summaryrefslogtreecommitdiff
path: root/src/usr.bin (follow)
Commit message (Collapse)AuthorAgeFilesLines
* sync x509v3_add_value with x509_utl.ctb2024-08-311-19/+32
|
* Add and use local copy of X509V3_add_value()tb2024-08-301-2/+41
| | | | The public API will be removed. This fixes its only consumer.
* zap line missed in previous removal; ok tbjmc2024-08-301-3/+2
|
* Adjust documentation for check/pubcheck removaltb2024-08-291-11/+2
| | | | ok beck
* Remove check and pubcheck from openssl pkey and pkeyparamtb2024-08-294-73/+7
| | | | | | The underlying API will be removed, so these commands have to go. ok beck
* ocsp.c: zap trailing whitespacetb2024-08-291-2/+2
|
* ts.c: typo flaf -> flagtb2024-08-261-2/+2
|
* openssl: adjust manual for LMK and CSP removaltb2024-08-221-10/+2
|
* openssl pkcs12: remove support for LMK and CSP attributestb2024-08-221-25/+1
| | | | | | | | | | | | | Documentation on what the Microsoft-specific local machine keyset and the cryptographic service provider are actually good for is hard to find. For some reason (perhaps one million and two arguments for PKCS12_create() was considered two too many) these hang off the EVP_PKEY in the attributes member, which serves no other purpose. Every use of EVP_PKEY (of which there are far too many) pays extra memory taxes for this fringe use case. This complication is not worth it. ok miod
* Use OPENSSL_config() instead of OPENSSL_load_builtin_modules()tb2024-08-181-2/+2
|
* Add -CRLfile option to 'cms' sub commandjob2024-08-122-7/+38
| | | | | | | | | This option allows to verify certs in a CMS object against additional CRLs. Ported from work by Tom Harrison from APNIC OK tb@
* Remove bogus connect(s, NULL, 0) calltb2024-08-051-5/+1
| | | | | | | | | | | | The only thing it does is error because of a check added in sockargs() in uipc_syscalls r1.155. As guenther pointed out, this may have been added because of a misreading of the last sentence of the first paragraph of the connect(2) manual. Instead of erroring, this will keep listening if -k is given and otherwise it will close the socket and exit with success. ok guenther jeremy
* nc(1): remove useless function pointer dereferencingjan2024-08-021-2/+2
| | | | ok tb@
* Move the sigaction next to multitb2024-07-131-2/+2
| | | | Reduces diff in -portable
* use sigaction() to setup SIGARLM so we can set SA_RESTART, andderaadt2024-07-121-6/+8
| | | | | | remove the re-arming in the handler. Better than using siginterrupt(), and avoids the errno saving requirement in the handler also. ok guenther millert
* do not need to force bss values to 0deraadt2024-07-091-2/+2
|
* KNF a pile of else if blocks; ok tbderaadt2024-07-091-19/+9
|
* Adjust manpage for SPKAC removaltb2024-07-081-84/+4
| | | | ok jsing
* Remove spkac subcommandtb2024-07-084-317/+4
| | | | | | | | | | | | | | Google killed efforts to have SPKAC in html5 by zapping it from chrome a decade ago. This effort doesn't look like it's going anywhere: https://datatracker.ietf.org/doc/draft-leggett-spkac/ Unfortunately, PHP and Ruby still support NETSCAPE_SPKI, so we can't kill that code, but I see no real reason we need to support this in our openssl command. If the need should arise we can write a somewhat less poor version of this. ok jsing
* Remove spkac handling from openssl(1) catb2024-07-081-187/+3
| | | | | | | This is very poorly written code and now the only consumer of some public API that should not have survived the turn of the millenium. ok jsing
* signal handler must use the save_errno dance, and massage a variablederaadt2024-07-011-2/+5
| | | | | of type 'volatile sig_atomic_t' ok tb
* openssl ca: avoid double free for spkac files without default sectiontb2024-06-231-2/+1
| | | | ok jsing
* openssl x509: rename pub_key to dsa_pub_keytb2024-05-271-4/+4
| | | | suggested by jsing
* openssl: enable -Wshadow for clangtb2024-05-271-2/+2
| | | | ok job jsing
* openssl: avoid shadowed pkeys in x509.ctb2024-05-271-12/+10
| | | | ok job jsing
* remove prototypes with no matching function and externs with no varjsg2024-05-211-2/+1
| | | | partly checked by millert@
* remove extern with no matching var; ok tb@jsg2024-05-181-2/+1
|
* remove prototypes with no matching function; ok tb@jsg2024-05-183-6/+3
|
* openssl: toolkit implementing the TLS v1 protocol is weirdtb2024-05-071-3/+3
| | | | | | Well, it's a toolkit alright, and a terrible one at that, but TLS v1 (which is this beloved toolkit's name for TLS v1.0) is a thing firmly from the past, so drop the v1.
* openssl req: plug obvious leaktb2024-04-171-1/+2
| | | | CID 492603
* Mention that port can be specified as 0 in some situations, so that thederaadt2024-04-011-2/+3
| | | | system will allocate a port.
* Clean up create_digest()tb2024-03-251-16/+17
| | | | | | | | | The ts code is its own kind of special. I only sent this diff out to hear beck squeal. This diff doesn't actually fix anything, apart from (maybe) appeasing some obscure static analyzer. It is decidedly less bad than a similar change in openssl's issue tracker. ok beck
* Expand only ever user of PBEPARAM_free() outside of libcryptotb2024-02-281-2/+3
|
* Zap a useless comment followed by a stray semicolontb2024-02-041-2/+1
| | | | Noticed by Christian Andersen
* Remove GOST and STREEBOG support from libssl.beck2024-02-031-7/+1
| | | | | | | | | | | | | | | | | | This version of GOST is old and not anywhere close to compliant with modern GOST standards. It is also very intrusive in libssl and makes a mess everywhere. Efforts to entice a suitably minded anyone to care about it have been unsuccessful. At this point it is probably best to remove this, and if someone ever showed up who truly needed a working version, it should be a clean implementation from scratch, and have it use something closer to the typical API in libcrypto so it would integrate less painfully here. This removes it from libssl in preparation for it's removal from libcrypto with a future major bump ok tb@
* Add 'openssl x509 -new' functionality to the libcrypto CLI utilityjob2024-01-262-14/+71
| | | | | | | | | The ability to generate a new certificate is useful for testing and experimentation with rechaining PKIs. While there, alias '-key' to '-signkey' for compatibility. with and OK tb@
* Add -force_pubkey -multivalue-rdn -set_issuer -set_subject -utf8 to x509 appjob2024-01-122-27/+152
| | | | | | | | The -set_issuer, -set_subject, and -force_pubkey features can be used to 'rechain' PKIs, for more information see https://labs.apnic.net/nro-ta/ and https://blog.apnic.net/2023/12/14/models-of-trust-for-the-rpki/ OK tb@
* Garbage collect the last users of SSL_set_debug(3)tb2023-12-292-5/+2
| | | | | | | | This undocumented, incomplete public function has never done anything useful. It will be removed from libssl. Removing it from openssl(1) clears the way for this. ok jsing
* s_client: pause hasn't worked in ages. Just ignore ittb2023-12-292-13/+5
| | | | ok jsing
* Make a few purpose things consttb2023-11-214-11/+11
| | | | | This should allow us to constify a sizable table in libcrypto in an upcoming bump.
* openssl pkcs12: rewrite without reaching into X509_ALGORtb2023-11-191-7/+10
| | | | | | | | | We can call ASN1_item_unpack() which will end up stuffing the same arguments into ASN1_item_d2i() as d2i_PBEPARAM(). This eliminates the last struct access into X509_ALGOR outside libcrypto in the base tree. ok jsing
* openssl ts: convert to X509_ALGOR_set0()tb2023-11-191-5/+8
| | | | ok jsing
* Kill last user of ASN1_time_parse() in the treetb2023-11-131-23/+3
| | | | | | | | ASN1_time_parse() was useful while OpenSSL didn't have something sort of equivalent, but now they do. Let's retire ASN1_time_parse() to internal. This will require some patching in ports, but shrug. ok beck
* Check notBefore/notAfter validity with ASN1_TIME_to_tm(3)tb2023-11-131-5/+3
| | | | ok beck
* netcat: avoid issuing syscalls on fd -1tb2023-08-141-3/+9
| | | | | | | | | | | In case a socket error condition occurs, readwrite() invalidates the corresponding fd. Later on, readwrite() may still issue a syscall on it. Avoid that by adding a couple of checks for fd == -1. Reported and fix suggested by Leah Neukirchen. Fixes https://github.com/libressl/openbsd/issues/143 "looks right" deraadt
* Drop unused conf, pem, and x509 headers, add unistd for pledgetb2023-07-291-4/+2
|
* Remove antiquated options outputtb2023-07-273-44/+7
| | | | | | | | This is uninteresting and rather meaningless except for the implementer. No need to have several hundred lines of code backing half a dozen symbols in the public API for this. ok jsing
* sprinkle some void between () in function definitionstb2023-07-2313-26/+26
|
* Remove -stats option from openssl(1) errstr.tb2023-07-232-41/+5
| | | | | | This is the only consumer of ERR_get_string_table(), which will go away. ok jsing
* some minor fix up;jmc2023-07-031-5/+5
|
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-19 23:42:39 +0000