From: Timo Sirainen <tss@iki.fi>
Date: Wed, 10 Jul 2013 07:01:26 +0000 (+0300)
Subject: lib-ssl-iostreams: ssl_protocols setting supports now TLSv1.1 and TLSv1.2 values.
X-Git-Tag: 2.2.5~66
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cc293ffe7994a85b727fc39dd8cd708c5fdfe2a2;p=thirdparty%2Fdovecot%2Fcore.git

lib-ssl-iostreams: ssl_protocols setting supports now TLSv1.1 and TLSv1.2 values.
---

diff --git a/src/lib-ssl-iostream/iostream-openssl-common.c b/src/lib-ssl-iostream/iostream-openssl-common.c
index a58f8e6ad0..8e3677d039 100644
--- a/src/lib-ssl-iostream/iostream-openssl-common.c
+++ b/src/lib-ssl-iostream/iostream-openssl-common.c
@@ -6,10 +6,12 @@
 #include <openssl/x509v3.h>
 
 enum {
-	DOVECOT_SSL_PROTO_SSLv2	= 0x01,
-	DOVECOT_SSL_PROTO_SSLv3	= 0x02,
-	DOVECOT_SSL_PROTO_TLSv1	= 0x04,
-	DOVECOT_SSL_PROTO_ALL	= 0x07
+	DOVECOT_SSL_PROTO_SSLv2		= 0x01,
+	DOVECOT_SSL_PROTO_SSLv3		= 0x02,
+	DOVECOT_SSL_PROTO_TLSv1		= 0x04,
+	DOVECOT_SSL_PROTO_TLSv1_1	= 0x08,
+	DOVECOT_SSL_PROTO_TLSv1_2	= 0x10,
+	DOVECOT_SSL_PROTO_ALL		= 0x1f
 };
 
 int openssl_get_protocol_options(const char *protocols)
@@ -34,6 +36,14 @@ int openssl_get_protocol_options(const char *protocols)
 			proto = DOVECOT_SSL_PROTO_SSLv3;
 		else if (strcasecmp(name, SSL_TXT_TLSV1) == 0)
 			proto = DOVECOT_SSL_PROTO_TLSv1;
+#ifdef SSL_TXT_TLSV1_1
+		else if (strcasecmp(name, SSL_TXT_TLSV1_1) == 0)
+			proto = DOVECOT_SSL_PROTO_TLSv1_1;
+#endif
+#ifdef SSL_TXT_TLSV1_2
+		else if (strcasecmp(name, SSL_TXT_TLSV1_2) == 0)
+			proto = DOVECOT_SSL_PROTO_TLSv1_2;
+#endif
 		else {
 			i_fatal("Invalid ssl_protocols setting: "
 				"Unknown protocol '%s'", name);
@@ -51,6 +61,12 @@ int openssl_get_protocol_options(const char *protocols)
 	if ((exclude & DOVECOT_SSL_PROTO_SSLv2) != 0) op |= SSL_OP_NO_SSLv2;
 	if ((exclude & DOVECOT_SSL_PROTO_SSLv3) != 0) op |= SSL_OP_NO_SSLv3;
 	if ((exclude & DOVECOT_SSL_PROTO_TLSv1) != 0) op |= SSL_OP_NO_TLSv1;
+#ifdef SSL_OP_NO_TLSv1_1
+	if ((exclude & DOVECOT_SSL_PROTO_TLSv1_1) != 0) op |= SSL_OP_NO_TLSv1_1;
+#endif
+#ifdef SSL_OP_NO_TLSv1_2
+	if ((exclude & DOVECOT_SSL_PROTO_TLSv1_2) != 0) op |= SSL_OP_NO_TLSv1_2;
+#endif
 	return op;
 }