[openssl-commits] [openssl] master update

[kaduk at mit.edu]

The branch master has been updated
       via  e65dfa471a6fd9a4ba6265739039c4da75d75752 (commit)
      from  4130016623d043c7279f39937a73c24200288a73 (commit)


- Log -----------------------------------------------------------------
commit e65dfa471a6fd9a4ba6265739039c4da75d75752
Author: Benjamin Kaduk <bkaduk at akamai.com>
Date:   Tue Aug 29 11:31:20 2017 -0500

    Tighten up SSL_get1_supported_ciphers() docs
    
    This function is really emulating what would happen in client mode,
    and does not necessarily reflect what is usable for a server SSL.
    Make this a bit more explicit, and do some wordsmithing while here.
    
    Reviewed-by: Andy Polyakov <appro at openssl.org>
    (Merged from https://github.com/openssl/openssl/pull/4284)

-----------------------------------------------------------------------

Summary of changes:
 doc/man3/SSL_get_ciphers.pod | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/doc/man3/SSL_get_ciphers.pod b/doc/man3/SSL_get_ciphers.pod
index d1baafe..d91afc2 100644
--- a/doc/man3/SSL_get_ciphers.pod
+++ b/doc/man3/SSL_get_ciphers.pod
@@ -29,16 +29,16 @@ is returned.
 SSL_CTX_get_ciphers() returns the stack of available SSL_CIPHERs for B<ctx>.
 
 SSL_get1_supported_ciphers() returns the stack of enabled SSL_CIPHERs for
-B<ssl>, sorted by preference.
+B<ssl> as would be sent in a ClientHello (that is, sorted by preference).
 The list depends on settings like the cipher list, the supported protocol
 versions, the security level, and the enabled signature algorithms.
 SRP and PSK ciphers are only enabled if the appropriate callbacks or settings
 have been applied.
-This is the list that will be sent by the client to the server.
-The list supported by the server might include more ciphers in case there is a
-hole in the list of supported protocols.
-The server will also not use ciphers from this list depending on the
-configured certificates and DH parameters.
+The list of ciphers that would be sent in a ClientHello can differ from
+the list of ciphers that would be acceptable when acting as a server.
+For example, additional ciphers may be usable by a server if there is
+a gap in the list of supported protocols, and some ciphers may not be
+usable by a server if there is not a suitable certificate configured.
 If B<ssl> is NULL or no ciphers are available, NULL is returned.
 
 SSL_get_client_ciphers() returns the stack of available SSL_CIPHERs matching the