Skip to content

Commit e96d9c0

Browse files
rheniumrhenium
authored
Merge pull request #142 from rhenium/ky/ssl-version-min-max
ssl: add SSLContext#min_version= and #max_version=
2 parents a98152a + 5653599 commit e96d9c0

File tree

5 files changed

+460
-204
lines changed

5 files changed

+460
-204
lines changed

‎ext/openssl/extconf.rb‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -104,11 +104,6 @@ def find_openssl_library
104104

105105
Logging::message "=== Checking for OpenSSL features... ===\n"
106106
# compile options
107-
108-
# SSLv2 and SSLv3 may be removed in future versions of OpenSSL, and even macros
109-
# like OPENSSL_NO_SSL2 may not be defined.
110-
have_func("SSLv2_method")
111-
have_func("SSLv3_method")
112107
have_func("RAND_egd")
113108
engines = %w{builtin_engines openbsd_dev_crypto dynamic 4758cca aep atalla chil
114109
cswift nuron sureware ubsec padlock capi gmp gost cryptodev aesni}

‎ext/openssl/ossl_ssl.c‎

Lines changed: 182 additions & 119 deletions
Original file line numberDiff line numberDiff line change
@@ -46,44 +46,6 @@ static ID id_i_cert_store, id_i_ca_file, id_i_ca_path, id_i_verify_mode,
4646
id_i_verify_hostname;
4747
static ID id_i_io, id_i_context, id_i_hostname;
4848

49-
/*
50-
* SSLContext class
51-
*/
52-
static const struct {
53-
const char *name;
54-
const SSL_METHOD *(*func)(void);
55-
int version;
56-
} ossl_ssl_method_tab[] = {
57-
#if defined(HAVE_SSL_CTX_SET_MIN_PROTO_VERSION)
58-
#define OSSL_SSL_METHOD_ENTRY(name, version) \
59-
{ #name, TLS_method, version }, \
60-
{ #name"_server", TLS_server_method, version }, \
61-
{ #name"_client", TLS_client_method, version }
62-
#else
63-
#define OSSL_SSL_METHOD_ENTRY(name, version) \
64-
{ #name, name##_method, version }, \
65-
{ #name"_server", name##_server_method, version }, \
66-
{ #name"_client", name##_client_method, version }
67-
#endif
68-
#if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL2_METHOD) && defined(HAVE_SSLV2_METHOD)
69-
OSSL_SSL_METHOD_ENTRY(SSLv2, SSL2_VERSION),
70-
#endif
71-
#if !defined(OPENSSL_NO_SSL3) && !defined(OPENSSL_NO_SSL3_METHOD) && defined(HAVE_SSLV3_METHOD)
72-
OSSL_SSL_METHOD_ENTRY(SSLv3, SSL3_VERSION),
73-
#endif
74-
#if !defined(OPENSSL_NO_TLS1) && !defined(OPENSSL_NO_TLS1_METHOD)
75-
OSSL_SSL_METHOD_ENTRY(TLSv1, TLS1_VERSION),
76-
#endif
77-
#if !defined(OPENSSL_NO_TLS1_1) && !defined(OPENSSL_NO_TLS1_1_METHOD)
78-
OSSL_SSL_METHOD_ENTRY(TLSv1_1, TLS1_1_VERSION),
79-
#endif
80-
#if !defined(OPENSSL_NO_TLS1_2) && !defined(OPENSSL_NO_TLS1_2_METHOD)
81-
OSSL_SSL_METHOD_ENTRY(TLSv1_2, TLS1_2_VERSION),
82-
#endif
83-
OSSL_SSL_METHOD_ENTRY(SSLv23, 0),
84-
#undef OSSL_SSL_METHOD_ENTRY
85-
};
86-
8749
static int ossl_ssl_ex_vcb_idx;
8850
static int ossl_ssl_ex_ptr_idx;
8951
static int ossl_sslctx_ex_ptr_idx;
@@ -121,7 +83,11 @@ ossl_sslctx_s_alloc(VALUE klass)
12183
VALUE obj;
12284

12385
obj = TypedData_Wrap_Struct(klass, &ossl_sslctx_type, 0);
86+
#if OPENSSL_VERSION_NUMBER >= 0x10100000 && !defined(LIBRESSL_VERSION_NUMBER)
87+
ctx = SSL_CTX_new(TLS_method());
88+
#else
12489
ctx = SSL_CTX_new(SSLv23_method());
90+
#endif
12591
if (!ctx) {
12692
ossl_raise(eSSLError, "SSL_CTX_new");
12793
}
@@ -144,49 +110,89 @@ ossl_sslctx_s_alloc(VALUE klass)
144110
return obj;
145111
}
146112

113+
static int
114+
parse_proto_version(VALUE str)
115+
{
116+
int i;
117+
static const struct {
118+
const char *name;
119+
int version;
120+
} map[] = {
121+
{ "SSL2", SSL2_VERSION },
122+
{ "SSL3", SSL3_VERSION },
123+
{ "TLS1", TLS1_VERSION },
124+
{ "TLS1_1", TLS1_1_VERSION },
125+
{ "TLS1_2", TLS1_2_VERSION },
126+
#ifdef TLS1_3_VERSION
127+
{ "TLS1_3", TLS1_3_VERSION },
128+
#endif
129+
};
130+
131+
if (NIL_P(str))
132+
return 0;
133+
if (RB_INTEGER_TYPE_P(str))
134+
return NUM2INT(str);
135+
136+
if (SYMBOL_P(str))
137+
str = rb_sym2str(str);
138+
StringValue(str);
139+
for (i = 0; i < numberof(map); i++)
140+
if (!strncmp(map[i].name, RSTRING_PTR(str), RSTRING_LEN(str)))
141+
return map[i].version;
142+
rb_raise(rb_eArgError, "unrecognized version %+"PRIsVALUE, str);
143+
}
144+
147145
/*
148146
* call-seq:
149-
* ctx.ssl_version = :TLSv1
150-
* ctx.ssl_version = "SSLv23_client"
151-
*
152-
* Sets the SSL/TLS protocol version for the context. This forces connections to
153-
* use only the specified protocol version.
147+
* ctx.set_minmax_proto_version(min, max) -> nil
154148
*
155-
* You can get a list of valid versions with OpenSSL::SSL::SSLContext::METHODS
149+
* Sets the minimum and maximum supported protocol versions. See #min_version=
150+
* and #max_version=.
156151
*/
157152
static VALUE
158-
ossl_sslctx_set_ssl_version(VALUE self, VALUE ssl_method)
153+
ossl_sslctx_set_minmax_proto_version(VALUE self, VALUE min_v, VALUE max_v)
159154
{
160155
SSL_CTX *ctx;
161-
const char *s;
162-
VALUE m = ssl_method;
163-
int i;
156+
int min, max;
164157

165158
GetSSLCTX(self, ctx);
166-
if (RB_TYPE_P(ssl_method, T_SYMBOL))
167-
m = rb_sym2str(ssl_method);
168-
s = StringValueCStr(m);
169-
for (i = 0; i < numberof(ossl_ssl_method_tab); i++) {
170-
if (strcmp(ossl_ssl_method_tab[i].name, s) == 0) {
171-
#if defined(HAVE_SSL_CTX_SET_MIN_PROTO_VERSION)
172-
int version = ossl_ssl_method_tab[i].version;
173-
#endif
174-
const SSL_METHOD *method = ossl_ssl_method_tab[i].func();
175-
176-
if (SSL_CTX_set_ssl_version(ctx, method) != 1)
177-
ossl_raise(eSSLError, "SSL_CTX_set_ssl_version");
159+
min = parse_proto_version(min_v);
160+
max = parse_proto_version(max_v);
161+
162+
#ifdef HAVE_SSL_CTX_SET_MIN_PROTO_VERSION
163+
if (!SSL_CTX_set_min_proto_version(ctx, min))
164+
ossl_raise(eSSLError, "SSL_CTX_set_min_proto_version");
165+
if (!SSL_CTX_set_max_proto_version(ctx, max))
166+
ossl_raise(eSSLError, "SSL_CTX_set_max_proto_version");
167+
#else
168+
{
169+
unsigned long sum = 0, opts = 0;
170+
int i;
171+
static const struct {
172+
int ver;
173+
unsigned long opts;
174+
} options_map[] = {
175+
{ SSL2_VERSION, SSL_OP_NO_SSLv2 },
176+
{ SSL3_VERSION, SSL_OP_NO_SSLv3 },
177+
{ TLS1_VERSION, SSL_OP_NO_TLSv1 },
178+
{ TLS1_1_VERSION, SSL_OP_NO_TLSv1_1 },
179+
{ TLS1_2_VERSION, SSL_OP_NO_TLSv1_2 },
180+
# if defined(TLS1_3_VERSION)
181+
{ TLS1_3_VERSION, SSL_OP_NO_TLSv1_3 },
182+
# endif
183+
};
178184

179-
#if defined(HAVE_SSL_CTX_SET_MIN_PROTO_VERSION)
180-
if (!SSL_CTX_set_min_proto_version(ctx, version))
181-
ossl_raise(eSSLError, "SSL_CTX_set_min_proto_version");
182-
if (!SSL_CTX_set_max_proto_version(ctx, version))
183-
ossl_raise(eSSLError, "SSL_CTX_set_max_proto_version");
184-
#endif
185-
return ssl_method;
186-
}
185+
for (i = 0; i < numberof(options_map); i++) {
186+
sum |= options_map[i].opts;
187+
if (min && min > options_map[i].ver || max && max < options_map[i].ver)
188+
opts |= options_map[i].opts;
189+
}
190+
SSL_CTX_clear_options(ctx, sum);
191+
SSL_CTX_set_options(ctx, opts);
187192
}
193+
#endif
188194

189-
ossl_raise(rb_eArgError, "unknown SSL method `%"PRIsVALUE"'.", m);
195+
return Qnil;
190196
}
191197

192198
static VALUE
@@ -727,7 +733,11 @@ ossl_sslctx_get_options(VALUE self)
727733
{
728734
SSL_CTX *ctx;
729735
GetSSLCTX(self, ctx);
730-
return LONG2NUM(SSL_CTX_get_options(ctx));
736+
/*
737+
* Do explicit cast because SSL_CTX_get_options() returned (signed) long in
738+
* OpenSSL before 1.1.0.
739+
*/
740+
return ULONG2NUM((unsigned long)SSL_CTX_get_options(ctx));
731741
}
732742

733743
/*
@@ -746,7 +756,7 @@ ossl_sslctx_set_options(VALUE self, VALUE options)
746756
if (NIL_P(options)) {
747757
SSL_CTX_set_options(ctx, SSL_OP_ALL);
748758
} else {
749-
SSL_CTX_set_options(ctx, NUM2LONG(options));
759+
SSL_CTX_set_options(ctx, NUM2ULONG(options));
750760
}
751761

752762
return self;
@@ -2240,9 +2250,6 @@ ossl_ssl_tmp_key(VALUE self)
22402250
void
22412251
Init_ossl_ssl(void)
22422252
{
2243-
int i;
2244-
VALUE ary;
2245-
22462253
#if 0
22472254
mOSSL = rb_define_module("OpenSSL");
22482255
eOSSLError = rb_define_class_under(mOSSL, "OpenSSLError", rb_eStandardError);
@@ -2539,7 +2546,8 @@ Init_ossl_ssl(void)
25392546

25402547
rb_define_alias(cSSLContext, "ssl_timeout", "timeout");
25412548
rb_define_alias(cSSLContext, "ssl_timeout=", "timeout=");
2542-
rb_define_method(cSSLContext, "ssl_version=", ossl_sslctx_set_ssl_version, 1);
2549+
rb_define_private_method(cSSLContext, "set_minmax_proto_version",
2550+
ossl_sslctx_set_minmax_proto_version, 2);
25432551
rb_define_method(cSSLContext, "ciphers", ossl_sslctx_get_ciphers, 0);
25442552
rb_define_method(cSSLContext, "ciphers=", ossl_sslctx_set_ciphers, 1);
25452553
rb_define_method(cSSLContext, "ecdh_curves=", ossl_sslctx_set_ecdh_curves, 1);
@@ -2607,14 +2615,6 @@ Init_ossl_ssl(void)
26072615
rb_define_method(cSSLContext, "options", ossl_sslctx_get_options, 0);
26082616
rb_define_method(cSSLContext, "options=", ossl_sslctx_set_options, 1);
26092617

2610-
ary = rb_ary_new2(numberof(ossl_ssl_method_tab));
2611-
for (i = 0; i < numberof(ossl_ssl_method_tab); i++) {
2612-
rb_ary_push(ary, ID2SYM(rb_intern(ossl_ssl_method_tab[i].name)));
2613-
}
2614-
rb_obj_freeze(ary);
2615-
/* The list of available SSL/TLS methods */
2616-
rb_define_const(cSSLContext, "METHODS", ary);
2617-
26182618
/*
26192619
* Document-class: OpenSSL::SSL::SSLSocket
26202620
*/
@@ -2661,44 +2661,107 @@ Init_ossl_ssl(void)
26612661
# endif
26622662
#endif
26632663

2664-
#define ossl_ssl_def_const(x) rb_define_const(mSSL, #x, LONG2NUM(SSL_##x))
2664+
rb_define_const(mSSL, "VERIFY_NONE", INT2NUM(SSL_VERIFY_NONE));
2665+
rb_define_const(mSSL, "VERIFY_PEER", INT2NUM(SSL_VERIFY_PEER));
2666+
rb_define_const(mSSL, "VERIFY_FAIL_IF_NO_PEER_CERT", INT2NUM(SSL_VERIFY_FAIL_IF_NO_PEER_CERT));
2667+
rb_define_const(mSSL, "VERIFY_CLIENT_ONCE", INT2NUM(SSL_VERIFY_CLIENT_ONCE));
2668+
2669+
rb_define_const(mSSL, "OP_ALL", ULONG2NUM(SSL_OP_ALL));
2670+
rb_define_const(mSSL, "OP_LEGACY_SERVER_CONNECT", ULONG2NUM(SSL_OP_LEGACY_SERVER_CONNECT));
2671+
#ifdef SSL_OP_TLSEXT_PADDING /* OpenSSL 1.0.1h and OpenSSL 1.0.2 */
2672+
rb_define_const(mSSL, "OP_TLSEXT_PADDING", ULONG2NUM(SSL_OP_TLSEXT_PADDING));
2673+
#endif
2674+
#ifdef SSL_OP_SAFARI_ECDHE_ECDSA_BUG /* OpenSSL 1.0.1f and OpenSSL 1.0.2 */
2675+
rb_define_const(mSSL, "OP_SAFARI_ECDHE_ECDSA_BUG", ULONG2NUM(SSL_OP_SAFARI_ECDHE_ECDSA_BUG));
2676+
#endif
2677+
#ifdef SSL_OP_ALLOW_NO_DHE_KEX /* OpenSSL 1.1.1 */
2678+
rb_define_const(mSSL, "OP_ALLOW_NO_DHE_KEX", ULONG2NUM(SSL_OP_ALLOW_NO_DHE_KEX));
2679+
#endif
2680+
rb_define_const(mSSL, "OP_DONT_INSERT_EMPTY_FRAGMENTS", ULONG2NUM(SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS));
2681+
rb_define_const(mSSL, "OP_NO_TICKET", ULONG2NUM(SSL_OP_NO_TICKET));
2682+
rb_define_const(mSSL, "OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION", ULONG2NUM(SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION));
2683+
rb_define_const(mSSL, "OP_NO_COMPRESSION", ULONG2NUM(SSL_OP_NO_COMPRESSION));
2684+
rb_define_const(mSSL, "OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION", ULONG2NUM(SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION));
2685+
#ifdef SSL_OP_NO_ENCRYPT_THEN_MAC /* OpenSSL 1.1.1 */
2686+
rb_define_const(mSSL, "OP_NO_ENCRYPT_THEN_MAC", ULONG2NUM(SSL_OP_NO_ENCRYPT_THEN_MAC));
2687+
#endif
2688+
rb_define_const(mSSL, "OP_CIPHER_SERVER_PREFERENCE", ULONG2NUM(SSL_OP_CIPHER_SERVER_PREFERENCE));
2689+
rb_define_const(mSSL, "OP_TLS_ROLLBACK_BUG", ULONG2NUM(SSL_OP_TLS_ROLLBACK_BUG));
2690+
#ifdef SSL_OP_NO_RENEGOTIATION /* OpenSSL 1.1.1 */
2691+
rb_define_const(mSSL, "OP_NO_RENEGOTIATION", ULONG2NUM(SSL_OP_NO_RENEGOTIATION));
2692+
#endif
2693+
rb_define_const(mSSL, "OP_CRYPTOPRO_TLSEXT_BUG", ULONG2NUM(SSL_OP_CRYPTOPRO_TLSEXT_BUG));
2694+
2695+
rb_define_const(mSSL, "OP_NO_SSLv3", ULONG2NUM(SSL_OP_NO_SSLv3));
2696+
rb_define_const(mSSL, "OP_NO_TLSv1", ULONG2NUM(SSL_OP_NO_TLSv1));
2697+
rb_define_const(mSSL, "OP_NO_TLSv1_1", ULONG2NUM(SSL_OP_NO_TLSv1_1));
2698+
rb_define_const(mSSL, "OP_NO_TLSv1_2", ULONG2NUM(SSL_OP_NO_TLSv1_2));
2699+
#ifdef SSL_OP_NO_TLSv1_3 /* OpenSSL 1.1.1 */
2700+
rb_define_const(mSSL, "OP_NO_TLSv1_3", ULONG2NUM(SSL_OP_NO_TLSv1_3));
2701+
#endif
2702+
2703+
/* SSL_OP_* flags for DTLS */
2704+
#if 0
2705+
rb_define_const(mSSL, "OP_NO_QUERY_MTU", ULONG2NUM(SSL_OP_NO_QUERY_MTU));
2706+
rb_define_const(mSSL, "OP_COOKIE_EXCHANGE", ULONG2NUM(SSL_OP_COOKIE_EXCHANGE));
2707+
rb_define_const(mSSL, "OP_CISCO_ANYCONNECT", ULONG2NUM(SSL_OP_CISCO_ANYCONNECT));
2708+
#endif
2709+
2710+
/* Deprecated in OpenSSL 1.1.0. */
2711+
rb_define_const(mSSL, "OP_MICROSOFT_SESS_ID_BUG", ULONG2NUM(SSL_OP_MICROSOFT_SESS_ID_BUG));
2712+
/* Deprecated in OpenSSL 1.1.0. */
2713+
rb_define_const(mSSL, "OP_NETSCAPE_CHALLENGE_BUG", ULONG2NUM(SSL_OP_NETSCAPE_CHALLENGE_BUG));
2714+
/* Deprecated in OpenSSL 0.9.8q and 1.0.0c. */
2715+
rb_define_const(mSSL, "OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG", ULONG2NUM(SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG));
2716+
/* Deprecated in OpenSSL 1.0.1h and 1.0.2. */
2717+
rb_define_const(mSSL, "OP_SSLREF2_REUSE_CERT_TYPE_BUG", ULONG2NUM(SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG));
2718+
/* Deprecated in OpenSSL 1.1.0. */
2719+
rb_define_const(mSSL, "OP_MICROSOFT_BIG_SSLV3_BUFFER", ULONG2NUM(SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER));
2720+
/* Deprecated in OpenSSL 0.9.7h and 0.9.8b. */
2721+
rb_define_const(mSSL, "OP_MSIE_SSLV2_RSA_PADDING", ULONG2NUM(SSL_OP_MSIE_SSLV2_RSA_PADDING));
2722+
/* Deprecated in OpenSSL 1.1.0. */
2723+
rb_define_const(mSSL, "OP_SSLEAY_080_CLIENT_DH_BUG", ULONG2NUM(SSL_OP_SSLEAY_080_CLIENT_DH_BUG));
2724+
/* Deprecated in OpenSSL 1.1.0. */
2725+
rb_define_const(mSSL, "OP_TLS_D5_BUG", ULONG2NUM(SSL_OP_TLS_D5_BUG));
2726+
/* Deprecated in OpenSSL 1.1.0. */
2727+
rb_define_const(mSSL, "OP_TLS_BLOCK_PADDING_BUG", ULONG2NUM(SSL_OP_TLS_BLOCK_PADDING_BUG));
2728+
/* Deprecated in OpenSSL 1.1.0. */
2729+
rb_define_const(mSSL, "OP_SINGLE_ECDH_USE", ULONG2NUM(SSL_OP_SINGLE_ECDH_USE));
2730+
/* Deprecated in OpenSSL 1.1.0. */
2731+
rb_define_const(mSSL, "OP_SINGLE_DH_USE", ULONG2NUM(SSL_OP_SINGLE_DH_USE));
2732+
/* Deprecated in OpenSSL 1.0.1k and 1.0.2. */
2733+
rb_define_const(mSSL, "OP_EPHEMERAL_RSA", ULONG2NUM(SSL_OP_EPHEMERAL_RSA));
2734+
/* Deprecated in OpenSSL 1.1.0. */
2735+
rb_define_const(mSSL, "OP_NO_SSLv2", ULONG2NUM(SSL_OP_NO_SSLv2));
2736+
/* Deprecated in OpenSSL 1.0.1. */
2737+
rb_define_const(mSSL, "OP_PKCS1_CHECK_1", ULONG2NUM(SSL_OP_PKCS1_CHECK_1));
2738+
/* Deprecated in OpenSSL 1.0.1. */
2739+
rb_define_const(mSSL, "OP_PKCS1_CHECK_2", ULONG2NUM(SSL_OP_PKCS1_CHECK_2));
2740+
/* Deprecated in OpenSSL 1.1.0. */
2741+
rb_define_const(mSSL, "OP_NETSCAPE_CA_DN_BUG", ULONG2NUM(SSL_OP_NETSCAPE_CA_DN_BUG));
2742+
/* Deprecated in OpenSSL 1.1.0. */
2743+
rb_define_const(mSSL, "OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG", ULONG2NUM(SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG));
2744+
26652745

2666-
ossl_ssl_def_const(VERIFY_NONE);
2667-
ossl_ssl_def_const(VERIFY_PEER);
2668-
ossl_ssl_def_const(VERIFY_FAIL_IF_NO_PEER_CERT);
2669-
ossl_ssl_def_const(VERIFY_CLIENT_ONCE);
2670-
/* Introduce constants included in OP_ALL. These constants are mostly for
2671-
* unset some bits in OP_ALL such as;
2672-
* ctx.options = OP_ALL & ~OP_DONT_INSERT_EMPTY_FRAGMENTS
2746+
/*
2747+
* SSL/TLS version constants. Used by SSLContext#min_version= and
2748+
* #max_version=
26732749
*/
2674-
ossl_ssl_def_const(OP_MICROSOFT_SESS_ID_BUG);
2675-
ossl_ssl_def_const(OP_NETSCAPE_CHALLENGE_BUG);
2676-
ossl_ssl_def_const(OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG);
2677-
ossl_ssl_def_const(OP_SSLREF2_REUSE_CERT_TYPE_BUG);
2678-
ossl_ssl_def_const(OP_MICROSOFT_BIG_SSLV3_BUFFER);
2679-
ossl_ssl_def_const(OP_MSIE_SSLV2_RSA_PADDING);
2680-
ossl_ssl_def_const(OP_SSLEAY_080_CLIENT_DH_BUG);
2681-
ossl_ssl_def_const(OP_TLS_D5_BUG);
2682-
ossl_ssl_def_const(OP_TLS_BLOCK_PADDING_BUG);
2683-
ossl_ssl_def_const(OP_DONT_INSERT_EMPTY_FRAGMENTS);
2684-
ossl_ssl_def_const(OP_ALL);
2685-
ossl_ssl_def_const(OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION);
2686-
ossl_ssl_def_const(OP_SINGLE_ECDH_USE);
2687-
ossl_ssl_def_const(OP_SINGLE_DH_USE);
2688-
ossl_ssl_def_const(OP_EPHEMERAL_RSA);
2689-
ossl_ssl_def_const(OP_CIPHER_SERVER_PREFERENCE);
2690-
ossl_ssl_def_const(OP_TLS_ROLLBACK_BUG);
2691-
ossl_ssl_def_const(OP_NO_SSLv2);
2692-
ossl_ssl_def_const(OP_NO_SSLv3);
2693-
ossl_ssl_def_const(OP_NO_TLSv1);
2694-
ossl_ssl_def_const(OP_NO_TLSv1_1);
2695-
ossl_ssl_def_const(OP_NO_TLSv1_2);
2696-
ossl_ssl_def_const(OP_NO_TICKET);
2697-
ossl_ssl_def_const(OP_NO_COMPRESSION);
2698-
ossl_ssl_def_const(OP_PKCS1_CHECK_1);
2699-
ossl_ssl_def_const(OP_PKCS1_CHECK_2);
2700-
ossl_ssl_def_const(OP_NETSCAPE_CA_DN_BUG);
2701-
ossl_ssl_def_const(OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG);
2750+
/* SSL 2.0 */
2751+
rb_define_const(mSSL, "SSL2_VERSION", INT2NUM(SSL2_VERSION));
2752+
/* SSL 3.0 */
2753+
rb_define_const(mSSL, "SSL3_VERSION", INT2NUM(SSL3_VERSION));
2754+
/* TLS 1.0 */
2755+
rb_define_const(mSSL, "TLS1_VERSION", INT2NUM(TLS1_VERSION));
2756+
/* TLS 1.1 */
2757+
rb_define_const(mSSL, "TLS1_1_VERSION", INT2NUM(TLS1_1_VERSION));
2758+
/* TLS 1.2 */
2759+
rb_define_const(mSSL, "TLS1_2_VERSION", INT2NUM(TLS1_2_VERSION));
2760+
#ifdef TLS1_3_VERSION /* OpenSSL 1.1.1 */
2761+
/* TLS 1.3 */
2762+
rb_define_const(mSSL, "TLS1_3_VERSION", INT2NUM(TLS1_3_VERSION));
2763+
#endif
2764+
27022765

27032766
sym_exception = ID2SYM(rb_intern("exception"));
27042767
sym_wait_readable = ID2SYM(rb_intern("wait_readable"));

0 commit comments

Comments
 (0)