Skip to content

Commit

Permalink
Implement SSL_CIPHER_get_version for recent TLS versions (#1627)
Browse files Browse the repository at this point in the history
### Issues:
Resolves t-V1408365647
Addresses n/a

### Description of changes: 

This change modifies `SSL_CIPHER_get_version` to return the relevant
version for non-deprecated TLS versions, namely TLSv1.2 and TLSv1.3
(preferred). For older TLS versions, the previous behavior (return
constant cstring `TLSv1/SSLv3`) is preserved.

### Call-outs:
- n/a

### Testing:
- CI

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license and the ISC license.
  • Loading branch information
WillChilds-Klein authored Jun 7, 2024
1 parent 4013299 commit 3b19b5a
Show file tree
Hide file tree
Showing 2 changed files with 18 additions and 1 deletion.
10 changes: 9 additions & 1 deletion ssl/ssl_cipher.cc
Original file line number Diff line number Diff line change
Expand Up @@ -1834,7 +1834,15 @@ bool tls_print_all_supported_cipher_suites(bool use_openssl_name) {
}

const char *SSL_CIPHER_get_version(const SSL_CIPHER *cipher) {
return "TLSv1/SSLv3";
switch (SSL_CIPHER_get_min_version(cipher)) {
case TLS1_2_VERSION:
case DTLS1_2_VERSION:
return "TLSv1.2";
case TLS1_3_VERSION:
return "TLSv1.3";
default:
return "TLSv1/SSLv3";
}
}

STACK_OF(SSL_COMP) *SSL_COMP_get_compression_methods(void) { return NULL; }
Expand Down
9 changes: 9 additions & 0 deletions ssl/ssl_test.cc
Original file line number Diff line number Diff line change
Expand Up @@ -7828,6 +7828,15 @@ TEST_P(SSLVersionTest, SessionPropertiesThreads) {
EXPECT_FALSE(verified_chain);
EXPECT_TRUE(SSL_get_current_cipher(ssl));
EXPECT_TRUE(SSL_get_group_id(ssl));
const uint16_t version = SSL_version(ssl);
if (version == TLS1_2_VERSION || version == TLS1_3_VERSION) {
const char *version_str = SSL_get_version(ssl);
EXPECT_STREQ(version_str, SSL_CIPHER_get_version(SSL_get_current_cipher(ssl)));
} else if (version == DTLS1_2_VERSION) { // ciphers don't differentiate D/TLS
EXPECT_STREQ("TLSv1.2", SSL_CIPHER_get_version(SSL_get_current_cipher(ssl)));
} else {
EXPECT_STREQ("TLSv1/SSLv3", SSL_CIPHER_get_version(SSL_get_current_cipher(ssl)));
}
};

std::vector<std::thread> threads;
Expand Down

0 comments on commit 3b19b5a

Please sign in to comment.