aboutsummaryrefslogtreecommitdiffstats
path: root/doc
Commit message (Collapse)AuthorAgeFilesLines
* CMS ESS: Move four internal aux function to where they belong in crypto/cmsDr. David von Oheimb2021-04-281-0/+2
| | | | | | | Also constify and slightly refactor them. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14601)
* ESS: Export three core functions, clean up TS and CMS CAdES-BES usageDr. David von Oheimb2021-04-284-0/+99
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14601)
* Add X509 version constants.David Benjamin2021-04-281-4/+6
| | | | | | | | | | | | | | | The X509 version APIs return the numerical values of the version numbers, which are one off from the names. This is a bit confusing. Where they don't get it wrong (accidentally making an "X509v4" certificate), callers tend to try commenting every call site to explain the mismatch, including in OpenSSL itself. Define constants for these values, so code can be self-documenting and callers are nudged towards the right values. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14549)
* OPENSSL_sk functions are effectively already documentedTomas Mraz2021-04-281-8/+15
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14728)
* Improve the implementation of X509_STORE_CTX_get1_issuer()Tomas Mraz2021-04-281-7/+14
| | | | | | | | | | | | | It is possible for the stack of X509_OBJECTs held in an X509_STORE_CTX to have a custom compare function associated with it. Normally (by default) this uses X509_NAME_cmp(). The X509_STORE_CTX_get1_issuer() function assumed that it would always be X509_NAME_cmp(). By implementing OPENSSL_sk_find_all() function we can avoid explicitly using X509_NAME_cmp() in X509_STORE_CTX_get1_issuer(). Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14728)
* Deprecate EVP_PKEY_cmp() and EVP_PKEY_cmp_parameters().Shane Lontis2021-04-273-12/+17
| | | | | | | | | The replacement functions EVP_PKEY_eq() and EVP_PKEY_parameters_eq() already exist. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/14997)
* Doc updates for DH/DSA examplesShane Lontis2021-04-272-9/+14
| | | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14936)
* Fixes related to separation of DH and DHX typesShane Lontis2021-04-263-60/+222
| | | | | | | | | | | | | | | | | | | | | Fix dh_rfc5114 option in genpkey. Fixes #14145 Fixes #13956 Fixes #13952 Fixes #13871 Fixes #14054 Fixes #14444 Updated documentation for app to indicate what options are available for DH and DHX keys. DH and DHX now have different keymanager gen_set_params() methods. Added CHANGES entry to indicate the breaking change. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14883)
* Add type_name member to provided methods and use itTomas Mraz2021-04-266-12/+44
| | | | | | | Fixes #14701 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14898)
* Documentation fix for openssl-verify certificatesKlaas van Schelven2021-04-261-5/+5
| | | | | | | | | | | `openssl verify` silently ignores any but the first certificate in the `certificates` argument. See #14675 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14754)
* APPS: Improve diagnostics for string options and options expecting int >= 0Dr. David von Oheimb2021-04-241-1/+1
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14970)
* BIO_s_connect.pod: Improve doc of BIO_set_conn_hostname() etc.Dr. David von Oheimb2021-04-223-23/+17
| | | | | Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14967)
* Remove an unused parameterRich Salz2021-04-221-3/+3
| | | | | | Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14943)
* Update copyright yearMatt Caswell2021-04-2212-12/+12
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14986)
* DOC: Clarify EVP_MAC_init() params vs. EVP_MAC_CTX_set_params()Dr. David von Oheimb2021-04-211-3/+6
| | | | | | | | Fixes #14855 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14937)
* ENCODER & DECODER: Allow decoder implementations to specify "carry on"Richard Levitte2021-04-211-1/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | So far, decoder implementations would return true (1) for a successful decode all the way, including what the callback it called returned, and false (0) in all other cases. This construction didn't allow to stop to decoding process on fatal errors, nor to choose what to report in the provider code. This is now changed so that decoders implementations are made to return false only on errors that should stop the decoding process from carrying on with other implementations, and return true for all other cases, even if that didn't result in a constructed object (EVP_PKEY for example), essentially making it OK to return "empty handed". The success of the decoding process is now all about successfully constructing the final object, rather than about the return value of the decoding chain. If no construction is attempted, the central decoding processing code concludes that whatever the input consisted of, it's not supported by the available decoder implementations. Fixes #14423 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14834)
* Improve ossl_cmp_build_cert_chain(); publish it as X509_build_chain()Dr. David von Oheimb2021-04-202-23/+24
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14128)
* PKCS12 etc.: Add hints on using -legacy and -provider-path optionsDr. David von Oheimb2021-04-194-1/+14
| | | | | | | | Fixes #14790 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14891)
* Add the function OSSL_LIB_CTX_get0_global_default()Matt Caswell2021-04-191-6/+14
| | | | | | | | | An API function for obtaining the global default lib ctx. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14890)
* Change the semantics of OSSL_LIB_CTX_set0_default() NULL handlingMatt Caswell2021-04-191-1/+3
| | | | | | | | | | | | | | | | | Change things so that passing NULL to OSSL_LIB_CTX_set0_default() means keep the current library context unchanged. This has the advantage of simplifying error handling, e.g. you can call OSSL_LIB_CTX_set0_default in an error/finalisation block safe in the knowledge the if the "prevctx" was never set then it will be a no-op (like calling a "free" function with NULL). Fixes #14593 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14890)
* Add DHX FIPS 186-4 domain parameter validation exampleTomas Mraz2021-04-192-11/+53
| | | | | | | Fixes #14369 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14896)
* Add "origin" field to EVP_CIPHER, EVP_MDRich Salz2021-04-182-7/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a "where did this EVP_{CIPHER,MD} come from" flag: global, via fetch, or via EVP_{CIPHER,MD}_meth_new. Update EVP_{CIPHER,MD}_free to handle all three origins. The flag is deliberately right before some function pointers, so that compile-time failures (int/pointer) will occur, as opposed to taking a bit in the existing "flags" field. The "global variable" flag is non-zero, so the default case of using OPENSSL_zalloc (for provider ciphers), will do the right thing. Ref-counting is a no-op for Make up_ref no-op for global MD and CIPHER objects Deprecate EVP_MD_CTX_md(). Added EVP_MD_CTX_get0_md() (same semantics as the deprecated function) and EVP_MD_CTX_get1_md(). Likewise, deprecate EVP_CIPHER_CTX_cipher() in favor of EVP_CIPHER_CTX_get0_cipher(), and add EVP_CIPHER_CTX_get1_CIPHER(). Refactor EVP_MD_free() and EVP_MD_meth_free() to call new common evp_md_free_int() function. Refactor EVP_CIPHER_free() and EVP_CIPHER_meth_free() to call new common evp_cipher_free_int() function. Also change some flags tests to explicit test == or != zero. E.g., if (flags & x) --> if ((flags & x) != 0) if (!(flags & x)) --> if ((flags & x) == 0) Only done for those lines where "get0_cipher" calls were made. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14193)
* Fix naming for EVP_RAND_CTX_gettable functions.Pauli2021-04-172-11/+11
| | | | | | | | | | | | | | | Change: EVP_RAND_gettable_ctx_params -> EVP_RAND_CTX_gettable_params EVP_RAND_settable_ctx_params -> EVP_RAND_CTX_settable_params Which brings them in line with the other similar functions for other algorithm types. Fixes #14880 Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14893)
* lifecycle: update master lifecycle transition spreadsheet fixing the ettable ↵Pauli2021-04-161-0/+0
| | | | | | | issue Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14867)
* lifecycle: correct [sg]ettable to [sg]etPauli2021-04-161-4/+4
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14867)
* Add EVP_PKEY_todata() and EVP_PKEY_export() functions.Shane Lontis2021-04-155-3/+77
| | | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14800)
* Rename EVP_PKEY_get0_first_alg_name to EVP_PKEY_get0_type_nameTomas Mraz2021-04-151-13/+16
| | | | | | | | | | | | | | | We use type elsewhere and documenting the 'first' in the name of the call is a little bit superfluous making the name too mouthful. Also rename EVP_PKEY_typenames_do_all to EVP_PKEY_type_names_do_all to keep the words separated by underscore. Fixes #14701 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14868)
* Remove keymgmt_copy function from the provider APITomas Mraz2021-04-151-10/+1
| | | | | | | It is superceded by the keymgmt_dup. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14793)
* Add selection support to the provider keymgmt_dup functionTomas Mraz2021-04-151-3/+4
| | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14793)
* Implement provider-side keymgmt_dup functionTomas Mraz2021-04-151-2/+9
| | | | | | | | | | | | | | To avoid mutating key data add OSSL_FUNC_KEYMGMT_DUP function to the provider API and implement it for all asym-key key managements. Use it when copying everything to an empty EVP_PKEY which is the case with EVP_PKEY_dup(). Fixes #14658 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14793)
* apps/cmp: Add generic random state options, e.g., for nonce generationDr. David von Oheimb2021-04-141-0/+12
| | | | | Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14842)
* openssl-cmp.pod.in: Fix missing provider options descriptionDr. David von Oheimb2021-04-141-2/+10
| | | | | | | Also correct layout of engines description Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14842)
* bio: note that BIO_sprintf null terminates on insufficient space.Pauli2021-04-141-4/+10
| | | | | | | Fixes: #14772 Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14829)
* doc: Fix formattingJakub Wilk2021-04-141-1/+1
| | | | | | | | CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14835)
* Add FIPS Self test for AES_ECB decryptShane Lontis2021-04-131-1/+3
| | | | | | | | | | | | | | | Fixes #14807 Compliance with IG 9.4 requires that an inverse cipher function be tested if one is implemented. Just running AES_GCM encrypt/decrypt does not meet this requirement (Since only ECB, CBC, XTS, KW, KWP support the inverse function during decryption mode). Added a mode to the cipher test so that the AES_GCM only does an encrypt and AES_ECB only does a decrypt. TDES still does both. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14825)
* Remove the function EVP_PKEY_set_alias_typeMatt Caswell2021-04-121-28/+6
| | | | | | | | | | | | | | | | OTC recently voted that EVP_PKEY types will be immutable in 3.0. This means that EVP_PKEY_set_alias_type can no longer work and should be removed entirely (applications will need to be rewritten not to use it). It was primarily used for SM2 which no longer needs this call. Applications should generate SM2 keys directly (without going via an EC key first), or otherwise when loading keys they should automatically be detected as SM2 keys. Fixes #14379 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14803)
* Update KTLS documentationMatt Caswell2021-04-123-17/+27
| | | | | | | | | KTLS support has been changed to be off by default, and configuration is via a single "option" rather two "modes". Documentation is updated accordingly. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14799)
* Replace OSSL_PARAM_BLD_free_params() with OSSL_PARAM_free().Shane Lontis2021-04-122-10/+6
| | | | | Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14785)
* Add OSSL_PARAM_dup() and OSSL_PARAM_merge().Shane Lontis2021-04-123-1/+66
| | | | | | | | | | | | These functions are prerequisites for implementing EVP_PKEY_todata(). OSSL_PARAM_dup() is required to make a deep copy of the exported params (since the provider export() uses a OSSL_PARAM_BLD which throws away the data after the call), and then use OSSL_PARAM_merge() to add some additional params that can be passed to the EVP_PKEY_todata(). Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14785)
* kmac: update the documention for the customisation string maximum lengthPauli2021-04-121-1/+1
| | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14810)
* Fix typos in x509.podNan Xiao2021-04-091-2/+2
| | | | | | | | CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14783)
* Small fixes and cleanups of provider API documentationTomas Mraz2021-04-0912-27/+35
| | | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14756)
* provider-decoder.pod: Documentation of provider side decoder APITomas Mraz2021-04-092-0/+343
| | | | | | | | Fixes #13949 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14756)
* PEM_X509_INFO_read_bio_ex(): Generalize to allow parsing any type of private keyDr. David von Oheimb2021-04-081-1/+1
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14647)
* d2i_PrivateKey{,_ex}() and PEM_X509_INFO_read_bio_ex(): Fix handling of ↵Dr. David von Oheimb2021-04-081-7/+6
| | | | | | | | | RSA/DSA/EC private key This is needed to correct d2i_PrivateKey() after it was changed by commit 576892d78f80cf9a. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14647)
* PEM_X509_INFO_read,{_bio}_ex(): Complete documentation in ↵Dr. David von Oheimb2021-04-081-10/+20
| | | | | | | PEM_X509_INFO_read_bio_ex.pod Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14647)
* Update copyright yearMatt Caswell2021-04-0833-33/+33
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14801)
* Remove a TODO in EVP_set_default_propertiesMatt Caswell2021-04-081-5/+3
| | | | | | | Fixes #14371 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1487)
* Update the algorithm fetching documentation linksMatt Caswell2021-04-0814-20/+20
| | | | | | | | The documentation on algorithm fetching has moved. There were a lot of references to the old location so we update all of those locations. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1487)
* Update provider.podMatt Caswell2021-04-081-192/+8
| | | | | | | | | The previous commits moved some content out of provider.pod into other pages, so that content is now removed. provider.pod is now exclusively focussed on provider authors. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1487)
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-29 15:19:58 +0000