OSSL_INDICATOR_SET_CALLBACK(3SSL)

📦
version 4.0.3 · 6 versions
, in ubuntu stonking

✨ OSSL_INDICATOR_set_callback, OSSL_INDICATOR_get_callback — the FIPS indicator callback situation 💅

okay bestie, so this one lives in the OpenSSL family of manual pages, manual name 3SSL, and it's literally just about handing a callback to the FIPS indicator machinery. no cap. let's get into it 🫶

🌸 NAME 🌸

OSSL_INDICATOR_set_callback, OSSL_INDICATOR_get_callback — specify a callback for FIPS indicators 💖

✨ SYNOPSIS ✨

#include <openssl/indicator.h>

typedef int (OSSL_INDICATOR_CALLBACK)(const char *type, const char *desc,
                                      const OSSL_PARAM params[]);

void OSSL_INDICATOR_set_callback(OSSL_LIB_CTX *libctx,
                                 OSSL_INDICATOR_CALLBACK *cb);
void OSSL_INDICATOR_get_callback(OSSL_LIB_CTX *libctx,
                                 OSSL_INDICATOR_CALLBACK **cb);

🦋 DESCRIPTION 🦋

so OSSL_INDICATOR_set_callback() sets a user callback cb that gets associated with a libctx, and that callback is gonna get called whenever a non approved FIPS operation gets detected. it's giving alarm bells but make it optional 🔔

and bestie, important: your callback can be triggered multiple times during a single algorithm operation, because it's flagging that different approved mode checks have failed. so like, don't assume it's a one-and-done, okay?

Non approved operations may only occur if the user has deliberately chosen to do so — either by setting a global FIPS configuration option, or via an option in an algorithm's operation context. so yeah, you kinda signed up for it if it happens. main character choice, honestly.

inside your callback, the OSSL_INDICATOR_CALLBACK params type and desc carry the algorithm type and the operation that isn't approved. params is not currently used. yeah. it's just sitting there. iconic of it 💀

🚨 and here's the spicy bit: if your user callback returns 0, an error will occur in the caller. great for testing purposes, less great for vibes. your call.

🎀 RETURN VALUES 🎀

OSSL_INDICATOR_get_callback() returns the callback that's been set via OSSL_INDICATOR_set_callback() for the given library context libctx — or NULL if no callback is currently set. simple as. 🫶

🌈 EXAMPLES 🌈

here's a simple indicator callback that just logs non approved FIPS operations, as a little treat:

static int indicator_cb(const char *type, const char *desc,
                        const OSSL_PARAM params[])
{
    if (type != NULL && desc != NULL)
        fprintf(stdout, "%s %s is not approved\n", type, desc);
end:
    /* For Testing purposes you could return 0 here to cause an error */
    return 1;
}

OSSL_INDICATOR_set_callback(libctx, indicator_cb);

see how it returns 1? that's the "we're all good, no chaos today" return. the comment is telling you that 0 is your chaos button for testing 🧚

💜 SEE ALSO 💜

⭐ HISTORY ⭐

the functions described here were added in OpenSSL 3.4. they're new-ish, they're fresh ✨

Copyright 2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie 🎀 this was OpenSSL docs, version 4.0.3, dated 2026-09-29 — go forth, set your callbacks, log those non approved operations, and remember: return 0 only if you're testing 💅🦋 no cap.

📦 where this page comes from