boring
boring copied to clipboard
Documentation of `SslContextBuilder::set_cipher_list` does not match boringSSL's documentation
trafficstars
In boring/src/ssl/mod.rs we have
/// Sets the list of supported ciphers for protocols before TLSv1.3.
///
/// The `set_ciphersuites` method controls the cipher suites for TLSv1.3.
///
/// See [`ciphers`] for details on the format.
///
/// This corresponds to [`SSL_CTX_set_cipher_list`].
///
/// [`ciphers`]: https://www.openssl.org/docs/man1.1.0/apps/ciphers.html
/// [`SSL_CTX_set_cipher_list`]: https://www.openssl.org/docs/manmaster/man3/SSL_CTX_set_cipher_list.html
But boring-sys/deps/boringssl/include/openssl/ssl.h says
// SSL_CTX_set_cipher_list configures the cipher list for |ctx|, evaluating
// |str| as a cipher string. It returns one on success and zero on failure.
//
// Prefer to use |SSL_CTX_set_strict_cipher_list|. This function tolerates
// garbage inputs, unless an empty cipher list results.
OPENSSL_EXPORT int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str);
and in the paragraph above this declaration, it says
// TLS 1.3 ciphers do not participate in this mechanism and instead have a
// built-in preference order. Functions to set cipher lists do not affect TLS
// 1.3, and functions to query the cipher list do not include TLS 1.3 ciphers.
Moreover, set_ciphersuites doesn't appear to exist.