]> git.ipfire.org Git - thirdparty/haproxy.git/commit
MEDIUM: ssl: ssl_methods implementation is reworked and factored for min/max tlsxx
authorEmmanuel Hocdet <manu@gandi.net>
Thu, 30 Mar 2017 17:19:37 +0000 (19:19 +0200)
committerWilly Tarreau <w@1wt.eu>
Fri, 12 May 2017 13:49:04 +0000 (15:49 +0200)
commit5db33cbdc4f2952cbd3c140edce0eda84e1447b4
tree50643d03ca78f30b9655250efffc8fc67f14bae7
parent6cb2d1e9638f22f080d1391e6bb8260b6a0b1f95
MEDIUM: ssl: ssl_methods implementation is reworked and factored for min/max tlsxx

Plan is to add min-tlsxx max-tlsxx configuration, more consistent than no-tlsxx.
This patch introduce internal min/max and replace force-tlsxx implementation.
SSL method configuration is store in 'struct tls_version_filter'.
SSL method configuration to openssl setting is abstract in 'methodVersions' table.
With openssl < 1.1.0, SSL_CTX_set_ssl_version is used for force (min == max).
With openssl >= 1.1.0, SSL_CTX_set_min/max_proto_version is used.
include/types/listener.h
include/types/server.h
include/types/ssl_sock.h
src/ssl_sock.c