Hakase/openssl-custom
1
0 Fork 0
Code Issues Pull Requests Releases Wiki Activity

Latest update (add quic)

Browse Source
This commit is contained in:
Hakase
2020-07-12 19:52:18 +09:00
parent 3a6d64bb68
commit e85ee33eee
501 changed files with 19166 additions and 10232 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/man3/ASN1_STRING_TABLE_add.pod
+2 -2
View File
@@ -13,7 +13,7 @@ ASN1_STRING_TABLE_cleanup - ASN1_STRING_TABLE manipulation functions
int ASN1_STRING_TABLE_add(int nid, long minsize, long maxsize,
unsigned long mask, unsigned long flags);
ASN1_STRING_TABLE * ASN1_STRING_TABLE_get(int nid);
ASN1_STRING_TABLE *ASN1_STRING_TABLE_get(int nid);
void ASN1_STRING_TABLE_cleanup(void);
=head1 DESCRIPTION
@@ -55,7 +55,7 @@ L<ERR_get_error(3)>
=head1 COPYRIGHT
Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/ASN1_STRING_length.pod
+4 -4
View File
@@ -11,10 +11,10 @@ ASN1_STRING_to_UTF8 - ASN1_STRING utility functions
#include <openssl/asn1.h>
int ASN1_STRING_length(ASN1_STRING *x);
const unsigned char * ASN1_STRING_get0_data(const ASN1_STRING *x);
unsigned char * ASN1_STRING_data(ASN1_STRING *x);
const unsigned char *ASN1_STRING_get0_data(const ASN1_STRING *x);
unsigned char *ASN1_STRING_data(ASN1_STRING *x);
ASN1_STRING * ASN1_STRING_dup(const ASN1_STRING *a);
ASN1_STRING *ASN1_STRING_dup(const ASN1_STRING *a);
int ASN1_STRING_cmp(ASN1_STRING *a, ASN1_STRING *b);
@@ -103,7 +103,7 @@ L<ERR_get_error(3)>
=head1 COPYRIGHT
Copyright 2002-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2002-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/ASN1_STRING_new.pod
+3 -3
View File
@@ -9,8 +9,8 @@ ASN1_STRING allocation functions
#include <openssl/asn1.h>
ASN1_STRING * ASN1_STRING_new(void);
ASN1_STRING * ASN1_STRING_type_new(int type);
ASN1_STRING *ASN1_STRING_new(void);
ASN1_STRING *ASN1_STRING_type_new(int type);
void ASN1_STRING_free(ASN1_STRING *a);
=head1 DESCRIPTION
@@ -42,7 +42,7 @@ L<ERR_get_error(3)>
=head1 COPYRIGHT
Copyright 2002-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2002-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/BIO_f_ssl.pod
+9 -6
View File
@@ -96,12 +96,15 @@ chain and calling SSL_shutdown() on its internal SSL
pointer.
BIO_do_handshake() attempts to complete an SSL handshake on the
supplied BIO and establish the SSL connection. It returns 1
if the connection was established successfully. A zero or negative
value is returned if the connection could not be established, the
call BIO_should_retry() should be used for non blocking connect BIOs
to determine if the call should be retried. If an SSL connection has
already been established this call has no effect.
-supplied BIO and establish the SSL connection.
For non-SSL BIOs the connection is done typically at TCP level.
If domain name resolution yields multiple IP addresses all of them are tried
after connect() failures.
The function returns 1 if the connection was established successfully.
A zero or negative value is returned if the connection could not be established.
The call BIO_should_retry() should be used for non-blocking connect BIOs
to determine if the call should be retried.
If a connection has already been established this call has no effect.
=head1 NOTES
doc/man3/BIO_s_connect.pod
+9 -4
View File
@@ -94,11 +94,16 @@ non blocking I/O is set during the connect process.
BIO_new_connect() combines BIO_new() and BIO_set_conn_hostname() into
a single call: that is it creates a new connect BIO with B<name>.
BIO_do_connect() attempts to connect the supplied BIO. It returns 1
if the connection was established successfully. A zero or negative
value is returned if the connection could not be established, the
call BIO_should_retry() should be used for non blocking connect BIOs
BIO_do_connect() attempts to connect the supplied BIO.
This performs an SSL/TLS handshake as far as supported by the BIO.
For non-SSL BIOs the connection is done typically at TCP level.
If domain name resolution yields multiple IP addresses all of them are tried
after connect() failures.
The function returns 1 if the connection was established successfully.
A zero or negative value is returned if the connection could not be established.
The call BIO_should_retry() should be used for non blocking connect BIOs
to determine if the call should be retried.
If a connection has already been established this call has no effect.
=head1 NOTES
doc/man3/BIO_set_callback.pod
+1 -1
View File
@@ -48,7 +48,7 @@ out information relating to each BIO operation. If the callback
argument is set it is interpreted as a BIO to send the information
to, otherwise stderr is used.
BIO_callback_fn_ex is the type of the callback function and BIO_callback_fn
BIO_callback_fn_ex() is the type of the callback function and BIO_callback_fn()
is the type of the old format callback function. The meaning of each argument
is described below:
doc/man3/BIO_socket_wait.pod
-58
View File
@@ -1,58 +0,0 @@
=pod
=head1 NAME
BIO_socket_wait,
BIO_wait,
BIO_connect_retry
- BIO socket utility functions
=head1 SYNOPSIS
#include <openssl/bio.h>
#ifndef OPENSSL_NO_SOCK
int BIO_socket_wait(int fd, int for_read, time_t max_time);
#endif
int BIO_wait(BIO *bio, time_t max_time, unsigned int milliseconds);
int BIO_connect_retry(BIO *bio, long timeout);
=head1 DESCRIPTION
BIO_socket_wait() waits on the socket B<fd> for reading if B<for_read> is not 0,
else for writing, at most until B<max_time>.
It succeeds immediately if B<max_time> == 0 (which means no timeout given).
BIO_wait() waits at most until B<max_time> on the given B<bio>,
which is typically socket-based,
for reading if B<bio> is supposed to read, else for writing.
It succeeds immediately if B<max_time> == 0 (which means no timeout given).
If sockets are not available it succeeds after waiting at most given
B<milliseconds> in order to help avoiding a tight busy loop at the caller.
BIO_connect_retry() connects via the given B<bio>, retrying BIO_do_connect()
until success or a timeout or error condition is reached.
If the B<timeout> parameter is > 0 this indicates the maximum number of seconds
to wait until the connection is established. A value of 0 enables waiting
indefinitely, while a value < 0 immediately leads to a timeout condition.
=head1 RETURN VALUES
BIO_socket_wait(), BIO_wait(), and BIO_connect_retry()
return -1 on error, 0 on timeout, and 1 on success.
=head1 HISTORY
BIO_socket_wait(), BIO_wait(), and BIO_connect_retry()
were added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/CMS_verify.pod
+7 -3
View File
@@ -66,10 +66,14 @@ from the content. If the content is not of type B<text/plain> then an error is
returned.
If B<CMS_NO_SIGNER_CERT_VERIFY> is set the signing certificates are not
verified.
verified, unless CMS_CADES flag is also set.
If B<CMS_NO_ATTR_VERIFY> is set the signed attributes signature is not
verified.
verified, unless CMS_CADES flag is also set.
If B<CMS_CADES> is set, each signer certificate is checked against the
"ESS signing-certificate" extension added in the signed attributes of the
signature.
If B<CMS_NO_CONTENT_VERIFY> is set then the content digest is not checked.
@@ -122,7 +126,7 @@ L<ERR_get_error(3)>, L<CMS_sign(3)>
=head1 COPYRIGHT
Copyright 2008-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2008-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/CRYPTO_get_ex_new_index.pod
+5 -5
View File
@@ -23,7 +23,7 @@ CRYPTO_free_ex_data, CRYPTO_new_ex_data
typedef void CRYPTO_EX_free(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
int idx, long argl, void *argp);
typedef int CRYPTO_EX_dup(CRYPTO_EX_DATA *to, const CRYPTO_EX_DATA *from,
void *from_d, int idx, long argl, void *argp);
void **from_d, int idx, long argl, void *argp);
int CRYPTO_new_ex_data(int class_index, void *obj, CRYPTO_EX_DATA *ad)
@@ -140,10 +140,8 @@ dup_func() is called when a structure is being copied. This is only done
for B<SSL>, B<SSL_SESSION>, B<EC_KEY> objects and B<BIO> chains via
BIO_dup_chain(). The B<to> and B<from> parameters
are pointers to the destination and source B<CRYPTO_EX_DATA> structures,
respectively. The B<from_d> parameter needs to be cast to a B<void **pptr>
as the API has currently the wrong signature; that will be changed in a
future version. The B<*pptr> is a pointer to the source exdata.
When the dup_func() returns, the value in B<*pptr> is copied to the
respectively. The B<*from_d> parameter is a pointer to the source exdata.
When the dup_func() returns, the value in B<*from_d> is copied to the
destination ex_data. If the pointer contained in B<*pptr> is not modified
by the dup_func(), then both B<to> and B<from> will point to the same data.
The B<idx>, B<argl> and B<argp> parameters are as described for the other
@@ -165,6 +163,8 @@ dup_func() should return 0 for failure and 1 for success.
=head1 HISTORY
CRYPTO_alloc_ex_data() was added in OpenSSL 3.0.
The signature of the dup_func() callback was changed in OpenSSL 3.0 to use the
type B<void **> for B<from_d>. Previously this parameter was of type B<void *>.
=head1 COPYRIGHT
doc/man3/EC_GFp_simple_method.pod
+17 -5
View File
@@ -8,6 +8,8 @@ EC_GFp_simple_method, EC_GFp_mont_method, EC_GFp_nist_method, EC_GFp_nistp224_me
#include <openssl/ec.h>
Deprecated since OpenSSL 3.0:
const EC_METHOD *EC_GFp_simple_method(void);
const EC_METHOD *EC_GFp_mont_method(void);
const EC_METHOD *EC_GFp_nist_method(void);
@@ -21,6 +23,10 @@ EC_GFp_simple_method, EC_GFp_mont_method, EC_GFp_nist_method, EC_GFp_nistp224_me
=head1 DESCRIPTION
All const EC_METHOD *EC_GF* functions were deprecated in OpenSSL 3.0, since
EC_METHOD is no longer a public concept.
The Elliptic Curve library provides a number of different implementations through a single common interface.
When constructing a curve using EC_GROUP_new (see L<EC_GROUP_new(3)>) an
implementation method must be provided. The functions described here all return a const pointer to an
@@ -39,10 +45,8 @@ The functions EC_GFp_nistp224_method, EC_GFp_nistp256_method and EC_GFp_nistp521
optimised implementations for the NIST P224, P256 and P521 curves respectively. Note, however, that these
implementations are not available on all platforms.
EC_METHOD_get_field_type identifies what type of field the EC_METHOD structure supports, which will be either
F2^m or Fp. If the field type is Fp then the value B<NID_X9_62_prime_field> is returned. If the field type is
F2^m then the value B<NID_X9_62_characteristic_two_field> is returned. These values are defined in the
obj_mac.h header file.
EC_METHOD_get_field_type() was deprecated in OpenSSL 3.0.
Applications should use EC_GROUP_get_field_type() as a replacement (see L<EC_GROUP_copy(3)>).
=head1 RETURN VALUES
@@ -57,9 +61,17 @@ L<EC_POINT_new(3)>, L<EC_POINT_add(3)>, L<EC_KEY_new(3)>,
L<d2i_ECPKParameters(3)>,
L<BN_mod_mul_montgomery(3)>
=head1 HISTORY
EC_GFp_simple_method(), EC_GFp_mont_method(void),
EC_GFp_nist_method(), EC_GFp_nistp224_method(),
EC_GFp_nistp256_method(), EC_GFp_nistp521_method(),
EC_GF2m_simple_method(), and EC_METHOD_get_field_type()
were deprecated in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2013-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2013-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EC_GROUP_copy.pod
+19 -6
View File
@@ -22,8 +22,6 @@ EC_GROUP_get_pentanomial_basis, EC_GROUP_get0_field
int EC_GROUP_copy(EC_GROUP *dst, const EC_GROUP *src);
EC_GROUP *EC_GROUP_dup(const EC_GROUP *src);
const EC_METHOD *EC_GROUP_method_of(const EC_GROUP *group);
int EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator,
const BIGNUM *order, const BIGNUM *cofactor);
const EC_POINT *EC_GROUP_get0_generator(const EC_GROUP *group);
@@ -63,6 +61,10 @@ EC_GROUP_get_pentanomial_basis, EC_GROUP_get0_field
int EC_GROUP_get_pentanomial_basis(const EC_GROUP *, unsigned int *k1,
unsigned int *k2, unsigned int *k3);
Deprecated since OpenSSL 3.0:
const EC_METHOD *EC_GROUP_method_of(const EC_GROUP *group);
=head1 DESCRIPTION
EC_GROUP_copy() copies the curve B<src> into B<dst>. Both B<src> and B<dst> must use the same EC_METHOD.
@@ -71,6 +73,7 @@ EC_GROUP_dup() creates a new EC_GROUP object and copies the content from B<src>
EC_GROUP object.
EC_GROUP_method_of() obtains the EC_METHOD of B<group>.
This function was deprecated in OpenSSL 3.0, since EC_METHOD is no longer a public concept.
EC_GROUP_set_generator() sets curve parameters that must be agreed by all participants using the curve. These
parameters include the B<generator>, the B<order> and the B<cofactor>. The B<generator> is a well defined point on the
@@ -140,8 +143,12 @@ built-in curves within the library provide seed values that can be obtained. It
EC_GROUP_set_seed() and passing a pointer to a memory block, along with the length of the seed. Again, the EC library will not use
this seed value, although it will be preserved in any ASN1 based communications.
EC_GROUP_get_degree() gets the degree of the field. For Fp fields this will be the number of bits in p. For F2^m fields this will be
the value m.
EC_GROUP_get_degree() gets the degree of the field.
For Fp fields this will be the number of bits in p.
For F2^m fields this will be the value m.
EC_GROUP_get_field_type() identifies what type of field the EC_GROUP structure supports,
which will be either F2^m or Fp.
The function EC_GROUP_check_discriminant() calculates the discriminant for the curve and verifies that it is valid.
For a curve defined over Fp the discriminant is given by the formula 4*a^3 + 27*b^2 whilst for F2^m curves the discriminant is
@@ -202,6 +209,10 @@ EC_GROUP_get_point_conversion_form() returns the point_conversion_form for B<gro
EC_GROUP_get_degree() returns the degree for B<group> or 0 if the operation is not supported by the underlying group implementation.
EC_GROUP_get_field_type() returns either B<NID_X9_62_prime_field> for prime curves
or B<NID_X9_62_characteristic_two_field> for binary curves;
these values are defined in the obj_mac.h header file.
EC_GROUP_check_named_curve() returns the nid of the matching named curve, otherwise it returns 0 for no match, or -1 on error.
EC_GROUP_get0_order() returns an internal pointer to the group order.
@@ -229,11 +240,13 @@ L<EC_GFp_simple_method(3)>, L<d2i_ECPKParameters(3)>
=head1 HISTORY
The EC_GROUP_check_named_curve() function was added in OpenSSL 3.0.
EC_GROUP_method_of() was deprecated in OpenSSL 3.0.
EC_GROUP_check_named_curve() and EC_GROUP_get_field_type() were added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2013-2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2013-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EC_GROUP_new.pod
+9 -9
View File
@@ -4,7 +4,6 @@
EC_GROUP_get_ecparameters,
EC_GROUP_get_ecpkparameters,
EC_GROUP_new_ex,
EC_GROUP_new,
EC_GROUP_new_from_ecparameters,
EC_GROUP_new_from_ecpkparameters,
@@ -27,8 +26,6 @@ objects
#include <openssl/ec.h>
EC_GROUP *EC_GROUP_new_ex(OPENSSL_CTX *libctx, const EC_METHOD *meth);
EC_GROUP *EC_GROUP_new(const EC_METHOD *meth);
EC_GROUP *EC_GROUP_new_from_ecparameters(const ECPARAMETERS *params)
EC_GROUP *EC_GROUP_new_from_ecpkparameters(const ECPKPARAMETERS *params)
void EC_GROUP_free(EC_GROUP *group);
@@ -62,6 +59,7 @@ Deprecated since OpenSSL 3.0, can be hidden entirely by defining
B<OPENSSL_API_COMPAT> with a suitable version value, see
L<openssl_user_macros(7)>:
EC_GROUP *EC_GROUP_new(const EC_METHOD *meth);
void EC_GROUP_clear_free(EC_GROUP *group);
=head1 DESCRIPTION
@@ -83,20 +81,20 @@ Operations in a binary field are performed relative to an
B<irreducible polynomial>. All such curves with OpenSSL use a trinomial or a
pentanomial for this parameter.
A new curve can be constructed by calling EC_GROUP_new_ex(), using the
Although deprecated since OpenSSL 3.0 and should no longer be used,
a new curve can be constructed by calling EC_GROUP_new(), using the
implementation provided by B<meth> (see L<EC_GFp_simple_method(3)>) and
associated with the library context B<ctx> (see L<OPENSSL_CTX(3)>).
The B<ctx> parameter may be NULL in which case the default library context is
used.
It is then necessary to call EC_GROUP_set_curve() to set the curve parameters.
Applications should instead use one of the other EC_GROUP_new_* constructors.
EC_GROUP_new_from_ecparameters() will create a group from the
specified B<params> and
EC_GROUP_new_from_ecpkparameters() will create a group from the specific PK
B<params>.
EC_GROUP_new() is the same as EC_GROUP_new_ex() except that the library context
used is always the default library context.
EC_GROUP_set_curve() sets the curve parameters B<p>, B<a> and B<b>. For a curve
over Fp B<p> is the prime for the field. For a curve over F2^m B<p> represents
the irreducible polynomial - each bit represents a term in the polynomial.
@@ -182,7 +180,9 @@ L<OPENSSL_CTX(3)>
=item *
EC_GROUP_new_ex() and EC_GROUP_new_by_curve_name_ex() were added in OpenSSL 3.0.
EC_GROUP_new() was deprecated in OpenSSL 3.0.
EC_GROUP_new_by_curve_name_ex() was added in OpenSSL 3.0.
=item *
@@ -193,7 +193,7 @@ instead.
=head1 COPYRIGHT
Copyright 2013-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2013-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EC_KEY_new.pod
+13 -3
View File
@@ -40,7 +40,6 @@ EC_KEY objects
point_conversion_form_t EC_KEY_get_conv_form(const EC_KEY *key);
void EC_KEY_set_conv_form(EC_KEY *eckey, point_conversion_form_t cform);
void EC_KEY_set_asn1_flag(EC_KEY *eckey, int asn1_flag);
int EC_KEY_precompute_mult(EC_KEY *key, BN_CTX *ctx);
int EC_KEY_generate_key(EC_KEY *key);
int EC_KEY_check_key(const EC_KEY *key);
int EC_KEY_set_public_key_affine_coordinates(EC_KEY *key, BIGNUM *x, BIGNUM *y);
@@ -56,6 +55,10 @@ EC_KEY objects
size_t EC_KEY_priv2buf(const EC_KEY *eckey, unsigned char **pbuf);
Deprecated since OpenSSL 3.0:
int EC_KEY_precompute_mult(EC_KEY *key, BN_CTX *ctx);
=head1 DESCRIPTION
An EC_KEY represents a public key and, optionally, the associated private
@@ -136,11 +139,14 @@ EC_KEY_set_asn1_flag() sets the asn1_flag on the underlying EC_GROUP object
(if set). Refer to L<EC_GROUP_copy(3)> for further information on the
asn1_flag.
Although deprecated in OpenSSL 3.0 and should no longer be used,
EC_KEY_precompute_mult() stores multiples of the underlying EC_GROUP generator
for faster point multiplication. See also L<EC_POINT_add(3)>.
Modern versions should instead switch to named curves which OpenSSL has
hardcoded lookup tables for.
EC_KEY_oct2key() and EC_KEY_key2buf() are identical to the functions
EC_POINT_oct2point() and EC_KEY_point2buf() except they use the public key
EC_POINT_oct2point() and EC_POINT_point2buf() except they use the public key
EC_POINT in B<eckey>.
EC_KEY_oct2priv() and EC_KEY_priv2oct() convert between the private key
@@ -195,9 +201,13 @@ L<EC_GFp_simple_method(3)>,
L<d2i_ECPKParameters(3)>,
L<OPENSSL_CTX(3)>
=head1 HISTORY
EC_KEY_precompute_mult() was deprecated in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2013-2017 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2013-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EC_POINT_add.pod
+16 -12
View File
@@ -15,18 +15,18 @@ EC_POINT_add, EC_POINT_dbl, EC_POINT_invert, EC_POINT_is_at_infinity, EC_POINT_i
int EC_POINT_is_at_infinity(const EC_GROUP *group, const EC_POINT *p);
int EC_POINT_is_on_curve(const EC_GROUP *group, const EC_POINT *point, BN_CTX *ctx);
int EC_POINT_cmp(const EC_GROUP *group, const EC_POINT *a, const EC_POINT *b, BN_CTX *ctx);
int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *n,
const EC_POINT *q, const BIGNUM *m, BN_CTX *ctx);
Deprecated since OpenSSL 3.0:
int EC_POINT_make_affine(const EC_GROUP *group, EC_POINT *point, BN_CTX *ctx);
int EC_POINTs_make_affine(const EC_GROUP *group, size_t num,
EC_POINT *points[], BN_CTX *ctx);
int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *n,
const EC_POINT *q, const BIGNUM *m, BN_CTX *ctx);
int EC_GROUP_precompute_mult(EC_GROUP *group, BN_CTX *ctx);
int EC_GROUP_have_precompute_mult(const EC_GROUP *group);
Deprecated since OpenSSL 3.0:
int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *n, size_t num,
const EC_POINT *p[], const BIGNUM *m[], BN_CTX *ctx);
int EC_GROUP_precompute_mult(EC_GROUP *group, BN_CTX *ctx);
int EC_GROUP_have_precompute_mult(const EC_GROUP *group);
=head1 DESCRIPTION
@@ -43,7 +43,8 @@ EC_POINT_cmp compares the two supplied points and tests whether or not they are
The functions EC_POINT_make_affine and EC_POINTs_make_affine force the internal representation of the EC_POINT(s) into the affine
co-ordinate system. In the case of EC_POINTs_make_affine the value B<num> provides the number of points in the array B<points> to be
forced.
forced. These functions were deprecated in OpenSSL 3.0 and should no longer be used.
Modern versions automatically perform this conversion when needed.
EC_POINT_mul calculates the value generator * B<n> + B<q> * B<m> and stores the result in B<r>.
The value B<n> may be NULL in which case the result is just B<q> * B<m> (variable point multiplication). Alternatively, both B<q> and B<m> may be NULL, and B<n> non-NULL, in which case the result is just generator * B<n> (fixed point multiplication).
@@ -56,8 +57,9 @@ Modern versions should instead use EC_POINT_mul(), combined (if needed) with EC_
The function EC_GROUP_precompute_mult stores multiples of the generator for faster point multiplication, whilst
EC_GROUP_have_precompute_mult tests whether precomputation has already been done. See L<EC_GROUP_copy(3)> for information
about the generator.
about the generator. Precomputation functionality was deprecated in OpenSSL 3.0.
Users of EC_GROUP_precompute_mult() and EC_GROUP_have_precompute_mult() should
switch to named curves which OpenSSL has hardcoded lookup tables for.
=head1 RETURN VALUES
@@ -80,11 +82,13 @@ L<EC_GFp_simple_method(3)>, L<d2i_ECPKParameters(3)>
=head1 HISTORY
EC_POINTs_mul() was deprecated in OpenSSL 3.0.
EC_POINT_make_affine(), EC_POINTs_make_affine(), EC_POINTs_mul(),
EC_GROUP_precompute_mult(), and EC_GROUP_have_precompute_mult()
were deprecated in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2013-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2013-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EC_POINT_new.pod
+4 -1
View File
@@ -38,7 +38,6 @@ EC_POINT_hex2point
void EC_POINT_clear_free(EC_POINT *point);
int EC_POINT_copy(EC_POINT *dst, const EC_POINT *src);
EC_POINT *EC_POINT_dup(const EC_POINT *src, const EC_GROUP *group);
const EC_METHOD *EC_POINT_method_of(const EC_POINT *point);
int EC_POINT_set_to_infinity(const EC_GROUP *group, EC_POINT *point);
int EC_POINT_set_affine_coordinates(const EC_GROUP *group, EC_POINT *p,
const BIGNUM *x, const BIGNUM *y,
@@ -68,6 +67,7 @@ EC_POINT_hex2point
Deprecated since OpenSSL 3.0:
const EC_METHOD *EC_POINT_method_of(const EC_POINT *point);
int EC_POINT_set_Jprojective_coordinates_GFp(const EC_GROUP *group,
EC_POINT *p,
const BIGNUM *x, const BIGNUM *y,
@@ -116,6 +116,8 @@ EC_POINT_dup() creates a new B<EC_POINT> object and copies the content from
B<src> to the newly created B<EC_POINT> object.
EC_POINT_method_of() obtains the B<EC_METHOD> associated with B<point>.
This function was deprecated in OpenSSL 3.0, since EC_METHOD is no longer a
public concept.
A valid point on a curve is the special point at infinity. A point is set to
be at infinity by calling EC_POINT_set_to_infinity().
@@ -249,6 +251,7 @@ L<EC_GFp_simple_method(3)>, L<d2i_ECPKParameters(3)>
=head1 HISTORY
EC_POINT_method_of(),
EC_POINT_set_Jprojective_coordinates_GFp(),
EC_POINT_get_Jprojective_coordinates_GFp(),
EC_POINT_set_affine_coordinates_GFp(), EC_POINT_get_affine_coordinates_GFp(),
doc/man3/EVP_EncryptInit.pod
+1 -1
View File
@@ -770,7 +770,7 @@ with a 128-bit key:
/* Don't set key or IV right away; we want to check lengths */
ctx = EVP_CIPHER_CTX_new();
EVP_CipherInit_ex(&ctx, EVP_aes_128_cbc(), NULL, NULL, NULL,
EVP_CipherInit_ex(ctx, EVP_aes_128_cbc(), NULL, NULL, NULL,
do_encrypt);
OPENSSL_assert(EVP_CIPHER_CTX_key_length(ctx) == 16);
OPENSSL_assert(EVP_CIPHER_CTX_iv_length(ctx) == 16);
doc/man3/EVP_KDF.pod
+25 -29
View File
@@ -3,11 +3,11 @@
=head1 NAME
EVP_KDF, EVP_KDF_fetch, EVP_KDF_free, EVP_KDF_up_ref,
EVP_KDF_CTX, EVP_KDF_CTX_new, EVP_KDF_CTX_free, EVP_KDF_CTX_dup,
EVP_KDF_CTX, EVP_KDF_new_ctx, EVP_KDF_free_ctx, EVP_KDF_dup_ctx,
EVP_KDF_reset, EVP_KDF_derive,
EVP_KDF_size, EVP_KDF_provider, EVP_KDF_CTX_kdf, EVP_KDF_is_a,
EVP_KDF_size, EVP_KDF_provider, EVP_KDF_get_ctx_kdf, EVP_KDF_is_a,
EVP_KDF_number, EVP_KDF_names_do_all,
EVP_KDF_CTX_get_params, EVP_KDF_CTX_set_params, EVP_KDF_do_all_provided,
EVP_KDF_get_ctx_params, EVP_KDF_set_ctx_params, EVP_KDF_do_all_provided,
EVP_KDF_get_params, EVP_KDF_gettable_ctx_params, EVP_KDF_settable_ctx_params,
EVP_KDF_gettable_params - EVP KDF routines
@@ -18,10 +18,10 @@ EVP_KDF_gettable_params - EVP KDF routines
typedef struct evp_kdf_st EVP_KDF;
typedef struct evp_kdf_ctx_st EVP_KDF_CTX;
EVP_KDF_CTX *EVP_KDF_CTX_new(const EVP_KDF *kdf);
const EVP_KDF *EVP_KDF_CTX_kdf(EVP_KDF_CTX *ctx);
void EVP_KDF_CTX_free(EVP_KDF_CTX *ctx);
EVP_KDF_CTX *EVP_KDF_CTX_dup(const EVP_KDF_CTX *src);
EVP_KDF_CTX *EVP_KDF_new_ctx(const EVP_KDF *kdf);
const EVP_KDF *EVP_KDF_get_ctx_kdf(EVP_KDF_CTX *ctx);
void EVP_KDF_free_ctx(EVP_KDF_CTX *ctx);
EVP_KDF_CTX *EVP_KDF_dup_ctx(const EVP_KDF_CTX *src);
void EVP_KDF_reset(EVP_KDF_CTX *ctx);
size_t EVP_KDF_size(EVP_KDF_CTX *ctx);
int EVP_KDF_derive(EVP_KDF_CTX *ctx, unsigned char *key, size_t keylen);
@@ -39,8 +39,8 @@ EVP_KDF_gettable_params - EVP KDF routines
void (*fn)(const char *name, void *data),
void *data);
int EVP_KDF_get_params(EVP_KDF *kdf, OSSL_PARAM params[]);
int EVP_KDF_CTX_get_params(EVP_KDF_CTX *ctx, OSSL_PARAM params[]);
int EVP_KDF_CTX_set_params(EVP_KDF_CTX *ctx, const OSSL_PARAM params[]);
int EVP_KDF_get_ctx_params(EVP_KDF_CTX *ctx, OSSL_PARAM params[]);
int EVP_KDF_set_ctx_params(EVP_KDF_CTX *ctx, const OSSL_PARAM params[]);
const OSSL_PARAM *EVP_KDF_gettable_params(const EVP_KDF *kdf);
const OSSL_PARAM *EVP_KDF_gettable_ctx_params(const EVP_KDF *kdf);
const OSSL_PARAM *EVP_KDF_settable_ctx_params(const EVP_KDF *kdf);
@@ -52,8 +52,8 @@ The EVP KDF routines are a high level interface to Key Derivation Function
algorithms and should be used instead of algorithm-specific functions.
After creating a B<EVP_KDF_CTX> for the required algorithm using
EVP_KDF_CTX_new(), inputs to the algorithm are supplied
using calls to EVP_KDF_CTX_set_params() before
EVP_KDF_new_ctx(), inputs to the algorithm are supplied
using calls to EVP_KDF_set_ctx_params() before
calling EVP_KDF_derive() to derive the key.
=head2 Types
@@ -68,6 +68,9 @@ EVP_KDF_fetch() fetches an implementation of a KDF I<algorithm>, given
a library context I<libctx> and a set of I<properties>.
See L<provider(7)/Fetching algorithms> for further information.
See L<OSSL_PROVIDER-default(7)/Key Derivation Function (KDF)> for the lists of
algorithms supported by the default provider.
The returned value must eventually be freed with
L<EVP_KDF_free(3)>.
@@ -79,12 +82,12 @@ NULL is a valid parameter, for which this function is a no-op.
=head2 Context manipulation functions
EVP_KDF_CTX_new() creates a new context for the KDF implementation I<kdf>.
EVP_KDF_new_ctx() creates a new context for the KDF implementation I<kdf>.
EVP_KDF_CTX_free() frees up the context I<ctx>. If I<ctx> is NULL, nothing
EVP_KDF_free_ctx() frees up the context I<ctx>. If I<ctx> is NULL, nothing
is done.
EVP_KDF_CTX_kdf() returns the B<EVP_KDF> associated with the context
EVP_KDF_get_ctx_kdf() returns the B<EVP_KDF> associated with the context
I<ctx>.
=head2 Computing functions
@@ -104,14 +107,14 @@ parameters should be retrieved.
Note that a parameter that is unknown in the underlying context is
simply ignored.
EVP_KDF_CTX_get_params() retrieves chosen parameters, given the
EVP_KDF_get_ctx_params() retrieves chosen parameters, given the
context I<ctx> and its underlying context.
The set of parameters given with I<params> determine exactly what
parameters should be retrieved.
Note that a parameter that is unknown in the underlying context is
simply ignored.
EVP_KDF_CTX_set_params() passes chosen parameters to the underlying
EVP_KDF_set_ctx_params() passes chosen parameters to the underlying
context, given a context I<ctx>.
The set of parameters given with I<params> determine exactly what
parameters are passed down.
@@ -123,8 +126,8 @@ defined by the implementation.
EVP_KDF_gettable_params(), EVP_KDF_gettable_ctx_params() and
EVP_KDF_settable_ctx_params() get a constant B<OSSL_PARAM> array that
describes the retrievable and settable parameters, i.e. parameters that
can be used with EVP_KDF_get_params(), EVP_KDF_CTX_get_params()
and EVP_KDF_CTX_set_params(), respectively.
can be used with EVP_KDF_get_params(), EVP_KDF_get_ctx_params()
and EVP_KDF_set_ctx_params(), respectively.
See L<OSSL_PARAM(3)> for the use of B<OSSL_PARAM> as parameter descriptor.
=head2 Information functions
@@ -234,10 +237,10 @@ NULL on error.
EVP_KDF_up_ref() returns 1 on success, 0 on error.
EVP_KDF_CTX_new() returns either the newly allocated
EVP_KDF_new_ctx() returns either the newly allocated
B<EVP_KDF_CTX> structure or NULL if an error occurred.
EVP_KDF_CTX_free() and EVP_KDF_reset() do not return a value.
EVP_KDF_free_ctx() and EVP_KDF_reset() do not return a value.
EVP_KDF_size() returns the output size. B<SIZE_MAX> is returned to indicate
that the algorithm produces a variable amount of output; 0 to indicate failure.
@@ -248,14 +251,7 @@ supported by the KDF algorithm.
=head1 SEE ALSO
L<EVP_KDF-SCRYPT(7)>
L<EVP_KDF-TLS1_PRF(7)>
L<EVP_KDF-PBKDF2(7)>
L<EVP_KDF-HKDF(7)>
L<EVP_KDF-SS(7)>
L<EVP_KDF-SSHKDF(7)>
L<EVP_KDF-X963(7)>
L<EVP_KDF-X942(7)>
L<OSSL_PROVIDER-default(7)/Key Derivation Function (KDF)>
=head1 HISTORY
@@ -263,7 +259,7 @@ This functionality was added to OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_MAC.pod
+26 -23
View File
@@ -5,8 +5,8 @@
EVP_MAC, EVP_MAC_fetch, EVP_MAC_up_ref, EVP_MAC_free,
EVP_MAC_is_a, EVP_MAC_number, EVP_MAC_names_do_all,
EVP_MAC_provider, EVP_MAC_get_params, EVP_MAC_gettable_params,
EVP_MAC_CTX, EVP_MAC_CTX_new, EVP_MAC_CTX_free, EVP_MAC_CTX_dup,
EVP_MAC_CTX_mac, EVP_MAC_CTX_get_params, EVP_MAC_CTX_set_params,
EVP_MAC_CTX, EVP_MAC_new_ctx, EVP_MAC_free_ctx, EVP_MAC_dup_ctx,
EVP_MAC_get_ctx_mac, EVP_MAC_get_ctx_params, EVP_MAC_set_ctx_params,
EVP_MAC_size, EVP_MAC_init, EVP_MAC_update, EVP_MAC_final,
EVP_MAC_gettable_ctx_params, EVP_MAC_settable_ctx_params,
EVP_MAC_do_all_provided - EVP MAC routines
@@ -30,12 +30,12 @@ EVP_MAC_do_all_provided - EVP MAC routines
const OSSL_PROVIDER *EVP_MAC_provider(const EVP_MAC *mac);
int EVP_MAC_get_params(EVP_MAC *mac, OSSL_PARAM params[]);
EVP_MAC_CTX *EVP_MAC_CTX_new(EVP_MAC *mac);
void EVP_MAC_CTX_free(EVP_MAC_CTX *ctx);
EVP_MAC_CTX *EVP_MAC_CTX_dup(const EVP_MAC_CTX *src);
EVP_MAC *EVP_MAC_CTX_mac(EVP_MAC_CTX *ctx);
int EVP_MAC_CTX_get_params(EVP_MAC_CTX *ctx, OSSL_PARAM params[]);
int EVP_MAC_CTX_set_params(EVP_MAC_CTX *ctx, const OSSL_PARAM params[]);
EVP_MAC_CTX *EVP_MAC_new_ctx(EVP_MAC *mac);
void EVP_MAC_free_ctx(EVP_MAC_CTX *ctx);
EVP_MAC_CTX *EVP_MAC_dup_ctx(const EVP_MAC_CTX *src);
EVP_MAC *EVP_MAC_get_ctx_mac(EVP_MAC_CTX *ctx);
int EVP_MAC_get_ctx_params(EVP_MAC_CTX *ctx, OSSL_PARAM params[]);
int EVP_MAC_set_ctx_params(EVP_MAC_CTX *ctx, const OSSL_PARAM params[]);
size_t EVP_MAC_size(EVP_MAC_CTX *ctx);
int EVP_MAC_init(EVP_MAC_CTX *ctx);
@@ -82,6 +82,9 @@ EVP_MAC_fetch() fetches an implementation of a MAC I<algorithm>, given
a library context I<libctx> and a set of I<properties>.
See L<provider(7)/Fetching algorithms> for further information.
See L<OSSL_PROVIDER-default(7)/Message Authentication Code (MAC)> for the list
of algorithms supported by the default provider.
The returned value must eventually be freed with
L<EVP_MAC_free(3)>.
@@ -93,18 +96,18 @@ NULL is a valid parameter, for which this function is a no-op.
=head2 Context manipulation functions
EVP_MAC_CTX_new() creates a new context for the MAC type I<mac>.
EVP_MAC_new_ctx() creates a new context for the MAC type I<mac>.
The created context can then be used with most other functions
described here.
EVP_MAC_CTX_free() frees the contents of the context, including an
EVP_MAC_free_ctx() frees the contents of the context, including an
underlying context if there is one, as well as the context itself.
NULL is a valid parameter, for which this function is a no-op.
EVP_MAC_CTX_dup() duplicates the I<src> context and returns a newly allocated
EVP_MAC_dup_ctx() duplicates the I<src> context and returns a newly allocated
context.
EVP_MAC_CTX_mac() returns the B<EVP_MAC> associated with the context
EVP_MAC_get_ctx_mac() returns the B<EVP_MAC> associated with the context
I<ctx>.
=head2 Computing functions
@@ -133,14 +136,14 @@ parameters should be retrieved.
Note that a parameter that is unknown in the underlying context is
simply ignored.
EVP_MAC_CTX_get_params() retrieves chosen parameters, given the
EVP_MAC_get_ctx_params() retrieves chosen parameters, given the
context I<ctx> and its underlying context.
The set of parameters given with I<params> determine exactly what
parameters should be retrieved.
Note that a parameter that is unknown in the underlying context is
simply ignored.
EVP_MAC_CTX_set_params() passes chosen parameters to the underlying
EVP_MAC_set_ctx_params() passes chosen parameters to the underlying
context, given a context I<ctx>.
The set of parameters given with I<params> determine exactly what
parameters are passed down.
@@ -152,8 +155,8 @@ defined by the implementation.
EVP_MAC_gettable_params(), EVP_MAC_gettable_ctx_params() and
EVP_MAC_settable_ctx_params() get a constant B<OSSL_PARAM> array that
describes the retrievable and settable parameters, i.e. parameters that
can be used with EVP_MAC_get_params(), EVP_MAC_CTX_get_params()
and EVP_MAC_CTX_set_params(), respectively.
can be used with EVP_MAC_get_params(), EVP_MAC_get_ctx_params()
and EVP_MAC_set_ctx_params(), respectively.
See L<OSSL_PARAM(3)> for the use of B<OSSL_PARAM> as parameter descriptor.
=head2 Information functions
@@ -267,12 +270,12 @@ the given name, otherwise 0.
EVP_MAC_provider() returns a pointer to the provider for the MAC, or
NULL on error.
EVP_MAC_CTX_new() and EVP_MAC_CTX_dup() return a pointer to a newly
EVP_MAC_new_ctx() and EVP_MAC_dup_ctx() return a pointer to a newly
created EVP_MAC_CTX, or NULL if allocation failed.
EVP_MAC_CTX_free() returns nothing at all.
EVP_MAC_free_ctx() returns nothing at all.
EVP_MAC_CTX_get_params() and EVP_MAC_CTX_set_params() return 1 on
EVP_MAC_get_ctx_params() and EVP_MAC_set_ctx_params() return 1 on
success, 0 on error.
EVP_MAC_init(), EVP_MAC_update(), and EVP_MAC_final() return 1 on success, 0
@@ -324,8 +327,8 @@ EVP_MAC_do_all_provided() returns nothing at all.
if (mac == NULL
|| key == NULL
|| (ctx = EVP_MAC_CTX_new(mac)) == NULL
|| EVP_MAC_CTX_set_params(ctx, params) <= 0)
|| (ctx = EVP_MAC_new_ctx(mac)) == NULL
|| EVP_MAC_set_ctx_params(ctx, params) <= 0)
goto err;
if (!EVP_MAC_init(ctx))
@@ -344,12 +347,12 @@ EVP_MAC_do_all_provided() returns nothing at all.
printf("%02X", buf[i]);
printf("\n");
EVP_MAC_CTX_free(ctx);
EVP_MAC_free_ctx(ctx);
EVP_MAC_free(mac);
exit(0);
err:
EVP_MAC_CTX_free(ctx);
EVP_MAC_free_ctx(ctx);
EVP_MAC_free(mac);
fprintf(stderr, "Something went wrong\n");
ERR_print_errors_fp(stderr);
doc/man3/EVP_PKEY_ASN1_METHOD.pod
+4 -4
View File
@@ -43,7 +43,7 @@ EVP_PKEY_get0_asn1
void EVP_PKEY_asn1_set_public(EVP_PKEY_ASN1_METHOD *ameth,
int (*pub_decode) (EVP_PKEY *pk,
X509_PUBKEY *pub),
const X509_PUBKEY *pub),
int (*pub_encode) (X509_PUBKEY *pub,
const EVP_PKEY *pk),
int (*pub_cmp) (const EVP_PKEY *a,
@@ -170,7 +170,7 @@ They're called by L<X509_PUBKEY_get0(3)> and L<X509_PUBKEY_set(3)>.
The pub_cmp() method is called when two public keys are to be
compared.
It MUST return 1 when the keys are equal, 0 otherwise.
It's called by L<EVP_PKEY_cmp(3)>.
It's called by L<EVP_PKEY_eq(3)>.
The pub_print() method is called to print a public key in humanly
readable text to B<out>, indented B<indent> spaces.
@@ -228,7 +228,7 @@ It's called by L<EVP_PKEY_copy_parameters(3)>.
The param_cmp() method compares the parameters of keys B<a> and B<b>.
It MUST return 1 when the keys are equal, 0 when not equal, or a
negative number on error.
It's called by L<EVP_PKEY_cmp_parameters(3)>.
It's called by L<EVP_PKEY_parameters_eq(3)>.
The param_print() method prints the private key parameters in humanly
readable text to B<out>, indented B<indent> spaces.
@@ -434,7 +434,7 @@ B<EVP_PKEY_ASN1_METHOD> object otherwise.
=head1 COPYRIGHT
Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_PKEY_CTX_ctrl.pod
+1 -57
View File
@@ -2,10 +2,6 @@
=head1 NAME
EVP_PKEY_CTX_get_params,
EVP_PKEY_CTX_gettable_params,
EVP_PKEY_CTX_set_params,
EVP_PKEY_CTX_settable_params,
EVP_PKEY_CTX_ctrl,
EVP_PKEY_CTX_ctrl_str,
EVP_PKEY_CTX_ctrl_uint64,
@@ -78,11 +74,6 @@ EVP_PKEY_CTX_set1_id, EVP_PKEY_CTX_get1_id, EVP_PKEY_CTX_get1_id_len
#include <openssl/evp.h>
int EVP_PKEY_CTX_get_params(EVP_PKEY_CTX *ctx, OSSL_PARAM *params);
const OSSL_PARAM *EVP_PKEY_CTX_gettable_params(EVP_PKEY_CTX *ctx);
int EVP_PKEY_CTX_set_params(EVP_PKEY_CTX *ctx, OSSL_PARAM *params);
const OSSL_PARAM *EVP_PKEY_CTX_settable_params(EVP_PKEY_CTX *ctx);
int EVP_PKEY_CTX_ctrl(EVP_PKEY_CTX *ctx, int keytype, int optype,
int cmd, int p1, void *p2);
int EVP_PKEY_CTX_ctrl_uint64(EVP_PKEY_CTX *ctx, int keytype, int optype,
@@ -186,49 +177,6 @@ EVP_PKEY_CTX_set1_id, EVP_PKEY_CTX_get1_id, EVP_PKEY_CTX_get1_id_len
=head1 DESCRIPTION
The EVP_PKEY_CTX_get_params() and EVP_PKEY_CTX_set_params() functions get and
send arbitrary parameters from and to the algorithm implementation respectively.
Not all parameters may be supported by all providers.
See L<OSSL_PROVIDER(3)> for more information on providers.
See L<OSSL_PARAM(3)> for more information on parameters.
These functions must only be called after the EVP_PKEY_CTX has been initialised
for use in an operation.
The parameters currently supported by the default provider are:
=over 4
=item "pad" (B<OSSL_EXCHANGE_PARAM_PAD>) <unsigned integer>
Sets the DH padding mode.
If B<OSSL_EXCHANGE_PARAM_PAD> is 1 then the shared secret is padded with zeros
up to the size of the DH prime I<p>.
If B<OSSL_EXCHANGE_PARAM_PAD> is zero (the default) then no padding is
performed.
=item "digest" (B<OSSL_SIGNATURE_PARAM_DIGEST>) <UTF8 string>
Gets and sets the name of the digest algorithm used for the input to the
signature functions.
=item "digest-size" (B<OSSL_SIGNATURE_PARAM_DIGEST_SIZE>) <unsigned integer>
Gets and sets the output size of the digest algorithm used for the input to the
signature functions.
The length of the "digest-size" parameter should not exceed that of a B<size_t>.
The internal algorithm that supports this parameter is DSA.
=back
EVP_PKEY_CTX_gettable_params() and EVP_PKEY_CTX_settable_params() gets a
constant B<OSSL_PARAM> array that describes the gettable and
settable parameters for the current algorithm implementation, i.e. parameters
that can be used with EVP_PKEY_CTX_get_params() and EVP_PKEY_CTX_set_params()
respectively.
See L<OSSL_PARAM(3)> for the use of B<OSSL_PARAM> as parameter descriptor.
These functions must only be called after the EVP_PKEY_CTX has been initialised
for use in an operation.
The function EVP_PKEY_CTX_ctrl() sends a control operation to the context
I<ctx>. The key type used must match I<keytype> if it is not -1. The parameter
I<optype> is a mask indicating which operations the control can be applied to.
@@ -662,17 +610,13 @@ allocate adequate memory space for the I<id> before calling EVP_PKEY_CTX_get1_id
=head1 RETURN VALUES
EVP_PKEY_CTX_set_params() returns 1 for success or 0 otherwise.
EVP_PKEY_CTX_settable_params() returns an OSSL_PARAM array on success or NULL on
error.
It may also return NULL if there are no settable parameters available.
All other functions and macros described on this page return a positive value
for success and 0 or a negative value for failure. In particular a return value
of -2 indicates the operation is not supported by the public key algorithm.
=head1 SEE ALSO
L<EVP_PKEY_CTX_set_params(3)>,
L<EVP_PKEY_CTX_new(3)>,
L<EVP_PKEY_encrypt(3)>,
L<EVP_PKEY_decrypt(3)>,
doc/man3/EVP_PKEY_CTX_new.pod
+2 -1
View File
@@ -16,7 +16,8 @@ EVP_PKEY_CTX_new_from_pkey, EVP_PKEY_CTX_dup, EVP_PKEY_CTX_free
const char *name,
const char *propquery);
EVP_PKEY_CTX *EVP_PKEY_CTX_new_from_pkey(OPENSSL_CTX *libctx,
EVP_PKEY *pkey);
EVP_PKEY *pkey,
const char *propquery);
EVP_PKEY_CTX *EVP_PKEY_CTX_dup(const EVP_PKEY_CTX *ctx);
void EVP_PKEY_CTX_free(EVP_PKEY_CTX *ctx);
doc/man3/EVP_PKEY_CTX_set_params.pod
+95
View File
@@ -0,0 +1,95 @@
=pod
=head1 NAME
EVP_PKEY_CTX_set_params,
EVP_PKEY_CTX_settable_params,
EVP_PKEY_CTX_get_params,
EVP_PKEY_CTX_gettable_params
- provider parameter passing operations
=head1 SYNOPSIS
#include <openssl/evp.h>
int EVP_PKEY_CTX_set_params(EVP_PKEY_CTX *ctx, OSSL_PARAM *params);
const OSSL_PARAM *EVP_PKEY_CTX_settable_params(EVP_PKEY_CTX *ctx);
int EVP_PKEY_CTX_get_params(EVP_PKEY_CTX *ctx, OSSL_PARAM *params);
const OSSL_PARAM *EVP_PKEY_CTX_gettable_params(EVP_PKEY_CTX *ctx);
=head1 DESCRIPTION
The EVP_PKEY_CTX_get_params() and EVP_PKEY_CTX_set_params() functions allow
transfer of arbitrary key parameters to and from providers.
Not all parameters may be supported by all providers.
See L<OSSL_PROVIDER(3)> for more information on providers.
See L<OSSL_PARAM(3)> for more information on parameters.
These functions must only be called after the EVP_PKEY_CTX has been initialised
for use in an operation.
These methods replace the EVP_PKEY_CTX_ctrl() mechanism. (EVP_PKEY_CTX_ctrl now
calls these methods internally to interact with providers).
EVP_PKEY_CTX_gettable_params() and EVP_PKEY_CTX_settable_params() get a
constant B<OSSL_PARAM> array that describes the gettable and
settable parameters for the current algorithm implementation, i.e. parameters
that can be used with EVP_PKEY_CTX_get_params() and EVP_PKEY_CTX_set_params()
respectively.
See L<OSSL_PARAM(3)> for the use of B<OSSL_PARAM> as parameter descriptor.
These functions must only be called after the EVP_PKEY_CTX has been initialised
for use in an operation.
=head2 Parameters
Examples of EVP_PKEY parameters include the following:
L<provider-keymgmt(7)/Common parameters>
L<provider-keyexch(7)/Key Exchange parameters>
L<provider-signature(7)/Signature parameters>
L<EVP_PKEY-RSA(7)/Common RSA parameters>
L<EVP_PKEY-RSA(7)/RSA key generation parameters>
L<EVP_PKEY-FFC(7)/FFC parameters>
L<EVP_PKEY-FFC(7)/FFC key generation parameters>
L<EVP_PKEY-DSA(7)/DSA parameters>
L<EVP_PKEY-DSA(7)/DSA key generation parameters>
L<EVP_PKEY-DH(7)/DH parameters>
L<EVP_PKEY-DH(7)/DH key generation parameters>
L<EVP_PKEY-EC(7)/Common EC parameters>
L<EVP_PKEY-X25519(7)/Common X25519, X448, ED25519 and ED448 parameters>
=head1 RETURN VALUES
EVP_PKEY_CTX_set_params() returns 1 for success or 0 otherwise.
EVP_PKEY_CTX_settable_params() returns an OSSL_PARAM array on success or NULL on
error.
It may also return NULL if there are no settable parameters available.
All other functions and macros described on this page return a positive value
for success and 0 or a negative value for failure. In particular a return value
of -2 indicates the operation is not supported by the public key algorithm.
=head1 SEE ALSO
L<EVP_PKEY_CTX_new(3)>,
L<EVP_PKEY_encrypt(3)>,
L<EVP_PKEY_decrypt(3)>,
L<EVP_PKEY_sign(3)>,
L<EVP_PKEY_verify(3)>,
L<EVP_PKEY_verify_recover(3)>,
L<EVP_PKEY_derive(3)>,
L<EVP_PKEY_keygen(3)>
=head1 HISTORY
All functions were added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/EVP_PKEY_cmp.pod → doc/man3/EVP_PKEY_copy_parameters.pod
+20 -9
View File
@@ -2,7 +2,8 @@
=head1 NAME
EVP_PKEY_copy_parameters, EVP_PKEY_missing_parameters, EVP_PKEY_cmp_parameters,
EVP_PKEY_missing_parameters, EVP_PKEY_copy_parameters, EVP_PKEY_parameters_eq,
EVP_PKEY_cmp_parameters, EVP_PKEY_eq,
EVP_PKEY_cmp - public key parameter and comparison functions
=head1 SYNOPSIS
@@ -12,7 +13,9 @@ EVP_PKEY_cmp - public key parameter and comparison functions
int EVP_PKEY_missing_parameters(const EVP_PKEY *pkey);
int EVP_PKEY_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from);
int EVP_PKEY_parameters_eq(const EVP_PKEY *a, const EVP_PKEY *b);
int EVP_PKEY_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b);
int EVP_PKEY_eq(const EVP_PKEY *a, const EVP_PKEY *b);
int EVP_PKEY_cmp(const EVP_PKEY *a, const EVP_PKEY *b);
=head1 DESCRIPTION
@@ -26,11 +29,11 @@ B<from> to key B<to>. An error is returned if the parameters are missing in
B<from> or present in both B<from> and B<to> and mismatch. If the parameters
in B<from> and B<to> are both present and match this function has no effect.
The function EVP_PKEY_cmp_parameters() compares the parameters of keys
B<a> and B<b>.
The function EVP_PKEY_parameters_eq() checks the parameters of keys
B<a> and B<b> for equality.
The function EVP_PKEY_cmp() compares the public key components and parameters
(if present) of keys B<a> and B<b>.
The function EVP_PKEY_eq() checks the public key components and parameters
(if present) of keys B<a> and B<b> for equality.
=head1 NOTES
@@ -40,7 +43,7 @@ parameters are sometimes omitted from a public key if they are inherited from
the CA that signed it.
Since OpenSSL private keys contain public key components too the function
EVP_PKEY_cmp() can also be used to determine if a private key matches
EVP_PKEY_eq() can also be used to determine if a private key matches
a public key.
=head1 RETURN VALUES
@@ -52,8 +55,8 @@ doesn't use parameters.
These functions EVP_PKEY_copy_parameters() returns 1 for success and 0 for
failure.
The function EVP_PKEY_cmp_parameters() and EVP_PKEY_cmp() return 1 if the
keys match, 0 if they don't match, -1 if the key types are different and
The function EVP_PKEY_parameters_eq() and EVP_PKEY_eq() return 1 if their
inputs match, 0 if they don't match, -1 if the key types are different and
-2 if the operation is not supported.
=head1 SEE ALSO
@@ -61,9 +64,17 @@ keys match, 0 if they don't match, -1 if the key types are different and
L<EVP_PKEY_CTX_new(3)>,
L<EVP_PKEY_keygen(3)>
=head1 HISTORY
The function EVP_PKEY_cmp was deprecated and renamed to B<EVP_PKEY_eq> and
EVP_PKEY_cmp_parameters was deprecated and renamed to B<EVP_PKEY_parameters_eq>
(without changing semantics) in OpenSSL 3.0.
This was done to avoid confusion on their return values with other _cmp()
functions that return 0 in case their arguments are equal.
=head1 COPYRIGHT
Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/EVP_PKEY_new.pod
+2 -1
View File
@@ -96,7 +96,8 @@ B<EVP_PKEY_X25519>, B<EVP_PKEY_ED25519>, B<EVP_PKEY_X448> or B<EVP_PKEY_ED448>.
EVP_PKEY_new_CMAC_key() works in the same way as EVP_PKEY_new_raw_private_key()
except it is only for the B<EVP_PKEY_CMAC> algorithm type. In addition to the
raw private key data, it also takes a cipher algorithm to be used during
creation of a CMAC in the B<cipher> argument.
creation of a CMAC in the B<cipher> argument. The cipher should be a standard
encryption only cipher. For example AEAD and XTS ciphers should not be used.
EVP_PKEY_new_mac_key() works in the same way as EVP_PKEY_new_raw_private_key().
New applications should use EVP_PKEY_new_raw_private_key() instead.
doc/man3/EVP_md2.pod
+2 -1
View File
@@ -14,7 +14,7 @@ EVP_md2
=head1 DESCRIPTION
MD2 is a cryptographic hash function standardized in RFC 1319 and designed by
Ronald Rivest.
Ronald Rivest. This implementation is only available with the legacy provider.
=over 4
@@ -38,6 +38,7 @@ IETF RFC 1319.
=head1 SEE ALSO
L<evp(7)>,
L<provider(7)>,
L<EVP_DigestInit(3)>
=head1 COPYRIGHT
doc/man3/EVP_md4.pod
+3 -1
View File
@@ -14,7 +14,8 @@ EVP_md4
=head1 DESCRIPTION
MD4 is a cryptographic hash function standardized in RFC 1320 and designed by
Ronald Rivest, first published in 1990.
Ronald Rivest, first published in 1990. This implementation is only available
with the legacy provider.
=over 4
@@ -38,6 +39,7 @@ IETF RFC 1320.
=head1 SEE ALSO
L<evp(7)>,
L<provider(7)>,
L<EVP_DigestInit(3)>
=head1 COPYRIGHT
doc/man3/EVP_mdc2.pod
+3 -1
View File
@@ -14,7 +14,8 @@ EVP_mdc2
=head1 DESCRIPTION
MDC-2 (Modification Detection Code 2 or Meyer-Schilling) is a cryptographic
hash function based on a block cipher.
hash function based on a block cipher. This implementation is only available
with the legacy provider.
=over 4
@@ -38,6 +39,7 @@ ISO/IEC 10118-2:2000 Hash-Function 2, with DES as the underlying block cipher.
=head1 SEE ALSO
L<evp(7)>,
L<provider(7)>,
L<EVP_DigestInit(3)>
=head1 COPYRIGHT
doc/man3/EVP_ripemd160.pod
+2
View File
@@ -15,6 +15,7 @@ EVP_ripemd160
RIPEMD-160 is a cryptographic hash function first published in 1996 belonging
to the RIPEMD family (RACE Integrity Primitives Evaluation Message Digest).
This implementation is only available with the legacy provider.
=over 4
@@ -37,6 +38,7 @@ ISO/IEC 10118-3:2016 Dedicated Hash-Function 1 (RIPEMD-160).
=head1 SEE ALSO
L<evp(7)>,
L<provider(7)>,
L<EVP_DigestInit(3)>
=head1 COPYRIGHT
doc/man3/EVP_whirlpool.pod
+3 -1
View File
@@ -14,7 +14,8 @@ EVP_whirlpool
=head1 DESCRIPTION
WHIRLPOOL is a cryptographic hash function standardized in ISO/IEC 10118-3:2004
designed by Vincent Rijmen and Paulo S. L. M. Barreto.
designed by Vincent Rijmen and Paulo S. L. M. Barreto. This implementation is
only available with the legacy provider.
=over 4
@@ -39,6 +40,7 @@ ISO/IEC 10118-3:2004.
=head1 SEE ALSO
L<evp(7)>,
L<provider(7)>,
L<EVP_DigestInit(3)>
=head1 COPYRIGHT
doc/man3/HMAC.pod
+1 -1
View File
@@ -54,7 +54,7 @@ L<openssl_user_macros(7)>:
=head1 DESCRIPTION
All of the functions described on this page are deprecated. Applications should
instead use L<EVP_MAC_CTX_new(3)>, L<EVP_MAC_CTX_free(3)>, L<EVP_MAC_init(3)>,
instead use L<EVP_MAC_new_ctx(3)>, L<EVP_MAC_free_ctx(3)>, L<EVP_MAC_init(3)>,
L<EVP_MAC_update(3)> and L<EVP_MAC_final(3)>.
HMAC is a MAC (message authentication code), i.e. a keyed hash
doc/man3/ISSUER_SIGN_TOOL_new.pod
-51
View File
@@ -1,51 +0,0 @@
=pod
=head1 NAME
ISSUER_SIGN_TOOL_new, ISSUER_SIGN_TOOL_free,ISSUER_SIGN_TOOL_it,
d2i_ISSUER_SIGN_TOOL, i2d_ISSUER_SIGN_TOOL
=head1 SYNOPSIS
=for openssl generic
#include <openssl/x509v3.h>
extern const ISSUER_SIGN_TOOL_it;
ISSUER_SIGN_TOOL *ISSUER_SIGN_TOOL_new(void);
void ISSUER_SIGN_TOOL_free(ISSUER_SIGN_TOOL *v);
ISSUER_SIGN_TOOL *d2i_ISSUER_SIGN_TOOL(ISSUER_SIGN_TOOL **a, const unsigned char **pp, long length);
int i2d_ISSUER_SIGN_TOOL(const ISSUER_SIGN_TOOL *a, unsigned char **pp);
=head1 DESCRIPTION
The ISSUER_SIGN_TOOL_new() function returns a new ISSUER_SIGN_TOOL.
ISSUER_SIGN_TOOL_free() frees up a single ISSUER_SIGN_TOOL object.
=head1 RETURN VALUES
ISSUER_SIGN_TOOL_new() returns a newly created ISSUER_SIGN_TOOL or NULL if the call fails.
ISSUER_SIGN_TOOL_free() does not return values.
d2i_ISSUER_SIGN_TOOL() and i2d_ISSUER_SIGN_TOOL() decode and encode an B<ISSUER_SIGN_TOOL>
structure. They otherwise follow the conventions of other ASN.1 functions such as d2i_X509().
=head1 HISTORY
The ISSUER_SIGN_TOOL_up_ref(), ISSUER_SIGN_TOOL_lock() and ISSUER_SIGN_TOOL_unlock()
functions were added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/OCSP_sendreq_new.pod
+28 -21
View File
@@ -10,22 +10,22 @@ OCSP_REQ_CTX_set1_req, OCSP_sendreq_bio - OCSP responder query functions
#include <openssl/ocsp.h>
OCSP_REQ_CTX *OCSP_sendreq_new(BIO *io, const char *path,
OCSP_REQUEST *req, int maxline);
OCSP_REQ_CTX *OCSP_sendreq_new(BIO *io, const char *path, OCSP_REQUEST *req,
int maxline);
int OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OCSP_REQ_CTX *rctx);
void OCSP_REQ_CTX_free(OCSP_REQ_CTX *rctx);
void OCSP_set_max_response_length(OCSP_REQ_CTX *rctx,
unsigned long len);
void OCSP_set_max_response_length(OCSP_REQ_CTX *rctx, unsigned long len);
int OCSP_REQ_CTX_add1_header(OCSP_REQ_CTX *rctx,
const char *name, const char *value);
int OCSP_REQ_CTX_set1_req(OCSP_REQ_CTX *rctx, const OCSP_REQUEST *req);
int OCSP_REQ_CTX_set1_req(OCSP_REQ_CTX *rctx, OCSP_REQUEST *req);
OCSP_RESPONSE *OCSP_sendreq_bio(BIO *io, const char *path, OCSP_REQUEST *req);
OCSP_RESPONSE *OCSP_sendreq_bio(BIO *io, const char *path, OCSP_REQUEST *req,
int maxline);
=head1 DESCRIPTION
@@ -35,14 +35,14 @@ response header maximum line length of B<maxline>. If B<maxline> is zero a
default value of 4k is used. The OCSP request B<req> may be set to B<NULL>
and provided later if required.
OCSP_sendreq_nbio() performs I/O on the OCSP request context B<rctx>.
When the operation is complete it returns the response in B<*presp>.
OCSP_sendreq_nbio() performs non-blocking I/O on the OCSP request context
B<rctx>. When the operation is complete it returns the response in B<*presp>.
OCSP_REQ_CTX_free() frees up the OCSP context B<rctx>.
OCSP_set_max_response_length() sets the maximum response length
for B<rctx> to B<len>. If the response exceeds this length an error occurs.
If not set a default value of 100k is used.
OCSP_set_max_response_length() sets the maximum response length for B<rctx>
to B<len>. If the response exceeds this length an error occurs. If not
set a default value of 100k is used.
OCSP_REQ_CTX_add1_header() adds header B<name> with value B<value> to the
context B<rctx>. It can be called more than once to add multiple headers.
@@ -55,21 +55,23 @@ function should be called after any calls to OCSP_REQ_CTX_add1_header().
OCSP_sendreq_bio() performs an OCSP request using the responder B<io>, the URL
path B<path>, the OCSP request B<req> and with a response header maximum line
length 4k. It waits indefinitely on a response.
length of B<maxline>. If B<maxline> is zero a default value of 4k is used.
=head1 RETURN VALUES
OCSP_sendreq_new() returns a valid B<OCSP_REQ_CTX> structure or B<NULL>
if an error occurred.
OCSP_sendreq_new() returns a valid B<OCSP_REQ_CTX> structure or B<NULL> if
an error occurred.
OCSP_sendreq_nbio(), OCSP_REQ_CTX_add1_header() and OCSP_REQ_CTX_set1_req()
return B<1> for success and B<0> for failure.
OCSP_sendreq_nbio() returns B<1> if the operation was completed successfully,
B<-1> if the operation should be retried and B<0> if an error occurred.
OCSP_REQ_CTX_add1_header() and OCSP_REQ_CTX_set1_req() return B<1> for success
and B<0> for failure.
OCSP_sendreq_bio() returns the B<OCSP_RESPONSE> structure sent by the
responder or B<NULL> if an error occurred.
OCSP_REQ_CTX_free() and OCSP_set_max_response_length()
do not return values.
OCSP_REQ_CTX_free() and OCSP_set_max_response_length() do not return values.
=head1 NOTES
@@ -90,9 +92,14 @@ a Host header for B<ocsp.com> you would call:
OCSP_REQ_CTX_add1_header(ctx, "Host", "ocsp.com");
OCSP_sendreq_bio() does not support timeout nor setting extra headers.
It is retained for compatibility.
Better use B<OCSP_sendreq_nbio()> instead.
If OCSP_sendreq_nbio() indicates an operation should be retried the
corresponding BIO can be examined to determine which operation (read or
write) should be retried and appropriate action taken (for example a select()
call on the underlying socket).
OCSP_sendreq_bio() does not support retries and so cannot handle non-blocking
I/O efficiently. It is retained for compatibility and its use in new
applications is not recommended.
=head1 SEE ALSO
doc/man3/OSSL_CMP_CTX_new.pod
+67 -50
View File
@@ -11,10 +11,12 @@ OSSL_CMP_CTX_set_log_cb,
OSSL_CMP_CTX_set_log_verbosity,
OSSL_CMP_CTX_print_errors,
OSSL_CMP_CTX_set1_serverPath,
OSSL_CMP_CTX_set1_server,
OSSL_CMP_CTX_set1_serverName,
OSSL_CMP_CTX_set_serverPort,
OSSL_CMP_CTX_set1_proxy,
OSSL_CMP_CTX_set1_no_proxy,
OSSL_CMP_CTX_set1_proxyName,
OSSL_CMP_CTX_set_proxyPort,
OSSL_CMP_DEFAULT_PORT,
OSSL_CMP_http_cb_t,
OSSL_CMP_CTX_set_http_cb,
OSSL_CMP_CTX_set_http_cb_arg,
OSSL_CMP_CTX_get_http_cb_arg,
@@ -73,19 +75,22 @@ OSSL_CMP_CTX_set1_senderNonce
/* logging and error reporting: */
int OSSL_CMP_CTX_set_log_cb(OSSL_CMP_CTX *ctx, OSSL_CMP_log_cb_t cb);
#define OSSL_CMP_CTX_set_log_verbosity(ctx, level)
void OSSL_CMP_CTX_print_errors(OSSL_CMP_CTX *ctx);
void OSSL_CMP_CTX_print_errors(const OSSL_CMP_CTX *ctx);
/* message transfer: */
int OSSL_CMP_CTX_set1_serverPath(OSSL_CMP_CTX *ctx, const char *path);
int OSSL_CMP_CTX_set1_server(OSSL_CMP_CTX *ctx, const char *address);
int OSSL_CMP_CTX_set1_serverName(OSSL_CMP_CTX *ctx, const char *name);
int OSSL_CMP_CTX_set_serverPort(OSSL_CMP_CTX *ctx, int port);
int OSSL_CMP_CTX_set1_proxy(OSSL_CMP_CTX *ctx, const char *name);
int OSSL_CMP_CTX_set1_no_proxy(OSSL_CMP_CTX *ctx, const char *names);
int OSSL_CMP_CTX_set_http_cb(OSSL_CMP_CTX *ctx, HTTP_bio_cb_t cb);
int OSSL_CMP_CTX_set1_proxyName(OSSL_CMP_CTX *ctx, const char *name);
int OSSL_CMP_CTX_set_proxyPort(OSSL_CMP_CTX *ctx, int port);
#define OSSL_CMP_DEFAULT_PORT 80
typedef BIO *(*OSSL_CMP_http_cb_t)(OSSL_CMP_CTX *ctx, BIO *hbio,
unsigned long detail);
int OSSL_CMP_CTX_set_http_cb(OSSL_CMP_CTX *ctx, OSSL_CMP_http_cb_t cb);
int OSSL_CMP_CTX_set_http_cb_arg(OSSL_CMP_CTX *ctx, void *arg);
void *OSSL_CMP_CTX_get_http_cb_arg(const OSSL_CMP_CTX *ctx);
typedef OSSL_CMP_MSG *(*OSSL_CMP_transfer_cb_t)(OSSL_CMP_CTX *ctx,
const OSSL_CMP_MSG *req);
typedef OSSL_CMP_MSG *(*OSSL_CMP_transfer_cb_t) (OSSL_CMP_CTX *ctx,
const OSSL_CMP_MSG *req);
int OSSL_CMP_CTX_set_transfer_cb(OSSL_CMP_CTX *ctx,
OSSL_CMP_transfer_cb_t cb);
int OSSL_CMP_CTX_set_transfer_cb_arg(OSSL_CMP_CTX *ctx, void *arg);
@@ -306,7 +311,7 @@ B<ERR_print_errors(3)> to print to STDERR (unless OPENSSL_NO_STDIO is defined).
OSSL_CMP_CTX_set1_serverPath() sets the HTTP path of the CMP server on the host,
also known as "CMP alias".
The default is "/".
The default is I</>.
OSSL_CMP_CTX_set1_server() sets the given server B<address>
(which may be a hostname or IP address or NULL) in the given B<ctx>.
@@ -323,7 +328,7 @@ Otherwise defaults to the value of B<https_proxy> if set, else B<HTTPS_PROXY>.
An empty proxy string specifies not to use a proxy.
Else the format is I<[http[s]://]address[:port][/path]>,
where any path given is ignored.
The default port number is 80, or 443 in case "https:" is given.
The default port number is 80, or 443 in case I<https:> is given.
OSSL_CMP_CTX_set1_no_proxy() sets the list of server hostnames not to use
an HTTP proxy for. The names may be separated by commas and/or whitespace.
@@ -380,32 +385,40 @@ OSSL_CMP_CTX_get_transfer_cb_arg() gets the argument, respectively the pointer
to a structure containing arguments, previously set by
OSSL_CMP_CTX_set_transfer_cb_arg() or NULL if unset.
OSSL_CMP_CTX_set1_srvCert() pins the given server certificate B<srvCert>
directly trusts it (even if it is expired) for verifying response messages.
OSSL_CMP_CTX_set1_srvCert() sets the expected server cert B<srvCert> and trusts
it directly (even if it is expired) when verifying signed response messages.
May be used alternatively to OSSL_CMP_CTX_set0_trustedStore()
to pin the accepted server.
Any previously set value is freed.
The B<cert> argument may be NULL to clear the entry.
If set, the subject of the certificate is also used
as default value for the recipient of CMP requests
and as default value for the expected sender of CMP responses.
OSSL_CMP_CTX_set1_expected_sender() sets the Distinguished Name (DN) expected to
be given in the sender response for messages protected with MSG_SIG_ALG. This
may be used to enforce that during validation of received messages the given DN
matches the sender field of the PKIMessage header, which in turn is used to
identify the server certificate.
This can be used to ensure that only a particular entity is accepted to act as
CMP server, and attackers are not able to use arbitrary certificates of a
trusted PKI hierarchy to fraudulently pose as server.
This defaults to the subject of the B<srvCert>, if any.
OSSL_CMP_CTX_set1_expected_sender() sets the Distinguished Name (DN)
expected in the sender field of CMP response messages.
Defaults to the subject of the pinned server certificate B<-srvcert>, if any.
This can be used to make sure that only a particular entity is accepted as
CMP message signer, and attackers are not able to use arbitrary certificates
of a trusted PKI hierarchy to fraudulently pose as CMP server.
Note that this gives slightly more freedom than OSSL_CMP_CTX_set1_srvCert(),
which pins the server to the holder of a particular certificate, while the
expected sender name will continue to match after updates of the server cert.
OSSL_CMP_CTX_set0_trustedStore() sets the X509_STORE type certificate store
containing trusted (root) CA certificates. The certificate store may also hold
CRLs and a certificate verification callback function used for CMP server
authentication. Any already existing store entry is freed. When given a NULL
parameter the entry is cleared.
OSSL_CMP_CTX_set0_trustedStore() sets the certificate store of type X509_STORE
containing trusted (root) CA certificates.
The store may also hold CRLs and
a certificate verification callback function used for CMP server authentication.
Any store entry already set before is freed.
When given a NULL parameter the entry is cleared.
OSSL_CMP_CTX_get0_trustedStore() returns a pointer to the certificate store
containing trusted root CA certificates, which may be empty if unset.
OSSL_CMP_CTX_get0_trustedStore() returns a pointer to the currently set
certificate store containing trusted cert etc., or an empty store if unset.
OSSL_CMP_CTX_set1_untrusted_certs() sets up a list of non-trusted certificates
of intermediate CAs that may be useful for path construction when authenticating
the CMP server and when verifying newly enrolled certificates.
of intermediate CAs that may be useful for path construction for the CMP client
certificate, for the TLS client certificate (if any), when verifying
the CMP server certificate, and when verifying newly enrolled certificates.
The reference counts of those certificates handled successfully are increased.
OSSL_CMP_CTX_get0_untrusted_certs(OSSL_CMP_CTX *ctx) returns a pointer to the
@@ -416,13 +429,13 @@ The public key of this B<cert> must correspond to
the private key set via B<OSSL_CMP_CTX_set1_pkey()>.
When using signature-based protection of CMP request messages
this "protection certificate" will be included first in the extraCerts field.
The subject of this B<cert> will be used as the "sender" field
of outgoing CMP messages, with the fallback being
the B<subjectName> set via B<OSSL_CMP_CTX_set1_subjectName()>.
The subject of this B<cert> will be used as the sender field of outgoing
messages, while the subject of any cert set via B<OSSL_CMP_CTX_set1_oldCert()>
and any value set via B<OSSL_CMP_CTX_set1_subjectName()> are used as fallback.
The B<cert> argument may be NULL to clear the entry.
OSSL_CMP_CTX_set1_pkey() sets the private key corresponding to the
protecting certificate B<cert> set via B<OSSL_CMP_CTX_set1_cert()>.
protection certificate B<cert> set via B<OSSL_CMP_CTX_set1_cert()>.
This key is used create signature-based protection (protectionAlg = MSG_SIG_ALG)
of outgoing messages
unless a PBM secret has been set via B<OSSL_CMP_CTX_set1_secretValue()>.
@@ -437,22 +450,25 @@ PBM-based protection takes precedence over signature-based protection.
OSSL_CMP_CTX_set1_referenceValue() sets the given referenceValue B<ref> with
length B<len> in the given B<ctx> or clears it if the B<ref> argument is NULL.
According to RFC 4210 section 5.1.1, if no value for the "sender" field in
CMP message headers can be determined (i.e., no protecting certificate B<cert>
and no B<subjectName> is given) then the "sender" field will contain the NULL-DN
According to RFC 4210 section 5.1.1, if no value for the sender field in
CMP message headers can be determined (i.e., no protection certificate B<cert>
and no B<subjectName> is given) then the sender field will contain the NULL-DN
and the senderKID field of the CMP message header must be set.
When signature-based protection is used the senderKID will be set to
the subjectKeyIdentifier of the protecting B<cert> as far as present.
the subjectKeyIdentifier of the protection B<cert> as far as present.
If not present or when PBM-based protection is used
the B<ref> value is taken as the fallback value for the senderKID.
OSSL_CMP_CTX_set1_recipient() sets the recipient name that will be used in the
PKIHeader of a request message, i.e. the X509 name of the (CA) server.
Setting is overruled by subject of B<srvCert> if set.
If neither B<srvCert> nor recipient are set, the recipient of the PKI message is
determined in the following order: issuer, issuer of old cert (oldCert),
issuer of protecting certificate (B<cert>), else NULL-DN.
When a response is received, its sender must match the recipient of the request.
PKIHeader of CMP request messages, i.e. the X509 name of the (CA) server.
The recipient field in the header of a CMP message is mandatory.
If not given explicitly the recipient is determined in the following order:
the subject of the CMP server certificate set using OSSL_CMP_CTX_set1_srvCert(),
the value set using OSSL_CMP_CTX_set1_issuer(),
the issuer of the certificate set using OSSL_CMP_CTX_set1_oldCert(),
the issuer of the protection certificate (B<cert>),
as far as any of those is present, else the NULL-DN as last resort.
OSSL_CMP_CTX_push0_geninfo_ITAV() adds B<itav> to the stack in the B<ctx> to be
added to the GeneralInfo field of the CMP PKIMessage header of a request
@@ -480,8 +496,8 @@ the CertTemplate structure when requesting a new cert. For Key Update Requests
(KUR), it defaults to the subject DN of the B<reference certificate>,
see B<OSSL_CMP_CTX_set1_oldCert()>. This default is used for Initialization
Requests (IR) and Certification Requests (CR) only if no SANs are set.
The B<subjectName> is also used as the "sender" field for outgoing CMP messages
if no B<cert> has been set (e.g., in case requests are protected using PBM).
The B<subjectName> is also used as fallback for the sender field
of outgoing CMP messages if no B<cert> and no B<oldcert> are available.
OSSL_CMP_CTX_push1_subjectAltName() adds the given X509 name to the list of
alternate names on the certificate template request. This cannot be used if
@@ -507,10 +523,11 @@ to the X509_EXTENSIONS of the requested certificate template.
OSSL_CMP_CTX_set1_oldCert() sets the old certificate to be updated in
Key Update Requests (KUR) or to be revoked in Revocation Requests (RR).
It must be given for RR, else it defaults to the protecting B<cert>.
It must be given for RR, else it defaults to the protection B<cert>.
The B<reference certificate> determined in this way, if any, is also used for
deriving default subject DN and Subject Alternative Names for IR, CR, and KUR.
Its issuer, if any, is used as default recipient in the CMP message header.
Its subject is used as sender in CMP message headers if no protection cert is given.
Its issuer is used as default recipient in CMP message headers.
OSSL_CMP_CTX_set1_p10CSR() sets the PKCS#10 CSR to be used in P10CR.
doc/man3/OSSL_CMP_MSG_http_perform.pod
-60
View File
@@ -1,60 +0,0 @@
=pod
=head1 NAME
OSSL_CMP_MSG_http_perform
- client-side HTTP(S) transfer of a CMP request-response pair
=head1 SYNOPSIS
#include <openssl/cmp.h>
OSSL_CMP_MSG *OSSL_CMP_MSG_http_perform(OSSL_CMP_CTX *ctx,
const OSSL_CMP_MSG *req);
=head1 DESCRIPTION
OSSL_CMP_MSG_http_perform() sends the given PKIMessage B<req>
to the CMP server specified in B<ctx> via L<OSSL_CMP_CTX_set1_server(3)>
and optionally L<OSSL_CMP_CTX_set_serverPort(3)>, using
any "CMP alias" optionally specified via L<OSSL_CMP_CTX_set1_serverPath(3)>.
The default port is 80 for HTTP and 443 for HTTPS; the default path is "/".
On success the function returns the server's response PKIMessage.
The function makes use of any HTTP callback function
set via L<OSSL_CMP_CTX_set_http_cb(3)>.
It respects any timeout value set via L<OSSL_CMP_CTX_set_option(3)>
with an B<OSSL_CMP_OPT_MSG_TIMEOUT> argument.
It also respects any HTTP(S) proxy options set via L<OSSL_CMP_CTX_set1_proxy(3)>
and L<OSSL_CMP_CTX_set1_no_proxy(3)> and the respective environment variables.
Proxying plain HTTP is supported directly,
while using a proxy for HTTPS connections requires a suitable callback function
such as L<OSSL_HTTP_proxy_connect(3)>.
=head1 NOTES
CMP is defined in RFC 4210.
HTTP transfer for CMP is defined in RFC 6712.
=head1 RETURN VALUES
OSSL_CMP_MSG_http_perform() returns a CMP message on success, else NULL.
=head1 SEE ALSO
L<OSSL_CMP_CTX_new(3)>, L<OSSL_HTTP_proxy_connect(3)>.
=head1 HISTORY
The OpenSSL CMP support was added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/OSSL_CMP_SRV_CTX_new.pod
+9 -8
View File
@@ -85,32 +85,33 @@ OSSL_CMP_SRV_CTX_set_grant_implicit_confirm
=head1 DESCRIPTION
OSSL_CMP_SRV_process_request() implements the generic aspects of a CMP server.
It does the typical generic checks on the given request message, calls
Its arguments are the B<OSSL_CMP_SRV_CTX> I<srv_ctx> and the CMP request message
I<req>. It does the typical generic checks on I<req>, calls
the respective callback function (if present) for more specific processing,
and then assembles a result message, which may be a CMP error message.
OSSL_CMP_CTX_server_perform() is an interface to
B<OSSL_CMP_SRV_process_request()> that can be used by a CMP client
in the same way as B<OSSL_CMP_MSG_http_perform()>.
The B<OSSL_CMP_SRV_CTX> must be set as B<transfer_cb_arg> of B<client_ctx>.
The B<OSSL_CMP_SRV_CTX> must be set as I<transfer_cb_arg> of I<client_ctx>.
OSSL_CMP_SRV_CTX_new() creates and initializes an OSSL_CMP_SRV_CTX structure
and returns a pointer to it on success, NULL on error.
OSSL_CMP_SRV_CTX_free() deletes the given B<srv_ctx>.
OSSL_CMP_SRV_CTX_free() deletes the given I<srv_ctx>.
OSSL_CMP_SRV_CTX_init() sets in the given B<srv_ctx> a custom server context
OSSL_CMP_SRV_CTX_init() sets in the given I<srv_ctx> a custom server context
pointer as well as callback functions performing the specific processing of CMP
certificate requests, revocation requests, certificate confirmation requests,
general messages, error messages, and poll requests.
All arguments except B<srv_ctx> may be NULL.
All arguments except I<srv_ctx> may be NULL.
If a callback for some message type is not given this means that the respective
type of CMP message is not supported by the server.
OSSL_CMP_SRV_CTX_get0_cmp_ctx() returns the B<OSSL_CMP_CTX> from the B<srv_ctx>.
OSSL_CMP_SRV_CTX_get0_cmp_ctx() returns the B<OSSL_CMP_CTX> from the I<srv_ctx>.
OSSL_CMP_SRV_CTX_get0_custom_ctx() returns the custom server context from
B<srv_ctx> that has been set using B<OSSL_CMP_SRV_CTX_init>.
I<srv_ctx> that has been set using B<OSSL_CMP_SRV_CTX_init()>.
OSSL_CMP_SRV_CTX_set_send_unprotected_errors() enables sending error messages
and other forms of negative responses unprotected.
@@ -142,7 +143,7 @@ OSSL_CMP_SRV_CTX_get0_cmp_ctx() returns a B<OSSL_CMP_CTX> structure on success,
NULL on error.
OSSL_CMP_SRV_CTX_get0_custom_ctx() returns the custom server context
that has been set using B<OSSL_CMP_SRV_CTX_init>.
that has been set using B<OSSL_CMP_SRV_CTX_init()>.
All other functions return 1 on success, 0 on error.
doc/man3/OSSL_CMP_validate_msg.pod
-7
View File
@@ -46,13 +46,6 @@ according to TS 33.310 [Network Domain Security (NDS); Authentication Framework
Any cert that has been found as described above is cached and tried first when
validating the signatures of subsequent messages in the same transaction.
After successful validation of PBM-based protection of a certificate response
the certificates in the caPubs field (if any) are added to the trusted
certificates provided via L<OSSL_CMP_CTX_set0_trustedStore(3)>, such that
they are available for validating subsequent messages in the same context.
Those could apply to any Polling Response (pollRep), error, or PKI Confirmation
(PKIConf) messages following in the same or future transactions.
OSSL_CMP_validate_cert_path() attempts to validate the given certificate and its
path using the given store of trusted certs (possibly including CRLs and a cert
verification callback) and non-trusted intermediate certs from the B<ctx>.
doc/man3/OSSL_HTTP_transfer.pod
-233
View File
@@ -1,233 +0,0 @@
=pod
=head1 NAME
OSSL_HTTP_get,
OSSL_HTTP_get_asn1,
OSSL_HTTP_post_asn1,
OSSL_HTTP_transfer,
OSSL_HTTP_bio_cb_t,
OSSL_HTTP_proxy_connect,
OSSL_HTTP_parse_url
- http client functions
=head1 SYNOPSIS
#include <openssl/http.h>
typedef BIO *(*OSSL_HTTP_bio_cb_t)(BIO *bio, void *arg,
int connect, int detail);
BIO *OSSL_HTTP_get(const char *url, const char *proxy, const char *no_proxy,
BIO *bio, BIO *rbio,
OSSL_HTTP_bio_cb_t bio_update_fn, void *arg,
const STACK_OF(CONF_VALUE) *headers,
int maxline, unsigned long max_resp_len, int timeout,
const char *expected_content_type, int expect_asn1);
ASN1_VALUE *OSSL_HTTP_get_asn1(const char *url,
const char *proxy, const char *no_proxy,
BIO *bio, BIO *rbio,
OSSL_HTTP_bio_cb_t bio_update_fn, void *arg,
const STACK_OF(CONF_VALUE) *headers,
int maxline, unsigned long max_resp_len,
int timeout, const char *expected_content_type,
const ASN1_ITEM *it);
ASN1_VALUE *OSSL_HTTP_post_asn1(const char *server, const char *port,
const char *path, int use_ssl,
const char *proxy, const char *no_proxy,
BIO *bio, BIO *rbio,
OSSL_HTTP_bio_cb_t bio_update_fn, void *arg,
const STACK_OF(CONF_VALUE) *headers,
const char *content_type,
const ASN1_VALUE *req, const ASN1_ITEM *req_it,
int maxline, unsigned long max_resp_len,
int timeout, const char *expected_ct,
const ASN1_ITEM *rsp_it);
BIO *OSSL_HTTP_transfer(const char *server, const char *port, const char *path,
int use_ssl, const char *proxy, const char *no_proxy,
BIO *bio, BIO *rbio,
OSSL_HTTP_bio_cb_t bio_update_fn, void *arg,
const STACK_OF(CONF_VALUE) *headers,
const char *content_type, BIO *req_mem,
int maxline, unsigned long max_resp_len, int timeout,
const char *expected_ct, int expect_asn1,
char **redirection_url);
int OSSL_HTTP_proxy_connect(BIO *bio, const char *server, const char *port,
const char *proxyuser, const char *proxypass,
int timeout, BIO *bio_err, const char *prog);
int OSSL_HTTP_parse_url(const char *url, char **phost, char **pport,
char **ppath, int *pssl);
=head1 DESCRIPTION
OSSL_HTTP_get() uses HTTP GET to obtain data (of any type) from the given B<url>
and returns it as a memory BIO.
OSSL_HTTP_get_asn1() uses HTTP GET to obtain an ASN.1-encoded value
(e.g., an X.509 certificate) with the expected structure specified by B<it>
(e.g., I<ASN1_ITEM_rptr(X509)>) from the given B<url>
and returns it on success as a pointer to I<ASN1_VALUE>.
OSSL_HTTP_post_asn1() uses the HTTP POST method to send a request B<req>
with the ASN.1 structure defined in B<req_it> and the given B<content_type> to
the given B<server> and optional B<port> and B<path>.
If B<use_ssl> is nonzero a TLS connection is requested and the B<bio_update_fn>
parameter, described below, must be provided.
The optional list B<headers> may contain additional custom HTTP header lines.
The expected structure of the response is specified by B<rsp_it>.
On success it returns the response as a pointer to B<ASN1_VALUE>.
OSSL_HTTP_transfer() exchanges any form of HTTP request and response.
It implements the core of the functions described above.
If B<path> parameter is NULL it defaults to "/".
If B<use_ssl> is nonzero a TLS connection is requested
and the B<bio_update_fn> parameter, described below, must be provided.
If B<req_mem> is NULL it uses the HTTP GET method, else it uses HTTP POST to
send a request with the contents of the memory BIO and optional B<content_type>.
The optional list B<headers> may contain additional custom HTTP header lines.
If B<req_mem> is NULL (i.e., the HTTP method is GET) and B<redirection_url>
is not NULL the latter pointer is used to provide any new location that
the server may return with HTTP code 301 (MOVED_PERMANENTLY) or 302 (FOUND).
In this case the caller is responsible for deallocating this URL with
L<OPENSSL_free(3)>.
The above functions have the following parameters in common.
Typically the OpenSSL build supports sockets
and the B<bio> and B<rbio> parameters are both NULL.
In this case the client creates a network BIO internally
for connecting to the given B<server>
at the specified B<port> (if any, defaulting to 80 for HTTP or 443 for HTTPS),
optionally via a B<proxy> (respecting B<no_proxy>) as described below.
Then the client uses this internal BIO for exchanging the request and response.
If B<bio> is given and B<rbio> is NULL then the client uses this B<bio> instead.
If both B<bio> and B<rbio> are given (which may be memory BIOs for instance)
then no explicit connection is attempted,
B<bio> is used for writing the request, and B<rbio> for reading the response.
As soon as the client has flushed B<bio> the server must be ready to provide
a response or indicate a waiting condition via B<rbio>.
The optional B<proxy> parameter can be used to set the address of the an
HTTP(S) proxy to use (unless overridden by "no_proxy" settings).
If TLS is not used this defaults to the environment variable B<http_proxy>
if set, else B<HTTP_PROXY>.
If B<use_ssl> != 0 it defaults to B<https_proxy> if set, else B<HTTPS_PROXY>.
An empty proxy string specifies not to use a proxy.
Else the format is I<[http[s]://]address[:port][/path]>,
where any path given is ignored.
The default proxy port number is 80, or 443 in case "https:" is given.
The HTTP client functions connect via the given proxy unless the B<server>
is found in the optional list B<no_proxy> of proxy hostnames (if not NULL;
default is the environment variable B<no_proxy> if set, else B<NO_PROXY>).
Proxying plain HTTP is supported directly,
while using a proxy for HTTPS connections requires a suitable callback function
such as B<OSSL_HTTP_proxy_connect()>, described below.
The B<maxline> parameter specifies the response header maximum line length,
where 0 indicates the default value, which currently is 4k.
The B<max_resp_len> parameter specifies the maximum response length,
where 0 indicates the default value, which currently is 100k.
An ASN.1-encoded response is expected by OSSL_HTTP_get_asn1() and
OSSL_HTTP_post_asn1(), while for OSSL_HTTP_get() or OSSL_HTTP_transfer()
this is only the case if the B<expect_asn1> parameter is nonzero.
If the response header contains one or more "Content-Length" header lines and/or
an ASN.1-encoded response is expected, which should include a total length,
the length indications received are checked for consistency
and for not exceeding the maximum response length.
If the parameter B<expected_content_type> (or B<expected_ct>, respectively)
is not NULL then the HTTP client checks that the given content type string
is included in the HTTP header of the response and returns an error if not.
If the B<timeout> parameter is > 0 this indicates the maximum number of seconds
to wait until the transfer is complete.
A value of 0 enables waiting indefinitely,
while a value < 0 immediately leads to a timeout condition.
The optional parameter B<bio_update_fn> with its optional argument B<arg> may
be used to modify the connection BIO used by the HTTP client (and cannot be
used when both B<bio> and B<rbio> are given).
B<bio_update_fn> is a BIO connect/disconnect callback function with prototype
BIO *(*OSSL_HTTP_bio_cb_t)(BIO *bio, void *arg, int connect, int detail)
The callback may modify the HTTP BIO provided in the B<bio> argument,
whereby it may make use of a custom defined argument B<arg>,
which may for instance refer to an I<SSL_CTX> structure.
During connection establishment, just after calling BIO_connect_retry(),
the function is invoked with the B<connect> argument being 1 and the B<detail>
argument being 1 if HTTPS is requested, i.e., SSL/TLS should be enabled.
On disconnect B<connect> is 0 and B<detail> is 1 if no error occurred, else 0.
For instance, on connect the function may prepend a TLS BIO to implement HTTPS;
after disconnect it may do some diagnostic output and/or specific cleanup.
The function should return NULL to indicate failure.
Here is a simple example that supports TLS connections (but not via a proxy):
BIO *http_tls_cb(BIO *hbio, void *arg, int connect, int detail)
{
SSL_CTX *ctx = (SSL_CTX *)arg;
if (connect && detail) { /* connecting with TLS */
BIO *sbio = BIO_new_ssl(ctx, 1);
hbio = sbio != NULL ? BIO_push(sbio, hbio) : NULL;
} else if (!connect && !detail) { /* disconnecting after error */
/* optionally add diagnostics here */
}
return hbio;
}
After disconnect the modified BIO will be deallocated using BIO_free_all().
OSSL_HTTP_proxy_connect() may be used by an above BIO connect callback function
to set up an SSL/TLS connection via an HTTPS proxy.
It promotes the given BIO B<bio> representing a connection
pre-established with a TLS proxy using the HTTP CONNECT method,
optionally using proxy client credentials B<proxyuser> and B<proxypass>,
to connect with TLS protection ultimately to B<server> and B<port>.
If the B<port> argument is NULL or the empty string it defaults to "443".
The B<timeout> parameter is used as described above.
Since this function is typically called by appplications such as
L<openssl-s_client(1)> it uses the B<bio_err> and B<prog> parameters (unless
NULL) to print additional diagnostic information in a user-oriented way.
OSSL_HTTP_parse_url() parses its input string B<url> as a URL and splits it up
into host, port and path components and a flag whether it begins with 'https'.
The host component may be a DNS name or an IPv4 or an IPv6 address.
The port component is optional and defaults to "443" for HTTPS, else "80".
The path component is also optional and defaults to "/".
As far as the result pointer arguments are not NULL it assigns via
them copies of the respective string components.
The strings returned this way must be deallocated by the caller using
L<OPENSSL_free(3)> unless they are NULL, which is their default value on error.
=head1 NOTES
The names of the environment variables used by this implementation:
B<http_proxy>, B<HTTP_PROXY>, B<https_proxy>, B<HTTPS_PROXY>, B<no_proxy>, and
B<NO_PROXY>, have been chosen for maximal compatibility with
other HTTP client implementations such as wget, curl, and git.
=head1 RETURN VALUES
OSSL_HTTP_get(), OSSL_HTTP_get_asn1(), OSSL_HTTP_post_asn1(), and
OSSL_HTTP_transfer() return on success the data received via HTTP, else NULL.
Error conditions include connection/transfer timeout, parse errors, etc.
OSSL_HTTP_proxy_connect() and OSSL_HTTP_parse_url()
return 1 on success, 0 on error.
=head1 HISTORY
OSSL_HTTP_get(), OSSL_HTTP_get_asn1(), OSSL_HTTP_post_asn1(),
OSSL_HTTP_proxy_connect(), and OSSL_HTTP_parse_url() were added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/OSSL_PARAM_allocate_from_text.pod
+1 -1
View File
@@ -175,7 +175,7 @@ Can be written like this instead:
goto err;
}
params[params_n] = OSSL_PARAM_construct_end();
if (!EVP_MAC_CTX_set_params(ctx, params))
if (!EVP_MAC_set_ctx_params(ctx, params))
goto err;
while (params_n-- > 0)
OPENSSL_free(params[params_n].data);
doc/man3/OSSL_PROVIDER.pod
+31 -1
View File
@@ -4,8 +4,9 @@
OSSL_PROVIDER_set_default_search_path,
OSSL_PROVIDER, OSSL_PROVIDER_load, OSSL_PROVIDER_unload,
OSSL_PROVIDER_available,
OSSL_PROVIDER_available, OSSL_PROVIDER_do_all,
OSSL_PROVIDER_gettable_params, OSSL_PROVIDER_get_params,
OSSL_PROVIDER_query_operation, OSSL_PROVIDER_get0_provider_ctx,
OSSL_PROVIDER_add_builtin, OSSL_PROVIDER_name - provider routines
=head1 SYNOPSIS
@@ -20,10 +21,18 @@ OSSL_PROVIDER_add_builtin, OSSL_PROVIDER_name - provider routines
OSSL_PROVIDER *OSSL_PROVIDER_load(OPENSSL_CTX *libctx, const char *name);
int OSSL_PROVIDER_unload(OSSL_PROVIDER *prov);
int OSSL_PROVIDER_available(OPENSSL_CTX *libctx, const char *name);
int OSSL_PROVIDER_do_all(OPENSSL_CTX *ctx,
int (*cb)(OSSL_PROVIDER *provider, void *cbdata),
void *cbdata);
const OSSL_PARAM *OSSL_PROVIDER_gettable_params(OSSL_PROVIDER *prov);
int OSSL_PROVIDER_get_params(OSSL_PROVIDER *prov, OSSL_PARAM params[]);
const OSSL_ALGORITHM *OSSL_PROVIDER_query_operation(const OSSL_PROVIDER *prov,
int operation_id,
int *no_cache);
void *OSSL_PROVIDER_get0_provider_ctx(const OSSL_PROVIDER *prov);
int OSSL_PROVIDER_add_builtin(OPENSSL_CTX *libctx, const char *name,
ossl_provider_init_fn *init_fn);
@@ -66,6 +75,10 @@ runs its teardown function.
OSSL_PROVIDER_available() checks if a named provider is available
for use.
OSSL_PROVIDER_do_all() iterates over all loaded providers, calling
I<cb> for each one, with the current provider in I<provider> and the
I<cbdata> that comes from the caller.
OSSL_PROVIDER_gettable_params() is used to get a provider parameter
descriptor set as a constant B<OSSL_PARAM> array.
See L<OSSL_PARAM(3)> for more information.
@@ -75,6 +88,20 @@ The caller must prepare the B<OSSL_PARAM> array before calling this
function, and the variables acting as buffers for this parameter array
should be filled with data when it returns successfully.
OSSL_PROVIDER_query_operation() calls the provider's I<query_operation>
function (see L<provider(7)>), if the provider has one. It returns an
array of I<OSSL_ALGORITHM> for the given I<operation_id> terminated by an all
NULL OSSL_ALGORITHM entry. This is considered a low-level function that most
applications should not need to call.
OSSL_PROVIDER_get0_provider_ctx() returns the provider context for the given
provider. The provider context is an opaque handle set by the provider itself
and is passed back to the provider by libcrypto in various function calls.
If it is permissible to cache references to this array then I<*no_store> is set
to 0 or 1 otherwise. If the array is not cacheable then it is assumed to
have a short lifetime.
OSSL_PROVIDER_name() returns the name of the given provider.
=head1 RETURN VALUES
@@ -94,6 +121,9 @@ of constant B<OSSL_PARAM>, or NULL if none is provided.
OSSL_PROVIDER_get_params() returns 1 on success, or 0 on error.
OSSL_PROVIDER_query_operation() returns an array of OSSL_ALGORITHM or NULL on
error.
=head1 EXAMPLES
This demonstrates how to load the provider module "foo" and ask for
doc/man3/OSSL_STORE_INFO.pod
+12 -17
View File
@@ -54,25 +54,24 @@ loaders to create B<OSSL_STORE_INFO> holders.
=head2 Types
B<OSSL_STORE_INFO> is an opaque type that's just an intermediary holder for
the objects that have been retrieved by OSSL_STORE_load() and similar
functions.
the objects that have been retrieved by OSSL_STORE_load() and similar functions.
Supported OpenSSL type object can be extracted using one of
STORE_INFO_get0_TYPE().
STORE_INFO_get0_<TYPE>() where <TYPE> can be NAME, PARAMS, PKEY, CERT, or CRL.
The life time of this extracted object is as long as the life time of
the B<OSSL_STORE_INFO> it was extracted from, so care should be taken not
to free the latter too early.
As an alternative, STORE_INFO_get1_TYPE() extracts a duplicate (or the
As an alternative, STORE_INFO_get1_<TYPE>() extracts a duplicate (or the
same object with its reference count increased), which can be used
after the containing B<OSSL_STORE_INFO> has been freed.
The object returned by STORE_INFO_get1_TYPE() must be freed separately
The object returned by STORE_INFO_get1_<TYPE>() must be freed separately
by the caller.
See L</SUPPORTED OBJECTS> for more information on the types that are
supported.
See L</SUPPORTED OBJECTS> for more information on the types that are supported.
=head2 Functions
OSSL_STORE_INFO_get_type() takes a B<OSSL_STORE_INFO> and returns the STORE
type number for the object inside.
STORE_INFO_get_type_string() takes a STORE type number and returns a
short string describing it.
@@ -94,6 +93,8 @@ OSSL_STORE_INFO_new_NAME() , OSSL_STORE_INFO_new_PARAMS(),
OSSL_STORE_INFO_new_PKEY(), OSSL_STORE_INFO_new_CERT() and
OSSL_STORE_INFO_new_CRL() create a B<OSSL_STORE_INFO>
object to hold the given input object.
On success the input object is consumed.
Additionally, for B<OSSL_STORE_INFO_NAME>` objects,
OSSL_STORE_INFO_set0_NAME_description() can be used to add an extra
description.
@@ -162,9 +163,9 @@ OSSL_STORE_INFO_get0_PARAMS(), OSSL_STORE_INFO_get0_PKEY(),
OSSL_STORE_INFO_get0_CERT() and OSSL_STORE_INFO_get0_CRL() all return
a pointer to the OpenSSL object on success, NULL otherwise.
OSSL_STORE_INFO_get0_NAME(), OSSL_STORE_INFO_get0_NAME_description(),
OSSL_STORE_INFO_get0_PARAMS(), OSSL_STORE_INFO_get0_PKEY(),
OSSL_STORE_INFO_get0_CERT() and OSSL_STORE_INFO_get0_CRL() all return
OSSL_STORE_INFO_get1_NAME(), OSSL_STORE_INFO_get1_NAME_description(),
OSSL_STORE_INFO_get1_PARAMS(), OSSL_STORE_INFO_get1_PKEY(),
OSSL_STORE_INFO_get1_CERT() and OSSL_STORE_INFO_get1_CRL() all return
a pointer to a duplicate of the OpenSSL object on success, NULL otherwise.
OSSL_STORE_INFO_type_string() returns a string on success, or B<NULL> on
@@ -184,13 +185,7 @@ L<ossl_store(7)>, L<OSSL_STORE_open(3)>, L<OSSL_STORE_register_loader(3)>
=head1 HISTORY
OSSL_STORE_INFO(), OSSL_STORE_INFO_get_type(), OSSL_STORE_INFO_get0_NAME(),
OSSL_STORE_INFO_get0_PARAMS(), OSSL_STORE_INFO_get0_PKEY(),
OSSL_STORE_INFO_get0_CERT(), OSSL_STORE_INFO_get0_CRL(),
OSSL_STORE_INFO_type_string(), OSSL_STORE_INFO_free(), OSSL_STORE_INFO_new_NAME(),
OSSL_STORE_INFO_new_PARAMS(), OSSL_STORE_INFO_new_PKEY(),
OSSL_STORE_INFO_new_CERT() and OSSL_STORE_INFO_new_CRL()
were added in OpenSSL 1.1.1.
The OSSL_STORE API was added in OpenSSL 1.1.1.
=head1 COPYRIGHT
doc/man3/OSSL_STORE_open.pod
+18 -13
View File
@@ -46,21 +46,22 @@ OSSL_STORE_close() to work together.
=head2 Functions
OSSL_STORE_open() takes a uri or path B<uri>, password UI method
B<ui_method> with associated data B<ui_data>, and post processing
callback B<post_process> with associated data B<post_process_data>,
OSSL_STORE_open() takes a uri or path I<uri>, password UI method
I<ui_method> with associated data I<ui_data>, and post processing
callback I<post_process> with associated data I<post_process_data>,
opens a channel to the data located at that URI and returns a
B<OSSL_STORE_CTX> with all necessary internal information.
The given B<ui_method> and B<ui_data_data> will be reused by all
functions that use B<OSSL_STORE_CTX> when interaction is needed.
The given B<post_process> and B<post_process_data> will be reused by
The given I<ui_method> and I<ui_data> will be reused by all
functions that use B<OSSL_STORE_CTX> when interaction is needed,
for instance to provide a password.
The given I<post_process> and I<post_process_data> will be reused by
OSSL_STORE_load() to manipulate or drop the value to be returned.
The B<post_process> function drops values by returning B<NULL>, which
The I<post_process> function drops values by returning NULL, which
will cause OSSL_STORE_load() to start its process over with loading
the next object, until B<post_process> returns something other than
B<NULL>, or the end of data is reached as indicated by OSSL_STORE_eof().
the next object, until I<post_process> returns something other than
NULL, or the end of data is reached as indicated by OSSL_STORE_eof().
OSSL_STORE_ctrl() takes a B<OSSL_STORE_CTX>, and command number B<cmd> and
OSSL_STORE_ctrl() takes a B<OSSL_STORE_CTX>, and command number I<cmd> and
more arguments not specified here.
The available loader specific command numbers and arguments they each
take depends on the loader that's used and is documented together with
@@ -94,6 +95,7 @@ OSSL_STORE_eof() shows that the end of data has been reached.
OSSL_STORE_close() takes a B<OSSL_STORE_CTX>, closes the channel that was opened
by OSSL_STORE_open() and frees all other information that was stored in the
B<OSSL_STORE_CTX>, as well as the B<OSSL_STORE_CTX> itself.
If I<ctx> is NULL it does nothing.
=head1 SUPPORTED SCHEMES
@@ -123,12 +125,12 @@ See L<passphrase-encoding(7)> for further information.
=head1 RETURN VALUES
OSSL_STORE_open() returns a pointer to a B<OSSL_STORE_CTX> on success, or
B<NULL> on failure.
NULL on failure.
OSSL_STORE_load() returns a pointer to a B<OSSL_STORE_INFO> on success, or
B<NULL> on error or when end of data is reached.
NULL on error or when end of data is reached.
Use OSSL_STORE_error() and OSSL_STORE_eof() to determine the meaning of a
returned B<NULL>.
returned NULL.
OSSL_STORE_eof() returns 1 if the end of data has been reached, otherwise
0.
@@ -149,6 +151,9 @@ OSSL_STORE_CTX(), OSSL_STORE_post_process_info_fn(), OSSL_STORE_open(),
OSSL_STORE_ctrl(), OSSL_STORE_load(), OSSL_STORE_eof() and OSSL_STORE_close()
were added in OpenSSL 1.1.1.
Handling of NULL I<ctx> argument for OSSL_STORE_close()
was introduced in OpenSSL 1.1.1h.
=head1 COPYRIGHT
Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
doc/man3/OSSL_trace_set_channel.pod
+2 -2
View File
@@ -178,9 +178,9 @@ point during evaluation.
Traces BIGNUM context operations.
=item C<OSSL_TRACE_CATEGORY_PROVIDER_CONF>
=item C<OSSL_TRACE_CATEGORY_CONF>
Traces the OSSL_PROVIDER configuration.
Traces details about the provider and engine configuration.
=back
doc/man3/SSL_CIPHER_get_name.pod
+13
View File
@@ -13,6 +13,7 @@ SSL_CIPHER_get_digest_nid,
SSL_CIPHER_get_handshake_digest,
SSL_CIPHER_get_kx_nid,
SSL_CIPHER_get_auth_nid,
SSL_CIPHER_get_prf_nid,
SSL_CIPHER_is_aead,
SSL_CIPHER_find,
SSL_CIPHER_get_id,
@@ -34,6 +35,7 @@ SSL_CIPHER_get_protocol_id
const EVP_MD *SSL_CIPHER_get_handshake_digest(const SSL_CIPHER *c);
int SSL_CIPHER_get_kx_nid(const SSL_CIPHER *c);
int SSL_CIPHER_get_auth_nid(const SSL_CIPHER *c);
int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
int SSL_CIPHER_is_aead(const SSL_CIPHER *c);
const SSL_CIPHER *SSL_CIPHER_find(SSL *ssl, const unsigned char *ptr);
uint32_t SSL_CIPHER_get_id(const SSL_CIPHER *c);
@@ -91,6 +93,15 @@ TLS 1.3 cipher suites) B<NID_auth_any> is returned. Examples (not comprehensive)
NID_auth_ecdsa
NID_auth_psk
SSL_CIPHER_get_prf_nid() retuns the pseudo-random function NID for B<c>. If B<c> is
a pre-TLS-1.2 cipher, it returns B<NID_md5_sha1> but note these ciphers use
SHA-256 in TLS 1.2. Other return values may be treated uniformly in all
applicable versions. Examples (not comprehensive):
NID_md5_sha1
NID_sha256
NID_sha384
SSL_CIPHER_is_aead() returns 1 if the cipher B<c> is AEAD (e.g. GCM or
ChaCha20/Poly1305), and 0 if it is not AEAD.
@@ -201,6 +212,8 @@ required to enable this function.
The OPENSSL_cipher_name() function was added in OpenSSL 1.1.1.
The SSL_CIPHER_get_prf_nid() function was added in OpenSSL 3.0.0.
=head1 COPYRIGHT
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
doc/man3/SSL_CTX_load_verify_locations.pod
+6 -10
View File
@@ -22,20 +22,16 @@ SSL_CTX_set_default_verify_store, SSL_CTX_load_verify_locations
int SSL_CTX_set_default_verify_file(SSL_CTX *ctx);
int SSL_CTX_set_default_verify_store(SSL_CTX *ctx);
Deprecated since OpenSSL 3.0, can be hidden entirely by defining
B<OPENSSL_API_COMPAT> with a suitable version value, see
L<openssl_user_macros(7)>:
int SSL_CTX_load_verify_locations(SSL_CTX *ctx, const char *CAfile,
const char *CApath);
=head1 DESCRIPTION
SSL_CTX_load_verify_dir(), SSL_CTX_load_verify_file(),
SSL_CTX_load_verify_store() specifies the locations for B<ctx>, at
which CA certificates for verification purposes are located. The
certificates available via B<CAfile>, B<CApath> and B<CAstore> are
trusted.
SSL_CTX_load_verify_locations(), SSL_CTX_load_verify_dir(),
SSL_CTX_load_verify_file(), SSL_CTX_load_verify_store() specifies the
locations for B<ctx>, at which CA certificates for verification purposes
are located. The certificates available via B<CAfile>, B<CApath> and
B<CAstore> are trusted.
SSL_CTX_set_default_verify_paths() specifies that the default locations from
which CA certificates are loaded should be used. There is one default directory,
@@ -176,7 +172,7 @@ L<SSL_CTX_set_client_CA_list(3)>
=head1 COPYRIGHT
Copyright 2000-2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/SSL_CTX_set_options.pod
+17 -2
View File
@@ -217,6 +217,20 @@ not propose, and servers will not accept the extension.
Disable all renegotiation in TLSv1.2 and earlier. Do not send HelloRequest
messages, and ignore renegotiation requests via ClientHello.
=item SSL_OP_IGNORE_UNEXPECTED_EOF
Some TLS implementations do not send the mandatory close_notify alert on
shutdown. If the application tries to wait for the close_notify alert but the
peer closes the connection without sending it, an error is generated. When this
option is enabled the peer does not need to send the close_notify alert and a
closed connection will be treated as if the close_notify alert was received.
You should only enable this option if the protocol running over TLS
can detect a truncation attack itself, and that the application is checking for
that truncation attack.
For more information on shutting down a connection, see L<SSL_shutdown(3)>.
=item SSL_OP_ALLOW_NO_DHE_KEX
In TLSv1.3 allow a non-(ec)dhe based key exchange mode on resumption. This means
@@ -367,7 +381,7 @@ secure renegotiation and 0 if it does not.
=head1 SEE ALSO
L<ssl(7)>, L<SSL_new(3)>, L<SSL_clear(3)>,
L<ssl(7)>, L<SSL_new(3)>, L<SSL_clear(3)>, L<SSL_shutdown(3)>
L<SSL_CTX_set_tmp_dh_callback(3)>,
L<SSL_CTX_set_min_proto_version(3)>,
L<openssl-dhparam(1)>
@@ -380,7 +394,8 @@ OpenSSL 0.9.8m.
The B<SSL_OP_PRIORITIZE_CHACHA> and B<SSL_OP_NO_RENEGOTIATION> options
were added in OpenSSL 1.1.1.
The B<SSL_OP_NO_EXTENDED_MASTER_SECRET> option was added in OpenSSL 3.0.
The B<SSL_OP_NO_EXTENDED_MASTER_SECRET> and B<SSL_OP_IGNORE_UNEXPECTED_EOF>
options were added in OpenSSL 3.0.
=head1 COPYRIGHT
doc/man3/SSL_CTX_set_psk_client_callback.pod
+4 -2
View File
@@ -123,7 +123,9 @@ and it will use that in preference. If no such callback is present then it will
check to see if a callback has been set via SSL_CTX_set_psk_client_callback() or
SSL_set_psk_client_callback() and use that. In this case the B<hint> value will
always be NULL and the handshake digest will default to SHA-256 for any returned
PSK.
PSK. TLSv1.3 early data exchanges are possible in PSK connections only with the
B<SSL_psk_use_session_cb_func> callback, and are not possible with the
B<SSL_psk_client_cb_func> callback.
=head1 NOTES
@@ -167,7 +169,7 @@ were added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/SSL_CTX_set_quic_method.pod
+232
View File
@@ -0,0 +1,232 @@
=pod
=head1 NAME
SSL_QUIC_METHOD,
OSSL_ENCRYPTION_LEVEL,
SSL_CTX_set_quic_method,
SSL_set_quic_method,
SSL_set_quic_transport_params,
SSL_get_peer_quic_transport_params,
SSL_quic_max_handshake_flight_len,
SSL_quic_read_level,
SSL_quic_write_level,
SSL_provide_quic_data,
SSL_process_quic_post_handshake,
SSL_is_quic
- QUIC support
=head1 SYNOPSIS
#include <openssl/ssl.h>
typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
typedef enum ssl_encryption_level_t OSSL_ENCRYPTION_LEVEL;
int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
int SSL_set_quic_transport_params(SSL *ssl,
const uint8_t *params,
size_t params_len);
void SSL_get_peer_quic_transport_params(const SSL *ssl,
const uint8_t **out_params,
size_t *out_params_len);
size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
const uint8_t *data, size_t len);
int SSL_process_quic_post_handshake(SSL *ssl);
int SSL_is_quic(SSL *ssl);
=head1 DESCRIPTION
SSL_CTX_set_quic_method() and SSL_set_quic_method() configures the QUIC methods.
This should only be configured with a minimum version of TLS 1.3. B<quic_method>
must remain valid for the lifetime of B<ctx> or B<ssl>. Calling this disables
the SSL_OP_ENABLE_MIDDLEBOX_COMPAT option, which is not required for QUIC.
SSL_set_quic_transport_params() configures B<ssl> to send B<params> (of length
B<params_len>) in the quic_transport_parameters extension in either the
ClientHello or EncryptedExtensions handshake message. This extension will
only be sent if the TLS version is at least 1.3, and for a server, only if
the client sent the extension. The buffer pointed to by B<params> only need be
valid for the duration of the call to this function.
SSL_get_peer_quic_transport_params() provides the caller with the value of the
quic_transport_parameters extension sent by the peer. A pointer to the buffer
containing the TransportParameters will be put in B<*out_params>, and its
length in B<*out_params_len>. This buffer will be valid for the lifetime of the
B<ssl>. If no params were received from the peer, B<*out_params_len> will be 0.
SSL_quic_max_handshake_flight_len() returns the maximum number of bytes
that may be received at the given encryption level. This function should be
used to limit buffering in the QUIC implementation.
See https://tools.ietf.org/html/draft-ietf-quic-transport-16#section-4.4.
SSL_quic_read_level() returns the current read encryption level.
SSL_quic_write_level() returns the current write encryption level.
SSL_provide_quic_data() provides data from QUIC at a particular encryption
level B<level>. It is an error to call this function outside of the handshake
or with an encryption level other than the current read level. It returns one
on success and zero on error.
SSL_process_quic_post_handshake() processes any data that QUIC has provided
after the handshake has completed. This includes NewSessionTicket messages
sent by the server.
SSL_is_quic() indicates whether a connection uses QUIC.
=head1 NOTES
These APIs are implementations of BoringSSL's QUIC APIs.
QUIC acts as an underlying transport for the TLS 1.3 handshake. The following
functions allow a QUIC implementation to serve as the underlying transport as
described in draft-ietf-quic-tls.
When configured for QUIC, SSL_do_handshake() will drive the handshake as
before, but it will not use the configured B<BIO>. It will call functions on
B<SSL_QUIC_METHOD> to configure secrets and send data. If data is needed from
the peer, it will return B<SSL_ERROR_WANT_READ>. When received, the caller
should call SSL_provide_quic_data() and then SSL_do_handshake() to continue
the handshake. After the handshake is complete, the caller should call
SSL_provide_quic_data() for any post-handshake data, followed by
SSL_process_quic_post_handshake() to process it. It is an error to call
SSL_read()/SSL_read_ex() and SSL_write()/SSL_write_ex() in QUIC.
Note that secrets for an encryption level may be available to QUIC before the
level is active in TLS. Callers should use SSL_quic_read_level() to determine
the active read level for SSL_provide_quic_data(). SSL_do_handshake() will
pass the active write level to add_handshake_data() when writing data. Callers
can use SSL_quic_write_level() to query the active write level when
generating their own errors.
See https://tools.ietf.org/html/draft-ietf-quic-tls-15#section-4.1 for more
details.
To avoid DoS attacks, the QUIC implementation must limit the amount of data
being queued up. The implementation can call
SSL_quic_max_handshake_flight_len() to get the maximum buffer length at each
encryption level.
draft-ietf-quic-tls defines a new TLS extension quic_transport_parameters
used by QUIC for each endpoint to unilaterally declare its supported
transport parameters. draft-ietf-quic-transport (section 7.4) defines the
contents of that extension (a TransportParameters struct) and describes how
to handle it and its semantic meaning.
OpenSSL handles this extension as an opaque byte string. The caller is
responsible for serializing and parsing it.
=head2 OSSL_ENCRYPTION_LEVEL
B<OSSL_ENCRYPTION_LEVEL> (B<enum ssl_encryption_level_t>) represents the
encryption levels:
=over 4
=item ssl_encryption_initial
The initial encryption level that is used for client and server hellos.
=item ssl_encryption_early_data
The encryption level for early data. This is a write-level for the client
and a read-level for the server.
=item ssl_encryption_handshake
The encryption level for the remainder of the handshake.
=item ssl_encryption_application
The encryption level for the application data.
=back
=head2 SSL_QUIC_METHOD
The B<SSL_QUIC_METHOD> (B<struct ssl_quic_method_st>) describes the
QUIC methods.
struct ssl_quic_method_st {
int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
const uint8_t *read_secret,
const uint8_t *write_secret, size_t secret_len);
int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
const uint8_t *data, size_t len);
int (*flush_flight)(SSL *ssl);
int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
};
typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
set_encryption_secrets() configures the read and write secrets for the given
encryption level. This function will always be called before an encryption
level other than B<ssl_encryption_initial> is used. Note, however, that
secrets for a level may be configured before TLS is ready to send or accept
data at that level.
When reading packets at a given level, the QUIC implementation must send
ACKs at the same level, so this function provides read and write secrets
together. The exception is B<ssl_encryption_early_data>, where secrets are
only available in the client to server direction. The other secret will be
NULL. The server acknowledges such data at B<ssl_encryption_application>,
which will be configured in the same SSL_do_handshake() call.
This function should use SSL_get_current_cipher() to determine the TLS
cipher suite.
add_handshake_data() adds handshake data to the current flight at the given
encryption level. It returns one on success and zero on error.
OpenSSL will pack data from a single encryption level together, but a
single handshake flight may include multiple encryption levels. Callers
should defer writing data to the network until flush_flight() to better
pack QUIC packets into transport datagrams.
flush_flight() is called when the current flight is complete and should be
written to the transport. Note a flight may contain data at several
encryption levels.
send_alert() sends a fatal alert at the specified encryption level.
All QUIC methods return 1 on success and 0 on error.
=head1 RETURN VALUES
SSL_CTX_set_quic_method(),
SSL_set_quic_method(),
SSL_set_quic_transport_params(), and
SSL_process_quic_post_handshake()
return 1 on success, and 0 on error.
SSL_quic_read_level() and SSL_quic_write_level() return the current
encryption level as B<OSSL_ENCRYPTION_LEVEL> (B<enum ssl_encryption_level_t>).
SSL_quic_max_handshake_flight_len() returns the maximum length of a flight
for a given encryption level.
SSL_is_quic() returns 1 if QUIC is being used, 0 if not.
=head1 SEE ALSO
L<ssl(7)>, L<SSL_CIPHER_get_prf_nid(3)>, L<SSL_do_handshake(3)>
=head1 HISTORY
These functions were added in OpenSSL 3.0.0.
=head1 COPYRIGHT
Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/SSL_CTX_set_record_padding_callback.pod
+9 -1
View File
@@ -16,7 +16,7 @@ SSL_set_block_padding - install callback to specify TLS 1.3 record padding
#include <openssl/ssl.h>
void SSL_CTX_set_record_padding_callback(SSL_CTX *ctx, size_t (*cb)(SSL *s, int type, size_t len, void *arg));
void SSL_set_record_padding_callback(SSL *ssl, size_t (*cb)(SSL *s, int type, size_t len, void *arg));
int SSL_set_record_padding_callback(SSL *ssl, size_t (*cb)(SSL *s, int type, size_t len, void *arg));
void SSL_CTX_set_record_padding_callback_arg(SSL_CTX *ctx, void *arg);
void *SSL_CTX_get_record_padding_callback_arg(const SSL_CTX *ctx);
@@ -32,6 +32,8 @@ SSL_set_block_padding - install callback to specify TLS 1.3 record padding
SSL_CTX_set_record_padding_callback() or SSL_set_record_padding_callback()
can be used to assign a callback function I<cb> to specify the padding
for TLS 1.3 records. The value set in B<ctx> is copied to a new SSL by SSL_new().
Kernel TLS is not possible if the record padding callback is set, and the callback
function cannot be set if Kernel TLS is already configured for the current SSL object.
SSL_CTX_set_record_padding_callback_arg() and SSL_set_record_padding_callback_arg()
assign a value B<arg> that is passed to the callback when it is invoked. The value
@@ -64,6 +66,9 @@ indicates no padding will be added. A return value that causes the record to
exceed the maximum record size (SSL3_RT_MAX_PLAIN_LENGTH) will pad out to the
maximum record size.
The SSL_CTX_get_record_padding_callback_arg() function returns 1 on success or 0 if
the callback function is not set because Kernel TLS is configured for the SSL object.
=head1 NOTES
The default behavior is to add no padding to the record.
@@ -84,6 +89,9 @@ L<ssl(7)>, L<SSL_new(3)>
The record padding API was added for TLS 1.3 support in OpenSSL 1.1.1.
The return type of SSL_CTX_set_record_padding_callback() function was
changed to int in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2017 The OpenSSL Project Authors. All Rights Reserved.
doc/man3/SSL_CTX_set_session_ticket_cb.pod
+1 -1
View File
@@ -177,7 +177,7 @@ L<SSL_get_session(3)>
=head1 HISTORY
The SSL_CTX_set_session_ticket_cb(), SSSL_SESSION_set1_ticket_appdata()
The SSL_CTX_set_session_ticket_cb(), SSL_SESSION_set1_ticket_appdata()
and SSL_SESSION_get_ticket_appdata() functions were added in OpenSSL 1.1.1.
=head1 COPYRIGHT
doc/man3/SSL_CTX_set_tlsext_ticket_key_cb.pod
+7 -7
View File
@@ -49,7 +49,7 @@ ticket information or it starts a full TLS handshake to create a new session
ticket.
Before the callback function is started I<ctx> and I<hctx> have been
initialised with L<EVP_CIPHER_CTX_reset(3)> and L<EVP_MAC_CTX_new(3)>
initialised with L<EVP_CIPHER_CTX_reset(3)> and L<EVP_MAC_new_ctx(3)>
respectively.
For new sessions tickets, when the client doesn't present a session ticket, or
@@ -66,7 +66,7 @@ maximum IV length is B<EVP_MAX_IV_LENGTH> bytes defined in B<evp.h>.
The initialization vector I<iv> should be a random value. The cipher context
I<ctx> should use the initialisation vector I<iv>. The cipher context can be
set using L<EVP_EncryptInit_ex(3)>. The hmac context and digest can be set using
L<EVP_MAC_CTX_set_params(3)> with the B<OSSL_MAC_PARAM_KEY> and
L<EVP_MAC_set_ctx_params(3)> with the B<OSSL_MAC_PARAM_KEY> and
B<OSSL_MAC_PARAM_DIGEST> parameters respectively.
When the client presents a session ticket, the callback function with be called
@@ -76,7 +76,7 @@ the session ticket. The OpenSSL library expects that the I<name> will be used
to retrieve a cryptographic parameters and that the cryptographic context
I<ctx> will be set with the retrieved parameters and the initialization vector
I<iv>. using a function like L<EVP_DecryptInit_ex(3)>. The key material and
digest for I<hctx> need to be set using L<EVP_MAC_CTX_set_params(3)> with the
digest for I<hctx> need to be set using L<EVP_MAC_set_ctx_params(3)> with the
B<OSSL_MAC_PARAM_KEY> and B<OSSL_MAC_PARAM_DIGEST> parameters respectively.
If the I<name> is still valid but a renewal of the ticket is required the
@@ -120,8 +120,8 @@ The SSL_CTX_set_tlsext_ticket_key_cb() function is identical to
SSL_CTX_set_tlsext_ticket_key_evp_cb() except that it takes a deprecated
HMAC_CTX pointer instead of an EVP_MAC_CTX one.
Before this callback function is started I<hctx> will have been
initialised with L<EVP_MAC_CTX_new(3)> and the digest set with
L<EVP_MAC_CTX_set_params(3)>.
initialised with L<EVP_MAC_new_ctx(3)> and the digest set with
L<EVP_MAC_set_ctx_params(3)>.
The I<hctx> key material can be set using L<HMAC_Init_ex(3)>.
=head1 NOTES
@@ -185,7 +185,7 @@ Reference Implementation:
params[1] = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST,
"sha256", 0);
params[2] = OSSL_PARAM_construct_end();
EVP_MAC_CTX_set_params(hctx, params);
EVP_MAC_set_ctx_params(hctx, params);
return 1;
@@ -200,7 +200,7 @@ Reference Implementation:
params[1] = OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST,
"sha256", 0);
params[2] = OSSL_PARAM_construct_end();
EVP_MAC_CTX_set_params(hctx, params);
EVP_MAC_set_ctx_params(hctx, params);
EVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL, key->aes_key, iv);
doc/man3/SSL_CTX_use_psk_identity_hint.pod
+4 -2
View File
@@ -83,7 +83,9 @@ via SSL_CTX_set_psk_find_session_callback() or SSL_set_psk_find_session_callback
and it will use that in preference. If no such callback is present then it will
check to see if a callback has been set via SSL_CTX_set_psk_server_callback() or
SSL_set_psk_server_callback() and use that. In this case the handshake digest
will default to SHA-256 for any returned PSK.
will default to SHA-256 for any returned PSK. TLSv1.3 early data exchanges are
possible in PSK connections only with the B<SSL_psk_find_session_cb_func>
callback, and are not possible with the B<SSL_psk_server_cb_func> callback.
A connection established via a TLSv1.3 PSK will appear as if session resumption
has occurred so that L<SSL_session_reused(3)> will return true.
@@ -144,7 +146,7 @@ were added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/SSL_get_error.pod
+13 -1
View File
@@ -25,6 +25,15 @@ other OpenSSL function calls should appear in between. The current
thread's error queue must be empty before the TLS/SSL I/O operation is
attempted, or SSL_get_error() will not work reliably.
=head1 NOTES
Some TLS implementations do not send a close_notify alert on shutdown.
On an unexpected EOF, versions before OpenSSL 3.0 returned
B<SSL_ERROR_SYSCALL>, nothing was added to the error stack, and errno was 0.
Since OpenSSL 3.0 the returned error is B<SSL_ERROR_SSL> with a meaningful
error on the error stack.
=head1 RETURN VALUES
The following return values can currently occur:
@@ -44,6 +53,9 @@ No more data can be read.
Note that B<SSL_ERROR_ZERO_RETURN> does not necessarily
indicate that the underlying transport has been closed.
This error can also appear when the option B<SSL_OP_IGNORE_UNEXPECTED_EOF>
is set. See L<SSL_CTX_set_options(3)> for more details.
=item SSL_ERROR_WANT_READ, SSL_ERROR_WANT_WRITE
The operation did not complete and can be retried later.
@@ -166,7 +178,7 @@ The SSL_ERROR_WANT_CLIENT_HELLO_CB error code was added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/SSL_read_early_data.pod
+6 -5
View File
@@ -58,10 +58,11 @@ SSL_set_allow_early_data_cb
These functions are used to send and receive early data where TLSv1.3 has been
negotiated. Early data can be sent by the client immediately after its initial
ClientHello without having to wait for the server to complete the handshake.
Early data can only be sent if a session has previously been established with
the server, and the server is known to support it. Additionally these functions
can be used to send data from the server to the client when the client has not
yet completed the authentication stage of the handshake.
Early data can be sent if a session has previously been established with the
server or when establishing a new session using an out-of-band PSK, and only
when the server is known to support it. Additionally these functions can be used
to send data from the server to the client when the client has not yet completed
the authentication stage of the handshake.
Early data has weaker security properties than other data sent over an SSL/TLS
connection. In particular the data does not have forward secrecy. There are also
@@ -364,7 +365,7 @@ All of the functions described above were added in OpenSSL 1.1.1.
=head1 COPYRIGHT
Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2017-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/SSL_shutdown.pod
+5 -3
View File
@@ -83,8 +83,10 @@ message, otherwise an unexpected EOF will be reported.
There are implementations that do not send the required close_notify alert.
If there is a need to communicate with such an implementation, and it's clear
that all data has been received, do not wait for the peer's close_notify alert.
Waiting for the close_notify alert when the peer just closes the connection will
result in an error being generated.
Waiting for the close_notify alert when the peer just closes the connection
will result in an error being generated.
The error can be ignored using the B<SSL_OP_IGNORE_UNEXPECTED_EOF>.
For more information see L<SSL_CTX_set_options(3)>.
=head2 First to close the connection
@@ -159,7 +161,7 @@ It can also occur when not all data was read using SSL_read().
L<SSL_get_error(3)>, L<SSL_connect(3)>,
L<SSL_accept(3)>, L<SSL_set_shutdown(3)>,
L<SSL_CTX_set_quiet_shutdown(3)>,
L<SSL_CTX_set_quiet_shutdown(3)>, L<SSL_CTX_set_options(3)>
L<SSL_clear(3)>, L<SSL_free(3)>,
L<ssl(7)>, L<bio(7)>
doc/man3/X509_PUBKEY_new.pod
+15 -6
View File
@@ -5,8 +5,8 @@
X509_PUBKEY_new, X509_PUBKEY_free, X509_PUBKEY_dup,
X509_PUBKEY_set, X509_PUBKEY_get0, X509_PUBKEY_get,
d2i_PUBKEY, i2d_PUBKEY, d2i_PUBKEY_bio, d2i_PUBKEY_fp,
i2d_PUBKEY_fp, i2d_PUBKEY_bio, X509_PUBKEY_set0_param,
X509_PUBKEY_get0_param - SubjectPublicKeyInfo public key functions
i2d_PUBKEY_fp, i2d_PUBKEY_bio, X509_PUBKEY_set0_param, X509_PUBKEY_get0_param,
X509_PUBKEY_eq - SubjectPublicKeyInfo public key functions
=head1 SYNOPSIS
@@ -17,8 +17,8 @@ X509_PUBKEY_get0_param - SubjectPublicKeyInfo public key functions
X509_PUBKEY *X509_PUBKEY_dup(const X509_PUBKEY *a);
int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey);
EVP_PKEY *X509_PUBKEY_get0(X509_PUBKEY *key);
EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key);
EVP_PKEY *X509_PUBKEY_get0(const X509_PUBKEY *key);
EVP_PKEY *X509_PUBKEY_get(const X509_PUBKEY *key);
EVP_PKEY *d2i_PUBKEY(EVP_PKEY **a, const unsigned char **pp, long length);
int i2d_PUBKEY(const EVP_PKEY *a, unsigned char **pp);
@@ -34,7 +34,8 @@ X509_PUBKEY_get0_param - SubjectPublicKeyInfo public key functions
unsigned char *penc, int penclen);
int X509_PUBKEY_get0_param(ASN1_OBJECT **ppkalg,
const unsigned char **pk, int *ppklen,
X509_ALGOR **pa, X509_PUBKEY *pub);
X509_ALGOR **pa, const X509_PUBKEY *pub);
int X509_PUBKEY_eq(X509_PUBKEY *a, X509_PUBKEY *b);
=head1 DESCRIPTION
@@ -81,6 +82,8 @@ parameters is not required it can be set to B<NULL>. All of the
retrieved pointers are internal and must not be freed after the
call.
X509_PUBKEY_eq() compares two B<X509_PUBKEY> values.
=head1 NOTES
The B<X509_PUBKEY> functions can be used to encode and decode public keys
@@ -104,15 +107,21 @@ structure or B<NULL> if an error occurs.
X509_PUBKEY_set(), X509_PUBKEY_set0_param() and X509_PUBKEY_get0_param()
return 1 for success and 0 if an error occurred.
X509_PUBKEY_eq() returns 1 for equal, 0 for different, and < 0 on error.
=head1 SEE ALSO
L<d2i_X509(3)>,
L<ERR_get_error(3)>,
L<X509_get_pubkey(3)>,
=head1 HISTORY
The X509_PUBKEY_eq() function was added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
doc/man3/X509_STORE_add_cert.pod
-2
View File
@@ -32,8 +32,6 @@ X509_STORE_load_locations
int X509_STORE_load_path(X509_STORE *ctx, const char *dir);
int X509_STORE_load_store(X509_STORE *ctx, const char *uri);
Deprecated:
int X509_STORE_load_locations(X509_STORE *ctx,
const char *file, const char *dir);
doc/man3/X509_dup.pod
+5
View File
@@ -81,7 +81,11 @@ IPAddressOrRange_free,
IPAddressOrRange_new,
IPAddressRange_free,
IPAddressRange_new,
ISSUER_SIGN_TOOL_free,
ISSUER_SIGN_TOOL_it,
ISSUER_SIGN_TOOL_new,
ISSUING_DIST_POINT_free,
ISSUING_DIST_POINT_it,
ISSUING_DIST_POINT_new,
NAME_CONSTRAINTS_free,
NAME_CONSTRAINTS_new,
@@ -252,6 +256,7 @@ TS_TST_INFO_new,
USERNOTICE_free,
USERNOTICE_new,
X509_ALGOR_free,
X509_ALGOR_it,
X509_ALGOR_new,
X509_ATTRIBUTE_dup,
X509_ATTRIBUTE_free,
doc/man3/X509_get0_distinguishing_id.pod
+3 -1
View File
@@ -21,7 +21,9 @@ The Distinguishing ID is defined in FIPS 196 as follows:
=over 4
I<Distinguishing identifier>: information which unambiguously distinguishes
=item I<Distinguishing identifier>
Information which unambiguously distinguishes
an entity in the authentication process.
=back
doc/man3/X509_load_http.pod
-63
View File
@@ -1,63 +0,0 @@
=pod
=head1 NAME
X509_load_http,
X509_http_nbio,
X509_CRL_load_http,
X509_CRL_http_nbio
- certificate and CRL loading functions
=head1 SYNOPSIS
#include <openssl/x509.h>
X509 *X509_load_http(const char *url, BIO *bio, BIO *rbio, int timeout);
X509_CRL *X509_CRL_load_http(const char *url, BIO *bio, BIO *rbio, int timeout);
#define X509_http_nbio(url)
#define X509_CRL_http_nbio(url)
=head1 DESCRIPTION
X509_load_http() and X509_CRL_load_http() loads a certificate or a CRL,
respectively, in ASN.1 format using HTTP from the given B<url>.
If B<bio> is given and B<rbio> is NULL then this BIO is used instead of an
internal one for connecting, writing the request, and reading the response.
If both B<bio> and B<rbio> are given (which may be memory BIOs, for instance)
then no explicit connection is attempted,
B<bio> is used for writing the request, and B<rbio> for reading the response.
If the B<timeout> parameter is > 0 this indicates the maximum number of seconds
to wait until the transfer is complete.
A value of 0 enables waiting indefinitely,
while a value < 0 immediately leads to a timeout condition.
X509_http_nbio() and X509_CRL_http_nbio() are macros for backward compatibility
that have the same effect as the functions above but with infinite timeout
and without the possibility to specify custom BIOs.
=head1 RETURN VALUES
On success the function yield the loaded value, else NULL.
Error conditions include connection/transfer timeout, parse errors, etc.
=head1 SEE ALSO
L<OSSL_HTTP_get_asn1(3)>
=head1 HISTORY
X509_load_http() and X509_CRL_load_http() were added in OpenSSL 3.0.
=head1 COPYRIGHT
Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
in the file LICENSE in the source distribution or at
L<https://www.openssl.org/source/license.html>.
=cut
doc/man3/d2i_X509.pod
+2
View File
@@ -75,6 +75,7 @@ d2i_IPAddressChoice,
d2i_IPAddressFamily,
d2i_IPAddressOrRange,
d2i_IPAddressRange,
d2i_ISSUER_SIGN_TOOL,
d2i_ISSUING_DIST_POINT,
d2i_NAMING_AUTHORITY,
d2i_NETSCAPE_CERT_SEQUENCE,
@@ -267,6 +268,7 @@ i2d_IPAddressChoice,
i2d_IPAddressFamily,
i2d_IPAddressOrRange,
i2d_IPAddressRange,
i2d_ISSUER_SIGN_TOOL,
i2d_ISSUING_DIST_POINT,
i2d_NAMING_AUTHORITY,
i2d_NETSCAPE_CERT_SEQUENCE,