mirror of
https://github.com/opnsense/src.git
synced 2026-02-27 03:40:37 -05:00
b077aed33b
Migrate to OpenSSL 3.0 in advance of FreeBSD 14.0. OpenSSL 1.1.1 (the version we were previously using) will be EOL as of 2023-09-11. Most of the base system has already been updated for a seamless switch to OpenSSL 3.0. For many components we've added `-DOPENSSL_API_COMPAT=0x10100000L` to CFLAGS to specify the API version, which avoids deprecation warnings from OpenSSL 3.0. Changes have also been made to avoid OpenSSL APIs that were already deprecated in OpenSSL 1.1.1. The process of updating to contemporary APIs can continue after this merge. Additional changes are still required for libarchive and Kerberos- related libraries or tools; workarounds will immediately follow this commit. Fixes are in progress in the upstream projects and will be incorporated when those are next updated. There are some performance regressions in benchmarks (certain tests in `openssl speed`) and in some OpenSSL consumers in ports (e.g. haproxy). Investigation will continue for these. Netflix's testing showed no functional regression and a rather small, albeit statistically significant, increase in CPU consumption with OpenSSL 3.0. Thanks to ngie@ and des@ for updating base system components, to antoine@ and bofh@ for ports exp-runs and port fixes/workarounds, and to Netflix and everyone who tested prior to commit or contributed to this update in other ways. PR: 271615 PR: 271656 [exp-run] Relnotes: Yes Sponsored by: The FreeBSD Foundation
240 lines
9 KiB
Groff
240 lines
9 KiB
Groff
.\" Automatically generated by Pod::Man 4.14 (Pod::Simple 3.40)
|
|
.\"
|
|
.\" Standard preamble:
|
|
.\" ========================================================================
|
|
.de Sp \" Vertical space (when we can't use .PP)
|
|
.if t .sp .5v
|
|
.if n .sp
|
|
..
|
|
.de Vb \" Begin verbatim text
|
|
.ft CW
|
|
.nf
|
|
.ne \\$1
|
|
..
|
|
.de Ve \" End verbatim text
|
|
.ft R
|
|
.fi
|
|
..
|
|
.\" Set up some character translations and predefined strings. \*(-- will
|
|
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
|
|
.\" double quote, and \*(R" will give a right double quote. \*(C+ will
|
|
.\" give a nicer C++. Capital omega is used to do unbreakable dashes and
|
|
.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
|
|
.\" nothing in troff, for use with C<>.
|
|
.tr \(*W-
|
|
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
|
|
.ie n \{\
|
|
. ds -- \(*W-
|
|
. ds PI pi
|
|
. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
|
|
. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
|
|
. ds L" ""
|
|
. ds R" ""
|
|
. ds C` ""
|
|
. ds C' ""
|
|
'br\}
|
|
.el\{\
|
|
. ds -- \|\(em\|
|
|
. ds PI \(*p
|
|
. ds L" ``
|
|
. ds R" ''
|
|
. ds C`
|
|
. ds C'
|
|
'br\}
|
|
.\"
|
|
.\" Escape single quotes in literal strings from groff's Unicode transform.
|
|
.ie \n(.g .ds Aq \(aq
|
|
.el .ds Aq '
|
|
.\"
|
|
.\" If the F register is >0, we'll generate index entries on stderr for
|
|
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
|
|
.\" entries marked with X<> in POD. Of course, you'll have to process the
|
|
.\" output yourself in some meaningful fashion.
|
|
.\"
|
|
.\" Avoid warning from groff about undefined register 'F'.
|
|
.de IX
|
|
..
|
|
.nr rF 0
|
|
.if \n(.g .if rF .nr rF 1
|
|
.if (\n(rF:(\n(.g==0)) \{\
|
|
. if \nF \{\
|
|
. de IX
|
|
. tm Index:\\$1\t\\n%\t"\\$2"
|
|
..
|
|
. if !\nF==2 \{\
|
|
. nr % 0
|
|
. nr F 2
|
|
. \}
|
|
. \}
|
|
.\}
|
|
.rr rF
|
|
.\"
|
|
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
|
|
.\" Fear. Run. Save yourself. No user-serviceable parts.
|
|
. \" fudge factors for nroff and troff
|
|
.if n \{\
|
|
. ds #H 0
|
|
. ds #V .8m
|
|
. ds #F .3m
|
|
. ds #[ \f1
|
|
. ds #] \fP
|
|
.\}
|
|
.if t \{\
|
|
. ds #H ((1u-(\\\\n(.fu%2u))*.13m)
|
|
. ds #V .6m
|
|
. ds #F 0
|
|
. ds #[ \&
|
|
. ds #] \&
|
|
.\}
|
|
. \" simple accents for nroff and troff
|
|
.if n \{\
|
|
. ds ' \&
|
|
. ds ` \&
|
|
. ds ^ \&
|
|
. ds , \&
|
|
. ds ~ ~
|
|
. ds /
|
|
.\}
|
|
.if t \{\
|
|
. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
|
|
. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
|
|
. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
|
|
. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
|
|
. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
|
|
. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
|
|
.\}
|
|
. \" troff and (daisy-wheel) nroff accents
|
|
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
|
|
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
|
|
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
|
|
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
|
|
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
|
|
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
|
|
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
|
|
.ds ae a\h'-(\w'a'u*4/10)'e
|
|
.ds Ae A\h'-(\w'A'u*4/10)'E
|
|
. \" corrections for vroff
|
|
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
|
|
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
|
|
. \" for low resolution devices (crt and lpr)
|
|
.if \n(.H>23 .if \n(.V>19 \
|
|
\{\
|
|
. ds : e
|
|
. ds 8 ss
|
|
. ds o a
|
|
. ds d- d\h'-1'\(ga
|
|
. ds D- D\h'-1'\(hy
|
|
. ds th \o'bp'
|
|
. ds Th \o'LP'
|
|
. ds ae ae
|
|
. ds Ae AE
|
|
.\}
|
|
.rm #[ #] #H #V #F C
|
|
.\" ========================================================================
|
|
.\"
|
|
.IX Title "OSSL_HTTP_PARSE_URL 3"
|
|
.TH OSSL_HTTP_PARSE_URL 3 "2023-05-30" "3.0.9" "OpenSSL"
|
|
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
|
|
.\" way too many mistakes in technical documents.
|
|
.if n .ad l
|
|
.nh
|
|
.SH "NAME"
|
|
OSSL_HTTP_adapt_proxy,
|
|
OSSL_parse_url,
|
|
OSSL_HTTP_parse_url,
|
|
OCSP_parse_url
|
|
\&\- http utility functions
|
|
.SH "SYNOPSIS"
|
|
.IX Header "SYNOPSIS"
|
|
.Vb 1
|
|
\& #include <openssl/http.h>
|
|
\&
|
|
\& const char *OSSL_HTTP_adapt_proxy(const char *proxy, const char *no_proxy,
|
|
\& const char *server, int use_ssl);
|
|
\&
|
|
\& int OSSL_parse_url(const char *url, char **pscheme, char **puser, char **phost,
|
|
\& char **pport, int *pport_num,
|
|
\& char **ppath, char **pquery, char **pfrag);
|
|
\& int OSSL_HTTP_parse_url(const char *url,
|
|
\& int *pssl, char **puser, char **phost,
|
|
\& char **pport, int *pport_num,
|
|
\& char **ppath, char **pquery, char **pfrag);
|
|
.Ve
|
|
.PP
|
|
The following functions have been deprecated since OpenSSL 3.0, and can be
|
|
hidden entirely by defining \fB\s-1OPENSSL_API_COMPAT\s0\fR with a suitable version value,
|
|
see \fBopenssl_user_macros\fR\|(7):
|
|
.PP
|
|
.Vb 2
|
|
\& int OCSP_parse_url(const char *url, char **phost, char **pport, char **ppath,
|
|
\& int *pssl);
|
|
.Ve
|
|
.SH "DESCRIPTION"
|
|
.IX Header "DESCRIPTION"
|
|
\&\fBOSSL_HTTP_adapt_proxy()\fR takes an optional proxy hostname \fIproxy\fR
|
|
and returns it transformed according to the optional \fIno_proxy\fR parameter,
|
|
\&\fIserver\fR, \fIuse_ssl\fR, and the applicable environment variable, as follows.
|
|
If \fIproxy\fR is \s-1NULL,\s0 take any default value from the \f(CW\*(C`http_proxy\*(C'\fR
|
|
environment variable, or from \f(CW\*(C`https_proxy\*(C'\fR if \fIuse_ssl\fR is nonzero.
|
|
If this still does not yield a proxy hostname,
|
|
take any further default value from the \f(CW\*(C`HTTP_PROXY\*(C'\fR
|
|
environment variable, or from \f(CW\*(C`HTTPS_PROXY\*(C'\fR if \fIuse_ssl\fR is nonzero.
|
|
If \fIno_proxy\fR is \s-1NULL,\s0 take any default exclusion value from the \f(CW\*(C`no_proxy\*(C'\fR
|
|
environment variable, or else from \f(CW\*(C`NO_PROXY\*(C'\fR.
|
|
Return the determined proxy hostname unless the exclusion contains \fIserver\fR.
|
|
Otherwise return \s-1NULL.\s0
|
|
.PP
|
|
\&\fBOSSL_parse_url()\fR parses its input string \fIurl\fR as a \s-1URL\s0 of the form
|
|
\&\f(CW\*(C`[scheme://][userinfo@]host[:port][/path][?query][#fragment]\*(C'\fR and splits it up
|
|
into scheme, userinfo, host, port, path, query, and fragment components.
|
|
The host (or server) component may be a \s-1DNS\s0 name or an \s-1IP\s0 address
|
|
where IPv6 addresses should be enclosed in square brackets \f(CW\*(C`[\*(C'\fR and \f(CW\*(C`]\*(C'\fR.
|
|
The port component is optional and defaults to \f(CW0\fR.
|
|
If given, it must be in decimal form. If the \fIpport_num\fR argument is not \s-1NULL\s0
|
|
the integer value of the port number is assigned to \fI*pport_num\fR on success.
|
|
The path component is also optional and defaults to \f(CW\*(C`/\*(C'\fR.
|
|
Each non-NULL result pointer argument \fIpscheme\fR, \fIpuser\fR, \fIphost\fR, \fIpport\fR,
|
|
\&\fIppath\fR, \fIpquery\fR, and \fIpfrag\fR, is assigned the respective url component.
|
|
On success, they are guaranteed to contain non-NULL string pointers, else \s-1NULL.\s0
|
|
It is the reponsibility of the caller to free them using \fBOPENSSL_free\fR\|(3).
|
|
If \fIpquery\fR is \s-1NULL,\s0 any given query component is handled as part of the path.
|
|
A string returned via \fI*ppath\fR is guaranteed to begin with a \f(CW\*(C`/\*(C'\fR character.
|
|
For absent scheme, userinfo, port, query, and fragment components
|
|
an empty string is provided.
|
|
.PP
|
|
\&\fBOSSL_HTTP_parse_url()\fR is a special form of \fBOSSL_parse_url()\fR
|
|
where the scheme, if given, must be \f(CW\*(C`http\*(C'\fR or \f(CW\*(C`https\*(C'\fR.
|
|
If \fIpssl\fR is not \s-1NULL,\s0 \fI*pssl\fR is assigned 1 in case parsing was successful
|
|
and the scheme is \f(CW\*(C`https\*(C'\fR, else 0.
|
|
The port component is optional and defaults to \f(CW443\fR if the scheme is \f(CW\*(C`https\*(C'\fR,
|
|
else \f(CW80\fR.
|
|
Note that relative paths must be given with a leading \f(CW\*(C`/\*(C'\fR,
|
|
otherwise the first path element is interpreted as the hostname.
|
|
.PP
|
|
Calling the deprecated function OCSP_parse_url(url, host, port, path, ssl)
|
|
is equivalent to
|
|
OSSL_HTTP_parse_url(url, ssl, \s-1NULL,\s0 host, port, \s-1NULL,\s0 path, \s-1NULL, NULL\s0).
|
|
.SH "RETURN VALUES"
|
|
.IX Header "RETURN VALUES"
|
|
\&\fBOSSL_HTTP_adapt_proxy()\fR returns \s-1NULL\s0 if no proxy is to be used,
|
|
otherwise a constant proxy hostname string,
|
|
which is either the proxy name handed in or an environment variable value.
|
|
.PP
|
|
\&\fBOSSL_parse_url()\fR, \fBOSSL_HTTP_parse_url()\fR, and \fBOCSP_parse_url()\fR
|
|
return 1 on success, 0 on error.
|
|
.SH "SEE ALSO"
|
|
.IX Header "SEE ALSO"
|
|
\&\fBOSSL_HTTP_transfer\fR\|(3)
|
|
.SH "HISTORY"
|
|
.IX Header "HISTORY"
|
|
\&\fBOSSL_HTTP_adapt_proxy()\fR,
|
|
\&\fBOSSL_parse_url()\fR and \fBOSSL_HTTP_parse_url()\fR were added in OpenSSL 3.0.
|
|
\&\fBOCSP_parse_url()\fR was deprecated in OpenSSL 3.0.
|
|
.SH "COPYRIGHT"
|
|
.IX Header "COPYRIGHT"
|
|
Copyright 2019\-2021 The OpenSSL Project Authors. All Rights Reserved.
|
|
.PP
|
|
Licensed under the Apache License 2.0 (the \*(L"License\*(R"). You may not use
|
|
this file except in compliance with the License. You can obtain a copy
|
|
in the file \s-1LICENSE\s0 in the source distribution or at
|
|
<https://www.openssl.org/source/license.html>.
|