Ignore entropy from RAND_add()/RAND_seed() in FIPS mode

[openssl.git] / doc / man3 / SSL_get_version.pod

diff --git a/doc/man3/SSL_get_version.pod b/doc/man3/SSL_get_version.pod
index e0ff96028188485bfe5568714195e238a8c71a37..d12927745a5049091d9933e9022fe9868b83e735 100644 (file)
--- a/doc/man3/SSL_get_version.pod
+++ b/doc/man3/SSL_get_version.pod
@@ -19,18 +19,20 @@ protocol information of a connection
 
 =head1 DESCRIPTION
 
-SSL_client_version() returns the protocol version used by the client when
-initiating the connection.
-
-SSL_get_version() returns the name of the protocol used for the
-connection.
+SSL_client_version() returns the numeric protocol version advertised by the
+client in the legacy_version field of the ClientHello when initiating the
+connection. Note that, for TLS, this value will never indicate a version greater
+than TLSv1.2 even if TLSv1.3 is subsequently negotiated. SSL_get_version()
+returns the name of the protocol used for the connection. SSL_version() returns
+the numeric protocol version used for the connection. They should only be called
+after the initial handshake has been completed. Prior to that the results
+returned from these functions may be unreliable.
 
 SSL_is_dtls() returns one if the connection is using DTLS, zero if not.
 
-SSL_version() returns the protocol version used for the connection.
-
 =head1 RETURN VALUES
 
+
 SSL_get_version() returns one of the following strings:
 
 =over 4
@@ -57,14 +59,14 @@ The connection uses the TLSv1.3 protocol.
 
 =item unknown
 
-This indicates that no version has been set (no connection established).
+This indicates an unknown protocol version.
 
 =back
 
-SSL_version() and SSL_client_version() return an integer which could include any of
-the following:
+SSL_version() and SSL_client_version() return an integer which could include any
+of the following:
 
-=over 5
+=over 4
 
 =item SSL3_VERSION
 
@@ -84,7 +86,8 @@ The connection uses the TLSv1.2 protocol.
 
 =item TLS1_3_VERSION
 
-The connection uses the TLSv1.3 protocol.
+The connection uses the TLSv1.3 protocol (never returned for
+SSL_client_version()).
 
 =back
 
@@ -94,13 +97,13 @@ L<ssl(7)>
 
 =head1 HISTORY
 
-SSL_is_dtls() was added in OpenSSL 1.1.0.
+The SSL_is_dtls() function was added in OpenSSL 1.1.0.
 
 =head1 COPYRIGHT
 
-Copyright 2001-2017 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.
 
-Licensed under the OpenSSL license (the "License").  You may not use
+Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
 in the file LICENSE in the source distribution or at
 L<https://www.openssl.org/source/license.html>.