generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Support disabling any or all TLS or DTLS versions

Browse Source 
Some users want to disable SSL 3.0/TLS 1.0/TLS 1.1, and enable just
TLS 1.2.  In the future they might want to disable TLS 1.2 and
enable just TLS 1.3, ...

This commit makes it possible to disable any or all of the TLS or
DTLS protocols.  It also considerably simplifies the SSL/TLS tests,
by auto-generating the min/max version tests based on the set of
supported protocols (425 explicitly written out tests got replaced
by two loops that generate all 425 tests if all protocols are
enabled, fewer otherwise).

Reviewed-by: Richard Levitte <levitte@openssl.org>
This commit is contained in:
Viktor Dukhovni
2016-01-18 13:10:21 -05:00
parent 6ada465fb2
commit 6b01bed206
9 changed files with 459 additions and 601 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
apps/ciphers.c
View File

@@ -78,15 +78,21 @@ OPTIONS ciphers_options[] = {
{"v", OPT_V, '-', "Verbose listing of the SSL/TLS ciphers"},
{"V", OPT_UPPER_V, '-', "Even more verbose"},
{"s", OPT_S, '-', "Only supported ciphers"},
{"tls1", OPT_TLS1, '-', "TLS1 mode"},
{"tls1_1", OPT_TLS1_1, '-', "TLS1.1 mode"},
{"tls1_2", OPT_TLS1_2, '-', "TLS1.2 mode"},
#ifndef OPENSSL_NO_SSL_TRACE
{"stdname", OPT_STDNAME, '-', "Show standard cipher names"},
#endif
#ifndef OPENSSL_NO_SSL3
{"ssl3", OPT_SSL3, '-', "SSL3 mode"},
#endif
#ifndef OPENSSL_NO_TLS1
{"tls1", OPT_TLS1, '-', "TLS1 mode"},
#endif
#ifndef OPENSSL_NO_TLS1_1
{"tls1_1", OPT_TLS1_1, '-', "TLS1.1 mode"},
#endif
#ifndef OPENSSL_NO_TLS1_2
{"tls1_2", OPT_TLS1_2, '-', "TLS1.2 mode"},
#endif
#ifndef OPENSSL_NO_SSL_TRACE
{"stdname", OPT_STDNAME, '-', "Show standard cipher names"},
#endif
#ifndef OPENSSL_NO_PSK
{"psk", OPT_PSK, '-', "include ciphersuites requiring PSK"},
#endif
@@ -153,13 +159,19 @@ int ciphers_main(int argc, char **argv)
#endif
break;
case OPT_TLS1:
#ifndef OPENSSL_NO_TLS1
meth = TLSv1_client_method();
#endif
break;
case OPT_TLS1_1:
#ifndef OPENSSL_NO_TLS1_1
meth = TLSv1_1_client_method();
#endif
break;
case OPT_TLS1_2:
#ifndef OPENSSL_NO_TLS1_2
meth = TLSv1_2_client_method();
#endif
break;
case OPT_PSK:
#ifndef OPENSSL_NO_PSK