From: Dr. David von Oheimb Date: Mon, 17 May 2021 09:04:40 +0000 (+0200) Subject: DOC: Fix nits found by new check on SYNOPSIS and OPTIONS consistency X-Git-Tag: openssl-3.0.0-beta1~467 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=359efeac3f9b99c5f734b90db8a4c5bfadb7323a;p=thirdparty%2Fopenssl.git DOC: Fix nits found by new check on SYNOPSIS and OPTIONS consistency Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/15299) --- diff --git a/apps/CA.pl.in b/apps/CA.pl.in index c0afb967161..6d1de165169 100644 --- a/apps/CA.pl.in +++ b/apps/CA.pl.in @@ -122,9 +122,9 @@ if ( $WHAT =~ /^(-\?|-h|-help)$/ ) { print STDERR < | B<-newca> [B<-extra-I> I] -B B<-pkcs12> [B<-extra-pkcs12> I] [I] +B B<-pkcs12> [I] -B B<-verify> [B<-extra-verify> I] I ... +B B<-verify> I ... -B B<-revoke> [B<-extra-ca> I] I [I] +B B<-revoke> I [I] =head1 DESCRIPTION @@ -57,7 +57,7 @@ the correct path of the configuration file. =over 4 -=item B, B<-h>, B<-help> +=item B<-?>, B<-h>, B<-help> Prints a usage message. diff --git a/doc/man1/openssl-ec.pod.in b/doc/man1/openssl-ec.pod.in index e38e405934a..86967012578 100644 --- a/doc/man1/openssl-ec.pod.in +++ b/doc/man1/openssl-ec.pod.in @@ -100,6 +100,10 @@ Prints out the public, private key components and parameters. This option prevents output of the encoded version of the key. +=item B<-param_out> + +Print the elliptic curve parameters. + =item B<-pubin> By default, a private key is read from the input file. With this option a diff --git a/doc/man1/openssl-enc.pod.in b/doc/man1/openssl-enc.pod.in index 5c94f491736..f424358ab3d 100644 --- a/doc/man1/openssl-enc.pod.in +++ b/doc/man1/openssl-enc.pod.in @@ -54,6 +54,10 @@ either by itself or in addition to the encryption or decryption. =over 4 +=item B<-I> + +The cipher to use. + =item B<-help> Print out a usage message. diff --git a/doc/man1/openssl-ocsp.pod.in b/doc/man1/openssl-ocsp.pod.in index 0aa06834a96..0116feeaaef 100644 --- a/doc/man1/openssl-ocsp.pod.in +++ b/doc/man1/openssl-ocsp.pod.in @@ -14,6 +14,7 @@ B B [B<-out> I] [B<-issuer> I] [B<-cert> I] +[B<-no_certs>] [B<-serial> I] [B<-signer> I] [B<-signkey> I] @@ -23,7 +24,6 @@ B B [B<-req_text>] [B<-resp_text>] [B<-text>] -[B<-no_certs>] [B<-reqout> I] [B<-respout> I] [B<-reqin> I] @@ -112,6 +112,10 @@ Add the certificate I to the request. The issuer certificate is taken from the previous B<-issuer> option, or an error occurs if no issuer certificate is specified. +=item B<-no_certs> + +Don't include any certificates in signed request. + =item B<-serial> I Same as the B<-cert> option except the certificate with serial number @@ -389,7 +393,6 @@ each child is willing to wait for the client's OCSP response. This option is available on POSIX systems (that support the fork() and other required unix system-calls). - =item B<-nmin> I, B<-ndays> I Number of minutes or days when fresh revocation information is available: diff --git a/doc/man1/openssl-pkcs8.pod.in b/doc/man1/openssl-pkcs8.pod.in index 100c5afd6fb..2af61203e9a 100644 --- a/doc/man1/openssl-pkcs8.pod.in +++ b/doc/man1/openssl-pkcs8.pod.in @@ -101,6 +101,10 @@ When creating new PKCS#8 containers, use a given number of iterations on the password in deriving the encryption key for the PKCS#8 output. High values increase the time required to brute-force a PKCS#8 container. +=item B<-noiter> + +When creating new PKCS#8 containers, use 1 as iteration count. + =item B<-nocrypt> PKCS#8 keys generated or input are normally PKCS#8 EncryptedPrivateKeyInfo diff --git a/doc/man1/openssl-s_server.pod.in b/doc/man1/openssl-s_server.pod.in index c7ce886b6ff..27522fc04be 100644 --- a/doc/man1/openssl-s_server.pod.in +++ b/doc/man1/openssl-s_server.pod.in @@ -77,13 +77,13 @@ B B [B<-no_proxy> I] [B<-status_url> I] [B<-status_file> I] +[B<-ssl_config> I] [B<-trace>] [B<-security_debug>] [B<-security_debug_verbose>] [B<-brief>] [B<-rev>] [B<-async>] -[B<-ssl_config> I] [B<-max_send_frag> I<+int>] [B<-split_send_frag> I<+int>] [B<-max_pipelines> I<+int>] @@ -123,9 +123,9 @@ B B [B<-listen>] [B<-sctp>] [B<-sctp_label_bug>] +[B<-use_srtp> I] [B<-no_dhe>] [B<-nextprotoneg> I] -[B<-use_srtp> I] [B<-alpn> I] [B<-sendfile>] [B<-keylogfile> I] @@ -303,6 +303,14 @@ This option translated a line feed from the terminal into CR+LF. Print extensive debugging information including a hex dump of all traffic. +=item B<-security_debug> + +Print output from SSL/TLS security framework. + +=item B<-security_debug_verbose> + +Print more output from SSL/TLS security framework + =item B<-msg> Show all protocol messages with hex dump. @@ -377,6 +385,10 @@ DH). Inhibit printing of session and certificate information. +=item B<-no_resume_ephemeral> + +Disable caching and tickets if ephemeral (EC)DH is used. + =item B<-tlsextdebug> Print a hex dump of any TLS extensions received from the server. @@ -426,6 +438,14 @@ option is enabled the peer does not need to send the close_notify alert and a closed connection will be treated as if the close_notify alert was received. For more information on shutting down a connection, see L. +=item B<-servername> + +Servername for HostName TLS extension. + +=item B<-servername_fatal> + +On servername mismatch send fatal alert (default: warning alert). + =item B<-id_prefix> I Generate SSL/TLS session IDs prefixed by I. This is mostly useful @@ -433,12 +453,40 @@ for testing any SSL/TLS code (e.g. proxies) that wish to deal with multiple servers, when each of which might be generating a unique range of session IDs (e.g. with a certain prefix). +=item B<-keymatexport> + +Export keying material using label. + +=item B<-keymatexportlen> + +Export the given number of bytes of keying material; default 20. + +=item B<-no_cache> + +Disable session cache. + +=item B<-ext_cache>. + +Disable internal cache, set up and use external cache. + =item B<-verify_return_error> Verification errors normally just print a message but allow the connection to continue, for debugging purposes. If this option is used, then verification errors close the connection. +=item B<-verify_quiet> + +No verify output except verify errors. + +=item B<-ign_eof> + +Ignore input EOF (default: when B<-quiet>). + +=item B<-no_ign_eof> + +Do not ignore input EOF. + =item B<-status> Enables certificate status request support (aka OCSP stapling). @@ -482,6 +530,10 @@ Any given query component is handled as part of the path component. Overrides any OCSP responder URLs from the certificate and always provides the OCSP Response stored in the file. The file must be in DER format. +=item B<-ssl_config> I + +Configure SSL_CTX using the given configuration value. + =item B<-trace> Show verbose trace output of protocol messages. OpenSSL needs to be compiled @@ -622,6 +674,14 @@ will be used. Turns on non blocking I/O. +=item B<-timeout> + +Enable timeouts. + +=item B<-mtu> + +Set link-layer MTU. + =item B<-psk_identity> I Expect the client to send PSK identity I when using a PSK @@ -644,6 +704,16 @@ This option must be provided in order to use a PSK cipher. Use the pem encoded SSL_SESSION data stored in I as the basis of a PSK. Note that this will only work if TLSv1.3 is negotiated. +=item B<-srpvfile> + +The verifier file for SRP. +This option is deprecated. + +=item B<-srpuserseed> + +A seed string for a default user salt. +This option is deprecated. + =item B<-listen> This option can only be used in conjunction with one of the DTLS options above. @@ -669,6 +739,10 @@ older broken implementations but breaks interoperability with correct implementations. Must be used in conjunction with B<-sctp>. This option is only available where OpenSSL has support for SCTP enabled. +=item B<-use_srtp> + +Offer SRTP key management with a colon-separated profile list. + =item B<-no_dhe> If this option is set then no DH parameters will be loaded effectively @@ -849,7 +923,8 @@ The -no_alt_chains option was added in OpenSSL 1.1.0. The -allow-no-dhe-kex and -prioritize_chacha options were added in OpenSSL 1.1.1. -The B<-engine> option was deprecated in OpenSSL 3.0. +The B<-srpvfile>, B<-srpuserseed>, and B<-engine> +option were deprecated in OpenSSL 3.0. =head1 COPYRIGHT diff --git a/doc/man1/openssl-speed.pod.in b/doc/man1/openssl-speed.pod.in index 0dbb19da4c2..bfe992797a5 100644 --- a/doc/man1/openssl-speed.pod.in +++ b/doc/man1/openssl-speed.pod.in @@ -81,6 +81,14 @@ C. Time the decryption instead of encryption. Affects only the EVP testing. +=item B<-mb> + +Enable multi-block mode on EVP-named cipher. + +=item B<-aead> + +Benchmark EVP-named AEAD cipher in TLS-like sequence. + =item B<-primes> I Generate a I-prime RSA key and use it to run the benchmarks. This option diff --git a/doc/man1/openssl-srp.pod.in b/doc/man1/openssl-srp.pod.in index c15d866704f..26f7ebcef9c 100644 --- a/doc/man1/openssl-srp.pod.in +++ b/doc/man1/openssl-srp.pod.in @@ -15,7 +15,6 @@ B [B<-delete>] [B<-list>] [B<-name> I
] -[B<-config> I] [B<-srpvfile> I] [B<-gn> I] [B<-userinfo> I] @@ -23,6 +22,7 @@ B [B<-passout> I] {- $OpenSSL::safe::opt_engine_synopsis -}{- $OpenSSL::safe::opt_r_synopsis -} {- $OpenSSL::safe::opt_provider_synopsis -} +{- $OpenSSL::safe::opt_config_synopsis -} [I ...] =head1 DESCRIPTION @@ -49,6 +49,26 @@ Display an option summary. Generate verbose output while processing. +=item B<-add> + +Add a user and SRP verifier. + +=item B<-modify> + +Modify the SRP verifier of an existing user. + +=item B<-delete> + +Delete user from verifier file. + +=item B<-list> + +List users. + +=item B<-name> + +The particular SRP definition to use. + =item B<-srpvfile> I If the config file is not specified, @@ -72,8 +92,12 @@ see L. {- $OpenSSL::safe::opt_engine_item -} +{- $OpenSSL::safe::opt_r_item -} + {- $OpenSSL::safe::opt_provider_item -} +{- $OpenSSL::safe::opt_config_item -} + {- $OpenSSL::safe::opt_r_synopsis -} =back diff --git a/doc/man1/openssl-ts.pod.in b/doc/man1/openssl-ts.pod.in index cf7d5f0260b..6f718202024 100644 --- a/doc/man1/openssl-ts.pod.in +++ b/doc/man1/openssl-ts.pod.in @@ -106,11 +106,23 @@ requests either by ftp or e-mail. Print out a usage message. +=item B<-query> + +Generate a TS query. For details see L. + +=item B<-reply> + +Generate a TS reply. For details see L. + +=item B<-verify> + +Verify a TS response. For details see L. + =back =head2 Timestamp Request generation -The B<-query> switch can be used for creating and printing a timestamp +The B<-query> command can be used for creating and printing a timestamp request with the following options: =over 4 diff --git a/doc/man1/openssl.pod b/doc/man1/openssl.pod index 78b98ab7a6b..3b47ae97298 100644 --- a/doc/man1/openssl.pod +++ b/doc/man1/openssl.pod @@ -13,13 +13,13 @@ I B B -B<-standard-commands> | -B<-digest-commands> | -B<-cipher-commands> | -B<-cipher-algorithms> | -B<-digest-algorithms> | -B<-mac-algorithms> | -B<-public-key-algorithms> +B | +B | +B | +B | +B | +B | +B B BI [ I ] diff --git a/doc/perlvars.pm b/doc/perlvars.pm index ab52a086eef..71f3888d585 100644 --- a/doc/perlvars.pm +++ b/doc/perlvars.pm @@ -58,14 +58,14 @@ $OpenSSL::safe::opt_v_item = "" # Extended validation options. $OpenSSL::safe::opt_x_synopsis = "" -. "[B<-xkey>] I\n" +. "[B<-xkey> I]\n" . "[B<-xcert> I]\n" -. "[B<-xchain>] I\n" -. "[B<-xchain_build>] I\n" +. "[B<-xchain> I]\n" +. "[B<-xchain_build> I]\n" . "[B<-xcertform> B|B]>\n" . "[B<-xkeyform> B|B]>"; $OpenSSL::safe::opt_x_item = "" -. "=item B I, B<-xcert> I, B<-xchain> I,\n" +. "=item B<-xkey> I, B<-xcert> I, B<-xchain> I,\n" . "B<-xchain_build> I, B<-xcertform> B|B,\n" . "B<-xkeyform> B|B\n" . "\n" @@ -203,8 +203,9 @@ $OpenSSL::safe::opt_s_synopsis = "" . "[B<-no_middlebox>]"; $OpenSSL::safe::opt_s_item = "" . "=item B<-bugs>, B<-comp>, B<-no_comp>, B<-no_ticket>, B<-serverpref>,\n" -. "B<-client_renegotiation>, B<_immediate_renegotiation>\n" -. "B<-legacy_renegotiation>, B<-no_renegotiation>, B<-no_resumption_on_reneg>,\n" +. "B<-client_renegotiation>, B<_immediate_renegotiation>,\n" +. "B<-legacy_renegotiation>, B<-no_renegotiation>,\n" +. "B<-immediate_renegotiation>, B<-no_resumption_on_reneg>,\n" . "B<-legacy_server_connect>, B<-no_legacy_server_connect>,\n" . "B<-allow_no_dhe_kex>, B<-prioritize_chacha>, B<-strict>, B<-sigalgs>\n" . "I, B<-client_sigalgs> I, B<-groups> I, B<-curves>\n"