1 files changed, 46 insertions, 4 deletions

diff --git a/src/regress/lib/libssl/interop/server.c b/src/regress/lib/libssl/interop/server.c
index 6723817498..4b9dd0f506 100644
--- a/src/regress/lib/libssl/interop/server.c
+++ b/src/regress/lib/libssl/interop/server.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: server.c,v 1.8 2019/03/21 17:52:26 bluhm Exp $        */
+/*      $OpenBSD: server.c,v 1.9 2020/09/14 00:51:04 bluhm Exp $        */
 /*
  * Copyright (c) 2018-2019 Alexander Bluhm <bluhm@openbsd.org>
  *
@@ -36,7 +36,7 @@ void __dead
 usage(void)
 {
         fprintf(stderr, "usage: server [-Lsvv] [-C CA] [-c crt -k key] "
-            "[-l ciphers] [-p dhparam] [host port]\n");
+            "[-l ciphers] [-p dhparam] [-V version] [host port]\n");
         exit(2);
 }
 
@@ -49,11 +49,12 @@ main(int argc, char *argv[])
         BIO *abio, *cbio;
         SSL_SESSION *session;
         int ch, error, listciphers = 0, sessionreuse = 0, verify = 0;
+        int version = 0;
         char buf[256], *dhparam = NULL;
         char *ca = NULL, *crt = NULL, *key = NULL, *ciphers = NULL;
         char *host_port, *host = "127.0.0.1", *port = "0";
 
-        while ((ch = getopt(argc, argv, "C:c:k:Ll:p:sv")) != -1) {
+        while ((ch = getopt(argc, argv, "C:c:k:Ll:p:sV:v")) != -1) {
                 switch (ch) {
                 case 'C':
                         ca = optarg;
@@ -77,6 +78,21 @@ main(int argc, char *argv[])
                         /* multiple reueses are possible */
                         sessionreuse++;
                         break;
+                case 'V':
+                        if (strcmp(optarg, "TLS1") == 0) {
+                                version = TLS1_VERSION;
+                        } else if (strcmp(optarg, "TLS1_1") == 0) {
+                                version = TLS1_1_VERSION;
+                        } else if (strcmp(optarg, "TLS1_2") == 0) {
+                                version = TLS1_2_VERSION;
+#ifdef TLS1_3_VERSION
+                        } else if (strcmp(optarg, "TLS1_3") == 0) {
+                                version = TLS1_3_VERSION;
+#endif
+                        } else {
+                                errx(1, "unknown protocol version: %s", optarg);
+                        }
+                        break;
                 case 'v':
                         /* use twice to force client cert */
                         verify++;
@@ -113,7 +129,24 @@ main(int argc, char *argv[])
         if (method == NULL)
                 err_ssl(1, "TLS_server_method");
 #else
-        method = SSLv23_server_method();
+        switch (version) {
+        case TLS1_VERSION:
+                method = TLSv1_server_method();
+                break;
+        case TLS1_1_VERSION:
+                method = TLSv1_1_server_method();
+                break;
+        case TLS1_2_VERSION:
+                method = TLSv1_2_server_method();
+                break;
+#ifdef TLS1_3_VERSION
+        case TLS1_3_VERSION:
+                err(1, "TLS1_3 not supported");
+#endif
+        default:
+                method = SSLv23_server_method();
+                break;
+        }
         if (method == NULL)
                 err_ssl(1, "SSLv23_server_method");
 #endif
@@ -121,6 +154,15 @@ main(int argc, char *argv[])
         if (ctx == NULL)
                 err_ssl(1, "SSL_CTX_new");
 
+#if OPENSSL_VERSION_NUMBER >= 0x1010000f
+        if (version) {
+                if (SSL_CTX_set_min_proto_version(ctx, version) != 1)
+                        err_ssl(1, "SSL_CTX_set_min_proto_version");
+                if (SSL_CTX_set_max_proto_version(ctx, version) != 1)
+                        err_ssl(1, "SSL_CTX_set_max_proto_version");
+        }
+#endif
+
 #if OPENSSL_VERSION_NUMBER >= 0x10100000
         /* needed to use DHE cipher with libressl */
         if (SSL_CTX_set_dh_auto(ctx, 1) <= 0)