lib-ssl-iostream: Use SSL_CTX_set_min_proto_version if available

diff --git a/src/lib-ssl-iostream/iostream-openssl-context.c b/src/lib-ssl-iostream/iostream-openssl-context.c
index a19aec2ea76d340147d3bbc69e2e0089f1c4f1ea..1503979b68e3481774d2af957dffabecb795cb53 100644 (file)
--- a/src/lib-ssl-iostream/iostream-openssl-context.c
+++ b/src/lib-ssl-iostream/iostream-openssl-context.c
@@ -384,14 +384,19 @@ ssl_iostream_context_set(struct ssl_iostream_context *ctx,
        }
        if (ctx->set.min_protocol != NULL) {
                long opts;
+               int min_protocol;
                if (openssl_min_protocol_to_options(ctx->set.min_protocol,
-                                                   &opts, NULL) < 0) {
+                                                   &opts, &min_protocol) < 0) {
                        *error_r = t_strdup_printf(
                                        "Unknown ssl_min_protocol setting '%s'",
                                        set->min_protocol);
                        return -1;
                }
+#ifdef HAVE_SSL_CTX_SET_MIN_PROTO_VERSION
+               SSL_CTX_set_min_proto_version(ctx->ssl_ctx, min_protocol);
+#else
                SSL_CTX_set_options(ctx->ssl_ctx, opts);
+#endif
        }
 
        if (set->cert.cert != NULL &&

diff --git a/src/lib-ssl-iostream/iostream-openssl.c b/src/lib-ssl-iostream/iostream-openssl.c
index da235fa03a3a4df4c63186e9577f43590f4ea028..81b006b688106784d752948651dee3dca8d42f03 100644 (file)
--- a/src/lib-ssl-iostream/iostream-openssl.c
+++ b/src/lib-ssl-iostream/iostream-openssl.c
@@ -178,14 +178,19 @@ openssl_iostream_set(struct ssl_iostream *ssl_io,
                SSL_clear_options(ssl_io->ssl, OPENSSL_ALL_PROTOCOL_OPTIONS);
 #endif
                long opts;
+               int min_protocol;
                if (openssl_min_protocol_to_options(set->min_protocol, &opts,
-                                                   NULL) < 0) {
+                                                   &min_protocol) < 0) {
                        *error_r = t_strdup_printf(
                                        "Unknown ssl_min_protocol setting '%s'",
                                        set->min_protocol);
                        return -1;
                }
+#ifdef HAVE_SSL_CTX_SET_MIN_PROTO_VERSION
+               SSL_set_min_proto_version(ssl_io->ssl, min_protocol);
+#else
                SSL_set_options(ssl_io->ssl, opts);
+#endif
        }
 
        if (set->cert.cert != NULL && strcmp(ctx_set->cert.cert, set->cert.cert) != 0) {