diff options
author | Kurt Roeckx <kurt@roeckx.be> | 2016-02-02 23:58:49 +0100 |
---|---|---|
committer | Kurt Roeckx <kurt@roeckx.be> | 2016-03-09 19:38:56 +0100 |
commit | 0d5301aff900970b09d2fe0c70d1038157d7638b (patch) | |
tree | eccb37f83a5388dee8ec57cbb90eb3b404ea3be0 /apps | |
parent | 1fc7d6664a3d118f9d5de217c9ffd154ed9ddb6f (diff) |
Use minimum and maximum protocol version instead of version fixed methods
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
MR: #1824
Diffstat (limited to 'apps')
-rw-r--r-- | apps/ciphers.c | 26 | ||||
-rw-r--r-- | apps/s_client.c | 49 | ||||
-rw-r--r-- | apps/s_server.c | 43 | ||||
-rw-r--r-- | apps/s_time.c | 9 |
4 files changed, 74 insertions, 53 deletions
diff --git a/apps/ciphers.c b/apps/ciphers.c index 3e1ed951a2..924c0153b3 100644 --- a/apps/ciphers.c +++ b/apps/ciphers.c @@ -126,6 +126,7 @@ int ciphers_main(int argc, char **argv) char *ciphers = NULL, *prog; char buf[512]; OPTION_CHOICE o; + int min_version = 0, max_version = 0; prog = opt_init(argc, argv, ciphers_options); while ((o = opt_next()) != OPT_EOF) { @@ -154,24 +155,20 @@ int ciphers_main(int argc, char **argv) #endif break; case OPT_SSL3: -#ifndef OPENSSL_NO_SSL3 - meth = SSLv3_client_method(); -#endif + min_version = SSL3_VERSION; + max_version = SSL3_VERSION; break; case OPT_TLS1: -#ifndef OPENSSL_NO_TLS1 - meth = TLSv1_client_method(); -#endif + min_version = TLS1_VERSION; + max_version = TLS1_VERSION; break; case OPT_TLS1_1: -#ifndef OPENSSL_NO_TLS1_1 - meth = TLSv1_1_client_method(); -#endif + min_version = TLS1_1_VERSION; + max_version = TLS1_1_VERSION; break; case OPT_TLS1_2: -#ifndef OPENSSL_NO_TLS1_2 - meth = TLSv1_2_client_method(); -#endif + min_version = TLS1_2_VERSION; + max_version = TLS1_2_VERSION; break; case OPT_PSK: #ifndef OPENSSL_NO_PSK @@ -191,6 +188,11 @@ int ciphers_main(int argc, char **argv) ctx = SSL_CTX_new(meth); if (ctx == NULL) goto err; + if (SSL_CTX_set_min_proto_version(ctx, min_version) == 0) + goto err; + if (SSL_CTX_set_max_proto_version(ctx, max_version) == 0) + goto err; + #ifndef OPENSSL_NO_PSK if (psk) SSL_CTX_set_psk_client_callback(ctx, dummy_psk); diff --git a/apps/s_client.c b/apps/s_client.c index c338b0c525..38d7c32a02 100644 --- a/apps/s_client.c +++ b/apps/s_client.c @@ -928,6 +928,7 @@ int s_client_main(int argc, char **argv) char *ctlog_file = NULL; ct_validation_cb ct_validation = NULL; #endif + int min_version = 0, max_version = 0; FD_ZERO(&readfds); FD_ZERO(&writefds); @@ -1199,25 +1200,30 @@ int s_client_main(int argc, char **argv) #ifndef OPENSSL_NO_SRP case OPT_SRPUSER: srp_arg.srplogin = opt_arg(); - meth = TLSv1_client_method(); + if (min_version < TLS1_VERSION) + min_version = TLS1_VERSION; break; case OPT_SRPPASS: srppass = opt_arg(); - meth = TLSv1_client_method(); + if (min_version < TLS1_VERSION) + min_version = TLS1_VERSION; break; case OPT_SRP_STRENGTH: srp_arg.strength = atoi(opt_arg()); BIO_printf(bio_err, "SRP minimal length for N is %d\n", srp_arg.strength); - meth = TLSv1_client_method(); + if (min_version < TLS1_VERSION) + min_version = TLS1_VERSION; break; case OPT_SRP_LATEUSER: srp_lateuser = 1; - meth = TLSv1_client_method(); + if (min_version < TLS1_VERSION) + min_version = TLS1_VERSION; break; case OPT_SRP_MOREGROUPS: srp_arg.amp = 1; - meth = TLSv1_client_method(); + if (min_version < TLS1_VERSION) + min_version = TLS1_VERSION; break; #else case OPT_SRPUSER: @@ -1231,24 +1237,20 @@ int s_client_main(int argc, char **argv) ssl_config = opt_arg(); break; case OPT_SSL3: -#ifndef OPENSSL_NO_SSL3 - meth = SSLv3_client_method(); -#endif + min_version = SSL3_VERSION; + max_version = SSL3_VERSION; break; case OPT_TLS1_2: -#ifndef OPENSSL_NO_TLS1_2 - meth = TLSv1_2_client_method(); -#endif + min_version = TLS1_2_VERSION; + max_version = TLS1_2_VERSION; break; case OPT_TLS1_1: -#ifndef OPENSSL_NO_TLS1_1 - meth = TLSv1_1_client_method(); -#endif + min_version = TLS1_1_VERSION; + max_version = TLS1_1_VERSION; break; case OPT_TLS1: -#ifndef OPENSSL_NO_TLS1 - meth = TLSv1_client_method(); -#endif + min_version = TLS1_VERSION; + max_version = TLS1_VERSION; break; case OPT_DTLS: #ifndef OPENSSL_NO_DTLS @@ -1258,13 +1260,17 @@ int s_client_main(int argc, char **argv) break; case OPT_DTLS1: #ifndef OPENSSL_NO_DTLS1 - meth = DTLSv1_client_method(); + meth = DTLS_client_method(); + min_version = DTLS1_VERSION; + max_version = DTLS1_VERSION; socket_type = SOCK_DGRAM; #endif break; case OPT_DTLS1_2: #ifndef OPENSSL_NO_DTLS1_2 - meth = DTLSv1_2_client_method(); + meth = DTLS_client_method(); + min_version = DTLS1_2_VERSION; + max_version = DTLS1_2_VERSION; socket_type = SOCK_DGRAM; #endif break; @@ -1566,6 +1572,11 @@ int s_client_main(int argc, char **argv) } } + if (SSL_CTX_set_min_proto_version(ctx, min_version) == 0) + goto end; + if (SSL_CTX_set_max_proto_version(ctx, max_version) == 0) + goto end; + if (vpmtouched && !SSL_CTX_set1_param(ctx, vpm)) { BIO_printf(bio_err, "Error setting verify params\n"); ERR_print_errors(bio_err); diff --git a/apps/s_server.c b/apps/s_server.c index af85dd7e83..e77f2f4fa7 100644 --- a/apps/s_server.c +++ b/apps/s_server.c @@ -1066,6 +1066,7 @@ int s_server_main(int argc, char *argv[]) char *srpuserseed = NULL; char *srp_verifier_file = NULL; #endif + int min_version = 0, max_version = 0; local_argc = argc; local_argv = argv; @@ -1389,13 +1390,15 @@ int s_server_main(int argc, char *argv[]) case OPT_SRPVFILE: #ifndef OPENSSL_NO_SRP srp_verifier_file = opt_arg(); - meth = TLSv1_server_method(); + if (min_version < TLS1_VERSION) + min_version = TLS1_VERSION; #endif break; case OPT_SRPUSERSEED: #ifndef OPENSSL_NO_SRP srpuserseed = opt_arg(); - meth = TLSv1_server_method(); + if (min_version < TLS1_VERSION) + min_version = TLS1_VERSION; #endif break; case OPT_REV: @@ -1414,24 +1417,20 @@ int s_server_main(int argc, char *argv[]) ssl_config = opt_arg(); break; case OPT_SSL3: -#ifndef OPENSSL_NO_SSL3 - meth = SSLv3_server_method(); -#endif + min_version = SSL3_VERSION; + max_version = SSL3_VERSION; break; case OPT_TLS1_2: -#ifndef OPENSSL_NO_TLS1_2 - meth = TLSv1_2_server_method(); -#endif + min_version = TLS1_2_VERSION; + max_version = TLS1_2_VERSION; break; case OPT_TLS1_1: -#ifndef OPENSSL_NO_TLS1_1 - meth = TLSv1_1_server_method(); -#endif + min_version = TLS1_1_VERSION; + max_version = TLS1_1_VERSION; break; case OPT_TLS1: -#ifndef OPENSSL_NO_TLS1 - meth = TLSv1_server_method(); -#endif + min_version = TLS1_VERSION; + max_version = TLS1_VERSION; break; case OPT_DTLS: #ifndef OPENSSL_NO_DTLS @@ -1440,14 +1439,18 @@ int s_server_main(int argc, char *argv[]) #endif break; case OPT_DTLS1: -#ifndef OPENSSL_NO_DTLS1 - meth = DTLSv1_server_method(); +#ifndef OPENSSL_NO_DTLS + meth = DTLS_server_method(); + min_version = DTLS1_VERSION; + max_version = DTLS1_VERSION; socket_type = SOCK_DGRAM; #endif break; case OPT_DTLS1_2: -#ifndef OPENSSL_NO_DTLS1_2 - meth = DTLSv1_2_server_method(); +#ifndef OPENSSL_NO_DTLS + meth = DTLS_server_method(); + min_version = DTLS1_2_VERSION; + max_version = DTLS1_2_VERSION; socket_type = SOCK_DGRAM; #endif break; @@ -1728,6 +1731,10 @@ int s_server_main(int argc, char *argv[]) goto end; } } + if (SSL_CTX_set_min_proto_version(ctx, min_version) == 0) + goto end; + if (SSL_CTX_set_max_proto_version(ctx, max_version) == 0) + goto end; if (session_id_prefix) { if (strlen(session_id_prefix) >= 32) diff --git a/apps/s_time.c b/apps/s_time.c index cc9a979755..f68002a224 100644 --- a/apps/s_time.c +++ b/apps/s_time.c @@ -132,7 +132,7 @@ OPTIONS s_time_options[] = { {"bugs", OPT_BUGS, '-', "Turn on SSL bug compatibility"}, {"verify", OPT_VERIFY, 'p', "Turn on peer certificate verification, set depth"}, - {"time", OPT_TIME, 'p', "Sf seconds to collect data, default" SECONDSSTR}, + {"time", OPT_TIME, 'p', "Seconds to collect data, default " SECONDSSTR}, {"www", OPT_WWW, 's', "Fetch specified page from the site"}, #ifndef OPENSSL_NO_SSL3 {"ssl3", OPT_SSL3, '-', "Just use SSLv3"}, @@ -162,6 +162,7 @@ int s_time_main(int argc, char **argv) 0, ver; long bytes_read = 0, finishtime = 0; OPTION_CHOICE o; + int max_version = 0; meth = TLS_client_method(); verify_depth = 0; @@ -230,9 +231,7 @@ int s_time_main(int argc, char **argv) } break; case OPT_SSL3: -#ifndef OPENSSL_NO_SSL3 - meth = SSLv3_client_method(); -#endif + max_version = SSL3_VERSION; break; } } @@ -251,6 +250,8 @@ int s_time_main(int argc, char **argv) goto end; SSL_CTX_set_quiet_shutdown(ctx, 1); + if (SSL_CTX_set_max_proto_version(ctx, max_version) == 0) + goto end; if (st_bugs) SSL_CTX_set_options(ctx, SSL_OP_ALL); |