aboutsummaryrefslogtreecommitdiffstats
path: root/doc
Commit message (Collapse)AuthorAgeFilesLines
...
* Ensure =cut is last line in every file.Rich Salz2016-05-1938-6/+63
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* When strict SCT fails record verification failureViktor Dukhovni2016-05-191-11/+20
| | | | | | | | | | | | | | | Since with SSL_VERIFY_NONE, the connection may continue and the session may even be cached, we should save some evidence that the chain was not sufficiently verified and would have been rejected with SSL_VERIFY_PEER. To that end when a CT callback returs failure we set the verify result to X509_V_ERR_NO_VALID_SCTS. Note: We only run the CT callback in the first place if the verify result is still X509_V_OK prior to start of the callback. RT #4502 Reviewed-by: Tim Hudson <tjh@openssl.org>
* Improve and document low-level PEM read routinesViktor Dukhovni2016-05-191-0/+90
| | | | | | | PEM_read(), PEM_read_bio(), PEM_get_EVP_CIPHER_INFO() and PEM_do_header(). Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Ensure verify error is set when X509_verify_cert() failsViktor Dukhovni2016-05-181-1/+1
| | | | | | | | | | | Set ctx->error = X509_V_ERR_OUT_OF_MEM when verificaiton cannot continue due to malloc failure. Also, when X509_verify_cert() returns <= 0 make sure that the verification status does not remain X509_V_OK, as a last resort set it it to X509_V_ERR_UNSPECIFIED, just in case some code path returns an error without setting an appropriate value of ctx->error. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Clarify negative return from X509_verify_cert()Viktor Dukhovni2016-05-181-6/+7
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Document the esc_2254 command line name optionRichard Levitte2016-05-181-1/+6
| | | | | | RT#1466 Reviewed-by: Rich Salz <rsalz@openssl.org>
* Correct documentation errorMatt Caswell2016-05-171-3/+3
| | | | | | | SSL_get_async_wait_fd() was replaced by SSL_get_all_async_fds() and SSL_get_changed_async_fds(). Reviewed-by: Richard Levitte <levitte@openssl.org>
* Documentation: Clarify sizes for UI_add_input_string()Richard Levitte2016-05-161-6/+6
| | | | | | | | The given sizes to not include the final NUL character. RT#2622 Reviewed-by: Matt Caswell <matt@openssl.org>
* Fold threads.h into crypto.h making API publicViktor Dukhovni2016-05-161-1/+60
| | | | | | Document thread-safe lock creation Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add some documentation of SSL_CTX_set_tlsext_status_type()Matt Caswell2016-05-161-13/+23
| | | | | | | The previous commit added SSL_CTX_set_tlsext_status_type(). This one adds some documentation for it. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Unify <TYPE>_up_ref methods signature and behaviour.FdaSilvaYY2016-05-165-8/+12
| | | | | | | | | Add a status return value instead of void. Add some sanity checks on reference counter value. Update the docs. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix various methods declaration in pod fileFdaSilvaYY2016-05-141-8/+8
| | | | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1042)
* Correct documentation on digest used.Dr. Stephen Henson2016-05-131-3/+2
| | | | | | RT#4302 Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Correctly check for trailing digest options.Dr. Stephen Henson2016-05-121-15/+16
| | | | | | | | | | Multiple digest options to the ocsp utility are allowed: e.g. to use different digests for different certificate IDs. A digest option without a following certificate is however illegal. RT#4215 Reviewed-by: Rich Salz <rsalz@openssl.org>
* Update pkcs8 defaults.Dr. Stephen Henson2016-05-111-24/+22
| | | | | | | | Update pkcs8 utility to use 256 bit AES using SHA256 by default. Update documentation. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Fix i2d_X509_AUX, update docs and add testsViktor Dukhovni2016-05-111-1/+13
| | | | | | | When *pp is NULL, don't write garbage, return an unexpected pointer or leak memory on error. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Add -srp option to ciphers command.Dr. Stephen Henson2016-05-101-6/+10
| | | | | | RT#4224 Reviewed-by: Richard Levitte <levitte@openssl.org>
* crypto/des: remove obsolete functions.Andy Polyakov2016-05-101-25/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Typo.Dr. Stephen Henson2016-05-101-1/+1
| | | | | | RT#4538 Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix the docs for ERR_remove_thread_state and ERR_remove_stateRichard Levitte2016-05-101-3/+4
| | | | | | | Don't primarly recommend using OPENSSL_thread_stop(), as that's a last resort. Instead, recommend leaving it to automatic mechanisms. Reviewed-by: Matt Caswell <matt@openssl.org>
* Restore the ERR_remove_thread_state() API and make it a no-opRichard Levitte2016-05-102-23/+20
| | | | | | | | | | | The ERR_remove_thread_state() API is restored to take a pointer argument, but does nothing more. ERR_remove_state() is also made into a no-op. Both functions are deprecated and users are recommended to use OPENSSL_thread_stop() instead. Documentation is changed to reflect this. Reviewed-by: Matt Caswell <matt@openssl.org>
* Fix BIO_eof() for BIO pairsMatt Caswell2016-05-091-0/+3
| | | | | | | | | BIO_eof() was always returning true when using a BIO pair. It should only be true if the peer BIO is empty and has been shutdown. RT#1215 Reviewed-by: Richard Levitte <levitte@openssl.org>
* fix tab-space mixed indentationFdaSilvaYY2016-05-091-1/+1
| | | | | | | No code change Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Constify PKCS12_newpass()Dr. Stephen Henson2016-05-061-1/+1
| | | | | | PR#4449 Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add documentation of PKCS12_newpass()Jeffrey Walton2016-05-061-0/+94
| | | | | | | PR#4478 Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
* Handle no async jobs in libsslMatt Caswell2016-05-052-3/+30
| | | | | | | | | | If the application has limited the size of the async pool using ASYNC_init_thread() then we could run out of jobs while trying to start a libssl io operation. However libssl was failing to handle this and treating it like a fatal error. It should not be fatal...we just need to retry when there are jobs available again. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Complete the list of names in doc/ssl/SSL_CTX_load_verify_locations.podRichard Levitte2016-05-041-2/+3
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* add documentationDr. Stephen Henson2016-05-041-0/+59
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Add documentation for EVP_EncodeInit() and similar functionsMatt Caswell2016-05-032-0/+151
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* GH875: Document -no_check_timeRich Salz2016-05-025-4/+15
| | | | | | | | | | | | Date: Tue Mar 15 15:19:44 2016 +0100 This commit updates the documentation of cms, ocsp, s_client, s_server, and verify to reflect the new "-no_check_time" option introduced in commit d35ff2c0ade0a12e84aaa2e9841b4983a2f3cf45 on 2015-07-31. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Issue #719:TJ Saunders2016-05-021-0/+8
| | | | | | | | | | | | | | If no serverinfo extension is found in some cases, do not abort the handshake, but simply omit/skip that extension. Check for already-registered serverinfo callbacks during serverinfo registration. Update SSL_CTX_use_serverinfo() documentation to mention the need to reload the same serverinfo per certificate, for servers with multiple server certificates. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Secure memory fixesTodd Short2016-05-021-17/+13
| | | | | | | | | | | | | | | Fix some of the variables to be (s)size_t, so that more than 1GB of secure memory can be allocated. The arena has to be a power of 2, and 2GB fails because it ends up being a negative 32-bit signed number. The |too_late| flag is not strictly necessary; it is easy to figure out if something is secure memory by looking at the arena. As before, secure memory allocations will not fail, but now they can be freed correctly. Once initialized, secure memory can still be used, even if allocations occured before initialization. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix spelling in pod filesFdaSilvaYY2016-05-0112-13/+13
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix some X509_STORE macrosMatt Caswell2016-04-291-0/+24
| | | | | | Some X509_STORE macros do not work since the type was made opaque. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* various spelling fixesFdaSilvaYY2016-04-281-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/952)
* Add getters for X509_STORE and X509_OBJECT membersChristian Heimes2016-04-282-0/+53
| | | | | | | | | | | | | | | OpenSSL 1.1.0-pre5 has made some additional structs opaque. Python's ssl module requires access to some of the struct members. Three new getters are added: int X509_OBJECT_get_type(X509_OBJECT *a); STACK_OF(X509_OBJECT) *X509_STORE_get0_objects(X509_STORE *v); X509_VERIFY_PARAM *X509_STORE_get0_param(X509_STORE *ctx); Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Implement X509_STORE_CTX_set_current_cert() accessorViktor Dukhovni2016-04-281-6/+23
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Documentation the changed {RSA,DSA,DH}_set0_* functionality changeRichard Levitte2016-04-273-6/+35
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Added missing X509_STORE_CTX_set_error_depth() accessorViktor Dukhovni2016-04-251-7/+12
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Enabled DANE only when at least one TLSA RR was addedViktor Dukhovni2016-04-221-14/+42
| | | | | | | | | | | | | | | | It is up to the caller of SSL_dane_tlsa_add() to take appropriate action when no records are added successfully or adding some records triggers an internal error (negative return value). With this change the caller can continue with PKIX if desired when none of the TLSA records are usable, or take some appropriate action if DANE is required. Also fixed the internal ssl_dane_dup() function to properly initialize the TLSA RR stack in the target SSL handle. Errors in ssl_dane_dup() are no longer ignored. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix warnings installing pod filesRainer Jung2016-04-202-3/+3
| | | | | | | Fixes some links in the pod files Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Make string_to_hex/hex_to_string publicRich Salz2016-04-181-0/+20
| | | | | | Give the API new names, document it. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add X509_STORE_CTX_set0_untrusted function.Dr. Stephen Henson2016-04-161-1/+5
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Make many X509_xxx types opaque.Rich Salz2016-04-153-28/+61
| | | | | | | | | Make X509_OBJECT, X509_STORE_CTX, X509_STORE, X509_LOOKUP, and X509_LOOKUP_METHOD opaque. Remove unused X509_CERT_FILE_CTX Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Write POD page.Rich Salz2016-04-141-0/+28
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Tweak to documentationMatt Caswell2016-04-131-2/+2
| | | | | | | Tweak to documentation following feedback Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Misc fix ups to deprecate explicit de-init documentationMatt Caswell2016-04-139-45/+22
| | | | | | | Documentation fix ups as a result of feedback received. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Deprecate CONF_modules_free() and make it a no-opMatt Caswell2016-04-132-8/+15
| | | | | | | | CONF_modules_free() should not be called expicitly - we should leave auto-deinit to clean this up instead. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Deprecate ENGINE_cleanup() and make it a no-opMatt Caswell2016-04-131-12/+19
| | | | | | | | ENGINE_cleanup() should not be called expicitly - we should leave auto-deinit to clean this up instead. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Deprecate OBJ_cleanup() and make it a no-opMatt Caswell2016-04-131-6/+13
| | | | | | | | OBJ_cleanup() should not be called expicitly - we should leave auto-deinit to clean this up instead. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-25 13:56:15 +0000