summaryrefslogtreecommitdiffstats
path: root/secure/lib/libssl/man/SSL_CTX_set_mode.3
blob: b81011fd3a0366dde8ce92127d3de36e88c015ee (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
.\" Automatically generated by Pod::Man 2.28 (Pod::Simple 3.30)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" Set up some character translations and predefined strings.  \*(-- will
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
.\" nothing in troff, for use with C<>.
.tr \(*W-
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.ie n \{\
.    ds -- \(*W-
.    ds PI pi
.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
.    ds L" ""
.    ds R" ""
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds -- \|\(em\|
.    ds PI \(*p
.    ds L" ``
.    ds R" ''
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is turned on, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{
.    if \nF \{
.        de IX
.        tm Index:\\$1\t\\n%\t"\\$2"
..
.        if !\nF==2 \{
.            nr % 0
.            nr F 2
.        \}
.    \}
.\}
.rr rF
.\"
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
.\" Fear.  Run.  Save yourself.  No user-serviceable parts.
.    \" fudge factors for nroff and troff
.if n \{\
.    ds #H 0
.    ds #V .8m
.    ds #F .3m
.    ds #[ \f1
.    ds #] \fP
.\}
.if t \{\
.    ds #H ((1u-(\\\\n(.fu%2u))*.13m)
.    ds #V .6m
.    ds #F 0
.    ds #[ \&
.    ds #] \&
.\}
.    \" simple accents for nroff and troff
.if n \{\
.    ds ' \&
.    ds ` \&
.    ds ^ \&
.    ds , \&
.    ds ~ ~
.    ds /
.\}
.if t \{\
.    ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
.    ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
.    ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
.    ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
.    ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
.    ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
.\}
.    \" troff and (daisy-wheel) nroff accents
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
.ds ae a\h'-(\w'a'u*4/10)'e
.ds Ae A\h'-(\w'A'u*4/10)'E
.    \" corrections for vroff
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
.    \" for low resolution devices (crt and lpr)
.if \n(.H>23 .if \n(.V>19 \
\{\
.    ds : e
.    ds 8 ss
.    ds o a
.    ds d- d\h'-1'\(ga
.    ds D- D\h'-1'\(hy
.    ds th \o'bp'
.    ds Th \o'LP'
.    ds ae ae
.    ds Ae AE
.\}
.rm #[ #] #H #V #F C
.\" ========================================================================
.\"
.IX Title "SSL_CTX_set_mode 3"
.TH SSL_CTX_set_mode 3 "2015-06-11" "1.0.1n" "OpenSSL"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH "NAME"
SSL_CTX_set_mode, SSL_set_mode, SSL_CTX_get_mode, SSL_get_mode \- manipulate SSL engine mode
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
.Vb 1
\& #include <openssl/ssl.h>
\&
\& long SSL_CTX_set_mode(SSL_CTX *ctx, long mode);
\& long SSL_set_mode(SSL *ssl, long mode);
\&
\& long SSL_CTX_get_mode(SSL_CTX *ctx);
\& long SSL_get_mode(SSL *ssl);
.Ve
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
\&\fISSL_CTX_set_mode()\fR adds the mode set via bitmask in \fBmode\fR to \fBctx\fR.
Options already set before are not cleared.
.PP
\&\fISSL_set_mode()\fR adds the mode set via bitmask in \fBmode\fR to \fBssl\fR.
Options already set before are not cleared.
.PP
\&\fISSL_CTX_get_mode()\fR returns the mode set for \fBctx\fR.
.PP
\&\fISSL_get_mode()\fR returns the mode set for \fBssl\fR.
.SH "NOTES"
.IX Header "NOTES"
The following mode changes are available:
.IP "\s-1SSL_MODE_ENABLE_PARTIAL_WRITE\s0" 4
.IX Item "SSL_MODE_ENABLE_PARTIAL_WRITE"
Allow SSL_write(..., n) to return r with 0 < r < n (i.e. report success
when just a single record has been written). When not set (the default),
\&\fISSL_write()\fR will only report success once the complete chunk was written.
Once \fISSL_write()\fR returns with r, r bytes have been successfully written
and the next call to \fISSL_write()\fR must only send the n\-r bytes left,
imitating the behaviour of \fIwrite()\fR.
.IP "\s-1SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER\s0" 4
.IX Item "SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER"
Make it possible to retry \fISSL_write()\fR with changed buffer location
(the buffer contents must stay the same). This is not the default to avoid
the misconception that non-blocking \fISSL_write()\fR behaves like
non-blocking \fIwrite()\fR.
.IP "\s-1SSL_MODE_AUTO_RETRY\s0" 4
.IX Item "SSL_MODE_AUTO_RETRY"
Never bother the application with retries if the transport is blocking.
If a renegotiation take place during normal operation, a
\&\fISSL_read\fR\|(3) or \fISSL_write\fR\|(3) would return
with \-1 and indicate the need to retry with \s-1SSL_ERROR_WANT_READ.\s0
In a non-blocking environment applications must be prepared to handle
incomplete read/write operations.
In a blocking environment, applications are not always prepared to
deal with read/write operations returning without success report. The
flag \s-1SSL_MODE_AUTO_RETRY\s0 will cause read/write operations to only
return after the handshake and successful completion.
.IP "\s-1SSL_MODE_RELEASE_BUFFERS\s0" 4
.IX Item "SSL_MODE_RELEASE_BUFFERS"
When we no longer need a read buffer or a write buffer for a given \s-1SSL,\s0
then release the memory we were using to hold it.  Released memory is
either appended to a list of unused \s-1RAM\s0 chunks on the \s-1SSL_CTX,\s0 or simply
freed if the list of unused chunks would become longer than 
\&\s-1SSL_CTX\-\s0>freelist_max_len, which defaults to 32.  Using this flag can
save around 34k per idle \s-1SSL\s0 connection.
This flag has no effect on \s-1SSL\s0 v2 connections, or on \s-1DTLS\s0 connections.
.IP "\s-1SSL_MODE_SEND_FALLBACK_SCSV\s0" 4
.IX Item "SSL_MODE_SEND_FALLBACK_SCSV"
Send \s-1TLS_FALLBACK_SCSV\s0 in the ClientHello.
To be set only by applications that reconnect with a downgraded protocol
version; see draft\-ietf\-tls\-downgrade\-scsv\-00 for details.
.Sp
\&\s-1DO NOT ENABLE THIS\s0 if your application attempts a normal handshake.
Only use this in explicit fallback retries, following the guidance
in draft\-ietf\-tls\-downgrade\-scsv\-00.
.SH "RETURN VALUES"
.IX Header "RETURN VALUES"
\&\fISSL_CTX_set_mode()\fR and \fISSL_set_mode()\fR return the new mode bitmask
after adding \fBmode\fR.
.PP
\&\fISSL_CTX_get_mode()\fR and \fISSL_get_mode()\fR return the current bitmask.
.SH "SEE ALSO"
.IX Header "SEE ALSO"
\&\fIssl\fR\|(3), \fISSL_read\fR\|(3), \fISSL_write\fR\|(3)
.SH "HISTORY"
.IX Header "HISTORY"
\&\s-1SSL_MODE_AUTO_RETRY\s0 as been added in OpenSSL 0.9.6.
OpenPOWER on IntegriCloud