aboutsummaryrefslogtreecommitdiffstats
path: root/apps
Commit message (Collapse)AuthorAgeFilesLines
* apps: drop invalid trust setting in check_cert_might_be_valid()Jakub Zelenka2026-07-271-1/+0
| | | | | | | | | | | | | | | | | | | | | | check_cert_might_be_valid() called X509_VERIFY_PARAM_set_trust() with X509_TRUST_OK_ANY_EKU, which is a trust_flags bit (1 << 4), not a valid trust id (1..8). The call therefore failed with X509_R_INVALID_TRUST and left that error on the error stack, which was then printed via ERR_print_errors() for every certificate loaded by the x509 app, even on success. The intended liberal behavior is already provided by X509_PURPOSE_ANY and by suppressing X509_V_ERR_CERT_REJECTED, so just remove the bogus call. Add a test checking that printing certificate info emits nothing on stderr. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Ryan Hooper <[email protected]> MergeDate: Mon Jul 27 11:50:39 2026 (Merged from https://github.com/openssl/openssl/pull/31968)
* apps: fail skeyutl -genkey on bad -skeyoptJakub Zelenka2026-07-271-0/+3
| | | | | | | | | | | | | | | | | | | | app_params_new_from_opts() returns NULL when a key option cannot be converted, either because the key management does not settle the parameter or because the opt:value separator is missing. skeyutl ignored that and generated the key without the requested options, only printing the parameter error to stderr and still exiting successfully. Bail out instead, the way the mac, kdf and enc applications do. A NULL return is only an error when key options were actually given, as app_params_new_from_opts() also returns NULL for an empty option list. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> MergeDate: Mon Jul 27 09:06:03 2026 (Merged from https://github.com/openssl/openssl/pull/32036)
* apps: decode DTLSv1.2 records in s_client/s_server -msg outputJakub Zelenka2026-07-201-1/+5
| | | | | | | | | | | | | | | | | | | | The msg_cb message callback used by the -msg option only recognised DTLSv1.0 among the DTLS versions, so DTLSv1.2 records were logged as "Not TLS data or unknown version" instead of being decoded. Add DTLS1_2_VERSION to the recognised version check and to the ssl_versions lookup table, and wrap the now-overlong condition. Add a test that runs s_client against s_server over TLSv1.2, TLSv1.3 and DTLSv1.2, logging the protocol messages via -msg, and checks that every record is decoded (no "Not TLS data or unknown version" lines). Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tim Hudson <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> MergeDate: Mon Jul 20 09:09:07 2026 (Merged from https://github.com/openssl/openssl/pull/31994)
* Convert internal use of ASN1_STRING_set and ASN1_STRING_lengthBob Beck2026-07-1810-45/+63
| | | | | | | | | | | | | | to use their non-deprecated replacements. For "pretty-printing" applications and test code that use a length and require an int, size_t lengths are simply cast to an int. For writes and protocol level things size_t lengths are checked against INT_MAX and take the error path if the returned value is too large to be used for a funciton that takes an integer length. Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Sat Jul 18 13:01:19 2026 (Merged from https://github.com/openssl/openssl/pull/31194)
* Fix dsaparams decoding from DER filesNeil Horman2026-07-161-10/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The tests addded in commit d8a7e8e uncovered an odd error case. https://github.com/openssl/openssl/actions/runs/29303845665/job/86993085732 Is failing when attempting to read in a der file converting from a corresponding PEM file containing DSA parameters. Interestingly The problem was only occuring when: 1) The input was a DER file and 2) Blake2 was not configured Doing some tracing of the decoder operation showed that this is occuring because the OSSL_STORE lookup used to find the proper decoder uses a "first successful decode wins" approach, after which the loading code checks to see if the decoded type matches the expected key type. When decoding PEM, this isn't a problem, as the PEM armoring gives the decoder a hint as to why type of data the input file is. But with DER, there is no such hint, and we're at the mercy of whichever decoder happens to decode the data correctly first. Normally it works just fine, but when features are disabled or enabled, the order in which the decoders are attempted may change, affecting the outcome. In this particular case, disabling blake2 caused the DHX decoder to be attempted first, which decodes the input der file without issue. That in turn caused the subsequent EVP_PKEY_is_a check to fail (as we were expecting a DSA key), and so the test fails. Fortunately, the code that the dsaparam applet uses to do this decode provides a keytype hint, which we can use to guide the decode process. keep the old store lookup method around in case anyone doesn't pass a uri that is a file path or provide a keytype, but if we do both those things, we can use OSSL_DECODER_CTX_new_for_pkey to specifically tell the decoder that we want to decode the input data as the expected type (in this case a DSA key). Fixes #31944 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Tim Hudson <[email protected]> MergeDate: Thu Jul 16 15:28:32 2026 (Merged from https://github.com/openssl/openssl/pull/31954)
* EC: make the group the single source of the point conversion formViktor Dukhovni2026-07-103-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The point conversion form (compressed, uncompressed, or hybrid) was kept both on the key and on the group, and the two could disagree -- a key imported as compressed could re-encode as uncompressed. The group is now the single source of truth: encoding, parameter output, and the legacy lookup all read it from the group, and decoding (PEM, DER, or raw parameters) records it there, so the form round-trips faithfully. Generated keys are always uncompressed; the point-format option at key generation is now a documented no-op (it had had no effect for several releases), and the unused form field on the keygen context is dropped. Imported keys still keep their form, and the deprecated EC_KEY_get_conv_form()/EC_KEY_set_conv_form() still work. EVP_PKEY_fromdata() and openssl pkey -text now report the form a loaded EC key actually has, and re-encoding via PEM or DER preserves it. Docs drop a stale note about a compile-time macro for compressed points on binary curves, and the EC tests now exercise both the affine and the compressed/hybrid binary formats unconditionally (fixing a latent bug in the compressed/hybrid form tests that were never exercised by CI). Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> MergeDate: Fri Jul 10 09:21:29 2026 (Merged from https://github.com/openssl/openssl/pull/30940)
* Fix doubled semicolons as statement terminationsDimitri Papadopoulos2026-07-081-4/+0
| | | | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Kurt Roeckx <[email protected]> Reviewed-by: Paul Dale <[email protected]> MergeDate: Wed Jul 8 18:03:29 2026 (Merged from https://github.com/openssl/openssl/pull/31877)
* Fix typosDimitri Papadopoulos2026-07-081-1/+1
| | | | | | | | | | | | | | | | Found by typos[1]. [1] https://github.com/crate-ci/typos CLA: trivial Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tim Hudson <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jul 8 10:46:01 2026 (Merged from https://github.com/openssl/openssl/pull/31858)
* Eliminate unnecessary whitespace before a quoted newlineDimitri Papadopoulos2026-07-081-1/+1
| | | | | | | | | | | Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Kurt Roeckx <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jul 8 10:11:22 2026 (Merged from https://github.com/openssl/openssl/pull/31860)
* Remove parentheses around return argumentsDimitri Papadopoulos2026-07-081-1/+1
| | | | | | | | | | | | | | Since return is an operator and not a function, parentheses are not required. Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Kurt Roeckx <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jul 8 10:11:13 2026 (Merged from https://github.com/openssl/openssl/pull/31860)
* Eliminate/fix repeated word usageDimitri Papadopoulos2026-07-081-1/+1
| | | | | | | | | | | Found by running the checkpatch.pl Linux script to enforce coding style. Reviewed-by: Kurt Roeckx <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jul 8 10:11:11 2026 (Merged from https://github.com/openssl/openssl/pull/31860)
* apps/ocsp.c: guard index_changed() with OPENSSL_NO_POSIX_IO, not HTTP_DAEMONolszomal2026-07-081-3/+7
| | | | | | | | | | | | | Replace #ifdef HTTP_DAEMON with #ifndef OPENSSL_NO_POSIX_IO for code that only requires POSIX {,f}stat(), improving portability. Retain syslog() call only when HTTP_DAEMON is defined, use BIO_printf(bio_err) otherwise. Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jul 8 09:47:43 2026 (Merged from https://github.com/openssl/openssl/pull/28172)
* apps: adjust stat usage to account for uplinkolszomal2026-07-081-5/+12
| | | | | | | | | | | | | Call stat() instead of fstat() when the FILE pointer provided by BIO_get_fp() is unavailable (as it may be the case in case of UPLINK builds). Signed-off-by: olszomal <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jul 8 09:47:42 2026 (Merged from https://github.com/openssl/openssl/pull/28172)
* Add -n option to openssl-rand to not output the trailing newlineEvy Garden2026-07-021-2/+7
| | | | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Thu Jul 2 10:59:26 2026 (Merged from https://github.com/openssl/openssl/pull/31795)
* s_client: skip TCP shutdown drain for datagram protocolsMichał Trojnara2026-07-011-23/+26
| | | | | | | | | | | | | | | | | The shutdown-side drain uses a TCP half-close and a fixed 500 ms select() timeout to let peers consume buffered alerts before close. Running it for DTLS/QUIC datagram connections causes an unnecessary delay after the connection has otherwise completed. Limit this workaround to non-DTLS, non-QUIC connections. CLA: trivial Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jul 1 13:35:53 2026 (Merged from https://github.com/openssl/openssl/pull/31558)
* apps/s_server.c: fix SSL object leak on rpk_enable() failureMounir IDRASSI2026-07-011-0/+2
| | | | | | | | | | | | | | | | | | | | | | | In www_body() and rev_body(), con = SSL_new(ctx) is called before rpk_enable(con), but ownership of con is transferred to ssl_bio only later by BIO_set_ssl(..., BIO_CLOSE). If rpk_enable() fails, the code jumps to err: before that transfer without freeing con, leaking the SSL object. Add SSL_free(con) before goto err in both rpk_enable() failure paths, matching the adjacent SSL_set_session_id_context() and BIO_new_socket() error paths. sv_body() is unaffected because its err: block already frees con. The global rpk_files is not leaked. Its lifetime is managed by s_server_main(), which frees it in the end cleanup block. Resolves: https://github.com/openssl/openssl/issues/31769 Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jul 1 12:04:13 2026 (Merged from https://github.com/openssl/openssl/pull/31789)
* SSL_OP_SECOP is dead codeBob Beck2026-06-301-4/+0
| | | | | | | | | | | | Nothing set the "vfy" parameters in any of these functions to anything but 0. Remove the parameter and stage things related to SSL_OP_SECOP to go away in the future. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Tue Jun 30 10:47:07 2026 (Merged from https://github.com/openssl/openssl/pull/31271)
* Drop Windows CE support.Bob Beck2026-06-252-6/+0
| | | | | | | | | | | | | | | | | | Windows CE has been out of mainstream support since 2018 and will not have a modern toolchain capable of compiling a modern OpenSSL. The vc_wince_info Perl helper, the crypto/LPdir_wince.c directory backend, and a long tail of _WIN32_WCE / OPENSSL_SYS_WINCE guards across the Windows code paths get removed. Spotted by idrassi. Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Thu Jun 25 07:27:18 2026 (Merged from https://github.com/openssl/openssl/pull/31601)
* apps/lib/s_cb.c: actualise signature_tls13_scheme_listEugene Syromiatnikov2026-06-231-1/+51
| | | | | | | | | | | | | | | | | | Update signature_tls13_scheme_list array in accordance with the current state of the "TLS SignatureScheme" table at [1]; leave TLS 1.2 GOST definitions be for now. Note: these are used only for debugging output when -security_debug option is provided to s_client/s_server commands. [1] https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-signaturescheme Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Tue Jun 23 16:30:02 2026 (Merged from https://github.com/openssl/openssl/pull/31248)
* fix type casting in ossl_cmp_mock_srv_set1 functionsNeil Horman2026-06-181-14/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | newer versions of clang trigger ubsan warnings on the following functions: ossl_cmp_mock_srv_set1_refCert ossl_cmp_mock_srv_set1_chainOut ossl_cmp_mock_srv_set1_certOut ossl_cmp_mock_srv_set1_newWithNew ossl_cmp_mock_srv_set1_newWithOld ossl_cmp_mock_srv_set1_oldWithNew ossl_cmp_mock_srv_set1_caPubsOut Due to the fact that the respective function prototypes don't match the callback function pointer prototypes (the former use concrete strucuture types while the latter uses a void pointer). Fix it by bifurcating setup_cert[s] (the call-in fuctions) to have variants that accept the expected type and corresponding callback signature so that the above functions can be used without thunking Fixes openssl/project#1969 Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Thu Jun 18 14:03:41 2026 (Merged from https://github.com/openssl/openssl/pull/31526)
* Fix s_client Sieve STARTTLS response parsingMounir IDRASSI2026-06-171-4/+2
| | | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Wed Jun 17 16:22:20 2026 (Merged from https://github.com/openssl/openssl/pull/31468)
* Use %zu for printing size_t valuesAndrew Dinh2026-06-152-4/+4
| | | | | | | | Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Milan Broz <[email protected]> MergeDate: Mon Jun 15 19:24:43 2026 (Merged from https://github.com/openssl/openssl/pull/31454)
* apps/dgst: avoid EXIT_* helper returns and format changesJohn Claus2026-06-151-16/+22
| | | | | | | | | Return plain status codes from helper paths instead of EXIT_* and apply formatting updates to keep style consistent. Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> MergeDate: Mon Jun 15 14:32:31 2026 (Merged from https://github.com/openssl/openssl/pull/30563)
* apps/lib/apps.c: free retdb before return on OPENSSL_strdup() failureXZ-X2026-06-151-1/+7
| | | | | | | | | | Fixes: c7d5ea2670c2 "Prepare to detect index changes in OCSP responder." Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Mon Jun 15 14:29:23 2026 (Merged from https://github.com/openssl/openssl/pull/24981)
* Fix duplicate CAstore option in s_time appJakub Zelenka2026-06-151-1/+0
| | | | | | | | | This fixes regression introduced in d260311c53a0d Reviewed-by: Tom Cosgrove <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 15 13:53:40 2026 (Merged from https://github.com/openssl/openssl/pull/31192)
* Test s_time with new -testmode optionJakub Zelenka2026-06-151-6/+14
| | | | | | | | | | | | | Adds -testmode to s_time, mirroring the option in openssl speed. It bypasses the -time window and runs a minimal number of iterations (1 for new connections, 2 for session reuse). Adds test_stime covering the new, reuse, and TLSv1.2/TLSv1.3 paths. Reviewed-by: Tom Cosgrove <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 15 13:53:39 2026 (Merged from https://github.com/openssl/openssl/pull/31192)
* CMP: Optionally accept missing or non-matching transactionID or recipNonce ↵Dr. David von Oheimb2026-06-111-0/+10
| | | | | | | | | | | | | | | values This is done for error messages received if OSSL_CMP_OPT_NONMATCHED_ERROR_NONCES is set or the respective -nonmatched_error_nonces CLI option is given. Can be helpful when the server (or other peer) cannot provide a proper error message header, for instance if was unable to parse the ASN.1 encoding of a request message. Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Thu Jun 11 14:56:49 2026 (Merged from https://github.com/openssl/openssl/pull/29043)
* apps/cmp.c: fix use of SSL_set_tlsext_host_name() for SNI and ↵Dr. David von Oheimb2026-06-103-29/+67
| | | | | | | | | X509_VERIFY_PARAM_set1_host() Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jun 10 06:27:00 2026 (Merged from https://github.com/openssl/openssl/pull/27357)
* apps/s_client.c: read one byte less to avoid triggerring overflow protectionEugene Syromiatnikov2026-06-081-2/+2
| | | | | | | | | | | | | | | | | Commit e0e276b50a1e "Fix a one byte buffer overflow in s_client" added a check for the buffer size before adding a terminating \0, which led to full reads of BUFSIZZ resulting in session termination. Avoid that by requesting one byte less. Co-Autherd-by: Tomas Mraz <[email protected]> Resolves: https://github.com/openssl/openssl/issues/30925 Fixes: e0e276b50a1e "Fix a one byte buffer overflow in s_client" Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 09:12:53 2026 (Merged from https://github.com/openssl/openssl/pull/31413)
* Remove unused crl_dir setting from config filesTeddy Engel2026-06-032-2/+0
| | | | | | | | | | | | | | | | | The crl_dir setting in CA_default section is not used anywhere. Remove it from the example config and test configs, update the VMSify-conf.pl path conversion script to no longer reference it, and regenerate openssl-vms.cnf. Fixes #31103 CLA: trivial Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> MergeDate: Wed Jun 3 11:37:02 2026 (Merged from https://github.com/openssl/openssl/pull/31215)
* Fix broken hex data by reformattingNorbert Pocs2026-06-032-5803/+585
| | | | | | | | | | | | | | | | The clang format broke some data in hexadecimal format. To make the tool obedient, the trailing comma needs to be removed, then it interpretes the data differently and therefore does not reformat it. The format can then be changed to the correct form. Fixes: https://github.com/openssl/project/issues/1959 Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jun 3 07:46:14 2026 (Merged from https://github.com/openssl/openssl/pull/31350)
* apps: fix printf formats according to param typesHerman Semenoff2026-06-015-10/+12
| | | | | | | | | | | | inttypes.h is also used for more accurate compatibility with all platforms, as it is the more correct choice according to C standard. Signed-off-by: Herman Semenoff <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Mon Jun 1 06:58:23 2026 (Merged from https://github.com/openssl/openssl/pull/30969)
* apps/*.c,doc/man1/*.pod.in: fix doc and error output of cert_store vs. ↵Dr. David von Oheimb2026-06-0111-50/+73
| | | | | | | | | chain_store/verify_store and PEM format Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Mon Jun 1 04:57:15 2026 (Merged from https://github.com/openssl/openssl/pull/25683)
* apps/rehash.c: reading cert/CRL from PEM file gets no more confused by any ↵Dr. David von Oheimb2026-06-011-9/+17
| | | | | | | | | included private keys Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Mon Jun 1 04:57:09 2026 (Merged from https://github.com/openssl/openssl/pull/25683)
* fix cmp mock server to not depend on NUL bytes in ASN1_STRINGBob Beck2026-05-201-1/+3
| | | | | | | | | | | | | ASN1_STRING is documented that the behavior of NUL byte addition should not be depended upon. The mock server calls strcmp on the bare data from an ASN1_STRING. This only works if the data is NUL terminated. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: David von Oheimb <[email protected]> MergeDate: Wed May 20 16:01:47 2026 (Merged from https://github.com/openssl/openssl/pull/31202)
* Fix app param memory cleaningMoryakhin Stas2026-05-182-2/+2
| | | | | | | | | | | Fixes #31149 Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon May 18 11:12:39 2026 (Merged from https://github.com/openssl/openssl/pull/31170)
* apps/lib/tlssrp_depr.c: fix leak of vb in set_up_srp_verifier_file()huanghuihui09042026-05-133-0/+14
| | | | | | | | | | | | | | | | | | set_up_srp_verifier_file() allocates srp_callback_parm->vb via SRP_VBASE_new(). If SRP_VBASE_init() fails, vb must be freed before returning. Additionally, add SRP_VBASE_free() to the end: cleanup path in s_server.c so that vb is also freed on normal program exit. Solves https://github.com/openssl/openssl/issues/30362 Fixes #30362 Signed-off-by: huanghuihui0904 <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Matt Caswell <[email protected]> MergeDate: Wed May 13 07:20:48 2026 (Merged from https://github.com/openssl/openssl/pull/30434)
* Deprecate the X509_check_{email,host,ip,ip_asc} family of functionsBob Beck2026-05-114-31/+139
| | | | | | | | | | | | | | | | Our own documentation for quite some time has indicated that you should call X509_verify_cert() instead of using these. Actually deprecate them and make apps not use the now deprecated functions. Resolves: https://github.com/openssl/project/issues/1899 References: https://github.com/openssl/project/issues/1897 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Mon May 11 00:08:33 2026 (Merged from https://github.com/openssl/openssl/pull/30403)
* Make apps self-containedBob Beck2026-05-064-0/+15
| | | | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Wed May 6 11:35:53 2026 (Merged from https://github.com/openssl/openssl/pull/31001)
* Fix progs.pl to generate guarded headerBob Beck2026-05-061-0/+4
| | | | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Wed May 6 11:35:52 2026 (Merged from https://github.com/openssl/openssl/pull/31001)
* Add missing header guards in appsBob Beck2026-05-065-0/+25
| | | | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Wed May 6 11:35:51 2026 (Merged from https://github.com/openssl/openssl/pull/31001)
* Fix missing prototype for win32_utf8argv under MINGW64Milan Broz2026-04-301-0/+1
| | | | | | | | | | | With strict warnings build fails on missing win32_utf8argv() function definition. Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Thu Apr 30 11:42:18 2026 (Merged from https://github.com/openssl/openssl/pull/30941)
* apps: Move PATH_MAX define out of the win32 blockSebastian Andrzej Siewior2026-04-261-1/+1
| | | | | | | | | | | | | | | | The PATH_MAX define is needed on HURD which is now skipped since it is winthin the _WIN32 block. Move the PATH_MAX check+define outside of the _WIN32 block. Fixes: a2e5848d9d11 "s_client and s_server options for ECH" Signed-off-by: Sebastian Andrzej Siewior <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Sun Apr 26 11:35:52 2026 (Merged from https://github.com/openssl/openssl/pull/30520)
* Fix error check for EVP_CTRL_AEAD_GET_TAGndossche2026-04-241-2/+3
| | | | | | | | | | "< 0" is definitely wrong as it can return 0 on error. Change the checks that are not of the form "== 1" or "!= 1" to "<= 0". Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Fri Apr 24 11:29:50 2026 (Merged from https://github.com/openssl/openssl/pull/30923)
* pkey(1) missing setup for interactive pass promptViktor Dukhovni2026-04-221-4/+8
| | | | | | | | | | | | | | | The changes in #29324 neglected some setup needed for interactive password prompting, leading to a segfaul when pkey(1) is asked to encrypt, but not given an explicit `-pass` argument. The required plumbing is added. Fixes: #30889 Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Apr 22 07:04:47 2026 (Merged from https://github.com/openssl/openssl/pull/30904)
* Fix memory leak in load_key_certs_crls() when add/push failsherbenderbler2026-04-211-4/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | When X509_add_cert() or sk_X509_CRL_push() failed, the cert or CRL from OSSL_STORE was not freed. Free on failure to avoid a leak. Fix 90-test_memfail.t parsing of count output so the memfail suite runs correctly: parse 'skip: N count M' with a regex (handles '# ' prefix), return (0,0) if the count file cannot be opened, and skip with a clear message when total malloc count is 0 instead of planning 0 tests. Apply clang-format to test/load_key_certs_crls_memfail.c. - apps/lib/apps.c: free cert/CRL on add/push failure - test/build.info: add load_key_certs_crls_memfail (allocfail-tests) - test/load_key_certs_crls_memfail.c: regression test for issue #30364 - test/recipes/90-test_memfail.t: fix get_count_info parsing and plan Issue #30364 Fixes: 6d382c74b375 "Use OSSL_STORE for load_{,pub}key() and load_cert() in apps/lib/apps.c" Fixes: d7fcee3b3b5fa "OSSL_HTTP_parse_url(): add optional port number return parameter and strengthen documentation" Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Tue Apr 21 08:50:18 2026 (Merged from https://github.com/openssl/openssl/pull/30428)
* apps/enc.c: typo fix in -k option descriptionEugene Syromiatnikov2026-04-201-1/+1
| | | | | | | | | | | | Add missing closing parenthesis. Fixes: de89ca9347c2 "apps/enc.c: Moved -pass, -k, -kfile to encryption options" Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Apr 20 10:18:05 2026 (Merged from https://github.com/openssl/openssl/pull/30813)
* apps : enforce command-line parameter checking.F. R. Da Silva2026-04-135-15/+22
| | | | | | | | | | | | | | | Improve 'verify' option help messages. integer value parsing formats are: - 'n' is any integer - 'N' is a non-negative integer (i.e. value >= 0) - 'p' is a positive integer (i.e. value > 0) Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> MergeDate: Mon Apr 13 09:30:22 2026 (Merged from https://github.com/openssl/openssl/pull/30476)
* apps: remove atoi() calls.Filipe R. Da Silva2026-04-1311-33/+33
| | | | | | | | | | Related to #8216 Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> MergeDate: Mon Apr 13 09:30:21 2026 (Merged from https://github.com/openssl/openssl/pull/30476)
* Fix off-by-one s_client overflowsMatt Caswell2026-04-111-5/+5
| | | | | | | | | | | | | | | | | There are one byte buffer overflows possible in s_client's handling of STARTTLS in various protocols. If a server's response fills the entire buffer (16k) then we attempt to add a NUL terminator one byte off the end of the buffer. This was reported by Igor Morgenstern from AISLE to openssl-security and assessed by the security team as "bug or hardening only". Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Sat Apr 11 16:16:24 2026 (Merged from https://github.com/openssl/openssl/pull/30731)
generated by cgit (git 2.51.2) at 2026-10-25 17:14:49 +0100