Latest update.

2020-03-03 19:16:19 +09:00
parent f85de4da03
commit b412d79e8b
310 changed files with 32765 additions and 19720 deletions
@@ -19,6 +19,10 @@ $OPENSSLSRC=\
        rsautl.c s_client.c s_server.c s_time.c sess_id.c smime.c speed.c \
        spkac.c srp.c ts.c verify.c version.c x509.c rehash.c storeutl.c \
        list.c info.c provider.c fipsinstall.c
+IF[{- !$disabled{'deprecated-3.0'} -}]
+  $OPENSSLSRC=$OPENSSLSRC \
+        dhparam.c dsa.c dsaparam.c gendsa.c
+ENDIF

 IF[{- !$disabled{apps} -}]
  PROGRAMS=openssl
@@ -26,15 +30,18 @@ IF[{- !$disabled{apps} -}]
  INCLUDE[openssl]=.. ../include include
  DEPEND[openssl]=libapps.a ../libssl

+  DEPEND[${OPENSSLSRC/.c/.o}]=progs.h
+  GENERATE[progs.c]=progs.pl -C $(APPS_OPENSSL)
+  GENERATE[progs.h]=progs.pl -H $(APPS_OPENSSL)
+  # progs.pl tries to read all 'openssl' sources, including progs.c, so we make
+  # sure things are generated in the correct order.
+  DEPEND[progs.h]=progs.c
+
  IF[{- $config{target} =~ /^(?:Cygwin|mingw|VC-)/ -}]
    GENERATE[openssl.rc]=../util/mkrc.pl openssl
    SOURCE[openssl]=openssl.rc
  ENDIF

-  IF[{- !$disabled{'deprecated-3.0'} -}]
-    SOURCE[openssl]=dhparam.c dsa.c dsaparam.c gendsa.c
-  ENDIF
-
  SCRIPTS{misc}=CA.pl
  SOURCE[CA.pl]=CA.pl.in
  # linkname tells build files that a symbolic link or copy of this script
@@ -2690,6 +2690,7 @@ OSSL_PARAM *app_params_new_from_opts(STACK_OF(OPENSSL_STRING) *opts,
    size_t sz = (size_t)sk_OPENSSL_STRING_num(opts);
    size_t params_n;
    char *opt = "", *stmp, *vtmp = NULL;
+    int found = 1;

    if (opts == NULL)
        return NULL;
@@ -2708,7 +2709,7 @@ OSSL_PARAM *app_params_new_from_opts(STACK_OF(OPENSSL_STRING) *opts,
        /* Skip over the separator so that vmtp points to the value */
        vtmp++;
        if (!OSSL_PARAM_allocate_from_text(&params[params_n], paramdefs,
-                                           stmp, vtmp, strlen(vtmp)))
+                                           stmp, vtmp, strlen(vtmp), &found))
            goto err;
        OPENSSL_free(stmp);
    }
@@ -2716,7 +2717,8 @@ OSSL_PARAM *app_params_new_from_opts(STACK_OF(OPENSSL_STRING) *opts,
    return params;
 err:
    OPENSSL_free(stmp);
-    BIO_printf(bio_err, "Parameter error '%s'\n", opt);
+    BIO_printf(bio_err, "Parameter %s '%s'\n", found ? "error" : "unknown",
+               opt);
    ERR_print_errors(bio_err);
    app_params_free(params);
    return NULL;
@@ -1434,7 +1434,20 @@ static int security_callback_debug(const SSL *s, const SSL_CTX *ctx,
    case SSL_SECOP_OTHER_DH:
        {
            DH *dh = other;
-            BIO_printf(sdb->out, "%d", DH_bits(dh));
+            EVP_PKEY *pkey = EVP_PKEY_new();
+            int fail = 1;
+
+            if (pkey != NULL) {
+                if (EVP_PKEY_set1_DH(pkey, dh)) {
+                    BIO_printf(sdb->out, "%d", EVP_PKEY_bits(pkey));
+                    fail = 0;
+                }
+
+                EVP_PKEY_free(pkey);
+            }
+            if (fail)
+                BIO_printf(sdb->out, "s_cb.c:security_callback_debug op=0x%x",
+                           op);
            break;
        }
 #endif
@@ -15,11 +15,29 @@
 #include <openssl/err.h>
 #include <openssl/evp.h>

+#ifndef OPENSSL_NO_EC
+# include <openssl/ec.h>
+
+static OPT_PAIR ec_conv_forms[] = {
+    {"compressed", POINT_CONVERSION_COMPRESSED},
+    {"uncompressed", POINT_CONVERSION_UNCOMPRESSED},
+    {"hybrid", POINT_CONVERSION_HYBRID},
+    {NULL}
+};
+
+static OPT_PAIR ec_param_enc[] = {
+    {"named_curve", OPENSSL_EC_NAMED_CURVE},
+    {"explicit", 0},
+    {NULL}
+};
+#endif
+
 typedef enum OPTION_choice {
    OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
    OPT_INFORM, OPT_OUTFORM, OPT_PASSIN, OPT_PASSOUT, OPT_ENGINE,
    OPT_IN, OPT_OUT, OPT_PUBIN, OPT_PUBOUT, OPT_TEXT_PUB,
-    OPT_TEXT, OPT_NOOUT, OPT_MD, OPT_TRADITIONAL, OPT_CHECK, OPT_PUB_CHECK
+    OPT_TEXT, OPT_NOOUT, OPT_MD, OPT_TRADITIONAL, OPT_CHECK, OPT_PUB_CHECK,
+    OPT_EC_PARAM_ENC, OPT_EC_CONV_FORM
 } OPTION_CHOICE;

 const OPTIONS pkey_options[] = {
@@ -31,6 +49,10 @@ const OPTIONS pkey_options[] = {
    {"check", OPT_CHECK, '-', "Check key consistency"},
    {"pubcheck", OPT_PUB_CHECK, '-', "Check public key consistency"},
    {"", OPT_MD, '-', "Any supported cipher"},
+    {"ec_param_enc", OPT_EC_PARAM_ENC, 's',
+     "Specifies the way the ec parameters are encoded"},
+    {"ec_conv_form", OPT_EC_CONV_FORM, 's',
+     "Specifies the point conversion form "},

    OPT_SECTION("Input"),
    {"in", OPT_IN, 's', "Input key"},
@@ -65,6 +87,12 @@ int pkey_main(int argc, char **argv)
    int informat = FORMAT_PEM, outformat = FORMAT_PEM;
    int pubin = 0, pubout = 0, pubtext = 0, text = 0, noout = 0, ret = 1;
    int private = 0, traditional = 0, check = 0, pub_check = 0;
+#ifndef OPENSSL_NO_EC
+    EC_KEY *eckey;
+    int ec_asn1_flag = OPENSSL_EC_NAMED_CURVE, new_ec_asn1_flag = 0;
+    int i, new_ec_form = 0;
+    point_conversion_form_t ec_form = POINT_CONVERSION_UNCOMPRESSED;
+#endif

    prog = opt_init(argc, argv, pkey_options);
    while ((o = opt_next()) != OPT_EOF) {
@@ -128,6 +156,27 @@ int pkey_main(int argc, char **argv)
        case OPT_MD:
            if (!opt_cipher(opt_unknown(), &cipher))
                goto opthelp;
+            break;
+        case OPT_EC_CONV_FORM:
+#ifdef OPENSSL_NO_EC
+            goto opthelp;
+#else
+            if (!opt_pair(opt_arg(), ec_conv_forms, &i))
+                goto opthelp;
+            new_ec_form = 1;
+            ec_form = i;
+            break;
+#endif
+        case OPT_EC_PARAM_ENC:
+#ifdef OPENSSL_NO_EC
+            goto opthelp;
+#else
+            if (!opt_pair(opt_arg(), ec_param_enc, &i))
+                goto opthelp;
+            new_ec_asn1_flag = 1;
+            ec_asn1_flag = i;
+            break;
+#endif
        }
    }
    argc = opt_num_rest();
@@ -154,6 +203,24 @@ int pkey_main(int argc, char **argv)
    if (pkey == NULL)
        goto end;

+#ifndef OPENSSL_NO_EC
+    /*
+     * TODO: remove this and use a set params call with a 'pkeyopt' command
+     * line option instead.
+     */
+    if (new_ec_form || new_ec_asn1_flag) {
+        if ((eckey = EVP_PKEY_get0_EC_KEY(pkey)) == NULL) {
+            ERR_print_errors(bio_err);
+            goto end;
+        }
+        if (new_ec_form)
+            EC_KEY_set_conv_form(eckey, ec_form);
+
+        if (new_ec_asn1_flag)
+            EC_KEY_set_asn1_flag(eckey, ec_asn1_flag);
+    }
+#endif
+
    if (check || pub_check) {
        int r;
        EVP_PKEY_CTX *ctx;
@@ -9,6 +9,7 @@

 #include <stdio.h>
 #include <string.h>
+#include <stdlib.h>
 #include "apps.h"
 #include "progs.h"
 #include <openssl/pem.h>
@@ -44,9 +45,11 @@ int pkeyparam_main(int argc, char **argv)
    ENGINE *e = NULL;
    BIO *in = NULL, *out = NULL;
    EVP_PKEY *pkey = NULL;
-    int text = 0, noout = 0, ret = 1, check = 0;
+    EVP_PKEY_CTX *ctx = NULL;
+    int text = 0, noout = 0, ret = EXIT_FAILURE, check = 0, r;
    OPTION_CHOICE o;
    char *infile = NULL, *outfile = NULL, *prog;
+    unsigned long err;

    prog = opt_init(argc, argv, pkeyparam_options);
    while ((o = opt_next()) != OPT_EOF) {
@@ -98,9 +101,6 @@ int pkeyparam_main(int argc, char **argv)
    }

    if (check) {
-        int r;
-        EVP_PKEY_CTX *ctx;
-
        ctx = EVP_PKEY_CTX_new(pkey, e);
        if (ctx == NULL) {
            ERR_print_errors(bio_err);
@@ -116,8 +116,6 @@ int pkeyparam_main(int argc, char **argv)
             * Note: at least for RSA keys if this function returns
             * -1, there will be no error reasons.
             */
-            unsigned long err;
-
            BIO_printf(out, "Parameters are invalid\n");

            while ((err = ERR_peek_error()) != 0) {
@@ -125,8 +123,8 @@ int pkeyparam_main(int argc, char **argv)
                           ERR_reason_error_string(err));
                ERR_get_error(); /* remove err from error stack */
            }
+            goto end;
        }
-        EVP_PKEY_CTX_free(ctx);
    }

    if (!noout)
@@ -135,9 +133,10 @@ int pkeyparam_main(int argc, char **argv)
    if (text)
        EVP_PKEY_print_params(out, pkey, 0, NULL);

-    ret = 0;
+    ret = EXIT_SUCCESS;

 end:
+    EVP_PKEY_CTX_free(ctx);
    EVP_PKEY_free(pkey);
    release_engine(e);
    BIO_free_all(out);
@@ -1,400 +0,0 @@
-/*
- * WARNING: do not edit!
- * Generated by apps/progs.pl
- *
- * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-#include "progs.h"
-
-FUNCTION functions[] = {
-    {FT_general, "asn1parse", asn1parse_main, asn1parse_options, NULL},
-    {FT_general, "ca", ca_main, ca_options, NULL},
-#ifndef OPENSSL_NO_SOCK
-    {FT_general, "ciphers", ciphers_main, ciphers_options, NULL},
-#endif
-#ifndef OPENSSL_NO_CMS
-    {FT_general, "cms", cms_main, cms_options, NULL},
-#endif
-    {FT_general, "crl", crl_main, crl_options, NULL},
-    {FT_general, "crl2pkcs7", crl2pkcs7_main, crl2pkcs7_options, NULL},
-    {FT_general, "dgst", dgst_main, dgst_options, NULL},
-#if !defined(OPENSSL_NO_DH) && !defined(OPENSSL_NO_DEPRECATED_3_0)
-    {FT_general, "dhparam", dhparam_main, dhparam_options, "pkeyparam"},
-#endif
-#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
-    {FT_general, "dsa", dsa_main, dsa_options, "pkey"},
-#endif
-#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
-    {FT_general, "dsaparam", dsaparam_main, dsaparam_options, "pkeyparam"},
-#endif
-#ifndef OPENSSL_NO_EC
-    {FT_general, "ec", ec_main, ec_options, NULL},
-#endif
-#ifndef OPENSSL_NO_EC
-    {FT_general, "ecparam", ecparam_main, ecparam_options, NULL},
-#endif
-    {FT_general, "enc", enc_main, enc_options, NULL},
-#ifndef OPENSSL_NO_ENGINE
-    {FT_general, "engine", engine_main, engine_options, NULL},
-#endif
-    {FT_general, "errstr", errstr_main, errstr_options, NULL},
-    {FT_general, "fipsinstall", fipsinstall_main, fipsinstall_options, NULL},
-#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
-    {FT_general, "gendsa", gendsa_main, gendsa_options, "genpkey"},
-#endif
-    {FT_general, "genpkey", genpkey_main, genpkey_options, NULL},
-#ifndef OPENSSL_NO_RSA
-    {FT_general, "genrsa", genrsa_main, genrsa_options, NULL},
-#endif
-    {FT_general, "help", help_main, help_options, NULL},
-    {FT_general, "info", info_main, info_options, NULL},
-    {FT_general, "kdf", kdf_main, kdf_options, NULL},
-    {FT_general, "list", list_main, list_options, NULL},
-    {FT_general, "mac", mac_main, mac_options, NULL},
-    {FT_general, "nseq", nseq_main, nseq_options, NULL},
-#ifndef OPENSSL_NO_OCSP
-    {FT_general, "ocsp", ocsp_main, ocsp_options, NULL},
-#endif
-    {FT_general, "passwd", passwd_main, passwd_options, NULL},
-#ifndef OPENSSL_NO_DES
-    {FT_general, "pkcs12", pkcs12_main, pkcs12_options, NULL},
-#endif
-    {FT_general, "pkcs7", pkcs7_main, pkcs7_options, NULL},
-    {FT_general, "pkcs8", pkcs8_main, pkcs8_options, NULL},
-    {FT_general, "pkey", pkey_main, pkey_options, NULL},
-    {FT_general, "pkeyparam", pkeyparam_main, pkeyparam_options, NULL},
-    {FT_general, "pkeyutl", pkeyutl_main, pkeyutl_options, NULL},
-    {FT_general, "prime", prime_main, prime_options, NULL},
-    {FT_general, "provider", provider_main, provider_options, NULL},
-    {FT_general, "rand", rand_main, rand_options, NULL},
-    {FT_general, "rehash", rehash_main, rehash_options, NULL},
-    {FT_general, "req", req_main, req_options, NULL},
-    {FT_general, "rsa", rsa_main, rsa_options, NULL},
-#ifndef OPENSSL_NO_RSA
-    {FT_general, "rsautl", rsautl_main, rsautl_options, NULL},
-#endif
-#ifndef OPENSSL_NO_SOCK
-    {FT_general, "s_client", s_client_main, s_client_options, NULL},
-#endif
-#ifndef OPENSSL_NO_SOCK
-    {FT_general, "s_server", s_server_main, s_server_options, NULL},
-#endif
-#ifndef OPENSSL_NO_SOCK
-    {FT_general, "s_time", s_time_main, s_time_options, NULL},
-#endif
-    {FT_general, "sess_id", sess_id_main, sess_id_options, NULL},
-    {FT_general, "smime", smime_main, smime_options, NULL},
-    {FT_general, "speed", speed_main, speed_options, NULL},
-    {FT_general, "spkac", spkac_main, spkac_options, NULL},
-#ifndef OPENSSL_NO_SRP
-    {FT_general, "srp", srp_main, srp_options, NULL},
-#endif
-    {FT_general, "storeutl", storeutl_main, storeutl_options, NULL},
-#ifndef OPENSSL_NO_TS
-    {FT_general, "ts", ts_main, ts_options, NULL},
-#endif
-    {FT_general, "verify", verify_main, verify_options, NULL},
-    {FT_general, "version", version_main, version_options, NULL},
-    {FT_general, "x509", x509_main, x509_options, NULL},
-#ifndef OPENSSL_NO_MD2
-    {FT_md, "md2", dgst_main, NULL, NULL},
-#endif
-#ifndef OPENSSL_NO_MD4
-    {FT_md, "md4", dgst_main, NULL, NULL},
-#endif
-    {FT_md, "md5", dgst_main, NULL, NULL},
-#ifndef OPENSSL_NO_GOST
-    {FT_md, "gost", dgst_main, NULL, NULL},
-#endif
-    {FT_md, "sha1", dgst_main, NULL, NULL},
-    {FT_md, "sha224", dgst_main, NULL, NULL},
-    {FT_md, "sha256", dgst_main, NULL, NULL},
-    {FT_md, "sha384", dgst_main, NULL, NULL},
-    {FT_md, "sha512", dgst_main, NULL, NULL},
-    {FT_md, "sha512-224", dgst_main, NULL, NULL},
-    {FT_md, "sha512-256", dgst_main, NULL, NULL},
-    {FT_md, "sha3-224", dgst_main, NULL, NULL},
-    {FT_md, "sha3-256", dgst_main, NULL, NULL},
-    {FT_md, "sha3-384", dgst_main, NULL, NULL},
-    {FT_md, "sha3-512", dgst_main, NULL, NULL},
-    {FT_md, "shake128", dgst_main, NULL, NULL},
-    {FT_md, "shake256", dgst_main, NULL, NULL},
-#ifndef OPENSSL_NO_MDC2
-    {FT_md, "mdc2", dgst_main, NULL, NULL},
-#endif
-#ifndef OPENSSL_NO_RMD160
-    {FT_md, "rmd160", dgst_main, NULL, NULL},
-#endif
-#ifndef OPENSSL_NO_BLAKE2
-    {FT_md, "blake2b512", dgst_main, NULL, NULL},
-#endif
-#ifndef OPENSSL_NO_BLAKE2
-    {FT_md, "blake2s256", dgst_main, NULL, NULL},
-#endif
-#ifndef OPENSSL_NO_SM3
-    {FT_md, "sm3", dgst_main, NULL, NULL},
-#endif
-    {FT_cipher, "aes-128-cbc", enc_main, enc_options, NULL},
-    {FT_cipher, "aes-128-ecb", enc_main, enc_options, NULL},
-    {FT_cipher, "aes-192-cbc", enc_main, enc_options, NULL},
-    {FT_cipher, "aes-192-ecb", enc_main, enc_options, NULL},
-    {FT_cipher, "aes-256-cbc", enc_main, enc_options, NULL},
-    {FT_cipher, "aes-256-ecb", enc_main, enc_options, NULL},
-#ifndef OPENSSL_NO_ARIA
-    {FT_cipher, "aria-128-cbc", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_ARIA
-    {FT_cipher, "aria-128-cfb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_ARIA
-    {FT_cipher, "aria-128-ctr", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_ARIA
-    {FT_cipher, "aria-128-ecb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_ARIA
-    {FT_cipher, "aria-128-ofb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_ARIA
-    {FT_cipher, "aria-128-cfb1", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_ARIA
-    {FT_cipher, "aria-128-cfb8", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_ARIA
-    {FT_cipher, "aria-192-cbc", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_ARIA
-    {FT_cipher, "aria-192-cfb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_ARIA
-    {FT_cipher, "aria-192-ctr", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_ARIA
-    {FT_cipher, "aria-192-ecb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_ARIA
-    {FT_cipher, "aria-192-ofb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_ARIA
-    {FT_cipher, "aria-192-cfb1", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_ARIA
-    {FT_cipher, "aria-192-cfb8", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_ARIA
-    {FT_cipher, "aria-256-cbc", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_ARIA
-    {FT_cipher, "aria-256-cfb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_ARIA
-    {FT_cipher, "aria-256-ctr", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_ARIA
-    {FT_cipher, "aria-256-ecb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_ARIA
-    {FT_cipher, "aria-256-ofb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_ARIA
-    {FT_cipher, "aria-256-cfb1", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_ARIA
-    {FT_cipher, "aria-256-cfb8", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_CAMELLIA
-    {FT_cipher, "camellia-128-cbc", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_CAMELLIA
-    {FT_cipher, "camellia-128-ecb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_CAMELLIA
-    {FT_cipher, "camellia-192-cbc", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_CAMELLIA
-    {FT_cipher, "camellia-192-ecb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_CAMELLIA
-    {FT_cipher, "camellia-256-cbc", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_CAMELLIA
-    {FT_cipher, "camellia-256-ecb", enc_main, enc_options, NULL},
-#endif
-    {FT_cipher, "base64", enc_main, enc_options, NULL},
-#ifdef ZLIB
-    {FT_cipher, "zlib", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_DES
-    {FT_cipher, "des", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_DES
-    {FT_cipher, "des3", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_DES
-    {FT_cipher, "desx", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_IDEA
-    {FT_cipher, "idea", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_SEED
-    {FT_cipher, "seed", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_RC4
-    {FT_cipher, "rc4", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_RC4
-    {FT_cipher, "rc4-40", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_RC2
-    {FT_cipher, "rc2", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_BF
-    {FT_cipher, "bf", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_CAST
-    {FT_cipher, "cast", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_RC5
-    {FT_cipher, "rc5", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_DES
-    {FT_cipher, "des-ecb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_DES
-    {FT_cipher, "des-ede", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_DES
-    {FT_cipher, "des-ede3", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_DES
-    {FT_cipher, "des-cbc", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_DES
-    {FT_cipher, "des-ede-cbc", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_DES
-    {FT_cipher, "des-ede3-cbc", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_DES
-    {FT_cipher, "des-cfb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_DES
-    {FT_cipher, "des-ede-cfb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_DES
-    {FT_cipher, "des-ede3-cfb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_DES
-    {FT_cipher, "des-ofb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_DES
-    {FT_cipher, "des-ede-ofb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_DES
-    {FT_cipher, "des-ede3-ofb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_IDEA
-    {FT_cipher, "idea-cbc", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_IDEA
-    {FT_cipher, "idea-ecb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_IDEA
-    {FT_cipher, "idea-cfb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_IDEA
-    {FT_cipher, "idea-ofb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_SEED
-    {FT_cipher, "seed-cbc", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_SEED
-    {FT_cipher, "seed-ecb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_SEED
-    {FT_cipher, "seed-cfb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_SEED
-    {FT_cipher, "seed-ofb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_RC2
-    {FT_cipher, "rc2-cbc", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_RC2
-    {FT_cipher, "rc2-ecb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_RC2
-    {FT_cipher, "rc2-cfb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_RC2
-    {FT_cipher, "rc2-ofb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_RC2
-    {FT_cipher, "rc2-64-cbc", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_RC2
-    {FT_cipher, "rc2-40-cbc", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_BF
-    {FT_cipher, "bf-cbc", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_BF
-    {FT_cipher, "bf-ecb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_BF
-    {FT_cipher, "bf-cfb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_BF
-    {FT_cipher, "bf-ofb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_CAST
-    {FT_cipher, "cast5-cbc", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_CAST
-    {FT_cipher, "cast5-ecb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_CAST
-    {FT_cipher, "cast5-cfb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_CAST
-    {FT_cipher, "cast5-ofb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_CAST
-    {FT_cipher, "cast-cbc", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_RC5
-    {FT_cipher, "rc5-cbc", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_RC5
-    {FT_cipher, "rc5-ecb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_RC5
-    {FT_cipher, "rc5-cfb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_RC5
-    {FT_cipher, "rc5-ofb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_SM4
-    {FT_cipher, "sm4-cbc", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_SM4
-    {FT_cipher, "sm4-ecb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_SM4
-    {FT_cipher, "sm4-cfb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_SM4
-    {FT_cipher, "sm4-ofb", enc_main, enc_options, NULL},
-#endif
-#ifndef OPENSSL_NO_SM4
-    {FT_cipher, "sm4-ctr", enc_main, enc_options, NULL},
-#endif
-    {0, NULL, NULL, NULL, NULL}
-};
@@ -1,123 +0,0 @@
-/*
- * WARNING: do not edit!
- * Generated by apps/progs.pl
- *
- * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-#include "function.h"
-
-extern int asn1parse_main(int argc, char *argv[]);
-extern int ca_main(int argc, char *argv[]);
-extern int ciphers_main(int argc, char *argv[]);
-extern int cms_main(int argc, char *argv[]);
-extern int crl_main(int argc, char *argv[]);
-extern int crl2pkcs7_main(int argc, char *argv[]);
-extern int dgst_main(int argc, char *argv[]);
-extern int dhparam_main(int argc, char *argv[]);
-extern int dsa_main(int argc, char *argv[]);
-extern int dsaparam_main(int argc, char *argv[]);
-extern int ec_main(int argc, char *argv[]);
-extern int ecparam_main(int argc, char *argv[]);
-extern int enc_main(int argc, char *argv[]);
-extern int engine_main(int argc, char *argv[]);
-extern int errstr_main(int argc, char *argv[]);
-extern int fipsinstall_main(int argc, char *argv[]);
-extern int gendsa_main(int argc, char *argv[]);
-extern int genpkey_main(int argc, char *argv[]);
-extern int genrsa_main(int argc, char *argv[]);
-extern int help_main(int argc, char *argv[]);
-extern int info_main(int argc, char *argv[]);
-extern int kdf_main(int argc, char *argv[]);
-extern int list_main(int argc, char *argv[]);
-extern int mac_main(int argc, char *argv[]);
-extern int nseq_main(int argc, char *argv[]);
-extern int ocsp_main(int argc, char *argv[]);
-extern int passwd_main(int argc, char *argv[]);
-extern int pkcs12_main(int argc, char *argv[]);
-extern int pkcs7_main(int argc, char *argv[]);
-extern int pkcs8_main(int argc, char *argv[]);
-extern int pkey_main(int argc, char *argv[]);
-extern int pkeyparam_main(int argc, char *argv[]);
-extern int pkeyutl_main(int argc, char *argv[]);
-extern int prime_main(int argc, char *argv[]);
-extern int provider_main(int argc, char *argv[]);
-extern int rand_main(int argc, char *argv[]);
-extern int rehash_main(int argc, char *argv[]);
-extern int req_main(int argc, char *argv[]);
-extern int rsa_main(int argc, char *argv[]);
-extern int rsautl_main(int argc, char *argv[]);
-extern int s_client_main(int argc, char *argv[]);
-extern int s_server_main(int argc, char *argv[]);
-extern int s_time_main(int argc, char *argv[]);
-extern int sess_id_main(int argc, char *argv[]);
-extern int smime_main(int argc, char *argv[]);
-extern int speed_main(int argc, char *argv[]);
-extern int spkac_main(int argc, char *argv[]);
-extern int srp_main(int argc, char *argv[]);
-extern int storeutl_main(int argc, char *argv[]);
-extern int ts_main(int argc, char *argv[]);
-extern int verify_main(int argc, char *argv[]);
-extern int version_main(int argc, char *argv[]);
-extern int x509_main(int argc, char *argv[]);
-
-extern const OPTIONS asn1parse_options[];
-extern const OPTIONS ca_options[];
-extern const OPTIONS ciphers_options[];
-extern const OPTIONS cms_options[];
-extern const OPTIONS crl_options[];
-extern const OPTIONS crl2pkcs7_options[];
-extern const OPTIONS dgst_options[];
-extern const OPTIONS dhparam_options[];
-extern const OPTIONS dsa_options[];
-extern const OPTIONS dsaparam_options[];
-extern const OPTIONS ec_options[];
-extern const OPTIONS ecparam_options[];
-extern const OPTIONS enc_options[];
-extern const OPTIONS engine_options[];
-extern const OPTIONS errstr_options[];
-extern const OPTIONS fipsinstall_options[];
-extern const OPTIONS gendsa_options[];
-extern const OPTIONS genpkey_options[];
-extern const OPTIONS genrsa_options[];
-extern const OPTIONS help_options[];
-extern const OPTIONS info_options[];
-extern const OPTIONS kdf_options[];
-extern const OPTIONS list_options[];
-extern const OPTIONS mac_options[];
-extern const OPTIONS nseq_options[];
-extern const OPTIONS ocsp_options[];
-extern const OPTIONS passwd_options[];
-extern const OPTIONS pkcs12_options[];
-extern const OPTIONS pkcs7_options[];
-extern const OPTIONS pkcs8_options[];
-extern const OPTIONS pkey_options[];
-extern const OPTIONS pkeyparam_options[];
-extern const OPTIONS pkeyutl_options[];
-extern const OPTIONS prime_options[];
-extern const OPTIONS provider_options[];
-extern const OPTIONS rand_options[];
-extern const OPTIONS rehash_options[];
-extern const OPTIONS req_options[];
-extern const OPTIONS rsa_options[];
-extern const OPTIONS rsautl_options[];
-extern const OPTIONS s_client_options[];
-extern const OPTIONS s_server_options[];
-extern const OPTIONS s_time_options[];
-extern const OPTIONS sess_id_options[];
-extern const OPTIONS smime_options[];
-extern const OPTIONS speed_options[];
-extern const OPTIONS spkac_options[];
-extern const OPTIONS srp_options[];
-extern const OPTIONS storeutl_options[];
-extern const OPTIONS ts_options[];
-extern const OPTIONS verify_options[];
-extern const OPTIONS version_options[];
-extern const OPTIONS x509_options[];
-
-extern FUNCTION functions[];
@@ -92,17 +92,17 @@ EOF

    my %cmd_disabler = (
        ciphers  => "sock",
+        pkcs12   => "des",
        genrsa   => "rsa",
        rsautl   => "rsa",
-        gendh    => "dh",
-        ecparam  => "ec",
-        pkcs12   => "des",
    );
    my %cmd_deprecated = (
        dhparam  => [ "3_0", "pkeyparam", "dh" ],
        dsaparam => [ "3_0", "pkeyparam", "dsa" ],
        dsa      => [ "3_0", "pkey",      "dsa" ],
        gendsa   => [ "3_0", "genpkey",   "dsa" ],
+        ec       => [ "3_0", "pkey",      "ec" ],
+        ecparam  => [ "3_0", "pkeyparam", "ec" ],
    );

    print "FUNCTION functions[] = {\n";
@@ -145,7 +145,7 @@ const OPTIONS x509_options[] = {
    {"extfile", OPT_EXTFILE, '<', "File with X509V3 extensions to add"},
    OPT_R_OPTIONS,
    {"CAform", OPT_CAFORM, 'F', "CA format - default PEM"},
-    {"CAkeyform", OPT_CAKEYFORM, 'f', "CA key format - default PEM"},
+    {"CAkeyform", OPT_CAKEYFORM, 'E', "CA key format - default PEM"},
    {"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"},
    {"CAcreateserial", OPT_CACREATESERIAL, '-',
     "Create serial number file if it does not exist"},
@@ -239,7 +239,7 @@ int x509_main(int argc, char **argv)
                goto opthelp;
            break;
        case OPT_CAKEYFORM:
-            if (!opt_format(opt_arg(), OPT_FMT_ANY, &CAkeyformat))
+            if (!opt_format(opt_arg(), OPT_FMT_PDE, &CAkeyformat))
                goto opthelp;
            break;
        case OPT_OUT: