Add metrics for negotiated group with client #11844
Conversation
| int nid = SSL_get_negotiated_group(const_cast<SSL *>(ssl)); | ||
| #endif | ||
| if (nid != NID_undef) { | ||
| if (auto it = tls_group_map.find(nid); it != tls_group_map.end()) { |
There was a problem hiding this comment.
We should have OTHER, otherwise we'd see a mysterious drop when SSL libraries and clients support a new group.
#9623
And the table could be autogenerated if the library used has SSL_get_all_group_names. Only users who use SSL library that doesn't have the function would be affected if new groups are added.
There was a problem hiding this comment.
Yeh, I was thinking the same thing. Will do them.
There was a problem hiding this comment.
BoringSSL has an API to get NID from group name?
There was a problem hiding this comment.
No, it doesn't. Look at cipher_map. Its key is a string, not NID. It may not be great in terms of calculating the hash, but if we really care about it, I suppose we could use the pointer for the const char.
masaori335
force-pushed
the
asf-master-tls-curves-metrics
branch
from
5b48887
to
0ff7688
Compare
Like TLS ciphers.
The
SSL_get_negotiated_groupis introduced by OpenSSL 3.0.0 (and BoringSSL), so this doesn't work with OpenSSL 1.1.1 and older.