diff options
Diffstat (limited to 'secure/lib/libcrypto/man/man7')
| -rw-r--r-- | secure/lib/libcrypto/man/man7/Ed25519.7 | 6 | ||||
| -rw-r--r-- | secure/lib/libcrypto/man/man7/Makefile | 1 | ||||
| -rw-r--r-- | secure/lib/libcrypto/man/man7/RAND.7 | 2 | ||||
| -rw-r--r-- | secure/lib/libcrypto/man/man7/RAND_DRBG.7 | 2 | ||||
| -rw-r--r-- | secure/lib/libcrypto/man/man7/RSA-PSS.7 | 2 | ||||
| -rw-r--r-- | secure/lib/libcrypto/man/man7/SM2.7 | 2 | ||||
| -rw-r--r-- | secure/lib/libcrypto/man/man7/X25519.7 | 6 | ||||
| -rw-r--r-- | secure/lib/libcrypto/man/man7/bio.7 | 2 | ||||
| -rw-r--r-- | secure/lib/libcrypto/man/man7/ct.7 | 2 | ||||
| -rw-r--r-- | secure/lib/libcrypto/man/man7/des_modes.7 | 2 | ||||
| -rw-r--r-- | secure/lib/libcrypto/man/man7/evp.7 | 2 | ||||
| -rw-r--r-- | secure/lib/libcrypto/man/man7/ossl_store-file.7 | 2 | ||||
| -rw-r--r-- | secure/lib/libcrypto/man/man7/ossl_store.7 | 2 | ||||
| -rw-r--r-- | secure/lib/libcrypto/man/man7/passphrase-encoding.7 | 6 | ||||
| -rw-r--r-- | secure/lib/libcrypto/man/man7/proxy-certificates.7 | 478 | ||||
| -rw-r--r-- | secure/lib/libcrypto/man/man7/scrypt.7 | 2 | ||||
| -rw-r--r-- | secure/lib/libcrypto/man/man7/ssl.7 | 2 | ||||
| -rw-r--r-- | secure/lib/libcrypto/man/man7/x509.7 | 2 |
18 files changed, 501 insertions, 22 deletions
diff --git a/secure/lib/libcrypto/man/man7/Ed25519.7 b/secure/lib/libcrypto/man/man7/Ed25519.7 index 20fe73d686ec..d6599c45c1b1 100644 --- a/secure/lib/libcrypto/man/man7/Ed25519.7 +++ b/secure/lib/libcrypto/man/man7/Ed25519.7 @@ -133,7 +133,7 @@ .\" ======================================================================== .\" .IX Title "ED25519 7" -.TH ED25519 7 "2019-09-10" "1.1.1d" "OpenSSL" +.TH ED25519 7 "2020-03-17" "1.1.1e" "OpenSSL" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l @@ -145,7 +145,7 @@ Ed25519, Ed448 \&\- EVP_PKEY Ed25519 and Ed448 support The \fBEd25519\fR and \fBEd448\fR \s-1EVP_PKEY\s0 implementation supports key generation, one-shot digest sign and digest verify using PureEdDSA and \fBEd25519\fR or \fBEd448\fR (see \s-1RFC8032\s0). It has associated private and public key formats compatible with -draft\-ietf\-curdle\-pkix\-04. +\&\s-1RFC 8410.\s0 .PP No additional parameters can be set during key generation, one-shot signing or verification. In particular, because PureEdDSA is used, a digest must \fB\s-1NOT\s0\fR be @@ -213,7 +213,7 @@ output in \s-1PEM\s0 format: \&\fBEVP_DigestVerifyInit\fR\|(3), .SH "COPYRIGHT" .IX Header "COPYRIGHT" -Copyright 2017\-2019 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2017\-2020 The OpenSSL Project Authors. All Rights Reserved. .PP Licensed under the OpenSSL license (the \*(L"License\*(R"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/secure/lib/libcrypto/man/man7/Makefile b/secure/lib/libcrypto/man/man7/Makefile index 34c0ff786be6..a9de694537fb 100644 --- a/secure/lib/libcrypto/man/man7/Makefile +++ b/secure/lib/libcrypto/man/man7/Makefile @@ -13,6 +13,7 @@ MAN+= evp.7 MAN+= ossl_store-file.7 MAN+= ossl_store.7 MAN+= passphrase-encoding.7 +MAN+= proxy-certificates.7 MAN+= scrypt.7 MAN+= ssl.7 MAN+= x509.7 diff --git a/secure/lib/libcrypto/man/man7/RAND.7 b/secure/lib/libcrypto/man/man7/RAND.7 index 9352e577af89..08e278914950 100644 --- a/secure/lib/libcrypto/man/man7/RAND.7 +++ b/secure/lib/libcrypto/man/man7/RAND.7 @@ -133,7 +133,7 @@ .\" ======================================================================== .\" .IX Title "RAND 7" -.TH RAND 7 "2019-09-10" "1.1.1d" "OpenSSL" +.TH RAND 7 "2020-03-17" "1.1.1e" "OpenSSL" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff --git a/secure/lib/libcrypto/man/man7/RAND_DRBG.7 b/secure/lib/libcrypto/man/man7/RAND_DRBG.7 index aab4f1dbf856..af6d6f32f860 100644 --- a/secure/lib/libcrypto/man/man7/RAND_DRBG.7 +++ b/secure/lib/libcrypto/man/man7/RAND_DRBG.7 @@ -133,7 +133,7 @@ .\" ======================================================================== .\" .IX Title "RAND_DRBG 7" -.TH RAND_DRBG 7 "2019-09-10" "1.1.1d" "OpenSSL" +.TH RAND_DRBG 7 "2020-03-17" "1.1.1e" "OpenSSL" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff --git a/secure/lib/libcrypto/man/man7/RSA-PSS.7 b/secure/lib/libcrypto/man/man7/RSA-PSS.7 index 6be71bad5ba0..c298e21625a5 100644 --- a/secure/lib/libcrypto/man/man7/RSA-PSS.7 +++ b/secure/lib/libcrypto/man/man7/RSA-PSS.7 @@ -133,7 +133,7 @@ .\" ======================================================================== .\" .IX Title "RSA-PSS 7" -.TH RSA-PSS 7 "2019-09-10" "1.1.1d" "OpenSSL" +.TH RSA-PSS 7 "2020-03-17" "1.1.1e" "OpenSSL" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff --git a/secure/lib/libcrypto/man/man7/SM2.7 b/secure/lib/libcrypto/man/man7/SM2.7 index 228278eb46f0..a96f85d76a31 100644 --- a/secure/lib/libcrypto/man/man7/SM2.7 +++ b/secure/lib/libcrypto/man/man7/SM2.7 @@ -133,7 +133,7 @@ .\" ======================================================================== .\" .IX Title "SM2 7" -.TH SM2 7 "2019-09-10" "1.1.1d" "OpenSSL" +.TH SM2 7 "2020-03-17" "1.1.1e" "OpenSSL" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff --git a/secure/lib/libcrypto/man/man7/X25519.7 b/secure/lib/libcrypto/man/man7/X25519.7 index 4fcedf08dddd..0356a8755976 100644 --- a/secure/lib/libcrypto/man/man7/X25519.7 +++ b/secure/lib/libcrypto/man/man7/X25519.7 @@ -133,7 +133,7 @@ .\" ======================================================================== .\" .IX Title "X25519 7" -.TH X25519 7 "2019-09-10" "1.1.1d" "OpenSSL" +.TH X25519 7 "2020-03-17" "1.1.1e" "OpenSSL" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l @@ -144,7 +144,7 @@ X25519, X448 \&\- EVP_PKEY X25519 and X448 support .IX Header "DESCRIPTION" The \fBX25519\fR and \fBX448\fR \s-1EVP_PKEY\s0 implementation supports key generation and key derivation using \fBX25519\fR and \fBX448\fR. It has associated private and public -key formats compatible with draft\-ietf\-curdle\-pkix\-03. +key formats compatible with \s-1RFC 8410.\s0 .PP No additional parameters can be set during key generation. .PP @@ -200,7 +200,7 @@ The key derivation example in \fBEVP_PKEY_derive\fR\|(3) can be used with \&\fBEVP_PKEY_derive_set_peer\fR\|(3) .SH "COPYRIGHT" .IX Header "COPYRIGHT" -Copyright 2017\-2019 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2017\-2020 The OpenSSL Project Authors. All Rights Reserved. .PP Licensed under the OpenSSL license (the \*(L"License\*(R"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/secure/lib/libcrypto/man/man7/bio.7 b/secure/lib/libcrypto/man/man7/bio.7 index 2d16323f72a2..3917a5ae9866 100644 --- a/secure/lib/libcrypto/man/man7/bio.7 +++ b/secure/lib/libcrypto/man/man7/bio.7 @@ -133,7 +133,7 @@ .\" ======================================================================== .\" .IX Title "BIO 7" -.TH BIO 7 "2019-09-10" "1.1.1d" "OpenSSL" +.TH BIO 7 "2020-03-17" "1.1.1e" "OpenSSL" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff --git a/secure/lib/libcrypto/man/man7/ct.7 b/secure/lib/libcrypto/man/man7/ct.7 index f8005393a607..08bd44e7d99a 100644 --- a/secure/lib/libcrypto/man/man7/ct.7 +++ b/secure/lib/libcrypto/man/man7/ct.7 @@ -133,7 +133,7 @@ .\" ======================================================================== .\" .IX Title "CT 7" -.TH CT 7 "2019-09-10" "1.1.1d" "OpenSSL" +.TH CT 7 "2020-03-17" "1.1.1e" "OpenSSL" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff --git a/secure/lib/libcrypto/man/man7/des_modes.7 b/secure/lib/libcrypto/man/man7/des_modes.7 index da9a50aefbb3..6d4a39f7a28f 100644 --- a/secure/lib/libcrypto/man/man7/des_modes.7 +++ b/secure/lib/libcrypto/man/man7/des_modes.7 @@ -133,7 +133,7 @@ .\" ======================================================================== .\" .IX Title "DES_MODES 7" -.TH DES_MODES 7 "2019-09-10" "1.1.1d" "OpenSSL" +.TH DES_MODES 7 "2020-03-17" "1.1.1e" "OpenSSL" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff --git a/secure/lib/libcrypto/man/man7/evp.7 b/secure/lib/libcrypto/man/man7/evp.7 index 165b60f35b20..dd07e03d6803 100644 --- a/secure/lib/libcrypto/man/man7/evp.7 +++ b/secure/lib/libcrypto/man/man7/evp.7 @@ -133,7 +133,7 @@ .\" ======================================================================== .\" .IX Title "EVP 7" -.TH EVP 7 "2019-09-10" "1.1.1d" "OpenSSL" +.TH EVP 7 "2020-03-17" "1.1.1e" "OpenSSL" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff --git a/secure/lib/libcrypto/man/man7/ossl_store-file.7 b/secure/lib/libcrypto/man/man7/ossl_store-file.7 index 3185ac380bbf..07b50c85b924 100644 --- a/secure/lib/libcrypto/man/man7/ossl_store-file.7 +++ b/secure/lib/libcrypto/man/man7/ossl_store-file.7 @@ -133,7 +133,7 @@ .\" ======================================================================== .\" .IX Title "OSSL_STORE-FILE 7" -.TH OSSL_STORE-FILE 7 "2019-09-10" "1.1.1d" "OpenSSL" +.TH OSSL_STORE-FILE 7 "2020-03-17" "1.1.1e" "OpenSSL" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff --git a/secure/lib/libcrypto/man/man7/ossl_store.7 b/secure/lib/libcrypto/man/man7/ossl_store.7 index c8ab5a70b3df..805046c4df97 100644 --- a/secure/lib/libcrypto/man/man7/ossl_store.7 +++ b/secure/lib/libcrypto/man/man7/ossl_store.7 @@ -133,7 +133,7 @@ .\" ======================================================================== .\" .IX Title "OSSL_STORE 7" -.TH OSSL_STORE 7 "2019-09-10" "1.1.1d" "OpenSSL" +.TH OSSL_STORE 7 "2020-03-17" "1.1.1e" "OpenSSL" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff --git a/secure/lib/libcrypto/man/man7/passphrase-encoding.7 b/secure/lib/libcrypto/man/man7/passphrase-encoding.7 index a9975f240b42..f664ee7f9c4b 100644 --- a/secure/lib/libcrypto/man/man7/passphrase-encoding.7 +++ b/secure/lib/libcrypto/man/man7/passphrase-encoding.7 @@ -133,7 +133,7 @@ .\" ======================================================================== .\" .IX Title "PASSPHRASE-ENCODING 7" -.TH PASSPHRASE-ENCODING 7 "2019-09-10" "1.1.1d" "OpenSSL" +.TH PASSPHRASE-ENCODING 7 "2020-03-17" "1.1.1e" "OpenSSL" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l @@ -188,7 +188,7 @@ A pass phrase encoded in \s-1ISO\-8859\-2\s0 could very well have a sequence suc 0xC3 0xAF (which is the two characters \*(L"\s-1LATIN CAPITAL LETTER A WITH BREVE\*(R"\s0 and \*(L"\s-1LATIN CAPITAL LETTER Z WITH DOT ABOVE\*(R"\s0 in \s-1ISO\-8859\-2\s0 encoding), but would be misinterpreted as the perfectly valid \s-1UTF\-8\s0 encoded code point U+00EF (\s-1LATIN -SMALL LETTER I WITH DIARESIS\s0) \fIif the pass phrase doesn't contain anything that +SMALL LETTER I WITH DIAERESIS\s0) \fIif the pass phrase doesn't contain anything that would be invalid \s-1UTF\-8\s0\fR. A pass phrase that contains this kind of byte sequence will give a different outcome in OpenSSL 1.1.0 and newer than in OpenSSL older than 1.1.0. @@ -279,7 +279,7 @@ erroneous/non\-compliant encoding used by OpenSSL older than 1.1.0) \&\fBd2i_PKCS8PrivateKey_bio\fR\|(3) .SH "COPYRIGHT" .IX Header "COPYRIGHT" -Copyright 2018 The OpenSSL Project Authors. All Rights Reserved. +Copyright 2018\-2020 The OpenSSL Project Authors. All Rights Reserved. .PP Licensed under the OpenSSL license (the \*(L"License\*(R"). You may not use this file except in compliance with the License. You can obtain a copy diff --git a/secure/lib/libcrypto/man/man7/proxy-certificates.7 b/secure/lib/libcrypto/man/man7/proxy-certificates.7 new file mode 100644 index 000000000000..41ed59187693 --- /dev/null +++ b/secure/lib/libcrypto/man/man7/proxy-certificates.7 @@ -0,0 +1,478 @@ +.\" Automatically generated by Pod::Man 4.11 (Pod::Simple 3.40) +.\" +.\" Standard preamble: +.\" ======================================================================== +.de Sp \" Vertical space (when we can't use .PP) +.if t .sp .5v +.if n .sp +.. +.de Vb \" Begin verbatim text +.ft CW +.nf +.ne \\$1 +.. +.de Ve \" End verbatim text +.ft R +.fi +.. +.\" Set up some character translations and predefined strings. \*(-- will +.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left +.\" double quote, and \*(R" will give a right double quote. \*(C+ will +.\" give a nicer C++. Capital omega is used to do unbreakable dashes and +.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, +.\" nothing in troff, for use with C<>. +.tr \(*W- +.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' +.ie n \{\ +. ds -- \(*W- +. ds PI pi +. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch +. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch +. ds L" "" +. ds R" "" +. ds C` "" +. ds C' "" +'br\} +.el\{\ +. ds -- \|\(em\| +. ds PI \(*p +. ds L" `` +. ds R" '' +. ds C` +. ds C' +'br\} +.\" +.\" Escape single quotes in literal strings from groff's Unicode transform. +.ie \n(.g .ds Aq \(aq +.el .ds Aq ' +.\" +.\" If the F register is >0, we'll generate index entries on stderr for +.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index +.\" entries marked with X<> in POD. Of course, you'll have to process the +.\" output yourself in some meaningful fashion. +.\" +.\" Avoid warning from groff about undefined register 'F'. +.de IX +.. +.nr rF 0 +.if \n(.g .if rF .nr rF 1 +.if (\n(rF:(\n(.g==0)) \{\ +. if \nF \{\ +. de IX +. tm Index:\\$1\t\\n%\t"\\$2" +.. +. if !\nF==2 \{\ +. nr % 0 +. nr F 2 +. \} +. \} +.\} +.rr rF +.\" +.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). +.\" Fear. Run. Save yourself. No user-serviceable parts. +. \" fudge factors for nroff and troff +.if n \{\ +. ds #H 0 +. ds #V .8m +. ds #F .3m +. ds #[ \f1 +. ds #] \fP +.\} +.if t \{\ +. ds #H ((1u-(\\\\n(.fu%2u))*.13m) +. ds #V .6m +. ds #F 0 +. ds #[ \& +. ds #] \& +.\} +. \" simple accents for nroff and troff +.if n \{\ +. ds ' \& +. ds ` \& +. ds ^ \& +. ds , \& +. ds ~ ~ +. ds / +.\} +.if t \{\ +. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" +. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' +. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' +. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' +. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' +. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' +.\} +. \" troff and (daisy-wheel) nroff accents +.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' +.ds 8 \h'\*(#H'\(*b\h'-\*(#H' +.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] +.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' +.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' +.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] +.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] +.ds ae a\h'-(\w'a'u*4/10)'e +.ds Ae A\h'-(\w'A'u*4/10)'E +. \" corrections for vroff +.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' +.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' +. \" for low resolution devices (crt and lpr) +.if \n(.H>23 .if \n(.V>19 \ +\{\ +. ds : e +. ds 8 ss +. ds o a +. ds d- d\h'-1'\(ga +. ds D- D\h'-1'\(hy +. ds th \o'bp' +. ds Th \o'LP' +. ds ae ae +. ds Ae AE +.\} +.rm #[ #] #H #V #F C +.\" ======================================================================== +.\" +.IX Title "PROXY-CERTIFICATES 7" +.TH PROXY-CERTIFICATES 7 "2020-03-17" "1.1.1e" "OpenSSL" +.\" For nroff, turn off justification. Always turn off hyphenation; it makes +.\" way too many mistakes in technical documents. +.if n .ad l +.nh +.SH "NAME" +proxy\-certificates \- Proxy certificates in OpenSSL +.SH "DESCRIPTION" +.IX Header "DESCRIPTION" +Proxy certificates are defined in \s-1RFC 3820.\s0 They are used to +extend rights to some other entity (a computer process, typically, or +sometimes to the user itself). This allows the entity to perform +operations on behalf of the owner of the \s-1EE\s0 (End Entity) certificate. +.PP +The requirements for a valid proxy certificate are: +.IP "\(bu" 4 +They are issued by an End Entity, either a normal \s-1EE\s0 certificate, or +another proxy certificate. +.IP "\(bu" 4 +They must not have the \fBsubjectAltName\fR or \fBissuerAltName\fR +extensions. +.IP "\(bu" 4 +They must have the \fBproxyCertInfo\fR extension. +.IP "\(bu" 4 +They must have the subject of their issuer, with one \fBcommonName\fR +added. +.SS "Enabling proxy certificate verification" +.IX Subsection "Enabling proxy certificate verification" +OpenSSL expects applications that want to use proxy certificates to be +specially aware of them, and make that explicit. This is done by +setting an X509 verification flag: +.PP +.Vb 1 +\& X509_STORE_CTX_set_flags(ctx, X509_V_FLAG_ALLOW_PROXY_CERTS); +.Ve +.PP +or +.PP +.Vb 1 +\& X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_ALLOW_PROXY_CERTS); +.Ve +.PP +See \*(L"\s-1NOTES\*(R"\s0 for a discussion on this requirement. +.SS "Creating proxy certificates" +.IX Subsection "Creating proxy certificates" +Creating proxy certificates can be done using the \fBopenssl\-x509\fR\|(1) +command, with some extra extensions: +.PP +.Vb 3 +\& [ v3_proxy ] +\& # A proxy certificate MUST NEVER be a CA certificate. +\& basicConstraints=CA:FALSE +\& +\& # Usual authority key ID +\& authorityKeyIdentifier=keyid,issuer:always +\& +\& # The extension which marks this certificate as a proxy +\& proxyCertInfo=critical,language:id\-ppl\-anyLanguage,pathlen:1,policy:text:AB +.Ve +.PP +It's also possible to specify the proxy extension in a separate section: +.PP +.Vb 1 +\& proxyCertInfo=critical,@proxy_ext +\& +\& [ proxy_ext ] +\& language=id\-ppl\-anyLanguage +\& pathlen=0 +\& policy=text:BC +.Ve +.PP +The policy value has a specific syntax, \fIsyntag\fR:\fIstring\fR, where the +\&\fIsyntag\fR determines what will be done with the string. The following +\&\fIsyntag\fRs are recognised: +.IP "\fBtext\fR" 4 +.IX Item "text" +indicates that the string is a byte sequence, without any encoding: +.Sp +.Vb 1 +\& policy=text:ra\*:ksmo\*:rga\*os +.Ve +.IP "\fBhex\fR" 4 +.IX Item "hex" +indicates the string is encoded hexadecimal encoded binary data, with +colons between each byte (every second hex digit): +.Sp +.Vb 1 +\& policy=hex:72:E4:6B:73:6D:F6:72:67:E5:73 +.Ve +.IP "\fBfile\fR" 4 +.IX Item "file" +indicates that the text of the policy should be taken from a file. +The string is then a filename. This is useful for policies that are +large (more than a few lines, e.g. \s-1XML\s0 documents). +.PP +\&\fI\s-1NOTE:\s0 The proxy policy value is what determines the rights granted +to the process during the proxy certificate. It's up to the +application to interpret and combine these policies.\fR +.PP +With a proxy extension, creating a proxy certificate is a matter of +two commands: +.PP +.Vb 3 +\& openssl req \-new \-config proxy.cnf \e +\& \-out proxy.req \-keyout proxy.key \e +\& \-subj "/DC=org/DC=openssl/DC=users/CN=proxy 1" +\& +\& openssl x509 \-req \-CAcreateserial \-in proxy.req \-out proxy.crt \e +\& \-CA user.crt \-CAkey user.key \-days 7 \e +\& \-extfile proxy.cnf \-extensions v3_proxy1 +.Ve +.PP +You can also create a proxy certificate using another proxy +certificate as issuer (note: using a different configuration +section for the proxy extensions): +.PP +.Vb 3 +\& openssl req \-new \-config proxy.cnf \e +\& \-out proxy2.req \-keyout proxy2.key \e +\& \-subj "/DC=org/DC=openssl/DC=users/CN=proxy 1/CN=proxy 2" +\& +\& openssl x509 \-req \-CAcreateserial \-in proxy2.req \-out proxy2.crt \e +\& \-CA proxy.crt \-CAkey proxy.key \-days 7 \e +\& \-extfile proxy.cnf \-extensions v3_proxy2 +.Ve +.SS "Using proxy certs in applications" +.IX Subsection "Using proxy certs in applications" +To interpret proxy policies, the application would normally start with +some default rights (perhaps none at all), then compute the resulting +rights by checking the rights against the chain of proxy certificates, +user certificate and \s-1CA\s0 certificates. +.PP +The complicated part is figuring out how to pass data between your +application and the certificate validation procedure. +.PP +The following ingredients are needed for such processing: +.IP "\(bu" 4 +a callback function that will be called for every certificate being +validated. The callback is called several times for each certificate, +so you must be careful to do the proxy policy interpretation at the +right time. You also need to fill in the defaults when the \s-1EE\s0 +certificate is checked. +.IP "\(bu" 4 +a data structure that is shared between your application code and the +callback. +.IP "\(bu" 4 +a wrapper function that sets it all up. +.IP "\(bu" 4 +an ex_data index function that creates an index into the generic +ex_data store that is attached to an X509 validation context. +.PP +The following skeleton code can be used as a starting point: +.PP +.Vb 4 +\& #include <string.h> +\& #include <netdb.h> +\& #include <openssl/x509.h> +\& #include <openssl/x509v3.h> +\& +\& #define total_rights 25 +\& +\& /* +\& * In this example, I will use a view of granted rights as a bit +\& * array, one bit for each possible right. +\& */ +\& typedef struct your_rights { +\& unsigned char rights[(total_rights + 7) / 8]; +\& } YOUR_RIGHTS; +\& +\& /* +\& * The following procedure will create an index for the ex_data +\& * store in the X509 validation context the first time it\*(Aqs +\& * called. Subsequent calls will return the same index. +\& */ +\& static int get_proxy_auth_ex_data_idx(X509_STORE_CTX *ctx) +\& { +\& static volatile int idx = \-1; +\& +\& if (idx < 0) { +\& X509_STORE_lock(X509_STORE_CTX_get0_store(ctx)); +\& if (idx < 0) { +\& idx = X509_STORE_CTX_get_ex_new_index(0, +\& "for verify callback", +\& NULL,NULL,NULL); +\& } +\& X509_STORE_unlock(X509_STORE_CTX_get0_store(ctx)); +\& } +\& return idx; +\& } +\& +\& /* Callback to be given to the X509 validation procedure. */ +\& static int verify_callback(int ok, X509_STORE_CTX *ctx) +\& { +\& if (ok == 1) { +\& /* +\& * It\*(Aqs REALLY important you keep the proxy policy check +\& * within this section. It\*(Aqs important to know that when +\& * ok is 1, the certificates are checked from top to +\& * bottom. You get the CA root first, followed by the +\& * possible chain of intermediate CAs, followed by the EE +\& * certificate, followed by the possible proxy +\& * certificates. +\& */ +\& X509 *xs = X509_STORE_CTX_get_current_cert(ctx); +\& +\& if (X509_get_extension_flags(xs) & EXFLAG_PROXY) { +\& YOUR_RIGHTS *rights = +\& (YOUR_RIGHTS *)X509_STORE_CTX_get_ex_data(ctx, +\& get_proxy_auth_ex_data_idx(ctx)); +\& PROXY_CERT_INFO_EXTENSION *pci = +\& X509_get_ext_d2i(xs, NID_proxyCertInfo, NULL, NULL); +\& +\& switch (OBJ_obj2nid(pci\->proxyPolicy\->policyLanguage)) { +\& case NID_Independent: +\& /* +\& * Do whatever you need to grant explicit rights +\& * to this particular proxy certificate, usually +\& * by pulling them from some database. If there +\& * are none to be found, clear all rights (making +\& * this and any subsequent proxy certificate void +\& * of any rights). +\& */ +\& memset(rights\->rights, 0, sizeof(rights\->rights)); +\& break; +\& case NID_id_ppl_inheritAll: +\& /* +\& * This is basically a NOP, we simply let the +\& * current rights stand as they are. +\& */ +\& break; +\& default: +\& /* +\& * This is usually the most complex section of +\& * code. You really do whatever you want as long +\& * as you follow RFC 3820. In the example we use +\& * here, the simplest thing to do is to build +\& * another, temporary bit array and fill it with +\& * the rights granted by the current proxy +\& * certificate, then use it as a mask on the +\& * accumulated rights bit array, and voila\*`, you +\& * now have a new accumulated rights bit array. +\& */ +\& { +\& int i; +\& YOUR_RIGHTS tmp_rights; +\& memset(tmp_rights.rights, 0, +\& sizeof(tmp_rights.rights)); +\& +\& /* +\& * process_rights() is supposed to be a +\& * procedure that takes a string and its +\& * length, interprets it and sets the bits +\& * in the YOUR_RIGHTS pointed at by the +\& * third argument. +\& */ +\& process_rights((char *) pci\->proxyPolicy\->policy\->data, +\& pci\->proxyPolicy\->policy\->length, +\& &tmp_rights); +\& +\& for(i = 0; i < total_rights / 8; i++) +\& rights\->rights[i] &= tmp_rights.rights[i]; +\& } +\& break; +\& } +\& PROXY_CERT_INFO_EXTENSION_free(pci); +\& } else if (!(X509_get_extension_flags(xs) & EXFLAG_CA)) { +\& /* We have an EE certificate, let\*(Aqs use it to set default! */ +\& YOUR_RIGHTS *rights = +\& (YOUR_RIGHTS *)X509_STORE_CTX_get_ex_data(ctx, +\& get_proxy_auth_ex_data_idx(ctx)); +\& +\& /* +\& * The following procedure finds out what rights the +\& * owner of the current certificate has, and sets them +\& * in the YOUR_RIGHTS structure pointed at by the +\& * second argument. +\& */ +\& set_default_rights(xs, rights); +\& } +\& } +\& return ok; +\& } +\& +\& static int my_X509_verify_cert(X509_STORE_CTX *ctx, +\& YOUR_RIGHTS *needed_rights) +\& { +\& int ok; +\& int (*save_verify_cb)(int ok,X509_STORE_CTX *ctx) = +\& X509_STORE_CTX_get_verify_cb(ctx); +\& YOUR_RIGHTS rights; +\& +\& X509_STORE_CTX_set_verify_cb(ctx, verify_callback); +\& X509_STORE_CTX_set_ex_data(ctx, get_proxy_auth_ex_data_idx(ctx), +\& &rights); +\& X509_STORE_CTX_set_flags(ctx, X509_V_FLAG_ALLOW_PROXY_CERTS); +\& ok = X509_verify_cert(ctx); +\& +\& if (ok == 1) { +\& ok = check_needed_rights(rights, needed_rights); +\& } +\& +\& X509_STORE_CTX_set_verify_cb(ctx, save_verify_cb); +\& +\& return ok; +\& } +.Ve +.PP +If you use \s-1SSL\s0 or \s-1TLS,\s0 you can easily set up a callback to have the +certificates checked properly, using the code above: +.PP +.Vb 2 +\& SSL_CTX_set_cert_verify_callback(s_ctx, my_X509_verify_cert, +\& &needed_rights); +.Ve +.SH "NOTES" +.IX Header "NOTES" +To this date, it seems that proxy certificates have only been used in +environments that are aware of them, and no one seems to have +investigated how they can be used or misused outside of such an +environment. +.PP +For that reason, OpenSSL requires that applications aware of proxy +certificates must also make that explicit. +.PP +\&\fBsubjectAltName\fR and \fBissuerAltName\fR are forbidden in proxy +certificates, and this is enforced in OpenSSL. The subject must be +the same as the issuer, with one commonName added on. +.SH "SEE ALSO" +.IX Header "SEE ALSO" +\&\fBX509_STORE_CTX_set_flags\fR\|(3), +\&\fBX509_STORE_CTX_set_verify_cb\fR\|(3), +\&\fBX509_VERIFY_PARAM_set_flags\fR\|(3), +\&\fBSSL_CTX_set_cert_verify_callback\fR\|(3), +\&\fBopenssl\-req\fR\|(1), \fBopenssl\-x509\fR\|(1), +\&\s-1RFC 3820\s0 <https://tools.ietf.org/html/rfc3820> +.SH "COPYRIGHT" +.IX Header "COPYRIGHT" +Copyright 2019 The OpenSSL Project Authors. All Rights Reserved. +.PP +Licensed under the Apache License 2.0 (the \*(L"License\*(R"). You may not use +this file except in compliance with the License. You can obtain a copy +in the file \s-1LICENSE\s0 in the source distribution or at +<https://www.openssl.org/source/license.html>. diff --git a/secure/lib/libcrypto/man/man7/scrypt.7 b/secure/lib/libcrypto/man/man7/scrypt.7 index fd73e3aa5fa4..6eb5c493e99c 100644 --- a/secure/lib/libcrypto/man/man7/scrypt.7 +++ b/secure/lib/libcrypto/man/man7/scrypt.7 @@ -133,7 +133,7 @@ .\" ======================================================================== .\" .IX Title "SCRYPT 7" -.TH SCRYPT 7 "2019-09-10" "1.1.1d" "OpenSSL" +.TH SCRYPT 7 "2020-03-17" "1.1.1e" "OpenSSL" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff --git a/secure/lib/libcrypto/man/man7/ssl.7 b/secure/lib/libcrypto/man/man7/ssl.7 index 95fcdc10a116..7f246ee6e190 100644 --- a/secure/lib/libcrypto/man/man7/ssl.7 +++ b/secure/lib/libcrypto/man/man7/ssl.7 @@ -133,7 +133,7 @@ .\" ======================================================================== .\" .IX Title "SSL 7" -.TH SSL 7 "2019-09-10" "1.1.1d" "OpenSSL" +.TH SSL 7 "2020-03-17" "1.1.1e" "OpenSSL" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff --git a/secure/lib/libcrypto/man/man7/x509.7 b/secure/lib/libcrypto/man/man7/x509.7 index 6d493eba9a0c..c92b476c7e54 100644 --- a/secure/lib/libcrypto/man/man7/x509.7 +++ b/secure/lib/libcrypto/man/man7/x509.7 @@ -133,7 +133,7 @@ .\" ======================================================================== .\" .IX Title "X509 7" -.TH X509 7 "2019-09-10" "1.1.1d" "OpenSSL" +.TH X509 7 "2020-03-17" "1.1.1e" "OpenSSL" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l |