4307 Commits

Author	SHA1	Message	Date
Norbert Pocs	af2aaf3271	Deprecate ASN1_METH internal usage ... Some of them are needed and were kept by adding `#include "internal/deprecated"` and some had to be turned off. Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27727)	2025-07-17 11:25:18 -04:00
Norbert Pocs	91d34f408c	openssl: Add option to init sec mem at startup ... Adding env variables OPENSSL_SEC_MEM and OPENSSL_SEC_MEM_MINSIZE, which initializes the secure memory at the beginning of the openssl app. Resolves: https://github.com/openssl/project/issues/786 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/28036)	2025-07-16 08:23:38 -04:00
Tomas Mraz	c62cd07d14	apps: Silence warnings on Win64 builds ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27806)	2025-07-02 17:26:26 +02:00
Tomas Mraz	bb86c43fa8	libapps + libcrypto: Silence warnings on Win64 builds ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27806)	2025-07-02 17:26:26 +02:00
Chris	2d978786f3	Remove accidentally left debug statements from ec.c ... CLA: trivial - Cleaned up hardcoded debug statements that were inadvertently left in the open source distribution - No functional changes to the EC key processing logic Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27921)	2025-07-01 20:51:23 +02:00
Jiasheng Jiang	b2e7c4e2ba	apps/openssl.c: Add OPENSSL_free() to avoid memory leak ... Add OPENSSL_free() to release trace_data if trace_data is not NULL but other errors occur to avoid memory leak. Fixes: 682b444f8a ("apps/openssl.c: Adapt to enable tracing output") Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27911)	2025-07-01 20:48:11 +02:00
Jiasheng Jiang	2fccd17e8f	apps/lib/apps.c: Add check for BIO_new() ... Add checks for the return value of BIO_new() to guarantee successful allocation, consistent with other usages. Fixes: a412b89 ("dup_bio_* and bio_open_* are utility functions and belong in apps.c") Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27894)	2025-07-01 19:31:54 +02:00
Jakub Zelenka	f3867bb25b	Introduce cms kekcipher option to select cipher for pwri ... This is useful for AEAD ciphers where it is not possible to use AEAD cipher (currently only AES GCM supported) for password recipient info because the same cipher is used for encrypting the password and it is not possible to store tag for this purpose so different cipher (e.g. AES CBC) needs to be selected. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26871)	2025-07-01 19:04:53 +02:00
Ingo Franzki	7bdc0d13d2	speed: Increase MAX_SIG_NUM and fix its usage in loopargs_t fields ... Increase the maximum number of signature algorithms. With the introduction of the SignMessage and VerifyMessage API with OpenSSL 3.4 the providers that support combined digest and sign algorithms register quite a lot more signature algorithms, so the current limit of 111 is hit easily. While at it correct the definitions of the signature fields within the loopargs_t structure to use MAX_SIG_NUM instead of MAX_KEM_NUM. Closes: https://github.com/openssl/openssl/issues/27873 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27878)	2025-06-26 07:52:45 -04:00
Neil Horman	b6ff559853	Fix exit code for s_time when -new command line switch specified ... When operating with the -new switch in apps/openssl s_time, we neglect to set the exit code properly, and so the app exits with a code of 1 rather than 0 as expected Fixes #27856 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27857)	2025-06-20 14:56:44 -04:00
Bartel Artem	a4c5096d16	genpkey.c: Fix filename copy & paste bug in error output ... Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27789)	2025-06-10 19:55:03 +02:00
Dr. David von Oheimb	ac85974bc3	apps/x509.c: re-add ERR queue printing on errors ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27739)	2025-06-04 17:37:33 +02:00
Viktor Dukhovni	287bbb28b0	Split arguments taking quotes into account ... CA.pl supports interpolating multiple arguments into the executed commands. Previously these were evaluated by a shell, which supported quoting of values that contain whitespace, backslashes, ... With a shell no longer used (avoid command injection), backwards compatibility requires some similar functionality. The code now handles double and single-quoted strings (shell-style word splitting), but not parameter expansion ($foo remains unexpanded) or command substitution (`cmd` and $(cmd) remain unexpanded). On Windows system(@LIST) does not correctly preserve argv, do our own quoting instead and use system(<$quoted_cmd>). Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27432)	2025-06-04 17:33:48 +02:00
Viktor Dukhovni	0b1bdef38e	Avoid shell commandline processing in CA.pl ... The CA.pl script used to build single-string string commandlines to pass to a shell via `system(command_string)`. That was fragile and not a best practice. This PR replaces `system(command_string)` with `system { executable } @argv`, which avoids the shell whenever possible (at least Unix-like systems and Windows). The only question mark is whether some sort of quoting is needed for VMS to preserve the case of commandline arguments even when processes are spawned directly, rather than via the shell. Unfortunately, given the way that some environment variables and command-line options are used to construct the commands to run, the result is still brittle. The CA.pl utility really should be replaced with something better. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27432)	2025-06-04 17:33:48 +02:00
AntonMoryakov	3161f460fa	apps: lib: Prevent potential NULL dereference in init_client() ... apps: lib: Simplify ba_ret handling in init_client() Simplify logic around ba_ret assignment: - Fail early if ba_ret == NULL - Assign directly otherwise, without checking *ba_ret This avoids extra nesting and matches OpenSSL's conventions. CLA: trivial Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com> Co-authored-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26783)	2025-05-29 16:37:41 +02:00
JiashengJiang	e0ae801728	apps/cmp.c: Free bio on error to avoid memory leak ... Call BIO_free() to release bio if ASN1_i2d_bio_of() fails, preventing a memory leak. Fixes: 6a3579e190 ("CMP: add support for requesting cert template using genm/genp") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27647)	2025-05-27 19:51:55 +02:00
JiashengJiang	0dc6ea55a1	apps/pkeyutl.c: Add OPENSSL_free() to avoid a memory leak ... If EVP_PKEY_CTX_ctrl_str() fails, the code jumps to 'end' label without freeing passwd, causing a memory leak. Fixes: 9d1bf5f7de ("Add option to read pkeyopts interactively") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27470)	2025-05-27 19:47:17 +02:00
Tomas Mraz	0eb9acc24f	apps/x509.c: Fix the -addreject option adding trust instead of rejection ... Fixes CVE-2025-4575 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27672)	2025-05-22 09:49:18 +02:00
Dmitriy Denisov	00480f1def	The condition that is never checked has been removed. ... If criterion == OSSL_STORE_SEARCH_BY_KEY_FINGERPRINT, the criterion !=0 condition will be triggered. Found by Linux Verification Center (linuxtesting.org) with SVACE. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27607)	2025-05-19 16:26:14 +02:00
Norbert Pocs	6a6a098bf1	apps/prime.c: Remove unused assignment ... The variable is never read after the assignment. Coverity issue: 1646789 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27636)	2025-05-19 16:23:54 +02:00
Norbert Pocs	0d3f0876ac	prime.c: Remove uneeded if check for NULL value ... This was reported by coverity scan issue 1646789 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27623)	2025-05-15 15:38:10 -04:00
Norbert Pocs	7cc69ec4cf	configutl.c: Resolve possible resource leak of config file ... The coverity detects Resource leak here. It may come to leak when the option is passed multiple times. Resolve coverity scan issue 1646846 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27623)	2025-05-15 15:38:10 -04:00
Norbert Pocs	677ded7547	configutl.c: Remove dead code ... Resolve coverity issue 1646848, 1646847 Signed-off-by: Norbert Pocs <norbertp@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27623)	2025-05-15 15:38:10 -04:00
Jeremy Doupe	dca67c0aa1	APPS/x509: add -multi option for outputting all certs found in input ... Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27340)	2025-05-14 12:51:42 +02:00
Dr. David von Oheimb	88777599a6	apps/cms.c: add failure handling for I/O errors of 'BIO_printf(out, ...)' ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27368)	2025-05-14 08:43:21 +02:00
Dr. David von Oheimb	c3da4b584e	apps/cms.c: clarify treatment of 'ret' variable in cms_main() ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27368)	2025-05-14 08:43:20 +02:00
Dr. David von Oheimb	98b6df79fb	apps/cms.c: remove needless ERR_print_errors() calls ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27368)	2025-05-14 08:43:20 +02:00
Dr. David von Oheimb	cc7084a5ee	apps/cms.c: add missing error messages in various error cases ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27368)	2025-05-14 08:43:20 +02:00
Dr. David von Oheimb	1beaf112e5	apps/cms.c: add missing error message on error writing CMS output (ret == 6) ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27368)	2025-05-14 08:43:20 +02:00
Dr. David von Oheimb	35e431ed6d	APPS/cmp.c: fix char encoding of subject, issuer, sender, and recipient DN ... Fixes #27572 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27592)	2025-05-13 14:08:50 +02:00
Dmitry Belyavskiy	78ca45cef0	Utility for dumping OpenSSL config file ... Based on @neverpanic code` Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27290)	2025-05-08 11:05:42 +10:00
Tomas Mraz	3847b4920a	apps/prime.c: Remove dead code ... Fixes Coverity 1646773 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27524)	2025-05-02 13:39:41 +02:00
Tomas Mraz	573db12079	apps/prime.c: Fix memory leak of a BIGNUM ... Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27521)	2025-04-29 11:59:29 +02:00
zriback	d6dc0f1cac	Update to use BIO_get_line() with support for multiple primes per in file ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26549)	2025-04-29 14:17:06 +10:00
zriback	585a1e6f8b	Address and add tests for edge cases involving short or empty files ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26549)	2025-04-29 14:17:06 +10:00
zriback	f15a2a43ef	Fix issue where file is not read correctly with Windows line endings ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26549)	2025-04-29 14:17:06 +10:00
zriback	0b7a16fe09	Add 20-test_prime unit test ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26549)	2025-04-29 14:17:06 +10:00
zriback	d18526cb94	Add -in option to prime function to allow input from file for primality testing. Update -hex option documentation to reflect use with input and output. ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26549)	2025-04-29 14:17:06 +10:00
Richard Levitte	9123684c81	Add verbose output to 'openssl list -store-loaders' ... The provider based STORE loaders do have settable parameters, so they should be displayed when '-verbose' is given, just like for any other list. Out of necessity, this also introduces OSSL_STORE_LOADER_settable_ctx_params() Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26437)	2025-04-28 17:19:55 +02:00
Dr. David von Oheimb	1c1c9dc11b	app/s_client.c: clean up and broaden use of ERR_print_errors() ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27492)	2025-04-26 21:39:58 +02:00
Viktor Dukhovni	f492649b99	Fix default pkey(1) DER output ... This is expected to be PKCS#8, but was defaulting to traditional when possible. Changed default DER output format to PKCS#8 and extended the `-traditional` option to apply also to DER output. Fixes: #21708 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27273)	2025-04-24 21:12:49 +10:00
Pauli	fad8c04ded	commands: fix parameter value output ... The parameter value output library routine was incorrect. It used the incorrect length when printing fetched parameter sizes. It also printed a string which was potentially not zero terminated. Both of these are addressed here. Additionally, octet strings have their initial bytes printed in hex. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27221)	2025-04-18 15:23:42 +01:00
Malcolm Hogan	d890ad2b96	Remove DAYS argument ... This commit removes DAYS from certificate requests to avoid the warning 'Ignoring -days without -x509; not generating a certificate' This argument is not needed with the -new argument. Additionally makes sure $1 is handled when -nodes is not given. Preventing an uninitialized value error when the DAYS argument is removed. Fixes #26595 CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/27277)	2025-04-15 15:22:54 +01:00
fangming.fang	86408fa8de	Implement interleaving aes-cbc-hmac-sha on aarch64 ... This is to implement #19932, it adds enc-then-mac aes-cbc-hmac-sha1/256, aes-cbc and hmac-sha1/256 are interleaved to achieve better performance. It only supports non-padding mode that means the length of input data should be multiple of 16 bytes. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/22949)	2025-04-14 14:53:30 +01:00
Matt Caswell	3f0f723b52	Fix a segfault in the pkeyutl command line app ... Don't attempt to deref a pkey that is NULL Fixes #27156 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27228)	2025-04-02 17:28:29 +02:00
JiashengJiang	930c645e6b	apps/lib/apps.c: Add a check for OPENSSL_strdup() ... Add a check for the return value of OPENSSL_strdup() to guarantee the success of allocation, similar to the other call sites. Fixes: c7d5ea2670 ("Prepare to detect index changes in OCSP responder.") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27172)	2025-03-28 11:40:02 +01:00
Viktor Dukhovni	60f2a71400	Fix goto label indents to match style ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27175)	2025-03-28 11:37:12 +01:00
Viktor Dukhovni	aeb797594b	Report s_client chain cert pkey alg correctly ... In particular provided keys are also supported, and for EC keys we report the group rather than the bit count. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27131)	2025-03-27 10:40:29 +01:00
Viktor Dukhovni	dc246cec87	In s_client report 'long' certificate sigalg name ... This matches the sigalg output format of X509_signature_print(3). Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27130)	2025-03-26 15:23:04 +01:00
Viktor Dukhovni	681528cbc4	Report IANA sigalg name in s_client ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27128)	2025-03-25 20:06:19 +01:00