Functions

OSSL_trace_set_prefix() and OSSL_trace_set_suffix() can be used to add an extra line for each channel, to be output before and after group of tracing output. What constitues an output group is decided by the code that produces the output. The lines given here are considered immutable; for more dynamic tracing prefixes, consider setting a callback with OSSL_trace_set_callback() instead.

OSSL_trace_set_callback() is used to enable the given trace category by giving it the tracer callback cb with the associated data data, which will simply be passed through to cb whenever it's called. The callback function is internally wrapped by a dedicated BIO object, the so called callback trace channel. This should be used when it's desirable to do form the trace output to something suitable for application needs where a prefix and suffix line aren't enough.

OSSL_trace_set_channel() and OSSL_trace_set_callback() are mutually exclusive, calling one of them will clear whatever was set by the previous call.

Calling OSSL_trace_set_channel() with NULL for channel or OSSL_trace_set_callback() with NULL for cb disables tracing for the given category.

Trace callback

The possible control numbers are:

OSSL_TRACE_CTRL_BEGIN

The callback is called from OSSL_trace_begin(), which gives the callback the possibility to output a dynamic starting line, or set a prefix that should be output at the beginning of each line, or something other.

OSSL_TRACE_CTRL_WRITE

This callback is called whenever data is written to the BIO by some regular BIO output routine. An arbitrary number of OSSL_TRACE_CTRL_WRITE callbacks can occur inside a group marked by a pair of OSSL_TRACE_CTRL_BEGIN and OSSL_TRACE_CTRL_END calls, but never outside such a group.

OSSL_TRACE_CTRL_END

The callback is called from OSSL_trace_end(), which gives the callback the possibility to output a dynamic ending line, or reset the line prefix that was set with OSSL_TRACE_CTRL_BEGIN, or something other.

Trace categories

OSSL_TRACE_CATEGORY_TRACE

Traces the OpenSSL trace API itself.

More precisely, this will generate trace output any time a new trace hook is set.

OSSL_TRACE_CATEGORY_INIT

Traces OpenSSL library initialization and cleanup.

This needs special care, as OpenSSL will do automatic cleanup after exit from "main()", and any tracing output done during this cleanup will be lost if the tracing channel or callback were cleaned away prematurely. A suggestion is to make such cleanup part of a function that's registered very early with atexit(3).

OSSL_TRACE_CATEGORY_TLS

Traces the TLS/SSL protocol.

OSSL_TRACE_CATEGORY_TLS_CIPHER

Traces the ciphers used by the TLS/SSL protocol.

OSSL_TRACE_CATEGORY_ENGINE_TABLE

Traces the ENGINE algorithm table selection.

More precisely, functions like ENGINE_get_pkey_asn1_meth_engine(), ENGINE_get_pkey_meth_engine(), ENGINE_get_cipher_engine(), ENGINE_get_digest_engine(), will generate trace summaries of the handling of internal tables.

OSSL_TRACE_CATEGORY_ENGINE_REF_COUNT

Traces the ENGINE reference counting.

More precisely, both reference counts in the ENGINE structure will be monitored with a line of trace output generated for each change.

OSSL_TRACE_CATEGORY_PKCS5V2

Traces PKCS#5 v2 key generation.

OSSL_TRACE_CATEGORY_PKCS12_KEYGEN

Traces PKCS#12 key generation.

OSSL_TRACE_CATEGORY_PKCS12_DECRYPT

Traces PKCS#12 decryption.

OSSL_TRACE_CATEGORY_X509V3_POLICY

Traces X509v3 policy processing.

More precisely, this generates the complete policy tree at various point during evaluation.

OSSL_TRACE_CATEGORY_BN_CTX

Traces BIGNUM context operations.

OSSL_TRACE_CATEGORY_CONF

Traces details about the provider and engine configuration.

There is also OSSL_TRACE_CATEGORY_ALL, which works as a fallback and can be used to get all trace output.

Note, however, that in this case all trace output will effectively be associated with the 'ALL' category, which is undesirable if the application intends to include the category name in the trace output. In this case it is better to register separate channels for each trace category instead.

Simple example

 int main(int argc, char *argv[])
 {
     BIO *err = BIO_new_fp(stderr, BIO_NOCLOSE | BIO_FP_TEXT);
     OSSL_trace_set_channel(OSSL_TRACE_CATEGORY_SSL, err);
     OSSL_trace_set_prefix(OSSL_TRACE_CATEGORY_SSL, "BEGIN TRACE[TLS]");
     OSSL_trace_set_suffix(OSSL_TRACE_CATEGORY_SSL, "END TRACE[TLS]");

     /* ... work ... */
 }

When the trace producing code above is performed, this will be output on standard error:

 BEGIN TRACE[TLS]
 foo: 42
 0000 - 00 01 02 03 04 05 06 07-08 09 0a 0b 0c 0d 0e 0f   ................
 END TRACE[TLS]

Advanced example

 static size_t cb(const char *buf, size_t cnt,
                 int category, int cmd, void *vdata)
 {
     BIO *bio = vdata;
     const char *label = NULL;

     switch (cmd) {
     case OSSL_TRACE_CTRL_BEGIN:
         label = "BEGIN";
         break;
     case OSSL_TRACE_CTRL_END:
         label = "END";
         break;
     }

     if (label != NULL) {
         union {
             pthread_t tid;
             unsigned long ltid;
         } tid;

         tid.tid = pthread_self();
         BIO_printf(bio, "%s TRACE[%s]:%lx\n",
                    label, OSSL_trace_get_category_name(category), tid.ltid);
     }
     return (size_t)BIO_puts(bio, buf);
 }

 int main(int argc, char *argv[])
 {
     BIO *err = BIO_new_fp(stderr, BIO_NOCLOSE | BIO_FP_TEXT);
     OSSL_trace_set_callback(OSSL_TRACE_CATEGORY_SSL, cb, err);

     /* ... work ... */
 }

The output is almost the same as for the simple example above.

 BEGIN TRACE[TLS]:7f9eb0193b80
 foo: 42
 0000 - 00 01 02 03 04 05 06 07-08 09 0a 0b 0c 0d 0e 0f   ................
 END TRACE[TLS]:7f9eb0193b80

Configure Tracing

When the library is built with tracing disabled, the macro OPENSSL_NO_TRACE is defined in <openssl/opensslconf.h> and all functions described here are inoperational, i.e. will do nothing.