OSSL_TRACE_ENABLED(3ossl)

💅 OSSL_TRACE_ENABLED(3ossl) — the OpenSSL Tracing API, explained bestie to bestie

okay so this is a page from the 3ossl manual (OpenSSL, obviously 💖) and it's all about the OpenSSL Tracing API — the whole OSSL_trace_* family plus the macro squad. ngl it's giving "internal plumbing realness" but it's actually so useful if you're writing code inside OpenSSL-adjacent stuff. let's get into it ✨

🌸 NAME 🌸

OSSL_trace_enabled, OSSL_trace_begin, OSSL_trace_end, OSSL_TRACE_BEGIN, OSSL_TRACE_END, OSSL_TRACE_CANCEL, OSSL_TRACE, OSSL_TRACE1, OSSL_TRACE2, OSSL_TRACE3, OSSL_TRACE4, OSSL_TRACE5, OSSL_TRACE6, OSSL_TRACE7, OSSL_TRACE8, OSSL_TRACE9, OSSL_TRACEV, OSSL_TRACE_STRING, OSSL_TRACE_STRING_MAX, OSSL_trace_string, OSSL_TRACE_ENABLED — the OpenSSL Tracing API. that's the whole cast, main characters the lot of them 👑

🎀 SYNOPSIS 🎀

#include <openssl/trace.h>

int OSSL_trace_enabled(int category);

BIO *OSSL_trace_begin(int category);
void OSSL_trace_end(int category, BIO *channel);

/* trace group macros */
OSSL_TRACE_BEGIN(category) {
    ...
    if (some_error) {
        /* Leave trace group prematurely in case of an error */
        OSSL_TRACE_CANCEL(category);
        goto err;
    }
    ...
} OSSL_TRACE_END(category);

/* one-shot trace macros */
OSSL_TRACE(category, text)
OSSL_TRACE1(category, format, arg1)
OSSL_TRACE2(category, format, arg1, arg2)
...
OSSL_TRACE9(category, format, arg1, ..., arg9)
OSSL_TRACE_STRING(category, text, full, data, len)

#define OSSL_TRACE_STRING_MAX 80
int OSSL_trace_string(BIO *out, int text, int full,
                      const unsigned char *data, size_t size);

/* check whether a trace category is enabled */
if (OSSL_TRACE_ENABLED(category)) {
    ...
}

🦋 DESCRIPTION 🦋

so the functions on this page are mainly interesting for people who provide OpenSSL functionality — whether that's inside OpenSSL itself, or in engine modules, or similar vibes. basically if you're building the thing, not just using it 💅

if the tracing facility is enabled (peep "Configure Tracing" below, it's a whole section, we'll get there), these functions are what you use to generate free-text tracing output. like, actual human-readable trace lines. iconic.

the tracing output is split into types, and the application enables them individually. those types are described in detail over in "Trace types" in OSSL_trace_set_callback(3). ⚠️ important: the fallback type OSSL_TRACE_CATEGORY_ALL should not be used with the functions on this page. nope. not it.

tracing for a specific category is enabled at run-time if a so-called trace channel is attached to it. and a trace channel? it's literally just a BIO object that the application can write its trace output to. that's the whole thing. simple era.

the application has two ways to register a trace channel:

directly providing a BIO object using OSSL_trace_set_channel(3), or
providing a callback routine using OSSL_trace_set_callback(3).

the callback one gets wrapped internally by a dedicated BIO object, so from the tracing code's perspective both channel types are effectively indistinguishable. we call them a simple trace channel and a callback trace channel, respectively. cute naming, love that for us 🫶

to actually produce trace output you gotta:

get a pointer to the trace channel (i.e. the BIO object) using OSSL_trace_begin(),
write to it using arbitrary BIO output routines,
and finally release the channel using OSSL_trace_end().

the OSSL_trace_begin() / OSSL_trace_end() calls wrapped around the trace output create a group, and that group acts as a critical section (guarded by a mutex) so the trace output from different threads doesn't get mixed up. no chaotic interleaved mess, we don't do that here 😌

the tracing code normally does not call OSSL_trace_{begin,end}() directly — it uses a set of convenience macros instead. see the "Macros" section below, it's right there bestie.

✨ Functions ✨

OSSL_trace_enabled() — checks if tracing for the given category is enabled, i.e. whether the tracing facility has been statically enabled (see "Configure Tracing" below) and a trace channel has been registered using OSSL_trace_set_channel(3) or OSSL_trace_set_callback(3).
OSSL_trace_begin() — starts a tracing section and hands you the channel for the given category in the form of a BIO. heads up: this BIO can only be used for output. the returned pointer is NULL if the category is invalid or not enabled.
OSSL_trace_end() — ends a tracing section. that's it, that's the job.
OSSL_trace_string() — outputs data of length size as a string on BIO out. if text is 0, the function masks any included control characters apart from newlines, and makes sure that for nonempty input the output ends with a newline. unless full is nonzero, the length is limited (with a suitable warning) to OSSL_TRACE_STRING_MAX characters, which currently is 80. yes, eighty. that's the number 📏

⚠️ using OSSL_trace_begin() and OSSL_trace_end() to wrap tracing sections is mandatory. trying to produce tracing output outside of such sections has undefined results. do not test fate, bestie.

🌈 Macros 🌈

there's a bunch of convenience macros defined to make tracing easy and consistent. let's meet them 💖

OSSL_TRACE_BEGIN() and OSSL_TRACE_END() reserve the BIO "trc_out" and are used like this to wrap a trace section:

OSSL_TRACE_BEGIN(TLS) {

    BIO_printf(trc_out, ... );

} OSSL_TRACE_END(TLS);

which will normally expand to:

do {
    BIO *trc_out = OSSL_trace_begin(OSSL_TRACE_CATEGORY_TLS);
    if (trc_out != NULL) {
        ...
        BIO_printf(trc_out, ...);
    }
    OSSL_trace_end(OSSL_TRACE_CATEGORY_TLS, trc_out);
} while (0);

OSSL_TRACE_CANCEL() must be used before returning from or jumping out of a trace section:

OSSL_TRACE_BEGIN(TLS) {

    if (some_error) {
        OSSL_TRACE_CANCEL(TLS);
        goto err;
    }
    BIO_printf(trc_out, ... );

} OSSL_TRACE_END(TLS);

which will normally expand to:

do {
    BIO *trc_out = OSSL_trace_begin(OSSL_TRACE_CATEGORY_TLS);
    if (trc_out != NULL) {
        if (some_error) {
            OSSL_trace_end(OSSL_TRACE_CATEGORY_TLS, trc_out);
            goto err;
        }
        BIO_printf(trc_out, ... );
    }
    OSSL_trace_end(OSSL_TRACE_CATEGORY_TLS, trc_out);
} while (0);

OSSL_TRACE() and OSSL_TRACE1(), OSSL_TRACE2(), … OSSL_TRACE9() are the so-called one-shot macros:

the macro call OSSL_TRACE(category, text) produces literal text trace output.
the macro call OSSL_TRACEn(category, format, arg1, ..., argn) produces printf-style trace output with n format field arguments (n=1,...,9). it expands to:

OSSL_TRACE_BEGIN(category) {
    BIO_printf(trc_out, format, arg1, ..., argN);
} OSSL_TRACE_END(category)

internally, all the one-shot macros are implemented using a generic OSSL_TRACEV() macro, because C90 does not support variadic macros. 🫠 this helper macro has a rather weird synopsis and should not be used directly. hands off, iykyk.

the macro call OSSL_TRACE_STRING(category, text, full, data, len) outputs data of length size as a string if tracing for the given category is enabled. it expands to:

OSSL_TRACE_BEGIN(category) {
    OSSL_trace_string(trc_out, text, full, data, len);
} OSSL_TRACE_END(category)

the OSSL_TRACE_ENABLED() macro can be used to conditionally execute some code only if a specific trace category is enabled. in some situations this is simpler than entering a trace section using OSSL_TRACE_BEGIN() and OSSL_TRACE_END(). for example, the code

if (OSSL_TRACE_ENABLED(TLS)) {
    ...
}

expands to

if (OSSL_trace_enabled(OSSL_TRACE_CATEGORY_TLS) {
    ...
}

💀 NOTES 💀

you do not need to guard trace output function calls like OSSL_TRACE(category, ...) with OSSL_TRACE_ENABLED(category). the macro's already on it, don't double up 💅

if producing the trace output requires carrying out auxiliary calculations, that auxiliary code should be placed inside a conditional block that's executed only if the trace category is enabled.

the most natural way to do this is to stick the code inside the trace section itself, because it already introduces such a conditional block:

OSSL_TRACE_BEGIN(TLS) {
    int var = do_some_auxiliary_calculation();

    BIO_printf(trc_out, "var = %d\n", var);

} OSSL_TRACE_END(TLS);

in some cases it's more advantageous to use a simple conditional group instead of a trace section. this is the case if calculations and tracing happen in different locations of the code, or if the calculations are so time-consuming that placing them inside a (critical) trace section would create too much contention. nobody wants a traffic jam in the mutex, fr fr.

if (OSSL_TRACE_ENABLED(TLS)) {
    int var = do_some_auxiliary_calculation();

    OSSL_TRACE1("var = %d\n", var);
}

🙈 note however that premature optimization of tracing code is in general futile and it's better to keep the tracing code as simple as possible. because most often the limiting factor for the application's speed is the time it takes to print the trace output, not to calculate it. say it louder for the people in the back 📢

🧚 Configure Tracing 🧚

by default, the OpenSSL library is built with tracing disabled. so to use the tracing functionality documented on this very page, it's necessary to configure and build OpenSSL with the 'enable-trace' option. that's the switch. flip it.

when the library is built with tracing disabled:

the macro OPENSSL_NO_TRACE is defined in <openssl/opensslconf.h>.
all functions are still present, but OSSL_trace_enabled() will always report the categories as disabled, and all other functions will do nothing. (ghost functions, honestly 💀)
the convenience macros are defined to produce dead code. for example, take this example from the "Macros" section above:

OSSL_TRACE_BEGIN(TLS) {

    if (condition) {
        OSSL_TRACE_CANCEL(TLS);
        goto err;
    }
    BIO_printf(trc_out, ... );

} OSSL_TRACE_END(TLS);

when the tracing API isn't operational, that will expand to:

do {
    BIO *trc_out = NULL;
    if (0) {
        if (condition) {
            ((void)0);
            goto err;
        }
        BIO_printf(trc_out, ... );
    }
} while (0);

⭐ RETURN VALUES ⭐

OSSL_trace_enabled() returns 1 if tracing for the given type is operational and enabled, otherwise 0.
OSSL_trace_begin() returns a BIO pointer if the given type is enabled, otherwise NULL.
OSSL_trace_string() returns the number of characters emitted, or -1 on error. 😭

🔥 SEE ALSO 🔥

OSSL_trace_set_channel(3), OSSL_trace_set_callback(3) — go read those next bestie, they're the other half of the story 💜

👑 HISTORY 👑

the OpenSSL Tracing API was added in OpenSSL 3.0 ✨

OSSL_TRACE_STRING(), OSSL_TRACE_STRING_MAX, and OSSL_trace_string were added in OpenSSL 3.2 🎀

🌸 COPYRIGHT 🌸

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, no cap 🫶 this was version 3.5.0 of the manual, dated 2026-09-25, filed under OSSL_TRACE_ENABLED(3ossl) — go trace something iconic bestie 💅✨💖

📦 where this page comes from

opensuse-leap 16.0: openssl-3-doc 3.5.0-160000.11.1 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms