Skip to content

SSL_get_shared_ciphers returns client ciphers not shared ciphers #5317

@noxxi

Description

@noxxi

Contrary to what the name suggests SSL_get_shared_ciphers returns the same ciphers as SSL_get_client_ciphers, i.e. the contents of ssl->session->ciphers. The ciphers member of ssl_session_st is documented as follows:

  STACK_OF(SSL_CIPHER) *ciphers; /* shared ciphers? */

The question mark behind "shared ciphers" is there since at least 0.9.8 - and rightly so. Because this member contains at least in the current versions not the shared ciphers but all ciphers offered by the client.

Given that SSL_get_shared_ciphers is used for example in apps/s_server.c the output from this app is misleading since it claims that the client provided ciphers are actually the shared ciphers. For example when using s_server with a restricted cipher set and connecting with a client offering a larger cipher set the output looks like this:

   $ openssl s_server -cipher 'AES128-SHA' -cert ...
   ....
   Shared ciphers:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:...AES128-SHA:...
   ...
   CIPHER is AES128-SHA

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions