616 Commits

Author SHA1 Message Date
Sebastian Andrzej Siewior 33958827f7 apps: Move PATH_MAX define out of the win32 block
The PATH_MAX define is needed on HURD which is now skipped since it is
winthin the _WIN32 block.

Move the PATH_MAX check+define outside of the _WIN32 block.

Fixes: a2e5848d9d "s_client and s_server options for ECH"
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Sun Apr 26 11:35:52 2026
(Merged from https://github.com/openssl/openssl/pull/30520)
2026-04-26 13:35:27 +02:00
F. R. Da Silva 98ed49849e apps : enforce command-line parameter checking.
Improve 'verify' option help messages.

integer value parsing formats are:
- 'n' is any integer
- 'N' is a non-negative integer (i.e. value >= 0)
- 'p' is a positive integer (i.e. value > 0)

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Mon Apr 13 09:30:22 2026
(Merged from https://github.com/openssl/openssl/pull/30476)
2026-04-13 11:30:19 +02:00
Filipe R. Da Silva 871e10f17a apps: remove atoi() calls.
Related to #8216

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
MergeDate: Mon Apr 13 09:30:21 2026
(Merged from https://github.com/openssl/openssl/pull/30476)
2026-04-13 11:29:19 +02:00
sftcd dc449562f4 ECH: chunk-size bug fix and non-regression changes
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
MergeDate: Thu Mar 19 10:35:56 2026
(Merged from https://github.com/openssl/openssl/pull/30417)
2026-03-19 11:35:54 +01:00
openssl-machine c721580653 Copyright year updates
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Mar 10 14:37:54 2026
Release: yes
2026-03-10 14:37:52 +00:00
Viktor Dukhovni 3acf8e9a1a Added -expected-rpks s_client/server option
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Sat Feb 28 09:17:23 2026
(Merged from https://github.com/openssl/openssl/pull/30089)
2026-02-28 20:14:40 +11:00
Eugene Syromiatnikov 2bd2451da2 apps/s_server.c: call OPENSSL_DIR_end after directory traversal in ech_load_dir
While it is not documented, OPENSSL_DIR_end() is to be called at the end
of directory traversal to free the context and avoid leaking memory.

Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1681464
Fixes: a2e5848d9d "s_client and s_server options for ECH"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 25 11:10:39 2026
(Merged from https://github.com/openssl/openssl/pull/30139)
2026-02-25 12:10:23 +01:00
Eugene Syromiatnikov 08f6739dfa apps/s_server.c: free ECH storage in ech_load_dir() on return
The ECH storage is to be freed on both error and success paths,
as it is copied by SSL_CTX_set1_echstore().

Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1681454
Fixes: a2e5848d9d "s_client and s_server options for ECH"
Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Wed Feb 25 11:10:38 2026
(Merged from https://github.com/openssl/openssl/pull/30139)
2026-02-25 12:10:23 +01:00
Bob Beck b0f2107b44 Constify X509_NAME
There are still a few casts away from const where things do not actually
end up mutating the object, we'll deal with that later.

Part of #28654 and #29117
Fixes openssl/project#1781

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Norbert Pocs <norbertp@openssl.org>
MergeDate: Wed Feb 25 09:58:35 2026
(Merged from https://github.com/openssl/openssl/pull/29468)
2026-02-25 10:56:17 +01:00
Tomas Mraz dba0ecd3bf ECH: Use BIO_puts when appropriate
And also a few additional code cleanups.

Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Fri Feb 20 10:11:20 2026
(Merged from https://github.com/openssl/openssl/pull/30066)
2026-02-20 16:40:25 +00:00
sftcd 5e5a76fc2c Add tests and documentation and fix a couple of issues identified by added tests
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
MergeDate: Mon Feb 16 15:41:15 2026
(Merged from https://github.com/openssl/openssl/pull/29200)
2026-02-20 16:40:25 +00:00
sftcd a2e5848d9d s_client and s_server options for ECH
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28270)
2026-02-20 16:40:25 +00:00
Philip Prindeville 7b6c638dd5 Cleanup of printing in apps
Don't use BIO_printf() where BIO_puts() will do.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Feb 13 15:05:38 2026
(Merged from https://github.com/openssl/openssl/pull/29677)
2026-02-13 16:05:36 +01:00
Viktor Dukhovni aa4802204b Enable signing of empty files with pkeyutl
The allocated buffer for the file contents is then zero bytes long,
which `app_malloc()` used to refuse.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue Jan 20 18:17:12 2026
(Merged from https://github.com/openssl/openssl/pull/29613)
2026-01-20 19:17:06 +01:00
Kurt Roeckx 60c15b2aff Remove support for SSLv3
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29338)
2025-12-23 10:54:06 -05:00
Bob Beck 2fab90bb5e 4.0-POST-CLANG-FORMAT-WEBKIT
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29242)
2025-12-09 00:28:19 -07:00
Norbert Pocs 9425238145 apps/: Remove "-keyform engine"
Resolves: https://github.com/openssl/project/issues/1354

Signed-off-by: Norbert Pocs <norbertp@openssl.org>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29305)
2025-12-04 07:31:06 -05:00
Norbert Pocs 26b1723ed4 apps/: Remove engines
Signed-off-by: Norbert Pocs <norbertp@openssl.org>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29305)
2025-12-04 07:31:05 -05:00
martin c5c8b44f0f Fixed non-compliant handling of missing stapled OCSP responses
If the OCSP response was not present for a certificate the server
created a non-conforming empty CertificateStatus extension
instead of not sending the extension at all.

Fixes #28902

Fixes b1b4b154

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28955)
2025-11-28 15:43:54 +01:00
Joshua Rogers 095aab1dc2 Remove dead RENEG code
Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/28914)
2025-10-27 10:26:20 -04:00
Joshua Rogers 7e97bb2c63 s_server: Use static int, not static.
Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>

Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Frederik Wedel-Heinen <fwh.openssl@gmail.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/28914)
2025-10-27 10:26:19 -04:00
Joshua Rogers 0d3efc8754 s_server: print program not, not port
Signed-off-by: Joshua Rogers <MegaManSec@users.noreply.github.com>

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28807)
2025-10-17 19:00:52 +02:00
Ryan Hooper e5f01903ed Enable peer verification with s_server's verify_return_error option
If the option is specified it will now implicitly enable peer verification.

The s_client command  was already behaved this way, so
s_server was updated to match the behavior of s_client.

Fixes #15134

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28445)
2025-09-18 17:24:03 +02:00
Neil Horman 3c4f009959 Fix NULL check in get_ocsp_resp_from_responder
We assign an allocation to *sk_resp, but only check for NULL on sk_resp,
not the value it points to.

Addresses https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1659222

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28101)
2025-07-29 13:40:57 -04:00
Neil Horman bd1a14bcaf Set *sk_resp to NULL when freeing.
Its possible for get_ocsp_resp_from_responder to return OK after having
freed *sk_resp without setting the freed pointer to NULL, leading us to
set a garbage pointer in other code.

Ensure that we set it to NULL after freeing

Addresses https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1659225

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28101)
2025-07-29 13:40:57 -04:00
Neil Horman 8ceae5a622 Fix NULL check in bring_oscp_resp_in_correct_order
We assign an allocated pointer to *sk_resp but only check if sk_resp is
NULL when sk_resp is a pointer to a pointer

Addresses https://scan5.scan.coverity.com/#/project-view/60762/10222?selectedIssue=1659227

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28101)
2025-07-29 13:40:57 -04:00
martin b1b4b154fd Add support for TLS 1.3 OCSP multi-stapling for server certs
Co-authored-by: Michael Krueger

Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20945)
2025-07-25 17:24:37 +02:00
Tomas Mraz c62cd07d14 apps: Silence warnings on Win64 builds
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/27806)
2025-07-02 17:26:26 +02:00
openssl-machine 0c679f5566 Copyright year updates
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Release: yes
2025-03-12 13:35:59 +00:00
Frederik Wedel-Heinen 00fbc96988 Adds missing checks of return from XXX_up_ref().
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/26294)
2025-02-18 16:32:59 +01:00
Daiki Ueno f37dea418b s_server: Support reading HTTP request from early data
This would be useful when testing with browsers / downloaders which
support 0-RTT only through HTTP.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/16055)
2024-09-12 14:19:44 +02:00
FdaSilvaYY 23b795d34f apps: directly inclusion of "e_os.h when needed
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14344)
2024-09-05 17:02:51 +02:00
Richard Levitte b646179229 Copyright year updates
Reviewed-by: Neil Horman <nhorman@openssl.org>
Release: yes
(cherry picked from commit 0ce7d1f355)

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24034)
2024-04-09 13:43:26 +02:00
olszomal d6aafeb107 Use the untrusted certificate chain to create a valid certificate ID for OCSP_request
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22192)
2024-03-12 14:02:13 +01:00
Frederik Wedel-Heinen 575117efe1 Error in s_server when -rev option is used with dtls.
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23278)
2024-01-15 16:34:06 +01:00
Dimitri Papadopoulos e22ebb893e Bad function definition
void f() should probably be void f(void)

Found by running the checkpatch.pl Linux script to enforce coding style.

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21468)
2023-09-11 10:15:30 +02:00
wangcheng b9a189ce87 Modify the dkeyform type to support engine
The valtype value of dkeyform defined in the s_server_options structure is F, which leads to the judgment that the engine is not supported when processing parameters in the opt_next function.
This the valtype value of dkeyform should be changed to "f".

CLA: trivial

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21982)
2023-09-08 16:16:31 +10:00
Dimitri Papadopoulos a024ab984e Fix typos found by codespell
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21467)
2023-07-18 18:54:45 +10:00
Tomas Mraz 82b81161de Coverity 1528490: Avoid assignment of unused value of i
It is used only within the loop and initialized at the beginning
2023-06-10 19:23:59 -04:00
Todd Short 3c95ef22df RFC7250 (RPK) support
Add support for the RFC7250 certificate-type extensions.
Alows the use of only private keys for connection (i.e. certs not needed).

Add APIs
Add unit tests
Add documentation
Add s_client/s_server support

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18185)
2023-03-28 13:49:54 -04:00
besher 8e2552b1ea Fix a potential memory leak in apps/s_server.c
Allocate memory for a new SSL session.
If any of these steps fail,
free the key memory and the tmpsess object
before returning 0 to prevent a memory leak.

Fixes: #20110

CLA: trivial

Reviewed-by: Paul Yang <kaishen.yy@antfin.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/20213)
2023-02-08 09:47:45 -05:00
Peiwei Hu 25d02f333b Fix the check of BIO_set_write_buffer_size and BIO_set_read_buffer_size
Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19819)
2022-12-05 13:04:18 +01:00
Maxim Mikityanskiy cd715b7e7f Add support for KTLS zerocopy sendfile on Linux
TLS device offload allows to perform zerocopy sendfile transmissions.
FreeBSD provides this feature by default, and Linux 5.19 introduced it
as an opt-in. Zerocopy improves the TX rate significantly, but has a
side effect: if the underlying file is changed while being transmitted,
and a TCP retransmission happens, the receiver may get a TLS record
containing both new and old data, which leads to an authentication
failure and termination of connection. This effect is the reason Linux
makes a copy on sendfile by default.

This commit adds support for TLS zerocopy sendfile on Linux disabled by
default to avoid any unlikely backward compatibility issues on Linux,
although sacrificing consistency in OpenSSL's behavior on Linux and
FreeBSD. A new option called KTLSTxZerocopySendfile is added to enable
the new zerocopy behavior on Linux. This option should be used when the
the application guarantees that the file is not modified during
transmission, or it doesn't care about breaking the connection.

The related documentation is also added in this commit. The unit test
added doesn't test the actual functionality (it would require specific
hardware and a non-local peer), but solely checks that it's possible to
set the new option flag.

Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Boris Pismenny <borisp@nvidia.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18650)
2022-11-24 13:19:37 +01:00
Todd Short b67cb09f8d Add support for compressed certificates (RFC8879)
* Compressed Certificate extension (server/client)
* Server certificates (send/receive)
* Client certificate (send/receive)

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18186)
2022-10-18 09:30:22 -04:00
Richard Levitte 5139dec255 Rename ossl_sleep calls to OSSL_sleep everywhere
Also, remove inclusions of internal/e_os.h where it seems no longer
necessary.

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/19330)
2022-10-06 08:01:09 +02:00
Jiasheng Jiang a6a2dd9f60 apps/s_server.c: Add check for OPENSSL_strdup
As the potential failure of the OPENSSL_strdup(),
it should be better to check the return value and
return error if fails.

Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>

Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18595)
2022-06-22 16:56:40 +10:00
Daniel Fiala a6d52f178c s_serve: Report an error if init-connection fails without an attempt to read.
Fixes: openssl#18047.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18154)
2022-05-06 14:57:07 +02:00
JHH20 e257d3e76f Remove duplicated #include headers
CLA: trivial

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Todd Short <todd.short@me.com>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18220)
2022-05-04 13:46:10 +10:00
Matt Caswell fecb3aae22 Update copyright year
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Release: yes
2022-05-03 13:34:51 +01:00
Dmitry Belyavskiy fba140c735 str[n]casecmp => OPENSSL_strncasecmp
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18069)
2022-04-22 11:34:41 +02:00