SSL_CTX_is_server() was added.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
MergeDate: Fri Jan 16 13:19:25 2026
(Merged from https://github.com/openssl/openssl/pull/29635)

diff --git a/CHANGES.md b/CHANGES.md
index 9b46ca53aa404c0ffb9ee5e57458bd628503c0bb..067a2b0752baf9008e439dc2c50428aac404cac0 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -352,6 +352,10 @@ OpenSSL 3.6
 
    *Dimitri John Ledkov*
 
+ * SSL_CTX_is_server() was added.
+
+   *Igor Ustinov*
+
 OpenSSL 3.5
 -----------
 

diff --git a/doc/man3/SSL_get_version.pod b/doc/man3/SSL_get_version.pod
index 2412cbd1c286a217e3e1b293d0bf9d906b1a994a..cb729668b6ee9d7ff0462dee1e3312551ba38530 100644 (file)
--- a/doc/man3/SSL_get_version.pod
+++ b/doc/man3/SSL_get_version.pod
@@ -3,7 +3,8 @@
 =head1 NAME
 
 SSL_client_version, SSL_get_version, SSL_is_dtls, SSL_is_tls, SSL_is_quic,
-SSL_CTX_is_quic, SSL_version - get the protocol information of a connection
+SSL_CTX_is_quic, SSL_CTX_is_server, SSL_version - get the protocol information
+of a connection
 
 =head1 SYNOPSIS
 
@@ -17,6 +18,7 @@ SSL_CTX_is_quic, SSL_version - get the protocol information of a connection
  int SSL_is_tls(const SSL *ssl);
  int SSL_is_quic(const SSL *ssl);
  int SSL_CTX_is_quic(const SSL_CTX *ctx);
+ int SSL_CTX_is_server(const SSL_CTX *ctx);
 
  int SSL_version(const SSL *s);
 
@@ -41,6 +43,9 @@ SSL_is_quic() returns 1 if the connection is using QUIC or 0 if not.
 
 SSL_CTX_is_quic() returns 1 if the ctx creates QUIC SSL objects or 0 if not.
 
+SSL_CTX_is_server() returns 1 if the ctx uses a I<method> that allows it to be
+a server (i.e. server-only or generic method) or 0 if not.
+
 =head1 RETURN VALUES
 
 
@@ -143,7 +148,8 @@ L<ssl(7)>
 The SSL_is_dtls() function was added in OpenSSL 1.1.0. The SSL_is_tls() and
 SSL_is_quic() functions were added in OpenSSL 3.2.
 
-The SSL_CTX_is_quic() function was added in OpenSSL 4.0
+The SSL_CTX_is_quic() and SSL_CTX_is_server() functions were added in
+OpenSSL 4.0
 
 =head1 COPYRIGHT
 

diff --git a/include/openssl/ssl.h.in b/include/openssl/ssl.h.in
index 61e7ce67efbac8b632e88424c7c2f3e1f658066a..7882b8bc674b62eb1ddb6400ef4f6b74207727c0 100644 (file)
--- a/include/openssl/ssl.h.in
+++ b/include/openssl/ssl.h.in
@@ -1831,6 +1831,7 @@ int SSL_is_dtls(const SSL *s);
 int SSL_is_tls(const SSL *s);
 int SSL_is_quic(const SSL *s);
 int SSL_CTX_is_quic(const SSL_CTX *c);
+int SSL_CTX_is_server(const SSL_CTX *c);
 
 __owur int SSL_set_session_id_context(SSL *ssl, const unsigned char *sid_ctx,
     unsigned int sid_ctx_len);

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 2bafe473fbf7535e08e66b0318446ce85a0f90a5..e82ac8c0406c3e60f1af16efd7bbb1abbc18080a 100644 (file)
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -1008,6 +1008,13 @@ int SSL_CTX_is_quic(const SSL_CTX *c)
     return IS_QUIC_CTX(c);
 }
 
+int SSL_CTX_is_server(const SSL_CTX *c)
+{
+    if (c == NULL || c->method == NULL)
+        return 0;
+    return (c->method->ssl_accept == ssl_undefined_function) ? 0 : 1;
+}
+
 int SSL_up_ref(SSL *s)
 {
     int i;

diff --git a/test/sslapitest.c b/test/sslapitest.c
index 6c13b8e2269fe4f80781b18312dd2c2a4ffe1bdd..efc3a863b3f73cdf4ffb18209e767b76bc09a030 100644 (file)
--- a/test/sslapitest.c
+++ b/test/sslapitest.c
@@ -12181,6 +12181,34 @@ end:
     return testresult;
 }
 
+/*
+ * Test that SSL_CTX_is_server returns the expected results.
+ */
+static int test_ssl_ctx_is_server(void)
+{
+    int testresult = 0;
+    SSL_CTX *cctx = NULL, *sctx = NULL, *gctx = NULL;
+
+    cctx = SSL_CTX_new_ex(libctx, NULL, TLS_client_method());
+    sctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method());
+    gctx = SSL_CTX_new_ex(libctx, NULL, TLS_method());
+
+    if (!TEST_ptr(cctx) || !TEST_ptr(sctx) || !TEST_ptr(gctx))
+        goto end;
+
+    if (!TEST_false(SSL_CTX_is_server(cctx))
+        || !TEST_true(SSL_CTX_is_server(sctx))
+        || !TEST_true(SSL_CTX_is_server(gctx)))
+        goto end;
+
+    testresult = 1;
+end:
+    SSL_CTX_free(cctx);
+    SSL_CTX_free(sctx);
+    SSL_CTX_free(gctx);
+    return testresult;
+}
+
 /*
  * Test that the SSL_rstate_string*() APIs return sane results
  */
@@ -14070,6 +14098,7 @@ int setup_tests(void)
     ADD_ALL_TESTS(test_serverinfo_custom, 4);
 #endif
     ADD_ALL_TESTS(test_version, 6);
+    ADD_TEST(test_ssl_ctx_is_server);
     ADD_TEST(test_rstate_string);
     ADD_ALL_TESTS(test_handshake_retry, 16);
     ADD_TEST(test_data_retry);

diff --git a/util/libssl.num b/util/libssl.num
index c657d5ee61f96c9bd6e11f8a0915e58d4d92aaa3..d43e75f4d501be4d3e8254f5896e1ee725725d7f 100644 (file)
--- a/util/libssl.num
+++ b/util/libssl.num
@@ -606,5 +606,6 @@ SSL_set_quic_tls_cbs                    ?   4_0_0   EXIST::FUNCTION:
 SSL_set_quic_tls_transport_params       ?      4_0_0   EXIST::FUNCTION:
 SSL_set_quic_tls_early_data_enabled     ?      4_0_0   EXIST::FUNCTION:
 SSL_CTX_is_quic                         ?      4_0_0   EXIST::FUNCTION:
+SSL_CTX_is_server                       ?      4_0_0   EXIST::FUNCTION:
 OSSL_QUIC_method                        ?      4_0_0   EXIST::FUNCTION:QUIC
 SSL_listen_ex                           ?      4_0_0   EXIST::FUNCTION: