summaryrefslogtreecommitdiffstats
path: root/doc/man3
AgeCommit message (Collapse)Author
2021-12-11Fix faulty detail in BN_rand() manualRichard Levitte
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17131)
2021-12-09OBJ_nid2obj.pod: Replace remaining 'B<' by 'I<' were appropriateDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17221)
2021-12-07Fix documentation for tlsext_ticket_keyMatt Caswell
The tlsext_ticket_key functions are documented as returning 0 on success. In fact they return 1 on success. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17210) (cherry picked from commit b0be101326f369f0dd547556d2f3eb3ef5ed0e33)
2021-12-03BIO_f_ssl.pod: Make clear where an SSL BIOs are expected as an argumentDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17135)
2021-11-26BIO_push.pod: fix confusing text and add details on corner casesDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17086) (cherry picked from commit 7a37fd09a8f3607ed8acf55e03479861595be069)
2021-11-24Clarify and correct the EVP_CTRL_AEAD_SET_TAG docsMatt Caswell
The restriction about setting a tag length prior to setting the IV only applies to OCB mode. We clarify when in the process EVP_CTRL_AEAD_SET_TAG can be called. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17111) (cherry picked from commit 3607b8ad8ee1980a079e985333a196e0c79f8f00)
2021-11-23DOC: Add a few previously documented functionsRichard Levitte
d2i_X509_bio(), d2i_X509_fp(), i2d_X509_bio(), and i2d_X509_fp() were documented in OpenSSL 1.0.2. In a grand unification of the documentation of (almost) all d2i and i2d functions, these were dropped, most likely by mistake. This simply adds them back. Fixes #17091 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17093)
2021-10-22Fix some documentation errors related to return valuesPW Hu
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16794) (cherry picked from commit f1d077f1108b1bc2334350a4d53a46e29e082910)
2021-09-30doc/man3/SSL_set_fd.pod: add note about Windows compiler warningDr. Matthias St. Pierre
According to an old stackoverflow thread [1], citing an even older comment by Andy Polyakov (1875e6db29, Pull up Win64 support from 0.9.8., 2005-07-05), a cast of 'SOCKET' (UINT_PTR) to 'int' does not create a problem, because although the documentation [2] claims that the upper limit is INVALID_SOCKET-1 (2^64 - 2), in practice the socket() implementation on Windows returns an index into the kernel handle table, the size of which is limited to 2^24 [3]. Add this note to the manual page to avoid unnecessary roundtrips to StackOverflow. [1] https://stackoverflow.com/questions/1953639/is-it-safe-to-cast-socket-to-int-under-win64 [2] https://docs.microsoft.com/en-us/windows/win32/winsock/socket-data-type-2 [3] https://docs.microsoft.com/en-us/windows/win32/sysinfo/kernel-objects Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16699) (cherry picked from commit f8dd5869bca047a23599ac925aace70efcf487ad)
2021-09-17Correct the documentation for SSL_set_num_tickets()Matt Caswell
The behaviour for what happens in a resumption connection was not quite described correctly. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16582) (cherry picked from commit 4603b782e6dbed493d2f38db111abc05df66fb99)
2021-09-17Clarify what SSL_get_session() does on the server side in TLSv1.3Matt Caswell
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16582) (cherry picked from commit 9e51f877930dbd4216438a5da3c9612bf4d0a918)
2021-08-24Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2021-08-05[doc/man3] documentation: BN_cmp manpage updatesBilly Brumley
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/16214) (cherry picked from commit 3d4ca443b4778e3230ff23f17625f58f815a9142)
2021-07-01doc: Mention the update of der data pointers in d2i/i2dTomas Mraz
Fixes #15958 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15973)
2021-04-01Remove unnecessary BIO_do_handshake()sNan Xiao
Since BIO_do_connect() and BIO_do_handshake() are same, no need to invoke BIO_do_handshake() once more after BIO_do_connect(). Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14725) (cherry picked from commit 975e37cd016f86985d16f1ee646e88213494854a)
2021-03-30Fix typo in BIO_push.podNan Xiao
CLA: trivial Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14718) (cherry picked from commit 2db9bef264ba39e173d6b6a3a800595e15eef31b)
2021-02-16Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2021-01-14X509_cmp(): Fix comparison in case x509v3_cache_extensions() failed to due ↵Dr. David von Oheimb
to invalid cert This is the backport of #13755 to v1.1.1. Fixes #13698 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13756)
2021-01-10[crypto/dh] side channel hardening for computing DH shared keys (1.1.1)Billy Brumley
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13772)
2020-12-18Document OCSP_REQ_CTX_i2d.Rich Salz
This is a backport of the documentation from #13620. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13691)
2020-12-09Fix typo in OPENSSL_malloc.podNan Xiao
CLA: trivial Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13632) (cherry picked from commit 74c8dd1c516c7017477a205fd1f5f975cfa86722)
2020-12-03x509_vfy.c: Restore rejection of expired trusted (root) certificateDr. David von Oheimb
The certificate path validation procedure specified in RFC 5280 does not include checking the validity period of the trusted (root) certificate. Still it is common good practice to perform this check. Also OpenSSL did this until version 1.1.1h, yet commit e2590c3a162eb118c36b09c2168164283aa099b4 accidentally killed it. The current commit restores the previous behavior. It also removes the cause of that bug, namely counter-intuitive design of the internal function check_issued(), which was complicated by checks that actually belong to some other internal function, namely find_issuer(). Moreover, this commit adds a regression check and proper documentation of the root cert validity period check feature, which had been missing so far. Fixes #13471 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13585)
2020-11-05Correct description of BN_mask_bitsT.Yanagisawa
CLA: trivial Correct right shift to left shift. Pseudo code `a&=~((~0)>>n)` means "get higher n-bits of a", but actually crypto lib gives lower n-bits. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12727) (cherry picked from commit b6ef3c7089e887427cde8c550e28211dc0c22dd1)
2020-09-22Update copyright yearMatt Caswell
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/12949)
2020-09-21Add const to 'ppin' function parameterolszomal
CLA: trivial Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> GH: #12205 (cherry picked from commit 434343f896a2bb3e5857cc9831c38f8cd1cceec1)
2020-09-21EC_KEY: add EC_KEY_decoded_from_explicit_params()Tomas Mraz
The function returns 1 when the encoding of a decoded EC key used explicit encoding of the curve parameters. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12909)
2020-07-24Fix typos and repeated wordsGustaf Neumann
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/12370)
2020-07-24Update EVP_EncodeInit.podRead Hughes
Fix EVP_EncodeBlock description using incorrect parameter name for encoding length CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12518) (cherry picked from commit 1660c8fa6be2d7c4587e490c88a44a870e9b4298)
2020-07-22Avoid errors with a priori inapplicable protocol boundsViktor Dukhovni
The 'MinProtocol' and 'MaxProtocol' configuration commands now silently ignore TLS protocol version bounds when configurign DTLS-based contexts, and conversely, silently ignore DTLS protocol version bounds when configuring TLS-based contexts. The commands can be repeated to set bounds of both types. The same applies with the corresponding "min_protocol" and "max_protocol" command-line switches, in case some application uses both TLS and DTLS. SSL_CTX instances that are created for a fixed protocol version (e.g. TLSv1_server_method()) also silently ignore version bounds. Previously attempts to apply bounds to these protocol versions would result in an error. Now only the "version-flexible" SSL_CTX instances are subject to limits in configuration files in command-line options. Expected to resolve #12394 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> GH: #12507
2020-07-20man3: Drop warning about using security levels higher than 1.Dimitri John Ledkov
Today, majority of web-browsers reject communication as allowed by the security level 1. Instead key sizes and algorithms from security level 2 are required. Thus remove the now obsolete warning against using security levels higher than 1. For example Ubuntu, compiles OpenSSL with security level set to 2, and further restricts algorithm versions available at that security level. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/12444) (cherry picked from commit 02e14a65fd6cc63204b43a79d510e95a63bdd901)
2020-07-17doc: Fix documentation of EVP_EncryptUpdate().Pauli
The documentation was off by one for the length this function could return. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12435) (cherry picked from commit 3fc164e8d18dcdef57d297956debf8d966e7fbef)
2020-07-16x509_vfy.c: Improve key usage checks in internal_verify() of cert chainsDr. David von Oheimb
If a presumably self-signed cert is last in chain we verify its signature only if X509_V_FLAG_CHECK_SS_SIGNATURE is set. Upon this request we do the signature verification, but not in case it is a (non-conforming) self-issued CA certificate with a key usage extension that does not include keyCertSign. Make clear when we must verify the signature of a certificate and when we must adhere to key usage restrictions of the 'issuing' cert. Add some comments for making internal_verify() easier to understand. Update the documentation of X509_V_FLAG_CHECK_SS_SIGNATURE accordingly. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12357)
2020-07-16Fix issue 1418 by moving check of KU_KEY_CERT_SIGN and weakening check_issued()Dr. David von Oheimb
Move check that cert signing is allowed from x509v3_cache_extensions() to where it belongs: internal_verify(), generalize it for proxy cert signing. Correct and simplify check_issued(), now checking self-issued (not: self-signed). Add test case to 25-test_verify.t that demonstrates successful fix. As prerequisites, this adds the static function check_sig_alg_match() and the internal functions x509_likely_issued() and x509_signing_allowed(). This is a backport of the core of PR #10587. Fixes #1418 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12357)
2020-07-09improve SSL_CTX_set_tlsext_ticket_key_cb ref implGlenn Strauss
improve reference implementation code in SSL_CTX_set_tlsext_ticket_key_cb man page change EVP_aes_128_cbc() to EVP_aes_256_cbc(), with the implication of requiring longer keys. Updating this code brings the reference implementation in line with implementation in openssl committed in 2016: commit 05df5c20 Use AES256 for the default encryption algorithm for TLS session tickets add comments where user-implementation is needed to complete code (backport from https://github.com/openssl/openssl/pull/12063) Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12391)
2020-07-02doc: remove reference to the predecessor of SHA-1.Pauli
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12322) (cherry picked from commit 69f982679ec0c8887a4324d8518a33808fee1cd7)
2020-06-30Fix a typo on the SSL_dup pageMatt Caswell
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12245)
2020-06-30Don't attempt to duplicate the BIO state in SSL_dupMatt Caswell
SSL_dup attempted to duplicate the BIO state if the source SSL had BIOs configured for it. This did not work. Firstly the SSL_dup code was passing a BIO ** as the destination argument for BIO_dup_state. However BIO_dup_state expects a BIO * for that parameter. Any attempt to use this will either (1) fail silently, (2) crash or fail in some other strange way. Secondly many BIOs do not implement the BIO_CTRL_DUP ctrl required to make this work. Thirdly, if rbio == wbio in the original SSL object, then an attempt is made to up-ref the BIO in the new SSL object - even though it hasn't been set yet and is NULL. This results in a crash. This appears to have been broken for a very long time with at least some of the problems described above coming from SSLeay. The simplest approach is to just remove this capability from the function. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12245)
2020-06-30Update the SSL_dup documentation to match realityMatt Caswell
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12245)
2020-06-26doc/man3: fix types taken by HMAC(), HMAC_Update()pedro martelletto
HMAC() and HMAC_Update() take size_t for 'n' and 'len' respectively. CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12264) (cherry picked from commit cc63865f336e0144f8501aa0a862ba0247a50622)
2020-06-19Make it clear that you can't use all ciphers for CMACMatt Caswell
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12107)
2020-06-16CMS_get0_signers() descriptionolszomal
CLA: trivial Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12055) (cherry picked from commit 9ac916c7529a21cd01d1b539362abf8402719e30)
2020-06-13doc: Random spellcheckingSebastian Andrzej Siewior
A little spell checking. Backport of commit af0d413654d19 ("doc: Random spellchecking") Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <paul.dale@oracle.com> GH: #12075
2020-06-05Fix a typo in SSL_CTX_set_session_ticket_cb.podBenjamin Kaduk
"SSL" takes two esses, not three. [skip ci] Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12038) (cherry picked from commit 09527c493596060544bda92ecd0d8ef40a366c5e)
2020-06-02fix a docs typoJack O'Connor
Correct "EC_KEY_point2buf" to "EC_POINT_point2buf". The former does not exist. CLA: trivial Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11988) (cherry picked from commit a5a87011baeef71c86938a2bae54f89fbe99e5dc)
2020-05-28EVP_EncryptInit.pod: fix examplePatrick Steuer
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11976) (cherry picked from commit d561b84143f5e7956454090e15de0c5e1425ceac)
2020-05-25Fix B<..> vs. I<..> and add two remarks in OSSL_STORE_open.podDr. David von Oheimb
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11912)
2020-05-25Allow NULL arg to OSSL_STORE_close()Dr. David von Oheimb
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11912)
2020-05-19Update early data exchange scenarios in docraja-ashok
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/11816) (cherry picked from commit b2a5001d954e81e2a582f2a935212ab554a3cbbe)
2020-05-19Update limitation of psk_client_cb and psk_server_cb in usage with TLSv1.3raja-ashok
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/11816) (cherry picked from commit e0bcb4f97f7496af032013ead15b7472b60e85fa)
2020-05-05Improve SSL_shutdown documentation.Kurt Roeckx
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/11531) (cherry picked from commit e307e616f25a6b7b0f343fc1e62a35b2cba888f3)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-25 05:09:11 +0000