summaryrefslogtreecommitdiffstats
path: root/doc
AgeCommit message (Collapse)Author
2016-09-21Dcoument -alpn flagRich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 776e15f9393a9e3083bec60a8da376ce2fe1e97e)
2016-09-06Misc BN fixesRich Salz
Never output -0; make "negative zero" an impossibility. Do better checking on BN_rand top/bottom requirements and #bits. Update doc. Ignoring trailing garbage in BN_asc2bn. Port this commit from boringSSL: https://boringssl.googlesource.com/boringssl/+/899b9b19a4cd3fe526aaf5047ab9234cdca19f7d%5E!/ Ensure |BN_div| never gives negative zero in the no_branch code. Have |bn_correct_top| fix |bn->neg| if the input is zero so that we don't have negative zeros lying around. Thanks to Brian Smith for noticing. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 01c09f9fde5793e0b3712d602b02e2aed4908e8d) (Some manual work required)
2016-08-19RT3940: For now, just document the issue.Rich Salz
Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 2a9afa4046592d44af84644cd89fe1a0d6d46889)
2016-08-19Fix NULL-return checks in 1.0.2Rich Salz
RT4386: Add sanity checks for BN_new() RT4384: Missing Sanity Checks for RSA_new_method() RT4384: Missing Sanity Check plus potential NULL pointer deref RT4382: Missing Sanity Check(s) for BUF_strdup() RT4380: Missing Sanity Checks for EVP_PKEY_new() RT4377: Prevent potential NULL pointer dereference RT4375: Missing sanity checks for OPENSSL_malloc() RT4374: Potential for NULL pointer dereferences RT4371: Missing Sanity Check for malloc() RT4370: Potential for NULL pointer dereferences Also expand tabs, make update, typo fix (rsalz) Minor tweak by Paul Dale. Some minor internal review feedback. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-07-22Clarify digest change in HMAC_Init_ex()Dr. Stephen Henson
RT#4603 Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-29Allow proxy certs to be present when verifying a chainRichard Levitte
Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-26RT2964: Fix it via docRich Salz
OBJ_nid2obj() and friends should be treated as const. Reviewed-by: Dr. Stephen Henson <steve@openssl.org> (cherry picked from commit 5d28ff38fd4127c5894d22533e842ee446c3d3c2)
2016-06-25Revert "RT2964: Fix it via doc"Rich Salz
This reverts commit 58b18779ba6e6060ac357cd0803d83317ed00f8b. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-06-25RT2964: Fix it via docRich Salz
OBJ_nid2obj() and friends should be treated as const. Reviewed-by: Dr. Stephen Henson <steve@openssl.org> (cherry picked from commit 82f31fe4dd0dac30229fa8684229b49d2bcef404)
2016-06-22doc/crypto/OPENSSL_ia32cap.pod: harmonize with actual declaration.Andy Polyakov
[Note that in master declaration is different.] RT#4568 Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-06-16RT4573: Synopsis for RAND_add is wrongPauli
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-14RT4546: Backport doc fixRich Salz
Reviewed-by: Matt Caswell <matt@openssl.org> Manual cherry-pick of 538860a3ce0b9fd142a7f1a62e597cccb74475d3.
2016-06-14RT4562: Backport doc fix.Rich Salz
Reviewed-by: Matt Caswell <matt@openssl.org>
2016-06-03Fix documentation error in x509 app certopt flagMatt Caswell
According to the x509 man page in the section discussing -certopt it says that the ca_default option is the same as that used by the ca utility and (amongst other things) has the effect of suppressing printing of the signature - but in fact it doesn't. This error seems to have been present since the documentation was written back in 2001. It never had this effect. The default config file sets the certopt value to ca_default. The ca utility takes that and THEN adds additional options to suppress printing of the signature. So the ca utility DOES suppress printing of the signature - but it is not as a result of using the ca_default option. GitHub Issue #247 Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 39a470088af6f833bd1a912908c44bf4a9f48b0c)
2016-05-31Parameter copy sanity checks.Dr. Stephen Henson
Don't copy parameters is they're already present in the destination. Return error if an attempt is made to copy different parameters to destination. Update documentation. If key type is not initialised return missing parameters RT#4149 Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit f72f00d49549c6620d7101f5e9bf7963da6df9ee)
2016-05-20Revert "Document the esc_2254 command line name option"Richard Levitte
This reverts commit 54fc5795c9f7d0dc95d537672c716c9d250eb0fb. Reviewed-by: Matt Caswell <matt@openssl.org>
2016-05-19Clarify negative return from X509_verify_cert()Viktor Dukhovni
Reviewed-by: Tim Hudson <tjh@openssl.org>
2016-05-18Document the esc_2254 command line name optionRichard Levitte
RT#1466 Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit a37458c1bf76c603cc27e8baf32ac2aa1cd7662e)
2016-05-16Documentation: Clarify sizes for UI_add_input_string()Richard Levitte
The given sizes to not include the final NUL character. RT#2622 Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 727ee8cfeb2893d5aec4a6e571e9adf0667e9135)
2016-05-11Fix i2d_X509_AUX and update docsViktor Dukhovni
When *pp is NULL, don't write garbage, return an unexpected pointer or leak memory on error. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-05-10Typo.Dr. Stephen Henson
RT#4538 Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 981b5bb8efca8a8adbf6a567e3a401c586a694cc)
2016-05-09Fix BIO_eof() for BIO pairsMatt Caswell
BIO_eof() was always returning true when using a BIO pair. It should only be true if the peer BIO is empty and has been shutdown. RT#1215 Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 3105d695358d86c0f2a404b2b74a1870b941ce5e)
2016-05-04add documentationDr. Stephen Henson
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit b1b3e14fbeb373a288ba20402600e071e6f402f8)
2016-05-03Remove some documentation for functions not in 1.0.xMatt Caswell
A few functions in the recently added EVP_EncodeInit docs don't apply to the 1.0.x branches. Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-03Add documentation for EVP_EncodeInit() and similar functionsMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-05-02Issue #719:TJ Saunders
If no serverinfo extension is found in some cases, do not abort the handshake, but simply omit/skip that extension. Check for already-registered serverinfo callbacks during serverinfo registration. Update SSL_CTX_use_serverinfo() documentation to mention the need to reload the same serverinfo per certificate, for servers with multiple server certificates. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
2016-04-04Fix ALPNTodd Short
* Perform ALPN after the SNI callback; the SSL_CTX may change due to that processing * Add flags to indicate that we actually sent ALPN, to properly error out if unexpectedly received. * document ALPN functions * unit tests Backport of commit 817cd0d52f0462039d1fe60462150be7f59d2002 Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
2016-03-07Remove LOW from the defaultKurt Roeckx
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-03-01RT4358: Extra ] in doc/ocsp.podEric S. Raymond
Reviewed-by: Richard Levitte <levitte@openssl.org>
2016-03-01Disable EXPORT and LOW SSLv3+ ciphers by defaultViktor Dukhovni
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-03-01Bring SSL method documentation up to dateViktor Dukhovni
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-02-12RT 3854: Update apps/reqEmilia Kasper
Change the default keysize to 2048 bits, and the minimum to 512 bits. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit a76265574398944d686d2d0de9bacca162f555ca)
2016-02-01GH554: Improve pkeyutl docHubert Kario
Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Dr. Stephen Henson <steve@openssl.org> (cherry picked from commit 53619f9f40740ae8b256998574758aa191635db8)
2016-02-01RT4129: BUF_new_mem_buf should take const void *Daniel Kahn Gillmor
Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Dr. Stephen Henson <steve@openssl.org> (cherry picked from commit 8ab31975bacb9c907261088937d3aa4102e3af84)
2016-01-28Always generate DH keys for ephemeral DH cipher suitesMatt Caswell
Modified version of the commit ffaef3f15 in the master branch by Stephen Henson. This makes the SSL_OP_SINGLE_DH_USE option a no-op and always generates a new DH key for every handshake regardless. CVE-2016-0701 (fix part 2 or 2) Issue reported by Antonio Sanso Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2016-01-10File is about s_time, not s_clientKurt Roeckx
Reviewed-by: Dr. Stephen Henson <steve@openssl.org> (cherry picked from commit 1918e01c9f915e2eba31a5e2f86f0a5daa4fafb6)
2015-12-27Add some documentation for the OCSP callback functionsMatt Caswell
Describe the usage of the OCSP callback functions on both the client and the server side. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
2015-12-23The functions take a SSL *, not a SSL_CTX *Daniel Kahn Gillmor
Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> RT: #4192, MR: #1533 (cherry picked from commit d938e8dfee16e6bb5427eac7bda32337634ce130)
2015-12-19Document how BIO_get_conn_ip and BIO_get_conn_int_port actually workRichard Levitte
No dummy arguments. Reviewed-by: Rich Salz <rsalz@openssl.org>
2015-11-04Minor EVP_SignInit_ex doc fixMatt Caswell
EVP_SignInit_ex was missing from the NAME section of its man page so typing "man EVP_SignInit_ex" failed to load the page. Reviewed-by: Stephen Henson <steve@openssl.org> (cherry picked from commit 3d866ea67e8b19777e88ac2a78ee4188e0983168)
2015-10-23Fix typosAlessandro Ghedini
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit d900a015b5a89ea2018e6122dd2738925e4d68ab)
2015-10-22Clarify return values for EVP_DigestVerifyFinal.Adam Eijdenberg
Previous language was unclear. New language isn't pretty but I believe it is more accurate. Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 8cbb048c3ea416f2bd8a3706d027f3aa26ef08d9)
2015-09-29GH367: use random data if seed too short.Ismo Puustinen
Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Emilia Käsper <emilia@openssl.org>
2015-09-22Document BUF_strnlenEmilia Kasper
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 21b0fa91186ff1c1c3d956c0593ef4ac02521695)
2015-09-22BUF_strdup and friends: update docsEmilia Kasper
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 58e3457a82e8940ff36b36949f9c7a60e7614b2c)
2015-09-18This undoes GH367 for non-masterRich Salz
Was only approved for master, to avoid compatibility issues on previous releases. Reviewed-by: Emilia Käsper <emilia@openssl.org>
2015-09-11Use default field separator.Dr. Stephen Henson
If the field separator isn't specified through -nameopt then use XN_FLAG_SEP_CPLUS_SPC instead of printing nothing and returing an error. PR#2397 Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 03706afa30aeb4407287171a9d6f9a765395d0a2)
2015-09-01RT3767: openssl_button.gif should be PNGRich Salz
No, we should just delete it. And updated the README Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 8db78781069697cfa30a2261413f33f5055a2838)
2015-08-31GH367 follow-up, for more clarityBen Kaduk
Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 36ac7bc8a9c856bcdff6eecdaca128ccc5430a1e)
2015-08-31Remove auto-fill-modeRichard Levitte
Apparently, emacs sees changes to auto-fill-mode as insecure Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 6dc08048d93ff35de882878f190ae49aa698b5d2)
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-06 08:11:55 +0000