From: Martti Rannanjärvi <martti.rannanjarvi@dovecot.fi>
Date: Wed, 29 Nov 2017 13:46:34 +0000 (+0200)
Subject: lib-ssl-iostream: Use SSL_CTX_set_min_proto_version if available
X-Git-Tag: 2.3.0.rc1~169
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=804bca734d3bdf930f1678ee24885965a6aa756c;p=thirdparty%2Fdovecot%2Fcore.git

lib-ssl-iostream: Use SSL_CTX_set_min_proto_version if available
---

diff --git a/src/lib-ssl-iostream/iostream-openssl-context.c b/src/lib-ssl-iostream/iostream-openssl-context.c
index a19aec2ea7..1503979b68 100644
--- a/src/lib-ssl-iostream/iostream-openssl-context.c
+++ b/src/lib-ssl-iostream/iostream-openssl-context.c
@@ -384,14 +384,19 @@ ssl_iostream_context_set(struct ssl_iostream_context *ctx,
 	}
 	if (ctx->set.min_protocol != NULL) {
 		long opts;
+		int min_protocol;
 		if (openssl_min_protocol_to_options(ctx->set.min_protocol,
-						    &opts, NULL) < 0) {
+						    &opts, &min_protocol) < 0) {
 			*error_r = t_strdup_printf(
 					"Unknown ssl_min_protocol setting '%s'",
 					set->min_protocol);
 			return -1;
 		}
+#ifdef HAVE_SSL_CTX_SET_MIN_PROTO_VERSION
+		SSL_CTX_set_min_proto_version(ctx->ssl_ctx, min_protocol);
+#else
 		SSL_CTX_set_options(ctx->ssl_ctx, opts);
+#endif
 	}
 
 	if (set->cert.cert != NULL &&
diff --git a/src/lib-ssl-iostream/iostream-openssl.c b/src/lib-ssl-iostream/iostream-openssl.c
index da235fa03a..81b006b688 100644
--- a/src/lib-ssl-iostream/iostream-openssl.c
+++ b/src/lib-ssl-iostream/iostream-openssl.c
@@ -178,14 +178,19 @@ openssl_iostream_set(struct ssl_iostream *ssl_io,
 		SSL_clear_options(ssl_io->ssl, OPENSSL_ALL_PROTOCOL_OPTIONS);
 #endif
 		long opts;
+		int min_protocol;
 		if (openssl_min_protocol_to_options(set->min_protocol, &opts,
-						    NULL) < 0) {
+						    &min_protocol) < 0) {
 			*error_r = t_strdup_printf(
 					"Unknown ssl_min_protocol setting '%s'",
 					set->min_protocol);
 			return -1;
 		}
+#ifdef HAVE_SSL_CTX_SET_MIN_PROTO_VERSION
+		SSL_set_min_proto_version(ssl_io->ssl, min_protocol);
+#else
 		SSL_set_options(ssl_io->ssl, opts);
+#endif
 	}
 
 	if (set->cert.cert != NULL && strcmp(ctx_set->cert.cert, set->cert.cert) != 0) {