SSL_CTX_SET_..._GENERATE_CB(3ossl)

📦
version 15.1 · 3 versions
, in freebsd 15.1

💅 SSL_CTX_SET_..._GENERATE_CB(3ossl) — the OpenSSL glow-up 🎀

okay bestie, so this is one of those OpenSSL manual pages, the 3ossl side of the library, and it's literally all about cookie callbacks. not the yummy kind 😭 the TLS1.3 / DTLS handshake kind. stay with me, it slaps once you get it.

✨ NAME ✨

SSL_CTX_set_stateless_cookie_generate_cb, SSL_CTX_set_stateless_cookie_verify_cb, SSL_CTX_set_cookie_generate_cb, SSL_CTX_set_cookie_verify_cb — callback functions for stateless TLS1.3 cookies 🍪

🌸 SYNOPSIS 🌸

#include <openssl/ssl.h>

void SSL_CTX_set_stateless_cookie_generate_cb(
    SSL_CTX *ctx,
    int (*gen_stateless_cookie_cb) (SSL *ssl,
                                    unsigned char *cookie,
                                    size_t *cookie_len));
void SSL_CTX_set_stateless_cookie_verify_cb(
    SSL_CTX *ctx,
    int (*verify_stateless_cookie_cb) (SSL *ssl,
                                       const unsigned char *cookie,
                                       size_t cookie_len));

void SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx,
                                    int (*app_gen_cookie_cb) (SSL *ssl,
                                                              unsigned char
                                                              *cookie,
                                                              unsigned int
                                                              *cookie_len));
void SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx,
                                  int (*app_verify_cookie_cb) (SSL *ssl,
                                                               const unsigned
                                                               char *cookie,
                                                               unsigned int
                                                               cookie_len));

like, yes, they're all void-returning setters and the actual callback signatures are the whole personality here. look at them. chef's kiss 👑

💖 DESCRIPTION 💖

This is the setter. It sets the callback that SSL_stateless(3) uses to generate the application-controlled portion of the cookie that gets handed to clients in the HelloRetryRequest. and when does that happen? when the server receives a ClientHello with a missing or invalid cookie. iconic behavior honestly.

so gen_stateless_cookie_cb() has rules, and they're not optional:

  • it must write at most SSL_COOKIE_LENGTH bytes into cookie
  • it must write the number of bytes written to cookie_len
  • if a cookie genuinely cannot be generated, you can return a zero value to abort the handshake 💀

sets the callback SSL_stateless(3) uses to figure out whether the application-controlled portion of a ClientHello cookie is valid.

the cookie data is pointed to by cookie, and its length is cookie_len. a nonzero return value from verify_stateless_cookie_cb() is how you communicate "yep, that cookie is valid, slay" ✅

and here's the part that's giving main character energy: the integrity of the entire cookie — including the application-controlled portion — is automatically verified by HMAC before verify_stateless_cookie_cb() is even called. so OpenSSL did that for you. you're welcome 🫶

sets the callback DTLSv1_listen(3) uses to generate the cookie handed to clients in the HelloVerifyRequest, which is transmitted as a response to a ClientHello with a missing or invalid cookie.

same energy, different constants:

  • app_gen_cookie_cb() must write at most DTLS1_COOKIE_LENGTH bytes into cookie
  • it must write the number of bytes written to cookie_len
  • if a cookie cannot be generated, a zero return value can be used to abort the handshake 😭

sets the callback DTLSv1_listen(3) uses to determine whether the cookie in a ClientHello is valid.

cookie data is pointed to by cookie, and it's cookie_len long. a nonzero return value from app_verify_cookie_cb() means "valid, bestie" ✅

⚠️ okay hear me on this one: the integrity of the cookie is not verified by OpenSSL here. that's an application responsibility. so like… it's on you. no cap. 💀

🌈 RETURN VALUES 🌈

neither function returns a value. they're setters. they set. that's the whole arc. ✨

👑 SEE ALSO 👑

go read those next, iykyk 🦋

⭐ HISTORY ⭐

SSL_CTX_set_stateless_cookie_generate_cb() and SSL_CTX_set_stateless_cookie_verify_cb() were added in OpenSSL 1.1.1. vintage. lowkey a classic 💜

Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

🎀 and that's the page!! this was OpenSSL 3.5.6, dated 2026-04-07, signing off — stay encrypted, stay hydrated, and please actually check those DTLS cookies yourself bestie 😭💖
📦 where this page comes from