yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2025-03-23 23:05:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Improve documentation of mbedtls_ssl_get_peer_cert()

Browse source
This commit is contained in:
Hanno Becker 2019-02-05 11:33:12 +00:00
parent f02d5501d8
commit 869144b3e9
1 changed files with 25 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
include/mbedtls/ssl.h
View file

@ -3230,18 +3230,34 @@ int mbedtls_ssl_get_max_out_record_payload( const mbedtls_ssl_context *ssl );
#if defined(MBEDTLS_X509_CRT_PARSE_C) #if defined(MBEDTLS_X509_CRT_PARSE_C)
/** /**
* \brief Return the peer certificate from the current connection * \brief Return the peer certificate from the current connection.
* *
* Note: Can be NULL in case no certificate was sent during * For ciphersuites not using certificate-based peer
* the handshake. Different calls for the same connection can * authentication (such as PSK-based ciphersuites), no
* return the same or different pointers for the same * peer certificate is available, and this function returns
* certificate and even a different certificate altogether. * \c NULL.
* The peer cert CAN change in a single connection if
* renegotiation is performed.
* *
* \param ssl SSL context * \param ssl The SSL context to use. This must be initialized and setup.
* *
* \return the current peer certificate * \return The current peer certificate, or \c NULL if
* none is available. It is owned by the SSL context
* and valid only until the next call to the SSL API.
*
* \note For one-time inspection of the peer's certificate during
* the handshake, consider registering an X.509 CRT verification
* callback through mbedtls_ssl_conf_verify() instead of calling
* this function. Using mbedtls_ssl_conf_verify() also comes at
* the benefit of allowing you to influence the verification
* process, for example by masking expected and tolerated
* verification failures.
*
* \warning You must not use the pointer returned by this function
* after any further call to the SSL API, including
* mbedtls_ssl_read() and mbedtls_ssl_write(); this is
* because the pointer might change during renegotiation,
* which happens transparently to the user.
* If you want to use the certificate across API calls,
* you must make a copy.
*/ */
const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl ); const mbedtls_x509_crt *mbedtls_ssl_get_peer_cert( const mbedtls_ssl_context *ssl );
#endif /* MBEDTLS_X509_CRT_PARSE_C */ #endif /* MBEDTLS_X509_CRT_PARSE_C */