diff options
author | kris <kris@FreeBSD.org> | 2001-07-19 19:59:37 +0000 |
---|---|---|
committer | kris <kris@FreeBSD.org> | 2001-07-19 19:59:37 +0000 |
commit | 3b19ada1e8e5f87b844d2cc1e72907cfb7774fb6 (patch) | |
tree | 97ecedd5f90991a7abe96b7ca0cb51fa579341b5 /crypto/openssl/doc/ssl | |
parent | 12896e829e9474d92c70a1528cc64270e9dc08ad (diff) | |
download | FreeBSD-src-3b19ada1e8e5f87b844d2cc1e72907cfb7774fb6.zip FreeBSD-src-3b19ada1e8e5f87b844d2cc1e72907cfb7774fb6.tar.gz |
Initial import of OpenSSL 0.9.6b
Diffstat (limited to 'crypto/openssl/doc/ssl')
-rw-r--r-- | crypto/openssl/doc/ssl/SSL_CTX_get_ex_new_index.pod | 2 | ||||
-rw-r--r-- | crypto/openssl/doc/ssl/SSL_CTX_load_verify_locations.pod | 14 | ||||
-rw-r--r-- | crypto/openssl/doc/ssl/SSL_CTX_set_client_CA_list.pod | 24 | ||||
-rw-r--r-- | crypto/openssl/doc/ssl/SSL_CTX_set_session_cache_mode.pod | 2 | ||||
-rw-r--r-- | crypto/openssl/doc/ssl/SSL_SESSION_get_ex_new_index.pod | 2 | ||||
-rw-r--r-- | crypto/openssl/doc/ssl/SSL_get_error.pod | 11 | ||||
-rw-r--r-- | crypto/openssl/doc/ssl/SSL_get_ex_new_index.pod | 2 | ||||
-rw-r--r-- | crypto/openssl/doc/ssl/SSL_get_peer_certificate.pod | 9 | ||||
-rw-r--r-- | crypto/openssl/doc/ssl/SSL_read.pod | 17 | ||||
-rw-r--r-- | crypto/openssl/doc/ssl/SSL_shutdown.pod | 2 | ||||
-rw-r--r-- | crypto/openssl/doc/ssl/SSL_write.pod | 11 |
11 files changed, 72 insertions, 24 deletions
diff --git a/crypto/openssl/doc/ssl/SSL_CTX_get_ex_new_index.pod b/crypto/openssl/doc/ssl/SSL_CTX_get_ex_new_index.pod index 1506743..5686faf 100644 --- a/crypto/openssl/doc/ssl/SSL_CTX_get_ex_new_index.pod +++ b/crypto/openssl/doc/ssl/SSL_CTX_get_ex_new_index.pod @@ -40,7 +40,7 @@ SSL_CTX_get_ex_data() is used to retrieve the information for B<idx> from B<ctx>. A detailed description for the B<*_get_ex_new_index()> functionality -can be found in L<RSA_get_ex_new_index.pod(3)|RSA_get_ex_new_index.pod(3)>. +can be found in L<RSA_get_ex_new_index(3)|RSA_get_ex_new_index(3)>. The B<*_get_ex_data()> and B<*_set_ex_data()> functionality is described in L<CRYPTO_set_ex_data(3)|CRYPTO_set_ex_data(3)>. diff --git a/crypto/openssl/doc/ssl/SSL_CTX_load_verify_locations.pod b/crypto/openssl/doc/ssl/SSL_CTX_load_verify_locations.pod index 88f18bd..0f63537 100644 --- a/crypto/openssl/doc/ssl/SSL_CTX_load_verify_locations.pod +++ b/crypto/openssl/doc/ssl/SSL_CTX_load_verify_locations.pod @@ -33,10 +33,6 @@ which can be used e.g. for descriptions of the certificates. The B<CAfile> is processed on execution of the SSL_CTX_load_verify_locations() function. -If on an TLS/SSL server no special setting is performed using *client_CA_list() -functions, the certificates contained in B<CAfile> are listed to the client -as available CAs during the TLS/SSL handshake. - If B<CApath> is not NULL, it points to a directory containing CA certificates in PEM format. The files each contain one CA certificate. The files are looked up by the CA subject name hash value, which must hence be available. @@ -50,9 +46,6 @@ The certificates in B<CApath> are only looked up when required, e.g. when building the certificate chain or when actually performing the verification of a peer certificate. -On a server, the certificates in B<CApath> are not listed as available -CA certificates to a client during a TLS/SSL handshake. - When looking up CA certificates, the OpenSSL library will first search the certificates in B<CAfile>, then those in B<CApath>. Certificate matching is done based on the subject name, the key identifier (if present), and the @@ -62,6 +55,13 @@ matching the parameters is found, the verification process will be performed; no other certificates for the same parameters will be searched in case of failure. +In server mode, when requesting a client certificate, the server must send +the list of CAs of which it will accept client certificates. This list +is not influenced by the contents of B<CAfile> or B<CApath> and must +explicitely be set using the +L<SSL_CTX_set_client_CA_list(3)|SSL_CTX_set_client_CA_list(3)> +family of functions. + When building its own certificate chain, an OpenSSL client/server will try to fill in missing certificates from B<CAfile>/B<CApath>, if the certificate chain was not explicitly specified (see diff --git a/crypto/openssl/doc/ssl/SSL_CTX_set_client_CA_list.pod b/crypto/openssl/doc/ssl/SSL_CTX_set_client_CA_list.pod index 81e3127..632b556 100644 --- a/crypto/openssl/doc/ssl/SSL_CTX_set_client_CA_list.pod +++ b/crypto/openssl/doc/ssl/SSL_CTX_set_client_CA_list.pod @@ -36,25 +36,23 @@ the chosen B<ssl>, overriding the setting valid for B<ssl>'s SSL_CTX object. When a TLS/SSL server requests a client certificate (see B<SSL_CTX_set_verify_options()>), it sends a list of CAs, for which -it will accept certificates, to the client. If no special list is provided, -the CAs available using the B<CAfile> option in -L<SSL_CTX_load_verify_locations(3)|SSL_CTX_load_verify_locations(3)> -are sent. +it will accept certificates, to the client. -This list can be explicitly set using the SSL_CTX_set_client_CA_list() for +This list must explicitly be set using SSL_CTX_set_client_CA_list() for B<ctx> and SSL_set_client_CA_list() for the specific B<ssl>. The list specified overrides the previous setting. The CAs listed do not become trusted (B<list> only contains the names, not the complete certificates); use L<SSL_CTX_load_verify_locations(3)|SSL_CTX_load_verify_locations(3)> to additionally load them for verification. +If the list of acceptable CAs is compiled in a file, the +L<SSL_load_client_CA_file(3)|SSL_load_client_CA_file(3)> +function can be used to help importing the necessary data. + SSL_CTX_add_client_CA() and SSL_add_client_CA() can be used to add additional items the list of client CAs. If no list was specified before using SSL_CTX_set_client_CA_list() or SSL_set_client_CA_list(), a new client -CA list for B<ctx> or B<ssl> (as appropriate) is opened. The CAs implicitly -specified using -L<SSL_CTX_load_verify_locations(3)|SSL_CTX_load_verify_locations(3)> -are no longer used automatically. +CA list for B<ctx> or B<ssl> (as appropriate) is opened. These functions are only useful for TLS/SSL servers. @@ -80,11 +78,17 @@ to find out the reason. =back +=head1 EXAMPLES + +Scan all certificates in B<CAfile> and list them as acceptable CAs: + + SSL_CTX_set_client_CA_list(ctx,SSL_load_client_CA_file(CAfile)); + =head1 SEE ALSO L<ssl(3)|ssl(3)>, L<SSL_get_client_CA_list(3)|SSL_get_client_CA_list(3)>, -L<SSL_load_client_CA_file(3)|SSL_load_client_CA_file(3)> +L<SSL_load_client_CA_file(3)|SSL_load_client_CA_file(3)>, L<SSL_CTX_load_verify_locations(3)|SSL_CTX_load_verify_locations(3)> =cut diff --git a/crypto/openssl/doc/ssl/SSL_CTX_set_session_cache_mode.pod b/crypto/openssl/doc/ssl/SSL_CTX_set_session_cache_mode.pod index 083766f..8bbfc78 100644 --- a/crypto/openssl/doc/ssl/SSL_CTX_set_session_cache_mode.pod +++ b/crypto/openssl/doc/ssl/SSL_CTX_set_session_cache_mode.pod @@ -101,7 +101,7 @@ L<SSL_CTX_sess_number(3)|SSL_CTX_sess_number(3)>, L<SSL_CTX_sess_set_cache_size(3)|SSL_CTX_sess_set_cache_size(3)>, L<SSL_CTX_sess_set_get_cb(3)|SSL_CTX_sess_set_get_cb(3)>, L<SSL_CTX_set_session_id_context(3)|SSL_CTX_set_session_id_context(3)>, -L<SSL_CTX_set_timeout.pod(3)|SSL_CTX_set_timeout.pod(3)>, +L<SSL_CTX_set_timeout(3)|SSL_CTX_set_timeout(3)>, L<SSL_CTX_flush_sessions(3)|SSL_CTX_flush_sessions(3)> =cut diff --git a/crypto/openssl/doc/ssl/SSL_SESSION_get_ex_new_index.pod b/crypto/openssl/doc/ssl/SSL_SESSION_get_ex_new_index.pod index dd5cb4f..da0bcf1 100644 --- a/crypto/openssl/doc/ssl/SSL_SESSION_get_ex_new_index.pod +++ b/crypto/openssl/doc/ssl/SSL_SESSION_get_ex_new_index.pod @@ -40,7 +40,7 @@ SSL_SESSION_get_ex_data() is used to retrieve the information for B<idx> from B<session>. A detailed description for the B<*_get_ex_new_index()> functionality -can be found in L<RSA_get_ex_new_index.pod(3)|RSA_get_ex_new_index.pod(3)>. +can be found in L<RSA_get_ex_new_index(3)|RSA_get_ex_new_index(3)>. The B<*_get_ex_data()> and B<*_set_ex_data()> functionality is described in L<CRYPTO_set_ex_data(3)|CRYPTO_set_ex_data(3)>. diff --git a/crypto/openssl/doc/ssl/SSL_get_error.pod b/crypto/openssl/doc/ssl/SSL_get_error.pod index fefaf61..d95eec7 100644 --- a/crypto/openssl/doc/ssl/SSL_get_error.pod +++ b/crypto/openssl/doc/ssl/SSL_get_error.pod @@ -69,6 +69,17 @@ to read data. This is mainly because TLS/SSL handshakes may occur at any time during the protocol (initiated by either the client or the server); SSL_read(), SSL_peek(), and SSL_write() will handle any pending handshakes. +=item SSL_ERROR_WANT_CONNECT + +The operation did not complete; the same TLS/SSL I/O function should be +called again later. The underlying BIO was not connected yet to the peer +and the call would block in connect(). The SSL function should be +called again when the connection is established. This messages can only +appear with a BIO_s_connect() BIO. +In order to find out, when the connection has been successfully established, +on many platforms select() or poll() for writing on the socket file descriptor +can be used. + =item SSL_ERROR_WANT_X509_LOOKUP The operation did not complete because an application callback set by diff --git a/crypto/openssl/doc/ssl/SSL_get_ex_new_index.pod b/crypto/openssl/doc/ssl/SSL_get_ex_new_index.pod index 2b69bb1..6644ef8 100644 --- a/crypto/openssl/doc/ssl/SSL_get_ex_new_index.pod +++ b/crypto/openssl/doc/ssl/SSL_get_ex_new_index.pod @@ -40,7 +40,7 @@ SSL_get_ex_data() is used to retrieve the information for B<idx> from B<ssl>. A detailed description for the B<*_get_ex_new_index()> functionality -can be found in L<RSA_get_ex_new_index.pod(3)|RSA_get_ex_new_index.pod(3)>. +can be found in L<RSA_get_ex_new_index(3)|RSA_get_ex_new_index(3)>. The B<*_get_ex_data()> and B<*_set_ex_data()> functionality is described in L<CRYPTO_set_ex_data(3)|CRYPTO_set_ex_data(3)>. diff --git a/crypto/openssl/doc/ssl/SSL_get_peer_certificate.pod b/crypto/openssl/doc/ssl/SSL_get_peer_certificate.pod index 1102c7f..18d1db5 100644 --- a/crypto/openssl/doc/ssl/SSL_get_peer_certificate.pod +++ b/crypto/openssl/doc/ssl/SSL_get_peer_certificate.pod @@ -17,6 +17,12 @@ peer presented. If the peer did not present a certificate, NULL is returned. =head1 NOTES +Due to the protocol definition, a TLS/SSL server will always send a +certificate, if present. A client will only send a certificate when +explicitely requested to do so by the server (see +L<SSL_CTX_set_verify(3)|SSL_CTX_set_verify(3)>). If an anonymous cipher +is used, no certificates are sent. + That a certificate is returned does not indicate information about the verification state, use L<SSL_get_verify_result(3)|SSL_get_verify_result(3)> to check the verification state. @@ -43,6 +49,7 @@ The return value points to the certificate presented by the peer. =head1 SEE ALSO -L<ssl(3)|ssl(3)>, L<SSL_get_verify_result(3)|SSL_get_verify_result(3)> +L<ssl(3)|ssl(3)>, L<SSL_get_verify_result(3)|SSL_get_verify_result(3)>, +L<SSL_CTX_set_verify(3)|SSL_CTX_set_verify(3)> =cut diff --git a/crypto/openssl/doc/ssl/SSL_read.pod b/crypto/openssl/doc/ssl/SSL_read.pod index 7db5ee0..cc7aa1a 100644 --- a/crypto/openssl/doc/ssl/SSL_read.pod +++ b/crypto/openssl/doc/ssl/SSL_read.pod @@ -29,7 +29,22 @@ initialized to client or server mode. This is not the case if a generic method is being used (see L<SSL_CTX_new(3)|SSL_CTX_new(3)>, so that L<SSL_set_connect_state(3)|SSL_set_connect_state(3)> or SSL_set_accept_state() must be used before the first call to an SSL_read() or -L<SSL_write(3)|SSL_write(3)> function. +L<SSL_write(3)|SSL_write(3)> function). + +SSL_read() works based on the SSL/TLS records. The data are received in +records (with a maximum record size of 16kB for SSLv3/TLSv1). Only when a +record has been completely received, it can be processed (decryption and +check of integrity). Therefore data that was not retrieved at the last +call of SSL_read() can still be buffered inside the SSL layer and will be +retrieved on the next call to SSL_read(). If B<num> is higher than the +number of bytes buffered, SSL_read() will return with the bytes buffered. +If no more bytes are in the buffer, SSL_read() will trigger the processing +of the next record. Only when the record has been received and processed +completely, SSL_read() will return reporting success. At most the contents +of the record will be returned. As the size of an SSL/TLS record may exceed +the maximum packet size of the underlying transport (e.g. TCP), it may +be necessary to read several packets from the transport layer before the +record is complete and SSL_read() can succeed. If the underlying BIO is B<blocking>, SSL_read() will only return, once the read operation has been finished or an error occurred, except when a diff --git a/crypto/openssl/doc/ssl/SSL_shutdown.pod b/crypto/openssl/doc/ssl/SSL_shutdown.pod index 7988dd3..c4ae670 100644 --- a/crypto/openssl/doc/ssl/SSL_shutdown.pod +++ b/crypto/openssl/doc/ssl/SSL_shutdown.pod @@ -66,7 +66,7 @@ Call SSL_get_error() with the return value B<ret> to find out the reason. L<SSL_get_error(3)|SSL_get_error(3)>, L<SSL_connect(3)|SSL_connect(3)>, L<SSL_accept(3)|SSL_accept(3)>, L<SSL_set_shutdown(3)|SSL_set_shutdown(3)>, -L<SSL_clear(3)|SSL_clear(3), L<SSL_free(3)|SSL_free(3)>, +L<SSL_clear(3)|SSL_clear(3)>, L<SSL_free(3)|SSL_free(3)>, L<ssl(3)|ssl(3)>, L<bio(3)|bio(3)> =cut diff --git a/crypto/openssl/doc/ssl/SSL_write.pod b/crypto/openssl/doc/ssl/SSL_write.pod index be1ad76..b0dfefa 100644 --- a/crypto/openssl/doc/ssl/SSL_write.pod +++ b/crypto/openssl/doc/ssl/SSL_write.pod @@ -50,6 +50,17 @@ non-blocking socket, nothing is to be done, but select() can be used to check for the required condition. When using a buffering BIO, like a BIO pair, data must be written into or retrieved out of the BIO before being able to continue. +SSL_write() will only return with success, when the complete contents +of B<buf> of length B<num> has been written. This default behaviour +can be changed with the SSL_MODE_ENABLE_PARTIAL_WRITE option of +L<SSL_CTX_set_mode(3)|SSL_CTX_set_mode(3)>. When this flag is set, +SSL_write() will also return with success, when a partial write has been +successfully completed. In this case the SSL_write() operation is considered +completed. The bytes are sent and a new SSL_write() operation with a new +buffer (with the already sent bytes removed) must be started. +A partial write is performed with the size of a message block, which is +16kB for SSLv3/TLSv1. + =head1 WARNING When an SSL_write() operation has to be repeated because of |