Changeset 4968 for pjproject/trunk/pjlib/src/pj/ssl_sock_ossl.c

Timestamp:

Dec 18, 2014 4:40:35 AM (9 years ago)

Author:

riza

Message:

Re #1806: Implement SSL/TLS setting to set protocol operation.

File:

• pjproject/trunk/pjlib/src/pj/ssl_sock_ossl.c (modified) (4 diffs)

pjproject/trunk/pjlib/src/pj/ssl_sock_ossl.c

@@ -503 +503 @@
     EC_KEY *ecdh;
 #endif
-    SSL_METHOD *ssl_method;
+    SSL_METHOD *ssl_method = NULL;
     SSL_CTX *ctx;
+    pj_uint32_t ssl_opt = 0;
     pj_ssl_cert_t *cert;
     int mode, rc;
@@ -515 +516 @@
     /* Make sure OpenSSL library has been initialized */
     init_openssl();
+
+    if (ssock->param.proto == PJ_SSL_SOCK_PROTO_DEFAULT)
+        ssock->param.proto = PJ_SSL_SOCK_PROTO_SSL23;
 
     /* Determine SSL method to use */
@@ -529 +533 @@
         ssl_method = (SSL_METHOD*)SSLv3_method();
         break;
-    case PJ_SSL_SOCK_PROTO_DEFAULT:
-    case PJ_SSL_SOCK_PROTO_SSL23:
+    }
+
+    if (!ssl_method) {
         ssl_method = (SSL_METHOD*)SSLv23_method();
-        break;
-    //case PJ_SSL_SOCK_PROTO_DTLS1:
-        //ssl_method = (SSL_METHOD*)DTLSv1_method();
-        //break;
-    default:
-        return PJ_EINVAL;
+
+#ifdef SSL_OP_NO_SSLv2
+        /** Check if SSLv2 is enabled */
+        ssl_opt |= ((ssock->param.proto & PJ_SSL_SOCK_PROTO_SSL2)==0)?
+                    SSL_OP_NO_SSLv2:0;
+#endif
+
+#ifdef SSL_OP_NO_SSLv3
+        /** Check if SSLv3 is enabled */
+        ssl_opt |= ((ssock->param.proto & PJ_SSL_SOCK_PROTO_SSL3)==0)?
+                    SSL_OP_NO_SSLv3:0;
+#endif
+
+#ifdef SSL_OP_NO_TLSv1
+        /** Check if TLSv1 is enabled */
+        ssl_opt |= ((ssock->param.proto & PJ_SSL_SOCK_PROTO_TLS1)==0)?
+                    SSL_OP_NO_TLSv1:0;
+#endif
+
+#ifdef SSL_OP_NO_TLSv1_1
+        /** Check if TLSv1_1 is enabled */
+        ssl_opt |= ((ssock->param.proto & PJ_SSL_SOCK_PROTO_TLS1_1)==0)?
+                    SSL_OP_NO_TLSv1_1:0;
+#endif
+
+#ifdef SSL_OP_NO_TLSv1_2
+        /** Check if TLSv1_2 is enabled */
+        ssl_opt |= ((ssock->param.proto & PJ_SSL_SOCK_PROTO_TLS1_2)==0)?
+                    SSL_OP_NO_TLSv1_2:0;
+
+#endif
+
     }
 
@@ -545 +576 @@
         return GET_SSL_STATUS(ssock);
     }
+    if (ssl_opt)
+        SSL_CTX_set_options(ctx, ssl_opt);
 
     /* Apply credentials */