summaryrefslogtreecommitdiffstats
path: root/doc
AgeCommit message (Collapse)Author
2021-02-23EVP: Implement EVP_PKEY_CTX_is_a()Richard Levitte
This does what was previously done by looking at pctx->pmeth->pkey_id, but handles both legacy and provider side contexts, and is supposed to become a replacement for the old way. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13913)
2021-02-22Note that the OSSL_CORE_MAKE_FUNC macro is reservedMatt Caswell
The OSSL_CORE_MAKE_FUNC macro has been added since 1.1.1 and is undocumented. However it is not intended for application use and so we document it as "reserved". Fixes #13192 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14232)
2021-02-22Document the OSSL_PARAM_DEFN macroMatt Caswell
This macro was added since 1.1.1 and was undocumented. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14232)
2021-02-22Add documentation for the macro OPENSSL_VERSION_PREREQMatt Caswell
This macro was added since 1.1.1 but had no associated documentation. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14232)
2021-02-22Document OPENSSL_LH_flush()Matt Caswell
The function OPENSSL_LH_flush() was added since 1.1.1 and was undocumented. We also add documentation for some other OPENSSL_LH_*() functions at the same time. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14232)
2021-02-22Add EVP_PKEY_public_check_quick.Shane Lontis
Adding the EVP_PKEY_param_check_quick() reminded me that there are also partial checks for public keys as part of SP800-56A for FFC (DH named safe prime groups) and ECC. The code was mainly already there and just needed to be plumbed into the validate methods. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14206)
2021-02-19CMP: Fix total_timeout behavior; small doc and diagnostic improvementsDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14019)
2021-02-19doc: remove notes section in OSSL_ENCODER.podPauli
Fixes #14212 The note wasn't adding anything useful. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14220)
2021-02-18rfc2606 compliant example domains for x509v3_config.podGeorg Höllrigl
Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14210)
2021-02-18Various improvements of doc/man5/x509v3_config.podgeorg-x
include is the better word Co-authored-by: kaduk <kaduk-github@mit.edu> Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14210)
2021-02-18OSSL_PARAM: Correct the assumptions on the UTF8 string lengthRichard Levitte
When the string "ABCDEFGH" is passed, what's considered its data, this? { 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H' } or this? { 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', '\0' } If it's passed as a pass phrase, should the terminating NUL byte be considered part of the pass phrase, or not? Our treatment of OSSL_PARAMs with the data type OSSL_PARAM_UTF8_STRING set the length of the string to include the terminating NUL byte, which is quite confusing. What should the recipient of such a string believe? Instead of perpetuating this confusion, we change the assumption to set the OSSL_PARAM to the length of the string, not including the terminating NUL byte, thereby giving it the same value as a strlen() call would give. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14168)
2021-02-18Update copyright yearMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14235)
2021-02-18DH: Make DH_bits(), DH_size(), and DH_security_bits() check that there are ↵Sahana Prasad
key parameters Fixes #13569 Signed-off-by: Sahana Prasad <sahana@redhat.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13955)
2021-02-17apps/cmp.c: Improve initialization of ext_ctx structure w.r.t. CSRDr. David von Oheimb
Also improve doc how the -reqexts option affects the CSR given with the -csr option. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/14181)
2021-02-17Rename OSSL_ENCODER_CTX_new_by_EVP_PKEY and OSSL_DECODER_CTX_new_by_EVP_PKEYTomas Mraz
Additional renames done in encoder and decoder implementation to follow the style. Fixes #13622 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14155)
2021-02-17[doc/man3][OSSL_ENCODER] Move NOTES to the bottomNicola Tuveri
For consistency with `OSSL_DECODER.pod`, and `man-pages(7)`, the `NOTES` section is moved at the end of the file. According to `man-pages(7)` the recommended section order is: > NAME > SYNOPSIS > CONFIGURATION [Normally only in Section 4] > DESCRIPTION > OPTIONS [Normally only in Sections 1, 8] > EXIT STATUS [Normally only in Sections 1, 8] > RETURN VALUE [Normally only in Sections 2, 3] > ERRORS [Typically only in Sections 2, 3] > ENVIRONMENT > FILES > VERSIONS [Normally only in Sections 2, 3] > CONFORMING TO > NOTES > BUGS > EXAMPLE > SEE ALSO This commit does not attempt to fix the order in all pages but focuses only on `OSSL_ENCODER` which has a "twin" man page in `OSSL_DECODER`, making the inconsistent section order quite jarring. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13932)
2021-02-17[doc/man3] Fix typo in DESCRIPTION of OSSL_ENCODER_propertiesNicola Tuveri
This commit fixes the DECSCRIPTION section of doc/man3/OSSL_ENCODER.pod, where `OSSL_ENCODER_properties` was incorrectly referred to as `OSSL_ENCODER_provider`. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13932)
2021-02-17doc: document the two new RAND functionsPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14162)
2021-02-15Document the newly added function EVP_PKEY_param_check_quick()Matt Caswell
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14146)
2021-02-15Implement EVP_PKEY_param_check_quick() and use it in libsslMatt Caswell
The low level DH API has two functions for checking parameters: DH_check_ex() and DH_check_params_ex(). The former does a "full" check, while the latter does a "quick" check. Most importantly it skips the check for a safe prime. We're ok without using safe primes here because we're doing ephemeral DH. Now that libssl is fully using the EVP API, we need a way to specify that we want a quick check instead of a full check. Therefore we introduce EVP_PKEY_param_check_quick() and use it. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14146)
2021-02-15Add docs for ASN1_item_sign and ASN1_item_verify functionsShane Lontis
This is to address part of issue #13192. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13373)
2021-02-12DOCS: Update the internal documentation on EVP_PKEY.Richard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14059)
2021-02-12Update documentation following deprecation of SRPMatt Caswell
Ensure all the man pages correctly reflect the deprecated status of SRP. Fixes #13917 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14132)
2021-02-11X509_STORE_CTX_cleanup(): Use internally so no need to call explicitlyDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14088)
2021-02-11Match description with actual output of dgstKOBAYASHI Ittoku
CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14089)
2021-02-10Handle partial data re-sending on ktls/sendfile on FreeBSDOleksandr Tymoshenko
Add a handler for EBUSY sendfile error in addition to EAGAIN. With EBUSY returned the data still can be partially sent and user code has to be notified about it, otherwise it may try to send data multiple times. Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13716)
2021-02-10Replace provider digest flags with separate param fieldsShane Lontis
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13830)
2021-02-10Replace provider cipher flags with separate param fieldsShane Lontis
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13830)
2021-02-10Replace MAC flags OSSL_MAC_PARAM_FLAGS with separate param fields.Shane Lontis
Fixes #12992 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13830)
2021-02-10Change the ASN1 variant of x942kdf so that it can test acvp data.Shane Lontis
This 'special' way of specifying the data should only be used for testing purposes. It should not be used in production environments. ACVP passes a blob of DER encoded data for some of the fields rather than passing them as separate fields that need to be DER encoded. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14077)
2021-02-09x509_vfy.c: Sort out return values 0 vs. -1 (failure/internal error)Dr. David von Oheimb
Also simplify first part of verify_chain() Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14095)
2021-02-09x509_vfy: Clarify relevance of ctx->error also on successful verificationDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14127)
2021-02-09x509_vfy.c: Fix various coding style and documentation style nitsDr. David von Oheimb
Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14127)
2021-02-09CHANGES.md: Mention RSA key generation slowdown related changesTomas Mraz
Fixes #14068 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14073)
2021-02-09Deprecate BN_pseudo_rand() and BN_pseudo_rand_range()Tomas Mraz
The functions are obsolete aliases for BN_rand() and BN_rand_range() since 1.1.0. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14080)
2021-02-09Enhanced integer parsing in OSSL_PARAM_allocate_from_textPetr Gotthard
Fixes #14041 and additional bugs discovered by the newly created tests. This patch: - Introduces support for 0x prefixed integers - Fixes parsing of negative integers (negative numbers were shifted by -2) - Fixes ability to parse maximal unsigned numbers ("too small buffer" error used to be reported incorrectly) - Fixes a memory leak when OSSL_PARAM_allocate_from_text fails leaving a temporary BN allocated Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14093)
2021-02-08Simplify the EVP_PKEY_XXX_fromdata_XX methods.Shane Lontis
The existing names such as EVP_PKEY_param_fromdata_settable were a bit confusing since the 'param' referred to key params not OSSL_PARAM. To simplify the interface a 'selection' parameter will be passed instead. The changes are: (1) EVP_PKEY_fromdata_init() replaces both EVP_PKEY_key_fromdata_init() and EVP_PKEY_param_fromdata_init(). (2) EVP_PKEY_fromdata() has an additional selection parameter. (3) EVP_PKEY_fromdata_settable() replaces EVP_PKEY_key_fromdata_settable() and EVP_PKEY_param_fromdata_settable(). EVP_PKEY_fromdata_settable() also uses a selection parameter. Fixes #12989 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14076)
2021-02-07Fix race condition & allow operation cache to grow.Pauli
This fixes a race condition where the index to the cache location was found under a read lock and a later write lock set the cache entry. The issue being that two threads could get the same location index and then fight each other over writing the cache entry. The most likely outcome is a memory leak, however it would be possible to set up an invalid cache entry. The operation cache was a fixed sized array, once full an assertion failed. The other fix here is to convert this to a stack. The code is simplified and it avoids a cache overflow condition. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14062)
2021-02-06Add X509_STORE_CTX_verify(), which takes the first untrusted cert as default ↵Dr. David von Oheimb
target Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14021)
2021-02-05Makefile template: Allow separate generation of .pod.in -> .podRichard Levitte
We do this by adding the attribute 'pod' to all .pod.in -> .pod generations, like this: DEPEND[NAME.pod]{pod}=NAME.pod.in, ... and selecting out the target files for those dependencies into a dedicated target 'build_generated_pods', which the 'doc-nits' and 'cmd-nits' make targets are made to depend on. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14067)
2021-02-05DOCS: Remove the "global" dependency on writing .pod files from .pod.inRichard Levitte
The dependency was made in such a way that .pod.in -> .pod generation would always be done, no matter what. This changes the procedure so that the generation is made "on demand", i.e. when the resulting .pod files are needed. This turned out to be duplicated dependencies, as the .pod -> .pod.in dependencies were already in place. Just removing the duplicate fixes the situation. 'make build_all_generated' still works, for those who do want to have all file generations performed. (as a reminder, this is suitable to generate the files a fast system and then copy the result to a slower system, or system where there's no perl) Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14067)
2021-02-05provider-signature.pod: Fix formatting.Tomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13988)
2021-02-05EVP: Adapt EVP_PKEY_{set1,get1}_encoded_public_key()Richard Levitte
These functions are modified to use EVP_PKEY_set_octet_string_param() and EVP_PKEY_get_octet_string_param() instead of evp_keymgmt_set_params() and evp_keymgmt_get_params(). To accomplish this fully, EVP_PKEY_get_octet_string_param() is changed slightly to populate |*out_sz| with the return size, even if getting the params resulted in an error. We also modify EVP_PKEY_get_utf8_string_param() to match EVP_PKEY_get_octet_string_param() Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14056)
2021-02-05EVP: Modify the checks in EVP_PKEY_{set,get}_xxx_param() functionsRichard Levitte
The checks of the type of EVP_PKEY were from before we had the macro evp_pkey_is_provided(). Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14056)
2021-02-05EVP: Adapt the other EVP_PKEY_set_xxx_param() functionsRichard Levitte
They were calling evp_keymgmt_set_params() directly. Those calls are changed to go through EVP_PKEY_set_params(). We take the opportunity to constify these functions. They have to unconstify internally for the compiler to stop complaining when placing those pointers in an OSSL_PARAM element, but that's still better than forcing the callers to do that cast. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14056)
2021-02-05apps/openssl: add -propquery command line optionPetr Gotthard
Fixes #13656. Right now all openssl commands use a NULL propq. This patch adds a possibility to specify a custom propq. The implementation follows the example of set_nameopt/get_nameopt. Various tools had to be modified to call app_get0_propq after it has been populated. Otherwise the -propquery has no effect. The tests then verify the -propquery affects the tool behaviour by requesting a non-existing property. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13707)
2021-02-04Allow NULL arg to OPENSSL_sk_{dup,deep_copy} returning empty stackDr. David von Oheimb
This simplifies many usages Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14040)
2021-02-04openssl.pod: Add documentation for using the loader_attic engineDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13551)
2021-02-03Deprecate EVP_MD_CTX_{set_}update_fn()Rich Salz
They are still used internally in legacy code. Also fixed up some minor things in EVP_DigestInit.pod Fixes: #14003 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14008)
2021-02-02Ensure the EVP_PKEY operation_cache is appropriately lockedMatt Caswell
The EVP_PKEY operation_cache caches references to provider side key objects that have previously been exported for this EVP_PKEY, and their associated key managers. The cache may be updated from time to time as the EVP_PKEY is exported to more providers. Since an EVP_PKEY may be shared by multiple threads simultaneously we must be careful to ensure the cache updates are locked. Fixes #13818 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13987)
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-11 00:05:03 +0000