summaryrefslogtreecommitdiffstats
path: root/doc (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Make many X509_xxx types opaque.Rich Salz2016-04-153-28/+61
| | | | | | | | | Make X509_OBJECT, X509_STORE_CTX, X509_STORE, X509_LOOKUP, and X509_LOOKUP_METHOD opaque. Remove unused X509_CERT_FILE_CTX Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Write POD page.Rich Salz2016-04-141-0/+28
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Tweak to documentationMatt Caswell2016-04-131-2/+2
| | | | | | | Tweak to documentation following feedback Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Misc fix ups to deprecate explicit de-init documentationMatt Caswell2016-04-139-45/+22
| | | | | | | Documentation fix ups as a result of feedback received. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Deprecate CONF_modules_free() and make it a no-opMatt Caswell2016-04-132-8/+15
| | | | | | | | CONF_modules_free() should not be called expicitly - we should leave auto-deinit to clean this up instead. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Deprecate ENGINE_cleanup() and make it a no-opMatt Caswell2016-04-131-12/+19
| | | | | | | | ENGINE_cleanup() should not be called expicitly - we should leave auto-deinit to clean this up instead. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Deprecate OBJ_cleanup() and make it a no-opMatt Caswell2016-04-131-6/+13
| | | | | | | | OBJ_cleanup() should not be called expicitly - we should leave auto-deinit to clean this up instead. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Deprecate EVP_cleanup() and make it a no-opMatt Caswell2016-04-132-9/+36
| | | | | | | | EVP_cleanup() should not be called expicitly - we should leave auto-deinit to clean this up instead. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Deprecate RAND_cleanup() and make it a no-opMatt Caswell2016-04-133-5/+17
| | | | | | | | RAND_cleanup() should not be called expicitly - we should leave auto-deinit to clean this up instead. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Deprecate SSL_COMP_free_compression_methods() and make it a no-opMatt Caswell2016-04-131-4/+15
| | | | | | | | SSL_COMP_free_compression_methods() should not be called expicitly - we should leave auto-deinit to clean this up instead. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Deprecate ERR_free_strings() and make it a no-opMatt Caswell2016-04-132-9/+23
| | | | | | | | ERR_free_strings() should not be called expicitly - we should leave auto-deinit to clean this up instead. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* X509_PUBKEY docsDr. Stephen Henson2016-04-133-9/+141
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Add SSL_CTX_get_ciphers()Kazuki Yamaguchi2016-04-112-6/+11
| | | | | | | | | | | Add an accessor for SSL_CTX. Since libssl was made opaque, there is no way for users to access the cipher_list, while users can set the cipher_list by SSL_CTX_set_cipher_list(). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* RSA: the docs still talk about RSA_PKCS1_SSLeayBeat Bolli2016-04-091-4/+4
| | | | | | | Rename the function to RSA_PKCS1_OpenSSL. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add documentation for following DH and DH_METHOD opacityMatt Caswell2016-04-094-45/+248
| | | | | | | A number of new functions have been added following the DH and DH_METHOD opacity commits. This commit provides documentation for those functions. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Suppress CT callback as appropriateViktor Dukhovni2016-04-073-38/+91
| | | | | | | | | | | | | | | | | | | | | | Suppress CT callbacks with aNULL or PSK ciphersuites that involve no certificates. Ditto when the certificate chain is validated via DANE-TA(2) or DANE-EE(3) TLSA records. Also skip SCT processing when the chain is fails verification. Move and consolidate CT callbacks from libcrypto to libssl. We also simplify the interface to SSL_{,CTX_}_enable_ct() which can specify either a permissive mode that just collects information or a strict mode that requires at least one valid SCT or else asks to abort the connection. Simplified SCT processing and options in s_client(1) which now has just a simple pair of "-noct" vs. "-ct" options, the latter enables the permissive callback so that we can complete the handshake and report all relevant information. When printing SCTs, print the validation status if set and not valid. Signed-off-by: Rob Percival <robpercival@google.com> Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Fix client verify mode to check SSL_VERIFY_PEERViktor Dukhovni2016-04-071-14/+1
| | | | | | | | | | The original check for != SSL_VERIFY_NONE can give surprising results when flags SSL_VERIFY_PEER is not set, but other flags are. Note that SSL_VERIFY_NONE (0) is not a flag bit, it is rather the absense of all other flag bits. Signed-off-by: Rob Percival <robpercival@google.com> Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Document RSA_METHOD creators/destructor/accessors/writersRichard Levitte2016-04-061-0/+225
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Document RSA accessors/writersRichard Levitte2016-04-062-20/+93
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Revert "various spelling fixes"Rich Salz2016-04-041-1/+1
| | | | | | | This reverts commit 620d540bd47a96fb6905fbbdd8ea5167a8841a3e. It wasn't reviewed. Reviewed-by: Rich Salz <rsalz@openssl.org>
* various spelling fixesFdaSilvaYY2016-04-041-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add X509_REQ_get0_pubkey methodFdaSilvaYY2016-04-041-5/+7
| | | | | Reviewed-by: Stephen Henson <steve@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Move peer chain security checks into x509_vfy.cViktor Dukhovni2016-04-038-28/+86
| | | | | | | | | | | | | | | | | | | A new X509_VERIFY_PARAM_set_auth_level() function sets the authentication security level. For verification of SSL peers, this is automatically set from the SSL security level. Otherwise, for now, the authentication security level remains at (effectively) 0 by default. The new "-auth_level" verify(1) option is available in all the command-line tools that support the standard verify(1) options. New verify(1) tests added to check enforcement of chain signature and public key security levels. Also added new tests of enforcement of the verify_depth limit. Updated documentation. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Rename get/set_app_data to get0/set0_app_dataMatt Caswell2016-04-031-4/+4
| | | | | | | Also fixed a style issue Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
* Various DSA opacity fixupsMatt Caswell2016-04-032-20/+27
| | | | | | | Numerous fixups based on feedback of the DSA opacity changes. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
* Document functions added as a result of DSA opacity changesMatt Caswell2016-04-033-44/+262
| | | | | | | | A number of getters/setters have been added for examining DSA objects, as well as a whole set of functions for creating and buildingup DSA_METHODs. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
* Optimized BIO mem read - without reallocationKirill Marinushkin2016-04-021-9/+4
| | | | | | | | | | | | Currently on every BIO mem read operation the remaining data is reallocated. This commit solves the issue. BIO mem structure includes additional pointer to the read position. On every read the pointer moves instead of reallocating the memory for the remaining data. Reallocation accures before write and some ioctl operations, if the read pointer doesn't point on the beginning of the buffer. Also the flag is added to rewind the read pointer without losing the data. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Clarify the behavior of BIO_gets() a bit moreBenjamin Kaduk2016-03-301-4/+6
| | | | | | | | | | | | | | The API contract is more tight than was previously documented -- the returned string must be NUL-terminated, and the supplied buffer includes space for the trailing NUL, so the maximum length that can be read in is reduced. Clarify that the NUL is not included in the returned length, and fix the spelling of "NUL-terminated" in a nearby spot. Adjust punctuation to make a modest improvement to the grammar. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add documentation for BIO functionsMatt Caswell2016-03-294-8/+204
| | | | | | | Add the documentation for new BIO functions added as a result of making BIO and BIO_METHOD opaque. Reviewed-by: Richard Levitte <levitte@openssl.org>
* It's called SSL_session_reused(), not SSL_session_resumed()Kurt Roeckx2016-03-271-1/+1
| | | | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #2452
* Correct another batch of typosAlex Gaynor2016-03-2328-35/+33
| | | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* RT4660: BIO_METHODs should be const.David Benjamin2016-03-2115-17/+17
| | | | | | | BIO_new, etc., don't need a non-const BIO_METHOD. This allows all the built-in method tables to live in .rodata. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix ALPN - more fixesTodd Short2016-03-211-6/+6
| | | | | | | | | | * Clear proposed, along with selected, before looking at ClientHello * Add test case for above * Clear NPN seen after selecting ALPN on server * Minor documentation updates Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* constify DSA_SIG_get0()Dr. Stephen Henson2016-03-201-1/+1
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fixed languageAlex Gaynor2016-03-201-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fixed a bunch of typos in the docsAlex Gaynor2016-03-2023-29/+29
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* constify ECDSA_SIG_get0()Dr. Stephen Henson2016-03-191-1/+1
| | | | | | | PR#4436 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Correct faulty L<> links in .podsRichard Levitte2016-03-194-9/+10
| | | | | | Closes RT#4450 Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove more unused things.Rich Salz2016-03-182-169/+1
| | | | | | Moved doc/standards.txt to the web. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Update EVP_CIPHER_CTX_set_padding documentation.Conrado Porto Lopes Gouvêa2016-03-181-6/+8
| | | | | | Add note about when EVP_CIPHER_CTX_set_padding should be called. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* General verify options to openssl tsfbroda2016-03-151-11/+51
| | | | | | | | | | | | | | This commit adds the general verify options of ocsp, verify, cms, etc. to the openssl timestamping app as suggested by Stephen N. Henson in [openssl.org #4287]. The conflicting "-policy" option of "openssl ts" has been renamed to "-tspolicy". Documentation and tests have been updated. CAVE: This will break code, which currently uses the "-policy" option. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Update and clarify ECDSA documentation.Dr. Stephen Henson2016-03-141-121/+119
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix typo in manual, missing ending '>'Richard Levitte2016-03-141-1/+1
| | | | Reviewed-by: Stephen Henson <steve@openssl.org>
* Document X509_get_serialNumber and X509_set_serialNumber.Dr. Stephen Henson2016-03-141-0/+55
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Add EVP_PKEY documentation.Dr. Stephen Henson2016-03-131-11/+27
| | | | | | Document EVP_PKEY_id() and EVP_PKEY_base_id(). Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Add doc on when to use SCT callback.Rich Salz2016-03-122-1/+7
| | | | | | With help from Viktor. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Make X509_SIG opaque.Dr. Stephen Henson2016-03-111-3/+9
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Review commentsKurt Roeckx2016-03-111-9/+9
| | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add blake2 support.Bill Cox2016-03-113-8/+13
| | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add X509_CHECK_FLAG_NEVER_CHECK_SUBJECT flagViktor Dukhovni2016-03-101-0/+8
| | | | Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-21 11:52:10 +0100