X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=doc%2Fssl%2FSSL_CONF_cmd.pod;h=bbda10a76aa4467f22342ac3aad349f3e5103bbb;hp=0fbf0d75df9a488f6c642d57d60998ae9b649c9f;hb=f0ef019da28a7b8ad81f65c2fbd2fcc9c88e5c52;hpb=65f2a56580ec1b5ad27f1c898cd6891532d898a3 diff --git a/doc/ssl/SSL_CONF_cmd.pod b/doc/ssl/SSL_CONF_cmd.pod index 0fbf0d75df..bbda10a76a 100644 --- a/doc/ssl/SSL_CONF_cmd.pod +++ b/doc/ssl/SSL_CONF_cmd.pod @@ -9,6 +9,8 @@ SSL_CONF_cmd - send configuration command #include int SSL_CONF_cmd(SSL_CONF_CTX *cctx, const char *cmd, const char *value); + int SSL_CONF_cmd_value_type(SSL_CONF_CTX *cctx, const char *cmd); + int SSL_CONF_finish(SSL_CONF_CTX *cctx); =head1 DESCRIPTION @@ -17,11 +19,17 @@ optional parameter B on B. Its purpose is to simplify application configuration of B or B structures by providing a common framework for command line options or configuration files. +SSL_CONF_cmd_value_type() returns the type of value that B refers to. + +The function SSL_CONF_finish() must be called after all configuration +operations have been completed. It is used to finalise any operations +or to process defaults. + =head1 SUPPORTED COMMAND LINE COMMANDS Currently supported B names for command lines (i.e. when the flag B is set) are listed below. Note: all B names -and are case sensitive. Unless otherwise stated commands can be used by +are case sensitive. Unless otherwise stated commands can be used by both clients and servers and the B parameter is not used. The default prefix for command line commands is B<-> and that is reflected below. @@ -80,6 +88,27 @@ Sets the cipher suite list to B. Note: syntax checking of B is currently not performed unless a B or B structure is associated with B. +=item B<-cert> + +Attempts to use the file B as the certificate for the appropriate +context. It currently uses SSL_CTX_use_cerificate_chain_file if an B +structure is set or SSL_use_certifcate_file with filetype PEM if an B +structure is set. This option is only supported if certificate operations +are permitted. + +=item B<-key> + +Attempts to use the file B as the private key for the appropriate +context. This option is only supported if certificate operations +are permitted. Note: if no B<-key> option is set then a private key is +not loaded: it does not currently use the B<-cert> file. + +=item B<-dhparam> + +Attempts to use the file B as the set of temporary DH parameters for +the appropriate context. This option is only supported if certificate +operations are permitted. + =item B<-no_ssl2>, B<-no_ssl3>, B<-no_tls1>, B<-no_tls1_1>, B<-no_tls1_2> Disables protocol support for SSLv2, SSLv3, TLS 1.0, TLS 1.1 or TLS 1.2 @@ -104,6 +133,10 @@ Use server and not client preference order when determining which cipher suite, signature algorithm or elliptic curve to use for an incoming connection. Equivalent to B. Only used by servers. +=item B<-no_resumption_on_reneg> + +set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION flag. Only used by servers. + =item B<-legacyrenegotiation> permits the use of unsafe legacy renegotiation. Equivalent to setting @@ -147,6 +180,32 @@ Sets the cipher suite list to B. Note: syntax checking of B is currently not performed unless an B or B structure is associated with B. +=item B + +Attempts to use the file B as the certificate for the appropriate +context. It currently uses SSL_CTX_use_cerificate_chain_file if an B +structure is set or SSL_use_certifcate_file with filetype PEM if an B +structure is set. This option is only supported if certificate operations +are permitted. + +=item B + +Attempts to use the file B as the private key for the appropriate +context. This option is only supported if certificate operations +are permitted. Note: if no B<-key> option is set then a private key is +not loaded: it does not currently use the B file. + +=item B + +Attempts to use the file B in the "serverinfo" extension using the +function SSL_CTX_use_serverinfo_file. + +=item B + +Attempts to use the file B as the set of temporary DH parameters for +the appropriate context. This option is only supported if certificate +operations are permitted. + =item B This sets the supported signature algorithms for TLS v1.2. For clients this @@ -237,6 +296,9 @@ determining which cipher suite, signature algorithm or elliptic curve to use for an incoming connection. Equivalent to B. Only used by servers. +B set +B flag. Only used by servers. + B permits the use of unsafe legacy renegotiation. Equivalent to B. @@ -246,6 +308,30 @@ Set by default. =back +=head1 SUPPORTED COMMAND TYPES + +The function SSL_CONF_cmd_value_type() currently returns one of the following +types: + +=over 4 + +=item B + +The B string is unrecognised, this return value can be use to flag +syntax errors. + +=item B + +The value is a string without any specific structure. + +=item B + +The value is a file name. + +=item B + +The value is a directory name. + =head1 NOTES The order of operations is significant. This can be used to set either defaults @@ -284,6 +370,12 @@ can be checked instead. If -3 is returned a required argument is missing and an error is indicated. If 0 is returned some other error occurred and this can be reported back to the user. +The function SSL_CONF_cmd_value_type() can be used by applications to +check for the existence of a command or to perform additional syntax +checking or translation of the command value. For example if the return +value is B an application could translate a relative +pathname to an absolute pathname. + =head1 EXAMPLES Set supported signature algorithms: @@ -312,7 +404,7 @@ Set automatic support for any elliptic curve for key exchange: =head1 RETURN VALUES -SSL_CONF_cmd() return 1 if the value of B is recognised and B is +SSL_CONF_cmd() returns 1 if the value of B is recognised and B is B used and 2 if both B and B are used. In other words it returns the number of arguments processed. This is useful when processing command lines. @@ -327,6 +419,8 @@ error occurred attempting to perform the operation: for example due to an error in the syntax of B in this case the error queue may provide additional information. +SSL_CONF_finish() returns 1 for success and 0 for failure. + =head1 SEE ALSO L, @@ -337,6 +431,6 @@ L =head1 HISTORY -SSL_CONF_cmd() was first added to OpenSSL 1.1.0 +SSL_CONF_cmd() was first added to OpenSSL 1.0.2 =cut