openbsd/src/lib/libssl/ssl_versions.c, branch OPENBSD_6_8_BASEA mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE2020-05-31T18:03:32+00:00Replace ssl_max_server_version() with ssl_downgrade_max_version()2020-05-31T18:03:32+00:00jsing2020-05-31T18:03:32+00:00urn:sha1:354a3e8ef8994750d21e12eda969485e19c89844
Replace the only occurrence of ssl_max_server_version() with a call
to ssl_downgrade_max_version() and remove ssl_max_server_version().
ok beck@ tb@
Correct downgrade sentinels when a version pinned method is in use.2020-05-31T16:36:35+00:00jsing2020-05-31T16:36:35+00:00urn:sha1:059c16b3ca987ee98bd63a9cf4d0c58bfc02334e
Previously only the enabled protocol versions were considered, however we
also have to consider the method in use which may be version pinned.
Found the hard way by danj@ with haproxy and force-tlsv12.
ok beck@ inoguchi@ tb@
Include TLSv1.3 in version handling code.2018-11-06T01:40:23+00:00jsing2018-11-06T01:40:23+00:00urn:sha1:2b77bc57bf2b32edd50745f45bb26dd938cdc787
This is effectively a no-op, since most of the code clamps to the maximum
version supported by the TLS method (which are still at TLSv1.2).
ok beck@ bluhm@ tb@
Provide SSL{,_CTX}_set_{min,max}_proto_version() functions.2017-05-06T20:37:25+00:00jsing2017-05-06T20:37:25+00:00urn:sha1:0869d93fa2822cd7c9118eab9c9868d0d91ba3d7
Rides minor bump.
ok beck@
Add missing $OpenBSD$ tags.2017-05-06T16:18:36+00:00jsing2017-05-06T16:18:36+00:00urn:sha1:0de4d35571b79288296f8df357dedc38c201ad7eMove relatively new version range code from ssl_lib.c into a separate2017-01-26T06:01:44+00:00jsing2017-01-26T06:01:44+00:00urn:sha1:1cc79b15c0e05858d638931ff222a6c8592f3103
ssl_versions.c file.
ok beck@