Add SSL_get_client_certificate_types.

openssl/include/openssl/ssl.h

Index: openssl/include/openssl/ssl.h
diff --git a/openssl/include/openssl/ssl.h b/openssl/include/openssl/ssl.h
index a3944f177dda9ae8f632a6e70bb8d93081355233..7c5a4c9e699688bd0c4165dacd0684602871ce32 100644
--- a/openssl/include/openssl/ssl.h
+++ b/openssl/include/openssl/ssl.h
@@ -1982,6 +1982,8 @@ STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(const SSL_CTX *s);
 int SSL_add_client_CA(SSL *ssl,X509 *x);
 int SSL_CTX_add_client_CA(SSL_CTX *ctx,X509 *x);
 
+void SSL_get_client_certificate_types(SSL *s, char **ctype, size_t *ctype_num);

[wtc, 2014/04/25 17:42:03]

1. Should |s| be a const SSL * pointer? See the SSL_get_client_CA_list functio
prototype.

2. |ctype| should be const char ** to prevent the caller from modifying the
s->s3->tmp.ctype buffer with *ctype. 

3. In TLS 1.2, CertificateRequest has a new supported_signature_algorithms
member:

      struct {
          ClientCertificateType certificate_types<1..2^8-1>;
          SignatureAndHashAlgorithm
            supported_signature_algorithms<2^16-1>;
          DistinguishedName certificate_authorities<0..2^16-1>;
      } CertificateRequest;

So we may also want to add a SSL_get_server_supported_signature_algorithms
function.

[davidben, 2014/05/02 22:42:02]

Done.
Done.
Probably. Although OpenSSL doesn't actually save that right now. It just
remembers the first supported hash algorithm per signature algorithm and
discards rest; that's sufficient if you're using that to negotiate the hash
function in your CertificateVerify, but not if you want to also negotiate the
signatures in the client's certificate chain. We can support that additionally
later I guess? Not sure if it (or this, for that matter) is especially
interesting. :-)

+
 void SSL_set_connect_state(SSL *s);
 void SSL_set_accept_state(SSL *s);