summaryrefslogtreecommitdiffstats
path: root/doc
AgeCommit message (Collapse)Author
2 days[DOCS] Correct history in doc/man3/OSSL_STORE_LOADER.podopenssl-3.3Richard Levitte
Bulk editing had history wrongly specify current functions as deprecated, among other small errors. Fixes #24678 Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24680) (cherry picked from commit b23cd39f0a4e3cfe142694402a5246a498a3574f)
4 daysMake rcu_thread_key context-awareNeil Horman
Currently, rcu has a global bit of data, the CRYPTO_THREAD_LOCAL object to store per thread data. This works in some cases, but fails in FIPS, becuase it contains its own copy of the global key. So 1) Make the rcu_thr_key a per-context variable, and force ossl_rcu_lock_new to be context aware 2) Store a pointer to the context in the lock object 3) Use the context to get the global thread key on read/write lock 4) Use ossl_thread_start_init to properly register a cleanup on thread exit 5) Fix up missed calls to OSSL_thread_stop() in our tests (cherry picked from commit 24d16d3a1915a06a2130385a87de9a37fc09c4b9) Fixes #24581 Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24630)
4 daysdocs: fix SSL_CTX_set_tlsext_ticket_key_cb typosDaniel McCarney
* "shortcuts the TLS" -> "shortcuts the TLS handshake" * "don't occur" -> "doesn't occur" * "storing client certificate" -> "storing the client certificate" * "an all other" -> "and all other" CLA: trivial Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24674) (cherry picked from commit e2a4d68a03b8a3576b0fe917a602b3a283d105a5)
5 daysossl_store.pod: Correct the example of OSSL_STORE API usageEt7f3
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24056) (cherry picked from commit d5412c94a399d3923b2dec2431ead60288d857c8)
5 daysFix typo in openssl-verification-options documentation.Jaime Hablutzel
CLA: trivial Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24662) (cherry picked from commit f159d861e2761ffc6421b0486fdd482f37215f9f)
6 daysCMP app: fix combination of -certout and -chainout with equal filename argumentDr. David von Oheimb
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/24267) (cherry picked from commit 5aec3f4a72604d76970581f1ea445b331beda608)
7 daysOSSL_CMP_{validate_msg,CTX_new}.pod: add warning notes on ↵Dr. David von Oheimb
OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23814) (cherry picked from commit 40948c4c74099ae21843d9265dfe65f13cb9e6c5)
2024-06-07[Docs] Notes about freeing objectsRuslan Baratov
- Free objects returned from PEM read - Free objects returned from d2i_* Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24478) (cherry picked from commit d4700c0b237c05315e3bf14fc416abcbdfe51ff2)
2024-06-06Drop the old PGP key fingerprintRichard Levitte
All public releases have the information of the new PGP key in doc/fingerprints.txt, so it is finally time to drop the old. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24563) (cherry picked from commit a9fa07f47cea6a43d5ac4a3aa336ab34756c2e9b)
2024-06-04Copyright year updatesTomas Mraz
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
2024-05-30[Docs] SSL_*_use will increment reference counterRuslan Baratov
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24520) (cherry picked from commit 0c73d65eeae9086c37149f4a512946040c8c2af3)
2024-05-29Update configurable sigalgs documentation for providersMichael Baentsch
also adding to SignatureAlgorithms section Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/24499) (cherry picked from commit 90e7c12f1b238ed714786fafc26d05b59a63752b)
2024-05-22[Docs] Default value for verification flags is 'SSL_VERIFY_NONE'Ruslan Baratov
Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24435) (cherry picked from commit a73e07dbb7df4795c4ec537f19516b541fb8dd3c)
2024-05-15Update openssl-smime.pod.inDominikN
Remove duplicate entries for -nocerts and -noattr CLA:trivial Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24052) (cherry picked from commit 5a0c92cf093b4f0aa65f4fdbff88d7bdc83491f3)
2024-05-15[Docs] 'SSL_CTX_set_cert_store' ownership of 'store'Ruslan Baratov
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24375) (cherry picked from commit 987baef4fa54d268d7eaa93837a56398409698a1)
2024-05-14doc: Fix description of EVP_CIPHER_CTX_dupDaiki Ueno
This fixes a couple of copy and paste error from EVP_MD_CTX_dup, where: EVP_CIPHER_CTX_dup is useful to avoid multiple EVP_CIPHER_fetch (instead of EVP_MD_fetch) and returns EVP_CIPHER_CTX (instead of EVP_MD_CTX). Signed-off-by: Daiki Ueno <dueno@redhat.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24376) (cherry picked from commit 7860bca22c404cfd763ae2648d708d5cc4df6c2f)
2024-05-06Document the SSL_set_session_secret_cb() functionMatt Caswell
This function is only useful for EAP-FAST, but was previously undocumented. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24309) (cherry picked from commit aecaaccaf93c4b36dd830accf08f2175059c5782)
2024-05-01Fixed typos in EVP_PKEY_decrypt.pod and RSA_public_encrypt.podsapph2c
CLA: trivial Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24304) (cherry picked from commit f4601b6de709a89120c86ad825b70f65b332deed)
2024-04-29doc: clarify SSL_CIPHER_description allocationDaniel McCarney
Previously the documentation for `SSL_CIPHER_description` said: > If buf is provided, it must be at least 128 bytes, otherwise a buffer > will be allocated using OPENSSL_malloc(). In reality, `OPENSSL_malloc` is only invoked if the provided `buf` argument is `NULL`. If the `buf` arg is not `NULL`, but smaller than 128 bytes, the function returns `NULL` without attempting to allocate a new buffer for the description. This commit adjusts the documentation to better describe the implemented behaviour. CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Paul Dale <ppzgs1@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23921) (cherry picked from commit 6a4a714045415be6720f4165c4d70a0ff229a26a)
2024-04-22Be more explicit about RSAES-PKCS#1v1.5 error handlingHubert Kario
And add a note how to perform side-channel free error stack handling. Signed-off-by: Hubert Kario <hkario@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24159) (cherry picked from commit 98161274636dca12e3bfafab7d2d2ac28f4d7c30)
2024-04-22fix sending error when no root CA cert update availableRajeev Ranjan
Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24169) (cherry picked from commit fc9649f61a8ac5f980da6807214fcbbbae1c45aa)
2024-04-19Fix migration guide mappings for i2o/o2i_ECPublicKeyslontis
Fixes #23854 Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24041) (cherry picked from commit 6594baf6457c64f6fce3ec60cb2617f75d98d159)
2024-04-19OSSL_STORE: Add reference docs for the built-in Windows store implementationRichard Levitte
Fixes openssl/project#422 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24170) (cherry picked from commit faa4a10ebe5095765262c0e3c711fca08026c3d4)
2024-04-16doc/fingerprints.txt: Add the future OpenSSL release keyRichard Levitte
This will be used for future releases Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24063) (cherry picked from commit 4ffef97d3755a0425d5d72680daebfa07383b05c)
2024-04-10Fix typos found by codespell in openssl-3.3 docDimitri Papadopoulos
Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24014)
2024-04-10Document that private and pairwise checks are not bounded by key sizeTomas Mraz
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/24049) (cherry picked from commit 27005cecc75ec7a22a673d57fc35a11dea30ac0a)
2024-04-10man EVP_PKEY_CTX_set_params: document params is a listHubert Kario
Signed-off-by: Hubert Kario <hkario@redhat.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23986) (cherry picked from commit 9b87c5a3ffa1ca233be96dd0bce812c04bad53fe)
2024-04-09Add docs noting requirements for SM2 signingNeil Horman
Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23887) (cherry picked from commit 4feb4a2b2cb7c45c0392e03453a658f29bd70bd2)
2024-04-09Add demo for ECDH key exchangeslontis
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22916) (cherry picked from commit 56e4d112ae226d5fa0210cd1f0dd96e6857805fd)
2024-04-09Copyright year updatesTomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
2024-04-04openssl-crl(1): The -verify option is implied by -CA* optionsTomas Mraz
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/24024) (cherry picked from commit a16f2e7651b22ee992bb0c279e25164b519c1e80)
2024-04-04DEFINE_STACK_OF.pod: Fix prototypes of sk_TYPE_free/zero()Tomas Mraz
They take non-const STACK_OF(TYPE)* argument. Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <ppzgs1@gmail.com> (Merged from https://github.com/openssl/openssl/pull/24023) (cherry picked from commit e898c367312c3ab6eb5eaac9b4be768f0d2e4b0e)
2024-04-04Update Documentation for EVP_DigestSign, EVP_DigestVerify.slontis
Fixes #23075 In OpenSSL 3.2 EVP_DigestSign and EVP_DigestVerify were changed so that a flag is set once these functions do a one-shot sign or verify operation. This PR updates the documentation to match the behaviour. Investigations showed that prior to 3.2 different key type behaved differently if multiple calls were done. By accident X25519 and X448 would produce the same signature, but ECDSA and RSA remembered the digest state between calls, so the signature was different when multiple calls were done. Because of this undefined behaviour something needed to be done, so keeping the 'only allow it to be called once' behaviour seems a reasonable approach. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23834) (cherry picked from commit 5e908e6068708c89da7b5591cc65ff4b3d3135d2)
2024-04-04Align 'openssl req' string_mask docs to how the software really worksJob Snijders
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23699) (cherry picked from commit 2410cb42e62c3be69dcf1aad1bdf1eb0233b670f)
2024-04-02Document change of -verify behavior in crl and req appsVladimir Kotal
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23983) (cherry picked from commit 15585af97ec682182f40f815741e66f1ec40f941)
2024-04-02Explicitly state what -keys doesSimo Sorce
Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/23919) (cherry picked from commit 693c479a2ca671e0dfca8d1ad14e789169b982ff)
2024-03-29Copyright year updatesMatt Caswell
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
2024-03-26apps/req,crl: exit with 1 on verification failureVladimir Kotal
Fixes #23771 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/23773) (cherry picked from commit 6af739b79ba50bd42ac8934747ab5c8b996f16b6)
2024-03-22Fixed a typo and grammar in openssl-ts.podolszomal
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23913) (cherry picked from commit f1c14f1853d2df94e339208eed1df823c2238389)
2024-03-20Copyright year updatesRichard Levitte
Reviewed-by: Neil Horman <nhorman@openssl.org> Release: yes
2024-03-15Minor docfix for OSSL_HTTP_REQ_CTX_set_max_response_hdr_lines(3)Alexandr Nedvedicky
Also removal of duplicate assignment and addition of comment in test/http_test.c Follow up change to PR #23781 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23837)
2024-03-15SSL_add_dir_cert_subjects_to_stack(): Documented return valuesShakti Shah
In the man page for SSL_add_dir_cert_subjects_to_stack(), the functions returning int have undocumented return values. Fixes #23171 Signed-off-by: Shakti Shah <shaktishah33@gmail.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23433)
2024-03-12Limit the number of http headers when receiving the http responseAlexandr Nedvedicky
Change introduces a default limit on HTTP headers we expect to receive from server to 256. If limit is exceeded http client library indicates HTTP_R_RESPONSE_TOO_MANY_HDRLINES error. Application can use OSSL_HTTP_REQ_CTX_set_max_response_hdr_lines() to change default. Setting limit to 0 implies no limit (current behavior). Fixes #22264 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23781)
2024-03-12Improve the documentation on -cert_chain and -status_verbose optionsolszomal
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22192)
2024-03-12Doc: fix style谭九鼎
CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23805)
2024-03-11Fix BIO_get_new_index() to return an error when it is exhausted.slontis
Fixes #23655 BIO_get_new_index() returns a range of 129..255. It is set to BIO_TYPE_START (128) initially and is incremented on each call. >= 256 is reserved for the class type flags (BIO_TYPE_DESCRIPTOR) so it should error if it reaches the upper bound. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23732)
2024-03-09Bring SSL_group_to_name docs in line with API definitionNeil Horman
docs say the SSL object in this function is const, but the api doesn't qualify it as such. Adjust the docs to match the definition Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23785)
2024-03-09QUIC: Add stream write buffer queriesHugo Landau
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Neil Horman <nhorman@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23584)
2024-03-07QUIC: Define error code for stateless resetHugo Landau
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23598)
2024-03-07QUIC: Add documentation for QUIC error codesHugo Landau
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23598)
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-24 11:04:19 +0000