summaryrefslogtreecommitdiffstats
path: root/doc/man3
AgeCommit message (Collapse)Author
2021-02-11X509_STORE_CTX_cleanup(): Use internally so no need to call explicitlyDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14088)
2021-02-10Handle partial data re-sending on ktls/sendfile on FreeBSDOleksandr Tymoshenko
Add a handler for EBUSY sendfile error in addition to EAGAIN. With EBUSY returned the data still can be partially sent and user code has to be notified about it, otherwise it may try to send data multiple times. Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13716)
2021-02-10Replace provider digest flags with separate param fieldsShane Lontis
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13830)
2021-02-10Replace MAC flags OSSL_MAC_PARAM_FLAGS with separate param fields.Shane Lontis
Fixes #12992 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13830)
2021-02-09x509_vfy.c: Sort out return values 0 vs. -1 (failure/internal error)Dr. David von Oheimb
Also simplify first part of verify_chain() Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14095)
2021-02-09x509_vfy: Clarify relevance of ctx->error also on successful verificationDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14127)
2021-02-09x509_vfy.c: Fix various coding style and documentation style nitsDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14127)
2021-02-09CHANGES.md: Mention RSA key generation slowdown related changesTomas Mraz
Fixes #14068 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14073)
2021-02-09Deprecate BN_pseudo_rand() and BN_pseudo_rand_range()Tomas Mraz
The functions are obsolete aliases for BN_rand() and BN_rand_range() since 1.1.0. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14080)
2021-02-09Enhanced integer parsing in OSSL_PARAM_allocate_from_textPetr Gotthard
Fixes #14041 and additional bugs discovered by the newly created tests. This patch: - Introduces support for 0x prefixed integers - Fixes parsing of negative integers (negative numbers were shifted by -2) - Fixes ability to parse maximal unsigned numbers ("too small buffer" error used to be reported incorrectly) - Fixes a memory leak when OSSL_PARAM_allocate_from_text fails leaving a temporary BN allocated Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14093)
2021-02-08Simplify the EVP_PKEY_XXX_fromdata_XX methods.Shane Lontis
The existing names such as EVP_PKEY_param_fromdata_settable were a bit confusing since the 'param' referred to key params not OSSL_PARAM. To simplify the interface a 'selection' parameter will be passed instead. The changes are: (1) EVP_PKEY_fromdata_init() replaces both EVP_PKEY_key_fromdata_init() and EVP_PKEY_param_fromdata_init(). (2) EVP_PKEY_fromdata() has an additional selection parameter. (3) EVP_PKEY_fromdata_settable() replaces EVP_PKEY_key_fromdata_settable() and EVP_PKEY_param_fromdata_settable(). EVP_PKEY_fromdata_settable() also uses a selection parameter. Fixes #12989 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14076)
2021-02-06Add X509_STORE_CTX_verify(), which takes the first untrusted cert as default ↵Dr. David von Oheimb
target Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14021)
2021-02-05EVP: Adapt EVP_PKEY_{set1,get1}_encoded_public_key()Richard Levitte
These functions are modified to use EVP_PKEY_set_octet_string_param() and EVP_PKEY_get_octet_string_param() instead of evp_keymgmt_set_params() and evp_keymgmt_get_params(). To accomplish this fully, EVP_PKEY_get_octet_string_param() is changed slightly to populate |*out_sz| with the return size, even if getting the params resulted in an error. We also modify EVP_PKEY_get_utf8_string_param() to match EVP_PKEY_get_octet_string_param() Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14056)
2021-02-05EVP: Modify the checks in EVP_PKEY_{set,get}_xxx_param() functionsRichard Levitte
The checks of the type of EVP_PKEY were from before we had the macro evp_pkey_is_provided(). Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14056)
2021-02-05EVP: Adapt the other EVP_PKEY_set_xxx_param() functionsRichard Levitte
They were calling evp_keymgmt_set_params() directly. Those calls are changed to go through EVP_PKEY_set_params(). We take the opportunity to constify these functions. They have to unconstify internally for the compiler to stop complaining when placing those pointers in an OSSL_PARAM element, but that's still better than forcing the callers to do that cast. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14056)
2021-02-04Allow NULL arg to OPENSSL_sk_{dup,deep_copy} returning empty stackDr. David von Oheimb
This simplifies many usages Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14040)
2021-02-03Deprecate EVP_MD_CTX_{set_}update_fn()Rich Salz
They are still used internally in legacy code. Also fixed up some minor things in EVP_DigestInit.pod Fixes: #14003 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14008)
2021-02-02OSSL_HTTP_REQ_CTX.pod and OSSL_HTTP_transfer.pod: various improvementsDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13960)
2021-02-02Constify OSSL_HTTP_REQ_CTX_get0_mem_bio()Dr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13960)
2021-02-02HTTP: Fix mistakes and unclarities on maxline and max_resp_len paramsDr. David von Oheimb
Also rename internal structure fields iobuf(len) to readbuf(len) for clarity Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13960)
2021-02-02Fix not backwards-compat X509_http_nbio() and X509_CRL_http_nbio()Dr. David von Oheimb
Provides partial fix of #13127. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13960)
2021-01-28EVP: fix keygen for EVP_PKEY_RSA_PSSDaniel Bevenius
This commit attempts to fix the an issue when generating a key of type EVP_PKEY_RSA_PSS. Currently, EVP_PKEY_CTX_set_rsa_keygen_bits will return -1 if the key id is not of type EVP_PKEY_RSA. This commit adds EVP_PKEY_RSA_PSS to also be accepted. The macro EVP_PKEY_CTX_set_rsa_pss_keygen_md si converted into a function and it is now called in legacy_ctrl_to_param. Fixes #12384 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13099)
2021-01-28Update copyright yearRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13999)
2021-01-27Fix OSSL_PARAM_allocate_from_text() for EBCDICRichard Levitte
OSSL_PARAM_allocate_from_text() converted text values to UTF-8 OSSL_PARAMs with a simple strncpy(). However, if the text is EBCDIC, that won't become UTF-8. Therefore, it's made to convert from EBCDIC to ASCII on platforms where the native character encoding is the former. One might argue that the conversion should be the responsibility of the application. However, this is a helper function, and the calling application can't easily know what sort of OSSL_PARAM the input values are going to be used for. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13961)
2021-01-26TLS client: allow cert verify callback return -1 for SSL_ERROR_WANT_RETRY_VERIFYDr. David von Oheimb
The client-side cert verification callback function may not only return as usual for success or 0 for failure, but also -1, typically on failure verifying the server certificate. This makes the handshake suspend and return control to the calling application with SSL_ERROR_WANT_RETRY_VERIFY. The app can for instance fetch further certificates or cert status information needed for the verification. Calling SSL_connect() again resumes the connection attempt by retrying the server certificate verification step. This process may even be repeated if need be. The core implementation of the feature is in ssl/statem/statem_clnt.c, splitting tls_process_server_certificate() into a preparation step that just copies the certificates received from the server to s->session->peer_chain (rather than having them in a local variable at first) and returns to the state machine, and a post-processing step in tls_post_process_server_certificate() that can be repeated: Try verifying the current contents of s->session->peer_chain basically as before, but give the verification callback function the chance to pause connecting and make the TLS state machine later call tls_post_process_server_certificate() again. Otherwise processing continues as usual. The documentation of the new feature is added to SSL_CTX_set_cert_verify_callback.pod and SSL_want.pod. This adds two tests: * A generic test in test/helpers/handshake.c on the usability of the new server cert verification retry feature. It is triggered via test/ssl-tests/03-custom_verify.cnf.in (while the bulky auto- generated changes to test/ssl-tests/03-custom_verify.cnf can be basically ignored). * A test in test/sslapitest.c that demonstrates the effectiveness of the approach for augmenting the cert chain provided by the server in between SSL_connect() calls. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13906)
2021-01-26params: OSSL_PARAM_utf8_ptr: don't automatically reference `address`Daiki Ueno
Since the pointer can be later be modified, the caller should have the responsibility to supply the address of that. Signed-off-by: Daiki Ueno <dueno@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13951)
2021-01-26DOC: Fix a few minor issues in OSSL_ENCODER / OSSL_DECODER docsRichard Levitte
Partially fixes #13949 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13954)
2021-01-26EVP_PKEY_get_group_name works with public keys as wellTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
2021-01-26Add manpage for EVP_PKEY_get_field_type and EVP_PKEY_get_point_conv_formTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
2021-01-26Deprecate EC_KEY + Update ec apps to use EVP_PKEYShane Lontis
Co-author: Richard Levitte <levitte@openssl.org> Co-author: Tomas Mraz <tmraz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
2021-01-26Add functions to set values into an EVP_PKEYShane Lontis
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13139)
2021-01-23OCSP HTTP: Restore API of undocumented and recently deprecated functionsDr. David von Oheimb
Restore parameters of OCSP_REQ_CTX_new(), OCSP_REQ_CTX_http(), OCSP_REQ_CTX_i2d(). Fix a bug (wrong HTTP method selected on req == NULL in OCSP_sendreq_new(). Minor further fixes in OSSL_HTTP_REQ_CTX.pod Fixes #13873 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13898)
2021-01-23OSSL_HTTP_REQ_CTX.pod: minor addition and remove redundant paragraphDr. David von Oheimb
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13898)
2021-01-23OSSL_HTTP_REQ_CTX_new(): replace method_GET parameter by method_POSTDr. David von Oheimb
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13898)
2021-01-23rename OSSL_HTTP_REQ_CTX_header to OSSL_HTTP_REQ_CTX_set_request_lineDr. David von Oheimb
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13898)
2021-01-21CMP: Allow PKCS#10 input also for ir, cr, kur, and rr messagesDr. David von Oheimb
Also update documentation regarding sources of certs and keys, improve type of OSSL_CMP_exec_RR_ses(), add tests for CSR-based cert revocation Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13841)
2021-01-21Deprecate EVP_KEY_new_CMAC_key and EVP_PKEY_new_CMAC_key_exRich Salz
EVP_KEY_new_CMAC_key_ex was in the pre-release 3.0 only, so is safe to remove. Restore 1.1.1 version of EVP_PKEY_new_CMAC_key documentation. Also make testing of EVP_PKEY_new_CMAC_key properly #ifdef'd. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13829)
2021-01-20X509v3_get_ext_by_NID.pod: Add warning on counter-intuitive behavior of ↵Dr. David von Oheimb
X509v3_delete_ext() etc. Also simplify two uses of these functions. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13711)
2021-01-20ASN1_TIME_print() etc.: Improve doc and add comment on handling invalid time ↵Dr. David von Oheimb
input Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13714)
2021-01-19Deprecate OCSP_xxx API for OSSL_HTTP_xxxRich Salz
Deprecations made: OCSP_REQ_CTX typedef->OSSL_HTTP_REQ_CTX OCSP_REQ_CTX_new->OSSL_HTTP_REQ_CTX_new OCSP_REQ_CTX_free->OSSL_HTTP_REQ_CTX_free OCSP_REQ_CTX_http-> OSSL_HTTP_REQ_CTX_header OCSP_REQ_CTX_add1_header->OSSL_HTTP_REQ_CTX_add1_header OCSP_REQ_CTX_i2d->OSSL_HTTP_REQ_CTX_i2d OCSP_REQ_CTX_get0_mem_bio->OSSL_HTTP_REQ_CTX_get0_mem_bio OCSP_set_max_response_length->OSSL_HTTP_REQ_CTX_set_max_response_length OCSP_REQ_CTX_nbio_d2i->OSSL_HTTP_REQ_CTX_sendreq_d2i OCSP_REQ_CTX_nbio->OSSL_HTTP_REQ_CTX_nbio Made some editorial changes to man3/OCSP_sendreq.pod; move the NOTES text inline. Some of the original functions had no documentation: OCSP_REQ_CTX_new, OCSP_REQ_CTX_http, OCSP_REQ_CTX_get0_mem_bio, OCSP_REQ_CTX_nbio_d2i, and OCSP_REQ_CTX_nbio. Their new counterparts are now documented in doc/man3/OSSL_HTTP_REQ_CTX.pod Fixes #12234 Co-authored-by: Richard Levitte <levitte@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13742)
2021-01-18Rename EVP_CIPHER_CTX_get_iv and EVP_CIPHER_CTX_get_iv_state for clarityTomas Mraz
To clarify the purpose of these two calls rename them to EVP_CIPHER_CTX_get_original_iv and EVP_CIPHER_CTX_get_updated_iv. Also rename the OSSL_CIPHER_PARAM_IV_STATE to OSSL_CIPHER_PARAM_UPDATED_IV to better align with the function name. Fixes #13411 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13870)
2021-01-15Document openssl thread-safetyRich Salz
Also discuss reference-counting, mutability and safety. Thanks to David Benjamin for pointing to comment text he added to boringSSL's header files. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13788)
2021-01-14Enhance default provider documentationMichael Baentsch
Bring Wiki and man page documentation in line regarding default provider fall-back behaviour. Fixes #13844 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13859)
2021-01-14Enable locking on the primary DRBG when we create itMatt Caswell
The primary DRBG may be shared across multiple threads and therefore we must use locking to access it. Previously we were enabling that locking lazily when we attempted to obtain one of the child DRBGs. Part of the process of enabling the lock, is to create the lock. But if we create the lock lazily then it is too late - we may race with other threads where each thread is independently attempting to enable the locking. This results in multiple locks being created - only one of which "sticks" and the rest are leaked. Instead we enable locking on the primary when we first create it. This is already locked and therefore we cannot race. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13660)
2021-01-14Make the OSSL_CMP manual conform with man-pages(7)Richard Levitte
Details from man-pages(7) that are used: Formatting conventions for manual pages describing functions ... Variable names should, like argument names, be specified in italics. ... Formatting conventions (general) ... Special macros, which are usually in uppercase, are in bold. Exception: don't boldface NULL. ... Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13846)
2021-01-13Make header references conform with man-pages(7) in all manualsRichard Levitte
Details from man-pages(7) that are used: Formatting conventions (general) ... Filenames (whether pathnames, or references to header files) are always in italics (e.g., <stdio.h>), except in the SYNOPSIS section, where in‐ cluded files are in bold (e.g., #include <stdio.h>). When referring to a standard header file include, specify the header file surrounded by angle brackets, in the usual C way (e.g., <stdio.h>). ... Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13843)
2021-01-13Make the OSSL_trace manual conform with man-pages(7)Richard Levitte
Details from man-pages(7) that are used: Formatting conventions for manual pages describing functions ... Variable names should, like argument names, be specified in italics. ... Formatting conventions (general) ... Special macros, which are usually in uppercase, are in bold. Exception: don't boldface NULL. ... Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13842)
2021-01-13Make the OSSL_PROVIDER manual conform with man-pages(7)Richard Levitte
Details from man-pages(7) that are used: Formatting conventions for manual pages describing functions ... Variable names should, like argument names, be specified in italics. ... Formatting conventions (general) ... Special macros, which are usually in uppercase, are in bold. Exception: don't boldface NULL. ... Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13845)
2021-01-13Make the OSSL_HTTP manual conform with man-pages(7)Richard Levitte
Details from man-pages(7) that are used: Formatting conventions for manual pages describing functions ... Variable names should, like argument names, be specified in italics. ... Formatting conventions (general) ... Special macros, which are usually in uppercase, are in bold. Exception: don't boldface NULL. ... Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13847)
2021-01-13Make the OSSL_SELF_TEST manual conform with man-pages(7)Richard Levitte
Details from man-pages(7) that are used: Formatting conventions for manual pages describing functions ... Variable names should, like argument names, be specified in italics. ... Formatting conventions (general) ... Special macros, which are usually in uppercase, are in bold. Exception: don't boldface NULL. ... Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13849)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-08 04:20:37 +0000