OSSL_TRACE_ENABLED(3ossl)

📦

version 3.5.9 · 8 versions

3.5.9 · fedora 43, fedora 44 (latest)
3.5.9 · centos-stream 9
3.5.9 · centos-stream 10
3.5.9 · alpine 3.22
3.5.9 · alpine 3.23, alpine 3.24
3.5.8 · fedora 43
3.5.1 · fedora 43
3.5.5 · fedora 44

💖 OSSL_TRACE_ENABLED 💖

okay bestie, welcome to the OSSL_TRACE_ENABLED(3ossl) page, straight out of the OpenSSL manual ✨ this is the OpenSSL Tracing API and it's lowkey one of the most underrated little corners of the library. grab a strawberry 🍓 and let's get into it.

🌸 NAME 🌸

OSSL_trace_enabled, OSSL_trace_begin, OSSL_trace_end, OSSL_TRACE_BEGIN, OSSL_TRACE_END, OSSL_TRACE_CANCEL, OSSL_TRACE, OSSL_TRACE1, OSSL_TRACE2, OSSL_TRACE3, OSSL_TRACE4, OSSL_TRACE5, OSSL_TRACE6, OSSL_TRACE7, OSSL_TRACE8, OSSL_TRACE9, OSSL_TRACEV, OSSL_TRACE_STRING, OSSL_TRACE_STRING_MAX, OSSL_trace_string, OSSL_TRACE_ENABLED — that's the whole squad, and together they're the OpenSSL Tracing API 🫶

✨ SYNOPSIS ✨

#include <openssl/trace.h>

int OSSL_trace_enabled(int category);

BIO *OSSL_trace_begin(int category);
void OSSL_trace_end(int category, BIO *channel);

/* trace group macros */
OSSL_TRACE_BEGIN(category) {
    ...
    if (some_error) {
        /* Leave trace group prematurely in case of an error */
        OSSL_TRACE_CANCEL(category);
        goto err;
    }
    ...
} OSSL_TRACE_END(category);

/* one-shot trace macros */
OSSL_TRACE(category, text)
OSSL_TRACE1(category, format, arg1)
OSSL_TRACE2(category, format, arg1, arg2)
...
OSSL_TRACE9(category, format, arg1, ..., arg9)
OSSL_TRACE_STRING(category, text, full, data, len)

#define OSSL_TRACE_STRING_MAX 80
int OSSL_trace_string(BIO *out, int text, int full,
                      const unsigned char *data, size_t size);

/* check whether a trace category is enabled */
if (OSSL_TRACE_ENABLED(category)) {
    ...
}

🦋 DESCRIPTION 🦋

ngl, the stuff on this page is mainly for the girlies who provide OpenSSL functionality — whether that's inside OpenSSL itself or in engine modules or whatever similar situation you're in. it's builder-coded 💅

if the tracing facility is turned on (peep "Configure Tracing" down below), these functions are what you use to spit out free-text tracing output.

the tracing output is split into types, and each type gets enabled individually by the application. the tracing types are described in full detail in "Trace types" in OSSL_trace_set_callback(3). and heads up: the fallback type OSSL_TRACE_CATEGORY_ALL should not be used with the functions on this page. not the vibe 🙅‍♀️

tracing for a specific category is enabled at run-time if a so-called trace channel is attached to it. a trace channel is literally just a BIO object that the application can write its trace output to. iconic, honestly.

your app has two ways to register a trace channel:

give a BIO object directly, using OSSL_trace_set_channel(3), or
give a callback routine using OSSL_trace_set_callback(3).

the callback one gets wrapped internally by a dedicated BIO object, so as far as the tracing code is concerned, both channel types are effectively indistinguishable 👯‍♀️ we call them a simple trace channel and a callback trace channel, respectively.

to actually produce trace output you have to:

get a pointer to the trace channel (aka the BIO object) using OSSL_trace_begin(),
write to it using arbitrary BIO output routines,
release the channel using OSSL_trace_end().

and the OSSL_trace_begin() / OSSL_trace_end() calls wrapping the trace output create a group, which acts as a critical section (guarded by a mutex 🫣) so that trace output from different threads doesn't get all mixed up. the way that keeps everything cute and orderly. obsessed.

the tracing code normally does not call OSSL_trace_{begin,end}() directly — it uses a set of convenience macros instead. see the "Macros" section below, bestie.

💜 Functions

OSSL_trace_enabled() — checks if tracing for the given category is enabled, meaning: the tracing facility has been statically enabled (see "Configure Tracing" below) and a trace channel has been registered using OSSL_trace_set_channel(3) or OSSL_trace_set_callback(3).
OSSL_trace_begin() — starts a tracing section and hands you the channel for the given category in the form of a BIO. this BIO can only be used for output. the pointer it returns is NULL if the category is invalid or not enabled.
OSSL_trace_end() — ends a tracing section.

⚠️ using OSSL_trace_begin() and OSSL_trace_end() to wrap tracing sections is mandatory. trying to produce tracing output outside of such sections has undefined results. do not do it. i'm serious, bestie 😭

OSSL_trace_string() — outputs data of length size as a string on BIO out. if text is 0, the function masks any included control characters apart from newlines, and makes sure that for nonempty input the output ends with a newline. unless full is nonzero, the length is limited (with a suitable warning) to OSSL_TRACE_STRING_MAX characters, which currently is 80.

🎀 Macros

there's a bunch of convenience macros defined here, to make tracing easy and consistent. slay.

OSSL_TRACE_BEGIN() and OSSL_TRACE_END() reserve the BIO trc_out and are used like this to wrap a trace section:

OSSL_TRACE_BEGIN(TLS) {

    BIO_printf(trc_out, ... );

} OSSL_TRACE_END(TLS);

this will normally expand to:

do {
    BIO *trc_out = OSSL_trace_begin(OSSL_TRACE_CATEGORY_TLS);
    if (trc_out != NULL) {
        ...
        BIO_printf(trc_out, ...);
    }
    OSSL_trace_end(OSSL_TRACE_CATEGORY_TLS, trc_out);
} while (0);

OSSL_TRACE_CANCEL() must be used before returning from, or jumping out of, a trace section:

OSSL_TRACE_BEGIN(TLS) {

    if (some_error) {
        OSSL_TRACE_CANCEL(TLS);
        goto err;
    }
    BIO_printf(trc_out, ... );

} OSSL_TRACE_END(TLS);

this will normally expand to:

do {
    BIO *trc_out = OSSL_trace_begin(OSSL_TRACE_CATEGORY_TLS);
    if (trc_out != NULL) {
        if (some_error) {
            OSSL_trace_end(OSSL_TRACE_CATEGORY_TLS, trc_out);
            goto err;
        }
        BIO_printf(trc_out, ... );
    }
    OSSL_trace_end(OSSL_TRACE_CATEGORY_TLS, trc_out);
} while (0);

OSSL_TRACE() and OSSL_TRACE1(), OSSL_TRACE2(), … OSSL_TRACE9() are the so-called one-shot macros:

the macro call OSSL_TRACE(category, text) produces literal text trace output.
the macro call OSSL_TRACEn(category, format, arg1, ..., argn) produces printf-style trace output with n format field arguments (n=1,…,9). it expands to:

OSSL_TRACE_BEGIN(category) {
    BIO_printf(trc_out, format, arg1, ..., argN);
} OSSL_TRACE_END(category)

internally, all one-shot macros are implemented using a generic OSSL_TRACEV() macro, because C90 does not support variadic macros. this helper macro has a rather weird synopsis and should not be used directly. don't do it, it's giving chaos 🙈

the macro call OSSL_TRACE_STRING(category, text, full, data, len) outputs data of length size as a string if tracing for the given category is enabled. it expands to:

OSSL_TRACE_BEGIN(category) {
    OSSL_trace_string(trc_out, text, full, data, len);
} OSSL_TRACE_END(category)

the OSSL_TRACE_ENABLED() macro can be used to conditionally execute some code only if a specific trace category is enabled. in some situations this is simpler than entering a trace section using OSSL_TRACE_BEGIN() and OSSL_TRACE_END(). for example, the code

if (OSSL_TRACE_ENABLED(TLS)) {
    ...
}

expands to

if (OSSL_trace_enabled(OSSL_TRACE_CATEGORY_TLS) {
    ...
}

🌈 Configure Tracing

by default, the OpenSSL library is built with tracing disabled. so to use the tracing functionality documented here, you gotta configure and build OpenSSL with the 'enable-trace' option. no option, no vibes.

when the library is built with tracing disabled:

the macro OPENSSL_NO_TRACE is defined in <openssl/opensslconf.h>.
all functions are still present, but OSSL_trace_enabled() will always report the categories as disabled, and all other functions will do nothing. 💀
the convenience macros are defined to produce dead code. for example, take this example from the "Macros" section above:

OSSL_TRACE_BEGIN(TLS) {

    if (condition) {
        OSSL_TRACE_CANCEL(TLS);
        goto err;
    }
    BIO_printf(trc_out, ... );

} OSSL_TRACE_END(TLS);

when the tracing API isn't operational, that will expand to:

do {
    BIO *trc_out = NULL;
    if (0) {
        if (condition) {
            ((void)0);
            goto err;
        }
        BIO_printf(trc_out, ... );
    }
} while (0);

🧚 NOTES 🧚

you do not need to guard trace output function calls like OSSL_TRACE(category, ...) by OSSL_TRACE_ENABLED(category). it's already handled, bestie, relax 💅

if producing the trace output requires carrying out auxiliary calculations, that auxiliary code should live inside a conditional block that only executes if the trace category is enabled.

the most natural way to do this is to put the code inside the trace section itself, because it already introduces such a conditional block:

OSSL_TRACE_BEGIN(TLS) {
    int var = do_some_auxiliary_calculation();

    BIO_printf(trc_out, "var = %d\n", var);

} OSSL_TRACE_END(TLS);

in some cases it's more advantageous to use a simple conditional group instead of a trace section. this is the case if calculations and tracing happen in different locations of the code, or if the calculations are so time consuming that putting them inside a (critical) trace section would create too much contention:

if (OSSL_TRACE_ENABLED(TLS)) {
    int var = do_some_auxiliary_calculation();

    OSSL_TRACE1("var = %d\n", var);
}

note however that premature optimization of tracing code is in general futile and it's better to keep the tracing code as simple as possible. because most often the limiting factor for the application's speed is the time it takes to print the trace output, not to calculate it. periodt. 🔥

⭐ RETURN VALUES ⭐

OSSL_trace_enabled() returns 1 if tracing for the given type is operational and enabled, otherwise 0.
OSSL_trace_begin() returns a BIO pointer if the given type is enabled, otherwise NULL.
OSSL_trace_string() returns the number of characters emitted, or -1 on error.

🌟 HISTORY 🌟

the OpenSSL Tracing API was added in OpenSSL 3.0. a classic, honestly.

OSSL_TRACE_STRING(), OSSL_TRACE_STRING_MAX, and OSSL_trace_string were added in OpenSSL 3.2. the glow-up era ✨

💌 COPYRIGHT 💌

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie 🫶 this was OpenSSL 3.5.9, dated 2026-09-29, and you were reading OSSL_TRACE_ENABLED(3ossl). go forth and trace responsibly 💖✨🎀

📦 where this page comes from

fedora 43: openssl-devel 1:3.5.9-1.fc43 · Apache-2.0
fedora 43: openssl-devel 1:3.5.9-1.fc43 · Apache-2.0
fedora 44: openssl-devel 1:3.5.9-1.fc44 · Apache-2.0
fedora 44: openssl-devel 1:3.5.9-1.fc44 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-14: a language model's rewrite of the original, under its terms