summaryrefslogtreecommitdiffstats
path: root/doc
AgeCommit message (Collapse)Author
2019-05-28Update copyright yearRichard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9034)
2019-05-27doc/man3/X509_LOOKUP_meth_new.pod: clarify the requirementsRichard Levitte
The documentation of what a X509_LOOKUP implementation must do was unclear and confusing. Most of all, clarification was needed that it must store away the found objects in the X509_STORE. Fixes #8707 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8755) (cherry picked from commit 19f43f02aa5349034d0a7a60c3a750e046f994b5)
2019-05-24Doc update: minor typo in CMS_verify.podSambit Kumar Dash
CLA: trivial Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8952) (cherry picked from commit 55e09d17d4c84213d372651b0c91bdc9ef786728)
2019-05-21Change default RSA, DSA and DH size to 2048 bitKurt Roeckx
Fixes: #8737 Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Richard Levitte <levitte@openssl.org> GH: #8741 (cherry picked from commit 70b0b977f73cd70e17538af3095d18e0cf59132e)
2019-05-21Change SSL parameter SSL_session_reused constArne Schwabe
This function only returns a status and does not modify the parameter. Since similar function are already taking const parameters, also change this function to have a const parameter. Fixes #8934 CLA: trivial Signed-off-by: Arne Schwabe <arne@rfc2549.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8945) (cherry picked from commit c04b66b18d1a90f0c6326858e4b8367be5444582)
2019-05-08Allow specifying the tag after AAD in CCM modeTobias Nießen
This change allows to pass the authentication tag after specifying the AAD in CCM mode. This is already true for the other two supported AEAD modes (GCM and OCB) and it seems appropriate to match the behavior. GCM and OCB also support to set the tag at any point before the call to `EVP_*Final`, but this won't work for CCM due to a restriction imposed by section 2.6 of RFC3610: The tag must be set before actually decrypting data. This commit also adds a test case for setting the tag after supplying plaintext length and AAD. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7243) (cherry picked from commit 67c81ec311d696464bdbf4c6d6f8a887a3ddf9f8)
2019-05-07man: fix a typo and a grammar nit in EVP_PKEY_meth_new(3)Dr. Matthias St. Pierre
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8893) (cherry picked from commit 260a16f33682a819414fcba6161708a5e6bdff50)
2019-04-24doc: Get rid of unrelated reference to DSA_new()Jakub Jelen
CLA: trivial Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8786) (cherry picked from commit 87930507ff1c020d4ba1ca895ef3ef08e17253b3)
2019-04-19Check if num is 0 before trying to malloc memory. Otherwise for client ↵dyrock
hellos without extensions SSL_client_hello_get1_extensions_present will return MALLOC_FAILURE. Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8756) (cherry picked from commit 6fda11ae5a06e28fd9463e5afb60735d074904b3)
2019-04-19Clarify the documentation on the use of ChaCha20Matt Caswell
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8780) (cherry picked from commit 6f3aae256d62cfcc48c07cc0ead5080b070f371b)
2019-04-16Add documentation for the BIO_s_mem pecularitiesTomas Mraz
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8649) (cherry picked from commit 3d42833d389134b7b05b655c264e4dba5a2179e9)
2019-04-15Further harmonisation of manual page HISTORY sectionsJoshua Lock
A couple of minor tweaks to match the style introduced in #7854: - BIO_connect: remove line break to make more grep friendly - SSL_CTX_new: harmoise the format of the HISTORY section Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 938e82f622eb04ebbfe534c79d234d0f6a0df035) Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8736)
2019-04-15Update various man pages to place HISTORY section after SEE ALSOJoshua Lock
SEE ALSO before HISTORY is the more common pattern in OpenSSL manual pages and seems to be the prevalent order based on sampling my system manual pages. Fixes #8631 Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit b5c4bbbe54e112b976155004b3d702e47ce7d9d9) Conflicts: doc/man3/RAND_DRBG_generate.pod doc/man3/RAND_DRBG_reseed.pod Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8736)
2019-04-15Place return values after examples in docPaul Yang
Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 4564e77ae9dd1866e8a033f03511b6a1792c024e) Conflicts: doc/internal/man3/openssl_ctx_get_data.pod (non-existant) doc/man3/OPENSSL_s390xcap.pod (non-existant) Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/8736)
2019-04-05Add the prediction_resistance flag to the documentation.Pauli
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/8678)
2019-04-04Correct the documentation about SSL_CIPHER_description()Matt Caswell
There are some ciphersuites that were introduced in TLSv1.0/TLSv1.1 but are backwards compatible with SSLv3. Fixes #8655 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8658) (cherry picked from commit 69539990a8152e90dbe1df1124263db126b1e6f3)
2019-03-28Make OCSP_id_cmp and OCSP_id_issuer_cmp accept const paramsMatt Caswell
Fixes #8589 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8597) (cherry picked from commit cc6d92619fc3678817b2e09894683b40860563a7)
2019-03-27Don't allow SHAKE128/SHAKE256 with HMACMatt Caswell
See discussion in github issue #8563 Fixes #8563 Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/8585)
2019-03-27Fix three identical grammatical errorsDr. Matthias St. Pierre
Reported by Mak Kolybabi Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8591) (cherry picked from commit fc4e500b037fcbe89238b1c9f0c1ccf46a7c6559)
2019-03-25ts(1): digest option is mandatoryHubert Kario
not specifying the digest both on command line and in the config file will lead to response generation aborting with 140617514493760:error:2F098088:time stamp routines:ts_CONF_lookup_fail: \ cannot find config variable:crypto/ts/ts_conf.c:106:tsr_test::signer_digest Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/8421) (cherry picked from commit 29716a03e8c602d69d6c86558b2903b23edddd9b)
2019-03-21Providing missing accessor to EVP_PKEY.engineDmitry Belyavskiy
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8526)
2019-03-20Updated doc for BN_clear, BN_CTX_end when param is NULLShane Lontis
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8532) (cherry picked from commit 138ef774fedb567b29d6e5a96541a396cadc6135)
2019-03-19Update pkeyutl documentation about the digest optionMatt Caswell
DSA can accept other digests other than SHA1. EC ignores the digest option altogether. Fixes #8425 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8432) (cherry picked from commit 6a6d9ecd1dff669c162e8ab940dac5db2e82679d)
2019-03-10Fix two spelling errorsA. Schulze
CLA: trivial Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/8447) (cherry picked from commit 3dcbb6c4a395d56dfa561145d89017ff958bb18e)
2019-03-07Update documentation of RSA_padding_check_PKCS1_OAEP_mgf1Bernd Edlinger
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/8365) (cherry picked from commit f0e4a860d0b350e10a1ee3898445cac85af8ea16)
2019-03-07Update documentation regarding required output buffer memory sizeBernd Edlinger
of RSA_private_decrypt/RSA_public_encrypt. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/8365) (cherry picked from commit b89fdeb2f7d4471cbfd8a579945754327a4e06a8)
2019-03-06Update ChaCha20-Poly1305 documentationMatt Caswell
Correctly describe the maximum IV length. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8406) (cherry picked from commit 27d5631236325c3fd8a3bd06af282ac496aac64b)
2019-02-26Fix trivial typo in EVP_DigestVerifyInit docNicola Tuveri
(cherry picked from commit b3883f77df33989b0d4298ca9a21d8595dd9a8c9) Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8319)
2019-02-26Clarify that SSL_shutdown() must not be called after a fatal errorMatt Caswell
Follow on from CVE-2019-1559 Reviewed-by: Richard Levitte <levitte@openssl.org>
2019-02-26Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8347)
2019-02-22Fix a grammar nit in CRYPTO_get_ex_new_index.podPaul Yang
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8303) (cherry picked from commit 84712024da5e5485e8397afc763555355bddf960)
2019-02-21SSL_CONF_cmd: fix doc for NoRenegotiationHubert Kario
The option is a flag for Options, not a standalone setting. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8292) (cherry picked from commit 4ac5e43da6d9ee828240e6d347c48c8fae6573a2)
2019-02-19Don't set SNI by default if hostname is not dNS nameIonut Mihalcea
Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8175) (cherry picked from commit 8e981051ceecd10754f8f6d1291414a7453c8fac)
2019-02-17Add missing dots in dgst man pageVedran Miletić
CLA: trivial Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> GH: #8142 (cherry picked from commit e3ac3654892246d7492f1012897e42ad7efd13ce)
2019-02-17Fixed typoJan Macku
CLA: trivial Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> GH: #8121 (cherry picked from commit 70680262329004c934497040bfc6940072043f48)
2019-02-14Don't signal SSL_CB_HANDSHAKE_START for TLSv1.3 post-handshake messagesMatt Caswell
The original 1.1.1 design was to use SSL_CB_HANDSHAKE_START and SSL_CB_HANDSHAKE_DONE to signal start/end of a post-handshake message exchange in TLSv1.3. Unfortunately experience has shown that this confuses some applications who mistake it for a TLSv1.2 renegotiation. This means that KeyUpdate messages are not handled properly. This commit removes the use of SSL_CB_HANDSHAKE_START and SSL_CB_HANDSHAKE_DONE to signal the start/end of a post-handshake message exchange. Individual post-handshake messages are still signalled in the normal way. This is a potentially breaking change if there are any applications already written that expect to see these TLSv1.3 events. However, without it, KeyUpdate is not currently usable for many applications. Fixes #8069 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8096) (cherry picked from commit 4af5836b55442f31795eff6c8c81ea7a1b8cf94b)
2019-02-11Allow the syntax of the .include directive to optionally have '='Tomas Mraz
If the old openssl versions not supporting the .include directive load a config file with it, they will bail out with error. This change allows using the .include = <filename> syntax which is interpreted as variable assignment by the old openssl config file parser. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8141) (cherry picked from commit 9d5560331d86c6463e965321f774e4eed582ce0b)
2019-02-08Update d2i_PrivateKey documentationTodd Short
Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8168) (cherry picked from commit 1980ce45d6bdd2b57df7003d6b56b5df560b9064)
2019-02-07Make OPENSSL_malloc_init() a no-opMatt Caswell
Making this a no-op removes a potential infinite loop than can occur in some situations. Fixes #2865 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8167) (cherry picked from commit ef45aa14c5af024fcb8bef1c9007f3d1c115bd85)
2019-02-05Remove unnecessary trailing whitespaceSam Roberts
Trim trailing whitespace. It doesn't match OpenSSL coding standards, AFAICT, and it can cause problems with git tooling. Trailing whitespace remains in test data and external source. Backport-of: https://github.com/openssl/openssl/pull/8092 Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8134)
2019-02-05Make some simple getters take const SSL/SSL_CTXSam Roberts
Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8145) (cherry picked from commit 3499327bad401eb510d76266428923d06c9c7bb7)
2019-02-01Fix end-point shared secret for DTLS/SCTPMichael Tuexen
When computing the end-point shared secret, don't take the terminating NULL character into account. Please note that this fix breaks interoperability with older versions of OpenSSL, which are not fixed. Fixes #7956 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7957) (cherry picked from commit 09d62b336d9e2a11b330d45d4f0f3f37cbb0d674)
2019-01-30Complain if -twopass is used incorrectlyMatt Caswell
The option -twopass to the pkcs12 app is ignored if -passin, -passout or -password is used. We should complain if an attempt is made to use it in combination with those options. Fixes #8107 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8114) (cherry picked from commit 40b64553f577716cb4898895f5fd4530a6266c75)
2019-01-27clarify which functions are the CMS functions which must have CMS_PARTIAL setMichael Richardson
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7960) (cherry picked from commit 61e033308b1c004bd808352fb1d786547dcdf62b)
2019-01-27Remove stray -modulus option from the ec manual page.Tomas Mraz
Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8082) (cherry picked from commit d7bcbfd0828616f33008e711eabc6ec00b32e87b)
2019-01-07More configurable crypto and ssl library initializationViktor Dukhovni
1. In addition to overriding the default application name, one can now also override the configuration file name and flags passed to CONF_modules_load_file(). 2. By default we still keep going when configuration file processing fails. But, applications that want to be strict about initialization errors can now make explicit flag choices via non-null OPENSSL_INIT_SETTINGS that omit the CONF_MFLAGS_IGNORE_RETURN_CODES flag (which had so far been both undocumented and unused). 3. In OPENSSL_init_ssl() do not request OPENSSL_INIT_LOAD_CONFIG if the options already include OPENSSL_INIT_NO_LOAD_CONFIG. 4. Don't set up atexit() handlers when called with opts equal to OPENSSL_INIT_BASE_ONLY (this flag should only be used alone). Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7969)
2019-01-07doc/man1/x509.pod: fix typoDr. Matthias St. Pierre
This looks like a copy&paste error from req.pod to x509.pod. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7995) (cherry picked from commit 67ee899cb51d3e3d7b5f00b878f8f82a097b93f0)
2019-01-04Implement OPENSSL_INIT_NO_ATEXITMatt Caswell
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7983)
2018-12-29Fixed minor typo in the req.pod docsBehrang
CLA: Trivial Fixes #7928. Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7973) (cherry picked from commit 005247af76aa8d623fadbf3a82aa7b8ef449989f)
2018-12-27fixed grammar typoMichael Richardson
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/7959) (cherry picked from commit fff1470cda05dedd98d2e8e18c3bc320635365d4)
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-22 13:55:32 +0000