SSL_SET_SESSION_SECRET_CB(3ossl)

📦
version 15.1 · 2 versions
, in freebsd 15.1

🌸 NAME 🌸

Okay bestie, welcome to the SSL_SET_SESSION_SECRET_CB(3ossl) manual page — OpenSSL's own page for SSL_set_session_secret_cb and tls_session_secret_cb_fn. It's literally about setting the session secret callback. That's the whole assignment. 💅

✨ SYNOPSIS ✨

        #include <openssl/ssl.h>

        typedef int (*tls_session_secret_cb_fn)(SSL *s, void *secret, int *secret_len,
                                                STACK_OF(SSL_CIPHER) *peer_ciphers,
                                                const SSL_CIPHER **cipher, void *arg);

        int SSL_set_session_secret_cb(SSL *s,
                                      tls_session_secret_cb_fn session_secret_cb,
                                      void *arg);

💖 DESCRIPTION 💖

Okay so SSL_set_session_secret_cb() sets the session secret callback to be used (session_secret_cb), plus an optional argument (arg) to be passed to that callback when it is called. Cute, right? 🎀

🚨 Real talk, bestie: this is only useful for an implementation of EAP-FAST (RFC4851). The presence of the callback also modifies the internal OpenSSL TLS state machine to match the modified TLS behaviour as described in RFC4851. Therefore this callback should not be used except when implementing EAP-FAST. Periodt. 💀

The callback is expected to set the master secret to be used by filling in the data pointed to by *secret. The size of the secret buffer is initially available in *secret_len and may be updated by the callback — but it must not be larger than the initial value. No cap, don't overshoot. 🫶

On the server side the set of ciphersuites offered by the peer is provided in the peer_ciphers stack. Optionally the callback may select the preferred ciphersuite by setting it in *cipher. Slay. ✨

On the client side the peer_ciphers stack will always be NULL. The callback may specify the preferred cipher in *cipher and this will be associated with the SSL_SESSION — but it does not affect the ciphersuite selected by the server. IYKYK. 🦋

The callback is also supplied with an additional argument in arg, which is the argument that was provided to the original SSL_set_session_secret_cb() call. Full circle, bestie. 🌈

🎀 RETURN VALUES 🎀

SSL_set_session_secret_cb() returns 1 on success and 0 on failure. Simple.

If the callback returns 1 then this indicates it has successfully set the secret. A return value of 0 indicates that the secret has not been set. On the client this will cause an immediate abort of the handshake. 😭 So yeah, if it's giving 0, the handshake is not okay.

🦋 SEE ALSO 🦋

Copyright 2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

💖 That's the whole manual page, bestie! It's from OpenSSL 3.5.6, dated 2026-04-07, and it's the SSL_SET_SESSION_SECRET_CB(3ossl) page. Byeeee! 💅✨

📦 where this page comes from