From f3fd673337f4c7d147e7a3a3530de96729775d68 Mon Sep 17 00:00:00 2001 From: Selva Nair Date: Sat, 20 Jan 2018 12:11:34 -0500 Subject: [PATCH] Add SSL_CTX_get_max_proto_version() not in openssl 1.0 - No change in functionality. This is used in a subsequent patch for extending TLS1.2 support with cryptoapicert Signed-off-by: Selva Nair Acked-by: Gert Doering Message-Id: <1516468294-32635-1-git-send-email-selva.nair@gmail.com> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg16304.html Signed-off-by: Gert Doering (cherry-picked with 2.4/0.9.8 amendments from commit 9e272106029a41b2110c10334ba8cae0f4afb1b4) --- src/openvpn/openssl_compat.h | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/src/openvpn/openssl_compat.h b/src/openvpn/openssl_compat.h index 9f1e92a18..4b338d2d6 100644 --- a/src/openvpn/openssl_compat.h +++ b/src/openvpn/openssl_compat.h @@ -670,6 +670,33 @@ SSL_CTX_get_min_proto_version(SSL_CTX *ctx) } #endif /* SSL_CTX_get_min_proto_version */ +#ifndef SSL_CTX_get_max_proto_version +/** Return the max SSL protocol version currently enabled in the context. + * If no valid version >= TLS1.0 is found, return 0. */ +static inline int +SSL_CTX_get_max_proto_version(SSL_CTX *ctx) +{ + long sslopt = SSL_CTX_get_options(ctx); +#ifdef SSL_OP_NO_TLSv1_2 + if (!(sslopt & SSL_OP_NO_TLSv1_2)) + { + return TLS1_2_VERSION; + } +#endif +#ifdef SSL_OP_NO_TLSv1_1 + if (!(sslopt & SSL_OP_NO_TLSv1_1)) + { + return TLS1_1_VERSION; + } +#endif + if (!(sslopt & SSL_OP_NO_TLSv1)) + { + return TLS1_VERSION; + } + return 0; +} +#endif /* SSL_CTX_get_max_proto_version */ + #ifndef SSL_CTX_set_min_proto_version /** Mimics SSL_CTX_set_min_proto_version for OpenSSL < 1.1 */ static inline int -- 2.47.2