Remove cipher from SSL_SESSION.

For a long time SSL_SESSION has had both a cipher ID and a pointer to
an SSL_CIPHER (and not both are guaranteed to be populated). There is also
a pointer to an SSL_CIPHER in the SSL_HANDSHAKE that denotes the cipher
being used for this connection. Some code has been using the cipher from
SSL_SESSION and some code has been using the cipher from SSL_HANDSHAKE.

Remove cipher from SSL_SESSION and use the version in SSL_HANDSHAKE
everywhere. If resuming from a session then we need to use the SSL_SESSION
cipher ID to set the SSL_HANDSHAKE cipher. And we still need to ensure that
we update the cipher ID in the SSL_SESSION whenever the SSL_HANDSHAKE
cipher changes (this only occurs in a few places).

ok tb@

1 files changed, 5 insertions, 4 deletions

diff --git a/src/lib/libssl/ssl_txt.c b/src/lib/libssl/ssl_txt.c
index ee3d218d68..26b631d5ab 100644
--- a/src/lib/libssl/ssl_txt.c
+++ b/src/lib/libssl/ssl_txt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_txt.c,v 1.37 2023/07/08 16:40:13 beck Exp $ */
+/* $OpenBSD: ssl_txt.c,v 1.38 2024/07/20 04:04:23 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -108,6 +108,7 @@ LSSL_ALIAS(SSL_SESSION_print_fp);
 int
 SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
 {
+        const SSL_CIPHER *cipher;
         size_t i;
         int ret = 0;
 
@@ -121,15 +122,15 @@ SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
             ssl_version_string(x->ssl_version)) <= 0)
                 goto err;
 
-        if (x->cipher == NULL) {
+        if ((cipher = ssl3_get_cipher_by_id(x->cipher_id)) == NULL) {
                 if (BIO_printf(bp, "    Cipher    : %04lX\n",
                     x->cipher_id & SSL3_CK_VALUE_MASK) <= 0)
                         goto err;
         } else {
                 const char *cipher_name = "unknown";
 
-                if (x->cipher->name != NULL)
-                        cipher_name = x->cipher->name;
+                if (cipher->name != NULL)
+                        cipher_name = cipher->name;
 
                 if (BIO_printf(bp, "    Cipher    : %s\n", cipher_name) <= 0)
                         goto err;