4135 Commits

Author	SHA1	Message	Date
openssl-machine	e9d98629ed	Copyright year updates ... Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes	2025-07-01 12:04:53 +00:00
Neil Horman	49ad74a484	Fix exit code for s_time when -new command line switch specified ... When operating with the -new switch in apps/openssl s_time, we neglect to set the exit code properly, and so the app exits with a code of 1 rather than 0 as expected Fixes #27856 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/27857) (cherry picked from commit b6ff559853)	2025-06-20 15:44:13 -04:00
Dr. David von Oheimb	56d12310d4	apps/x509.c: re-add ERR queue printing on errors ... Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27739) (cherry picked from commit ac85974bc3)	2025-06-04 17:45:03 +02:00
Viktor Dukhovni	1d4260c1a9	Split arguments taking quotes into account ... CA.pl supports interpolating multiple arguments into the executed commands. Previously these were evaluated by a shell, which supported quoting of values that contain whitespace, backslashes, ... With a shell no longer used (avoid command injection), backwards compatibility requires some similar functionality. The code now handles double and single-quoted strings (shell-style word splitting), but not parameter expansion ($foo remains unexpanded) or command substitution (`cmd` and $(cmd) remain unexpanded). On Windows system(@LIST) does not correctly preserve argv, do our own quoting instead and use system(<$quoted_cmd>). Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27432) (cherry picked from commit 287bbb28b0)	2025-06-04 17:34:46 +02:00
Viktor Dukhovni	bdb9184aa6	Avoid shell commandline processing in CA.pl ... The CA.pl script used to build single-string string commandlines to pass to a shell via `system(command_string)`. That was fragile and not a best practice. This PR replaces `system(command_string)` with `system { executable } @argv`, which avoids the shell whenever possible (at least Unix-like systems and Windows). The only question mark is whether some sort of quoting is needed for VMS to preserve the case of commandline arguments even when processes are spawned directly, rather than via the shell. Unfortunately, given the way that some environment variables and command-line options are used to construct the commands to run, the result is still brittle. The CA.pl utility really should be replaced with something better. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27432) (cherry picked from commit 0b1bdef38e)	2025-06-04 17:34:45 +02:00
AntonMoryakov	c4019b581d	apps: lib: Prevent potential NULL dereference in init_client() ... apps: lib: Simplify ba_ret handling in init_client() Simplify logic around ba_ret assignment: - Fail early if ba_ret == NULL - Assign directly otherwise, without checking *ba_ret This avoids extra nesting and matches OpenSSL's conventions. CLA: trivial Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com> Co-authored-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26783) (cherry picked from commit 3161f460fa)	2025-05-29 16:38:40 +02:00
JiashengJiang	c8cf313d89	apps/pkeyutl.c: Add OPENSSL_free() to avoid a memory leak ... If EVP_PKEY_CTX_ctrl_str() fails, the code jumps to 'end' label without freeing passwd, causing a memory leak. Fixes: 9d1bf5f7de ("Add option to read pkeyopts interactively") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27470) (cherry picked from commit 0dc6ea55a1)	2025-05-27 19:47:53 +02:00
Dmitriy Denisov	037ac5ca86	The condition that is never checked has been removed. ... If criterion == OSSL_STORE_SEARCH_BY_KEY_FINGERPRINT, the criterion !=0 condition will be triggered. Found by Linux Verification Center (linuxtesting.org) with SVACE. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27607) (cherry picked from commit 00480f1def)	2025-05-19 16:27:23 +02:00
Dr. David von Oheimb	507015297f	APPS/cmp.c: fix char encoding of subject, issuer, sender, and recipient DN ... Fixes #27572 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27592) (cherry picked from commit 35e431ed6d)	2025-05-13 14:09:21 +02:00
Malcolm Hogan	3adda70659	Remove DAYS argument ... This commit removes DAYS from certificate requests to avoid the warning 'Ignoring -days without -x509; not generating a certificate' This argument is not needed with the -new argument. Additionally makes sure $1 is handled when -nodes is not given. Preventing an uninitialized value error when the DAYS argument is removed. Fixes #26595 CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/27277) (cherry picked from commit d890ad2b96)	2025-04-15 15:25:44 +01:00
JiashengJiang	22e2b03a3d	apps/lib/apps.c: Add a check for OPENSSL_strdup() ... Add a check for the return value of OPENSSL_strdup() to guarantee the success of allocation, similar to the other call sites. Fixes: c7d5ea2670 ("Prepare to detect index changes in OCSP responder.") Signed-off-by: JiashengJiang <jiasheng@purdue.edu> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27172) (cherry picked from commit 930c645e6b)	2025-03-28 11:40:36 +01:00
Ankit Kekre	5fc5acb5c0	apps/cms.c, apps/ocsp.c: Added NULL pointer checks ... Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/27059) (cherry picked from commit 952d9b83b2)	2025-03-20 11:32:00 +01:00
Tomas Mraz	84b4fef8ab	apps: Escape control characters in DNs by default ... When displaying distinguished names the control characters are escaped by default. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26932) (cherry picked from commit 2411f9b662)	2025-03-03 09:11:50 +01:00
Shakti Shah	f03fe5caee	Make org.openssl.winstore: work in openssl-ts ... Fixes #26739 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26833) (cherry picked from commit c9e56da777)	2025-02-20 20:26:34 +01:00
Kim, Hyuk	c2cda0a4b8	Replace snprintf with BIO_snprintf ... Updated snprintf to BIO_snprintf for consistency with previous changes. #24008 CLA: trivial Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26749) (cherry picked from commit aa6b7ac875)	2025-02-18 16:26:28 +01:00
openssl-machine	45e2b27630	Copyright year updates ... Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes	2025-02-11 14:36:52 +00:00
Nadav Tasher	71f8af87f2	s_socket: naccept: close listening socket after accepting clients ... When `-naccept` is passed (i.e with `s_server`), the listening socket remains open while handling client, even after `naccept` is supposed to reach `0`. This is caused to to the decrementation of `naccept` and closing of the socket happening a little too late in the `do_server` function. Signed-off-by: Nadav Tasher <tashernadav@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26228) (cherry picked from commit 113c12ee8c)	2025-01-22 09:20:49 +01:00
Ingo Franzki	0ef7774243	speed: Pass IV to EVP_CipherInit_ex for -evp runs with non-AEAD ciphers ... Some (non-AEAD) ciphers require an IV to be used. Always pass a (dummy) IV when setting the key. It is ignored by ciphers that do not use an IV. Commit 607a46d003 corrected the use of AEAD ciphers, but removed the IV from being passed to EVP_CipherInit_ex() for non-AEAD ciphers. Fixes: 607a46d003 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26346) (cherry picked from commit b8028d4890)	2025-01-13 11:47:56 +01:00
Frederik Wedel-Heinen	cdc1a180b1	Fix memory leaks from missing checks of return value from sk_OPENSSL_STRING_push() ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26238) (cherry picked from commit d48874ab47)	2025-01-09 15:24:32 +01:00
Jakub Zelenka	f3381f59ac	Fix CMS encryption with key agreement when originator set ... OpenSSL currently does not support encryption with originator flag so it should fail nicely instead of segfaulting. Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26014) (cherry picked from commit 894e69e747)	2025-01-06 11:45:53 +01:00
Jakub Zelenka	2b8d7217c1	Fix originator cert leak in cms app ... Reviewed-by: Hugo Landau <hlandau@devever.net> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/26014) (cherry picked from commit 24dd635eff)	2025-01-06 11:45:51 +01:00
Dr. David von Oheimb	e26d56d219	openssl-pkeyutl.pod.in: improve description of -rawin and -digest options ... Fixes #25827 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/25913) (cherry picked from commit 3c433bbc53)	2024-11-26 22:33:31 +01:00
Mohammed Alhabib	2da9426071	apps/speed.c: Fix the benchmarking for AEAD ciphers ... Fixed the benchmarking for the evp aead interface for ccm, gcm, ocb, and siv, where decryption fails when executing `openssl speed -evp aes-128-ccm -decrypt` and `openssl speed -evp aes-128-gcm -decrypt`. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25896)	2024-11-13 17:28:25 +01:00
Tomas Mraz	05a5b9706f	speed.c: Check for 0 block size ... Although this cannot really happen check for 0 block size to avoid division by 0. Fixes Coverity 1633936 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25822) (cherry picked from commit 59f5f6c73c)	2024-10-31 13:00:45 +01:00
Tomas Mraz	06f5e493fd	speed.c: Check block size before running EVP_Cipher_loop() ... Reviewed-by: Saša Nedvědický <sashan@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/25792) (cherry picked from commit a3660729e6)	2024-10-29 09:49:39 +01:00
Bernd Edlinger	95fd497635	Fix ambiguous output of Signature Algorithms ... Signature Algorithms are printed in a SIG+HASH format. In some cases this is ambiguous like brainpool and RSA-PSS. And the name of ed25519 and ed448 must be spelled in lower case, so that the output can be used as a -sigalgs parameter value. Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25797) (cherry picked from commit f30d6ba455)	2024-10-28 05:54:31 +01:00
Dr. David von Oheimb	4b3ff44bef	replace various calls to sprintf() by BiO_snprintf() to avoid compiler warnings, e.g., on MacOS ... Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Saša Nedvědický <sashan@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25534) (cherry picked from commit 2c536c8b15)	2024-10-12 15:48:21 +02:00
David von Oheimb	4e93741bce	http_server.{c,h}: make clear that IPv4 or IPv6 is used by http_server_init() ... Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25010) (cherry picked from commit ec4b123a96)	2024-09-23 22:17:07 +02:00
David von Oheimb	1947363ad5	http_server.c: fix checks of error return code in http_server_init() ... Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25010) (cherry picked from commit 7ec5d5916b)	2024-09-23 22:17:06 +02:00
XZ-X	9985b9bede	rehash.c: handle possible null pointer returned by OPENSSL_strdup ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24980) (cherry picked from commit a5cd06f7ff)	2024-09-09 09:20:53 +02:00
Tomas Mraz	5fca53d7ba	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes	2024-09-03 14:50:21 +02:00
FdaSilvaYY	c17c57b5a7	apps: add missing entry to tls extension label list ... noticed by @sftcd Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25111) (cherry picked from commit 4688f9b821)	2024-08-21 15:43:48 +02:00
Andreas Treichel	d2a456681c	apps/cms.c, apps/smime.c: Fix -crlfeol help messages ... CLA: trivial Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24434) (cherry picked from commit 0813ffee2f)	2024-08-15 19:46:18 +02:00
Marc Brooks	77e7a47a86	Free fetched digest in show_digests ... Fixes #24892 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/25046) (cherry picked from commit 871c534d39)	2024-08-01 11:38:10 +02:00
Tomas Mraz	6b6e5163a9	Avoid leaking *ba_ret on reconnections ... Also fixes Coverity 1604639 There is no point in checking ba_ret as it can never be NULL. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24931) (cherry picked from commit 4fa9d1f40f)	2024-07-31 11:23:45 +02:00
Neil Horman	ed96c0ddfa	Fix coverity-1604665 ... Coverity issued an error in the opt_uintmax code, detecting a potential overflow on a cast to ossl_intmax_t Looks like it was just a typo, casting m from uintmax_t to ossl_intmax_t Fix it by correcting the cast to be ossl_uintmax_t, as would be expected Theres also some conditionals that seem like they should be removed, but I'll save that for later, as there may be some corner cases in which ossl_uintmax_t isn't equal in size to uintmax_t..maybe. Fixes openssl/private#567 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24897) (cherry picked from commit a753547eef)	2024-07-17 09:51:02 +02:00
Dr. David von Oheimb	14b3955e10	CMP app: fix combination of -certout and -chainout with equal filename argument ... This backports commit 5aec3f4a72 of PR #24267 to 3.2 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24696)	2024-07-06 16:22:13 +02:00
Richard Levitte	518916065b	fix: remove some odd empty lines ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24776) (cherry picked from commit cfe0bbdeca)	2024-07-03 11:24:44 +02:00
Richard Levitte	c78cca53cc	fix: openssl speed: RSA encryption is on the pubkey, not the privkey ... Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24776) (cherry picked from commit bb90a7861c)	2024-07-03 11:24:43 +02:00
Tomas Mraz	91bcb1668d	Copyright year updates ... Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes	2024-06-04 14:58:30 +02:00
Richard Levitte	54e9e254fe	VMS: Redefine _XOPEN_SOURCE_EXTENDED with the value 1 in apps/ocsp.c ... Some versions if the VMS C system header files seem to require this. Fixes #24466 on release older than 3.3. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/24471)	2024-05-29 08:58:40 +02:00
naaysayer	fbe351c8a6	apps/pkcs12: Not writing the private key file until the import password is verified ... Fixes #904 CLA: trivial Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23729) (cherry picked from commit f5462572a1)	2024-05-14 15:37:37 +02:00
Rajeev Ranjan	1fbbe1bb68	fix sending error when no root CA cert update available ... Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24169) (cherry picked from commit fc9649f61a)	2024-04-22 08:32:54 +02:00
Tomas Mraz	6cb91b331f	list_provider_info(): Fix leak on error ... Fixes #24110 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24117) (cherry picked from commit 993c2407d0)	2024-04-15 09:11:02 +02:00
Jiasheng Jiang	a1d45a4217	APPS: Add missing OPENSSL_free() and combine the error handler ... Add the OPENSSL_free() in the error handler to release the "*md_value" allocated by app_malloc(). To make the code clear and avoid possible future errors, combine the error handler in the "err" tag. Then, we only need to use "goto err" instead of releasing the memory separately. Since the EVP_MD_get_size() may return negative numbers when an error occurs, create_query() may fail to catch the error since it only considers 0 as an error code. Therefore, unifying the error codes of create_digest() from non-positive numbers to 0 is better, which also benefits future programming. Fixes: c7235be ("RFC 3161 compliant time stamp request creation, response generation and response verification.") Signed-off-by: Jiasheng Jiang <jiasheng@purdue.edu> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/23873) (cherry picked from commit beb82177dd)	2024-04-09 20:37:10 +02:00
Tom Cosgrove	f348d65b67	Fix "Error finalizing cipher loop" when running openssl speed -evp -decrypt ... When using CCM, openssl speed uses the loop function EVP_Update_loop_ccm() which sets a (fake) tag when decrypting. When using -aead (which benchmarks a different sequence than normal, to be comparable to TLS operation), the loop function EVP_Update_loop_aead() is used, which also sets a tag when decrypting. However, when using defaults, the loop function EVP_Update_loop() is used, which does not set a tag on decryption, leading to "Error finalizing cipher loop". To fix this, set a fake tag value if we're doing decryption on an AEAD cipher in EVP_Update_loop(). We don't check the return value: this shouldn't really be able to fail, and if it does, the following EVP_DecryptUpdate() is almost certain to fail, so that can catch it. The decryption is certain to fail (well, almost certain, but with a very low probability of success), but this is no worse than at present. This minimal change means that future benchmarking data should be comparable to previous benchmarking data. (This is benchmarking code: don't write real apps like this!) Fixes #23657 Change-Id: Id581cf30503c1eb766464e315b1f33914040dcf7 Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23757) (cherry picked from commit b3be6cc89e)	2024-04-09 20:28:11 +02:00
Bernd Edlinger	38c5f2c169	Fix openssl req with -addext subjectAltName=dirName ... The syntax check of the -addext fails because the X509V3_CTX is used to lookup the referenced section, but the wrong configuration file is used, where only a default section with all passed in -addext lines is available. Thus it was not possible to use the subjectAltName=dirName:section as an -addext parameter. Probably other extensions as well. This change affects only the syntax check, the real extension was already created with correct parameters. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23669) (cherry picked from commit 387418893e)	2024-04-02 17:36:03 +02:00
Viliam Lejčík	b2731c08b9	Add NULL check before accessing PKCS7 encrypted algorithm ... Printing content of an invalid test certificate causes application crash, because of NULL dereference: user@user:~/openssl$ openssl pkcs12 -in test/recipes/80-test_pkcs12_data/bad2.p12 -passin pass: -info MAC: sha256, Iteration 2048 MAC length: 32, salt length: 8 PKCS7 Encrypted data: Segmentation fault (core dumped) Added test cases for pkcs12 bad certificates Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23632) (cherry picked from commit a4cbffcd89)	2024-03-25 18:27:09 +01:00
Tomas Mraz	52bdbb8dac	apps/x509.c: No warning reading from stdin if redirected ... Fixes #22893 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23526) (cherry picked from commit 5c846d32d4)	2024-03-15 09:08:19 +01:00
MrRurikov	02e122c51b	s_cb.c: Add missing return value checks ... Return value of function 'SSL_CTX_ctrl', that is called from SSL_CTX_set1_verify_cert_store() and SSL_CTX_set1_chain_cert_store(), is not checked, but it is usually checked for this function. CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23647) (cherry picked from commit 6f794b461c)	2024-02-22 12:45:46 +01:00