generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fixes some typos in doc/ssl/

Browse Source 
This is the last of Alok's PR260
Reviewed-by: Tim Hudson <tjh@openssl.org>
This commit is contained in:
Alok Menghrajani 2015-04-13 09:48:06 -07:00 committed by Rich Salz
parent 4c583c3659
commit 5812e6f175
3 changed files with 15 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
doc/ssl/SSL_CTX_set_cert_cb.pod
View File

@ -43,7 +43,7 @@ SSL_add1_chain_cert().
It might also call SSL_certs_clear() to delete any certificates associated It might also call SSL_certs_clear() to delete any certificates associated
with the B<SSL> object. with the B<SSL> object.
The certificate callback functionality supercedes the (largely broken) The certificate callback functionality supersedes the (largely broken)
functionality provided by the old client certificate callback interface. functionality provided by the old client certificate callback interface.
It is B<always> called even is a certificate is already set so the callback It is B<always> called even is a certificate is already set so the callback
can modify or delete the existing certificate. can modify or delete the existing certificate.

2
doc/ssl/SSL_CTX_set_security_level.pod
View File

@ -34,7 +34,7 @@ SSL_CTX_set_security_level, SSL_set_security_level, SSL_CTX_get_security_level,
=head1 DESCRIPTION =head1 DESCRIPTION
The functions SSL_CTX_set_security_level() and SSL_set_security_level() set The functions SSL_CTX_set_security_level() and SSL_set_security_level() set
the security level to B<level>. If not set the libary default security level the security level to B<level>. If not set the library default security level
is used. is used.
The functions SSL_CTX_get_security_level() and SSL_get_security_level() The functions SSL_CTX_get_security_level() and SSL_get_security_level()

26
doc/ssl/SSL_CTX_set_tlsext_ticket_key_cb.pod
View File

@ -15,7 +15,7 @@ SSL_CTX_set_tlsext_ticket_key_cb - set a callback for session ticket processing
=head1 DESCRIPTION =head1 DESCRIPTION
SSL_CTX_set_tlsext_ticket_key_cb() sets a callback fuction I<cb> for handling SSL_CTX_set_tlsext_ticket_key_cb() sets a callback function I<cb> for handling
session tickets for the ssl context I<sslctx>. Session tickets, defined in session tickets for the ssl context I<sslctx>. Session tickets, defined in
RFC5077 provide an enhanced session resumption capability where the server RFC5077 provide an enhanced session resumption capability where the server
implementation is not required to maintain per session state. It only applies implementation is not required to maintain per session state. It only applies
@ -40,13 +40,13 @@ The server, through the callback function, either agrees to reuse the session
ticket information or it starts a full TLS handshake to create a new session ticket information or it starts a full TLS handshake to create a new session
ticket. ticket.
Before the callback function is started I<ctx> and I<hctx> have been Before the callback function is started I<ctx> and I<hctx> have been
initialised with EVP_CIPHER_CTX_init and HMAC_CTX_init respectively. initialised with EVP_CIPHER_CTX_init and HMAC_CTX_init respectively.
For new sessions tickets, when the client doesn't present a session ticket, or For new sessions tickets, when the client doesn't present a session ticket, or
an attempted retreival of the ticket failed, or a renew option was indicated, an attempted retrieval of the ticket failed, or a renew option was indicated,
the callback function will be called with I<enc> equal to 1. The OpenSSL the callback function will be called with I<enc> equal to 1. The OpenSSL
library expects that the function will set an arbitary I<name>, initialize library expects that the function will set an arbitrary I<name>, initialize
I<iv>, and set the cipher context I<ctx> and the hash context I<hctx>. I<iv>, and set the cipher context I<ctx> and the hash context I<hctx>.
The I<name> is 16 characters long and is used as a key identifier. The I<name> is 16 characters long and is used as a key identifier.
@ -54,22 +54,22 @@ The I<name> is 16 characters long and is used as a key identifier.
The I<iv> length is the length of the IV of the corresponding cipher. The The I<iv> length is the length of the IV of the corresponding cipher. The
maximum IV length is L<EVP_MAX_IV_LENGTH> bytes defined in B<evp.h>. maximum IV length is L<EVP_MAX_IV_LENGTH> bytes defined in B<evp.h>.
The initialization vector I<iv> should be a random value. The cipher context The initialization vector I<iv> should be a random value. The cipher context
I<ctx> should use the initialisation vector I<iv>. The cipher context can be I<ctx> should use the initialisation vector I<iv>. The cipher context can be
set using L<EVP_EncryptInit_ex>. The hmac context can be set using L<HMAC_Init_ex>. set using L<EVP_EncryptInit_ex>. The hmac context can be set using L<HMAC_Init_ex>.
When the client presents a session ticket, the callback function with be called When the client presents a session ticket, the callback function with be called
with I<enc> set to 0 indicating that the I<cb> function should retreive a set with I<enc> set to 0 indicating that the I<cb> function should retrieve a set
of parameters. In this case I<name> and I<iv> have already been parsed out of of parameters. In this case I<name> and I<iv> have already been parsed out of
the session ticket. The OpenSSL library expects that the I<name> will be used the session ticket. The OpenSSL library expects that the I<name> will be used
to retrieve a cryptographic parameters and that the cryptographic context to retrieve a cryptographic parameters and that the cryptographic context
I<ctx> will be set with the retreived parameters and the initialization vector I<ctx> will be set with the retrieved parameters and the initialization vector
I<iv>. using a function like L<EVP_DecryptInit_ex>. The I<hctx> needs to be set I<iv>. using a function like L<EVP_DecryptInit_ex>. The I<hctx> needs to be set
using L<HMAC_Init_ex>. using L<HMAC_Init_ex>.
If the I<name> is still valid but a renewal of the ticket is required the If the I<name> is still valid but a renewal of the ticket is required the
callback function should return 2. The library will call the callback again callback function should return 2. The library will call the callback again
with an arguement of enc equal to 1 to set the new ticket. with an argument of enc equal to 1 to set the new ticket.
The return value of the I<cb> function is used by OpenSSL to determine what The return value of the I<cb> function is used by OpenSSL to determine what
further processing will occur. The following return values have meaning: further processing will occur. The following return values have meaning:
@ -92,7 +92,7 @@ continue on those parameters.
=item Z<>0 =item Z<>0
This indicates that it was not possible to set/retrieve a session ticket and This indicates that it was not possible to set/retrieve a session ticket and
the SSL/TLS session will continue by by negiotationing a set of cryptographic the SSL/TLS session will continue by by negotiating a set of cryptographic
parameters or using the alternate SSL/TLS resumption mechanism, session ids. parameters or using the alternate SSL/TLS resumption mechanism, session ids.
If called with enc equal to 0 the library will call the I<cb> again to get If called with enc equal to 0 the library will call the I<cb> again to get
@ -107,10 +107,10 @@ This indicates an error.
=head1 NOTES =head1 NOTES
Session resumption shortcuts the TLS so that the client certificate Session resumption shortcuts the TLS so that the client certificate
negiotation don't occur. It makes up for this by storing client certificate negotiation don't occur. It makes up for this by storing client certificate
an all other negotiated state information encrypted within the ticket. In a an all other negotiated state information encrypted within the ticket. In a
resumed session the applications will have all this state information available resumed session the applications will have all this state information available
exactly as if a full negiotation had occured. exactly as if a full negotiation had occurred.
If an attacker can obtain the key used to encrypt a session ticket, they can If an attacker can obtain the key used to encrypt a session ticket, they can
obtain the master secret for any ticket using that key and decrypt any traffic obtain the master secret for any ticket using that key and decrypt any traffic
@ -125,7 +125,7 @@ enable an attacker to obtain the session keys.
=head1 EXAMPLES =head1 EXAMPLES
Reference Implemention: Reference Implementation:
SSL_CTX_set_tlsext_ticket_key_cb(SSL,ssl_tlsext_ticket_key_cb); SSL_CTX_set_tlsext_ticket_key_cb(SSL,ssl_tlsext_ticket_key_cb);
.... ....