summaryrefslogtreecommitdiff
path: root/src/usr.bin (follow)
Commit message (Collapse)AuthorAgeFilesLines
* openssl.1: remove mention of OPENSSL_EC_BIN_PT_COMPtb2026-03-141-16/+2
| | | | | | | | The need for this compile time option enabling point compression for binary curves despite patent issues has been removed in openssl 1.0.0 (released in 2010). [It's really difficult to count the number of bad ideas in the above.]
* nc(1) has the more crazy unveil + pledge configuration based uponderaadt2026-02-231-2/+4
| | | | | argument flags. I think this correctly replaces "tmppath" with an unveil.
* openssl x509: Remove legacy call to OBJ_create()kenjiro2026-02-081-4/+1
| | | | | | | The OID 2.99999.3 is not required for x509 output handling and is not referenced elsewhere. Remove the OBJ_create() call. ok tb jsing
* openssl x509: send -text output to the file specified by -outkenjiro2026-02-081-50/+44
| | | | | | | | | | | | | In the x509 command, `-text` output is not written to the file specified by `-out`, whereas in other OpenSSL/LibreSSL subcommands it is. With this change, STDout is removed, and `-text` output is written entirely to the file specified by `-out`, making the behavior consistent with other subcommands. Fix https://github.com/libressl/portable/issues/1228 ok tb jsing
* Implement s_client starttls protocol sieve.martijn2026-02-012-4/+62
| | | | | OK on previous diff concept sthen@ Suggestions, feedback and OK current diff tb@
* openssl asn1pars: move tmplen next to tmpbuftb2026-01-311-4/+4
|
* openssl asn1pars: avoid a few unnecessary caststb2026-01-311-11/+11
| | | | | | | | If str is a const unsigned char * rather than a char *, we can get away with a single cast and do not need to cast away const either. Reduce the scope of tmpbuf and ctmpbuf (now p) while there. ok kenjiro
* openssl: list SHA-3 digests in help outputkenjiro2026-01-021-1/+5
| | | | | | | | Register sha3-{224,256,384,512} as dgst commands so they appear in openssl help. Without this, SHA-3 support is easy to miss and looks unsupported from the command line. ok tb jsing
* openssl dgst: drop unused cfg.mkenjiro2026-01-021-5/+2
| | | | | | | Remove an unused intermediate EVP_MD pointer and assign digests directly to cfg.md. ok tb joel
* Reimplement ASN1_PRINTABLE_type() dance in ca.ctb2025-12-211-13/+55
| | | | | | | | | | | | | | | | | | In ca.c, there is some minimal validation of strings in the subject of a certificate. ASN1_PRINTABLE_type() is silly API that only exists for this one call. I want to remove a_print.c in the next major bump. ASN1_PRINTABLE_type() returns V_ASN1_PRINTABLESTRING if all characters belong to the specific subset of ASCII listed in X.680, 41.4, Table 10. Otherwise it returns V_ASN1_T61STRING or V_ASN1_IA5STRING depending on whether there is a character with the high bit set or not. With this in mind, the logic in ca.c comes down to this: blindly allow UTF-8, BMP and T61 strings. All other strings get rejected if the high bit of some character is set, or if the string is printable and there is a non-printable character. ok jsing kenjiro
* openssl: Remove -{,un}compress from cms "app"tb2025-12-202-40/+10
| | | | | | | | We haven't supported compiling against zlib in a very long time. These are the only two calls to CMS_{,un}compress(3) in the ecosystem. I am going to remove these two API stubs in the next major bump. ok jsing kenjiro
* speed: make hmac(sha256) the default hmackenjiro2025-12-131-4/+4
| | | | | | MD5 is obsolete. Use a sha256 hash for the HMAC benchmark. ok tb@ beck@
* Remove unused algorithms from speed.ckenjiro2025-12-111-7/+4
| | | | | | | | | | | | | | | Removed unused algorithms (MD2, SEED, RC5) from the algorithm enum and the `names[]` table. The current results for these algorithms were always: md2 0.00 0.00 0.00 0.00 0.00 seed cbc 0.00 0.00 0.00 0.00 0.00 rc5-32/12 cbc 0.00 0.00 0.00 0.00 0.00 indicating that they are no longer unused. ok tb@
* Convert D_, R_ macro indices to enums in speed.ckenjiro2025-12-111-49/+59
| | | | | | | | | Replaced many `#define` based index constants with enums by adding ALGOR_NUM, DSA_NUM, RSA_NUM, and EC_NUM to the enum definitions. This makes it easier to add or remove new entries. ok tb@
* speed: remove unused counters and dead parameterskenjiro2025-12-111-92/+77
| | | | | | | | | | | | | | In the speed implementation, a number of unused variables and parameters (save_count, c[][], rsa_c, dsa_c, ecdsa_c, ecdh_c, and the num argument of print_message()/pkey_print_message()) were still left behind. These values are no longer referenced and cannot affect the time-based benchmark logic, so remove them. Functional behaviour of speed remains unchanged. ok tb@
* sort the "va" keyword to be in alpha order, some programs use bsearchphessler2025-12-061-2/+2
| | | | noticed by deraadt@
* allow network programs select DSCP_VA for network ToSphessler2025-12-051-1/+2
| | | | OK stsp@
* openssl cms: switch to ASN1_STRING_get0_data()tb2025-11-271-3/+3
| | | | | | | The deprecated ASN1_STRING_data() will be removed in a future release. This is one small step towards that. ok kenjiro
* openssl pkcs12: stop reaching into ASN1_STRINGtb2025-11-271-18/+17
| | | | | | | Buy a t: rename hex_prin() to hex_print() and accept an ASN1_STRING so that we only need to use accessors once. Also avoid a printf %s NULL. ok kenjiro
* openssl ca: mechanical change to stop reaching into ASN1_STRINGtb2025-11-271-21/+26
| | | | ok kenjiro
* openssl asn1pars: don't reach into ASN1_STRINGtb2025-11-271-4/+4
| | | | ok kenjiro
* openssl ts: simplify create_nonce()tb2025-11-211-17/+7
| | | | | | | | Just your average dumb TS code. Instead of handrolling a random ASN.1 integer generator, we can use BN_rand() and convert the resulting bn to an ASN1_INTEGER. All this then also works without reaching into ASN1_STRING. ok kenjiro
* use strtonum() instead of atoi(), and error out for bad numbersderaadt2025-10-111-2/+7
| | | | | | | This generates a host-order number, so the ntohs() for getservbyport() was wrong, that should always have been htons(). The transform is the same, but misleading. ok tb
* openssl certhash: add digest param to certhash_directoryjoshua2025-07-271-13/+9
| | | | | | | This will allow us to call certhash_directory with other digests as required to implement the openssl rehash command, which uses SHA1 or MD5. ok jsing tb
* nc: document -Talpntb2025-06-241-2/+6
| | | | From David Leadbeater
* nc: add ALPN TLS option, so you can specify -T alpn=valuetb2025-06-241-2/+8
| | | | | From David Leadbeater with a report_tls tweak by me ok jsing
* sort process_tls_opt[]tb2025-06-241-2/+2
| | | | requested by jsing
* KNF for variations of get_cipher_by_name()tb2025-06-073-6/+9
|
* openssl.1: update defaults for cms and smimetb2025-06-071-4/+4
|
* openssl smime: switch default encryption from 40-bit RC2 to AES-256tb2025-06-071-11/+5
| | | | | | | | | The old default is still available with rc2-40. https://github.com/pyca/cryptography/issues/12949 https://github.com/libressl/portable/issues/1168 ok kenjiro
* openssl cms: switch default encryption from triple DES to AES-256tb2025-06-071-11/+5
| | | | | | | | | The old default is still available with "des3" https://github.com/pyca/cryptography/issues/12949 https://github.com/libressl/portable/issues/1168 ok kenjiro
* limitiation -> limitationjsg2025-05-281-3/+3
|
* openssl speed: clean up time_fjoshua2025-05-251-79/+76
| | | | | | | | | Rename Time_F to time_f and tidy up implementation and usage. time_f still uses app_timer_{user,real}, which I will clean up in a future commit. ok jsing
* openssl speed: remove whirlpooljoshua2025-05-252-41/+12
| | | | | | | | whirlpool was previously removed from libcrypto, and OPENSSL_NO_WHIRLPOOL will always be defined. Remove whirlpool support from the openssl speed command entirely. ok jsing tb
* openssl pkcs8: zap an outdated lietb2025-05-241-4/+1
|
* openssl speed: remove MAX_BLOCK_SIZE definejoshua2025-05-241-8/+2
| | | | ok jsing
* openssl speed: move key{16,24,32} above speed_mainjoshua2025-05-241-33/+25
| | | | | | Also, reuse the same keys for Camellia instead of having duplicates. ok jsing tb
* Update and improve documentation for pkcs8 -v2tb2025-05-241-12/+8
| | | | with input from jsing
* Switch default to PBES2 for openssl pkcs8 -topk8tb2025-05-241-3/+3
| | | | | | | | | | | | | | | | | | | | We currently use the glorious default of NID_pbeWithMD5AndDES_CBC which we inherited from OpenSSL. This could have been worse - there is also NID_pbeWithMD2AndDES_CBC... The way this diff works is that the undocumented PKCS8_encrypt() API uses the PKCS#5v2 code path when it's passed a NID of -1 and requires a cipher to succeed, otherwise it uses the PKCS#5v1.5 path. So pass in a sensible cipher, namely AES-CBC-256, and let layers of muppetry cascade to doing something resembling the right thing. This still uses the default of hmacWithSHA1 and a somewhat short salt, which will be improved in a subsequent commit. https://github.com/pyca/cryptography/issues/12949 https://github.com/libressl/portable/issues/1168 ok kenjiro joshua jsing
* openssl speed: use single md buffer for digestsjoshua2025-05-241-31/+10
| | | | ok jsing tb
* Fix HTTP CONNECT proxy support to not treat responses likedjm2025-05-221-5/+5
| | | | "HTTP/1.0 200poo" as success; patch from Spiros Thanasoulas
* for SOCKS4A don't perform a local hostname lookup that we're not goingdjm2025-05-211-4/+6
| | | | to use; spotted by lucas@
* add SOCKS4A to help textdjm2025-05-211-2/+2
|
* add SOCKS4A support to nc(1)'s proxy (-X) modedjm2025-05-213-7/+27
| | | | | | | | | | | SOCKS4A is a fairly obscure extension to the olde SOCKS4 protocol that allows passing the destination as a string rather than a literal IPv4 address, which is the only thing that vanilla SOCKS4 supports. The motivation for adding something so niche is to test the SOCKS4A server code in ssh(1)'s dynamic forwarding (-D) support. ok tb@
* nc: disallow -T with = when arguments are not key=value pairstb2025-05-141-1/+3
| | | | From Ross L Richardson
* cms: disallow AEAD ciphers and AES XTStb2025-05-101-3/+21
| | | | | | | | | | | | | | | | The CMS code doesn't support RFC 5083/5084 authenticated enveloped data and outputs garbage that even itself can't decrypt for a reason that I have not tried to pinpoint. So refuse using AEAD ciphers and AES XTS for enveloped data from the cms "app" and throw an error pointing out that this isn't supported. OpenSSL have since added incorrect support for AuthEnvelopedData (ASN.1 and code review are hard), so doing this right will need both correct and interoperable code, which I doubt anyone will bother to write anytime soon. Reported by Ben Cooper in https://github.com/libressl/portable/issues/1157 ok beck jsing
* openssl ocsp: switch from X509V3error() to perror()tb2025-05-091-6/+6
| | | | ok jsing
* Fix x509's -nameopt default and spell an option correctlykn2025-04-191-4/+4
| | | | Feedback OK tb
* Update openssl.1 for msie_hack removaltb2025-04-141-21/+4
| | | | ok jmc jsing
* Remove openssl ca -msie_hacktb2025-04-141-31/+2
| | | | | | The nineties called and wanted their garbage back. ok jsing
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2026-06-05 21:45:32 +0000