Latest update.
This commit is contained in:
@@ -49,10 +49,20 @@ is expanded.
|
||||
|
||||
These functions, other than BIO_f_buffer(), are implemented as macros.
|
||||
|
||||
Buffering BIOs implement BIO_gets() by using BIO_read_ex() operations on the
|
||||
next BIO in the chain. By prepending a buffering BIO to a chain it is therefore
|
||||
possible to provide BIO_gets() functionality if the following BIOs do not
|
||||
support it (for example SSL BIOs).
|
||||
Buffering BIOs implement BIO_read_ex() and BIO_gets() by using
|
||||
BIO_read_ex() operations on the next BIO in the chain and storing the
|
||||
result in an internal buffer, from which bytes are given back to the
|
||||
caller as appropriate for the call; a BIO_gets() is guaranteed to give
|
||||
the caller a whole line, and BIO_read_ex() is guaranteed to give the
|
||||
caller the number of bytes it asks for, unless there's an error or end
|
||||
of communication is reached in the next BIO. By prepending a
|
||||
buffering BIO to a chain it is therefore possible to provide
|
||||
BIO_gets() or exact size BIO_read_ex() functionality if the following
|
||||
BIOs do not support it.
|
||||
|
||||
Do not add more than one BIO_f_buffer() to a BIO chain. The result of
|
||||
doing so will force a full read of the size of the internal buffer of
|
||||
the top BIO_f_buffer(), which is 4 KiB at a minimum.
|
||||
|
||||
Data is only written to the next BIO in the chain when the write buffer fills
|
||||
or when BIO_flush() is called. It is therefore important to call BIO_flush()
|
||||
|
||||
@@ -16,6 +16,10 @@ DSA_meth_set_keygen - Routines to build up DSA methods
|
||||
|
||||
#include <openssl/dsa.h>
|
||||
|
||||
Deprecated since OpenSSL 3.0, can be hidden entirely by defining
|
||||
B<OPENSSL_API_COMPAT> with a suitable version value, see
|
||||
L<openssl_user_macros(7)>:
|
||||
|
||||
DSA_METHOD *DSA_meth_new(const char *name, int flags);
|
||||
|
||||
void DSA_meth_free(DSA_METHOD *dsam);
|
||||
@@ -86,6 +90,10 @@ DSA_meth_set_keygen - Routines to build up DSA methods
|
||||
|
||||
=head1 DESCRIPTION
|
||||
|
||||
All of the functions described on this page are deprecated.
|
||||
Applications and extension implementations should instead use the
|
||||
OSSL_PROVIDER APIs.
|
||||
|
||||
The B<DSA_METHOD> type is a structure used for the provision of custom DSA
|
||||
implementations. It provides a set of functions used by OpenSSL for the
|
||||
implementation of the various DSA capabilities.
|
||||
@@ -200,11 +208,13 @@ L<DSA_sign(3)>, L<DSA_size(3)>, L<DSA_get0_pqg(3)>
|
||||
|
||||
=head1 HISTORY
|
||||
|
||||
The functions described here were deprecated in OpenSSL 3.0.
|
||||
|
||||
The functions described here were added in OpenSSL 1.1.0.
|
||||
|
||||
=head1 COPYRIGHT
|
||||
|
||||
Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
|
||||
|
||||
Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
this file except in compliance with the License. You can obtain a copy
|
||||
|
||||
@@ -8,12 +8,20 @@ DSA_size, DSA_bits, DSA_security_bits - get DSA signature size, key bits or secu
|
||||
|
||||
#include <openssl/dsa.h>
|
||||
|
||||
Deprecated since OpenSSL 3.0, can be hidden entirely by defining
|
||||
B<OPENSSL_API_COMPAT> with a suitable version value, see
|
||||
L<openssl_user_macros(7)>:
|
||||
|
||||
int DSA_size(const DSA *dsa);
|
||||
int DSA_bits(const DSA *dsa);
|
||||
int DSA_security_bits(const DSA *dsa);
|
||||
|
||||
=head1 DESCRIPTION
|
||||
|
||||
All of the functions described on this page are deprecated.
|
||||
Applications should instead use L<EVP_PKEY_bits(3)>,
|
||||
L<EVP_PKEY_security_bits(3)> and L<EVP_PKEY_size(3)>.
|
||||
|
||||
DSA_size() returns the maximum size of an ASN.1 encoded DSA signature
|
||||
for key B<dsa> in bytes. It can be used to determine how much memory must
|
||||
be allocated for a DSA signature.
|
||||
@@ -34,8 +42,15 @@ DSA_bits() returns the number of bits in the key.
|
||||
|
||||
=head1 SEE ALSO
|
||||
|
||||
L<EVP_PKEY_bits(3)>,
|
||||
L<EVP_PKEY_security_bits(3)>,
|
||||
L<EVP_PKEY_size(3)>,
|
||||
L<DSA_new(3)>, L<DSA_sign(3)>
|
||||
|
||||
=head1 HISTORY
|
||||
|
||||
All of these functions were deprecated in OpenSSL 3.0.
|
||||
|
||||
=head1 COPYRIGHT
|
||||
|
||||
Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
|
||||
@@ -3,7 +3,8 @@
|
||||
=head1 NAME
|
||||
|
||||
ERR_raise, ERR_raise_data,
|
||||
ERR_put_error, ERR_add_error_data, ERR_add_error_vdata
|
||||
ERR_put_error, ERR_add_error_data, ERR_add_error_vdata,
|
||||
ERR_add_error_txt, ERR_add_error_mem_bio
|
||||
- record an error
|
||||
|
||||
=head1 SYNOPSIS
|
||||
@@ -15,6 +16,8 @@ ERR_put_error, ERR_add_error_data, ERR_add_error_vdata
|
||||
|
||||
void ERR_add_error_data(int num, ...);
|
||||
void ERR_add_error_vdata(int num, va_list arg);
|
||||
void ERR_add_error_txt(const char *sep, const char *txt);
|
||||
void ERR_add_error_mem_bio(const char *sep, BIO *bio);
|
||||
|
||||
Deprecated since OpenSSL 3.0:
|
||||
|
||||
@@ -38,9 +41,23 @@ B<func> of library B<lib>, in line number B<line> of B<file>.
|
||||
This function is usually called by a macro.
|
||||
|
||||
ERR_add_error_data() associates the concatenation of its B<num> string
|
||||
arguments with the error code added last.
|
||||
arguments as additional data with the error code added last.
|
||||
ERR_add_error_vdata() is similar except the argument is a B<va_list>.
|
||||
Multiple calls to these functions append to the current top of the error queue.
|
||||
The total length of the string data per error is limited to 4096 characters.
|
||||
|
||||
ERR_add_error_txt() appends the given text string as additional data to the
|
||||
last error queue entry, after inserting the optional separator string if it is
|
||||
not NULL and the top error entry does not yet have additional data.
|
||||
In case the separator is at the end of the text it is not appended to the data.
|
||||
The B<sep> argument may be for instance "\n" to insert a line break when needed.
|
||||
If the associated data would become more than 4096 characters long
|
||||
(which is the limit given above)
|
||||
it is split over sufficiently many new copies of the last error queue entry.
|
||||
|
||||
ERR_add_error_mem_bio() is the same as ERR_add_error_txt() except that
|
||||
the text string is taken from the given memory BIO.
|
||||
It appends '\0' to the BIO contents if not already NUL-terminated.
|
||||
|
||||
L<ERR_load_strings(3)> can be used to register
|
||||
error strings so that the application can a generate human-readable
|
||||
@@ -76,8 +93,10 @@ the ASN1err() macro.
|
||||
|
||||
=head1 RETURN VALUES
|
||||
|
||||
ERR_raise(), ERR_put_error(), ERR_add_error_data() and
|
||||
ERR_add_error_vdata() return no values.
|
||||
ERR_raise(), ERR_put_error(),
|
||||
ERR_add_error_data(), ERR_add_error_vdata()
|
||||
ERR_add_error_txt(), and ERR_add_error_mem_bio()
|
||||
return no values.
|
||||
|
||||
=head1 NOTES
|
||||
|
||||
@@ -87,6 +106,10 @@ ERR_raise() and ERR_put_error() are implemented as macros.
|
||||
|
||||
L<ERR_load_strings(3)>
|
||||
|
||||
=head1 HISTORY
|
||||
|
||||
B<ERR_add_error_txt> and B<ERR_add_error_mem_bio> were added in OpenSSL 3.0.
|
||||
|
||||
=head1 COPYRIGHT
|
||||
|
||||
Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.
|
||||
|
||||
@@ -4,16 +4,6 @@
|
||||
|
||||
OSSL_CMP_log_open,
|
||||
OSSL_CMP_log_close,
|
||||
OSSL_CMP_alert,
|
||||
OSSL_CMP_err,
|
||||
OSSL_CMP_warn,
|
||||
OSSL_CMP_info,
|
||||
OSSL_CMP_debug,
|
||||
OSSL_CMP_log,
|
||||
OSSL_CMP_log1,
|
||||
OSSL_CMP_log2,
|
||||
OSSL_CMP_log3,
|
||||
OSSL_CMP_log4,
|
||||
OSSL_CMP_severity,
|
||||
OSSL_CMP_LOG_EMERG,
|
||||
OSSL_CMP_LOG_ALERT,
|
||||
@@ -24,6 +14,7 @@ OSSL_CMP_LOG_NOTICE,
|
||||
OSSL_CMP_LOG_INFO,
|
||||
OSSL_CMP_LOG_DEBUG,
|
||||
OSSL_cmp_log_cb_t,
|
||||
OSSL_CMP_print_to_bio,
|
||||
OSSL_CMP_print_errors_cb
|
||||
- functions for logging and error reporting
|
||||
|
||||
@@ -33,16 +24,6 @@ OSSL_CMP_print_errors_cb
|
||||
|
||||
int OSSL_CMP_log_open(void);
|
||||
void OSSL_CMP_log_close(void);
|
||||
#define OSSL_CMP_alert(msg)
|
||||
#define OSSL_CMP_err(msg)
|
||||
#define OSSL_CMP_warn(msg)
|
||||
#define OSSL_CMP_info(msg)
|
||||
#define OSSL_CMP_debug(msg)
|
||||
#define OSSL_CMP_log(level, msg)
|
||||
#define OSSL_CMP_log1(level, fmt, arg1)
|
||||
#define OSSL_CMP_log2(level, fmt, arg1, arg2)
|
||||
#define OSSL_CMP_log3(level, fmt, arg1, arg2, arg3)
|
||||
#define OSSL_CMP_log4(level, fmt, arg1, arg2, arg3, arg4)
|
||||
|
||||
/* severity level declarations resemble those from syslog.h */
|
||||
typedef int OSSL_CMP_severity;
|
||||
@@ -54,16 +35,18 @@ OSSL_CMP_print_errors_cb
|
||||
#define OSSL_CMP_LOG_NOTICE 5
|
||||
#define OSSL_CMP_LOG_INFO 6
|
||||
#define OSSL_CMP_LOG_DEBUG 7
|
||||
|
||||
typedef int (*OSSL_cmp_log_cb_t)(const char *component,
|
||||
const char *file, int line,
|
||||
OSSL_CMP_severity level, const char *msg);
|
||||
|
||||
int OSSL_CMP_print_to_bio(BIO *bio, const char *component, const char *file,
|
||||
int line, OSSL_CMP_severity level, const char *msg);
|
||||
void OSSL_CMP_print_errors_cb(OSSL_cmp_log_cb_t log_fn);
|
||||
|
||||
=head1 DESCRIPTION
|
||||
|
||||
The logging and error reporting facility described here contains
|
||||
convenience functions for CMP-specific logging via the trace API,
|
||||
convenience functions for CMP-specific logging,
|
||||
including a string prefix mirroring the severity levels of syslog.h,
|
||||
and enhancements of the error queue mechanism needed for large diagnostic
|
||||
messages produced by the CMP library in case of certificate validation failures.
|
||||
@@ -73,12 +56,12 @@ should be provided for user information, debugging, and auditing purposes.
|
||||
A CMP application can obtain this information by providing a callback function
|
||||
with the following type:
|
||||
|
||||
typedef void (*OSSL_cmp_log_cb_t)(const char *component,
|
||||
const char *file, int line,
|
||||
OSSL_CMP_severity level, const char *msg);
|
||||
typedef int (*OSSL_cmp_log_cb_t)(const char *component,
|
||||
const char *file, int line,
|
||||
OSSL_CMP_severity level, const char *msg);
|
||||
|
||||
The parameters may provide
|
||||
a component identifier (which may be a library name or function name) or NULL,
|
||||
some component info (which may be a module name and/or function name) or NULL,
|
||||
a file pathname or NULL,
|
||||
a line number or 0 indicating the source code location,
|
||||
a severity level, and
|
||||
@@ -105,19 +88,15 @@ OSSL_CMP_log_close() may be called when all activities are finished to flush
|
||||
any pending CMP-specific log output and deallocate related resources.
|
||||
It may be called multiple times. It does get called at OpenSSL stutdown.
|
||||
|
||||
OSSL_CMP_alert() outputs a simple alert message via the trace API.
|
||||
OSSL_CMP_err() outputs a simple error message via the trace API.
|
||||
OSSL_CMP_warn() outputs a simple warning message via the trace API.
|
||||
OSSL_CMP_info() outputs a simple info message via the trace API.
|
||||
OSSL_CMP_debug() outputs a simple debug message via the trace API.
|
||||
|
||||
Note that due to the design of the trace API used, the log functions have no
|
||||
effect unless the B<enable-trace> option is used during build configuration.
|
||||
OSSL_CMP_print_to_bio() prints the given component info, filename, line number,
|
||||
severity level, and log message or error queue message to the given B<bio>.
|
||||
B<component> usually is a function or module name.
|
||||
If it is NULL, empty, or "(unknown function)" then "CMP" is used as fallback.
|
||||
|
||||
OSSL_CMP_print_errors_cb() outputs any entries in the OpenSSL error queue.
|
||||
It is similar to B<ERR_print_errors_cb()> but uses the CMP log callback function
|
||||
C<log_fn> for uniformity with CMP logging if not B<NULL>. Otherwise it uses
|
||||
B<ERR_print_errors(3)> to print to STDERR (unless OPENSSL_NO_STDIO is defined).
|
||||
C<log_fn> for uniformity with CMP logging if not B<NULL>. Otherwise it prints to
|
||||
STDERR using B<OSSL_CMP_print_to_bio(3)> (unless OPENSSL_NO_STDIO is defined).
|
||||
|
||||
=head1 RETURN VALUES
|
||||
|
||||
|
||||
@@ -0,0 +1,86 @@
|
||||
=pod
|
||||
|
||||
=head1 NAME
|
||||
|
||||
OSSL_CMP_validate_msg,
|
||||
OSSL_CMP_validate_cert_path
|
||||
- functions for verifying CMP message protection
|
||||
|
||||
=head1 SYNOPSIS
|
||||
|
||||
#include <openssl/cmp.h>
|
||||
int OSSL_CMP_validate_msg(OSSL_CMP_CTX *ctx, OSSL_CMP_MSG *msg);
|
||||
int OSSL_CMP_validate_cert_path(const OSSL_CMP_CTX *ctx,
|
||||
X509_STORE *trusted_store, X509 *cert);
|
||||
|
||||
=head1 DESCRIPTION
|
||||
|
||||
This is the API for validating the protection of CMP messages,
|
||||
which includes validating CMP message sender certificates and their paths
|
||||
while optionally checking the revocation status of the certificates(s).
|
||||
|
||||
OSSL_CMP_validate_msg() validates the protection of the given C<msg>
|
||||
using either password-based mac (PBM) or a signature algorithm.
|
||||
|
||||
In case of signature algorithm, the certificate to use for the signature check
|
||||
is preferably the one provided by a call to L<OSSL_CMP_CTX_set1_srvCert(3)>.
|
||||
If no such sender cert has been pinned then candidate sender certificates are
|
||||
taken from the list of certificates received in the C<msg> extraCerts, then any
|
||||
certificates provided before via L<OSSL_CMP_CTX_set1_untrusted_certs(3)>, and
|
||||
then all trusted certificates provided via L<OSSL_CMP_CTX_set0_trustedStore(3)>,
|
||||
where a candidate is acceptable only if has not expired, its subject DN matches
|
||||
the C<msg> sender DN (as far as present), and its subject key identifier
|
||||
is present and matches the senderKID (as far as the latter present).
|
||||
Each acceptable cert is tried in the given order to see if the message
|
||||
signature check succeeds and the cert and its path can be verified
|
||||
using any trust store set via L<OSSL_CMP_CTX_set0_trustedStore(3)>.
|
||||
|
||||
If the option OSSL_CMP_OPT_PERMIT_TA_IN_EXTRACERTS_FOR_IR was set by calling
|
||||
L<OSSL_CMP_CTX_set_option(3)>, for an Initialization Response (IP) message
|
||||
any self-issued certificate from the C<msg> extraCerts field may also be used
|
||||
as trust anchor for the path verification of an acceptable cert if it can be
|
||||
used also to validate the issued certificate returned in the IP message. This is
|
||||
according to TS 33.310 [Network Domain Security (NDS); Authentication Framework
|
||||
(AF)] document specified by the The 3rd Generation Partnership Project (3GPP).
|
||||
|
||||
Any cert that has been found as described above is cached and tried first when
|
||||
validating the signatures of subsequent messages in the same transaction.
|
||||
|
||||
After successful validation of PBM-based protection of a certificate response
|
||||
the certificates in the caPubs field (if any) are added to the trusted
|
||||
certificates provided via L<OSSL_CMP_CTX_set0_trustedStore(3)>, such that
|
||||
they are available for validating subsequent messages in the same context.
|
||||
Those could apply to any Polling Response (pollRep), error, or PKI Confirmation
|
||||
(PKIConf) messages following in the same or future transactions.
|
||||
|
||||
OSSL_CMP_validate_cert_path() attempts to validate the given certificate and its
|
||||
path using the given store of trusted certs (possibly including CRLs and a cert
|
||||
verification callback) and non-trusted intermediate certs from the B<ctx>.
|
||||
|
||||
=head1 NOTES
|
||||
|
||||
CMP is defined in RFC 4210 (and CRMF in RFC 4211).
|
||||
|
||||
=head1 RETURN VALUES
|
||||
|
||||
OSSL_CMP_validate_msg() and OSSL_CMP_validate_cert_path()
|
||||
return 1 on success, 0 on error or validation failed.
|
||||
|
||||
=head1 SEE ALSO
|
||||
|
||||
L<OSSL_CMP_CTX_new(3)>, L<OSSL_CMP_exec_IR_ses(3)>
|
||||
|
||||
=head1 HISTORY
|
||||
|
||||
The OpenSSL CMP support was added in OpenSSL 3.0.
|
||||
|
||||
=head1 COPYRIGHT
|
||||
|
||||
Copyright 2007-2019 The OpenSSL Project Authors. All Rights Reserved.
|
||||
|
||||
Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
this file except in compliance with the License. You can obtain a copy
|
||||
in the file LICENSE in the source distribution or at
|
||||
L<https://www.openssl.org/source/license.html>.
|
||||
|
||||
=cut
|
||||
+3
-12
@@ -2,18 +2,13 @@
|
||||
|
||||
=head1 NAME
|
||||
|
||||
OSSL_PARAM_construct_from_text, OSSL_PARAM_allocate_from_text
|
||||
OSSL_PARAM_allocate_from_text
|
||||
- OSSL_PARAM construction utilities
|
||||
|
||||
=head1 SYNOPSIS
|
||||
|
||||
#include <openssl/params.h>
|
||||
|
||||
int OSSL_PARAM_construct_from_text(OSSL_PARAM *to,
|
||||
const OSSL_PARAM *paramdefs,
|
||||
const char *key, const char *value,
|
||||
size_t value_n,
|
||||
void *buf, size_t *buf_n)
|
||||
int OSSL_PARAM_allocate_from_text(OSSL_PARAM *to,
|
||||
const OSSL_PARAM *paramdefs,
|
||||
const char *key, const char *value,
|
||||
@@ -30,7 +25,7 @@ OpenSSL 3.0 introduces a new mechanism to do the same thing with an
|
||||
array of parameters that contain name, value, value type and value
|
||||
size (see L<OSSL_PARAM(3)> for more information).
|
||||
|
||||
OSSL_PARAM_construct_from_text() takes a control I<key>, I<value> and
|
||||
OSSL_PARAM_allocate_from_text() takes a control I<key>, I<value> and
|
||||
value size I<value_n>, and given a parameter descriptor array
|
||||
I<paramdefs>, it converts the value to something suitable for
|
||||
L<OSSL_PARAM(3)> and stores that in the buffer I<buf>, and modifies
|
||||
@@ -42,9 +37,6 @@ left untouched, allowing a caller to find out how large the buffer
|
||||
should be.
|
||||
I<buf> needs to be correctly aligned for the type of the B<OSSL_PARAM>
|
||||
I<key>.
|
||||
|
||||
OSSL_PARAM_allocate_from_text() works like OSSL_PARAM_construct_from_text(),
|
||||
except it allocates the buffer internally.
|
||||
The caller must remember to free the data of I<to> when it's not
|
||||
useful any more.
|
||||
|
||||
@@ -57,8 +49,7 @@ as parameter value.
|
||||
|
||||
=head1 RETURN VALUES
|
||||
|
||||
OSSL_PARAM_construct_from_text() and OSSL_PARAM_allocate_from_text()
|
||||
returns 1 on success, and 0 on error.
|
||||
OSSL_PARAM_allocate_from_text() returns 1 on success, and 0 on error.
|
||||
|
||||
=head1 NOTES
|
||||
|
||||
@@ -10,6 +10,9 @@ OSSL_SERIALIZER_CTX_set_passphrase_ui,
|
||||
OSSL_SERIALIZER_PUBKEY_TO_PEM_PQ,
|
||||
OSSL_SERIALIZER_PrivateKey_TO_PEM_PQ,
|
||||
OSSL_SERIALIZER_Parameters_TO_PEM_PQ,
|
||||
OSSL_SERIALIZER_PUBKEY_TO_DER_PQ,
|
||||
OSSL_SERIALIZER_PrivateKey_TO_DER_PQ,
|
||||
OSSL_SERIALIZER_Parameters_TO_DER_PQ,
|
||||
OSSL_SERIALIZER_PUBKEY_TO_TEXT_PQ,
|
||||
OSSL_SERIALIZER_PrivateKey_TO_TEXT_PQ,
|
||||
OSSL_SERIALIZER_Parameters_TO_TEXT_PQ
|
||||
@@ -38,6 +41,10 @@ OSSL_SERIALIZER_Parameters_TO_TEXT_PQ
|
||||
#define OSSL_SERIALIZER_PrivateKey_TO_PEM_PQ "format=pem,type=private"
|
||||
#define OSSL_SERIALIZER_Parameters_TO_PEM_PQ "format=pem,type=parameters"
|
||||
|
||||
#define OSSL_SERIALIZER_PUBKEY_TO_DER_PQ "format=der,type=public"
|
||||
#define OSSL_SERIALIZER_PrivateKey_TO_DER_PQ "format=der,type=private"
|
||||
#define OSSL_SERIALIZER_Parameters_TO_DER_PQ "format=der,type=parameters"
|
||||
|
||||
#define OSSL_SERIALIZER_PUBKEY_TO_TEXT_PQ "format=text,type=public"
|
||||
#define OSSL_SERIALIZER_PrivateKey_TO_TEXT_PQ "format=text,type=private"
|
||||
#define OSSL_SERIALIZER_Parameters_TO_TEXT_PQ "format=text,type=parameters"
|
||||
@@ -84,11 +91,14 @@ through an internal B<OSSL_PASSPHRASE_CALLBACK> function.
|
||||
The macros B<OSSL_SERIALIZER_PUBKEY_TO_PEM_PQ>,
|
||||
B<OSSL_SERIALIZER_PrivateKey_TO_PEM_PQ>,
|
||||
B<OSSL_SERIALIZER_Parameters_TO_PEM_PQ>,
|
||||
B<OSSL_SERIALIZER_PUBKEY_TO_DER_PQ>,
|
||||
B<OSSL_SERIALIZER_PrivateKey_TO_DER_PQ>,
|
||||
B<OSSL_SERIALIZER_Parameters_TO_DER_PQ>,
|
||||
B<OSSL_SERIALIZER_PUBKEY_TO_TEXT_PQ>,
|
||||
B<OSSL_SERIALIZER_PrivateKey_TO_TEXT_PQ>,
|
||||
B<OSSL_SERIALIZER_Parameters_TO_TEXT_PQ> are convenience macros with
|
||||
property queries to serialize the B<EVP_PKEY> as a public key, private
|
||||
key or parameters to B<PEM>, or to text.
|
||||
key or parameters to B<PEM>, to B<DER>, or to text.
|
||||
|
||||
=head1 RETURN VALUES
|
||||
|
||||
|
||||
+23
-1
@@ -10,11 +10,19 @@ DHparams_print, DHparams_print_fp - print cryptographic parameters
|
||||
|
||||
#include <openssl/rsa.h>
|
||||
|
||||
Deprecated since OpenSSL 3.0, can be hidden entirely by defining
|
||||
B<OPENSSL_API_COMPAT> with a suitable version value, see
|
||||
L<openssl_user_macros(7)>:
|
||||
|
||||
int RSA_print(BIO *bp, RSA *x, int offset);
|
||||
int RSA_print_fp(FILE *fp, RSA *x, int offset);
|
||||
|
||||
#include <openssl/dsa.h>
|
||||
|
||||
Deprecated since OpenSSL 3.0, can be hidden entirely by defining
|
||||
B<OPENSSL_API_COMPAT> with a suitable version value, see
|
||||
L<openssl_user_macros(7)>:
|
||||
|
||||
int DSAparams_print(BIO *bp, DSA *x);
|
||||
int DSAparams_print_fp(FILE *fp, DSA *x);
|
||||
int DSA_print(BIO *bp, DSA *x, int offset);
|
||||
@@ -22,11 +30,19 @@ DHparams_print, DHparams_print_fp - print cryptographic parameters
|
||||
|
||||
#include <openssl/dh.h>
|
||||
|
||||
Deprecated since OpenSSL 3.0, can be hidden entirely by defining
|
||||
B<OPENSSL_API_COMPAT> with a suitable version value, see
|
||||
L<openssl_user_macros(7)>:
|
||||
|
||||
int DHparams_print(BIO *bp, DH *x);
|
||||
int DHparams_print_fp(FILE *fp, DH *x);
|
||||
|
||||
=head1 DESCRIPTION
|
||||
|
||||
All of the functions described on this page are deprecated.
|
||||
Applications should instead use L<EVP_PKEY_print_params(3)> and
|
||||
L<EVP_PKEY_print_private(3)>.
|
||||
|
||||
A human-readable hexadecimal output of the components of the RSA
|
||||
key, DSA parameters or key or DH parameters is printed to B<bp> or B<fp>.
|
||||
|
||||
@@ -38,7 +54,13 @@ These functions return 1 on success, 0 on error.
|
||||
|
||||
=head1 SEE ALSO
|
||||
|
||||
L<BN_bn2bin(3)>
|
||||
L<EVP_PKEY_print_params(3)>,
|
||||
L<EVP_PKEY_print_private(3)>,
|
||||
L<BN_bn2bin(3)>
|
||||
|
||||
=head1 HISTORY
|
||||
|
||||
All of these functions were deprecated in OpenSSL 3.0.
|
||||
|
||||
=head1 COPYRIGHT
|
||||
|
||||
|
||||
@@ -14,14 +14,16 @@ X509_STORE_CTX_get_check_issued,
|
||||
X509_STORE_CTX_get_get_issuer,
|
||||
X509_STORE_CTX_get_verify_cb,
|
||||
X509_STORE_CTX_set_verify_cb,
|
||||
X509_STORE_CTX_verify_cb
|
||||
- get and set verification callback
|
||||
X509_STORE_CTX_verify_cb,
|
||||
X509_STORE_CTX_print_verify_cb
|
||||
- get and set X509_STORE_CTX components such as verification callback
|
||||
|
||||
=head1 SYNOPSIS
|
||||
|
||||
#include <openssl/x509_vfy.h>
|
||||
|
||||
typedef int (*X509_STORE_CTX_verify_cb)(int, X509_STORE_CTX *);
|
||||
int X509_STORE_CTX_print_verify_cb(int ok, X509_STORE_CTX *ctx);
|
||||
|
||||
X509_STORE_CTX_verify_cb X509_STORE_CTX_get_verify_cb(X509_STORE_CTX *ctx);
|
||||
|
||||
@@ -63,6 +65,12 @@ structure and receive additional information about the error, for example
|
||||
by calling X509_STORE_CTX_get_current_cert(). Additional application data can
|
||||
be passed to the callback via the B<ex_data> mechanism.
|
||||
|
||||
X509_STORE_CTX_print_verify_cb() is a verification callback function that,
|
||||
when a certificate verification has failed, adds an entry to the error queue
|
||||
with code B<X509_R_CERTIFICATE_VERIFICATION_FAILED> and with diagnostic details,
|
||||
including the most relevant fields of the target certificate that failed to
|
||||
verify and, if appropriate, of the available untrusted and trusted certificates.
|
||||
|
||||
X509_STORE_CTX_get_verify_cb() returns the value of the current callback
|
||||
for the specific B<ctx>.
|
||||
|
||||
@@ -200,6 +208,8 @@ X509_STORE_CTX_get_cert_crl(), X509_STORE_CTX_get_check_policy(),
|
||||
X509_STORE_CTX_get_lookup_certs(), X509_STORE_CTX_get_lookup_crls()
|
||||
and X509_STORE_CTX_get_cleanup() functions were added in OpenSSL 1.1.0.
|
||||
|
||||
X509_STORE_CTX_print_verify_cb() was added in OpenSSL 3.0.
|
||||
|
||||
=head1 COPYRIGHT
|
||||
|
||||
Copyright 2009-2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
|
||||
@@ -3,7 +3,8 @@
|
||||
=head1 NAME
|
||||
|
||||
X509_STORE_get0_param, X509_STORE_set1_param,
|
||||
X509_STORE_get0_objects - X509_STORE setter and getter functions
|
||||
X509_STORE_get0_objects, X509_STORE_get1_all_certs
|
||||
- X509_STORE setter and getter functions
|
||||
|
||||
=head1 SYNOPSIS
|
||||
|
||||
@@ -12,6 +13,7 @@ X509_STORE_get0_objects - X509_STORE setter and getter functions
|
||||
X509_VERIFY_PARAM *X509_STORE_get0_param(X509_STORE *ctx);
|
||||
int X509_STORE_set1_param(X509_STORE *ctx, X509_VERIFY_PARAM *pm);
|
||||
STACK_OF(X509_OBJECT) *X509_STORE_get0_objects(X509_STORE *ctx);
|
||||
STACK_OF(X509) *X509_STORE_get1_all_certs(X509_STORE *st);
|
||||
|
||||
=head1 DESCRIPTION
|
||||
|
||||
@@ -22,10 +24,12 @@ X509_STORE_get0_param() retrieves an internal pointer to the verification
|
||||
parameters for B<ctx>. The returned pointer must not be freed by the
|
||||
calling application
|
||||
|
||||
X509_STORE_get0_objects() retrieve an internal pointer to the store's
|
||||
X509_STORE_get0_objects() retrieves an internal pointer to the store's
|
||||
X509 object cache. The cache contains B<X509> and B<X509_CRL> objects. The
|
||||
returned pointer must not be freed by the calling application.
|
||||
|
||||
X509_STORE_get1_all_certs() returns a list of all certificates in the store.
|
||||
The caller is responsible for freeing the returned list.
|
||||
|
||||
=head1 RETURN VALUES
|
||||
|
||||
@@ -36,6 +40,9 @@ X509_STORE_set1_param() returns 1 for success and 0 for failure.
|
||||
|
||||
X509_STORE_get0_objects() returns a pointer to a stack of B<X509_OBJECT>.
|
||||
|
||||
X509_STORE_get1_all_certs() returns a pointer to a stack of the retrieved
|
||||
certificates on success, else NULL.
|
||||
|
||||
=head1 SEE ALSO
|
||||
|
||||
L<X509_STORE_new(3)>
|
||||
@@ -44,6 +51,7 @@ L<X509_STORE_new(3)>
|
||||
|
||||
B<X509_STORE_get0_param> and B<X509_STORE_get0_objects> were added in
|
||||
OpenSSL 1.1.0.
|
||||
B<X509_STORE_get1_certs> was added in OpenSSL 3.0.
|
||||
|
||||
=head1 COPYRIGHT
|
||||
|
||||
|
||||
Reference in New Issue
Block a user