SSL_get_cipher_list: enumerate the configured cipher list

src/ssl.c

@@ -9029,6 +9029,49 @@ WOLF_STACK_OF(WOLFSSL_CIPHER) *wolfSSL_get_ciphers_compat(const WOLFSSL *ssl)
     }
     return ssl->suitesStack;
 }
+
+/* Get the name of the cipher at index priority in the cipher list configured
+ * on this SSL. Index 0 is the highest priority suite. Returns NULL once
+ * priority is past the end of the list. Matches OpenSSL SSL_get_cipher_list().
+ */
+const char* wolfSSL_get_cipher_list_compat(const WOLFSSL* ssl, int priority)
+{
+    const Suites* suites;
+    int i;
+    int idx = 0;
+
+    WOLFSSL_ENTER("wolfSSL_get_cipher_list_compat");
+
+    if (ssl == NULL || priority < 0)
+        return NULL;
+
+    suites = WOLFSSL_SUITES(ssl);
+    if (suites == NULL)
+        return NULL;
+
+    for (i = 0; i < suites->suiteSz; i += 2) {
+        /* A couple of suites are placeholders for special options, skip
+         * those. */
+        if (SCSV_Check(suites->suites[i], suites->suites[i+1])
+                || sslCipherMinMaxCheck(ssl, suites->suites[i],
+                                        suites->suites[i+1])) {
+            continue;
+        }
+
+        if (idx++ == priority) {
+            /* Report the same name that SSL_CIPHER_get_name() would. */
+        #if !defined(WOLFSSL_CIPHER_INTERNALNAME) && \
+            !defined(NO_ERROR_STRINGS) && !defined(WOLFSSL_QT)
+            return GetCipherNameIana(suites->suites[i], suites->suites[i+1]);
+        #else
+            return wolfSSL_get_cipher_name_from_suite(suites->suites[i],
+                    suites->suites[i+1]);
+        #endif
+        }
+    }
+
+    return NULL;
+}
 #endif /* OPENSSL_EXTRA || OPENSSL_ALL || WOLFSSL_NGINX || WOLFSSL_HAPROXY */
 #ifdef OPENSSL_ALL
 /* returned pointer is to an internal element in WOLFSSL struct and should not

tests/api.c

@@ -21877,6 +21877,46 @@ static int test_wolfSSL_get_ciphers_compat_empty(void)
     return EXPECT_RESULT();
 }
 
+/* SSL_get_cipher_list() walks the cipher list configured on the SSL, highest
+ * priority first, and returns NULL once past the end. No handshake has run
+ * here, so there is no negotiated suite to report. */
+static int test_wolfSSL_get_cipher_list_compat(void)
+{
+    EXPECT_DECLS;
+#if !defined(NO_TLS) && !defined(NO_WOLFSSL_CLIENT)
+    SSL_CTX* ctx = NULL;
+    WOLFSSL* ssl = NULL;
+    STACK_OF(SSL_CIPHER)* ciphers = NULL;
+    const char* name = NULL;
+    int num = 0;
+    int i;
+
+    ExpectNotNull(ctx = SSL_CTX_new(SSLv23_client_method()));
+    ExpectNotNull(ssl = SSL_new(ctx));
+
+    ExpectNull(SSL_get_cipher_list(NULL, 0));
+    ExpectNull(SSL_get_cipher_list(ssl, -1));
+
+    ExpectNotNull(name = SSL_get_cipher_list(ssl, 0));
+    ExpectStrNE(name, "None");
+
+    /* Must agree with the stack SSL_get_ciphers() returns, entry for entry. */
+    ExpectNotNull(ciphers = SSL_get_ciphers(ssl));
+    ExpectIntGT(num = sk_SSL_CIPHER_num(ciphers), 0);
+    for (i = 0; i < num; i++) {
+        ExpectNotNull(name = SSL_get_cipher_list(ssl, i));
+        ExpectStrEQ(name,
+            SSL_CIPHER_get_name(sk_SSL_CIPHER_value(ciphers, i)));
+    }
+
+    ExpectNull(SSL_get_cipher_list(ssl, num));
+
+    SSL_free(ssl);
+    SSL_CTX_free(ctx);
+#endif
+    return EXPECT_RESULT();
+}
+
 static int test_wolfSSL_CTX_ctrl(void)
 {
     EXPECT_DECLS;
@@ -38412,6 +38452,7 @@ TEST_CASE testCases[] = {
     TEST_DECL(test_wolfSSL_sk_CIPHER_description),
     TEST_DECL(test_wolfSSL_get_ciphers_compat),
     TEST_DECL(test_wolfSSL_get_ciphers_compat_empty),
+    TEST_DECL(test_wolfSSL_get_cipher_list_compat),
 
     TEST_DECL(test_wolfSSL_CTX_ctrl),
 #endif /* OPENSSL_ALL */

wolfssl/openssl/ssl.h

@@ -247,7 +247,8 @@ typedef STACK_OF(ACCESS_DESCRIPTION) AUTHORITY_INFO_ACCESS;
 
 #define SSL_get_client_random(ssl,out,outSz) \
                                   wolfSSL_get_client_random((ssl),(out),(outSz))
-#define SSL_get_cipher_list(ctx,i)         wolfSSL_get_cipher_list_ex((ctx),(i))
+#define SSL_get_cipher_list(ssl,i) \
+                                       wolfSSL_get_cipher_list_compat((ssl),(i))
 #define SSL_get_cipher_name(ctx)           wolfSSL_get_cipher((ctx))
 #define SSL_get_shared_ciphers(ctx,buf,len) \
                                    wolfSSL_get_shared_ciphers((ctx),(buf),(len))

wolfssl/ssl.h

@@ -1458,6 +1458,11 @@ WOLFSSL_API int  wolfSSL_set_write_fd (WOLFSSL* ssl, int fd);
 WOLFSSL_API int  wolfSSL_set_read_fd (WOLFSSL* ssl, int fd);
 WOLFSSL_API char* wolfSSL_get_cipher_list(int priority);
 WOLFSSL_API char* wolfSSL_get_cipher_list_ex(WOLFSSL* ssl, int priority);
+#if defined(OPENSSL_EXTRA) || defined(OPENSSL_ALL) || \
+    defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)
+WOLFSSL_API const char* wolfSSL_get_cipher_list_compat(const WOLFSSL* ssl,
+    int priority);
+#endif
 WOLFSSL_API int  wolfSSL_get_ciphers(char* buf, int len);
 WOLFSSL_API int wolfSSL_get_ciphers_iana(char* buf, int len);
 WOLFSSL_API const char* wolfSSL_get_cipher_name(WOLFSSL* ssl);