aboutsummaryrefslogtreecommitdiffstats
path: root/doc
Commit message (Collapse)AuthorAgeFilesLines
* RT 3854: Update apps/reqEmilia Kasper2016-02-121-3/+6
| | | | | | Change the default keysize to 2048 bits, and the minimum to 512 bits. Reviewed-by: Rich Salz <rsalz@openssl.org>
* update ciphers manual pageDr. Stephen Henson2016-02-111-38/+1
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Hide OPENSSL_INIT_SETTINGS.Rich Salz2016-02-112-22/+14
| | | | | Make OPENSSL_INIT_SETTINGS an opaque structure. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add CHACHA20 alias for ciphers.Todd Short2016-02-101-0/+14
| | | | | | | | | Update ciphers documentation as well (based on -04 rev of ID). Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> RT: #4206, GH: #642
* Make it possible to get ENGINESDIR info from OpenSSL_versionsRichard Levitte2016-02-102-0/+10
| | | | | | | | Have apps/openssl display the result along with OPENSSLDIR As part of this, add ENGINESDIR in util/mk1mf.pl Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add some documentation about init after deinitMatt Caswell2016-02-101-5/+12
| | | | | | | Attempting to init after deinit is an error. Update the documentation accordingly. Reviewed-by: Rich Salz <rsalz@openssl.org>
* The new init functions can now fail so shouldn't be voidMatt Caswell2016-02-102-4/+8
| | | | | | | The new init functions can fail if the library has already been stopped. We should be able to indicate failure with a 0 return value. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Deprecate the -issuer_checks debugging optionViktor Dukhovni2016-02-107-60/+177
| | | | | | | | | | | | This was a developer debugging feature and was never a useful public interface. Added all missing X509 error codes to the verify(1) manpage, but many still need a description beyond the associated text string. Sorted the errors in x509_txt.c by error number. Reviewed-by: Stephen Henson <steve@openssl.org>
* Rename INIT funtions, deprecate old ones.Rich Salz2016-02-1021-140/+87
| | | | | | Man, there were a lot of renamings :) Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove store.Rich Salz2016-02-101-6/+1
| | | | | | | Rebased and merged by me, with Ben's approval. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Ben Laurie <ben@openssl.org>
* Updates for auto init/deinit review commentsMatt Caswell2016-02-092-13/+16
| | | | | | Fixes for the auto-init/deinit code based on review comments Reviewed-by: Richard Levitte <levitte@openssl.org>
* Provide documentation for auto-init/auto-deinitMatt Caswell2016-02-092-0/+304
| | | | | | | | Provide some man pages for auto-init/deinit. Also update the INSTALL documentation for information on the new Configure options implemented as part of this. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Small fixesRichard Levitte2016-02-081-0/+5
| | | | | | | | - One typo fixed in crypto/bio/b_addr.c - Add a comment in doc/crypto/BIO_parse_hostserv.pod to explain the blank lines with one lonely space each. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Suppress DANE TLSA reflection when verification failsViktor Dukhovni2016-02-082-8/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As documented both SSL_get0_dane_authority() and SSL_get0_dane_tlsa() are expected to return a negative match depth and nothing else when verification fails. However, this only happened when verification failed during chain construction. Errors in verification of the constructed chain did not have the intended effect on these functions. This commit updates the functions to check for verify_result == X509_V_OK, and no longer erases any accumulated match information when chain construction fails. Sophisticated developers can, with care, use SSL_set_verify_result(ssl, X509_V_OK) to "peek" at TLSA info even when verification fail. They must of course first check and save the real error, and restore the original error as quickly as possible. Hiding by default seems to be the safer interface. Introduced X509_V_ERR_DANE_NO_MATCH code to signal failure to find matching TLSA records. Previously reported via X509_V_ERR_CERT_UNTRUSTED. This also changes the "-brief" output from s_client to include verification results and TLSA match information. Mentioned session resumption in code example in SSL_CTX_dane_enable(3). Also mentioned that depths returned are relative to the verified chain which is now available via SSL_get0_verified_chain(3). Added a few more test-cases to danetest, that exercise the new code. Resolved thread safety issue in use of static buffer in X509_verify_cert_error_string(). Fixed long-stating issue in apps/s_cb.c which always sets verify_error to either X509_V_OK or "chain to long", code elsewhere (e.g. s_time.c), seems to expect the actual error. [ The new chain construction code is expected to correctly generate "chain too long" errors, so at some point we need to drop the work-arounds, once SSL_set_verify_depth() is also fixed to propagate the depth to X509_STORE_CTX reliably. ] Reviewed-by: Rich Salz <rsalz@openssl.org>
* more doc fixesRich Salz2016-02-073-21/+48
| | | | | | | | | | | | | | | | | dgst: using digest instead of specific digest commands the digest list specified in man dgst may be inaccurate, hence using digest and referring to the list in digest-commands 'sha' as a digest name is no longer supported dgst,pkeyutl cmds help cleanup - In dgst, pkeyutl cmds, some options help was missing. - fixed a minor typo in openssl.pod, that fixes make install. - digest-commands was showing ‘sha’, which is not a supported digest anymore. Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
* Clarify resumed sessions and NULL return.Dr. Stephen Henson2016-02-081-2/+3
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Stack documentation.Dr. Stephen Henson2016-02-061-0/+200
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* commands help cleanupA J Mohan Rao2016-02-062-12/+15
| | | | | | | | opt_valtype 0 is same as '-' while printing cmd usage asn1parse/ca/ciphers help cleanup Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Add documenation for X509_chain_up_ref()Dr. Stephen Henson2016-02-061-0/+12
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Add SSL_get0_verified_chain() to return verified chain of peerDr. Stephen Henson2016-02-061-6/+21
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* RT4194: Restore old engine parameter parsing.Rich Salz2016-02-062-1/+96
| | | | | | | | | Allow initial engine names as first parameters before flags. Also add engine param to help summary Wrote manpage Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Update DTLSv1_listen documentationMatt Caswell2016-02-051-3/+5
| | | | | | | Make it clear that if we are unable to get hold of the peer address then *peer is cleared and the family set to AF_UNSPEC. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Add a BIO_ADDR_clear functionMatt Caswell2016-02-051-2/+7
| | | | | | | Adds a new function BIO_ADDR_clear to reset a BIO_ADDR back to an unitialised state, and to set the family to AF_UNSPEC. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* GH601: Various spelling fixes.FdaSilvaYY2016-02-058-13/+13
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Make DTLSv1_listen a first class function and change its typeMatt Caswell2016-02-051-10/+7
| | | | | | | | | The DTLSv1_listen function exposed details of the underlying BIO abstraction and did not properly allow for IPv6. This commit changes the "peer" argument to be a BIO_ADDR and makes it a first class function (rather than a ctrl) to ensure proper type checking. Reviewed-by: Richard Levitte <levitte@openssl.org>
* RT4292: Remove ===== lineRich Salz2016-02-053-1019/+0
| | | | | | Also remove two mistakenly checked-in files. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* RT1596: Add clarifying doc.Rich Salz2016-02-051-1/+2
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* GH628: Add -help to all apps docs.A J Mohan Rao2016-02-0540-15/+1218
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* GH628: Add -help to all apps docs.Rich Salz2016-02-053-0/+15
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Various RT doc fixesRich Salz2016-02-056-205/+144
| | | | | | | | | | | | | | | | RT1556: doc/crypto/threads.pod RT2024: Missing pages mentioned in crypto.pod RT2890: Wrong size in ERR_string_error description. RT3461: Better description of PEM Encryption (Jeffrey Walton <noloader@gmail.com>) Also, fix up formatting and removed some code examples that encourage unsafe patterns, like unencrypted private keys (Rich Salz) RT4240: Document some speed flags (Tomas Mraz <tmraz@redhat.com>) RT4260: Fix return value doc for X509_REQ_sign and X509_sign (Laetitia Baudoin <lbaudoin@google.com>) Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Restore -no_comp switch for backwards compatible behaviourViktor Dukhovni2016-02-053-1/+40
| | | | Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Add ec -check optionDr. Stephen Henson2016-02-041-0/+5
| | | | Reviewed-by: Andy Polyakov <appro@openssl.org>
* Refactoring BIO: adapt BIO_s_connect and BIO_s_acceptRichard Levitte2016-02-033-24/+21
| | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Refactoring BIO: new socket-handling functions, deprecate older onesRichard Levitte2016-02-031-0/+101
| | | | | | | | | | | | | | | | | | | | | Added functions: BIO_socket BIO_connect BIO_listen BIO_accept_ex BIO_closesocket BIO_sock_info These get deprecated: BIO_gethostbyname BIO_get_port BIO_get_host_ip BIO_get_accept_socket BIO_accept Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Refactoring BIO: add wrappers around sockaddr et alRichard Levitte2016-02-033-0/+253
| | | | | | | | | | | | | | | | | | | | | | | | | | Because different platforms have different levels of support for IPv6, different kinds of sockaddr variants, and some have getaddrinfo et al while others don't, we could end up with a mess if ifdefs, duplicate code and other maintainance nightmares. Instead, we're introducing wrappers around the common form for socket communication: BIO_ADDR, closely related to struct sockaddr and some of its variants. BIO_ADDRINFO, closely related to struct addrinfo. With that comes support routines, both convenient creators and accessors, plus a few utility functions: BIO_parse_hostserv, takes a string of the form host:service and splits it into host and service. It checks for * in both parts, and converts any [ipv6-address] syntax to ust the IPv6 address. BIO_lookup, looks up information on a host. All routines handle IPv4 (AF_INET) and IPv6 (AF_INET6) addresses, and there is support for local sockets (AF_UNIX) as well. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* RT3234: disable compressionEmilia Kasper2016-02-031-2/+6
| | | | | | | | | | | | | | | | | CRIME protection: disable compression by default, even if OpenSSL is compiled with zlib enabled. Applications can still enable compression by calling SSL_CTX_clear_options(ctx, SSL_OP_NO_COMPRESSION), or by using the SSL_CONF library to configure compression. SSL_CONF continues to work as before: SSL_CONF_cmd(ctx, "Options", "Compression") enables compression. SSL_CONF_cmd(ctx, "Options", "-Compression") disables compression (now no-op by default). The command-line switch has changed from -no_comp to -comp. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix pkeyutl/rsautl empty encrypt-input/decrypt-output handlingViktor Dukhovni2016-02-022-4/+9
| | | | | | | | | | | | | Also fix option processing in pkeyutl to allow use of (formerly) "out-of-order" switches that were needless implementation limitations. Handle documented "ENGINE" form with -keyform and -peerform. Better handling of OPENSSL_NO_ENGINE and OPENSSL_NO_RSA. RT2018 Reviewed-by: Rich Salz <rsalz@openssl.org>
* RT2353: Add ipsec IKE OIDRich Salz2016-02-021-0/+2
| | | | Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* New BN functions.Dr. Stephen Henson2016-02-021-2/+18
| | | | | | | | | | Add new function BN_bn2binpad() which checks the length of the output buffer and pads the result with zeroes if necessary. New functions BN_bn2lebinpad() and BN_lebin2bn() which use little endian format. Reviewed-by: Rich Salz <rsalz@openssl.org>
* GH554: Improve pkeyutl docHubert Kario2016-02-011-0/+13
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* constify PACKETEmilia Kasper2016-02-011-2/+2
| | | | | | | | PACKET contents should be read-only. To achieve this, also - constify two user callbacks - constify BUF_reverse. Reviewed-by: Rich Salz <rsalz@openssl.org>
* update DSA docsDr. Stephen Henson2016-02-011-5/+3
| | | | Reviewed-by: Andy Polyakov <appro@openssl.org>
* add option to exclude public key from EC keysDr. Stephen Henson2016-02-011-0/+5
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Check chain extensions also for trusted certificatesViktor Dukhovni2016-01-313-17/+35
| | | | | | | | | This includes basic constraints, key usages, issuer EKUs and auxiliary trust OIDs (given a trust suitably related to the intended purpose). Added tests and updated documentation. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Add EC_GROUP_order_bits, EC_GROUP_get0_order and EC_GROUP_get0_cofactorDr. Stephen Henson2016-01-311-0/+7
| | | | | | | | New functions to return internal pointer for order and cofactor. This avoids the need to allocate a new BIGNUM which to copy the value to. Simplify code to use new functions. Reviewed-by: Rich Salz <rsalz@openssl.org>
* RT4129: BUF_new_mem_buf should take const void *Daniel Kahn Gillmor2016-01-311-2/+2
| | | | | Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Add function to return internal enoding of X509_NAME.Dr. Stephen Henson2016-01-301-6/+20
| | | | | | PR#4280 Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add CRYPTO_secure_zallocRich Salz2016-01-271-27/+38
| | | | | | Also turn B<foo> into foo() in the pod page. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Doc fixes suggested by Claus AssmannViktor Dukhovni2016-01-272-34/+42
| | | | | | RT4264, RT4268 Reviewed-by: Tim Hudson <tjh@openssl.org>
* Add SSL_up_ref() and SSL_CTX_up_ref()Matt Caswell2016-01-263-6/+22
| | | | | | | | The SSL and SSL_CTX structures are reference counted. However since libssl was made opaque there is no way for users of the library to manipulate the reference counts. This adds functions to enable that. Reviewed-by: Stephen Henson <steve@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-01 18:12:53 +0000