aboutsummaryrefslogtreecommitdiffstats
path: root/apps
Commit message (Collapse)AuthorAgeFilesLines
* apps/lib/cmp_mock_srv.c: Fix NULL dereference of ASN1_INTEGER in refcert_cmp()Daniel Kubec21 hours1-2/+5
| | | | | | | | | | | | | | | | The issuer and the serialNumber are independently OPTIONAL in a CertTemplate. A component absent from the request cannot confirm a match with the reference cert, and ASN1_INTEGER_cmp() does not accept NULL, so require each component the reference cert has to be present in the request and to be equal. Fixes: 66be663b64e0 "cmp_mock_srv.c: Add missing OldCertID check for 'kur' cert update requests" References: b971d4198def "CMP mock server: add -ref_cert option and corresponding ossl_cmp_mock_srv_set1_refCert()" Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Sat Oct 24 09:44:19 2026 Merged-from: https://github.com/openssl/openssl/pull/33071
* apps/ocsp.c: fail on invalid response timesskaiea13-ai6 days1-0/+1
| | | | | | | | | | | | | | | | | | | | Propagate OCSP_check_validity() failures through print_ocsp_summary(), so the command returns a nonzero exit status for stale responses. Add a request-aware regression test using the existing signed fixtures. Resolves: https://github.com/openssl/openssl/issues/32367 References: 639bb581ce5b "apps/ocsp: Return non zero exit code with invalid certID" References: https://github.com/openssl/openssl/issues/7151 Co-Authored-by: Mounir Idrassi <[email protected]> Assisted-by: OpenAI Codex:GPT-5 Assisted-by: OpenAI Codex:GPT-6 Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Mon Oct 19 13:41:13 2026 Merged-from: https://github.com/openssl/openssl/pull/32600
* apps/s_server.c: fix BIO leak in ech_load_dir() on read failureMounir IDRASSI2026-10-091-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | When loading ECH keys from a directory (-ech_dir or -ech_noretry_dir), ech_load_dir() allocated a BIO via BIO_new_file(), but only freed it on the success path. If a file was readable, yet OSSL_ECHSTORE_read_pem() failed, the continue skipped BIO_free_all(), leaking the BIO. OSSL_ECHSTORE_read_pem() does not take ownership of the caller-supplied BIO. It pushes and pops its own internal buffer BIO, so the caller remains responsible for freeing the file BIO in all cases. Fix this by making the BIO local to each loop iteration and freeing it in the failure branch as well as the success branch. This also avoids carrying a dangling BIO pointer from one loop iteration to the next. Verified with Valgrind against a directory containing invalid ECH PEM files: definitely lost: 0 bytes, previously leaked 128 bytes per failing file. Resolves: https://github.com/openssl/openssl/issues/31770 Fixes: a2e5848d9d11 "s_client and s_server options for ECH" Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Fri Oct 9 19:55:28 2026 Merged-from: https://github.com/openssl/openssl/pull/31790
* apps: set cookie callbacks on s_server SNI contextJakub Zelenka2026-10-061-0/+4
| | | | | | | | | | | | | | | | | | s_server only installed the DTLS and stateless cookie callbacks on its main SSL_CTX. When -servername matched, the connection was switched to the second context before the cookie was generated, so a DTLS 1.2 client sending that name failed the handshake with a cookie generation callback failure instead of getting a HelloVerifyRequest. Install the callbacks on the SNI context as well and cover the case with a (D)TLSv1.2 server name handshake in the TLSProxy message test. Assisted-by: Claude:claude-fable-5-1 Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Tue Oct 6 14:46:55 2026 Merged-from: https://github.com/openssl/openssl/pull/33093
* apps/x509.c: don't load extensions if no -extfile/-extensions/"extensions" optEugene Syromiatnikov2026-10-051-6/+14
| | | | | | | | | | | | | | | | | | | | The documentation says "If neither of the options are given, an attempt is made to open the default configuration file [..] If the unnamed section [..] of the file does not list an B<extensions> variable, no extensions are added"; however, an attempt was made to load extensions in that case. Avoid that by using non-NULL extsect as a guard for do_EXT_REQ_add_nconf() and do_EXT_REQ_add_nconf() calls (which also avoids passing NULL as an "%s" format qualifier argument to BIO_printf() calls in case of load failure). Fixes: 84419e373ac1 "Improved handling of AKID/SKID extensions in CSRs and certs" Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> Merge-date: Mon Oct 5 10:09:56 2026 Merged-from: https://github.com/openssl/openssl/pull/33083
* Dealing with symmetric keys in pkcs12 command-line utilityDmitry Belyavskiy2026-09-291-2/+51
| | | | | | | | | | This is a follow-up to #30937 Assisted-by: Claude Opus 4.6 <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Simo Sorce <[email protected]> MergeDate: Tue Sep 29 18:34:13 2026 (Merged from https://github.com/openssl/openssl/pull/32978)
* apps/x509: Fix new output detection for -key signingMounir IDRASSI2026-09-251-1/+1
| | | | | | | | | | | | | | | | | | | | | The signing-only option validation runs before load_key(), so privkey is always NULL when determining newout. Consequently, -key or -signkey alone does not identify re-signing an input certificate or signing an -x509toreq output. Signing options are rejected, and the default extensions section is not loaded. Check privkeyfile at this stage, which records that the option was supplied. Keep the later privkey check unchanged because the key has been loaded by then. Add tests for the validation guard, re-signing options, and certificate and request extensions. Fixes #32150 Assisted-by: pi:kimi-k3 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Jakub Zelenka <[email protected]> Merge-date: Fri Sep 25 11:07:32 2026 Merged-from: https://github.com/openssl/openssl/pull/32151
* apps/server.c: Do not declare use_sendfile and use_zc_sendfile without ktlsTomas Mraz2026-09-171-2/+6
| | | | | | | | | It is unused otherwise. Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 17 14:05:04 2026 Merged-from: https://github.com/openssl/openssl/pull/32821
* apps: fix dsa app exit status on option parsing errorsJakub Zelenka2026-09-161-1/+0
| | | | | | | | | | | | | The dsa app set ret to 0 before printing the option parsing error, resulting in a successful exit status for invalid options. All other apps keep the initial error status in this case, so drop the errant assignment to make dsa fail as expected. Assisted-by: Claude:claude-fable-5 Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> Merge-date: Wed Sep 16 08:48:56 2026 Merged-from: https://github.com/openssl/openssl/pull/32590
* Fix a memory leak in apps/ocsp.c issuerBernd Edlinger2026-09-151-2/+6
| | | | | | | | Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Paul Yang <[email protected]> Merge-date: Tue Sep 15 16:28:52 2026 Merged-from: https://github.com/openssl/openssl/pull/32807
* Fix set but unsued variable in lib/opt.cNeil Horman2026-09-121-2/+0
| | | | | | | | | | | | | | https://github.com/openssl/openssl/actions/runs/34494520852/job/102982686286 CI is failing because we have a varaible in opt.c that is set but never used. Just remove it. Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> MergeDate: Sat Sep 12 13:18:16 2026 (Merged from https://github.com/openssl/openssl/pull/32787)
* Copyright year updatesopenssl-machine2026-09-0916-16/+16
| | | | | | | Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Wed Sep 9 13:12:46 2026 Release: yes
* apps: print an error for a non-positive genrsa bits argumentJakub Zelenka2026-09-071-1/+5
| | | | | | | | | | | Previously a negative or zero numbits argument made genrsa exit with a failure status without printing any error message. Assisted-by: Claude:claude-fable-5 Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Mon Sep 7 14:15:50 2026 Merged-from: https://github.com/openssl/openssl/pull/32592
* apps/x509.c: failing exit status on every failure path reaching err:Mounir IDRASSI2026-09-071-0/+2
| | | | | | | | | | | | | | | | | | | | | With -multi, a later certificate failure could return success after an earlier certificate succeeded because ret retained the earlier result on reaching err:. Set ret = 1 at err: so every path reaching it reports failure. Paths bypassing err: remain unchanged, including the pre-existing X509_VERIFY_PARAM_new() failure under -checkend, which will be addressed separately. Add a regression test using -multi -checkhost with a two-certificate chain whose second certificate fails. Fixes #32189 Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Todd Short <[email protected]> Merge-date: Mon Sep 7 14:01:00 2026 Merged-from: https://github.com/openssl/openssl/pull/32190
* PKCS7 and SMIME: improve documentation w.r.t. untrusted and signer certificatesDr. David von Oheimb2026-09-032-15/+19
| | | | | | | | Reviewed-by: Mounir Idrassi <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Thu Sep 3 09:26:56 2026 Merged-from: https://github.com/openssl/openssl/pull/22285
* s_server: Do not override -Verify with -verify_return_errorTomas Mraz2026-08-271-1/+1
| | | | | | | | | | | | Or the verification flags in instead of overriding the previous value with -verify_return_error. Fixes e5f01903ed7 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Merge-date: Thu Aug 27 16:15:34 2026 Merged-from: https://github.com/openssl/openssl/pull/32512
* Don't use BIO_snprintf as it is deprecatedNorbert Pocs2026-08-271-1/+1
| | | | | | | | Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Thu Aug 27 14:35:30 2026 Merged-from: https://github.com/openssl/openssl/pull/32547
* Sweep for printf UB - don't printf %s NULLBob Beck2026-08-271-1/+3
| | | | | | | | | | | As an asn1_string of length 0 will have NULL data, don't printf %s NULL. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Aug 27 13:52:48 2026 Merged-from: https://github.com/openssl/openssl/pull/32178
* Don't call strlcpy on a non-string.Bob Beck2026-08-271-1/+2
| | | | | | | | | | Again, ASN1_STRING_get0_data has never been guaranteed to be nul terminated. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Aug 27 13:52:40 2026 Merged-from: https://github.com/openssl/openssl/pull/32178
* Don't read an ASN1_STRING data raw and assume it's 0 byte terminatedBob Beck2026-08-271-4/+12
| | | | | | | | | | | Fix latent app bug in policy error diagnostics. Fixes: #32176 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Aug 27 13:52:39 2026 Merged-from: https://github.com/openssl/openssl/pull/32178
* Don't treat a CRL distribution point URI as a NUL terminated stringBob Beck2026-08-271-6/+12
| | | | | | | | | | | | | | | | | get_dp_url() returned the internal ASN1_STRING data of a DIST_POINT URI directly. That data has an explicit length and is not necessarily NUL terminated, yet load_crl() and the HTTP client it hands the URI to consume it as a C string, reading past the buffer for a certificate carrying a primitive-form IA5String URI in its CRL distribution points. Return an allocated NUL terminated copy of the URI and free it in load_crl_crldp(). Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Aug 27 13:52:39 2026 Merged-from: https://github.com/openssl/openssl/pull/32178
* Implement access to CMS verification results per signerJan Luebbe2026-08-271-0/+29
| | | | | | | | | | | | | | | | | | | When verifying CMS messages with multiple signatures using CMS_VERIFY_PARTIAL to implement additional custom requirements regarding signatures from which certificates are required and/or acceptable, information on which signature was considered invalid and why by CMS_verify is useful for reporting or debugging. Implement this by adding CMS_SignerInfo-based access to certificates (CMS_SignerInfo_get0_signer_cert) and verification results (CMS_SignerInfo_get_verification_result). Also use these new functions to show more details when using 'openssl cms -verify' with '-verify_partial'. Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: David von Oheimb <[email protected]> Merge-date: Thu Aug 27 13:14:14 2026 Merged-from: https://github.com/openssl/openssl/pull/27604
* Implement partial verification for CMS with multiple signaturesJan Luebbe2026-08-271-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, OpenSSL supports creating CMS SignedData structures with multiple signers using CMS_sign() with the CMS_PARTIAL flag combined with CMS_add1_signer(). This can be done for a new SignedData or by adding signers to an existing structure. In addition to the C API, this is supported via openssl cms -sign (using multiple -signer options) and openssl cms -resign. The corresponding CMS_verify() function and openssl cms -verify command check the signatures sequentially and abort with an error on the first problem. They support some flags (CMS_NO_SIGNER_CERT_VERIFY, CMS_NO_ATTR_VERIFY, CMS_NO_CONTENT_VERIFY), which disable some aspects of the verification, but do not allow continuing after a failed signature verification. The main use cases for multiple signatures on one message are: * Simplify CA certificate roll-over by signing messages with keys in both the old and new hierarchies during a transition period. Recipients would have either the old or new CA installed (or temporarily even both). In all cases, we'd like to accept any message which as at least one signature that can be verified. * Support user-implemented verification policies which require signatures from multiple specific signers. * Support user-implemented verification policies which require a minimum number of signatures from different signers under under a trusted CA. This is made possible by adding a CMS_VERIFY_PARTIAL flag to CMS_verify() and exposing it through a new -verify_partial option to 'openssl cms -verify'. If this flag is set, the call is successful even if some of the individual signatures cannot be verified (perhaps due to CAs missing from the local store or expired certificates). The application would then call CMS_get0_signers() and check if the set of valid signatures satisfies its policy. Fixes #3028 Fixes #26382 Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: David von Oheimb <[email protected]> Merge-date: Thu Aug 27 13:14:13 2026 Merged-from: https://github.com/openssl/openssl/pull/27604
* Replace strlen-then-snprintf preconditions with snprintf-returnBob Beck2026-08-261-73/+69
| | | | | | | | | | | | | | | This restructureis the apps/lib/apps.c file-rotation helpers to use snprintf for truncation detection, since they now can. This also collapses the per-snprintf VMS ifdef into one SUFFIX_SEP macro because the ifdef-per-call shape was making my eyes bleed from all the copypasta'ed snprintf lines with only one character changed in the format string. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> MergeDate: Wed Aug 26 16:20:32 2026 (Merged from https://github.com/openssl/openssl/pull/31640)
* Replace strlen-then-snprintf pattern in save_serial() with a single ↵Bob Beck2026-08-261-13/+13
| | | | | | | | | | | | truncation check. This used to be necessary because BIO_snprintf() could not detect truncation but now this is silly, and this ends up tripping GCC's -Wformat-truncation Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> MergeDate: Wed Aug 26 16:20:30 2026 (Merged from https://github.com/openssl/openssl/pull/31640)
* Convert BIO_snprintf() usage in describe_param_type()Bob Beck2026-08-261-9/+11
| | | | | | | | | | This adds the correct truncation check for snprintf() to each block that advances the index. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> MergeDate: Wed Aug 26 16:20:14 2026 (Merged from https://github.com/openssl/openssl/pull/31640)
* Convert BIO_snprintf() callers that detect truncation to snprintf().Bob Beck2026-08-263-12/+16
| | | | | | | | | | | These sites used the return value to detect truncation, then used the buffer as is. Convert them to detect truncation in the standard snprintf() way. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> MergeDate: Wed Aug 26 16:20:13 2026 (Merged from https://github.com/openssl/openssl/pull/31640)
* Convert BIO_snprintf() callers whose existing checks already workBob Beck2026-08-262-5/+5
| | | | | | | | | | | | under snprintf semantics. These call sites already guarded the result with the C99 truncation idiom, so they can simply use snprintf as a replacement as is. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> MergeDate: Wed Aug 26 16:20:09 2026 (Merged from https://github.com/openssl/openssl/pull/31640)
* Convert BIO_snprintf() callers that ignore the return value to snprintf().Bob Beck2026-08-2616-49/+58
| | | | | | | | | | | | Where the return value is discarded, BIO_snprintf() and snprintf() are interchangeable: both write the same bytes and NUL-terminate the buffer. The conversion is mechanical. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> MergeDate: Wed Aug 26 16:20:07 2026 (Merged from https://github.com/openssl/openssl/pull/31640)
* Add a build target for MSVC 2013Bob Beck2026-08-262-0/+18
| | | | | | | | | | | | | | | Apparently it is desired to keep this on life support. So we add a build target for this non-C99 platform, and provide internal versions of snprintf and vsnprintf for use only on this platform that match the C99 semantics. This allows us to use C99 semantics normally elsewhere. Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> MergeDate: Wed Aug 26 16:20:04 2026 (Merged from https://github.com/openssl/openssl/pull/31640)
* Support OSCP responses for DTLS 1.3Frederik Wedel-Heinen2026-08-252-9/+5
| | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/28455)
* Adds DTLS 1.3 ACK message functionalityFrederik Wedel-Heinen2026-08-251-1/+11
| | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/25119)
* Refactor code and fix a couple of missing DTLSv1.3 checks.Frederik Wedel-Heinen2026-08-252-15/+35
| | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/24345)
* Don't allow renegotiation for DTLS 1.3Frederik Wedel-Heinen2026-08-251-2/+3
| | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/22362)
* Print session ticket for dtls 1.3 as well.Frederik Wedel-Heinen2026-08-251-1/+1
| | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/22260)
* Integrate dtls1.3 in s_client and s_serverFrederik Wedel-Heinen2026-08-254-10/+42
| | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/22260)
* Fix system resource leak in TerminalSocket()YZL0v3ZZ2026-08-191-0/+2
| | | | | | | | | | | | | | | When establishing a terminal socket on OpenVMS, if the async I/O read operation (sys$qio) fails, the error path returns early without freeing the allocated channel via sys$dassgn. Add sys$dassgn(TerminalDeviceChan) in the sys$qio error path during creation. Also ensure dassgn executes regardless of whether sys$cancel succeeds during deletion to avoid exhausting the I/O channel quota. Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Merge-date: Wed Aug 19 15:37:03 2026 Merged-from: https://github.com/openssl/openssl/pull/30375
* Use an int for the return value of i2a_ASN1_OBJECTBob Beck2026-08-141-2/+3
| | | | | | | | | | | | | And as a result in this loop. I changed this to a size_t which was needed where the variable was used later on and missed this case at the start. While harmless, coverity notices. so let's do it right Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Merge-date: Fri Aug 14 06:29:29 2026 Merged-from: https://github.com/openssl/openssl/pull/32310
* Change set suffix in ASN1_STRING_set_{data,string} to set1Eugene Syromiatnikov2026-08-113-4/+4
| | | | | | | | | | | | | | | | | | | | | | | To comply with the naming guidelines for the API functions that transfer ownership of the data. The majority of the changes was done by for i in `git grep -l ASN1_STRING_set_data`; do \ sed -i 's/ASN1_STRING_set_data/ASN1_STRING_set1_data/g' "$i"; \ done for i in `git grep -l ASN1_STRING_set_string`; do \ sed -i 's/ASN1_STRING_set_string/ASN1_STRING_set1_string/g' "$i"; \ done with a manual touch-up in util/libcrypto.num. Complements: 28179061bfcd "Prepare a now opaque ASN1_STRING for the size_t rapture." Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Simo Sorce <[email protected]> MergeDate: Tue Aug 11 13:56:44 2026 (Merged from https://github.com/openssl/openssl/pull/32015)
* Rename ASN1_STRING_length_ex() to ASN1_STRING_get_length()Eugene Syromiatnikov2026-08-117-24/+24
| | | | | | | | | | | | | | | | | | | | To make it in line with ASN1_BIT_STRING_get_length() and other (size) getters. The majority of the changes was done by for i in `git grep -l ASN1_STRING_length_ex`; do \ sed -i 's/ASN1_STRING_length_ex/ASN1_STRING_get_length/g' "$i"; \ done with a manual touch-up in util/libcrypto.num. Complements: 28179061bfcd "Prepare a now opaque ASN1_STRING for the size_t rapture." Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Simo Sorce <[email protected]> MergeDate: Tue Aug 11 13:56:42 2026 (Merged from https://github.com/openssl/openssl/pull/32015)
* apps/tsget: minor cleanupsShreenidhi Shedi2026-08-071-45/+69
| | | | | | | | | | | | | | | Add a progress() helper to centralise verbose output. Move usage() to the top. Rename @old_argv to @saved_argv. Replace foreach with for+lexical variable. Inline $output_base. Switch exists to defined for option checks. Remove the main-program comment block. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Shreenidhi Shedi <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Matt Caswell <[email protected]> MergeDate: Fri Aug 7 13:29:39 2026 (Merged from https://github.com/openssl/openssl/pull/31445)
* apps/tsget: use three-arg open and binmode for binary safetyShreenidhi Shedi2026-08-071-4/+5
| | | | | | | | | | | | | | Switch bareword INPUT filehandle to a lexical filehandle with three-argument open. Add binmode on both the STDIN and file paths so timestamp request data is read as raw bytes on all platforms. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Shreenidhi Shedi <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Matt Caswell <[email protected]> MergeDate: Fri Aug 7 13:29:38 2026 (Merged from https://github.com/openssl/openssl/pull/31445)
* apps/tsget: enable use warningsShreenidhi Shedi2026-08-071-2/+6
| | | | | | | | | | | | | | Add "use warnings" and wrap CURLOPT_RANDOM_FILE and CURLOPT_EGDSOCKET setopt calls in eval blocks, as these constants were removed from libcurl and would cause an exception on modern installations. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Shreenidhi Shedi <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Matt Caswell <[email protected]> MergeDate: Fri Aug 7 13:29:37 2026 (Merged from https://github.com/openssl/openssl/pull/31445)
* apps/tsget: replace CURLOPT_UPLOAD with CURLOPT_POSTShreenidhi Shedi2026-08-071-68/+31
| | | | | | | | | | | | | | | | Switch from the UPLOAD+CUSTOMREQUEST+read-callback approach to POSTFIELDS, eliminating the read_body/write_body callbacks and the INFILE/INFILESIZE/FILE options. Rename get_timestamp to send_request with a simpler interface that writes directly to the output file via CURLOPT_WRITEDATA. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Shreenidhi Shedi <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Matt Caswell <[email protected]> MergeDate: Fri Aug 7 13:29:36 2026 (Merged from https://github.com/openssl/openssl/pull/31445)
* apps/tsget: switch WWW::Curl::Easy to Net::Curl::EasyShreenidhi Shedi2026-08-071-14/+8
| | | | | | | | | | | | | | | Minimal module swap: replace WWW::Curl::Easy with Net::Curl::Easy. Update callback signatures (Net::Curl passes the easy handle as the first argument), replace error-code-based perform() with eval/die, and drop cleanup() which Net::Curl does not require. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Shreenidhi Shedi <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Matt Caswell <[email protected]> MergeDate: Fri Aug 7 13:29:35 2026 (Merged from https://github.com/openssl/openssl/pull/31445)
* Fix encrypt decrypt fetch for cms from privoder sideMoryakhin Stas2026-08-011-1/+1
| | | | | | | | | | | | For algorithms without NID (without registration via the engine), cms_enc attempts to fetch via OBJ_obj2txt. passing cipher instead of NULL in EVP_PKEY_CTX_ctrl in apps/cms.c Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> MergeDate: Sat Aug 1 03:02:06 2026 (Merged from https://github.com/openssl/openssl/pull/31512)
* apps: Make s_client -quiet really quietSebastian Andrzej Siewior2026-07-303-8/+10
| | | | | | | | | | | | | | | | Despite the -quiet option s_client still reports the host it connects to and the certificate chain. Since -quiet is documented as "No s_client output", hide all non-error output. Pass the quiet option to init_client() to suppress the host output. Set verify's quiet flag if quiet is passed. Signed-off-by: Sebastian Andrzej Siewior <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> MergeDate: Thu Jul 30 09:09:35 2026 (Merged from https://github.com/openssl/openssl/pull/30519)
* Remove remaining atoi()/atol() callsMounir IDRASSI2026-07-297-18/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove the remaining direct atoi()/atol() uses across apps, libcrypto, libssl, providers, demos and tests, and route the replacements through checked helpers instead of open-coding the conversion at each call site: - apps use the existing opt_int()/opt_long()/opt_int_arg() parsers; - libcrypto and provider code use the new internal ossl_strtol()/ ossl_strtoint() helpers, a checked (and, for ossl_strtoint(), narrowing) signed counterpart to the public OPENSSL_strtoul(); - libssl, demos and tests use OPENSSL_strtoul(); the test code shares a single test_strtoint() helper rather than repeating the bound check and cast per file; - unsigned values use OPENSSL_strtoul(), with call-site-specific range checks before narrowing where the destination type requires it. Reject conversion failures and narrow through the helpers rather than acting on garbage, and preserve the signed RSA-PSS saltlen sentinels while rejecting invalid numeric strings. Add regression coverage for the invalid RSA-PSS saltlen string path. Fixes #8216 Assisted-by: OpenCode:GLM-5.2 Reviewed-by: Tom Cosgrove <[email protected]> Reviewed-by: Tim Hudson <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Wed Jul 29 17:02:18 2026 (Merged from https://github.com/openssl/openssl/pull/31731)
* apps: drop invalid trust setting in check_cert_might_be_valid()Jakub Zelenka2026-07-271-1/+0
| | | | | | | | | | | | | | | | | | | | | | check_cert_might_be_valid() called X509_VERIFY_PARAM_set_trust() with X509_TRUST_OK_ANY_EKU, which is a trust_flags bit (1 << 4), not a valid trust id (1..8). The call therefore failed with X509_R_INVALID_TRUST and left that error on the error stack, which was then printed via ERR_print_errors() for every certificate loaded by the x509 app, even on success. The intended liberal behavior is already provided by X509_PURPOSE_ANY and by suppressing X509_V_ERR_CERT_REJECTED, so just remove the bogus call. Add a test checking that printing certificate info emits nothing on stderr. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Ryan Hooper <[email protected]> MergeDate: Mon Jul 27 11:50:39 2026 (Merged from https://github.com/openssl/openssl/pull/31968)
* apps: fail skeyutl -genkey on bad -skeyoptJakub Zelenka2026-07-271-0/+3
| | | | | | | | | | | | | | | | | | | | app_params_new_from_opts() returns NULL when a key option cannot be converted, either because the key management does not settle the parameter or because the opt:value separator is missing. skeyutl ignored that and generated the key without the requested options, only printing the parameter error to stderr and still exiting successfully. Bail out instead, the way the mac, kdf and enc applications do. A NULL return is only an error when key options were actually given, as app_params_new_from_opts() also returns NULL for an empty option list. Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> MergeDate: Mon Jul 27 09:06:03 2026 (Merged from https://github.com/openssl/openssl/pull/32036)
generated by cgit (git 2.51.2) at 2026-10-25 07:28:12 +0100