summaryrefslogtreecommitdiffstats
path: root/doc
AgeCommit message (Collapse)Author
2022-01-03pem_password_cb: Clarify the documentation on passphrasesTomas Mraz
Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/17320) (cherry picked from commit 5b5342e04ff24d5138c054c1677c32729d47e938)
2021-12-28document additional stack push error codeMichael Baentsch
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17350)
2021-12-24permitting no/empty digest in core_obj_add_sigid for openssl-3.0Michael Baentsch
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17327)
2021-12-22HTTP client: Fix cleanup of TLS BIO via 'bio_update_fn' callback functionDr. David von Oheimb
Make app_http_tls_cb() tidy up on disconnect the SSL BIO it pushes on connect. Make OSSL_HTTP_close() respect this. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17318) (cherry picked from commit cdaf072f90399efb9e8e19ee4f387d1425f12274)
2021-12-15APPS/cmp: Fix logic and doc of mutually exclusive ↵Dr. David von Oheimb
-server/-use_mock_srv/-port/-rspin options Ignore -server with -rspin and exclude all of -use_mock_srv/-port/-rspin. On the other hand, -server is required if no -use_mock_srv/-port/-rspin is given. Ignore -tls_used with -use_mock_srv and -rspin; it is not supported with -port. If -server is not given, ignore -proxy, -no_proxy, and -tls_used. Also slightly improve the documentation of the two mock server variants. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17254) (cherry picked from commit a56bb5d64e7599140117f935eeeb34ba94c83aea)
2021-12-14Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2021-12-13Enhance the explanation of selector bits in provider-keymgmt(7)Richard Levitte
This uncovers what has been a mere comment in an attempt to clarify that the use of selector bits is very much at the discretion of the provider implementation. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16765) (cherry picked from commit e67254e4c3d82b1b8f5102bc4a0e7914f0b87ef0)
2021-12-13Fix EVP_PKEY_eq() to be possible to use with strictly private keysRichard Levitte
EVP_PKEY_eq() assumed that an EVP_PKEY always has the public key component if it has a private key component. However, this assumption no longer strictly holds true, at least for provider backed keys. EVP_PKEY_eq() therefore needs to be modified to specify that the private key should be checked too (at the discretion of what's reasonable for the implementation doing the actual comparison). Fixes #16267 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16765) (cherry picked from commit f3ba62653815b2f7991103cdbea1ac155c8c916a)
2021-12-11Fix faulty detail in BN_rand() manualRichard Levitte
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17131)
2021-12-10changes opensssl typos to opensslSam Eaton
CLA: trivial Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17191) (cherry picked from commit 44fde441937fc8db8ea6a7ac2e7c683ad9d5f8e0)
2021-12-09APPS/cmp: Fix use of OPENSSL_NO_SOCK: options like -server do not make sense ↵Dr. David von Oheimb
with no-sock Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17226) (cherry picked from commit 83b424c3f60a4401fa3e6e41ff7f08e85ee9df94)
2021-12-07Fix documentation for tlsext_ticket_keyMatt Caswell
The tlsext_ticket_key functions are documented as returning 0 on success. In fact they return 1 on success. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17210) (cherry picked from commit b0be101326f369f0dd547556d2f3eb3ef5ed0e33)
2021-12-07X509V3_set_ctx(): Clarify subject/req parameter for constructing SAN email ↵Dr. David von Oheimb
addresses from subject DN Also slightly improve the style of the respective code in crypto/x509/v3_san.c. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17145) (cherry picked from commit 317acac5cc0a2cb31bc4b91353c2b752a3989d8a)
2021-12-07X509V3_set_ctx(): Clarify use of subject/req parameter for constructing SKID ↵Dr. David von Oheimb
by hash of pubkey This does not change the semantics of expected usage because only either one may be given. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17145) (cherry picked from commit 15ac84e603678140ba32832c288e5f1745a258f8)
2021-12-07OSSL_HTTP_open(): clarify doc of 'server' arg and its use of BIO_new_connect()Dr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17186) (cherry picked from commit 119f8145c3bde29aae5d5b18c44d1663df975ef5)
2021-12-07OSSL_HTTP_open(): Complete documentation of checks for server and proxy argsDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17186) (cherry picked from commit 59b6b5a94f5a5f756aa323d1fb061697ca9eadf8)
2021-12-07OSSL_HTTP_set1_request(): Fix check for presence of port option and its ↵Dr. David von Oheimb
documentation For HTTP (not HTTPS) with proxy, server must be given, port is optional Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17186) (cherry picked from commit 266383b44c4ebce5ddf551547e73ab6eec47805b)
2021-12-07OBJ_obj2txt(): fix off-by-one documentation of the resultDr. David von Oheimb
This backports the doc improvements of #17188. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17189)
2021-12-06Clarify the deprecation warnings in the docsMatt Caswell
There was recently an instance where a user was confused by the deprecation warnings in the docs. They believed the warning applied to the immediately preceding function declarations, when it fact it applied to the following function declarations. https://mta.openssl.org/pipermail/openssl-users/2021-December/014665.html We clarify the wording to make it clear that the warning applies to the following functions. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17180) (cherry picked from commit 3dbf82438004b31258627f324841476c4f586c19)
2021-12-03OSSL_HTTP_transfer.pod: Some clarifications on the BIO connect/disconnect ↵Dr. David von Oheimb
callback function Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17160) (cherry picked from commit 2080134ee98a6b23f7456c17901e7b06e4a42ed5)
2021-12-03OSSL_HTTP_transfer.pod: Fix omission documenting the 'ok' parameter of ↵Dr. David von Oheimb
OSSL_HTTP_close() Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17160) (cherry picked from commit 4ee464cf8e0b8dc39970306bfbb49a6e06863e1c)
2021-12-03BIO_push.pod: fix confusing text and add details on corner casesDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17086) (cherry picked from commit 7a37fd09a8f3607ed8acf55e03479861595be069)
2021-11-30More detailed explanation how do engines work in 3.0Dmitry Belyavskiy
Related: #16868, #17081, #17107 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17115) (cherry picked from commit 29a27cb2c5c1757831f42117871f8c59058343a9)
2021-11-28doc: remove non-existent callbacksPauli
These used to exist but were removed before release. Updating the documentation was missed. Fixes #17138 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17141) (cherry picked from commit 6d770c5ba36d43f495b232392cfaa8fa460f17af)
2021-11-25doc: fix macro namePauli
OSSL_STORE_INFO_X509 doesn't exist. It should be OSSL_STORE_INFO_CERT. Fixes #17121 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17125) (cherry picked from commit 01fde90eec721b64bc0e1c01cd94a9fd431adcc6)
2021-11-24Clarify and correct the EVP_CTRL_AEAD_SET_TAG docsMatt Caswell
The restriction about setting a tag length prior to setting the IV only applies to OCB mode. We clarify when in the process EVP_CTRL_AEAD_SET_TAG can be called. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17111) (cherry picked from commit 3607b8ad8ee1980a079e985333a196e0c79f8f00)
2021-11-23DOC: Add a few previously documented functionsRichard Levitte
d2i_X509_bio(), d2i_X509_fp(), i2d_X509_bio(), and i2d_X509_fp() were documented in OpenSSL 1.0.2. In a grand unification of the documentation of (almost) all d2i and i2d functions, these were dropped, most likely by mistake. This simply adds them back. Fixes #17091 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17094)
2021-11-23DOC: OSSL_PARAM_{set,get,construct}_BN() currently only supports nonnegative ↵Richard Levitte
numbers Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17074) (cherry picked from commit b33fb68a3230b8fc87f6663212ac3ffae0b361c5)
2021-11-23Make OSSL_PARAM_BLD_push_BN{,_pad}() return an error on negative numbersRichard Levitte
Adding documentation to that fact as well. Fixes #17070 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17074) (cherry picked from commit db65eabefe76e44818ff8bd19c68990e7dcc70d3)
2021-11-22Fix the return check of OBJ_obj2txtPW Hu
Also update OBJ_nid2obj.pod to document the possible return values. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17005) (cherry picked from commit 2349d7ba57c9327290df6f7bc18b7f0c3976ca9e)
2021-11-17Add documentation for some of the missing environment variables.Pauli
Where document already exists, it has been linked to. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/17044) (cherry picked from commit 7f6496275157f8e40f544f75a223c2c0dc6b389e)
2021-11-15Clarify the PEM docsMatt Caswell
Make it clear how the existing PEM functions can be used to create an X509, X509_REQ or X509_CRL object with an associated libctx/propq. Fixes #16966 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17012) (cherry picked from commit e48fe798409eb22f067f635c62b9a72e18cd4347)
2021-11-15Use a write lock during ossl_provider_find()Matt Caswell
A "find" operation on a stack can end up sorting the underlying stack. In this case it is necessary to use a "write" lock to synchronise access to the stack across multiple threads. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17018)
2021-11-15Stop receiving child callbacks in a child libctx when appropriateMatt Caswell
We should stop receiving child callbacks if we're about to free up the child libctx. Otherwise we can get callbacks when the libctx is half freed up. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17018)
2021-11-15Don't attempt to deactive child providers if we don't need toMatt Caswell
If a provider doesn't have any child providers then there is no need to attempt to remove them - so we should not do so. This removes some potentialy thread races. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17018)
2021-11-12doc: Document outcome of multiple digestsign/digestverify callsTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16964) (cherry picked from commit 3641f04fb06e9679a67da113bab65e5f1bb5e9ba)
2021-11-08APPS/x509: Fix generation of AKID via v2i_AUTHORITY_KEYID()Dr. David von Oheimb
Fixes #16300 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16442) (cherry picked from commit 9bf1061c44c81059102cd4749f6078b6ce71da9d)
2021-11-08Fix errors in EVP_PKEY_fromdata examplesMatt Caswell
The EVP_PKEY_fromdata man page has some code examples with various errors in them. This fixes those errors. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16973) (cherry picked from commit 4ce64ed79d301939c7f2844a9e5e5fdd2033605f)
2021-11-02update doc: BN_bn2lebinpad() and BN_bn2nativepad()PW Hu
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16943) (cherry picked from commit aedc5a819ee3f5267a7ec5c795b97481a1c63dc6)
2021-10-28Fix return value error in doc, and an error testPW Hu
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16889) [edited to remove end of line whitespace and wrap lines to eighty columns] (cherry picked from commit 8b7d7789dc4ea0de11331cb4045bcb03ab0864fc)
2021-10-27Clarify the documentation for the "byname" functionsMatt Caswell
Make it clear that the cipher/digest objects returned from EVP_get_cipherbyname() and EVP_get_digestbyname() functions have no associated implementation fetched from a provider. Fixes #16864 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16893) (cherry picked from commit 971dbab4ad20193c27e8c3865e92e8f487b89334)
2021-10-27CORE: Encure that cached fetches can be done per providerRichard Levitte
This mostly entails passing around a provider pointer, and handling queries that includes a pointer to a provider, where NULL means "any". This also means that there's a need to pass the provider pointer, not just down to the cache functions, but also be able to get it from ossl_method_store_fetch(). To this end, that function's OSSL_PROVIDER pointer argument is modified to be a pointer reference, so the function can answer back what provider the method comes from. Test added. Fixes #16614 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16725) (cherry picked from commit dc010ca6ec01d313a84c3c4b040232655a1772ad)
2021-10-27EVP: Allow a fallback for operations that work with an EVP_PKEYRichard Levitte
Functions like EVP_PKEY_sign_init() do an implicit fetch of the operation implementation (EVP_SIGNATURE in this case), then get the KEYMGMT from the same provider, and tries to export the key there if necessary. If an export of the key isn't possible (because the provider that holds the key is an HSM and therefore can't export), we would simply fail without looking any further. This change modifies the behaviour a bit by trying a second fetch of the operation implementation, but specifically from the provider of the EVP_PKEY that's being used. This is done with the same properties that were used with the initial operation implementation fetch, and should therefore be safe, allowing only what those properties allow. Fixes #16614 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16725) (cherry picked from commit 839ffdd11cd48d329a1d89565d62e0be082f9d08)
2021-10-27EVP: Add the internal function evp_generic_fetch_from_prov()Richard Levitte
This function leverages the generic possibility to fetch EVP methods from a specific provider. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16725) (cherry picked from commit 2fd3392c8f4e2f3481fa4d7e6a683dc19c6c1cd2)
2021-10-27CORE: add a provider argument to ossl_method_construct()Richard Levitte
This makes it possible to limit the search of methods to that particular provider. This uses already available possibilities in ossl_algorithm_do_all(). Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16725) (cherry picked from commit cfce50f791511c8fee7dec90c57f02d9410d039f)
2021-10-26Doc: replace `NULL` terminated with `NUL`Kinshuk Dua
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16885) (cherry picked from commit 089df6f135b7cef4e7d0e7b7acecb1d90f5ef3ed)
2021-10-26doc: Fix some function signature errorsPW Hu
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16897) (cherry picked from commit 1e4cef5fde59e28f10ec555801349d06471d1da0)
2021-10-26test-rand: return failure on not enough data, allow parentPauli
The test-rand RNG was returning success when it had some but insufficient data. Now, it returns failure and doesn't advance the data pointer. The test-rand RNG was failing when a parent was specified. This case is now ignored. Fixes #16785 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16905) (cherry picked from commit d4dfd983e32b32b633aaa9edec422cc30419c6f7)
2021-10-25migration_guide: Mention ERR_GET_FUNC() and function code removalTomas Mraz
Fixes #16817 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16879) (cherry picked from commit b387274d0fb3097d3a252d397226b86b8f98f30d)
2021-10-25doc: Fix some function signature errorsPW Hu
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16874) (cherry picked from commit 7b2bde500dfdad6628b15c5faa641d0f6602110e)
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-10 22:52:37 +0000