OSSL_INDICATOR_SET_CALLBACK(3ossl)

Hey bestie 💖 welcome to the OSSL_INDICATOR_SET_CALLBACK(3ossl) page — OpenSSL, FIPS indicators, and the callbacks that tell you when something non approved is happening. It’s giving secure vibes, iykyk. 🫶

🎀 NAME 🎀

OSSL_INDICATOR_set_callback, OSSL_INDICATOR_get_callback — specify a callback for FIPS indicators. That’s the whole vibe.

✨ SYNOPSIS ✨

#include <openssl/indicator.h>

typedef int (OSSL_INDICATOR_CALLBACK)(const char *type, const char *desc,
                                      const OSSL_PARAM params[]);

void OSSL_INDICATOR_set_callback(OSSL_LIB_CTX *libctx,
                                 OSSL_INDICATOR_CALLBACK *cb);
void OSSL_INDICATOR_get_callback(OSSL_LIB_CTX *libctx,
                                 OSSL_INDICATOR_CALLBACK **cb);

🌸 DESCRIPTION 🌸

Okay so OSSL_INDICATOR_set_callback() sets a user callback cb associated with a libctx. That callback gets called when a non approved FIPS operation is detected. Main character callback energy.

Your callback may be triggered multiple times during an algorithm operation to indicate that different approved mode checks have failed. Not a one-and-done situation, bestie.

Non approved operations may only occur if the user has deliberately chosen to do so — either by setting a global FIPS configuration option or via an option in an algorithm’s operation context. No accidental chaos, no cap.

For the user’s callback, the OSSL_INDICATOR_CALLBACK type and desc arguments contain the algorithm type and operation that is not approved. params is not currently used. It’s just there being decorative.

If the user callback returns 0, an error will occur in the caller. This can be used for testing purposes. Testing mode, but make it intentional.

🦋 RETURN VALUES 🦋

OSSL_INDICATOR_get_callback() returns the callback that has been set via OSSL_INDICATOR_set_callback() for the given library context libctx, or NULL if no callback is currently set. Simple, clean, iconic. Periodt.

💅 EXAMPLES 💅

A simple indicator callback to log non approved FIPS operations:

static int indicator_cb(const char *type, const char *desc,
                        const OSSL_PARAM params[])
{
    if (type != NULL && desc != NULL)
        fprintf(stdout, "%s %s is not approved\n", type, desc);
end:
    /* For Testing purposes you could return 0 here to cause an error */
    return 1;
}

OSSL_INDICATOR_set_callback(libctx, indicator_cb);

Yes, the end: label is literally in the example — keep it exactly as shown. 😭

🌈 SEE ALSO 🌈

Sending you to: openssl-core.h(7), OSSL_PROVIDER-FIPS(7), OSSL_LIB_CTX(3).

⭐ HISTORY ⭐

The functions described here were added in OpenSSL 3.4. New-ish, but already serving.

📜 COPYRIGHT 📜

Copyright 2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the “License”). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

Catch you later, bestie 💅 This page is 3.5.6, dated 2026-04-07, and the manual name is OSSL_INDICATOR_SET_CALLBACK(3ossl) — OpenSSL all the way down. 🫶✨