Use minimum and maximum protocol version instead of version fixed methods
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MR: #1824
diff --git a/apps/ciphers.c b/apps/ciphers.c
index 3e1ed95..924c015 100644
--- a/apps/ciphers.c
+++ b/apps/ciphers.c
@@ -126,6 +126,7 @@
char *ciphers = NULL, *prog;
char buf[512];
OPTION_CHOICE o;
+ int min_version = 0, max_version = 0;
prog = opt_init(argc, argv, ciphers_options);
while ((o = opt_next()) != OPT_EOF) {
@@ -154,24 +155,20 @@
#endif
break;
case OPT_SSL3:
-#ifndef OPENSSL_NO_SSL3
- meth = SSLv3_client_method();
-#endif
+ min_version = SSL3_VERSION;
+ max_version = SSL3_VERSION;
break;
case OPT_TLS1:
-#ifndef OPENSSL_NO_TLS1
- meth = TLSv1_client_method();
-#endif
+ min_version = TLS1_VERSION;
+ max_version = TLS1_VERSION;
break;
case OPT_TLS1_1:
-#ifndef OPENSSL_NO_TLS1_1
- meth = TLSv1_1_client_method();
-#endif
+ min_version = TLS1_1_VERSION;
+ max_version = TLS1_1_VERSION;
break;
case OPT_TLS1_2:
-#ifndef OPENSSL_NO_TLS1_2
- meth = TLSv1_2_client_method();
-#endif
+ min_version = TLS1_2_VERSION;
+ max_version = TLS1_2_VERSION;
break;
case OPT_PSK:
#ifndef OPENSSL_NO_PSK
@@ -191,6 +188,11 @@
ctx = SSL_CTX_new(meth);
if (ctx == NULL)
goto err;
+ if (SSL_CTX_set_min_proto_version(ctx, min_version) == 0)
+ goto err;
+ if (SSL_CTX_set_max_proto_version(ctx, max_version) == 0)
+ goto err;
+
#ifndef OPENSSL_NO_PSK
if (psk)
SSL_CTX_set_psk_client_callback(ctx, dummy_psk);
diff --git a/apps/s_client.c b/apps/s_client.c
index c338b0c..38d7c32 100644
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -928,6 +928,7 @@
char *ctlog_file = NULL;
ct_validation_cb ct_validation = NULL;
#endif
+ int min_version = 0, max_version = 0;
FD_ZERO(&readfds);
FD_ZERO(&writefds);
@@ -1199,25 +1200,30 @@
#ifndef OPENSSL_NO_SRP
case OPT_SRPUSER:
srp_arg.srplogin = opt_arg();
- meth = TLSv1_client_method();
+ if (min_version < TLS1_VERSION)
+ min_version = TLS1_VERSION;
break;
case OPT_SRPPASS:
srppass = opt_arg();
- meth = TLSv1_client_method();
+ if (min_version < TLS1_VERSION)
+ min_version = TLS1_VERSION;
break;
case OPT_SRP_STRENGTH:
srp_arg.strength = atoi(opt_arg());
BIO_printf(bio_err, "SRP minimal length for N is %d\n",
srp_arg.strength);
- meth = TLSv1_client_method();
+ if (min_version < TLS1_VERSION)
+ min_version = TLS1_VERSION;
break;
case OPT_SRP_LATEUSER:
srp_lateuser = 1;
- meth = TLSv1_client_method();
+ if (min_version < TLS1_VERSION)
+ min_version = TLS1_VERSION;
break;
case OPT_SRP_MOREGROUPS:
srp_arg.amp = 1;
- meth = TLSv1_client_method();
+ if (min_version < TLS1_VERSION)
+ min_version = TLS1_VERSION;
break;
#else
case OPT_SRPUSER:
@@ -1231,24 +1237,20 @@
ssl_config = opt_arg();
break;
case OPT_SSL3:
-#ifndef OPENSSL_NO_SSL3
- meth = SSLv3_client_method();
-#endif
+ min_version = SSL3_VERSION;
+ max_version = SSL3_VERSION;
break;
case OPT_TLS1_2:
-#ifndef OPENSSL_NO_TLS1_2
- meth = TLSv1_2_client_method();
-#endif
+ min_version = TLS1_2_VERSION;
+ max_version = TLS1_2_VERSION;
break;
case OPT_TLS1_1:
-#ifndef OPENSSL_NO_TLS1_1
- meth = TLSv1_1_client_method();
-#endif
+ min_version = TLS1_1_VERSION;
+ max_version = TLS1_1_VERSION;
break;
case OPT_TLS1:
-#ifndef OPENSSL_NO_TLS1
- meth = TLSv1_client_method();
-#endif
+ min_version = TLS1_VERSION;
+ max_version = TLS1_VERSION;
break;
case OPT_DTLS:
#ifndef OPENSSL_NO_DTLS
@@ -1258,13 +1260,17 @@
break;
case OPT_DTLS1:
#ifndef OPENSSL_NO_DTLS1
- meth = DTLSv1_client_method();
+ meth = DTLS_client_method();
+ min_version = DTLS1_VERSION;
+ max_version = DTLS1_VERSION;
socket_type = SOCK_DGRAM;
#endif
break;
case OPT_DTLS1_2:
#ifndef OPENSSL_NO_DTLS1_2
- meth = DTLSv1_2_client_method();
+ meth = DTLS_client_method();
+ min_version = DTLS1_2_VERSION;
+ max_version = DTLS1_2_VERSION;
socket_type = SOCK_DGRAM;
#endif
break;
@@ -1566,6 +1572,11 @@
}
}
+ if (SSL_CTX_set_min_proto_version(ctx, min_version) == 0)
+ goto end;
+ if (SSL_CTX_set_max_proto_version(ctx, max_version) == 0)
+ goto end;
+
if (vpmtouched && !SSL_CTX_set1_param(ctx, vpm)) {
BIO_printf(bio_err, "Error setting verify params\n");
ERR_print_errors(bio_err);
diff --git a/apps/s_server.c b/apps/s_server.c
index af85dd7..e77f2f4 100644
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -1066,6 +1066,7 @@
char *srpuserseed = NULL;
char *srp_verifier_file = NULL;
#endif
+ int min_version = 0, max_version = 0;
local_argc = argc;
local_argv = argv;
@@ -1389,13 +1390,15 @@
case OPT_SRPVFILE:
#ifndef OPENSSL_NO_SRP
srp_verifier_file = opt_arg();
- meth = TLSv1_server_method();
+ if (min_version < TLS1_VERSION)
+ min_version = TLS1_VERSION;
#endif
break;
case OPT_SRPUSERSEED:
#ifndef OPENSSL_NO_SRP
srpuserseed = opt_arg();
- meth = TLSv1_server_method();
+ if (min_version < TLS1_VERSION)
+ min_version = TLS1_VERSION;
#endif
break;
case OPT_REV:
@@ -1414,24 +1417,20 @@
ssl_config = opt_arg();
break;
case OPT_SSL3:
-#ifndef OPENSSL_NO_SSL3
- meth = SSLv3_server_method();
-#endif
+ min_version = SSL3_VERSION;
+ max_version = SSL3_VERSION;
break;
case OPT_TLS1_2:
-#ifndef OPENSSL_NO_TLS1_2
- meth = TLSv1_2_server_method();
-#endif
+ min_version = TLS1_2_VERSION;
+ max_version = TLS1_2_VERSION;
break;
case OPT_TLS1_1:
-#ifndef OPENSSL_NO_TLS1_1
- meth = TLSv1_1_server_method();
-#endif
+ min_version = TLS1_1_VERSION;
+ max_version = TLS1_1_VERSION;
break;
case OPT_TLS1:
-#ifndef OPENSSL_NO_TLS1
- meth = TLSv1_server_method();
-#endif
+ min_version = TLS1_VERSION;
+ max_version = TLS1_VERSION;
break;
case OPT_DTLS:
#ifndef OPENSSL_NO_DTLS
@@ -1440,14 +1439,18 @@
#endif
break;
case OPT_DTLS1:
-#ifndef OPENSSL_NO_DTLS1
- meth = DTLSv1_server_method();
+#ifndef OPENSSL_NO_DTLS
+ meth = DTLS_server_method();
+ min_version = DTLS1_VERSION;
+ max_version = DTLS1_VERSION;
socket_type = SOCK_DGRAM;
#endif
break;
case OPT_DTLS1_2:
-#ifndef OPENSSL_NO_DTLS1_2
- meth = DTLSv1_2_server_method();
+#ifndef OPENSSL_NO_DTLS
+ meth = DTLS_server_method();
+ min_version = DTLS1_2_VERSION;
+ max_version = DTLS1_2_VERSION;
socket_type = SOCK_DGRAM;
#endif
break;
@@ -1728,6 +1731,10 @@
goto end;
}
}
+ if (SSL_CTX_set_min_proto_version(ctx, min_version) == 0)
+ goto end;
+ if (SSL_CTX_set_max_proto_version(ctx, max_version) == 0)
+ goto end;
if (session_id_prefix) {
if (strlen(session_id_prefix) >= 32)
diff --git a/apps/s_time.c b/apps/s_time.c
index cc9a979..f68002a 100644
--- a/apps/s_time.c
+++ b/apps/s_time.c
@@ -132,7 +132,7 @@
{"bugs", OPT_BUGS, '-', "Turn on SSL bug compatibility"},
{"verify", OPT_VERIFY, 'p',
"Turn on peer certificate verification, set depth"},
- {"time", OPT_TIME, 'p', "Sf seconds to collect data, default" SECONDSSTR},
+ {"time", OPT_TIME, 'p', "Seconds to collect data, default " SECONDSSTR},
{"www", OPT_WWW, 's', "Fetch specified page from the site"},
#ifndef OPENSSL_NO_SSL3
{"ssl3", OPT_SSL3, '-', "Just use SSLv3"},
@@ -162,6 +162,7 @@
0, ver;
long bytes_read = 0, finishtime = 0;
OPTION_CHOICE o;
+ int max_version = 0;
meth = TLS_client_method();
verify_depth = 0;
@@ -230,9 +231,7 @@
}
break;
case OPT_SSL3:
-#ifndef OPENSSL_NO_SSL3
- meth = SSLv3_client_method();
-#endif
+ max_version = SSL3_VERSION;
break;
}
}
@@ -251,6 +250,8 @@
goto end;
SSL_CTX_set_quiet_shutdown(ctx, 1);
+ if (SSL_CTX_set_max_proto_version(ctx, max_version) == 0)
+ goto end;
if (st_bugs)
SSL_CTX_set_options(ctx, SSL_OP_ALL);
