From: Lukas Tribus <lukas@ltri.eu>
Date: Tue, 5 Mar 2019 22:14:32 +0000 (+0100)
Subject: BUG/MINOR: ssl: fix warning about ssl-min/max-ver support
X-Git-Tag: v2.0-dev2~121
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1aabc939780d5eab1f88089d01fb077ad9315c65;p=thirdparty%2Fhaproxy.git

BUG/MINOR: ssl: fix warning about ssl-min/max-ver support

In 84e417d8 ("MINOR: ssl: support Openssl 1.1.1 early callback for
switchctx") the code was extended to also support OpenSSL 1.1.1
(code already supported BoringSSL). A configuration check warning
was updated but with the wrong logic, the #ifdef needs a && instead
of an ||.

Reported in #54.

Should be backported to 1.8.
---

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 99d2a11fae..7cfda2b575 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -7654,7 +7654,7 @@ static int parse_tls_method_minmax(char **args, int cur_arg, struct tls_version_
 
 static int ssl_bind_parse_tls_method_minmax(char **args, int cur_arg, struct proxy *px, struct ssl_bind_conf *conf, char **err)
 {
-#if (OPENSSL_VERSION_NUMBER < 0x10101000L) || !defined(OPENSSL_IS_BORINGSSL)
+#if (OPENSSL_VERSION_NUMBER < 0x10101000L) && !defined(OPENSSL_IS_BORINGSSL)
 	ha_warning("crt-list: ssl-min-ver and ssl-max-ver are not supported with this Openssl version (skipped).\n");
 #endif
 	return parse_tls_method_minmax(args, cur_arg, &conf->ssl_methods, err);