diff options
Diffstat (limited to 'secure/lib/libcrypto/man/BIO_f_ssl.3')
| -rw-r--r-- | secure/lib/libcrypto/man/BIO_f_ssl.3 | 497 |
1 files changed, 0 insertions, 497 deletions
diff --git a/secure/lib/libcrypto/man/BIO_f_ssl.3 b/secure/lib/libcrypto/man/BIO_f_ssl.3 deleted file mode 100644 index 7c5117b1ad9b..000000000000 --- a/secure/lib/libcrypto/man/BIO_f_ssl.3 +++ /dev/null @@ -1,497 +0,0 @@ -.\" Automatically generated by Pod::Man version 1.15 -.\" Wed Feb 19 16:42:43 2003 -.\" -.\" Standard preamble: -.\" ====================================================================== -.de Sh \" Subsection heading -.br -.if t .Sp -.ne 5 -.PP -\fB\\$1\fR -.PP -.. -.de Sp \" Vertical space (when we can't use .PP) -.if t .sp .5v -.if n .sp -.. -.de Ip \" List item -.br -.ie \\n(.$>=3 .ne \\$3 -.el .ne 3 -.IP "\\$1" \\$2 -.. -.de Vb \" Begin verbatim text -.ft CW -.nf -.ne \\$1 -.. -.de Ve \" End verbatim text -.ft R - -.fi -.. -.\" Set up some character translations and predefined strings. \*(-- will -.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left -.\" double quote, and \*(R" will give a right double quote. | will give a -.\" real vertical bar. \*(C+ will give a nicer C++. Capital omega is used -.\" to do unbreakable dashes and therefore won't be available. \*(C` and -.\" \*(C' expand to `' in nroff, nothing in troff, for use with C<> -.tr \(*W-|\(bv\*(Tr -.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' -.ie n \{\ -. ds -- \(*W- -. ds PI pi -. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch -. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch -. ds L" "" -. ds R" "" -. ds C` "" -. ds C' "" -'br\} -.el\{\ -. ds -- \|\(em\| -. ds PI \(*p -. ds L" `` -. ds R" '' -'br\} -.\" -.\" If the F register is turned on, we'll generate index entries on stderr -.\" for titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and -.\" index entries marked with X<> in POD. Of course, you'll have to process -.\" the output yourself in some meaningful fashion. -.if \nF \{\ -. de IX -. tm Index:\\$1\t\\n%\t"\\$2" -.. -. nr % 0 -. rr F -.\} -.\" -.\" For nroff, turn off justification. Always turn off hyphenation; it -.\" makes way too many mistakes in technical documents. -.hy 0 -.if n .na -.\" -.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). -.\" Fear. Run. Save yourself. No user-serviceable parts. -.bd B 3 -. \" fudge factors for nroff and troff -.if n \{\ -. ds #H 0 -. ds #V .8m -. ds #F .3m -. ds #[ \f1 -. ds #] \fP -.\} -.if t \{\ -. ds #H ((1u-(\\\\n(.fu%2u))*.13m) -. ds #V .6m -. ds #F 0 -. ds #[ \& -. ds #] \& -.\} -. \" simple accents for nroff and troff -.if n \{\ -. ds ' \& -. ds ` \& -. ds ^ \& -. ds , \& -. ds ~ ~ -. ds / -.\} -.if t \{\ -. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" -. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' -. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' -. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' -. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' -. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' -.\} -. \" troff and (daisy-wheel) nroff accents -.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' -.ds 8 \h'\*(#H'\(*b\h'-\*(#H' -.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] -.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' -.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' -.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] -.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] -.ds ae a\h'-(\w'a'u*4/10)'e -.ds Ae A\h'-(\w'A'u*4/10)'E -. \" corrections for vroff -.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' -.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' -. \" for low resolution devices (crt and lpr) -.if \n(.H>23 .if \n(.V>19 \ -\{\ -. ds : e -. ds 8 ss -. ds o a -. ds d- d\h'-1'\(ga -. ds D- D\h'-1'\(hy -. ds th \o'bp' -. ds Th \o'LP' -. ds ae ae -. ds Ae AE -.\} -.rm #[ #] #H #V #F C -.\" ====================================================================== -.\" -.IX Title "BIO_f_ssl 3" -.TH BIO_f_ssl 3 "0.9.7a" "2003-02-19" "OpenSSL" -.UC -.SH "NAME" -BIO_f_ssl, BIO_set_ssl, BIO_get_ssl, BIO_set_ssl_mode, BIO_set_ssl_renegotiate_bytes, -BIO_get_num_renegotiates, BIO_set_ssl_renegotiate_timeout, BIO_new_ssl, -BIO_new_ssl_connect, BIO_new_buffer_ssl_connect, BIO_ssl_copy_session_id, -BIO_ssl_shutdown \- \s-1SSL\s0 \s-1BIO\s0 -.SH "SYNOPSIS" -.IX Header "SYNOPSIS" -.Vb 2 -\& #include <openssl/bio.h> -\& #include <openssl/ssl.h> -.Ve -.Vb 1 -\& BIO_METHOD *BIO_f_ssl(void); -.Ve -.Vb 9 -\& #define BIO_set_ssl(b,ssl,c) BIO_ctrl(b,BIO_C_SET_SSL,c,(char *)ssl) -\& #define BIO_get_ssl(b,sslp) BIO_ctrl(b,BIO_C_GET_SSL,0,(char *)sslp) -\& #define BIO_set_ssl_mode(b,client) BIO_ctrl(b,BIO_C_SSL_MODE,client,NULL) -\& #define BIO_set_ssl_renegotiate_bytes(b,num) \e -\& BIO_ctrl(b,BIO_C_SET_SSL_RENEGOTIATE_BYTES,num,NULL); -\& #define BIO_set_ssl_renegotiate_timeout(b,seconds) \e -\& BIO_ctrl(b,BIO_C_SET_SSL_RENEGOTIATE_TIMEOUT,seconds,NULL); -\& #define BIO_get_num_renegotiates(b) \e -\& BIO_ctrl(b,BIO_C_SET_SSL_NUM_RENEGOTIATES,0,NULL); -.Ve -.Vb 5 -\& BIO *BIO_new_ssl(SSL_CTX *ctx,int client); -\& BIO *BIO_new_ssl_connect(SSL_CTX *ctx); -\& BIO *BIO_new_buffer_ssl_connect(SSL_CTX *ctx); -\& int BIO_ssl_copy_session_id(BIO *to,BIO *from); -\& void BIO_ssl_shutdown(BIO *bio); -.Ve -.Vb 1 -\& #define BIO_do_handshake(b) BIO_ctrl(b,BIO_C_DO_STATE_MACHINE,0,NULL) -.Ve -.SH "DESCRIPTION" -.IX Header "DESCRIPTION" -\&\fIBIO_f_ssl()\fR returns the \s-1SSL\s0 \s-1BIO\s0 method. This is a filter \s-1BIO\s0 which -is a wrapper round the OpenSSL \s-1SSL\s0 routines adding a \s-1BIO\s0 \*(L"flavour\*(R" to -\&\s-1SSL\s0 I/O. -.PP -I/O performed on an \s-1SSL\s0 \s-1BIO\s0 communicates using the \s-1SSL\s0 protocol with -the SSLs read and write BIOs. If an \s-1SSL\s0 connection is not established -then an attempt is made to establish one on the first I/O call. -.PP -If a \s-1BIO\s0 is appended to an \s-1SSL\s0 \s-1BIO\s0 using \fIBIO_push()\fR it is automatically -used as the \s-1SSL\s0 BIOs read and write BIOs. -.PP -Calling \fIBIO_reset()\fR on an \s-1SSL\s0 \s-1BIO\s0 closes down any current \s-1SSL\s0 connection -by calling \fISSL_shutdown()\fR. \fIBIO_reset()\fR is then sent to the next \s-1BIO\s0 in -the chain: this will typically disconnect the underlying transport. -The \s-1SSL\s0 \s-1BIO\s0 is then reset to the initial accept or connect state. -.PP -If the close flag is set when an \s-1SSL\s0 \s-1BIO\s0 is freed then the internal -\&\s-1SSL\s0 structure is also freed using \fISSL_free()\fR. -.PP -\&\fIBIO_set_ssl()\fR sets the internal \s-1SSL\s0 pointer of \s-1BIO\s0 \fBb\fR to \fBssl\fR using -the close flag \fBc\fR. -.PP -\&\fIBIO_get_ssl()\fR retrieves the \s-1SSL\s0 pointer of \s-1BIO\s0 \fBb\fR, it can then be -manipulated using the standard \s-1SSL\s0 library functions. -.PP -\&\fIBIO_set_ssl_mode()\fR sets the \s-1SSL\s0 \s-1BIO\s0 mode to \fBclient\fR. If \fBclient\fR -is 1 client mode is set. If \fBclient\fR is 0 server mode is set. -.PP -\&\fIBIO_set_ssl_renegotiate_bytes()\fR sets the renegotiate byte count -to \fBnum\fR. When set after every \fBnum\fR bytes of I/O (read and write) -the \s-1SSL\s0 session is automatically renegotiated. \fBnum\fR must be at -least 512 bytes. -.PP -\&\fIBIO_set_ssl_renegotiate_timeout()\fR sets the renegotiate timeout to -\&\fBseconds\fR. When the renegotiate timeout elapses the session is -automatically renegotiated. -.PP -\&\fIBIO_get_num_renegotiates()\fR returns the total number of session -renegotiations due to I/O or timeout. -.PP -\&\fIBIO_new_ssl()\fR allocates an \s-1SSL\s0 \s-1BIO\s0 using \s-1SSL_CTX\s0 \fBctx\fR and using -client mode if \fBclient\fR is non zero. -.PP -\&\fIBIO_new_ssl_connect()\fR creates a new \s-1BIO\s0 chain consisting of an -\&\s-1SSL\s0 \s-1BIO\s0 (using \fBctx\fR) followed by a connect \s-1BIO\s0. -.PP -\&\fIBIO_new_buffer_ssl_connect()\fR creates a new \s-1BIO\s0 chain consisting -of a buffering \s-1BIO\s0, an \s-1SSL\s0 \s-1BIO\s0 (using \fBctx\fR) and a connect -\&\s-1BIO\s0. -.PP -\&\fIBIO_ssl_copy_session_id()\fR copies an \s-1SSL\s0 session id between -\&\s-1BIO\s0 chains \fBfrom\fR and \fBto\fR. It does this by locating the -\&\s-1SSL\s0 BIOs in each chain and calling \fISSL_copy_session_id()\fR on -the internal \s-1SSL\s0 pointer. -.PP -\&\fIBIO_ssl_shutdown()\fR closes down an \s-1SSL\s0 connection on \s-1BIO\s0 -chain \fBbio\fR. It does this by locating the \s-1SSL\s0 \s-1BIO\s0 in the -chain and calling \fISSL_shutdown()\fR on its internal \s-1SSL\s0 -pointer. -.PP -\&\fIBIO_do_handshake()\fR attempts to complete an \s-1SSL\s0 handshake on the -supplied \s-1BIO\s0 and establish the \s-1SSL\s0 connection. It returns 1 -if the connection was established successfully. A zero or negative -value is returned if the connection could not be established, the -call \fIBIO_should_retry()\fR should be used for non blocking connect BIOs -to determine if the call should be retried. If an \s-1SSL\s0 connection has -already been established this call has no effect. -.SH "NOTES" -.IX Header "NOTES" -\&\s-1SSL\s0 BIOs are exceptional in that if the underlying transport -is non blocking they can still request a retry in exceptional -circumstances. Specifically this will happen if a session -renegotiation takes place during a \fIBIO_read()\fR operation, one -case where this happens is when \s-1SGC\s0 or step up occurs. -.PP -In OpenSSL 0.9.6 and later the \s-1SSL\s0 flag \s-1SSL_AUTO_RETRY\s0 can be -set to disable this behaviour. That is when this flag is set -an \s-1SSL\s0 \s-1BIO\s0 using a blocking transport will never request a -retry. -.PP -Since unknown \fIBIO_ctrl()\fR operations are sent through filter -BIOs the servers name and port can be set using \fIBIO_set_host()\fR -on the \s-1BIO\s0 returned by \fIBIO_new_ssl_connect()\fR without having -to locate the connect \s-1BIO\s0 first. -.PP -Applications do not have to call \fIBIO_do_handshake()\fR but may wish -to do so to separate the handshake process from other I/O -processing. -.SH "RETURN VALUES" -.IX Header "RETURN VALUES" -\&\s-1TBA\s0 -.SH "EXAMPLE" -.IX Header "EXAMPLE" -This \s-1SSL/TLS\s0 client example, attempts to retrieve a page from an -\&\s-1SSL/TLS\s0 web server. The I/O routines are identical to those of the -unencrypted example in BIO_s_connect(3). -.PP -.Vb 5 -\& BIO *sbio, *out; -\& int len; -\& char tmpbuf[1024]; -\& SSL_CTX *ctx; -\& SSL *ssl; -.Ve -.Vb 3 -\& ERR_load_crypto_strings(); -\& ERR_load_SSL_strings(); -\& OpenSSL_add_all_algorithms(); -.Ve -.Vb 3 -\& /* We would seed the PRNG here if the platform didn't -\& * do it automatically -\& */ -.Ve -.Vb 1 -\& ctx = SSL_CTX_new(SSLv23_client_method()); -.Ve -.Vb 4 -\& /* We'd normally set some stuff like the verify paths and -\& * mode here because as things stand this will connect to -\& * any server whose certificate is signed by any CA. -\& */ -.Ve -.Vb 1 -\& sbio = BIO_new_ssl_connect(ctx); -.Ve -.Vb 1 -\& BIO_get_ssl(sbio, &ssl); -.Ve -.Vb 4 -\& if(!ssl) { -\& fprintf(stderr, "Can't locate SSL pointer\en"); -\& /* whatever ... */ -\& } -.Ve -.Vb 2 -\& /* Don't want any retries */ -\& SSL_set_mode(ssl, SSL_MODE_AUTO_RETRY); -.Ve -.Vb 1 -\& /* We might want to do other things with ssl here */ -.Ve -.Vb 1 -\& BIO_set_conn_hostname(sbio, "localhost:https"); -.Ve -.Vb 6 -\& out = BIO_new_fp(stdout, BIO_NOCLOSE); -\& if(BIO_do_connect(sbio) <= 0) { -\& fprintf(stderr, "Error connecting to server\en"); -\& ERR_print_errors_fp(stderr); -\& /* whatever ... */ -\& } -.Ve -.Vb 5 -\& if(BIO_do_handshake(sbio) <= 0) { -\& fprintf(stderr, "Error establishing SSL connection\en"); -\& ERR_print_errors_fp(stderr); -\& /* whatever ... */ -\& } -.Ve -.Vb 1 -\& /* Could examine ssl here to get connection info */ -.Ve -.Vb 8 -\& BIO_puts(sbio, "GET / HTTP/1.0\en\en"); -\& for(;;) { -\& len = BIO_read(sbio, tmpbuf, 1024); -\& if(len <= 0) break; -\& BIO_write(out, tmpbuf, len); -\& } -\& BIO_free_all(sbio); -\& BIO_free(out); -.Ve -Here is a simple server example. It makes use of a buffering -\&\s-1BIO\s0 to allow lines to be read from the \s-1SSL\s0 \s-1BIO\s0 using BIO_gets. -It creates a pseudo web page containing the actual request from -a client and also echoes the request to standard output. -.PP -.Vb 5 -\& BIO *sbio, *bbio, *acpt, *out; -\& int len; -\& char tmpbuf[1024]; -\& SSL_CTX *ctx; -\& SSL *ssl; -.Ve -.Vb 3 -\& ERR_load_crypto_strings(); -\& ERR_load_SSL_strings(); -\& OpenSSL_add_all_algorithms(); -.Ve -.Vb 1 -\& /* Might seed PRNG here */ -.Ve -.Vb 1 -\& ctx = SSL_CTX_new(SSLv23_server_method()); -.Ve -.Vb 3 -\& if (!SSL_CTX_use_certificate_file(ctx,"server.pem",SSL_FILETYPE_PEM) -\& || !SSL_CTX_use_PrivateKey_file(ctx,"server.pem",SSL_FILETYPE_PEM) -\& || !SSL_CTX_check_private_key(ctx)) { -.Ve -.Vb 4 -\& fprintf(stderr, "Error setting up SSL_CTX\en"); -\& ERR_print_errors_fp(stderr); -\& return 0; -\& } -.Ve -.Vb 3 -\& /* Might do other things here like setting verify locations and -\& * DH and/or RSA temporary key callbacks -\& */ -.Ve -.Vb 2 -\& /* New SSL BIO setup as server */ -\& sbio=BIO_new_ssl(ctx,0); -.Ve -.Vb 1 -\& BIO_get_ssl(sbio, &ssl); -.Ve -.Vb 4 -\& if(!ssl) { -\& fprintf(stderr, "Can't locate SSL pointer\en"); -\& /* whatever ... */ -\& } -.Ve -.Vb 2 -\& /* Don't want any retries */ -\& SSL_set_mode(ssl, SSL_MODE_AUTO_RETRY); -.Ve -.Vb 1 -\& /* Create the buffering BIO */ -.Ve -.Vb 1 -\& bbio = BIO_new(BIO_f_buffer()); -.Ve -.Vb 2 -\& /* Add to chain */ -\& sbio = BIO_push(bbio, sbio); -.Ve -.Vb 1 -\& acpt=BIO_new_accept("4433"); -.Ve -.Vb 5 -\& /* By doing this when a new connection is established -\& * we automatically have sbio inserted into it. The -\& * BIO chain is now 'swallowed' by the accept BIO and -\& * will be freed when the accept BIO is freed. -\& */ -.Ve -.Vb 1 -\& BIO_set_accept_bios(acpt,sbio); -.Ve -.Vb 1 -\& out = BIO_new_fp(stdout, BIO_NOCLOSE); -.Ve -.Vb 6 -\& /* Setup accept BIO */ -\& if(BIO_do_accept(acpt) <= 0) { -\& fprintf(stderr, "Error setting up accept BIO\en"); -\& ERR_print_errors_fp(stderr); -\& return 0; -\& } -.Ve -.Vb 6 -\& /* Now wait for incoming connection */ -\& if(BIO_do_accept(acpt) <= 0) { -\& fprintf(stderr, "Error in connection\en"); -\& ERR_print_errors_fp(stderr); -\& return 0; -\& } -.Ve -.Vb 3 -\& /* We only want one connection so remove and free -\& * accept BIO -\& */ -.Ve -.Vb 1 -\& sbio = BIO_pop(acpt); -.Ve -.Vb 1 -\& BIO_free_all(acpt); -.Ve -.Vb 5 -\& if(BIO_do_handshake(sbio) <= 0) { -\& fprintf(stderr, "Error in SSL handshake\en"); -\& ERR_print_errors_fp(stderr); -\& return 0; -\& } -.Ve -.Vb 3 -\& BIO_puts(sbio, "HTTP/1.0 200 OK\er\enContent-type: text/html\er\en\er\en"); -\& BIO_puts(sbio, "<pre>\er\enConnection Established\er\enRequest headers:\er\en"); -\& BIO_puts(sbio, "--------------------------------------------------\er\en"); -.Ve -.Vb 8 -\& for(;;) { -\& len = BIO_gets(sbio, tmpbuf, 1024); -\& if(len <= 0) break; -\& BIO_write(sbio, tmpbuf, len); -\& BIO_write(out, tmpbuf, len); -\& /* Look for blank line signifying end of headers*/ -\& if((tmpbuf[0] == '\er') || (tmpbuf[0] == '\en')) break; -\& } -.Ve -.Vb 2 -\& BIO_puts(sbio, "--------------------------------------------------\er\en"); -\& BIO_puts(sbio, "</pre>\er\en"); -.Ve -.Vb 2 -\& /* Since there is a buffering BIO present we had better flush it */ -\& BIO_flush(sbio); -.Ve -.Vb 1 -\& BIO_free_all(sbio); -.Ve -.SH "SEE ALSO" -.IX Header "SEE ALSO" -\&\s-1TBA\s0 |