mirror of
https://github.com/opnsense/src.git
synced 2026-06-09 08:43:19 -04:00
b077aed33b
Migrate to OpenSSL 3.0 in advance of FreeBSD 14.0. OpenSSL 1.1.1 (the version we were previously using) will be EOL as of 2023-09-11. Most of the base system has already been updated for a seamless switch to OpenSSL 3.0. For many components we've added `-DOPENSSL_API_COMPAT=0x10100000L` to CFLAGS to specify the API version, which avoids deprecation warnings from OpenSSL 3.0. Changes have also been made to avoid OpenSSL APIs that were already deprecated in OpenSSL 1.1.1. The process of updating to contemporary APIs can continue after this merge. Additional changes are still required for libarchive and Kerberos- related libraries or tools; workarounds will immediately follow this commit. Fixes are in progress in the upstream projects and will be incorporated when those are next updated. There are some performance regressions in benchmarks (certain tests in `openssl speed`) and in some OpenSSL consumers in ports (e.g. haproxy). Investigation will continue for these. Netflix's testing showed no functional regression and a rather small, albeit statistically significant, increase in CPU consumption with OpenSSL 3.0. Thanks to ngie@ and des@ for updating base system components, to antoine@ and bofh@ for ports exp-runs and port fixes/workarounds, and to Netflix and everyone who tested prior to commit or contributed to this update in other ways. PR: 271615 PR: 271656 [exp-run] Relnotes: Yes Sponsored by: The FreeBSD Foundation
71 lines
2.4 KiB
Text
71 lines
2.4 KiB
Text
=pod
|
|
|
|
=head1 NAME
|
|
|
|
SSL_get_current_cipher, SSL_get_cipher_name, SSL_get_cipher,
|
|
SSL_get_cipher_bits, SSL_get_cipher_version,
|
|
SSL_get_pending_cipher - get SSL_CIPHER of a connection
|
|
|
|
=head1 SYNOPSIS
|
|
|
|
#include <openssl/ssl.h>
|
|
|
|
const SSL_CIPHER *SSL_get_current_cipher(const SSL *ssl);
|
|
const SSL_CIPHER *SSL_get_pending_cipher(const SSL *ssl);
|
|
|
|
const char *SSL_get_cipher_name(const SSL *s);
|
|
const char *SSL_get_cipher(const SSL *s);
|
|
int SSL_get_cipher_bits(const SSL *s, int *np);
|
|
const char *SSL_get_cipher_version(const SSL *s);
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
SSL_get_current_cipher() returns a pointer to an SSL_CIPHER object containing
|
|
the description of the actually used cipher of a connection established with
|
|
the B<ssl> object.
|
|
See L<SSL_CIPHER_get_name(3)> for more details.
|
|
|
|
SSL_get_cipher_name() obtains the
|
|
name of the currently used cipher.
|
|
SSL_get_cipher() is identical to SSL_get_cipher_name().
|
|
SSL_get_cipher_bits() is a
|
|
macro to obtain the number of secret/algorithm bits used and
|
|
SSL_get_cipher_version() returns the protocol name.
|
|
|
|
SSL_get_pending_cipher() returns a pointer to an SSL_CIPHER object containing
|
|
the description of the cipher (if any) that has been negotiated for future use
|
|
on the connection established with the B<ssl> object, but is not yet in use.
|
|
This may be the case during handshake processing, when control flow can be
|
|
returned to the application via any of several callback methods. The internal
|
|
sequencing of handshake processing and callback invocation is not guaranteed
|
|
to be stable from release to release, and at present only the callback set
|
|
by SSL_CTX_set_alpn_select_cb() is guaranteed to have a non-NULL return value.
|
|
Other callbacks may be added to this list over time.
|
|
|
|
=head1 RETURN VALUES
|
|
|
|
SSL_get_current_cipher() returns the cipher actually used, or NULL if
|
|
no session has been established.
|
|
|
|
SSL_get_pending_cipher() returns the cipher to be used at the next change
|
|
of cipher suite, or NULL if no such cipher is known.
|
|
|
|
=head1 NOTES
|
|
|
|
SSL_get_cipher, SSL_get_cipher_bits, SSL_get_cipher_version, and
|
|
SSL_get_cipher_name are implemented as macros.
|
|
|
|
=head1 SEE ALSO
|
|
|
|
L<ssl(7)>, L<SSL_CIPHER_get_name(3)>
|
|
|
|
=head1 COPYRIGHT
|
|
|
|
Copyright 2000-2022 The OpenSSL Project Authors. All Rights Reserved.
|
|
|
|
Licensed under the Apache License 2.0 (the "License"). You may not use
|
|
this file except in compliance with the License. You can obtain a copy
|
|
in the file LICENSE in the source distribution or at
|
|
L<https://www.openssl.org/source/license.html>.
|
|
|
|
=cut
|