OSSL_TRACE_SET_CHANNEL(3ossl)

📦

version 15.1 · 2 versions

15.1 · freebsd 15.1 (latest)
14.5 · freebsd 14.5

💅 OSSL_TRACE_SET_CHANNEL 💅

okay bestie, welcome to the 3ossl manual page for the trace-channel glow-up squad: OSSL_trace_set_channel, OSSL_trace_set_prefix, OSSL_trace_set_suffix, OSSL_trace_set_callback, and the callback type OSSL_trace_cb. This is literally all about enabling trace output, and yes it's as niche and iconic as it sounds 🎀

✨ SYNOPSIS ✨

#include <openssl/trace.h>

typedef size_t (*OSSL_trace_cb)(const char *buf, size_t cnt,
                                int category, int cmd, void *data);

void OSSL_trace_set_channel(int category, BIO *bio);
void OSSL_trace_set_prefix(int category, const char *prefix);
void OSSL_trace_set_suffix(int category, const char *suffix);
void OSSL_trace_set_callback(int category, OSSL_trace_cb cb, void  *data);

🦋 DESCRIPTION 🦋

So, if it's available (peep "Configure Tracing" down below 👀), your app can ask for internal trace output. It comes out as free text, made for humans to actually read 💖

The trace output is split into categories, and each one can be enabled all on its own. How? By attaching a so-called trace channel to it ✨ In the simplest case that's just a BIO object that your app writes this category's tracing output into. OR, alternatively, your app can hand over a tracer callback so it gets wayyy more fine-grained trace info. Internally, that callback gets wrapped up in a dedicated BIO object 🎁

To the tracing code itself, both channel types are indistinguishable — no cap. They're called a simple trace channel and a callback trace channel respectively 💅

OSSL_TRACE_ENABLED(3) is your girl for checking whether tracing is currently enabled for a given category. And functions like OSSL_TRACE1(3) plus macros like OSSL_TRACE_BEGIN(3) are the ones that actually produce the free-text trace output 🌸

🫶 Functions

OSSL_trace_set_channel() — enables the given trace category by attaching the BIO bio object as a (simple) trace channel. On success, ownership of the BIO gets transferred to the channel, so literally do not free it yourself afterwards, bestie 😭 that's not your BIO anymore.
OSSL_trace_set_prefix() and OSSL_trace_set_suffix() — these add an extra line per channel, output before and after a group of tracing output. What counts as an "output group" is decided by the code producing the output, not by you. The lines you give here are considered immutable — so if you want dynamic tracing prefixes, consider setting a callback with OSSL_trace_set_callback() instead 💫
OSSL_trace_set_callback() — enables the given trace category by giving it the tracer callback cb along with the associated data data, which just gets passed straight through to cb whenever it's called. The callback function is internally wrapped by a dedicated BIO object — the so-called callback trace channel. Reach for this when you want to transform the trace output into something that fits your app's needs and a prefix + suffix line just isn't enough 👑

OSSL_trace_set_channel() and OSSL_trace_set_callback() are mutually exclusive — calling one of them clears whatever the previous call set up. No hoarding both, it's giving monogamy 💀

And calling OSSL_trace_set_channel() with NULL for channel, or OSSL_trace_set_callback() with NULL for cb, disables tracing for that category. Off switch, slay 🔥

🧚 Trace callback

The tracer callback must return a size_t — zero on error, otherwise the number of bytes that were output, periodt. It receives a text buffer buf with cnt bytes of text, plus the category, a control number cmd, and the data that was passed to OSSL_trace_set_callback() 🌈

The possible control numbers are:

OSSL_TRACE_CTRL_BEGIN — the callback is called from OSSL_trace_begin(), which gives the callback the chance to output a dynamic starting line, or set a prefix that should be output at the beginning of each line, or do something other.✨
OSSL_TRACE_CTRL_WRITE — this callback fires whenever data is written to the BIO by some regular BIO output routine. An arbitrary number of OSSL_TRACE_CTRL_WRITE callbacks can occur inside a group marked by a pair of OSSL_TRACE_CTRL_BEGIN and OSSL_TRACE_CTRL_END calls — but never outside such a group. iykyk 🚫
OSSL_TRACE_CTRL_END — the callback is called from OSSL_trace_end(), which gives the callback the chance to output a dynamic ending line, or reset the line prefix that was set with OSSL_TRACE_CTRL_BEGIN, or do something other. 💜

👑 Trace categories

The trace categories are simple numbers, available through macros. Here's the whole roster 🎀

OSSL_TRACE_CATEGORY_TRACE — traces the OpenSSL trace API itself. More precisely, this generates trace output any time a new trace hook is set. meta, honestly 💅
OSSL_TRACE_CATEGORY_INIT — traces OpenSSL library initialization and cleanup. ⚠️ This one needs special care: OpenSSL does automatic cleanup after exit from main(), and any tracing output done during that cleanup will be lost if the tracing channel or callback were cleaned away prematurely. A suggestion (straight from the page, not me): make such cleanup part of a function that's registered very early with atexit(3).
OSSL_TRACE_CATEGORY_TLS — traces the TLS/SSL protocol.
OSSL_TRACE_CATEGORY_TLS_CIPHER — traces the ciphers used by the TLS/SSL protocol.
OSSL_TRACE_CATEGORY_CONF — traces details about the provider and engine configuration.
OSSL_TRACE_CATEGORY_ENGINE_TABLE — traces the ENGINE algorithm table selection. More precisely, functions like ENGINE_get_pkey_asn1_meth_engine(), ENGINE_get_pkey_meth_engine(), ENGINE_get_cipher_engine(), ENGINE_get_digest_engine(), will generate trace summaries of the handling of internal tables.
OSSL_TRACE_CATEGORY_ENGINE_REF_COUNT — traces the ENGINE reference counting. More precisely, both reference counts in the ENGINE structure get monitored with a line of trace output generated for each change. watching the counter go brrr 📈
OSSL_TRACE_CATEGORY_PKCS5V2 — traces PKCS#5 v2 key generation.
OSSL_TRACE_CATEGORY_PKCS12_KEYGEN — traces PKCS#12 key generation.
OSSL_TRACE_CATEGORY_PKCS12_DECRYPT — traces PKCS#12 decryption.
OSSL_TRACE_CATEGORY_X509V3_POLICY — traces X509v3 policy processing. More precisely, this generates the complete policy tree at various point during evaluation.
OSSL_TRACE_CATEGORY_BN_CTX — traces BIGNUM context operations.
OSSL_TRACE_CATEGORY_CMP — traces CMP client and server activity.
OSSL_TRACE_CATEGORY_STORE — traces STORE operations.
OSSL_TRACE_CATEGORY_DECODER — traces decoder operations.
OSSL_TRACE_CATEGORY_ENCODER — traces encoder operations.
OSSL_TRACE_CATEGORY_REF_COUNT — traces decrementing certain ASN.1 structure references.
OSSL_TRACE_CATEGORY_HTTP — traces the HTTP client, such as message headers being sent and received. 🦋

There's also OSSL_TRACE_CATEGORY_ALL, which works as a fallback and can be used to get all trace output. 🌈

But heads up — in that case all trace output will effectively be associated with the 'ALL' category, which is undesirable if your application intends to include the category name in the trace output. In that case it's better to register separate channels for each trace category instead. fr fr, don't do the lazy thing 🫶

💀 RETURN VALUES 💀

OSSL_trace_set_channel(), OSSL_trace_set_prefix(), OSSL_trace_set_suffix(), and OSSL_trace_set_callback() return 1 on success, or 0 on failure. That's it, that's the whole vibe check ✅

🌟 EXAMPLES 🌟

In all the examples below, the trace producing code is assumed to be the following:

int foo = 42;
const char bar[] = { 0,  1,  2,  3,  4,  5,  6,  7,
                     8,  9, 10, 11, 12, 13, 14, 15 };

OSSL_TRACE_BEGIN(TLS) {
    BIO_puts(trc_out, "foo: ");
    BIO_printf(trc_out, "%d\n", foo);
    BIO_dump(trc_out, bar, sizeof(bar));
} OSSL_TRACE_END(TLS);

🌸 Simple example

An example with just a channel and constant prefix / suffix. lowkey the starter pack:

int main(int argc, char *argv[])
{
    BIO *err = BIO_new_fp(stderr, BIO_NOCLOSE | BIO_FP_TEXT);
    OSSL_trace_set_channel(OSSL_TRACE_CATEGORY_SSL, err);
    OSSL_trace_set_prefix(OSSL_TRACE_CATEGORY_SSL, "BEGIN TRACE[TLS]");
    OSSL_trace_set_suffix(OSSL_TRACE_CATEGORY_SSL, "END TRACE[TLS]");

    /* ... work ... */
}

When the trace producing code above is performed, this will be output on standard error:

BEGIN TRACE[TLS]
foo: 42
0000 - 00 01 02 03 04 05 06 07-08 09 0a 0b 0c 0d 0e 0f   ................
END TRACE[TLS]

🎀 Advanced example

This example uses the callback, and depends on pthreads functionality. multi-threaded AND custom-formatted, she ate 💅

static size_t cb(const char *buf, size_t cnt,
                int category, int cmd, void *vdata)
{
    BIO *bio = vdata;
    const char *label = NULL;

    switch (cmd) {
    case OSSL_TRACE_CTRL_BEGIN:
        label = "BEGIN";
        break;
    case OSSL_TRACE_CTRL_END:
        label = "END";
        break;
    }

    if (label != NULL) {
        union {
            pthread_t tid;
            unsigned long ltid;
        } tid;

        tid.tid = pthread_self();
        BIO_printf(bio, "%s TRACE[%s]:%lx\n",
                   label, OSSL_trace_get_category_name(category), tid.ltid);
    }
    return (size_t)BIO_puts(bio, buf);
}

int main(int argc, char *argv[])
{
    BIO *err = BIO_new_fp(stderr, BIO_NOCLOSE | BIO_FP_TEXT);
    OSSL_trace_set_callback(OSSL_TRACE_CATEGORY_SSL, cb, err);

    /* ... work ... */
}

The output is almost the same as for the simple example above:

BEGIN TRACE[TLS]:7f9eb0193b80
foo: 42
0000 - 00 01 02 03 04 05 06 07-08 09 0a 0b 0c 0d 0e 0f   ................
END TRACE[TLS]:7f9eb0193b80

⭐ NOTES ⭐

🔧 Configure Tracing

By default, the OpenSSL library is built with tracing disabled. So to actually use the tracing functionality documented here, you gotta configure and build OpenSSL with the 'enable-trace' option. no shortcut, bestie 🛠️

When the library is built with tracing disabled, the macro OPENSSL_NO_TRACE is defined in <openssl/opensslconf.h> and all functions described here are inoperational, i.e. will do nothing. literally nothing. ghost behaviour 👻

🌈 HISTORY 🌈

OSSL_trace_set_channel(), OSSL_trace_set_prefix(), OSSL_trace_set_suffix(), and OSSL_trace_set_callback() were all added in OpenSSL 3.0. glow-up origin story 🎀

💖 COPYRIGHT 💖

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page!! 💅 this was OSSL_TRACE_SET_CHANNEL(3ossl) from OpenSSL 3.5.6, dated 2026-04-07 — mwah, go enable some tracing bestie, and remember: don't free that BIO 🫶✨🌸

📦 where this page comes from

freebsd 15.1: base 15.1
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms