summaryrefslogtreecommitdiffstats
path: root/doc/ssl
Commit message (Collapse)AuthorAgeFilesLines
* Document signature algorithm setting functions.Dr. Stephen Henson2015-07-281-0/+104
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Document shared sigalgs functions.Dr. Stephen Henson2015-07-231-0/+77
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* SSL_CONF additions.Dr. Stephen Henson2015-07-211-0/+27
| | | | | | | | | | Add support for loading verify and chain stores in SSL_CONF. Commands to set verify mode and client CA names. Add documentation. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* correct exampleDr. Stephen Henson2015-07-091-1/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add docs for ssl verification parameter functions.Dr. Stephen Henson2015-06-241-0/+55
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* GH297: Fix NAME section of SSL_CTX_use_serverinfo.podVitezslav Cizek2015-06-231-1/+1
| | | | | Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Matt Caswell <matt@openssl.org>
* Remove SSL_OP_TLS_BLOCK_PADDING_BUGEmilia Kasper2015-06-101-4/+0
| | | | | | | | | This is a workaround so old that nobody remembers what buggy clients it was for. It's also been broken in stable branches for two years and nobody noticed (see https://boringssl-review.googlesource.com/#/c/1694/). Reviewed-by: Tim Hudson <tjh@openssl.org>
* Change return type of the new accessorsMatt Caswell2015-05-281-7/+7
| | | | | | | | The new accessors SSL_get_client_random, SSL_get_server_random and SSL_SESSION_get_master_key should return a size_t to match the type of the |outlen| parameter. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Change the new functions to use size_tMatt Caswell2015-05-281-3/+3
| | | | | | | | Change the new SSL_get_client_random(), SSL_get_server_random() and SSL_SESSION_get_master_key() functions to use size_t for |outlen| instead of int. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Clarify that SSL3_RANDOM_SIZE is a constant, for now.Nick Mathewson2015-05-281-6/+12
| | | | | Signed-off-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add new functions to extract {client,server}_random, master_keyNick Mathewson2015-05-281-0/+73
| | | | | | | | | | | | | Tor uses these values to implement a low-rent clone of RFC 5705 (which, in our defense, we came up with before RFC 5705 existed). But now that ssl_st is opaque, we need another way to get at them. Includes documentation, with suitable warnings about not actually using these functions. Signed-off-by: Nick Mathewson <nickm@torproject.org> Signed-off-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add a documentation clarification suggested by Matt CaswellNick Mathewson2015-05-281-0/+5
| | | | | Signed-off-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add SSL_get_client_ciphers() to return ciphers from ClientHelloNick Mathewson2015-05-281-0/+5
| | | | | | | | | | On the server side, if you want to know which ciphers the client offered, you had to use session->ciphers. But that field is no longer visible, so we need a method to get at it. Signed-off-by: Nick Mathewson <nickm@torproject.org> Signed-off-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove support for OPENSSL_NO_TLSEXTMatt Caswell2015-05-221-3/+0
| | | | | | | | | | Given the pervasive nature of TLS extensions it is inadvisable to run OpenSSL without support for them. It also means that maintaining the OPENSSL_NO_TLSEXT option within the code is very invasive (and probably not well tested). Therefore it is being removed. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove dh512.pemEmilia Kasper2015-05-201-3/+2
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Update documentation with Diffie-Hellman best practices.Emilia Kasper2015-05-201-63/+42
| | | | | | | | | | | | - Do not advise generation of DH parameters with dsaparam to save computation time. - Promote use of custom parameters more, and explicitly forbid use of built-in parameters weaker than 2048 bits. - Advise the callback to ignore <keylength> - it is currently called with 1024 bits, but this value can and should be safely ignored by servers. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Version negotiation rewrite doc updatesMatt Caswell2015-05-163-22/+22
| | | | | | | Update various documentation references to the new TLS_*_method names. Also add a CHANGES entry. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* RT1207: document SSL_COMP_free_compression_methods.Rich Salz2015-05-131-3/+9
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Add SSL_use_certificate_chain_file functionDr. Stephen Henson2015-05-081-2/+3
| | | | | | | | | | | Add SSL_use_certiicate_chain file functions: this is works the same way as SSL_CTX_use_certificate_chain_file but for an SSL structure. Update SSL_CONF code to use the new function. Update docs. Update ordinals. Reviewed-by: Rich Salz <rsalz@openssl.org>
* SSL_CONF table reorganisation.Dr. Stephen Henson2015-05-061-0/+9
| | | | | | | | | Add command line switch entries to table and return SSL_CONF_TYPE_NONE for them in SSL_CONF_cmd_value_type. Update docs. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fixes some typos in doc/ssl/Alok Menghrajani2015-05-033-15/+15
| | | | | This is the last of Alok's PR260 Reviewed-by: Tim Hudson <tjh@openssl.org>
* SSL_CIPHER lookup functions.Dr. Stephen Henson2015-04-221-0/+10
| | | | | | | | | | | | | Add tables to convert between SSL_CIPHER fields and indices for ciphers and MACs. Reorganise ssl_ciph.c to use tables to lookup values and load them. New functions SSL_CIPHER_get_cipher_nid and SSL_CIPHER_get_digest_nid. Add documentation. Reviewed-by: Rich Salz <rsalz@openssl.org>
* free NULL cleanup 10Rich Salz2015-04-114-0/+5
| | | | | | | | | | Avoid checking for NULL before calling free functions. This gets ssl.*free: ssl_sess_cert_free ssl_free ssl_excert_free ssl_cert_free SSL_free SSL_SRP_CTX_free SSL_SESSION_free SSL_CTX_free SSL_CTX_SRP_CTX_free SSL_CONF_CTX_free Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Resolve swallowed returns codesMatt Caswell2015-03-251-1/+7
| | | | | | | | | | The recent updates to libssl to enforce stricter return code checking, left a small number of instances behind where return codes were being swallowed (typically because the function they were being called from was declared as void). This commit fixes those instances to handle the return codes more appropriately. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Support key loading from certificate fileDr. Stephen Henson2015-03-252-3/+10
| | | | | | | | | | | Support loading of key and certificate from the same file if SSL_CONF_FLAG_REQUIRE_PRIVATE is set. This is done by remembering the filename used for each certificate type and attempting to load a private key from the file when SSL_CONF_CTX_finish is called. Update docs. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Removed support for SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG. Also removedMatt Caswell2015-02-261-3/+0
| | | | | | the "-hack" option from s_server that set this option. Reviewed-by: Tim Hudson <tjh@openssl.org>
* typoDr. Stephen Henson2015-02-221-1/+1
| | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Add SSL_SESSION_get0_ticket API function.Matt Caswell2015-02-101-3/+11
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Provide the API functions SSL_SESSION_has_ticket andMatt Caswell2015-02-101-0/+34
| | | | | | | | | | SSL_SESSION_get_ticket_lifetime_hint. The latter has been reported as required to fix Qt for OpenSSL 1.1.0. I have also added the former in order to determine whether a ticket is present or not - otherwise it is difficult to know whether a zero lifetime hint is because the server set it to 0, or because there is no ticket. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove stray "=back". This was causing newer versions of pod2man to choke.Matt Caswell2015-02-091-2/+0
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Apache Traffic Server has a need to set the rbio without touching the wbio.Matt Caswell2015-02-071-2/+11
| | | | | | | | | | | There is no mechanism to do that at the moment - SSL_set_bio makes changes to the wbio even if you pass in SSL_get_wbio(). This commit introduces two new API functions SSL_set_rbio() and SSL_set_wbio(). These do the same job as SSL_set_bio() except they enable you to manage the rbio and wbio individually. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Remove support for SSL_OP_NETSCAPE_CA_DN_BUG.Matt Caswell2015-02-061-5/+0
| | | | | | | This is an ancient bug workaround for Netscape clients. The documentation talks about versions 3.x and 4.x beta. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add SSL_get_extms_support documentation.Dr. Stephen Henson2015-02-031-0/+33
| | | | | | | | | Document SSL_get_extms_support(). Modify behaviour of SSL_get_extms_support() so it returns -1 if the master secret support of the peer is not known (e.g. handshake in progress). Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* OPENSSL_NO_XXX cleanup: OPENSSL_NO_BUF_FREELISTSRich Salz2015-01-271-4/+2
| | | | | | | | Remove OPENSSL_NO_BUF_FREELISTS. This was turned on by default, so the work here is removing the 'maintain our own freelist' code. Also removed a minor old Windows-multibyte/widechar conversion flag. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Provide documentation for all SSL(_CTX)?_(get|set)(_default)?_read_aheadMatt Caswell2015-01-273-3/+63
| | | | | | functions. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Only allow ephemeral RSA keys in export ciphersuites.Dr. Stephen Henson2015-01-062-24/+9
| | | | | | | | | | | OpenSSL clients would tolerate temporary RSA keys in non-export ciphersuites. It also had an option SSL_OP_EPHEMERAL_RSA which enabled this server side. Remove both options as they are a protocol violation. Thanks to Karthikeyan Bhargavan for reporting this issue. (CVE-2015-0204) Reviewed-by: Matt Caswell <matt@openssl.org>
* Remove MS SGCDr. Stephen Henson2015-01-022-8/+2
| | | | | | | MS Server gated cryptography is obsolete and dates from the time of export restrictions on strong encryption and is only used by ancient versions of MSIE. Reviewed-by: Matt Caswell <matt@openssl.org>
* Clarify the return values for SSL_get_shared_curve.Emilia Kasper2014-12-051-7/+12
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Remove SSLv2 supportKurt Roeckx2014-12-0411-88/+36
| | | | | | The only support for SSLv2 left is receiving a SSLv2 compatible client hello. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix and improve SSL_MODE_SEND_FALLBACK_SCSV documentation.Bodo Moeller2014-10-211-2/+6
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add TLS_FALLBACK_SCSV documentation, and move s_client -fallback_scsvBodo Moeller2014-10-151-0/+6
| | | | | | handling out of #ifndef OPENSSL_NO_DTLS1 section. Reviewed-by: Rich Salz <rsalz@openssl.org>
* RT468: SSL_CTX_sess_set_cache_size wrongRich Salz2014-09-081-2/+4
| | | | | | | The documentation is wrong about what happens when the session cache fills up. Reviewed-by: Tim Hudson <tjh@openssl.org>
* RT2518: fix pod2man errorsScott Schaefer2014-09-082-7/+7
| | | | | | | | pod2man now complains when item tags are not sequential. Also complains about missing =back and other tags. Silence the warnings; most were already done. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Custom extension documentation.Dr. Stephen Henson2014-08-281-0/+133
| | | | Reviewed-by: Emilia Käsper <emilia@openssl.org>
* RT1744: SSL_CTX_set_dump_dh() doc feedbackDavid Gatwood2014-08-261-7/+9
| | | | | | | | The description of when the server creates a DH key is confusing. This cleans it up. (rsalz: also removed trailing whitespace.) Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* RT3239: Extra comma in NAME lines of two manpagesIngo Schwarze2014-08-121-1/+1
| | | | | | | | | | | | In two OpenSSL manual pages, in the NAME section, the last word of the name list is followed by a stray trailing comma. While this may seem minor, it is worth fixing because it may confuse some makewhatis(8) implementations. While here, also add the missing word "size" to the one line description in SSL_CTX_set_max_cert_list(3). Reviewed by: Dr Stephen Henson <shenson@drh-consultancy.co.uk>
* Fix typo.Dr. Stephen Henson2014-07-141-1/+1
|
* Fixed error in pod files with latest versions of pod2manMatt Caswell2014-07-061-3/+3
|
* Update ticket callback docs.Dr. Stephen Henson2014-07-031-2/+15
|
* Close a whole bunch of documentation-related tickets:Rich Salz2014-07-0215-25/+232
| | | | | 298 424 656 882 939 1630 1807 2263 2294 2311 2424 2623 2637 2686 2697 2921 2922 2940 3055 3112 3156 3177 3277
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-07 17:23:56 +0000