summaryrefslogtreecommitdiffstats
path: root/doc
AgeCommit message (Collapse)Author
2021-05-20Update copyright yearMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15381)
2021-05-20app: add a -store_loaders option to list.Pauli
Fixes #15307 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15323)
2021-05-20Update documentation for global properties mirroringMatt Caswell
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15242)
2021-05-20Documentation updates for mirroring of global propertiesMatt Caswell
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15242)
2021-05-20Add migration guide for 3.0Shane Lontis
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14710)
2021-05-19Update SSL_new_session_ticket() manual for triggered sendBenjamin Kaduk
Document the recently added functionality. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14817)
2021-05-19danetest.c: Improve code formattingDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14422)
2021-05-19X509_STORE_CTX_get1_issuer(): Simplify code, reducing risk of failureDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14422)
2021-05-19build.info: Make it possible to set attributes on SOURCE / SHARED_SOURCE stmtsRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15332)
2021-05-19speed: Document the deficiencies of the commandTomas Mraz
Fixes #7032 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15330)
2021-05-19apps/list: Remove obsolete -missing-help optionDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15329)
2021-05-19Make SMIME_read_CMS_ex() and SMIME_read_ASN1_ex() support binary inputDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12959)
2021-05-19bio_lib: Add BIO_get_line, correct doc of BIO_getsDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12959)
2021-05-19Remove '=for openssl ifdef'Rich Salz
No longer needed after rewrite of cmd-nits Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15311)
2021-05-18DOC: Fix nits found by improved find-doc-nits -cDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15298)
2021-05-18openssl-dsa.pod.in: Fix glitch: pvk-string -> pvk-strongDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15298)
2021-05-18find-doc-nits: Make -c option (cmd-nits) independent of app build and executionDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15298)
2021-05-18apps/s_server: Add -proxy and -no_proxy optionsDr. David von Oheimb
Strongly related to feature request #6965 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15245)
2021-05-18apps/ocsp: Add -proxy and -no_proxy optionsDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15245)
2021-05-18Add -quiet flag to genpkeyRich Salz
Picking up late suggestions to PR #6909 by Philip Prindeville <philipp@redfish-solutions.com>. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15249)
2021-05-17Add SSL_OP_ALLOW_CLIENT_RENEGOTIATIONRich Salz
Add -client_renegotiation flag support. The -client_renegotiation flag is equivalent to SSL_OP_ALLOW_CLIENT_RENEGOTIATION. Add support to the app, the config code, and the documentation. Add SSL_OP_ALLOW_CLIENT_RENEGOTIATION to the SSL tests. We don't need to always enable it, but there are so many tests so this is the easiest thing to do. Add a test where client tries to renegotiate and it fails as expected. Add a test where server tries to renegotiate and it succeeds. The second test is supported by a new flag, -immediate_renegotiation, which is ignored on the client. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15184)
2021-05-17Add doc for ERR_clear_last_mark().Shane Lontis
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15258)
2021-05-17Fix OSSL_DECODER_new_for_pkey() selection parameter documentationShane Lontis
Fixes #14518 EVP_PKEY_fromdata() already defines this value so we link to this documentation, 0 is also added as a possible input value. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15260)
2021-05-15Promote SSL_get_negotiated_group() for non-TLSv1.3Benjamin Kaduk
It can be useful to know what group was used for the handshake's key exchange process even on non-TLS 1.3 connections. Allow this API, new in OpenSSL 3.0.0, to be used on other TLS versions as well. Since pre-TLS-1.3 key exchange occurs only on full handshakes, this necessitates adding a field to the SSL_SESSION object to carry the group information across resumptions. The key exchange group in the SSL_SESSION can also be relevant in TLS 1.3 when the resumption handshake uses the "psk_ke" key-exchange mode, so also track whether a fresh key exchange was done for TLS 1.3. Since the new field is optional in the ASN.1 sense, there is no need to increment SSL_SESSION_ASN1_VERSION (which incurs strong incompatibility churn). Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14750)
2021-05-15Init the child providers immediately on creation of the child libctxMatt Caswell
We were deferring the initial creation of the child providers until the first fetch. This is a carry over from an earlier iteration of the child lib ctx development and is no longer necessary. In fact we need to init the child providers immediately otherwise not all providers quite init correctly. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15270)
2021-05-15doc: document all functions in provider-base(7)Pauli
Fixes #13358 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15259)
2021-05-14Add OSSL_ prefix to HTTP_DEFAULT_MAX_{LINE_LENGTH,RESP_LEN}Dr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14HTTP client: Allow streaming of response data (with possibly indefinite length)Dr. David von Oheimb
Also clean up max_resp_len and add OSSL_HTTP_REQ_CTX_get_resp_len(). Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14HTTP client: Allow streaming of request data (for POST method)Dr. David von Oheimb
Also clean up OSSL_HTTP_REQ_CTX_nbio() states and make it more efficient. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14HTTP client API: Generalize to arbitrary request and response contentsDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14OSSL_HTTP_transfer(): Fix error reporting in case rctx->server is NULLDr. David von Oheimb
Also improve doc of OSSL_parse_url() and OSSL_HTTP_parse_url(). Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14HTTP: Implement persistent connections (keep-alive)Dr. David von Oheimb
Both at API and at CLI level (for the CMP app only, so far) there is a new parameter/option: keep_alive. * 0 means HTTP connections are not kept open after receiving a response, which is the default behavior for HTTP 1.0. * 1 means that persistent connections are requested. * 2 means that persistent connections are required, i.e., in case the server does not grant them an error occurs. For the CMP app the default value is 1, which means preferring to keep the connection open. For all other internal uses of the HTTP client (fetching an OCSP response, a cert, or a CRL) it does not matter because these operations just take one round trip. If the client application requested or required a persistent connection and this was granted by the server, it can keep the OSSL_HTTP_REQ_CTX * as long as it wants to send further requests and OSSL_HTTP_is_alive() returns nonzero, else it should call OSSL_HTTP_REQ_CTX_free() or OSSL_HTTP_close(). In case the client application keeps the OSSL_HTTP_REQ_CTX * but the connection then dies for any reason at the server side, it will notice this obtaining an I/O error when trying to send the next request. This requires extending the HTTP header parsing and rearranging the high-level HTTP client API. In particular: * Split the monolithic OSSL_HTTP_transfer() into OSSL_HTTP_open(), OSSL_HTTP_set_request(), a lean OSSL_HTTP_transfer(), and OSSL_HTTP_close(). * Split the timeout functionality accordingly and improve default behavior. * Extract part of OSSL_HTTP_REQ_CTX_new() to OSSL_HTTP_REQ_CTX_set_expected(). * Extend struct ossl_http_req_ctx_st accordingly. Use the new feature for the CMP client, which requires extending related transaction management of CMP client and test server. Update the documentation and extend the tests accordingly. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15053)
2021-05-14mac: improve MAC documentation (Poly 1305 key reuse, nomenclature)Pauli
Fixes #12441 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15237)
2021-05-14Slightly reformat ssl.h.inRich Salz
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15230)
2021-05-14Convert SSL_{CTX}_[gs]et_options to 64Rich Salz
Less tersely: converted SSL_get_options, SSL_set_options, SSL_CTX_get_options and SSL_CTX_get_options to take and return uint64_t since we were running out of 32 bits. Fixes: 15145 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15230)
2021-05-13doc: remove references to undepreciated commands being deprecated.Pauli
The dsa, ec, ecparam, and rsa manual pages refer to themselves are being deprecated which they aren't. Address this and add a note pointing to the pkey command equivalents albeit without recommending it. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15239)
2021-05-13Replace EVP_PKEY_supports_digest_nidTomas Mraz
The EVP_PKEY_supports_digest_nid() is renamed to EVP_PKEY_digestsign_supports_digest() and implemented via EVP_DigestSignInit_ex(). Fixes #14343 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15198)
2021-05-13clarification about the DES statusDmitry Belyavskiy
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15197)
2021-05-13Enumerating the legacy provider's cipher algorithmsDmitry Belyavskiy
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15197)
2021-05-13EVP_PKEY-X25519.pod: Correct EVP_PKEY_Q_keygen function name in exampleDr. David von Oheimb
fixup for #14695: Add convenience functions and macros for asymmetric key generation Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15226)
2021-05-13Fix cut/paste (?) error.Rich Salz
Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15232)
2021-05-13Export/import flags for FFC params changed to seperate fields.Shane Lontis
An extra field got added to the ffc flags related to FIPS-186-2 key validation, but this field was not handled by the export/import since the flags were done as string combinations. To keep this consistent with other object flags they are now passed as seperate OSSL_PARAM fields. Fixes 'no-cached-fetch' build which uses export/import. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15210)
2021-05-12HTTP client: Minimal changes that include the improved APIDr. David von Oheimb
This is a minimal version of pull request #15053 including all the proposed improvements to the HTTP client API and its documentation but only those code adaptations strictly needed for it. The proposed new features include * support for persistent connections (keep-alive), * generalization to arbitrary request and response types, and * support for streaming BIOs for request and response data. The related API changes include: * Split the monolithic OSSL_HTTP_transfer() into OSSL_HTTP_open(), OSSL_HTTP_set_request(), a lean OSSL_HTTP_transfer(), and OSSL_HTTP_close(). * Split the timeout functionality accordingly and improve default behavior. * Extract part of OSSL_HTTP_REQ_CTX_new() to OSSL_HTTP_REQ_CTX_set_expected(). Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15147)
2021-05-12Add ASN1_item_i2d_mem_bio(); document and improve also ASN1_item_d2i_bio()Dr. David von Oheimb
ASN1_item_d2i_bio(): Do not report errors in queue on BIO input being NULL Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15147)
2021-05-12doc: document the encoder and decoder name functionsPauli
Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15211)
2021-05-12use LHASH_OF(TYPE) macro to make the example consistent with the declaration ↵EasySec
in ssl.h Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11481)
2021-05-11Update documentation following addition of OSSL_LIB_CTX_new_child()Matt Caswell
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-11Add the concept of a child OSSL_LIB_CTXMatt Caswell
Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-11Constify EVP_PKEY_CTX_set_params(), EVP_PKEY_CTX_{set,get}table_params(), etc.Dr. David von Oheimb
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14695)
2021-05-11Add convenience functions and macros for asymmetric key generationDr. David von Oheimb
Add EVP_PKEY_gen(), EVP_PKEY_Q_gen(), EVP_RSA_gen(), and EVP_EC_gen(). Also export auxiliary function OSSL_EC_curve_nid2name() and improve deprecation info on RSA and EC key generation/management functions. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14695)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-06 16:24:20 +0000