summaryrefslogtreecommitdiff
path: root/usr.bin/openssl
AgeCommit message (Collapse)Author
2020-04-26Display TLSv1.3 extension type with openssl(1) -tlsextdebugKinichiro Inoguchi
Add TLSv1.3 extension type, and sort by the definition order in tls1.h. This helps that openssl(1) s_server and s_client with -tlsextdebug displays the TLS extension type instead of "unknown". ok beck@ jsing@ tb@
2020-04-26s_client: fix use of possibly uninitialized valuesKinichiro Inoguchi
Set initial value to variable 'p' and 'pending'. Reported and fix requested from leonklingele by GitHub pull request. https://github.com/libressl-portable/portable/issues/577 https://github.com/libressl-portable/openbsd/pull/114 ok bcook@ jsing@ tb@
2020-04-25In s_server.c rev. 1.33, jsing added support for "openssl s_server -groups";Ingo Schwarze
document it and deprecate "openssl s_server -named_curve". While here, fix the error in the synopsis for "openssl s_client -groups" and use unified argument naming and similar wording like in SSL_CTX_set1_groups_list(3). OK jsing@
2020-04-19Add -groups option to openssl(1) s_server.Joel Sing
This allows supported EC groups to be configured, which will also control which TLSv1.3 key shares we'll accept. While here, deprecate the rather useless -named_curve option, which is effectively the same as -groups with a single group. Also stop setting a single default group of P-256 via SSL_CTX_set_tmp_ecdh() - use the library defaults instead. ok beck@ inoguchi@
2020-02-19Tag subcommand sectionskn
Allow semantic lookup by manually tagging sections (.Sh) for which no automatic tagging has been implemented; this thereby also eliminates false positives such that ":tx509<Enter>" now jumps to the X509 section. feedback remi inoguchi schwarze OK tb
2020-02-16Add -tls1_3 and -notls1_3 options to openssl(1) s_client.Joel Sing
Also stop using version pinned methods, instead setting the min and max protocol versions. Requested by inoguchi@ ok inoguchi@ tb@
2020-01-25add a couple of XXX for future cleanupTheo Buehler
2020-01-24Teach openssl s_client a bit about TLSv1.3.Theo Buehler
ok beck jsing
2020-01-23Make -peekaboo mode also use SSL_pending after peeking, to ensureBob Beck
SSL_pending implementation is correct. annoying jsing@
2020-01-22Simplify the peekaboo code.Joel Sing
ok beck@
2020-01-22Add -peekaboo option to s_client, to test SSL_peekBob Beck
peeks data before reading, compares to subsequent read. ok jsing@
2020-01-04Check CMS API return value in openssl(1) cmsKinichiro Inoguchi
ok jsing@
2019-12-18use "Currently" in the doc for "openssl enc" when talking about defaultStuart Henderson
md, to hint that it might not always be the case (e.g. if dealing with files from a different version of the tool). ok tb@
2019-12-18In January, the default digest used in the openssl enc command wasTheo Buehler
changed from md5 to sha256. Update manual to reflect that. From Fabio Scotoni ok jmc
2019-11-28Add manual for openssl(1) cmsKinichiro Inoguchi
ok and comments jmc@
2019-11-19More return value check in openssl(1) cmsKinichiro Inoguchi
Checking return value of sk_.*_new_null(). ok beck@ jsing@
2019-11-19Add manual descriptions for openssl(1) req -addextKinichiro Inoguchi
ok jmc@
2019-11-18Remove typedef and check sk_push return value in openssl(1) cmsKinichiro Inoguchi
- Remove typedef and use 'struct cms_key_param' instead - Check return value of sk_X509_push and sk_OPENSSL_STRING_push - Add a blank line to separate variable declarations from code comments from jsing@
2019-11-18Add -keyopt opiton to openssl(1) cms subcommandKinichiro Inoguchi
This provides rsa_padding_mode:oaep for cms -encrypt, and rsa_padding_mode:pss for cms -sign. ok jsing@
2019-11-06Check return value and remove unnecessary variableKinichiro Inoguchi
- Check NCONF_new() return value - Remove unnecessary 'i' comments from jsing@
2019-11-06Add -addext option to openssl(1) req subcommandKinichiro Inoguchi
First step of adding -addext option to openssl(1) req from OpenSSL 1.1.1d. ok jsing@
2019-11-04Indent labels for diffability.Joel Sing
2019-11-04Remove spaces between * and variable names.Joel Sing
2019-11-04Remove explicit NULL checks before *_free() calls.Joel Sing
2019-11-04Hook openssl(1) cms back up.Joel Sing
2019-11-04Currently we need to include pem.h before cms.h...Joel Sing
2019-11-04Remove engine argument from load_cert() calls.Joel Sing
This was cleaned up after cms went to the attic.
2019-11-04Bring openssl(1) cms back from the attic.Joel Sing
2019-10-04Avoid a path traversal bug in s_server on Windows.Brent Cook
openssl s_server has an arbitrary read vulnerability on Windows when run with the -WWW or -HTTP options, due to an incomplete path check logic. Thanks to Jobert Abma for reporting. ok tb@
2019-10-04the formatting for the mini synopses in this page did not render wellJason McIntyre
on html or groff. the solution, to replace the non-standard .nr macros with a hang list, was provided by ingo - thanks! ok schwarze
2019-08-30Remove unnecessary NULL check before free function in openssl(1) dgstKinichiro Inoguchi
2019-08-30Wrap lines over 80 cols and put space before goto label in openssl(1) dgstKinichiro Inoguchi
2019-08-30Simplify checking and more readable descriptions in openssl(1) dgstKinichiro Inoguchi
suggested from jsing@
2019-08-30Convert openssl(1) dgst to the newer style of option handlingKinichiro Inoguchi
Adapt openssl(1) dgst command to new option handling. Added dgst_options struct and option handlers, and replaced for-if-strcmp handling with options_parse(). ok bcook@ jsing@
2019-08-05Remove -port option from s_server since it is same as -acceptKinichiro Inoguchi
ok schwarze@
2019-07-29Moving variables into struct in openssl(1) dgstKinichiro Inoguchi
First step to adapt openssl(1) dgst command to new option handling. There is no functional changes by this diff, and just moving variables into dgst_config struct. ok bcook@
2019-07-26Code clean up openssl(1) pkcs12Kinichiro Inoguchi
- Add a space before 'export_end:' - Remove space after '*' - Wrap lines by 80 columns
2019-07-26Remove unnecessary NULL checks before free in openssl(1) pkcs12Kinichiro Inoguchi
ok bcook@ tb@
2019-07-25remove superfluous commentBrent Cook
2019-07-25zero tmpkeyiv buffer after use when encryptingBrent Cook
from Steven Roberts
2019-07-24Capitalize cipher name and mode in help message as sync with pkcs12Kinichiro Inoguchi
2019-07-24Convert openssl(1) pkcs12 to the newer style of option handlingKinichiro Inoguchi
Adapt openssl(1) pkcs12 command to new option handling. Added pkcs12_options struct, and replaced for-if-strcmp handling with options_parse(). ok and comments jsing@
2019-07-23Moving variables into struct in openssl(1) pkcs12Kinichiro Inoguchi
First step to adapt openssl(1) pkcs12 command to new option handling. There is no functional changes by this diff, and just moving variables into pkcs12_config struct. I still keep long lines more than 80 for this review to minimize diffs. ok jsing@ tb@
2019-07-16Fix long line by wrapping with 80 charsKinichiro Inoguchi
2019-07-16Move option handlers up to option definition struct in gendsa.cKinichiro Inoguchi
As we did in other openssl sub command, move up option handlers above option definition struct. No functional changes and just move up and remove prototype.
2019-07-16Fix typo and -keyform argument in openssl(1) manualKinichiro Inoguchi
- s/outputed/outputted/ - s/trused/trusted/ - add der as argument and describe pem is the default
2019-07-14Mark the initialized struct options arrays as both static and const.Philip Guenther
This moves them from .data to .data.rel.ro ok deraadt@ inoguchi@
2019-07-12Fix manual openssl(1) s_serverKinichiro Inoguchi
- Add undocumented options below. -alpn, -cert2, -certform, -dcertform, -dkeyform, -dpass, -dtls1, -key2, -keyform, -keymatexport, -keymatexportlen, -mtu, -named_curve, -no_cache, -no_ecdhe, -no_ticket, -pass, -port, -servername, -servername_fatal, -status, -status_timeout, -status_url, -status_verbose, -timeout, -tlsextdebug, -use_srtp, -verify_return_error - Remove -hack, -psk and -psk_hint since not exist in source code. I didn't add these 5 options since these were no-op. -chain, -legacy_renegotiation, -nextprotoneg, -no_comp, -no_ssl2 This option was removed from manual in the past. -no_ssl3 ok and suggestions from jmc@
2019-07-11Fix manual openssl(1) s_clientKinichiro Inoguchi
- Add undocumented options below. -alpn, -certform, -dtls1, -host, -keyform, -keymatexport, -keymatexportlen, -legacy_server_connect, -mtu, -no_ign_eof, -no_legacy_server_connect, -pass -port, -serverpref, -sess_in, -sess_out, -status, -timeout, -use_srtp, -verify_return_error - Remove -psk and -psk_identity since not exist in source code. I didn't add these 4 options since these were no-op. -nextprotoneg, -legacy_renegotiation, -no_comp, -no_ssl2 This option was removed from manual in the past. -no_ssl3 ok jmc@
2019-07-10Add missing option openssl dsa -modulusKinichiro Inoguchi
ok bcook@ jsing@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-22 19:01:49 +0000