OSSL_INDICATOR_SET_CALLBACK(3ossl)

💖 OSSL_INDICATOR_SET_CALLBACK 💖

okay bestie, so this is a page from the OpenSSL manuals (that's the 3ossl manual section, the "library functions" shelf 🌸). It's all about the FIPS indicators callback situation. Let's get into it, no cap.

---

✨ NAME ✨

OSSL_INDICATOR_set_callback, OSSL_INDICATOR_get_callback — the girlies that let you specify a callback for FIPS indicators 🎀

---

🌈 SYNOPSIS 🌈

#include <openssl/indicator.h>

typedef int (OSSL_INDICATOR_CALLBACK)(const char *type, const char *desc,
                                      const OSSL_PARAM params[]);

void OSSL_INDICATOR_set_callback(OSSL_LIB_CTX *libctx,
                                 OSSL_INDICATOR_CALLBACK *cb);
void OSSL_INDICATOR_get_callback(OSSL_LIB_CTX *libctx,
                                 OSSL_INDICATOR_CALLBACK **cb);

---

💅 DESCRIPTION 💅

OSSL_INDICATOR_set_callback() sets a user callback cb that gets associated with a libctx, and it gets called whenever a non approved FIPS operation is detected. it's giving "hey bestie, something unapproved just happened" 💀

the way your callback can be triggered multiple times during a single algorithm operation?? yeah, because it's flagging when different approved mode checks have failed. so don't be surprised if it's popping off repeatedly. 🙈

⚠️ non approved operations may only occur if you deliberately chose to do so — either by setting a global FIPS configuration option, or via an option in an algorithm's operation context. so like, it's on purpose, okay? not a glitch. ✨

your callback is of type OSSL_INDICATOR_CALLBACK, and its type and desc are carrying the algorithm type and the operation that is not approved. params is not currently used — she's just there for the vibe, don't stress about her. 🦋

and if your callback returns 0, an error will occur in the caller. lowkey iconic for testing purposes 👑

---

🌟 RETURN VALUES 🌟

OSSL_INDICATOR_get_callback() returns the callback that was set via OSSL_INDICATOR_set_callback() for the given library context libctx — or NULL if no callback is currently set. simple as that. 💖

---

🧚 EXAMPLES 🧚

here's a simple indicator callback that logs non approved FIPS operations. a lil' snack:

static int indicator_cb(const char *type, const char *desc,
                        const OSSL_PARAM params[])
{
    if (type != NULL && desc != NULL)
        fprintf(stdout, "%s %s is not approved\n", type, desc);
end:
    /* For Testing purposes you could return 0 here to cause an error */
    return 1;
}

OSSL_INDICATOR_set_callback(libctx, indicator_cb);

---

👑 SEE ALSO 👑

openssl-core.h(7), OSSL_PROVIDER-FIPS(7) OSSL_LIB_CTX(3)

---

🦋 HISTORY 🦋

the functions described here were added in OpenSSL 3.4. so they're new new. 🍓

---

💜 COPYRIGHT 💜

Copyright 2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie!! 💅✨ this was OpenSSL 3.5.9, dated 2026-09-29, and it lives in the OSSL_INDICATOR_SET_CALLBACK(3ossl) manual page. go forth and callback responsibly 🫶🌈