aboutsummaryrefslogtreecommitdiffstats
path: root/doc
Commit message (Collapse)AuthorAgeFilesLines
* Add random serial# support.Rich Salz2017-08-221-0/+9
| | | | | | | | | | Add -rand_serial to CA command and "serial_rand" config option. Up RAND_BITS to 159, and comment why: now confirms to CABForum guidelines (Ballot 164) as well as IETF RFC 5280 (PKIX). Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4185)
* Document missing EVP_PKEY_method_* itemsPaul Yang2017-08-211-0/+376
| | | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4104)
* Fix some documentation typos.David Benjamin2017-08-161-1/+1
| | | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/4173)
* STORE: Add documentation on the expectations for returned namesRichard Levitte2017-08-151-0/+8
| | | | | | | | | | Returned OSSL_STORE_INFO_NAME typed infos are supposed to be a canonical URI for the corresponding object. For example, when using the 'file' scheme loader, the file name is returned, possibly prefixed with 'file://' Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3856)
* STORE: Add info on the expected post_process callback behaviorRichard Levitte2017-08-151-0/+4
| | | | | Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3856)
* Add SSL_get_pending_cipher()Benjamin Kaduk2017-08-151-2/+18
| | | | | | | | | | | | | | | | | | | The existing function SSL_get_current_cipher() queries the current session for the ciphersuite in use, but there is no way for application code to determine what ciphersuite has been negotiated and will be used in the future, prior to ChangeCipherState (or the TLS 1.3 equivalent) causing the new cipher to take effect and become visible in the session information. Expose this information to appropriate application callbacks to use during the handshake. The name SSL_get_pending_cipher() was chosen for compatibility with BoringSSL's routine of that name. Improve the note on macro implementations in SSL_get_current_cipher.pod while here. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4070)
* Doc fixesRich Salz2017-08-1415-39/+183
| | | | | | | | | | | | Write missing prime.pod and srp.pod Implement -c in find-doc-nits (for command options) Other fixes to some manpages Use B<-I<digest|cipher>> notation Split up multiple flags into a single entry in the synopsis. Add -1 and missing-help to list command. Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4144)
* Fix some typo and commentsFdaSilvaYY2017-08-121-2/+2
| | | | | | | | [skip ci] Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4149)
* Add EVP_DigestFinalXOF, interface to extendable-output functions, XOFs.Andy Polyakov2017-08-121-3/+11
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4137)
* Clarify CLI OCSP documentationJohannes Bauer2017-08-111-0/+7
| | | | | | | | | | This fixes issue #3043, which ultimately was reported because documentation was not clear on the meaning of the "-ignore_err" option. Update both command line documentation and add this option to manpage. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4143)
* Fix some Typos and indentsFdaSilvaYY2017-08-111-1/+1
| | | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4108)
* Add missing documentation of the default format for commands.Tomas Mraz2017-08-0915-31/+33
| | | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4122)
* Fix trivial nits in documentaionPaul Yang2017-08-092-2/+2
| | | | | | | | Code Health (Tuesday?): Parameters' names are not correct. Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4117)
* Add XXX_security_bits documentationPaul Yang2017-08-096-18/+99
| | | | | | | | | This is a 'code health' commit to respond to this round of code health Tuesday... Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4099)
* Add an SSL_SESSION_dup() functionMatt Caswell2017-08-091-0/+9
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4072)
* Add documentation for the scrypt PKEY_METHODJohannes Bauer2017-08-081-0/+158
| | | | | | | | Added manpage for the new scrypt EVP_PKEY_METHOD KDF interface. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Stephen Henson <steve@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4026)
* Small typo in manpage of x509(1)Johannes Bauer2017-08-051-1/+1
| | | | | | Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Andy Polyakov <appro@openssl.org> GH: #4090
* Fix typo in HKDF example documentationJohannes Bauer2017-08-051-1/+1
| | | | | | | | | Out-of-bounds array access in the example documentation of EVP_PKEY_CTX_set_hkdf_md fixed. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4081)
* Consolidate to a single asn1_time_from_tm() functionTodd Short2017-08-041-32/+122
| | | | | | | | | | | | | | | | Add missing ASN1_TIME functions Do some cleanup of the ASN1_TIME code. Add ASN1_TIME_normalize() to normalize ASN1_TIME structures. Add ASN1_TIME_compare() to compare two ASN1_TIME structures. Add ASN1_TIME_cmp_time_t() to compare an ASN1_TIME to time_t (generic version of ASN1_UTCTIME_cmp_time_t()). Replace '0' .. '9' compares with isdigit() Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2753)
* Add RAND_priv_bytes() for private keysRich Salz2017-08-031-2/+9
| | | | | | | | | | Add a new global DRBG for private keys used by RAND_priv_bytes. Add BN_priv_rand() and BN_priv_rand_range() which use RAND_priv_bytes(). Change callers to use the appropriate BN_priv... function. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4076)
* Switch from ossl_rand to DRBG randRich Salz2017-08-031-7/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | If RAND_add wraps around, XOR with existing. Add test to drbgtest that does the wrap-around. Re-order seeding and stop after first success. Add RAND_poll_ex() Use the DF and therefore lower RANDOMNESS_NEEDED. Also, for child DRBG's, mix in the address as the personalization bits. Centralize the entropy callbacks, from drbg_lib to rand_lib. (Conceptually, entropy is part of the enclosing application.) Thanks to Dr. Matthias St Pierre for the suggestion. Various code cleanups: -Make state an enum; inline RANDerr calls. -Add RAND_POLL_RETRIES (thanks Pauli for the idea) -Remove most RAND_seed calls from rest of library -Rename DRBG_CTX to RAND_DRBG, etc. -Move some code from drbg_lib to drbg_rand; drbg_lib is now only the implementation of NIST DRBG. -Remove blocklength Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4019)
* Add EC key generation paragraph in doc/HOWTO/keys.txtPaul Yang2017-08-011-13/+46
| | | | | | | | Seems this documentation is not dead, so add this missing part Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4037)
* RSA_get0_ functions permit NULL parametersKen Goldman2017-08-011-0/+4
| | | | | | | | Document that the RSA_get0_ functions permit a NULL BIGNUM **. Those output parameters are ignored. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4064)
* Add '-ext' option to display extensions in 'x509'Paul Yang2017-08-011-0/+15
| | | | | | | | | | | | | This is to address issue #3932. Support comma-separated string to specify what extensions to be displayed. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4016) Remove redundant variable [to be squashed]
* Fix typo in documentsXiaoyin Liu2017-08-0116-28/+27
| | | | | | | | | I scanned all files in the doc folder with a spell checker (https://github.com/EWSoftware/VSSpellChecker). This patch (hopefully) corrected all spell errors that it found. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/4065)
* Fix the names of older ciphers.David Benjamin2017-07-311-2/+4
| | | | | | | | | | | | | | The names of these ciphers have an "SSL_" prefix, but the RFC names use "TLS_": https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4 This dates back to these ciphers being originally defined in SSLv3. As SSLv3 is on its way out anyway and this is a new set of APIs, consistently use the TLS names. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4007)
* Fix typo in ASN1_TIME_set.podXiaoyin Liu2017-07-301-1/+1
| | | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4053)
* Update ASN1_TIME_to_tm's documentationPaul Yang2017-07-301-1/+3
| | | | | | | | To state the fractional seconds part will be lost in the conversion. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4041)
* Add list -public-key-methodsDr. Stephen Henson2017-07-291-0/+6
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4015)
* Add public key method enumeration function.Dr. Stephen Henson2017-07-291-0/+50
| | | | | | | Add functions to enumerate public key methods. Add test to ensure table is in the correct order. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4015)
* Document OPENSSL_secure_clear_freeBernd Edlinger2017-07-291-2/+16
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4044)
* Make SSL_set_tlsext_host_name no effect from server sidePaul Yang2017-07-281-2/+12
| | | | | | | | | Documentation and test cases are also updated Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3783)
* Fix a reference nit in docPaul Yang2017-07-281-1/+1
| | | | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4036)
* Remove trailing whitespace from store-related man pagesBenjamin Kaduk2017-07-272-3/+3
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3860)
* Catch up to the removal of OSSL_STORE_open_file()Benjamin Kaduk2017-07-273-24/+8
| | | | | | | | | | Remove references to it in documentation. Unfortunately, it is too late to renumber symbols in libcrypto.num and avoid the NOEXIST entry there. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3860)
* Various doc fixes.Xiaoyin Liu2017-07-262-2/+2
| | | | | | | | | | | | | Fix typo in NOTES.WIN: this -> these Fix wrong capital letter in certificates.txt Make number of characters in each line more even Remove redundant empty line Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3986)
* add basic references to the new methods in documentationHubert Kario2017-07-262-0/+4
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1334)
* fix OSSL_STORE man pagesHubert Kario2017-07-263-3/+3
| | | | | | | | | the man pages have lines that contain nothing but whitespace, clean it up by removing that whitespace Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1334)
* Add test cases and docs for ASN1_STRING_TABLE_* functionsPaul Yang2017-07-261-0/+65
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3998)
* Add support to free/allocate SSL buffersTodd Short2017-07-261-0/+67
| | | | | | | | | | | | | | | | OpenSSL already has the feature of SSL_MODE_RELEASE_BUFFERS that can be set to release the read or write buffers when data has finished reading or writing. OpenSSL will automatically re-allocate the buffers as needed. This can be quite aggressive in terms of memory allocation. This provides a manual mechanism. SSL_free_buffers() will free the data buffers if there's no pending data. SSL_alloc_buffers() will realloc them; but this function is not strictly necessary, as it's still done automatically in the state machine. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2240)
* Wire SHA3 EVPs and add tests.Andy Polyakov2017-07-251-6/+14
| | | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3943)
* Improve struct tm populationPauli2017-07-241-4/+4
| | | | | | | | | | Using Zeller's congruence to fill the day of week field, Also populate the day of year field. Add unit test to cover a number of cases. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3999)
* Add asn1_time_to_tm function and check days in monthPaul Yang2017-07-241-2/+4
| | | | | | | | | | | | | Based on discussion in PR #3566. Reduce duplicated code in original asn1_utctime_to_tm and asn1_generalizedtime_to_tm, and introduce a new internal function asn1_time_to_tm. This function also checks if the days in the input time string is valid or not for the corresponding month. Test cases are also added. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3905)
* Update documentation for SSL_is_server()Paul Yang2017-07-241-2/+15
| | | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3893)
* Update doc/ca.pod to clarify description for datesPaul Yang2017-07-231-2/+14
| | | | | | | | "Note" part is based on PR #3566 Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3895)
* Add --with-rand-seedRich Salz2017-07-222-29/+46
| | | | | | | | | | | | | | | | | | | | | | | | Add a new config param to specify how the CSPRNG should be seeded. Illegal values or nonsensical combinations (e.g., anything other than "os" on VMS or HP VOS etc) result in build failures. Add RDSEED support. Add RDTSC but leave it disabled for now pending more investigation. Refactor and reorganization all seeding files (rand_unix/win/vms) so that they are simpler. Only require 128 bits of seeding material. Many document improvements, including why to not use RAND_add() and the limitations around using load_file/write_file. Document RAND_poll(). Cleanup Windows RAND_poll and return correct status More completely initialize the default DRBG. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3965)
* Support converting cipher name to RFC name and vice versaPaul Yang2017-07-212-2/+29
| | | | | | | | | | | | | | | Fixes: issue #3747 make SSL_CIPHER_standard_name globally available and introduce a new function OPENSSL_cipher_name. A new option '-convert' is also added to 'openssl ciphers' app. Documentation and test cases are added. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3859)
* Add some performance notes about early dataMatt Caswell2017-07-181-0/+24
| | | | | | | | | | In particular add information about the effect of Nagle's algorithm on early data. Fixes #3906 Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/3955)
* RSA_padding_check_PKCS1_type_2 is not constant time.Emilia Kasper2017-07-182-0/+14
| | | | | | | | This is an inherent weakness of the padding mode. We can't make the implementation constant time (see the comments in rsa_pk1.c), so add a warning to the docs. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Standardize apps use of -rand, etc.Rich Salz2017-07-1622-49/+255
| | | | | | | | | | | | | | | | | | | | Standardized the -rand flag and added a new one: -rand file... Always reads the specified files -writerand file Always writes to the file on exit For apps that use a config file, the RANDFILE config parameter reads the file at startup (to seed the RNG) and write to it on exit if the -writerand flag isn't used. Ensured that every app that took -rand also took -writerand, and made sure all of that agreed with all the documentation. Fix error reporting in write_file and -rand Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3862)
generated by cgit v1.2.3 (git 2.39.1) at 2024-05-24 17:55:29 +0000