Skip to contentSkip to conversation

Add SSL_CTX_get_max_proto_version() not in openssl 1.0

PATCH In review [email protected]... 3 participants 8 messages Jan 20, 2018

lore
Share & tools
lore

[email protected]...

author
#0 lore raw

PATCH 1/1 Add SSL_CTX_get_max_proto_version() not in openssl 1.0

From: Selva Nair <[email protected]...>

- No change in functionality. This is used in a subsequent patch for extending TLS1.2 support with cryptoapicert

Signed-off-by Selva Nair <[email protected]...>
---
 src/openvpn/openssl_compat.h | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
src/openvpn/openssl_compat.h +23 -0
index 9f1e92a..c94341a 100644
@@ -670,6 +670,29 @@ SSL_CTX_get_min_proto_version(SSL_CTX *ctx)
 }
 #endif /* SSL_CTX_get_min_proto_version */
 
+#ifndef SSL_CTX_get_max_proto_version
+/** Return the max SSL protocol version currently enabled in the context.
+ *  If no valid version >= TLS1.0 is found, return 0. */
+static inline int
+SSL_CTX_get_max_proto_version(SSL_CTX *ctx)
+{
+    long sslopt = SSL_CTX_get_options(ctx);
+    if (!(sslopt & SSL_OP_NO_TLSv1_2))
+    {
+	return TLS1_2_VERSION;
+    }
+    if (!(sslopt & SSL_OP_NO_TLSv1_1))
+    {
+	return TLS1_1_VERSION;
+    }
+    if (!(sslopt & SSL_OP_NO_TLSv1))
+    {
+	return TLS1_VERSION;
+    }
+    return 0;
+}
+#endif /* SSL_CTX_get_max_proto_version */
+
 #ifndef SSL_CTX_set_min_proto_version
 /** Mimics SSL_CTX_set_min_proto_version for OpenSSL < 1.1 */
 static inline int
Signature · 1 line
2.1.4
Acked-by on v1 1/1
#1 lore raw

Hi,

Quoted 35 lines · On 20-01-18 05:47, [email protected]... wrote:

From: Selva Nair <[email protected]...>

- No change in functionality. This is used in a subsequent patch for extending TLS1.2 support with cryptoapicert

Signed-off-by Selva Nair <[email protected]...>
---
 src/openvpn/openssl_compat.h | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
src/openvpn/openssl_compat.h +16 -0
index 9f1e92a..c94341a 100644
@@ -670,6 +670,29 @@ SSL_CTX_get_min_proto_version(SSL_CTX *ctx)
 }
 #endif /* SSL_CTX_get_min_proto_version */
 
+#ifndef SSL_CTX_get_max_proto_version
+/** Return the max SSL protocol version currently enabled in the context.
+ *  If no valid version >= TLS1.0 is found, return 0. */
+static inline int
+SSL_CTX_get_max_proto_version(SSL_CTX *ctx)
+{
+    long sslopt = SSL_CTX_get_options(ctx);
+    if (!(sslopt & SSL_OP_NO_TLSv1_2))
+    {
+	return TLS1_2_VERSION;
+    }
+    if (!(sslopt & SSL_OP_NO_TLSv1_1))
+    {
+	return TLS1_1_VERSION;
+    }
+    if (!(sslopt & SSL_OP_NO_TLSv1))

src/openvpn/openssl_compat.h SSL_CTX_get_min_proto_version(SSL_CTX *ctx) · line 698

Quoted 10 lines
src/openvpn/openssl_compat.h +7 -0
+    {
+	return TLS1_VERSION;
+    }
+    return 0;
+}
+#endif /* SSL_CTX_get_max_proto_version */
+
 #ifndef SSL_CTX_set_min_proto_version
 /** Mimics SSL_CTX_set_min_proto_version for OpenSSL < 1.1 */
 static inline int

Looks good and compiles fine.

Acked-by Steffan Karger <[email protected]...>

-Steffan

#2 lore raw

Hi,

Quoted 49 lines · Steffan Karger
Quoted 35 lines · On 20-01-18 05:47, [email protected]... wrote:

From: Selva Nair <[email protected]...>

- No change in functionality. This is used in a subsequent patch for extending TLS1.2 support with cryptoapicert

Signed-off-by Selva Nair <[email protected]...>
---
 src/openvpn/openssl_compat.h | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
src/openvpn/openssl_compat.h +16 -0
index 9f1e92a..c94341a 100644
@@ -670,6 +670,29 @@ SSL_CTX_get_min_proto_version(SSL_CTX *ctx)
 }
 #endif /* SSL_CTX_get_min_proto_version */
 
+#ifndef SSL_CTX_get_max_proto_version
+/** Return the max SSL protocol version currently enabled in the context.
+ *  If no valid version >= TLS1.0 is found, return 0. */
+static inline int
+SSL_CTX_get_max_proto_version(SSL_CTX *ctx)
+{
+    long sslopt = SSL_CTX_get_options(ctx);
+    if (!(sslopt & SSL_OP_NO_TLSv1_2))
+    {
+	return TLS1_2_VERSION;
+    }
+    if (!(sslopt & SSL_OP_NO_TLSv1_1))
+    {
+	return TLS1_1_VERSION;
+    }
+    if (!(sslopt & SSL_OP_NO_TLSv1))

src/openvpn/openssl_compat.h SSL_CTX_get_min_proto_version(SSL_CTX *ctx) · line 698

Quoted 10 lines
src/openvpn/openssl_compat.h +7 -0
+    {
+	return TLS1_VERSION;
+    }
+    return 0;
+}
+#endif /* SSL_CTX_get_max_proto_version */
+
 #ifndef SSL_CTX_set_min_proto_version
 /** Mimics SSL_CTX_set_min_proto_version for OpenSSL < 1.1 */
 static inline int

Looks good and compiles fine.

Quoted 1 line
Acked-by Steffan Karger <[email protected]...>

Sorry, one more thing: the current patch is only okay for master, as 2.4 still supports openssl 0.9.8 and 1.0.0, which do not have the SSL_OP_NO_TLSv1_1 and SSL_OP_NO_TLSv1_2 defines (the TLSx_VERSION ones *are* available though). If you want this patch backported to release/2.4, it needs #ifdefs like get_min_proto_version has.

-Steffan

author
#3 lore raw

Hi,

Quoted 52 lines · Steffan Karger

Hi,

Quoted 49 lines · Steffan Karger
Quoted 35 lines · On 20-01-18 05:47, [email protected]... wrote:

From: Selva Nair <[email protected]...>

- No change in functionality. This is used in a subsequent patch for extending TLS1.2 support with cryptoapicert

Signed-off-by Selva Nair <[email protected]...>
---
 src/openvpn/openssl_compat.h | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
src/openvpn/openssl_compat.h +16 -0
index 9f1e92a..c94341a 100644
@@ -670,6 +670,29 @@ SSL_CTX_get_min_proto_version(SSL_CTX *ctx)
 }
 #endif /* SSL_CTX_get_min_proto_version */
 
+#ifndef SSL_CTX_get_max_proto_version
+/** Return the max SSL protocol version currently enabled in the context.
+ *  If no valid version >= TLS1.0 is found, return 0. */
+static inline int
+SSL_CTX_get_max_proto_version(SSL_CTX *ctx)
+{
+    long sslopt = SSL_CTX_get_options(ctx);
+    if (!(sslopt & SSL_OP_NO_TLSv1_2))
+    {
+    return TLS1_2_VERSION;
+    }
+    if (!(sslopt & SSL_OP_NO_TLSv1_1))
+    {
+    return TLS1_1_VERSION;
+    }
+    if (!(sslopt & SSL_OP_NO_TLSv1))

src/openvpn/openssl_compat.h SSL_CTX_get_min_proto_version(SSL_CTX *ctx) · line 698

Quoted 10 lines
src/openvpn/openssl_compat.h +7 -0
+    {
+    return TLS1_VERSION;
+    }
+    return 0;
+}
+#endif /* SSL_CTX_get_max_proto_version */
+
 #ifndef SSL_CTX_set_min_proto_version
 /** Mimics SSL_CTX_set_min_proto_version for OpenSSL < 1.1 */
 static inline int

Looks good and compiles fine.

Quoted 7 lines
Quoted 1 line
Acked-by Steffan Karger <[email protected]...>

Sorry, one more thing: the current patch is only okay for master, as 2.4 still supports openssl 0.9.8 and 1.0.0, which do not have the SSL_OP_NO_TLSv1_1 and SSL_OP_NO_TLSv1_2 defines (the TLSx_VERSION ones *are* available though). If you want this patch backported to release/2.4, it needs #ifdefs like get_min_proto_version has.

Yeah, I meant it to go into master only (hence no ifdefs). Is it good to have it in 2.4 too?
If so I will send a back-ported patch.

Selva

#4 lore raw
In reply to [email protected]...

Your patch has been applied to the master branch.

commit 9e272106029a41b2110c10334ba8cae0f4afb1b4

Author: Selva Nair
Date:   Fri Jan 19 23:47:27 2018 -0500
     Add SSL_CTX_get_max_proto_version() not in openssl 1.0

     Signed-off-by: Selva Nair <[email protected]...>
     Acked-by: Steffan Karger <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/[email protected]/msg16287.html
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering

author
#5 lore raw

Hi,

If/when the TLS1.2+ support for cryptoapicert is ready for merge, is it a candidate for 2.4? Technically its a new feature but considering the "popular belief" that TLS1.1 needs to be shunned, and 2.5 is still far away, its worth considering..

In that case this patch would need to be backported to 2.4, so good to know what's the general consensus.

Thanks,

Selva

#6 lore raw

Hi

Quoted 7 lines · Selva Nair

If/when the TLS1.2+ support for cryptoapicert is ready for merge, is it a candidate for 2.4? Technically its a new feature but considering the "popular belief" that TLS1.1 needs to be shunned, and 2.5 is still far away, its worth considering..

In that case this patch would need to be backported to 2.4, so good to know what's the general consensus.

I would argue that TLS 1.2 is officially supported by 2.4, and as such it's a bug if cryptoapicert doesn't :-)

Given that the changes are fairly well localized and will not affect other platforms, and are likely to not affect users that do not use cryptoapicert, I would tend to "make sure that all we offer works with TLS 1.2" -> include in 2.4

But I let Steffan or David overrule me here if they find the patch too intrusive.

gert

Signature · 3 lines
now what should I write here...

Gert Doering - Munich, Germany                             [email protected]...
#7 lore raw

Hi,

Quoted 9 lines · Gert Doering
Quoted 7 lines · Selva Nair

If/when the TLS1.2+ support for cryptoapicert is ready for merge, is it a candidate for 2.4? Technically its a new feature but considering the "popular belief" that TLS1.1 needs to be shunned, and 2.5 is still far away, its worth considering..

In that case this patch would need to be backported to 2.4, so good to know what's the general consensus.

Quoted 7 lines

I would argue that TLS 1.2 is officially supported by 2.4, and as such it's a bug if cryptoapicert doesn't :-)

Given that the changes are fairly well localized and will not affect other platforms, and are likely to not affect users that do not use cryptoapicert, I would tend to "make sure that all we offer works with TLS 1.2" -> include in 2.4

Completely agree. I would like to see this backported to 2.4.

-Steffan