BUILD: ssl: Allow building against libssl without SSLv3.

If SSLv3 is explicitely requested but not available, warn the user and
bail out.

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 7f1a07018b28b8c8f172adcfe733d2f43be6275d..2b91eedbe88ff8070fe3bf480a76b587632a1331 100644 (file)
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -1937,8 +1937,14 @@ int ssl_sock_prepare_ctx(struct bind_conf *bind_conf, SSL_CTX *ctx, struct proxy
                ssloptions |= SSL_OP_NO_TLSv1_2;
        if (bind_conf->ssl_options & BC_SSL_O_NO_TLS_TICKETS)
                ssloptions |= SSL_OP_NO_TICKET;
-       if (bind_conf->ssl_options & BC_SSL_O_USE_SSLV3)
+       if (bind_conf->ssl_options & BC_SSL_O_USE_SSLV3) {
+#ifndef OPENSSL_NO_SSL3
                SSL_CTX_set_ssl_version(ctx, SSLv3_server_method());
+#else
+               Alert("SSLv3 support requested but unavailable.\n");
+               cfgerr++;
+#endif
+       }
        if (bind_conf->ssl_options & BC_SSL_O_USE_TLSV10)
                SSL_CTX_set_ssl_version(ctx, TLSv1_server_method());
 #if SSL_OP_NO_TLSv1_1
@@ -2305,8 +2311,14 @@ int ssl_sock_prepare_srv_ctx(struct server *srv, struct proxy *curproxy)
                options |= SSL_OP_NO_TLSv1_2;
        if (srv->ssl_ctx.options & SRV_SSL_O_NO_TLS_TICKETS)
                options |= SSL_OP_NO_TICKET;
-       if (srv->ssl_ctx.options & SRV_SSL_O_USE_SSLV3)
+       if (srv->ssl_ctx.options & SRV_SSL_O_USE_SSLV3) {
+#ifndef OPENSSL_NO_SSL3
                SSL_CTX_set_ssl_version(srv->ssl_ctx.ctx, SSLv3_client_method());
+#else
+               Alert("SSLv3 support requested but unavailable.");
+               cfgerr++;
+#endif
+       }
        if (srv->ssl_ctx.options & SRV_SSL_O_USE_TLSV10)
                SSL_CTX_set_ssl_version(srv->ssl_ctx.ctx, TLSv1_client_method());
 #if SSL_OP_NO_TLSv1_1