37:12 +01:00
Viktor Dukhovni 681528cbc4 Report IANA sigalg name in s_client 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27128)
 2025-03-25 20:06:19 +01:00
openssl-machine 0c679f5566 Copyright year updates 
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Release: yes
 2025-03-12 13:35:59 +00:00
Tomas Mraz 2411f9b662 apps: Escape control characters in DNs by default 
When displaying distinguished names the control characters
are escaped by default.

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26932)
 2025-03-03 09:08:34 +01:00
Viktor Dukhovni 31b5f3f382 Further decoder tuning possibly better perf 
- The decoder should consider fewer options based on
  more precise tracking of the desired input type
  (DER, PVK, MSBLOB), algorithm (RSA, EC, ...),
  input structure (SPKI, P8, ...).

How much this affects actual use-cases is harder to estimate, we'll just
have to run before/after perf tests.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26927)
 2025-03-02 02:04:09 +11:00
Viktor Dukhovni 594cef49b4 Accessors for the IANA signature scheme name 
This is the official name of the signature algorithm(s) used by the peer
and/or local end of the connection, and should be available, e.g. for
logging.

Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26738)
 2025-02-17 15:08:25 +11:00