aboutsummaryrefslogtreecommitdiff
path: root/doc
AgeCommit message (Collapse)AuthorFilesLines
2018-08-07man3/OPENSSL_LH_COMPFUNC.pod: clarifications and updates.Andy Polyakov1-16/+9
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6786)
2018-07-31Some protocol versions are build-timeRich Salz4-25/+14
Clarify docs to list that some protocol flags might not be available depending on how OpenSSL was build. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6816)
2018-07-31Deprecate the EC curve type specific functions in 1.2.0Matt Caswell2-5/+10
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6815)
2018-07-31Add documentation for the new non-curve type specific EC functionsMatt Caswell2-30/+77
Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6815)
2018-07-28doc/BN_generate_prime: update doc about other callback valuesBeat Bolli1-1/+7
This here page only documents the callback values 0 to 2, but the callers of BN_generate_prime_ex() call it with the value 3. The list of manual pages in the SEE ALSO section was extended with the output from git grep BN_GENCB_call.*[3-9] while in the doc/man3 directory. Signed-off-by: Beat Bolli <dev@drbeat.li> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6802)
2018-07-26Fix inconsisten use of bit vs bitsKurt Roeckx1-2/+2
Reviewed-by: Tim Hudson <tjh@openssl.org> GH: #6794
2018-07-26Make number of Miller-Rabin tests for a prime tests depend on the security ↵Kurt Roeckx1-1/+11
level of the prime The old numbers where all generated for an 80 bit security level. But the number should depend on security level you want to reach. For bigger primes we want a higher security level and so need to do more tests. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> GH: #6075 Fixes: #6012
2018-07-23Add a note about aborts encountered while sending early_dataMatt Caswell1-0/+13
In some circumstances it is possible for a client to have a session reporting a max early data value that is greater than the server will support. In such cases the client could encounter an aborted connection. Fixes #6735 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6740)
2018-07-20const-ify some input SSL * argumentsBenjamin Kaduk1-3/+3
These tiny functions only read from the input SSL, and we are about to use them from functions that only have a const SSL* available, so propagate const a bit further. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6378)
2018-07-17Improve documentation about reading and writingKurt Roeckx6-50/+127
Reviewed-by: Matt Caswell <matt@openssl.org> GH: #6240
2018-07-13Documentation typo fix in BN_bn2bin.podAlexandre Perrin1-2/+2
Change the description for BN_hex2bn() so that it uses the same BIGNUM argument name as its prototype. CLA: trivial Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6712)
2018-07-06Document SSL_CTX_set_recv_max_early_data() etcMatt Caswell1-3/+30
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6655)
2018-07-05Add missing include file to docRich Salz1-0/+2
Reported by Ingo Schwarze Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6656)
2018-07-04Document more EVP_MD_CTX functionsRichard Levitte1-2/+50
Fixes #6644 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6645)
2018-07-03Fix some issues found by Denian's lintian toolRich Salz14-93/+101
Also fix some L<> labels and =item entries found while doing this. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6630)
2018-07-02Add the ability to configure anti-replay via SSL_CONFMatt Caswell2-0/+32
This also adds the ability to control this through s_server Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6469)
2018-07-02Document the new early data callback and optionMatt Caswell2-1/+45
Document SSL_OP_NO_ANTI_REPLAY and SSL_CTX_set_allow_early_data_cb() Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6469)
2018-06-27Modify the DEVRANDOM source so that the files are kept open persistently.Pauli1-1/+13
This allows operation inside a chroot environment without having the random device present. A new call, RAND_keep_random_devices_open(), has been introduced that can be used to control file descriptor use by the random seed sources. Some seed sources maintain open file descriptors by default, which allows such sources to operate in a chroot(2) jail without the associated device nodes being available. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6432)
2018-06-26Document changes to SSL_OP_NO_TICKET for TLSv1.3Matt Caswell2-13/+41
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6563)
2018-06-23Fix prototype of ASN1_INTEGER_get and ASN1_INTEGER_setKurt Roeckx1-2/+2
The parameters where switched Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #6578
2018-06-23OpenSSL-II style for emacs: don't indent because of extern blockRichard Levitte1-0/+1
We don't want an indentation step inside a 'extern "C" {' .. '}' block. Apparently, cc-mode has a c-offsets-alist keyword to allow exactly this. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6557)
2018-06-21add documentation for OCSP_basic_verify()David von Oheimb1-1/+29
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6227)
2018-06-21Fix spelling errors in documentation.Pauli4-9/+9
Also fix some clumsy wording. [skip_ci] Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6545)
2018-06-20Update copyright yearMatt Caswell6-6/+6
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6538)
2018-06-19Fix & update documentation about RAND_priv_bytes()Nicola Tuveri3-23/+75
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Ben Kaduk <kaduk@mit.edu> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/6514)
2018-06-19Add EVP_PKEY_set_alias_typeJack Lloyd1-1/+15
Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6443)
2018-06-18add 'unsupported cipher mode' diagnostics to evp_lib.c and genpkey.cDavid von Oheimb2-2/+3
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6217)
2018-06-15Repair broken C syntax (missing close parens) in a manual page.Eric S. Raymond1-5/+5
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6491)
2018-06-13Fix manpage problemsEric S. Raymond2-3/+1
CLA: trivial Reviewed-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> GH: #6472
2018-06-13doc/man7/passphrase-encoding.pod: Make consistentRichard Levitte1-4/+4
The man name didn't match the file name, and some places had 'password' instead of 'pass phrase'. Fixes #6474 Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6476)
2018-06-12Document return value of X509_add_extViktor Dukhovni1-2/+4
and also X509_delete_ext() Reviewed-by: Matt Caswell <matt@openssl.org>
2018-06-12Deprecate DSA_sign_setup() in the documentationNicola Tuveri1-7/+6
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6460)
2018-06-08Documentation for missing s_client/s_server optionsDmitry Belyavskiy2-2/+95
Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6209)
2018-06-08Add function for setting the EVP_PKEY_ASN1_METHOD raw key getter functionsMatt Caswell1-2/+15
EVP_PKEY_asn1_set_get_priv_key() and EVP_PKEY_asn1_set_get_pub_key() Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6394)
2018-06-08Document the raw key getter functionsMatt Caswell1-10/+39
EVP_PKEY_get_raw_private_key() and EVP_PKEY_get_raw_public_key() Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6394)
2018-06-07Document UTF-8 expectation for pass phrases passed to OSSL_STORERichard Levitte3-16/+18
After some discussion, it was concluded that the better idea is to stipulate that the pass phrases passed to the OSSL_STORE API are expected to be UTF-8 encoded, and that all objects made accessible through OSSL_STORE URIs should adhere to this expectation (at the discretion of the loaders). Email ref: https://mta.openssl.org/pipermail/openssl-project/2018-June/000771.html Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6416)
2018-06-02Document failure return for ECDSA_SIG_newKen Goldman1-0/+2
ECDSA_SIG_new() returns NULL on error. Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6398)
2018-06-01STORE: split off the description of the 'file' scheme loaderRichard Levitte2-24/+76
This includes a quick recommendation on how to name loader docmentation. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6350)
2018-05-30apps/speed.c: add -aead flag.Andy Polyakov1-4/+10
Goal is to exercise AEAD ciphers in TLS-like sequence, i.e. 13-byte AAD followed by payload. Update doc/man1/speed.pod accordingly. [While we are at it, address even some styling and readability issues.] Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6311)
2018-05-30Add APIs for custom X509_LOOKUP_METHOD creationMingtao Yang2-0/+190
OpenSSL 1.1.0 made the X509_LOOKUP_METHOD structure opaque, so applications that were previously able to define a custom lookup method are not able to be ported. This commit adds getters and setters for each of the current fields of X509_LOOKUP_METHOD, along with getters and setters on several associated opaque types (such as X509_LOOKUP and X509_OBJECT). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6152)
2018-05-29Update the "Connected Commands" section of s_client/s_server docsMatt Caswell2-8/+51
Fixes #6307 Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6330)
2018-05-29Update copyright yearMatt Caswell24-24/+24
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6371)
2018-05-28ECDSA_SIG: add simple getters for commonly used struct membersDr. Matthias St. Pierre1-2/+12
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6290)
2018-05-28RSA: add simple getters for commonly used struct membersDr. Matthias St. Pierre1-1/+21
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6290)
2018-05-28DSA: add simple getters for commonly used struct membersDr. Matthias St. Pierre1-2/+14
Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6290)
2018-05-28DH: fix: add simple getters for commonly used struct membersDr. Matthias St. Pierre1-1/+5
amends 6db7fadf0975 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6290)
2018-05-26Improve the example getpass() implementation to show an error returnNick Mathewson1-6/+5
Also, modernize the code, so that it isn't trying to store a size_t into an int, and then check the int's sign. :/ Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6271)
2018-05-26Update documentation for PEM callback: error is now -1.Nick Mathewson1-1/+1
In previous versions of OpenSSL, the documentation for PEM_read_* said: The callback B<must> return the number of characters in the passphrase or 0 if an error occurred. But since c82c3462267afdbbaa5, 0 is now treated as a non-error return value. Applications that want to indicate an error need to return -1 instead. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6271)
2018-05-24Add a sanity check on the length of pkeyutl inputsMatt Caswell1-21/+26
When signing or verifying a file using pkeyutl the input is supposed to be a hash. Some algorithms sanity check the length of the input, while others don't and silently truncate. To avoid accidents we check that the length of the input looks sane. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6284)
2018-05-23Skip CN DNS name constraint checks when not neededViktor Dukhovni3-6/+24
Only check the CN against DNS name contraints if the `X509_CHECK_FLAG_NEVER_CHECK_SUBJECT` flag is not set, and either the certificate has no DNS subject alternative names or the `X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT` flag is set. Add pertinent documentation, and touch up some stale text about name checks and DANE. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
generated by cgit v1.1 at 2024-07-13 10:50:19 +0000