Support disabling any or all TLS or DTLS versions
Some users want to disable SSL 3.0/TLS 1.0/TLS 1.1, and enable just
TLS 1.2. In the future they might want to disable TLS 1.2 and
enable just TLS 1.3, ...
This commit makes it possible to disable any or all of the TLS or
DTLS protocols. It also considerably simplifies the SSL/TLS tests,
by auto-generating the min/max version tests based on the set of
supported protocols (425 explicitly written out tests got replaced
by two loops that generate all 425 tests if all protocols are
enabled, fewer otherwise).
Reviewed-by: Richard Levitte <levitte@openssl.org>
diff --git a/apps/s_client.c b/apps/s_client.c
index 6d6ad691..4dea7c4 100644
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -675,9 +675,6 @@
{"quiet", OPT_QUIET, '-', "No s_client output"},
{"ign_eof", OPT_IGN_EOF, '-', "Ignore input eof (default when -quiet)"},
{"no_ign_eof", OPT_NO_IGN_EOF, '-', "Don't ignore input eof"},
- {"tls1_2", OPT_TLS1_2, '-', "Just use TLSv1.2"},
- {"tls1_1", OPT_TLS1_1, '-', "Just use TLSv1.1"},
- {"tls1", OPT_TLS1, '-', "Just use TLSv1"},
{"starttls", OPT_STARTTLS, 's',
"Use the appropriate STARTTLS command before starting TLS"},
{"xmpphost", OPT_XMPPHOST, 's',
@@ -727,13 +724,26 @@
#ifndef OPENSSL_NO_SSL3
{"ssl3", OPT_SSL3, '-', "Just use SSLv3"},
#endif
+#ifndef OPENSSL_NO_TLS1
+ {"tls1", OPT_TLS1, '-', "Just use TLSv1"},
+#endif
+#ifndef OPENSSL_NO_TLS1_1
+ {"tls1_1", OPT_TLS1_1, '-', "Just use TLSv1.1"},
+#endif
+#ifndef OPENSSL_NO_TLS1_2
+ {"tls1_2", OPT_TLS1_2, '-', "Just use TLSv1.2"},
+#endif
#ifndef OPENSSL_NO_DTLS
{"dtls", OPT_DTLS, '-'},
- {"dtls1", OPT_DTLS1, '-', "Just use DTLSv1"},
- {"dtls1_2", OPT_DTLS1_2, '-'},
{"timeout", OPT_TIMEOUT, '-'},
{"mtu", OPT_MTU, 'p', "Set the link layer MTU"},
#endif
+#ifndef OPENSSL_NO_DTLS1
+ {"dtls1", OPT_DTLS1, '-', "Just use DTLSv1"},
+#endif
+#ifndef OPENSSL_NO_DTLS1_2
+ {"dtls1_2", OPT_DTLS1_2, '-'},
+#endif
#ifndef OPENSSL_NO_SSL_TRACE
{"trace", OPT_TRACE, '-'},
#endif
@@ -1108,41 +1118,48 @@
#endif
break;
case OPT_TLS1_2:
+#ifndef OPENSSL_NO_TLS1_2
meth = TLSv1_2_client_method();
+#endif
break;
case OPT_TLS1_1:
+#ifndef OPENSSL_NO_TLS1_1
meth = TLSv1_1_client_method();
+#endif
break;
case OPT_TLS1:
+#ifndef OPENSSL_NO_TLS1
meth = TLSv1_client_method();
+#endif
break;
-#ifndef OPENSSL_NO_DTLS
case OPT_DTLS:
+#ifndef OPENSSL_NO_DTLS
meth = DTLS_client_method();
socket_type = SOCK_DGRAM;
+#endif
break;
case OPT_DTLS1:
+#ifndef OPENSSL_NO_DTLS1
meth = DTLSv1_client_method();
socket_type = SOCK_DGRAM;
+#endif
break;
case OPT_DTLS1_2:
+#ifndef OPENSSL_NO_DTLS1_2
meth = DTLSv1_2_client_method();
socket_type = SOCK_DGRAM;
- break;
- case OPT_TIMEOUT:
- enable_timeouts = 1;
- break;
- case OPT_MTU:
- socket_mtu = atol(opt_arg());
- break;
-#else
- case OPT_DTLS:
- case OPT_DTLS1:
- case OPT_DTLS1_2:
- case OPT_TIMEOUT:
- case OPT_MTU:
- break;
#endif
+ break;
+ case OPT_TIMEOUT:
+#ifndef OPENSSL_NO_DTLS
+ enable_timeouts = 1;
+#endif
+ break;
+ case OPT_MTU:
+#ifndef OPENSSL_NO_DTLS
+ socket_mtu = atol(opt_arg());
+#endif
+ break;
case OPT_FALLBACKSCSV:
fallback_scsv = 1;
break;
