Introduce SSL_CIPHER_get_protocol_id

The returned ID matches with what IANA specifies (or goes on the
wire anyway, IANA notwithstanding).

Doc is added.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/4107)

diff --git a/doc/man3/SSL_CIPHER_get_name.pod b/doc/man3/SSL_CIPHER_get_name.pod
index 2f8dcae9f74e422171f4d35682c194cdaf5f5f5e..c82be8e4e296019736b0f0524b71d9bb22461772 100644 (file)
--- a/doc/man3/SSL_CIPHER_get_name.pod
+++ b/doc/man3/SSL_CIPHER_get_name.pod
@@ -15,7 +15,8 @@ SSL_CIPHER_get_kx_nid,
 SSL_CIPHER_get_auth_nid,
 SSL_CIPHER_is_aead,
 SSL_CIPHER_find,
-SSL_CIPHER_get_id
+SSL_CIPHER_get_id,
+SSL_CIPHER_get_protocol_id
 - get SSL_CIPHER properties
 
 =head1 SYNOPSIS
@@ -36,6 +37,7 @@ SSL_CIPHER_get_id
  int SSL_CIPHER_is_aead(const SSL_CIPHER *c);
  const SSL_CIPHER *SSL_CIPHER_find(SSL *ssl, const unsigned char *ptr);
  uint32_t SSL_CIPHER_get_id(const SSL_CIPHER *c);
+ uint32_t SSL_CIPHER_get_protocol_id(const SSL_CIPHER *c);
 
 =head1 DESCRIPTION
 
@@ -98,11 +100,11 @@ two-byte TLS cipher ID (as allocated by IANA) in network byte order. This parame
 is usually retrieved from a TLS packet by using functions like L<SSL_early_get0_ciphers(3)>.
 SSL_CIPHER_find() returns NULL if an error occurs or the indicated cipher is not found.
 
-SSL_CIPHER_get_id() returns the ID of the given cipher B<c>. The ID here is an
-OpenSSL-specific concept, which stores a prefix of 0x0300 in the higher two bytes,
-and the IANA-specified chipher suite ID in the lower two bytes. For instance,
-TLS_RSA_WITH_NULL_MD5 has IANA ID "0x00, 0x01", but the SSL_CIPHER_get_id()
-function will return an ID with value 0x03000001.
+SSL_CIPHER_get_id() returns the OpenSSL-specific ID of the given cipher B<c>. That ID is
+not the same as the IANA-specific ID.
+
+SSL_CIPHER_get_protocol_id() returns the two-byte ID used in the TLS protocol of the given
+cipher B<c>.
 
 SSL_CIPHER_description() returns a textual description of the cipher used
 into the buffer B<buf> of length B<len> provided.  If B<buf> is provided, it

diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h
index 218dbdf0e66b098c661c944ce8ceb3793e17b981..237c086baeca236710a301c1de14a85c8d275392 100644 (file)
--- a/include/openssl/ssl.h
+++ b/include/openssl/ssl.h
@@ -1441,6 +1441,7 @@ __owur const char *SSL_CIPHER_get_name(const SSL_CIPHER *c);
 __owur const char *SSL_CIPHER_standard_name(const SSL_CIPHER *c);
 __owur const char *OPENSSL_cipher_name(const char *rfc_name);
 __owur uint32_t SSL_CIPHER_get_id(const SSL_CIPHER *c);
+__owur uint16_t SSL_CIPHER_get_protocol_id(const SSL_CIPHER *c);
 __owur int SSL_CIPHER_get_kx_nid(const SSL_CIPHER *c);
 __owur int SSL_CIPHER_get_auth_nid(const SSL_CIPHER *c);
 __owur const EVP_MD *SSL_CIPHER_get_handshake_digest(const SSL_CIPHER *c);

diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
index deacef7b708c5b9de7f9703d9efdc6c6438c306e..cba9e14c26d6c9bad6133266e784b0ad2251efad 100644 (file)
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -1764,6 +1764,11 @@ uint32_t SSL_CIPHER_get_id(const SSL_CIPHER *c)
     return c->id;
 }
 
+uint16_t SSL_CIPHER_get_protocol_id(const SSL_CIPHER *c)
+{
+    return c->id & 0xFFFF;
+}
+
 SSL_COMP *ssl3_comp_find(STACK_OF(SSL_COMP) *sk, int n)
 {
     SSL_COMP *ctmp;

diff --git a/util/libssl.num b/util/libssl.num
index 7d4c01e80fde9a2913993bf1645a81bcd10e3f40..d5774566e09353979b8729ca2f768950953040b4 100644 (file)
--- a/util/libssl.num
+++ b/util/libssl.num
@@ -464,3 +464,4 @@ SSL_alloc_buffers                       464 1_1_1   EXIST::FUNCTION:
 SSL_free_buffers                        465    1_1_1   EXIST::FUNCTION:
 SSL_SESSION_dup                         466    1_1_1   EXIST::FUNCTION:
 SSL_get_pending_cipher                  467    1_1_1   EXIST::FUNCTION:
+SSL_CIPHER_get_protocol_id              468    1_1_1   EXIST::FUNCTION: