summaryrefslogtreecommitdiffstats
path: root/doc (follow)
Commit message (Collapse)AuthorAgeFilesLines
* DOC:Fix typos in man5/config.podAlex Boboc2020-02-181-1/+1
| | | | | | | | | CLA: trivial Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11104)
* DOC:Fix typos in openssl-enc.pod.in + openssl.podAlex Boboc2020-02-182-3/+3
| | | | | | | | | CLA: trivial Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11104)
* DOC:Fix typos in ossl_cmp_print_log.podAlex Boboc2020-02-181-1/+1
| | | | | | | | | CLA: trivial Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11104)
* DOC:Fix typos in ossl_param_bld_initAlex Boboc2020-02-181-2/+2
| | | | | | | | | CLA: trivial Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11104)
* Deprecate EC command line apps.Pauli2020-02-182-2/+20
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11106)
* DOC: Add documentation related to X509_LOOKUPsRichard Levitte2020-02-183-12/+215
| | | | | | | | | | | Most of all, the base X509_LOOKUP functionality is now documented. Furthermore, the names X509_LOOKUP_METHOD and X509_STORE are added for reference. Some functions were moved from X509_LOOKUP_meth_new.pod Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10986)
* Fix podchecker warningsRichard Levitte2020-02-181-3/+2
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11045)
* chunk 7 of CMP contribution to OpenSSLDr. David von Oheimb2020-02-175-20/+142
| | | | | | | | | | | | | add CMP message validation and related tests; while doing so: * add ERR_add_error_mem_bio() to crypto/err/err_prn.c * move ossl_cmp_add_error_txt() as ERR_add_error_txt() to crypto/err/err_prn.c * add X509_STORE_CTX_print_verify_cb() to crypto/x509/t_x509.c, adding internally x509_print_ex_brief(), print_certs(), and print_store_certs() * move {ossl_cmp_,}X509_STORE_get1_certs() to crypto/x509/x509_lu.c Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/10620)
* fix various formatting nits in CMP contribution chunks 1-6 found by the new ↵Dr. David von Oheimb2020-02-171-4/+4
| | | | | | | | | | | util/check-format.pl in addition: correct wording in doc, comments, and parameter names: self-signed -> self-issued where appropriate Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/10620)
* improve CMP logging according to comments on CMP chunk 7 previewDr. David von Oheimb2020-02-173-78/+128
| | | | | | | | | | | | | in particular: consolidate documentation of CMP logging and error reporting functions fix compilation problem with clang on some platforms rename OSSL_CMP_log etc. to ossl_cmp_log etc. since these macros are CMP-internal move chopping of trailing separator to ossl_cmp_add_error_txt(), also fix handling of leading separator internalize X509_print_ex_brief() as x509_print_ex_brief() Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/10620)
* add internal doc files actually belonging to CMP contribution chunk 6Dr. David von Oheimb2020-02-173-0/+327
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/10620)
* DOC: document in more detail what a BIO_read_ex() via BIO_f_buffer() doesRichard Levitte2020-02-151-4/+14
| | | | | | | | | | | The BIO_f_buffer() documentation tells in enough detail how it affects BIO_gets(), but not how it affects BIO_read_ex(). This change remedies that. Fixes #10859 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10890)
* Document OSSL_SERIALIZER_PUBKEY_TO_DER_PQ and friendsRichard Levitte2020-02-151-1/+11
| | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11071)
* apps x509: passing PKCS#11 URL as -signkeyBastian Germann2020-02-141-3/+4
| | | | | | | | | | | | | | OpenSSL 1.1.0 has extended option checking, and rejects passing a PKCS#11 engine URL to "-signkey" option. The actual code is ready to take it. Change the option parsing to allow an engine URL to be passed and modify the manpage accordingly. CLA: trivial Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/11086)
* Remove unused ossl_param_bld_to_param_ex() function.Pauli2020-02-121-15/+3
| | | | | | | | The recently introduced ossl_param_bld_to_param_ex() function is only called by the unit tests. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11053)
* Remove unused OSSL_PARAM_construct_from_text() function.Pauli2020-02-121-12/+3
| | | | | | | This function is recently introduced and never called by the library or tests. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11053)
* dsa: deprecate applications that depend on the low level DSA functions.Pauli2020-02-114-0/+32
| | | | | | | | | | speed is updated to not support DSA instead of being removed. The dhparam, dsaparam, dsa and gendsa commands are deprecated but still exist without NO_DEPRECATED defined. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10977)
* Deprecate the low level DSA functions.Pauli2020-02-113-2/+49
| | | | | | | | Use of the low level DSA functions has been informally discouraged for a long time. We now formally deprecate them. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10977)
* Generalize the HTTP client so far implemented mostly in crypto/ocsp/ocsp_ht.cDr. David von Oheimb2020-02-104-54/+315
| | | | | | | | | | | | | | | | The new client has become an independent libcrpyto module in crypto/http/ and * can handle any types of requests and responses (ASN.1-encoded and plain) * does not include potentially busy loops when waiting for responses but * makes use of a new timeout mechanism integrated with socket-based BIO * supports the use of HTTP proxies and TLS, including HTTPS over proxies * supports HTTP redirection via codes 301 and 302 for GET requests * returns more useful diagnostics in various error situations Also adapts - and strongly simplifies - hitherto uses of HTTP in crypto/ocsp/, crypto/x509/x_all.c, apps/lib/apps.c, and apps/{ocsp,s_client,s_server}.c Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/10667)
* add BIO_socket_wait(), BIO_wait(), and BIO_connect_retry() improving timeout ↵Dr. David von Oheimb2020-02-102-1/+54
| | | | | | | | support Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/10667)
* Memory allocator code cleanupDavide Galassi2020-02-101-27/+31
| | | | | | | | | | | | | | | | | Typedefs of CRYPTO malloc, realloc and free. MEM_CHECK "modes" are used only as a CRYPTO_mem_ctrl() parameter The CRYPTO_mem_ctrl is defined only if OPENSSL_NO_CRYPTO_MDEBUG is defined, thus define the MEM_CHECK modes under the same condition. Maybe the macros can be removed at all since: 1. CRYPTO_mem_ctrl() just returns -1 and ignores the parameter 2. CRYPTO_mem_ctr() is declared as DEPRECATED by 3.0 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11042)
* tests/drbgtest: use new RAND_DRBG callback_data API instead of ex_dataDr. Matthias St. Pierre2020-02-071-2/+2
| | | | | | | | | | | | | | | | | | | | | | | It took me a little while to realize why the test_rand_drbg_reseed test kept crashing after replacing the RAND_DRBG_{gs}et_ex_data() calls by RAND_DRBG_{gs}et_callback_data(). The reason was that the ex_data API prohibits modifying the callbacks or callback data of chained DRBGs and returned an error which was ignored by the `test_rand_drbg_reseed` test, for good reasons. The `test_rand_drbg_reseed` test is special in this respect, because it needs to install callbacks for all DRBGs, in order to intercept and count the reseeding events. Since the drbgtest module has access to the internal structures of the DRBG anyway, the problem could be solved by accessing the members directly. I added a warning comment in hook_drbg(). [extended tests] Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10950)
* RAND_DRBG: add a callback data for entropy and nonce callbacksDr. Matthias St. Pierre2020-02-072-3/+30
| | | | | | | | | | | | The callback data allows passing context specific data from the application of the DRBG to to the entropy callbacks. This a rather specialized feature which is useful for implementing known answer tests (KATs) or deterministic signatures (RFC6979), which require passing a specified entropy and nonce for instantiating the DRBG. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10950)
* Redesign the KEYMGMT libcrypto <-> provider interface - the basicsRichard Levitte2020-02-0711-315/+336
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The KEYMGMT libcrypto <-> provider interface currently makes a few assumptions: 1. provider side domain parameters and key data isn't mutable. In other words, as soon as a key has been created in any (loaded, imported data, ...), it's set in stone. 2. provider side domain parameters can be strictly separated from the key data. This does work for the most part, but there are places where that's a bit too rigid for the functionality that the EVP_PKEY API delivers. Key data needs to be mutable to allow the flexibility that functions like EVP_PKEY_copy_parameters promise, as well as to provide the combinations of data that an EVP_PKEY is generally assumed to be able to hold: - domain parameters only - public key only - public key + private key - domain parameters + public key - domain parameters + public key + private key To remedy all this, we: 1. let go of the distinction between domain parameters and key material proper in the libcrypto <-> provider interface. As a consequence, functions that still need it gain a selection argument, which is a set of bits that indicate what parts of the key object are to be considered in a specific call. This allows a reduction of very similar functions into one. 2. Rework the libcrypto <-> provider interface so provider side key objects are created and destructed with a separate function, and get their data filled and extracted in through import and export. (future work will see other key object constructors and other functions to fill them with data) Fixes #10979 squash! Redesign the KEYMGMT libcrypto <-> provider interface - the basics Remedy 1 needs a rewrite: Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11006)
* Fix misspelling errors and typos reported by codespellDr. Matthias St. Pierre2020-02-065-5/+5
| | | | | | | Fixes #10998 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11000)
* More accurate doc of -ssl_config optionRich Salz2020-02-061-3/+3
| | | | | | Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/10972)
* Update command listRich Salz2020-02-061-8/+14
| | | | | | | | | Add -standard-commands option to list command (documented) Update standard commands list in openssl.pod Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/10972)
* Add cmd-nits to travis buildRich Salz2020-02-061-1/+1
| | | | | | | | | | Update CHANGES to have a complete and uniform description. Fixes #9730 Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/10972)
* The -hmac option to speed is now #ifdef'dRich Salz2020-02-061-1/+1
| | | | | | Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/10972)
* Add missing s_client optionsRich Salz2020-02-061-1/+135
| | | | | | Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/10972)
* doc: Fix typo in EVP_DigestSignInit manpageJakub Jelen2020-02-061-1/+1
| | | | | | | | | | | | CLA: trivial Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10841)
* Fix small misspelling in doc for OCSP_response_statusthekuwayama2020-02-061-1/+1
| | | | | | | | | CLA: trivial Reviewed-by: Paul Yang <kaishen.yy@antfin.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10810)
* Add FFC param/key generationShane Lontis2020-02-061-4/+22
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10909)
* Params: change UTF8 construct calls to avoid explicit strlen(3) calls.Pauli2020-02-061-1/+3
| | | | | | | | | | It is better, safer and smaller to let the library routine handle the strlen(3) call. Added a note to the documentation suggesting this. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11019)
* Make minimum size for secure memory a size_t.Pauli2020-02-051-1/+4
| | | | | | | | | | | | The minimum size argument to CRYPTO_secure_malloc_init() was an int but ought to be a size_t since it is a size. From an API perspective, this is a change. However, the minimum size is verified as being a positive power of two and it will typically be a small constant. Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from #11003)
* Deprecate the ECDSA and EV_KEY_METHOD functions.Pauli2020-02-041-5/+18
| | | | | | | | Use of the low level ECDSA and EC_KEY_METHOD functions has been informally discouraged for a long time. We now formally deprecate them. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10960)
* EVP_PKEY_assign_EC_KEY(): detect SM2 curve and set EVP_PKEY type accordinglyRichard Levitte2020-02-022-19/+18
| | | | | | | | | | | | | | This means that when loaded or created, EC EVP_PKEYs with the SM2 curve will be regarded as EVP_PKEY_SM2 type keys by default. Applications are no longer forced to check and fix this. It's still possible, for those who want this, to set the key type to EVP_PKEY_EC and thereby run the normal EC computations with the SM2 curve. This has to be done explicitly. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/10942)
* Fix "ts" no-XXX options, document two TLS optionsRich Salz2020-01-312-2/+9
| | | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10191)
* Update the SSL/TLS connection optionsRich Salz2020-01-313-174/+185
| | | | | | | | | | | | | Refactor common flags for SSL/TLS connection options. Update SSL_CONF_cmd.pod to match ordering. Rewrite much of the documentation. Fixes #10160 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10191)
* Add support for DH 'modp' group parameters (RFC 3526)Shane Lontis2020-01-302-7/+11
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10897)
* Provide better documentation for SSL_get_servername()Matt Caswell2020-01-302-10/+115
| | | | | | | | | | | | The behaviour of SSL_get_servername() is quite complicated and depends on numerous factors such as whether it is called on the client or the server, whether it is called before or after the handshake, what protocol version was negotiated, and whether a resumption was attempted or was successful. We attempt to document the behavior more clearly. Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/10018)
* Fix type name typo in d2i/i2d documentation.David Makepeace2020-01-301-1/+1
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/10933)
* Add -issuer_checks to verify optionsRich Salz2020-01-292-2/+4
| | | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10873)
* Document most missing optionsRich Salz2020-01-2927-71/+364
| | | | | | | | | | | | | | | | | | | | | Add cmd-nits make target. Listing options should stop when it hits the "parameters" separator. Add missing .pod.in files to doc/man1/build.info Tweak find-doc-nits to try openssl-XXX before XXX for POD files and change an error messavge to be more useful. Fix the following pages: ca, cms, crl, dgst, enc, engine, errstr, gendsa, genrsa, list, ocsp, passwd, pkcs7, pkcs12, rand, rehash, req, rsautil, s_server, speed, s_time, sess_id, smime, srp, ts, x509. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10873)
* Add more generated man1 doc filesRich Salz2020-01-291-6/+8
| | | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/10873)
* Add RSA key validation to default providerShane Lontis2020-01-293-26/+99
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10780)
* TLS: use EVP for HMAC throughout libssl.Pauli2020-01-291-12/+55
| | | | | | | | Backwards compatibility with the old ticket key call back is maintained. This will be removed when the low level HMAC APIs are finally removed. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10836)
* Deprecate the low level HMAC functionsPauli2020-01-291-0/+10
| | | | | | | | | | | Use of the low level HMAC functions has been informally discouraged for a long time. We now formally deprecate them. Applications should instead use EVP_MAC_CTX_new(3), EVP_MAC_CTX_free(3), EVP_MAC_init(3), EVP_MAC_update(3) and EVP_MAC_final(3). Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10836)
* Modify EVP_PKEY_CTX_new_from_pkey() to add a propquery parameterMatt Caswell2020-01-271-3/+3
| | | | | | | | | | The function EVP_PKEY_CTX_new_from_pkey() infers the name of the algorithm to fetch from the EVP_PKEY that has been supplied as an argument. But there was no way to specify properties to be used during that fetch. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10926)
* openssl-config: add example libssl system-defaultsBenjamin Kaduk2020-01-251-0/+16
| | | | | | | | | Provide a "simple" example for affecting the systemwide default behavior of libssl. The large number of mandatory nested sections makes this less simple than the main description might suggest. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10937)
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-02 05:50:05 +0100