Make sure we can query the SSL object for version info when using QUIC

We have the existing functions SSL_version(), SSL_get_version() and
SSL_is_dtls(). We extend the first two to return something sensible when
using QUIC. We additionally provide the new functions SSL_is_tls() and
SSL_is_quic() to provide a mechanism to figure out what protocol we are
using.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20650)

diff --git a/include/openssl/prov_ssl.h b/include/openssl/prov_ssl.h
index d3e0896c8e6ff9fdb7c33b47926a7f171e8c7224..b120ca4be47b156bbff1f09042726a90ad4d28c8 100644 (file)
--- a/include/openssl/prov_ssl.h
+++ b/include/openssl/prov_ssl.h
@@ -19,6 +19,7 @@ extern "C" {
 
 # define SSL_MAX_MASTER_KEY_LENGTH 48
 
+/* SSL/TLS uses a 2 byte unsigned version number */
 # define SSL3_VERSION                    0x0300
 # define TLS1_VERSION                    0x0301
 # define TLS1_1_VERSION                  0x0302
@@ -28,6 +29,9 @@ extern "C" {
 # define DTLS1_2_VERSION                 0xFEFD
 # define DTLS1_BAD_VER                   0x0100
 
+/* QUIC uses a 4 byte unsigned version number */
+# define OSSL_QUIC1_VERSION              0x0000001
+
 # ifdef __cplusplus
 }
 # endif

diff --git a/include/openssl/ssl.h.in b/include/openssl/ssl.h.in
index 5cf6b319dc4de63d1351d14569b0ffc45a1d785e..38dc3e51720375f91cdf2132dc88e52c679fa97c 100644 (file)
--- a/include/openssl/ssl.h.in
+++ b/include/openssl/ssl.h.in
@@ -1798,6 +1798,8 @@ __owur int SSL_CTX_set_session_id_context(SSL_CTX *ctx,
 SSL *SSL_new(SSL_CTX *ctx);
 int SSL_up_ref(SSL *s);
 int SSL_is_dtls(const SSL *s);
+int SSL_is_tls(const SSL *s);
+int SSL_is_quic(const SSL *s);
 __owur int SSL_set_session_id_context(SSL *ssl, const unsigned char *sid_ctx,
                                       unsigned int sid_ctx_len);
 

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index efd89cf461a79649ac13d1429c7dab1c9aa36913..eac7fd659e4be1152fac99d52bfdeb0123542306 100644 (file)
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -928,12 +928,41 @@ int SSL_is_dtls(const SSL *s)
 {
     SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
 
+#ifndef OPENSSL_NO_QUIC
+    if (s->type == SSL_TYPE_QUIC_CONNECTION || s->type == SSL_TYPE_QUIC_STREAM)
+        return 0;
+#endif
+
     if (sc == NULL)
         return 0;
 
     return SSL_CONNECTION_IS_DTLS(sc) ? 1 : 0;
 }
 
+int SSL_is_tls(const SSL *s)
+{
+    SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
+
+#ifndef OPENSSL_NO_QUIC
+    if (s->type == SSL_TYPE_QUIC_CONNECTION || s->type == SSL_TYPE_QUIC_STREAM)
+        return 0;
+#endif
+
+    if (sc == NULL)
+        return 0;
+
+    return SSL_CONNECTION_IS_DTLS(sc) ? 0 : 1;
+}
+
+int SSL_is_quic(const SSL *s)
+{
+#ifndef OPENSSL_NO_QUIC
+    if (s->type == SSL_TYPE_QUIC_CONNECTION || s->type == SSL_TYPE_QUIC_STREAM)
+        return 1;
+#endif
+    return 0;
+}
+
 int SSL_up_ref(SSL *s)
 {
     int i;
@@ -4741,6 +4770,12 @@ const char *SSL_get_version(const SSL *s)
 {
     const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
 
+#ifndef OPENSSL_NO_QUIC
+    /* We only support QUICv1 - so if its QUIC its QUICv1 */
+    if (s->type == SSL_TYPE_QUIC_CONNECTION || s->type == SSL_TYPE_QUIC_STREAM)
+        return "QUICv1";
+#endif
+
     if (sc == NULL)
         return NULL;
 
@@ -5077,6 +5112,11 @@ int SSL_version(const SSL *s)
 {
     const SSL_CONNECTION *sc = SSL_CONNECTION_FROM_CONST_SSL(s);
 
+#ifndef OPENSSL_NO_QUIC
+    /* We only support QUICv1 - so if its QUIC its QUICv1 */
+    if (s->type == SSL_TYPE_QUIC_CONNECTION || s->type == SSL_TYPE_QUIC_STREAM)
+        return OSSL_QUIC1_VERSION;
+#endif
     /* TODO(QUIC): Do we want to report QUIC version this way instead? */
     if (sc == NULL)
         return 0;

diff --git a/util/libssl.num b/util/libssl.num
index 6bb916d63e5690cbe1a03f19208095c9342080f3..6e60aa8e9383c9ca0f3989002335ec890ea8c34a 100644 (file)
--- a/util/libssl.num
+++ b/util/libssl.num
@@ -558,3 +558,5 @@ SSL_get_negotiated_client_cert_type     ?   3_2_0   EXIST::FUNCTION:
 SSL_get_negotiated_server_cert_type     ?      3_2_0   EXIST::FUNCTION:
 SSL_add_expected_rpk                    ?      3_2_0   EXIST::FUNCTION:
 d2i_SSL_SESSION_ex                      ?      3_2_0   EXIST::FUNCTION:
+SSL_is_tls                              ?      3_2_0   EXIST::FUNCTION:
+SSL_is_quic                             ?      3_2_0   EXIST::FUNCTION: