1 files changed, 55 insertions, 13 deletions
diff --git a/upstream/debian-unstable/man3/X509_STORE_CTX_new.3ssl b/upstream/debian-unstable/man3/X509_STORE_CTX_new.3ssl
index 24345ea3..bc771e47 100644
--- a/upstream/debian-unstable/man3/X509_STORE_CTX_new.3ssl
+++ b/upstream/debian-unstable/man3/X509_STORE_CTX_new.3ssl
@@ -55,19 +55,23 @@
 .\" ========================================================================
 .\"
 .IX Title "X509_STORE_CTX_NEW 3SSL"
-.TH X509_STORE_CTX_NEW 3SSL 2024-02-03 3.1.5 OpenSSL
+.TH X509_STORE_CTX_NEW 3SSL 2024-04-04 3.2.2-dev OpenSSL
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
 .nh
 .SH NAME
 X509_STORE_CTX_new_ex, X509_STORE_CTX_new, X509_STORE_CTX_cleanup,
-X509_STORE_CTX_free, X509_STORE_CTX_init, X509_STORE_CTX_set0_trusted_stack,
+X509_STORE_CTX_free, X509_STORE_CTX_init,
+X509_STORE_CTX_init_rpk,
+X509_STORE_CTX_set0_trusted_stack,
 X509_STORE_CTX_set_cert, X509_STORE_CTX_set0_crls,
+X509_STORE_CTX_set0_rpk,
 X509_STORE_CTX_get0_param, X509_STORE_CTX_set0_param,
 X509_STORE_CTX_get0_untrusted, X509_STORE_CTX_set0_untrusted,
 X509_STORE_CTX_get_num_untrusted,
 X509_STORE_CTX_get0_chain, X509_STORE_CTX_set0_verified_chain,
+X509_STORE_CTX_get0_rpk,
 X509_STORE_CTX_set_default,
 X509_STORE_CTX_set_verify,
 X509_STORE_CTX_verify_fn,
@@ -87,11 +91,14 @@ X509_STORE_CTX_purpose_inherit
 \&
 \& int X509_STORE_CTX_init(X509_STORE_CTX *ctx, X509_STORE *trust_store,
 \&                         X509 *target, STACK_OF(X509) *untrusted);
+\& int X509_STORE_CTX_init_rpk(X509_STORE_CTX *ctx, X509_STORE *trust_store,
+\&                             EVP_PKEY *rpk);
 \&
 \& void X509_STORE_CTX_set0_trusted_stack(X509_STORE_CTX *ctx, STACK_OF(X509) *sk);
 \&
 \& void X509_STORE_CTX_set_cert(X509_STORE_CTX *ctx, X509 *target);
 \& void X509_STORE_CTX_set0_crls(X509_STORE_CTX *ctx, STACK_OF(X509_CRL) *sk);
+\& void X509_STORE_CTX_set0_rpk(X509_STORE_CTX *ctx, EVP_PKEY *target);
 \&
 \& X509_VERIFY_PARAM *X509_STORE_CTX_get0_param(const X509_STORE_CTX *ctx);
 \& void X509_STORE_CTX_set0_param(X509_STORE_CTX *ctx, X509_VERIFY_PARAM *param);
@@ -102,6 +109,7 @@ X509_STORE_CTX_purpose_inherit
 \& int X509_STORE_CTX_get_num_untrusted(const X509_STORE_CTX *ctx);
 \& STACK_OF(X509) *X509_STORE_CTX_get0_chain(const X509_STORE_CTX *ctx);
 \& void X509_STORE_CTX_set0_verified_chain(X509_STORE_CTX *ctx, STACK_OF(X509) *chain);
+\& EVP_PKEY *X509_STORE_CTX_get0_rpk(const X509_STORE_CTX *ctx);
 \&
 \& int X509_STORE_CTX_set_default(X509_STORE_CTX *ctx, const char *name);
 \& typedef int (*X509_STORE_CTX_verify_fn)(X509_STORE_CTX *);
@@ -133,7 +141,10 @@ It is used by \fBX509_STORE_CTX_init()\fR and \fBX509_STORE_CTX_free()\fR.
 is no longer valid.
 If \fIctx\fR is NULL nothing is done.
 .PP
-It must be called before each call to \fBX509_verify_cert\fR\|(3) or
+\&\fBX509_STORE_CTX_init()\fR sets up \fIctx\fR for a subsequent verification operation.
+.PP
+\&\fBX509_STORE_CTX_init()\fR initializes the internal state and resources of the
+X509_STORE_CTX, and must be called before each call to \fBX509_verify_cert\fR\|(3) or
 \&\fBX509_STORE_CTX_verify\fR\|(3), i.e., a context is only good for one verification.
 If you want to verify a further certificate or chain with the same \fIctx\fR
 then you must call \fBX509_STORE_CTX_init()\fR again.
@@ -143,6 +154,8 @@ they are provided simply as a list using \fBX509_STORE_CTX_set0_trusted_stack()\
 The certificate to be verified is set to \fItarget\fR,
 and a list of additional certificates may be provided in \fIuntrusted\fR,
 which will be untrusted but may be used to build the chain.
+The \fItarget\fR certificate is not copied (its reference count is not updated),
+and the caller must not free it before verification is complete.
 Each of the \fItrust_store\fR, \fItarget\fR and \fIuntrusted\fR parameters can be NULL.
 Yet note that \fBX509_verify_cert\fR\|(3) and \fBX509_STORE_CTX_verify\fR\|(3)
 will need a verification target.
@@ -151,6 +164,14 @@ For \fBX509_STORE_CTX_verify\fR\|(3), which takes by default the first element o
 list of untrusted certificates as its verification target,
 this can be also set indirectly using \fBX509_STORE_CTX_set0_untrusted()\fR.
 .PP
+\&\fBX509_STORE_CTX_init_rpk()\fR sets up \fIctx\fR for a subsequent verification
+operation for the \fItarget\fR raw public key.
+It behaves similarly to \fBX509_STORE_CTX_init()\fR.
+The \fItarget\fR raw public key can also be supplied separately, via
+\&\fBX509_STORE_CTX_set0_rpk()\fR.
+The \fItarget\fR public key is not copied (its reference count is not updated),
+and the caller must not free it before verification is complete.
+.PP
 \&\fBX509_STORE_CTX_set0_trusted_stack()\fR sets the set of trusted certificates of
 \&\fIctx\fR to \fIsk\fR. This is an alternative way of specifying trusted certificates
 instead of using an \fBX509_STORE\fR where its complexity is not needed
@@ -158,6 +179,14 @@ or to make sure that only the given set \fIsk\fR of certificates are trusted.
 .PP
 \&\fBX509_STORE_CTX_set_cert()\fR sets the target certificate to be verified in \fIctx\fR
 to \fItarget\fR.
+The target certificate is not copied (its reference count is not updated),
+and the caller must not free it before verification is complete.
+.PP
+\&\fBX509_STORE_CTX_set0_rpk()\fR sets the target raw public key to be verified in \fIctx\fR
+to \fItarget\fR, a non-NULL raw public key preempts any target certificate, which
+is then ignored.
+The \fItarget\fR public key is not copied (its reference count is not updated),
+and the caller must not free it before verification is complete.
 .PP
 \&\fBX509_STORE_CTX_set0_verified_chain()\fR sets the validated chain to \fIchain\fR.
 Ownership of the chain is transferred to \fIctx\fR,
@@ -166,6 +195,9 @@ and so it should not be free'd by the caller.
 \&\fBX509_STORE_CTX_get0_chain()\fR returns the internal pointer used by the
 \&\fIctx\fR that contains the constructed (output) chain.
 .PP
+\&\fBX509_STORE_CTX_get0_rpk()\fR returns the internal pointer used by the
+\&\fIctx\fR that contains the raw public key.
+.PP
 \&\fBX509_STORE_CTX_set0_crls()\fR sets a set of CRLs to use to aid certificate
 verification to \fIsk\fR. These CRLs will only be used if CRL verification is
 enabled in the associated \fBX509_VERIFY_PARAM\fR structure. This might be
@@ -247,14 +279,18 @@ verified in the \fIctx\fR. Built-in available values for the \fIpurpose\fR argum
 are \fBX509_PURPOSE_SSL_CLIENT\fR, \fBX509_PURPOSE_SSL_SERVER\fR,
 \&\fBX509_PURPOSE_NS_SSL_SERVER\fR, \fBX509_PURPOSE_SMIME_SIGN\fR,
 \&\fBX509_PURPOSE_SMIME_ENCRYPT\fR, \fBX509_PURPOSE_CRL_SIGN\fR, \fBX509_PURPOSE_ANY\fR,
-\&\fBX509_PURPOSE_OCSP_HELPER\fR and \fBX509_PURPOSE_TIMESTAMP_SIGN\fR. It is also
-possible to create a custom purpose value. Setting a purpose will ensure that
-the key usage declared within certificates in the chain being verified is
-consistent with that purpose as well as, potentially, other checks. Every
-purpose also has an associated default trust value which will also be set at the
-same time. During verification this trust setting will be verified to check it
-is consistent with the trust set by the system administrator for certificates in
-the chain.
+\&\fBX509_PURPOSE_OCSP_HELPER\fR, \fBX509_PURPOSE_TIMESTAMP_SIGN\fR and
+\&\fBX509_PURPOSE_CODE_SIGN\fR.  It is also
+possible to create a custom purpose value. Setting a purpose requests that
+the key usage and extended key usage (EKU) extensions optionally declared within
+the certificate and its chain are verified to be consistent with that purpose.
+For SSL client, SSL server, and S/MIME purposes, the EKU is checked also for the
+CA certificates along the chain, including any given trust anchor certificate.
+Potentially also further checks are done (depending on the purpose given).
+Every purpose also has an associated default trust value, which will also be set
+at the same time. During verification, this trust setting will be verified
+to check whether it is consistent with the trust set by the system administrator
+for certificates in the chain.
 .PP
 \&\fBX509_STORE_CTX_set_trust()\fR sets the trust value for the target certificate
 being verified in the \fIctx\fR. Built-in available values for the \fItrust\fR
@@ -300,11 +336,15 @@ should be made or reference counts increased instead.
 \&\fBX509_STORE_CTX_new()\fR returns a newly allocated context or NULL if an
 error occurred.
 .PP
-\&\fBX509_STORE_CTX_init()\fR returns 1 for success or 0 if an error occurred.
+\&\fBX509_STORE_CTX_init()\fR and \fBX509_STORE_CTX_init_rpk()\fR return 1 for success
+or 0 if an error occurred.
 .PP
 \&\fBX509_STORE_CTX_get0_param()\fR returns a pointer to an \fBX509_VERIFY_PARAM\fR
 structure or NULL if an error occurred.
 .PP
+\&\fBX509_STORE_CTX_get0_rpk()\fR returns a pointer to an \fBEVP_PKEY\fR structure if
+present, or NULL if absent.
+.PP
 \&\fBX509_STORE_CTX_cleanup()\fR, \fBX509_STORE_CTX_free()\fR,
 \&\fBX509_STORE_CTX_set0_trusted_stack()\fR,
 \&\fBX509_STORE_CTX_set_cert()\fR,
@@ -324,11 +364,13 @@ used.
 The \fBX509_STORE_CTX_set0_crls()\fR function was added in OpenSSL 1.0.0.
 The \fBX509_STORE_CTX_get_num_untrusted()\fR function was added in OpenSSL 1.1.0.
 The \fBX509_STORE_CTX_new_ex()\fR function was added in OpenSSL 3.0.
+The \fBX509_STORE_CTX_init_rpk()\fR, \fBX509_STORE_CTX_get0_rpk()\fR, and
+\&\fBX509_STORE_CTX_set0_rpk()\fR functions were added in OpenSSL 3.2.
 .PP
 There is no need to call \fBX509_STORE_CTX_cleanup()\fR explicitly since OpenSSL 3.0.
 .SH COPYRIGHT
 .IX Header "COPYRIGHT"
-Copyright 2009\-2022 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2009\-2023 The OpenSSL Project Authors. All Rights Reserved.
 .PP
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy