Skip to contentSkip to conversation

Add SSL_CTX_get_max_proto_version() not in openssl 1.0

PATCH In review [email protected]... 2 participants 2 messages Jan 20, 2018 – Jan 25, 2018 1 message not in the archive

lore
Share & tools
lore

[email protected]...

author
#1 lore raw

PATCH 1/1 Add SSL_CTX_get_max_proto_version() not in openssl 1.0

In reply to a message not in the archive

From: Selva Nair <[email protected]...>

- No change in functionality. This is used in a subsequent patch for extending TLS1.2 support with cryptoapicert

Signed-off-by Selva Nair <[email protected]...>

---
This is for 2.4
Same as the patch merged into master except for the ifdefs needed for 0.9.8

 src/openvpn/openssl_compat.h | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
src/openvpn/openssl_compat.h +27 -0
index 9f1e92a..4b338d2 100644
@@ -670,6 +670,33 @@ SSL_CTX_get_min_proto_version(SSL_CTX *ctx)
 }
 #endif /* SSL_CTX_get_min_proto_version */
 
+#ifndef SSL_CTX_get_max_proto_version
+/** Return the max SSL protocol version currently enabled in the context.
+ *  If no valid version >= TLS1.0 is found, return 0. */
+static inline int
+SSL_CTX_get_max_proto_version(SSL_CTX *ctx)
+{
+    long sslopt = SSL_CTX_get_options(ctx);
+#ifdef SSL_OP_NO_TLSv1_2
+    if (!(sslopt & SSL_OP_NO_TLSv1_2))
+    {
+	return TLS1_2_VERSION;
+    }
+#endif
+#ifdef SSL_OP_NO_TLSv1_1
+    if (!(sslopt & SSL_OP_NO_TLSv1_1))
+    {
+	return TLS1_1_VERSION;
+    }
+#endif
+    if (!(sslopt & SSL_OP_NO_TLSv1))
+    {
+	return TLS1_VERSION;
+    }
+    return 0;
+}
+#endif /* SSL_CTX_get_max_proto_version */
+
 #ifndef SSL_CTX_set_min_proto_version
 /** Mimics SSL_CTX_set_min_proto_version for OpenSSL < 1.1 */
 static inline int
Signature · 1 line
2.1.4
#2 lore raw

ACK. Same code as in master (+ifdef), compile-tested with 1.0.1 and 0.9.8

Your patch has been applied to the release/2.4 branch.

commit 51ab66a52b9b12402495274bc7070d0b9a2ebde6

Author: Selva Nair
Date:   Sat Jan 20 12:11:34 2018 -0500
     Add SSL_CTX_get_max_proto_version() not in openssl 1.0

     Signed-off-by: Selva Nair <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/[email protected]/msg16304.html
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering