summaryrefslogtreecommitdiffstats
path: root/doc (follow)
Commit message (Collapse)AuthorAgeFilesLines
* General verify options to openssl tsfbroda2016-03-151-11/+51
| | | | | | | | | | | | | | This commit adds the general verify options of ocsp, verify, cms, etc. to the openssl timestamping app as suggested by Stephen N. Henson in [openssl.org #4287]. The conflicting "-policy" option of "openssl ts" has been renamed to "-tspolicy". Documentation and tests have been updated. CAVE: This will break code, which currently uses the "-policy" option. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Update and clarify ECDSA documentation.Dr. Stephen Henson2016-03-141-121/+119
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix typo in manual, missing ending '>'Richard Levitte2016-03-141-1/+1
| | | | Reviewed-by: Stephen Henson <steve@openssl.org>
* Document X509_get_serialNumber and X509_set_serialNumber.Dr. Stephen Henson2016-03-141-0/+55
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Add EVP_PKEY documentation.Dr. Stephen Henson2016-03-131-11/+27
| | | | | | Document EVP_PKEY_id() and EVP_PKEY_base_id(). Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Add doc on when to use SCT callback.Rich Salz2016-03-122-1/+7
| | | | | | With help from Viktor. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Make X509_SIG opaque.Dr. Stephen Henson2016-03-111-3/+9
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Review commentsKurt Roeckx2016-03-111-9/+9
| | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add blake2 support.Bill Cox2016-03-113-8/+13
| | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add X509_CHECK_FLAG_NEVER_CHECK_SUBJECT flagViktor Dukhovni2016-03-101-0/+8
| | | | Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Deprecate the use of version-specific methodsKurt Roeckx2016-03-091-1/+3
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1824
* Fix usage of OPENSSL_NO_*_METHODKurt Roeckx2016-03-091-0/+10
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1824
* Update ciphers -s documentationKurt Roeckx2016-03-091-3/+15
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
* Document SSL_get1_supported_ciphersKurt Roeckx2016-03-091-3/+21
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
* Make SSL_CIPHER_get_version return a const char *Kurt Roeckx2016-03-091-1/+1
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #1595
* Do not display a CT log error message if CT validation is disabledRob Percival2016-03-091-3/+0
| | | | | Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* RT3676: Expose ECgroup i2d functionsRich Salz2016-03-091-1/+15
| | | | Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Convert RSA blinding to new multi-threading APIAlessandro Ghedini2016-03-091-18/+24
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Make DSA_SIG opaque.Dr. Stephen Henson2016-03-081-2/+5
| | | | | | | | | This adds a new accessor function DSA_SIG_get0. The customisation of DSA_SIG structure initialisation has been removed this means that the 'r' and 's' components are automatically allocated when DSA_SIG_new() is called. Update documentation. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Convert CRYPTO_LOCK_X509_* to new multi-threading APIAlessandro Ghedini2016-03-081-0/+36
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Convert CRYPTO_LOCK_BIO to new multi-threading APIAlessandro Ghedini2016-03-081-2/+5
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add cipher query functionsTodd Short2016-03-081-0/+22
| | | | | | | Add functions to determine authentication, key-exchange, FIPS and AEAD. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Convert ERR_STATE to new multi-threading APIAlessandro Ghedini2016-03-082-14/+11
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* GH787: Fix ALPNTodd Short2016-03-081-0/+126
| | | | | | | | | | | | * Perform ALPN after the SNI callback; the SSL_CTX may change due to that processing * Add flags to indicate that we actually sent ALPN, to properly error out if unexpectedly received. * clean up ssl3_free() no need to explicitly clear when doing memset * document ALPN functions Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Fix typo in SSL_pending docsMatt Caswell2016-03-071-1/+1
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Rename EVP_CIPHER_CTX_cipher_data to EVP_CIPHER_CTX_get_cipher_dataMatt Caswell2016-03-072-9/+10
| | | | | | | | We had the function EVP_CIPHER_CTX_cipher_data which is newly added for 1.1.0. As we now also need an EVP_CIPHER_CTX_set_cipher_data it makes more sense for the former to be called EVP_CIPHER_CTX_get_cipher_data. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add documentation for the EVP_CIPHER_CTX_cipher_data functionsMatt Caswell2016-03-071-0/+41
| | | | | | | | The new pipeline code added a new function EVP_CIPHER_CTX_set_cipher_data(). Add documentation for this and the existing EVP_CIPHER_CTX_cipher_data() function. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add documentation for new s_server/s_client optionsMatt Caswell2016-03-072-0/+52
| | | | | | Document the new split_send_frag, max_pipelines and read_buf options. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add documentation for SSL_has_pending()Matt Caswell2016-03-073-24/+44
| | | | | | | | A previous commit added the SSL_has_pending() function which provides a method for knowing whether OpenSSL has buffered, but as yet unprocessed record data. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add pipelining documentationMatt Caswell2016-03-071-0/+126
| | | | | | | Add some documentation for all of the SSL/SSL_CTX functions/ctrls for conrolling read and write pipelining. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Update the dasync engine to add a pipeline cipherMatt Caswell2016-03-071-0/+3
| | | | | | | | Implement aes128-cbc as a pipeline capable cipher in the dasync engine. As dasync is just a dummy engine, it actually just performs the parallel encrypts/decrypts in serial. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Fix pkeyutl to KDF lnks.Rich Salz2016-03-072-2/+2
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* GH768: Minor grammar nits in CRYPTO_get_ex_new_index.podBenjamin Kaduk2016-03-071-4/+5
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Add a function to detect if we have async or notMatt Caswell2016-03-071-5/+14
| | | | | | | Add the ASYNC_is_capable() function and use it in speed. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Update documentationDr. Stephen Henson2016-03-071-23/+0
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Change names of ordinals and libs, libeay => libcrypto and ssleay => libsslRichard Levitte2016-03-051-1/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* use saner default parameters for scryptDr. Stephen Henson2016-03-051-1/+1
| | | | | | Thanks to Colin Percival for reporting this issue. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Documentation for new CT s_client flagsRob Percival2016-03-041-0/+19
| | | | | Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Documentation for new SSL functionsRob Percival2016-03-044-0/+180
| | | | | Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Don't build RC4 ciphersuites into libssl by defaultMatt Caswell2016-03-041-2/+3
| | | | | | | | RC4 based ciphersuites in libssl have been disabled by default. They can be added back by building OpenSSL with the "enable-weak-ssl-ciphers" Configure option at compile time. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Improved HKDF and TLS1-PRF documentationViktor Dukhovni2016-03-043-15/+37
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* GH355: Implement HKDFAlessandro Ghedini2016-03-041-0/+103
| | | | | | | | | | This patch implements the HMAC-based Extract-and-Expand Key Derivation Function (HKDF) as defined in RFC 5869. It is required to implement the QUIC and TLS 1.3 protocols (among others). Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Add KDF support to pkeyutl. Update documentation.Dr. Stephen Henson2016-03-031-0/+17
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add string ctrl operations to TLS1 PRF, update documentation.Dr. Stephen Henson2016-03-021-1/+10
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Provide getters for default_passwd_cb and userdataChristian Heimes2016-03-021-4/+26
| | | | | | | | | This patch provides getters for default_passwd_cb and userdata for SSL and SSL_CTX. The getter functions are required to port Python's ssl module to OpenSSL 1.1.0. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Clarify ASYNC_WAIT_CTX_clear_fd() docsMatt Caswell2016-02-291-1/+2
| | | | | | | Clarify that the "cleanup" routing does not get called if you invoke ASYNC_WAIT_CTX_clear_fd() directly. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Refactor the async wait fd logicMatt Caswell2016-02-294-111/+281
| | | | | | | | | | | | | | | | | | | Implementation experience has shown that the original plan for async wait fds was too simplistic. Originally the async logic created a pipe internally and user/engine code could then get access to it via API calls. It is more flexible if the engine is able to create its own fd and provide it to the async code. Another issue is that there can be a lot of churn in the fd value within the context of (say) a single SSL connection leading to continually adding and removing fds from (say) epoll. It is better if we can provide some stability of the fd value across a whole SSL connection. This is problematic because an engine has no concept of an SSL connection. This commit refactors things to introduce an ASYNC_WAIT_CTX which acts as a proxy for an SSL connection down at the engine layer. Reviewed-by: Richard Levitte <levitte@openssl.org>
* RT4351: Update doc for OPENSSL_cleanseJeffrey Walton2016-02-281-2/+10
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* RT4354: Add some cross-refsJeffrey Walton2016-02-282-1/+3
| | | | | | | | | Stack Overflow has a number of questions related to mutual authentication, the client and its certificate. Those visiting the man pages for functions like SSL_CTX_use_certificate and SSL_CTX_load_verify_locations don't receive the benefit of a cross reference to SSL_CTX_set_client_CA_list. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Reformat and update EC_KEY_new manual page.Dr. Stephen Henson2016-02-271-36/+106
| | | | | | | | | Add some missing parentheses and reformat. Document EC_KEY_oct2key(), EC_KEY_key2buf(), EC_KEY_oct2priv(), EC_KEY_priv2oct() and EC_KEY_priv2buf() Reviewed-by: Rich Salz <rsalz@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-03 14:12:40 +0100