.\" -*- mode: troff; coding: utf-8 -*-
.\" Automatically generated by Pod::Man 5.0102 (Pod::Simple 3.45)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" \*(C` and \*(C' are quotes in nroff, nothing in troff, for use with C<>.
.ie n \{\
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{\
.    if \nF \{\
.        de IX
.        tm Index:\\$1\t\\n%\t"\\$2"
..
.        if !\nF==2 \{\
.            nr % 0
.            nr F 2
.        \}
.    \}
.\}
.rr rF
.\" ========================================================================
.\"
.IX Title "SSL_SET_SESSION_SECRET_CB 3ssl"
.TH SSL_SET_SESSION_SECRET_CB 3ssl 2024-10-23 3.4.0 OpenSSL
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH NAME
SSL_set_session_secret_cb, tls_session_secret_cb_fn
\&\- set the session secret callback
.SH SYNOPSIS
.IX Header "SYNOPSIS"
.Vb 1
\& #include <openssl/ssl.h>
\&
\& typedef int (*tls_session_secret_cb_fn)(SSL *s, void *secret, int *secret_len,
\&                                         STACK_OF(SSL_CIPHER) *peer_ciphers,
\&                                         const SSL_CIPHER **cipher, void *arg);
\&
\& int SSL_set_session_secret_cb(SSL *s,
\&                               tls_session_secret_cb_fn session_secret_cb,
\&                               void *arg);
.Ve
.SH DESCRIPTION
.IX Header "DESCRIPTION"
\&\fBSSL_set_session_secret_cb()\fR sets the session secret callback to be used
(\fIsession_secret_cb\fR), and an optional argument (\fIarg\fR) to be passed to that
callback when it is called. This is only useful for an implementation of
EAP-FAST (RFC4851). The presence of the callback also modifies the internal
OpenSSL TLS state machine to match the modified TLS behaviour as described in
RFC4851. Therefore this callback should not be used except when implementing
EAP-FAST.
.PP
The callback is expected to set the master secret to be used by filling in the
data pointed to by \fI*secret\fR. The size of the secret buffer is initially
available in \fI*secret_len\fR and may be updated by the callback (but must not be
larger than the initial value).
.PP
On the server side the set of ciphersuites offered by the peer is provided in
the \fIpeer_ciphers\fR stack. Optionally the callback may select the preferred
ciphersuite by setting it in \fI*cipher\fR.
.PP
On the client side the \fIpeer_ciphers\fR stack will always be NULL. The callback
may specify the preferred cipher in \fI*cipher\fR and this will be associated with
the \fBSSL_SESSION\fR \- but it does not affect the ciphersuite selected by the
server.
.PP
The callback is also supplied with an additional argument in \fIarg\fR which is the
argument that was provided to the original \fBSSL_set_session_secret_cb()\fR call.
.SH "RETURN VALUES"
.IX Header "RETURN VALUES"
\&\fBSSL_set_session_secret_cb()\fR returns 1 on success and 0 on failure.
.PP
If the callback returns 1 then this indicates it has successfully set the
secret. A return value of 0 indicates that the secret has not been set. On the
client this will cause an immediate abort of the handshake.
.SH "SEE ALSO"
.IX Header "SEE ALSO"
\&\fBssl\fR\|(7),
\&\fBSSL_get_session\fR\|(3)
.SH COPYRIGHT
.IX Header "COPYRIGHT"
Copyright 2024 The OpenSSL Project Authors. All Rights Reserved.
.PP
Licensed under the Apache License 2.0 (the "License").  You may not use
this file except in compliance with the License.  You can obtain a copy
in the file LICENSE in the source distribution or at
<https://www.openssl.org/source/license.html>.