mirrors/openssl
0
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-12-02 22:44:29 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add SSL_get_pending_cipher()

Browse Source 
The existing function SSL_get_current_cipher() queries the
current session for the ciphersuite in use, but there is no way
for application code to determine what ciphersuite has been
negotiated and will be used in the future, prior to ChangeCipherState
(or the TLS 1.3 equivalent) causing the new cipher to take effect and
become visible in the session information.  Expose this information
to appropriate application callbacks to use during the handshake.

The name SSL_get_pending_cipher() was chosen for compatibility with
BoringSSL's routine of that name.

Improve the note on macro implementations in SSL_get_current_cipher.pod
while here.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/4070)
This commit is contained in:
Benjamin Kaduk 2017-08-01 15:28:14 -05:00 committed by Benjamin Kaduk
parent 5626f634c3
commit 0aed6e449d
4 changed files with 25 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
doc/man3/SSL_get_current_cipher.pod
View File

@ -3,13 +3,15 @@
=head1 NAME
SSL_get_current_cipher, SSL_get_cipher_name, SSL_get_cipher,
SSL_get_cipher_bits, SSL_get_cipher_version - get SSL_CIPHER of a connection
SSL_get_cipher_bits, SSL_get_cipher_version,
SSL_get_pending_cipher - get SSL_CIPHER of a connection
=head1 SYNOPSIS
#include <openssl/ssl.h>
SSL_CIPHER *SSL_get_current_cipher(const SSL *ssl);
SSL_CIPHER *SSL_get_pending_cipher(const SSL *ssl);
const char *SSL_get_cipher_name(const SSL *s);
const char *SSL_get_cipher(const SSL *s);
@ -30,14 +32,28 @@ SSL_get_cipher_bits() is a
macro to obtain the number of secret/algorithm bits used and
SSL_get_cipher_version() returns the protocol name.
SSL_get_pending_cipher() returns a pointer to an SSL_CIPHER object containing
the description of the cipher (if any) that has been negotiated for future use
on the connection established with the B<ssl> object, but is not yet in use.
This may be the case during handshake processing, when control flow can be
returned to the application via any of several callback methods. The internal
sequencing of handshake processing and callback invocation is not guaranteed
to be stable from release to release, and at present only the callback set
by SSL_CTX_set_alpn_select_cb() is guaranteed to have a non-NULL return value.
Other callbacks may be added to this list over time.
=head1 RETURN VALUES
SSL_get_current_cipher() returns the cipher actually used, or NULL if
no session has been established.
SSL_get_pending_cipher() returns the cipher to be used at the next change
of cipher suite, or NULL if no such cipher is known.
=head1 NOTES
These are implemented as macros.
SSL_get_cipher, SSL_get_cipher_bits, SSL_get_cipher_version, and
SSL_get_cipher_name are implemented as macros.
=head1 SEE ALSO

1
include/openssl/ssl.h
View File

@ -1430,6 +1430,7 @@ __owur int SSL_clear(SSL *s);
void SSL_CTX_flush_sessions(SSL_CTX *ctx, long tm);
__owur const SSL_CIPHER *SSL_get_current_cipher(const SSL *s);
__owur const SSL_CIPHER *SSL_get_pending_cipher(const SSL *s);
__owur int SSL_CIPHER_get_bits(const SSL_CIPHER *c, int *alg_bits);
__owur const char *SSL_CIPHER_get_version(const SSL_CIPHER *c);
__owur const char *SSL_CIPHER_get_name(const SSL_CIPHER *c);

5
ssl/ssl_lib.c
View File

@ -3613,6 +3613,11 @@ const SSL_CIPHER *SSL_get_current_cipher(const SSL *s)
return (NULL);
}
const SSL_CIPHER *SSL_get_pending_cipher(const SSL *s)
{
return s->s3->tmp.new_cipher;
}
const COMP_METHOD *SSL_get_current_compression(SSL *s)
{
#ifndef OPENSSL_NO_COMP

1
util/libssl.num
View File

@ -463,3 +463,4 @@ OPENSSL_cipher_name 463 1_1_1 EXIST::FUNCTION:
SSL_alloc_buffers 464 1_1_1 EXIST::FUNCTION:
SSL_free_buffers 465 1_1_1 EXIST::FUNCTION:
SSL_SESSION_dup 466 1_1_1 EXIST::FUNCTION:
SSL_get_pending_cipher 467 1_1_1 EXIST::FUNCTION: