From baef74520563dff454420fc45cbb65b465668325 Mon Sep 17 00:00:00 2001 From: simon Date: Mon, 22 Nov 2010 18:29:00 +0000 Subject: Regenerate manual pages for OpenSSL 0.9.8p. --- secure/lib/libssl/man/SSL_CTX_set_verify.3 | 109 +++++++++++------------------ 1 file changed, 40 insertions(+), 69 deletions(-) (limited to 'secure/lib/libssl/man/SSL_CTX_set_verify.3') diff --git a/secure/lib/libssl/man/SSL_CTX_set_verify.3 b/secure/lib/libssl/man/SSL_CTX_set_verify.3 index 7a472f9..7493237 100644 --- a/secure/lib/libssl/man/SSL_CTX_set_verify.3 +++ b/secure/lib/libssl/man/SSL_CTX_set_verify.3 @@ -1,15 +1,7 @@ -.\" Automatically generated by Pod::Man v1.37, Pod::Parser v1.37 +.\" Automatically generated by Pod::Man 2.22 (Pod::Simple 3.07) .\" .\" Standard preamble: .\" ======================================================================== -.de Sh \" Subsection heading -.br -.if t .Sp -.ne 5 -.PP -\fB\\$1\fR -.PP -.. .de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp @@ -25,11 +17,11 @@ .. .\" Set up some character translations and predefined strings. \*(-- will .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left -.\" double quote, and \*(R" will give a right double quote. | will give a -.\" real vertical bar. \*(C+ will give a nicer C++. Capital omega is used to -.\" do unbreakable dashes and therefore won't be available. \*(C` and \*(C' -.\" expand to `' in nroff, nothing in troff, for use with C<>. -.tr \(*W-|\(bv\*(Tr +.\" double quote, and \*(R" will give a right double quote. \*(C+ will +.\" give a nicer C++. Capital omega is used to do unbreakable dashes and +.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, +.\" nothing in troff, for use with C<>. +.tr \(*W- .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' .ie n \{\ . ds -- \(*W- @@ -48,22 +40,25 @@ . ds R" '' 'br\} .\" +.\" Escape single quotes in literal strings from groff's Unicode transform. +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" .\" If the F register is turned on, we'll generate index entries on stderr for -.\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index +.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. -.if \nF \{\ +.ie \nF \{\ . de IX . tm Index:\\$1\t\\n%\t"\\$2" .. . nr % 0 . rr F .\} -.\" -.\" For nroff, turn off justification. Always turn off hyphenation; it makes -.\" way too many mistakes in technical documents. -.hy 0 -.if n .na +.el \{\ +. de IX +.. +.\} .\" .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). .\" Fear. Run. Save yourself. No user-serviceable parts. @@ -129,25 +124,25 @@ .\" ======================================================================== .\" .IX Title "SSL_CTX_set_verify 3" -.TH SSL_CTX_set_verify 3 "2010-03-24" "0.9.8n" "OpenSSL" +.TH SSL_CTX_set_verify 3 "2010-11-16" "0.9.8p" "OpenSSL" +.\" For nroff, turn off justification. Always turn off hyphenation; it makes +.\" way too many mistakes in technical documents. +.if n .ad l +.nh .SH "NAME" SSL_CTX_set_verify, SSL_set_verify, SSL_CTX_set_verify_depth, SSL_set_verify_depth \- set peer certificate verification parameters .SH "SYNOPSIS" .IX Header "SYNOPSIS" .Vb 1 \& #include -.Ve -.PP -.Vb 6 +\& \& void SSL_CTX_set_verify(SSL_CTX *ctx, int mode, \& int (*verify_callback)(int, X509_STORE_CTX *)); \& void SSL_set_verify(SSL *s, int mode, \& int (*verify_callback)(int, X509_STORE_CTX *)); \& void SSL_CTX_set_verify_depth(SSL_CTX *ctx,int depth); \& void SSL_set_verify_depth(SSL *s, int depth); -.Ve -.PP -.Vb 1 +\& \& int verify_callback(int preverify_ok, X509_STORE_CTX *x509_ctx); .Ve .SH "DESCRIPTION" @@ -300,7 +295,7 @@ into/retrieve application data from the \s-1SSL\s0 structure (see \fISSL_get_ex_new_index\fR\|(3), \&\fISSL_get_ex_data_X509_STORE_CTX_idx\fR\|(3)). .PP -.Vb 15 +.Vb 10 \& ... \& typedef struct { \& int verbose_mode; @@ -316,28 +311,20 @@ into/retrieve application data from the \s-1SSL\s0 structure \& int err, depth; \& SSL *ssl; \& mydata_t *mydata; -.Ve -.PP -.Vb 3 +\& \& err_cert = X509_STORE_CTX_get_current_cert(ctx); \& err = X509_STORE_CTX_get_error(ctx); \& depth = X509_STORE_CTX_get_error_depth(ctx); -.Ve -.PP -.Vb 6 +\& \& /* \& * Retrieve the pointer to the SSL of the connection currently treated \& * and the application specific data stored into the SSL object. \& */ \& ssl = X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()); \& mydata = SSL_get_ex_data(ssl, mydata_index); -.Ve -.PP -.Vb 1 +\& \& X509_NAME_oneline(X509_get_subject_name(err_cert), buf, 256); -.Ve -.PP -.Vb 22 +\& \& /* \& * Catch a too long certificate chain. The depth limit set using \& * SSL_CTX_set_verify_depth() is by purpose set to "limit+1" so @@ -347,7 +334,7 @@ into/retrieve application data from the \s-1SSL\s0 structure \& * be found explicitly; only errors introduced by cutting off the \& * additional certificates would be logged. \& */ -\& if (depth > mydata->verify_depth) { +\& if (depth > mydata\->verify_depth) { \& preverify_ok = 0; \& err = X509_V_ERR_CERT_CHAIN_TOO_LONG; \& X509_STORE_CTX_set_error(ctx, err); @@ -356,66 +343,50 @@ into/retrieve application data from the \s-1SSL\s0 structure \& printf("verify error:num=%d:%s:depth=%d:%s\en", err, \& X509_verify_cert_error_string(err), depth, buf); \& } -\& else if (mydata->verbose_mode) +\& else if (mydata\->verbose_mode) \& { \& printf("depth=%d:%s\en", depth, buf); \& } -.Ve -.PP -.Vb 9 +\& \& /* \& * At this point, err contains the last verification error. We can use \& * it for something special \& */ \& if (!preverify_ok && (err == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT)) \& { -\& X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert), buf, 256); +\& X509_NAME_oneline(X509_get_issuer_name(ctx\->current_cert), buf, 256); \& printf("issuer= %s\en", buf); \& } -.Ve -.PP -.Vb 6 -\& if (mydata->always_continue) +\& +\& if (mydata\->always_continue) \& return 1; \& else \& return preverify_ok; \& } \& ... -.Ve -.PP -.Vb 1 +\& \& mydata_t mydata; -.Ve -.PP -.Vb 2 +\& \& ... \& mydata_index = SSL_get_ex_new_index(0, "mydata index", NULL, NULL, NULL); -.Ve -.PP -.Vb 3 +\& \& ... \& SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER|SSL_VERIFY_CLIENT_ONCE, \& verify_callback); -.Ve -.PP -.Vb 5 +\& \& /* \& * Let the verify_callback catch the verify_depth error so that we get \& * an appropriate error in the logfile. \& */ \& SSL_CTX_set_verify_depth(verify_depth + 1); -.Ve -.PP -.Vb 6 +\& \& /* \& * Set up the SSL specific data into "mydata" and store it into th SSL \& * structure. \& */ \& mydata.verify_depth = verify_depth; ... \& SSL_set_ex_data(ssl, mydata_index, &mydata); -.Ve -.PP -.Vb 9 +\& \& ... \& SSL_accept(ssl); /* check of success left out for clarity */ \& if (peer = SSL_get_peer_certificate(ssl)) -- cgit v1.1