172 lines
6.3 KiB
Groff
172 lines
6.3 KiB
Groff
|
.\" $OpenBSD: SSL_CTX_set_default_passwd_cb.3,v 1.7 2018/04/02 02:06:14 schwarze Exp $
|
||
|
|
.\" full merge up to: OpenSSL 9b86974e Aug 17 15:21:33 2015 -0400
|
||
|
|
.\" selective merge up to: OpenSSL 2947af32 Nov 19 00:10:05 2016 +0100
|
||
|
|
.\"
|
||
|
|
.\" This file was written by Lutz Jaenicke <jaenicke@openssl.org>
|
||
|
|
.\" and Christian Heimes <cheimes@redhat.com>.
|
||
|
|
.\" Copyright (c) 2000, 2001, 2016 The OpenSSL Project. All rights reserved.
|
||
|
|
.\"
|
||
|
|
.\" Redistribution and use in source and binary forms, with or without
|
||
|
|
.\" modification, are permitted provided that the following conditions
|
||
|
|
.\" are met:
|
||
|
|
.\"
|
||
|
|
.\" 1. Redistributions of source code must retain the above copyright
|
||
|
|
.\" notice, this list of conditions and the following disclaimer.
|
||
|
|
.\"
|
||
|
|
.\" 2. Redistributions in binary form must reproduce the above copyright
|
||
|
|
.\" notice, this list of conditions and the following disclaimer in
|
||
|
|
.\" the documentation and/or other materials provided with the
|
||
|
|
.\" distribution.
|
||
|
|
.\"
|
||
|
|
.\" 3. All advertising materials mentioning features or use of this
|
||
|
|
.\" software must display the following acknowledgment:
|
||
|
|
.\" "This product includes software developed by the OpenSSL Project
|
||
|
|
.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
|
||
|
|
.\"
|
||
|
|
.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
||
|
|
.\" endorse or promote products derived from this software without
|
||
|
|
.\" prior written permission. For written permission, please contact
|
||
|
|
.\" openssl-core@openssl.org.
|
||
|
|
.\"
|
||
|
|
.\" 5. Products derived from this software may not be called "OpenSSL"
|
||
|
|
.\" nor may "OpenSSL" appear in their names without prior written
|
||
|
|
.\" permission of the OpenSSL Project.
|
||
|
|
.\"
|
||
|
|
.\" 6. Redistributions of any form whatsoever must retain the following
|
||
|
|
.\" acknowledgment:
|
||
|
|
.\" "This product includes software developed by the OpenSSL Project
|
||
|
|
.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
|
||
|
|
.\"
|
||
|
|
.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
||
|
|
.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||
|
|
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||
|
|
.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
||
|
|
.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
||
|
|
.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||
|
|
.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||
|
|
.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||
|
|
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
||
|
|
.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||
|
|
.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
||
|
|
.\" OF THE POSSIBILITY OF SUCH DAMAGE.
|
||
|
|
.\"
|
||
|
|
.Dd $Mdocdate: April 2 2018 $
|
||
|
|
.Dt SSL_CTX_SET_DEFAULT_PASSWD_CB 3
|
||
|
|
.Os
|
||
|
|
.Sh NAME
|
||
|
|
.Nm SSL_CTX_set_default_passwd_cb ,
|
||
|
|
.Nm SSL_CTX_set_default_passwd_cb_userdata ,
|
||
|
|
.Nm SSL_CTX_get_default_passwd_cb ,
|
||
|
|
.Nm SSL_CTX_get_default_passwd_cb_userdata ,
|
||
|
|
.Nm pem_password_cb
|
||
|
|
.Nd set or get passwd callback for encrypted PEM file handling
|
||
|
|
.Sh SYNOPSIS
|
||
|
|
.In openssl/ssl.h
|
||
|
|
.Ft void
|
||
|
|
.Fn SSL_CTX_set_default_passwd_cb "SSL_CTX *ctx" "pem_password_cb *cb"
|
||
|
|
.Ft void
|
||
|
|
.Fn SSL_CTX_set_default_passwd_cb_userdata "SSL_CTX *ctx" "void *u"
|
||
|
|
.Ft pem_password_cb *
|
||
|
|
.Fn SSL_CTX_get_default_passwd_cb "SSL_CTX *ctx"
|
||
|
|
.Ft void *
|
||
|
|
.Fn SSL_CTX_get_default_passwd_cb_userdata "SSL_CTX *ctx"
|
||
|
|
.In openssl/pem.h
|
||
|
|
.Ft typedef int
|
||
|
|
.Fn pem_password_cb "char *buf" "int size" "int rwflag" "void *userdata"
|
||
|
|
.Sh DESCRIPTION
|
||
|
|
.Fn SSL_CTX_set_default_passwd_cb
|
||
|
|
sets the default password callback called when loading/storing a PEM
|
||
|
|
certificate with encryption.
|
||
|
|
.Pp
|
||
|
|
.Fn SSL_CTX_set_default_passwd_cb_userdata
|
||
|
|
sets a pointer to userdata
|
||
|
|
.Fa u
|
||
|
|
which will be provided to the password callback on invocation.
|
||
|
|
.Pp
|
||
|
|
The
|
||
|
|
password callback
|
||
|
|
.Fa cb ,
|
||
|
|
which must be provided by the application,
|
||
|
|
hands back the password to be used during decryption.
|
||
|
|
On invocation a pointer to
|
||
|
|
.Fa userdata
|
||
|
|
is provided.
|
||
|
|
The password callback must write the password into the provided buffer
|
||
|
|
.Fa buf
|
||
|
|
which is of size
|
||
|
|
.Fa size .
|
||
|
|
The actual length of the password must be returned to the calling function.
|
||
|
|
.Fa rwflag
|
||
|
|
indicates whether the callback is used for reading/decryption
|
||
|
|
.Pq Fa rwflag No = 0
|
||
|
|
or writing/encryption
|
||
|
|
.Pq Fa rwflag No = 1 .
|
||
|
|
.Pp
|
||
|
|
When loading or storing private keys, a password might be supplied to protect
|
||
|
|
the private key.
|
||
|
|
The way this password can be supplied may depend on the application.
|
||
|
|
If only one private key is handled, it can be practical to have the
|
||
|
|
callback handle the password dialog interactively.
|
||
|
|
If several keys have to be handled, it can be practical to ask for the password
|
||
|
|
once, then keep it in memory and use it several times.
|
||
|
|
In the last case, the password could be stored into the
|
||
|
|
.Fa userdata
|
||
|
|
storage and the callback only returns the password already stored.
|
||
|
|
.Pp
|
||
|
|
When asking for the password interactively, the callback can use
|
||
|
|
.Fa rwflag
|
||
|
|
to check whether an item shall be encrypted
|
||
|
|
.Pq Fa rwflag No = 1 .
|
||
|
|
In this case the password dialog may ask for the same password twice for
|
||
|
|
comparison in order to catch typos which would make decryption impossible.
|
||
|
|
.Pp
|
||
|
|
Other items in PEM formatting (certificates) can also be encrypted; it is
|
||
|
|
however atypical, as certificate information is considered public.
|
||
|
|
.Sh RETURN VALUES
|
||
|
|
.Fn SSL_CTX_get_default_passwd_cb
|
||
|
|
returns a function pointer to the password callback currently set in
|
||
|
|
.Fa ctx ,
|
||
|
|
or
|
||
|
|
.Dv NULL
|
||
|
|
if none is set.
|
||
|
|
.Pp
|
||
|
|
.Fn SSL_CTX_get_default_passwd_cb_userdata
|
||
|
|
returns a pointer to the userdata currently set in
|
||
|
|
.Fa ctx ,
|
||
|
|
or
|
||
|
|
.Dv NULL
|
||
|
|
if none is set.
|
||
|
|
.Sh EXAMPLES
|
||
|
|
The following example returns the password provided as
|
||
|
|
.Fa userdata
|
||
|
|
to the calling function.
|
||
|
|
The password is considered to be a
|
||
|
|
.Sq \e0
|
||
|
|
terminated string.
|
||
|
|
If the password does not fit into the buffer, the password is truncated.
|
||
|
|
.Bd -literal
|
||
|
|
int pem_passwd_cb(char *buf, int size, int rwflag, void *password)
|
||
|
|
{
|
||
|
|
strncpy(buf, (char *)password, size);
|
||
|
|
buf[size - 1] = '\e0';
|
||
|
|
return strlen(buf);
|
||
|
|
}
|
||
|
|
.Ed
|
||
|
|
.Sh SEE ALSO
|
||
|
|
.Xr ssl 3 ,
|
||
|
|
.Xr SSL_CTX_use_certificate 3
|
||
|
|
.Sh HISTORY
|
||
|
|
.Fn SSL_CTX_set_default_passwd_cb
|
||
|
|
first appeared in SSLeay 0.6.2 and has been available since
|
||
|
|
.Ox 2.4 .
|
||
|
|
.Pp
|
||
|
|
.Fn SSL_CTX_set_default_passwd_cb_userdata
|
||
|
|
first appeared in OpenSSL 0.9.4 and has been available since
|
||
|
|
.Ox 2.6 .
|
||
|
|
.Pp
|
||
|
|
.Fn SSL_CTX_get_default_passwd_cb
|
||
|
|
and
|
||
|
|
.Fn SSL_CTX_get_default_passwd_cb_userdata
|
||
|
|
first appeared in OpenSSL 1.1.0 and have been available since
|
||
|
|
.Ox 6.3 .
|