{"action":"created","comment":{"url":"https://api.github.com/repos/openssl/openssl/pulls/comments/58766530","id":58766530,"diff_hunk":"@@ -2,39 +2,89 @@\n \n =head1 NAME\n \n+SSL_ct_enable, SSL_CTX_ct_enable, SSL_ct_disable, SSL_CTX_ct_disable,\n SSL_set_ct_validation_callback, SSL_CTX_set_ct_validation_callback,\n-SSL_get_ct_validation_callback, SSL_CTX_get_ct_validation_callback -\n+SSL_ct_is_enabled, SSL_CTX_ct_is_enabled -\n control Certificate Transparency policy\n \n =head1 SYNOPSIS\n \n  #include <openssl/ssl.h>\n \n- int SSL_set_ct_validation_callback(SSL *s, ct_validation_cb callback, void *arg);\n- int SSL_CTX_set_ct_validation_callback(SSL_CTX *ctx, ct_validation_cb callback, void *arg);\n- ct_validation_cb SSL_get_ct_validation_callback(const SSL *s);\n- ct_validation_cb SSL_CTX_get_ct_validation_callback(const SSL_CTX *ctx);\n+ int SSL_ct_enable(SSL *s, int vtype);\n+ int SSL_CTX_ct_enable(SSL_CTX *ctx, int vtype);\n+ int SSL_set_ct_validation_callback(SSL *s, ssl_ct_validation_cb callback,\n+                                    void *arg);\n+ int SSL_CTX_set_ct_validation_callback(SSL_CTX *ctx,\n+                                        ssl_ct_validation_cb callback,\n+                                        void *arg);\n+ void SSL_ct_disable(SSL *s);\n+ void SSL_CTX_ct_disable(SSL_CTX *ctx);\n+ int SSL_ct_is_enabled(const SSL *s);\n+ int SSL_CTX_ct_is_enabled(const SSL_CTX *ctx);\n \n =head1 DESCRIPTION\n \n-SSL_set_ct_validation_callback() and SSL_CTX_set_ct_validation_callback() set\n-the function that is called when Certificate Transparency validation needs to\n-occur. It is the responsibility of this function to examine the signed\n-certificate timestamps (SCTs) that are passed to it and determine whether they\n-are sufficient to allow the connection to continue. If they are, the function\n-must return 1, otherwise it must return 0.\n-\n-An arbitrary piece of user data, B<arg>, can be passed in when setting the\n-callback. This will be passed to the callback whenever it is invoked. Ownership\n-of this userdata remains with the caller.\n+SSL_ct_enable() and SSL_CTX_ct_enable() enable the processing of signed\n+certificate timestamps (SCTs) either for a given SSL connection or for all\n+connections that share the given SSL context, respectively.\n+This is accomplished by setting a built-in CT validation callback.\n+The behaviour of the callback is determined by the B<vtype> argument.\n+\n+If B<vtype> is equal to B<SSL_CT_VALIDATION_PERMISSIVE>, then the\n+handshake continues regardless of the validation status of any SCTs.\n+The application can inspect the validation status of the SCTs at\n+handshake completion.\n+Note that with session resumption there will not be any SCTs presented during\n+the handshake.\n+Therefore, in applications that delay SCT policy enforcement until after\n+handshake completion, SCT checks should only be performed when the session is\n+not reused.\n+See L<SSL_session_reused(3)>.\n+\n+If B<vtype> is equal to B<SSL_CT_VALIDATION_STRICT>, then in a full TLS\n+handshake with the verification mode set to B<SSL_VERIFY_PEER>, if the peer\n+presents no valid SCTs the handshake will be aborted.\n+See L<SSL_set_verify(3)>.\n+\n+SSL_set_ct_validation_callback() and SSL_CTX_set_ct_validation_callback()\n+register a custom callback that may implement a different policy than either of\n+the above.\n+This callback can examine the peer's SCTs and determine whether they are\n+sufficient to allow the connection to continue.\n+The TLS handshake is aborted if the verification mode is not B<SSL_VERIFY_NONE>\n+and the callback returns a non-positive result.\n+\n+An arbitrary callback context argument, B<arg>, can be passed in when setting\n+the callback.\n+This will be passed to the callback whenever it is invoked.\n+Ownership of this context remains with the caller.\n \n If no callback is set, SCTs will not be requested and Certificate Transparency\n validation will not occur.\n \n+No callback will be invoked when the peer presents no certificate, e.g. by\n+employing an anonymous (aNULL) ciphersuite.\n+In that case the handshake continues as it would had no callback been\n+requested.\n+Callbacks are also not invoked when the peer certificate chain is invalid or\n+validated via DANE-TA(2) or DANE-EE(3) TLSA records which use a private X.509\n+PKI, or no X.509 PKI at all, respectively.\n+Clients that require SCTs are expected to not have enabled any aNULL ciphers\n+nor to have specified server verification via DANE-TA(2) or DANE-EE(3) TLSA\n+records.\n+\n+SSL_ct_disable() and SSL_CTX_ct_disable() turn off CT processing, whether\n+enabled via the built-in or the custom callbacks, by setting a NULL callback.\n+These may be implemented as macros.\n+\n+SSL_ct_is_enabled() and SSL_CTX_ct_is_enabled() return 1 if CT processing is\n+enabled via a non-null validation callback, and 0 otherwise.","path":"doc/ssl/SSL_CTX_set_ct_validation_callback.pod","position":96,"original_position":96,"commit_id":"705b88024df646be74476d4930c831b60d696958","original_commit_id":"705b88024df646be74476d4930c831b60d696958","user":{"login":"vdukhovni","id":1107986,"avatar_url":"https://avatars.githubusercontent.com/u/1107986?v=3","gravatar_id":"","url":"https://api.github.com/users/vdukhovni","html_url":"https://github.com/vdukhovni","followers_url":"https://api.github.com/users/vdukhovni/followers","following_url":"https://api.github.com/users/vdukhovni/following{/other_user}","gists_url":"https://api.github.com/users/vdukhovni/gists{/gist_id}","starred_url":"https://api.github.com/users/vdukhovni/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vdukhovni/subscriptions","organizations_url":"https://api.github.com/users/vdukhovni/orgs","repos_url":"https://api.github.com/users/vdukhovni/repos","events_url":"https://api.github.com/users/vdukhovni/events{/privacy}","received_events_url":"https://api.github.com/users/vdukhovni/received_events","type":"User","site_admin":false},"body":"I see the confusion.  The intent is to include the built-in callbacks as a special case of ``non-null validation callback``, but that is not clear.  I'll reword.","created_at":"2016-04-06T19:26:54Z","updated_at":"2016-04-06T19:26:54Z","html_url":"https://github.com/openssl/openssl/pull/938#discussion_r58766530","pull_request_url":"https://api.github.com/repos/openssl/openssl/pulls/938","_links":{"self":{"href":"https://api.github.com/repos/openssl/openssl/pulls/comments/58766530"},"html":{"href":"https://github.com/openssl/openssl/pull/938#discussion_r58766530"},"pull_request":{"href":"https://api.github.com/repos/openssl/openssl/pulls/938"}}},"pull_request":{"url":"https://api.github.com/repos/openssl/openssl/pulls/938","id":65055079,"html_url":"https://github.com/openssl/openssl/pull/938","diff_url":"https://github.com/openssl/openssl/pull/938.diff","patch_url":"https://github.com/openssl/openssl/pull/938.patch","issue_url":"https://api.github.com/repos/openssl/openssl/issues/938","number":938,"state":"open","locked":false,"title":"Suppress ct as needed","user":{"login":"vdukhovni","id":1107986,"avatar_url":"https://avatars.githubusercontent.com/u/1107986?v=3","gravatar_id":"","url":"https://api.github.com/users/vdukhovni","html_url":"https://github.com/vdukhovni","followers_url":"https://api.github.com/users/vdukhovni/followers","following_url":"https://api.github.com/users/vdukhovni/following{/other_user}","gists_url":"https://api.github.com/users/vdukhovni/gists{/gist_id}","starred_url":"https://api.github.com/users/vdukhovni/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vdukhovni/subscriptions","organizations_url":"https://api.github.com/users/vdukhovni/orgs","repos_url":"https://api.github.com/users/vdukhovni/repos","events_url":"https://api.github.com/users/vdukhovni/events{/privacy}","received_events_url":"https://api.github.com/users/vdukhovni/received_events","type":"User","site_admin":false},"body":"","created_at":"2016-04-03T00:52:29Z","updated_at":"2016-04-06T19:26:54Z","closed_at":null,"merged_at":null,"merge_commit_sha":"7000791da7247bbb6f441d23af3e230c220da3a1","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/openssl/openssl/pulls/938/commits","review_comments_url":"https://api.github.com/repos/openssl/openssl/pulls/938/comments","review_comment_url":"https://api.github.com/repos/openssl/openssl/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openssl/openssl/issues/938/comments","statuses_url":"https://api.github.com/repos/openssl/openssl/statuses/705b88024df646be74476d4930c831b60d696958","head":{"label":"vdukhovni:suppress-ct-as-needed","ref":"suppress-ct-as-needed","sha":"705b88024df646be74476d4930c831b60d696958","user":{"login":"vdukhovni","id":1107986,"avatar_url":"https://avatars.githubusercontent.com/u/1107986?v=3","gravatar_id":"","url":"https://api.github.com/users/vdukhovni","html_url":"https://github.com/vdukhovni","followers_url":"https://api.github.com/users/vdukhovni/followers","following_url":"https://api.github.com/users/vdukhovni/following{/other_user}","gists_url":"https://api.github.com/users/vdukhovni/gists{/gist_id}","starred_url":"https://api.github.com/users/vdukhovni/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vdukhovni/subscriptions","organizations_url":"https://api.github.com/users/vdukhovni/orgs","repos_url":"https://api.github.com/users/vdukhovni/repos","events_url":"https://api.github.com/users/vdukhovni/events{/privacy}","received_events_url":"https://api.github.com/users/vdukhovni/received_events","type":"User","site_admin":false},"repo":{"id":55311918,"name":"openssl","full_name":"vdukhovni/openssl","owner":{"login":"vdukhovni","id":1107986,"avatar_url":"https://avatars.githubusercontent.com/u/1107986?v=3","gravatar_id":"","url":"https://api.github.com/users/vdukhovni","html_url":"https://github.com/vdukhovni","followers_url":"https://api.github.com/users/vdukhovni/followers","following_url":"https://api.github.com/users/vdukhovni/following{/other_user}","gists_url":"https://api.github.com/users/vdukhovni/gists{/gist_id}","starred_url":"https://api.github.com/users/vdukhovni/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vdukhovni/subscriptions","organizations_url":"https://api.github.com/users/vdukhovni/orgs","repos_url":"https://api.github.com/users/vdukhovni/repos","events_url":"https://api.github.com/users/vdukhovni/events{/privacy}","received_events_url":"https://api.github.com/users/vdukhovni/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/vdukhovni/openssl","description":"TLS/SSL and crypto library","fork":true,"url":"https://api.github.com/repos/vdukhovni/openssl","forks_url":"https://api.github.com/repos/vdukhovni/openssl/forks","keys_url":"https://api.github.com/repos/vdukhovni/openssl/keys{/key_id}","collaborators_url":"https://api.github.com/repos/vdukhovni/openssl/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/vdukhovni/openssl/teams","hooks_url":"https://api.github.com/repos/vdukhovni/openssl/hooks","issue_events_url":"https://api.github.com/repos/vdukhovni/openssl/issues/events{/number}","events_url":"https://api.github.com/repos/vdukhovni/openssl/events","assignees_url":"https://api.github.com/repos/vdukhovni/openssl/assignees{/user}","branches_url":"https://api.github.com/repos/vdukhovni/openssl/branches{/branch}","tags_url":"https://api.github.com/repos/vdukhovni/openssl/tags","blobs_url":"https://api.github.com/repos/vdukhovni/openssl/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/vdukhovni/openssl/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/vdukhovni/openssl/git/refs{/sha}","trees_url":"https://api.github.com/repos/vdukhovni/openssl/git/trees{/sha}","statuses_url":"https://api.github.com/repos/vdukhovni/openssl/statuses/{sha}","languages_url":"https://api.github.com/repos/vdukhovni/openssl/languages","stargazers_url":"https://api.github.com/repos/vdukhovni/openssl/stargazers","contributors_url":"https://api.github.com/repos/vdukhovni/openssl/contributors","subscribers_url":"https://api.github.com/repos/vdukhovni/openssl/subscribers","subscription_url":"https://api.github.com/repos/vdukhovni/openssl/subscription","commits_url":"https://api.github.com/repos/vdukhovni/openssl/commits{/sha}","git_commits_url":"https://api.github.com/repos/vdukhovni/openssl/git/commits{/sha}","comments_url":"https://api.github.com/repos/vdukhovni/openssl/comments{/number}","issue_comment_url":"https://api.github.com/repos/vdukhovni/openssl/issues/comments{/number}","contents_url":"https://api.github.com/repos/vdukhovni/openssl/contents/{+path}","compare_url":"https://api.github.com/repos/vdukhovni/openssl/compare/{base}...{head}","merges_url":"https://api.github.com/repos/vdukhovni/openssl/merges","archive_url":"https://api.github.com/repos/vdukhovni/openssl/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/vdukhovni/openssl/downloads","issues_url":"https://api.github.com/repos/vdukhovni/openssl/issues{/number}","pulls_url":"https://api.github.com/repos/vdukhovni/openssl/pulls{/number}","milestones_url":"https://api.github.com/repos/vdukhovni/openssl/milestones{/number}","notifications_url":"https://api.github.com/repos/vdukhovni/openssl/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/vdukhovni/openssl/labels{/name}","releases_url":"https://api.github.com/repos/vdukhovni/openssl/releases{/id}","deployments_url":"https://api.github.com/repos/vdukhovni/openssl/deployments","created_at":"2016-04-02T19:15:53Z","updated_at":"2016-04-02T19:16:04Z","pushed_at":"2016-04-05T16:59:49Z","git_url":"git://github.com/vdukhovni/openssl.git","ssh_url":"git@github.com:vdukhovni/openssl.git","clone_url":"https://github.com/vdukhovni/openssl.git","svn_url":"https://github.com/vdukhovni/openssl","homepage":"https://www.openssl.org","size":88126,"stargazers_count":0,"watchers_count":0,"language":"C","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"openssl:master","ref":"master","sha":"69853045e1154236d440eba363a001033f5e3781","user":{"login":"openssl","id":3279138,"avatar_url":"https://avatars.githubusercontent.com/u/3279138?v=3","gravatar_id":"","url":"https://api.github.com/users/openssl","html_url":"https://github.com/openssl","followers_url":"https://api.github.com/users/openssl/followers","following_url":"https://api.github.com/users/openssl/following{/other_user}","gists_url":"https://api.github.com/users/openssl/gists{/gist_id}","starred_url":"https://api.github.com/users/openssl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openssl/subscriptions","organizations_url":"https://api.github.com/users/openssl/orgs","repos_url":"https://api.github.com/users/openssl/repos","events_url":"https://api.github.com/users/openssl/events{/privacy}","received_events_url":"https://api.github.com/users/openssl/received_events","type":"Organization","site_admin":false},"repo":{"id":7634677,"name":"openssl","full_name":"openssl/openssl","owner":{"login":"openssl","id":3279138,"avatar_url":"https://avatars.githubusercontent.com/u/3279138?v=3","gravatar_id":"","url":"https://api.github.com/users/openssl","html_url":"https://github.com/openssl","followers_url":"https://api.github.com/users/openssl/followers","following_url":"https://api.github.com/users/openssl/following{/other_user}","gists_url":"https://api.github.com/users/openssl/gists{/gist_id}","starred_url":"https://api.github.com/users/openssl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openssl/subscriptions","organizations_url":"https://api.github.com/users/openssl/orgs","repos_url":"https://api.github.com/users/openssl/repos","events_url":"https://api.github.com/users/openssl/events{/privacy}","received_events_url":"https://api.github.com/users/openssl/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/openssl/openssl","description":"TLS/SSL and crypto library","fork":false,"url":"https://api.github.com/repos/openssl/openssl","forks_url":"https://api.github.com/repos/openssl/openssl/forks","keys_url":"https://api.github.com/repos/openssl/openssl/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openssl/openssl/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openssl/openssl/teams","hooks_url":"https://api.github.com/repos/openssl/openssl/hooks","issue_events_url":"https://api.github.com/repos/openssl/openssl/issues/events{/number}","events_url":"https://api.github.com/repos/openssl/openssl/events","assignees_url":"https://api.github.com/repos/openssl/openssl/assignees{/user}","branches_url":"https://api.github.com/repos/openssl/openssl/branches{/branch}","tags_url":"https://api.github.com/repos/openssl/openssl/tags","blobs_url":"https://api.github.com/repos/openssl/openssl/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openssl/openssl/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openssl/openssl/git/refs{/sha}","trees_url":"https://api.github.com/repos/openssl/openssl/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openssl/openssl/statuses/{sha}","languages_url":"https://api.github.com/repos/openssl/openssl/languages","stargazers_url":"https://api.github.com/repos/openssl/openssl/stargazers","contributors_url":"https://api.github.com/repos/openssl/openssl/contributors","subscribers_url":"https://api.github.com/repos/openssl/openssl/subscribers","subscription_url":"https://api.github.com/repos/openssl/openssl/subscription","commits_url":"https://api.github.com/repos/openssl/openssl/commits{/sha}","git_commits_url":"https://api.github.com/repos/openssl/openssl/git/commits{/sha}","comments_url":"https://api.github.com/repos/openssl/openssl/comments{/number}","issue_comment_url":"https://api.github.com/repos/openssl/openssl/issues/comments{/number}","contents_url":"https://api.github.com/repos/openssl/openssl/contents/{+path}","compare_url":"https://api.github.com/repos/openssl/openssl/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openssl/openssl/merges","archive_url":"https://api.github.com/repos/openssl/openssl/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openssl/openssl/downloads","issues_url":"https://api.github.com/repos/openssl/openssl/issues{/number}","pulls_url":"https://api.github.com/repos/openssl/openssl/pulls{/number}","milestones_url":"https://api.github.com/repos/openssl/openssl/milestones{/number}","notifications_url":"https://api.github.com/repos/openssl/openssl/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openssl/openssl/labels{/name}","releases_url":"https://api.github.com/repos/openssl/openssl/releases{/id}","deployments_url":"https://api.github.com/repos/openssl/openssl/deployments","created_at":"2013-01-15T22:34:48Z","updated_at":"2016-04-06T18:09:32Z","pushed_at":"2016-04-06T18:06:21Z","git_url":"git://github.com/openssl/openssl.git","ssh_url":"git@github.com:openssl/openssl.git","clone_url":"https://github.com/openssl/openssl.git","svn_url":"https://github.com/openssl/openssl","homepage":"https://www.openssl.org","size":96393,"stargazers_count":2413,"watchers_count":2413,"language":"C","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1375,"mirror_url":null,"open_issues_count":155,"forks":1375,"open_issues":155,"watchers":2413,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openssl/openssl/pulls/938"},"html":{"href":"https://github.com/openssl/openssl/pull/938"},"issue":{"href":"https://api.github.com/repos/openssl/openssl/issues/938"},"comments":{"href":"https://api.github.com/repos/openssl/openssl/issues/938/comments"},"review_comments":{"href":"https://api.github.com/repos/openssl/openssl/pulls/938/comments"},"review_comment":{"href":"https://api.github.com/repos/openssl/openssl/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/openssl/openssl/pulls/938/commits"},"statuses":{"href":"https://api.github.com/repos/openssl/openssl/statuses/705b88024df646be74476d4930c831b60d696958"}}}}