1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
|
.\" $OpenBSD: SSL_CTX_set_default_passwd_cb.3,v 1.7 2018/04/02 02:06:14 schwarze Exp $
.\" full merge up to: OpenSSL 9b86974e Aug 17 15:21:33 2015 -0400
.\" selective merge up to: OpenSSL 2947af32 Nov 19 00:10:05 2016 +0100
.\"
.\" This file was written by Lutz Jaenicke <jaenicke@openssl.org>
.\" and Christian Heimes <cheimes@redhat.com>.
.\" Copyright (c) 2000, 2001, 2016 The OpenSSL Project. All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\"
.\" 1. Redistributions of source code must retain the above copyright
.\" notice, this list of conditions and the following disclaimer.
.\"
.\" 2. Redistributions in binary form must reproduce the above copyright
.\" notice, this list of conditions and the following disclaimer in
.\" the documentation and/or other materials provided with the
.\" distribution.
.\"
.\" 3. All advertising materials mentioning features or use of this
.\" software must display the following acknowledgment:
.\" "This product includes software developed by the OpenSSL Project
.\" for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
.\"
.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
.\" endorse or promote products derived from this software without
.\" prior written permission. For written permission, please contact
.\" openssl-core@openssl.org.
.\"
.\" 5. Products derived from this software may not be called "OpenSSL"
.\" nor may "OpenSSL" appear in their names without prior written
.\" permission of the OpenSSL Project.
.\"
.\" 6. Redistributions of any form whatsoever must retain the following
.\" acknowledgment:
.\" "This product includes software developed by the OpenSSL Project
.\" for use in the OpenSSL Toolkit (http://www.openssl.org/)"
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
.\" OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.Dd $Mdocdate: April 2 2018 $
.Dt SSL_CTX_SET_DEFAULT_PASSWD_CB 3
.Os
.Sh NAME
.Nm SSL_CTX_set_default_passwd_cb ,
.Nm SSL_CTX_set_default_passwd_cb_userdata ,
.Nm SSL_CTX_get_default_passwd_cb ,
.Nm SSL_CTX_get_default_passwd_cb_userdata ,
.Nm pem_password_cb
.Nd set or get passwd callback for encrypted PEM file handling
.Sh SYNOPSIS
.In openssl/ssl.h
.Ft void
.Fn SSL_CTX_set_default_passwd_cb "SSL_CTX *ctx" "pem_password_cb *cb"
.Ft void
.Fn SSL_CTX_set_default_passwd_cb_userdata "SSL_CTX *ctx" "void *u"
.Ft pem_password_cb *
.Fn SSL_CTX_get_default_passwd_cb "SSL_CTX *ctx"
.Ft void *
.Fn SSL_CTX_get_default_passwd_cb_userdata "SSL_CTX *ctx"
.In openssl/pem.h
.Ft typedef int
.Fn pem_password_cb "char *buf" "int size" "int rwflag" "void *userdata"
.Sh DESCRIPTION
.Fn SSL_CTX_set_default_passwd_cb
sets the default password callback called when loading/storing a PEM
certificate with encryption.
.Pp
.Fn SSL_CTX_set_default_passwd_cb_userdata
sets a pointer to userdata
.Fa u
which will be provided to the password callback on invocation.
.Pp
The
password callback
.Fa cb ,
which must be provided by the application,
hands back the password to be used during decryption.
On invocation a pointer to
.Fa userdata
is provided.
The password callback must write the password into the provided buffer
.Fa buf
which is of size
.Fa size .
The actual length of the password must be returned to the calling function.
.Fa rwflag
indicates whether the callback is used for reading/decryption
.Pq Fa rwflag No = 0
or writing/encryption
.Pq Fa rwflag No = 1 .
.Pp
When loading or storing private keys, a password might be supplied to protect
the private key.
The way this password can be supplied may depend on the application.
If only one private key is handled, it can be practical to have the
callback handle the password dialog interactively.
If several keys have to be handled, it can be practical to ask for the password
once, then keep it in memory and use it several times.
In the last case, the password could be stored into the
.Fa userdata
storage and the callback only returns the password already stored.
.Pp
When asking for the password interactively, the callback can use
.Fa rwflag
to check whether an item shall be encrypted
.Pq Fa rwflag No = 1 .
In this case the password dialog may ask for the same password twice for
comparison in order to catch typos which would make decryption impossible.
.Pp
Other items in PEM formatting (certificates) can also be encrypted; it is
however atypical, as certificate information is considered public.
.Sh RETURN VALUES
.Fn SSL_CTX_get_default_passwd_cb
returns a function pointer to the password callback currently set in
.Fa ctx ,
or
.Dv NULL
if none is set.
.Pp
.Fn SSL_CTX_get_default_passwd_cb_userdata
returns a pointer to the userdata currently set in
.Fa ctx ,
or
.Dv NULL
if none is set.
.Sh EXAMPLES
The following example returns the password provided as
.Fa userdata
to the calling function.
The password is considered to be a
.Sq \e0
terminated string.
If the password does not fit into the buffer, the password is truncated.
.Bd -literal
int pem_passwd_cb(char *buf, int size, int rwflag, void *password)
{
strncpy(buf, (char *)password, size);
buf[size - 1] = '\e0';
return strlen(buf);
}
.Ed
.Sh SEE ALSO
.Xr ssl 3 ,
.Xr SSL_CTX_use_certificate 3
.Sh HISTORY
.Fn SSL_CTX_set_default_passwd_cb
first appeared in SSLeay 0.6.2 and has been available since
.Ox 2.4 .
.Pp
.Fn SSL_CTX_set_default_passwd_cb_userdata
first appeared in OpenSSL 0.9.4 and has been available since
.Ox 2.6 .
.Pp
.Fn SSL_CTX_get_default_passwd_cb
and
.Fn SSL_CTX_get_default_passwd_cb_userdata
first appeared in OpenSSL 1.1.0 and have been available since
.Ox 6.3 .
|
