summaryrefslogtreecommitdiff
path: root/demos/bio
diff options
context:
space:
mode:
authorMatt Caswell <matt@openssl.org>2015-03-27 23:01:51 +0000
committerMatt Caswell <matt@openssl.org>2015-05-16 09:19:56 +0100
commit32ec41539b5b23bc42503589fcc5be65d648d1f5 (patch)
tree340cc1e0e9d83d0db3af099741fed33f94ce89df /demos/bio
parent756eff7a31b5b46577e8529645b254ccc256a8ae (diff)
downloadopenssl-new-32ec41539b5b23bc42503589fcc5be65d648d1f5.tar.gz
Server side version negotiation rewrite
This commit changes the way that we do server side protocol version negotiation. Previously we had a whole set of code that had an "up front" state machine dedicated to the negotiating the protocol version. This adds significant complexity to the state machine. Historically the justification for doing this was the support of SSLv2 which works quite differently to SSLv3+. However, we have now removed support for SSLv2 so there is little reason to maintain this complexity. The one slight difficulty is that, although we no longer support SSLv2, we do still support an SSLv3+ ClientHello in an SSLv2 backward compatible ClientHello format. This is generally only used by legacy clients. This commit adds support within the SSLv3 code for these legacy format ClientHellos. Server side version negotiation now works in much the same was as DTLS, i.e. we introduce the concept of TLS_ANY_VERSION. If s->version is set to that then when a ClientHello is received it will work out the most appropriate version to respond with. Also, SSLv23_method and SSLv23_server_method have been replaced with TLS_method and TLS_server_method respectively. The old SSLv23* names still exist as macros pointing at the new name, although they are deprecated. Subsequent commits will look at client side version negotiation, as well of removal of the old s23* code. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
Diffstat (limited to 'demos/bio')
-rw-r--r--demos/bio/saccept.c2
-rw-r--r--demos/bio/server-arg.c2
-rw-r--r--demos/bio/server-conf.c2
3 files changed, 3 insertions, 3 deletions
diff --git a/demos/bio/saccept.c b/demos/bio/saccept.c
index 505d98b68f..0d173aa039 100644
--- a/demos/bio/saccept.c
+++ b/demos/bio/saccept.c
@@ -45,7 +45,7 @@ int main(int argc, char *argv[])
/* Add ciphers and message digests */
OpenSSL_add_ssl_algorithms();
- ctx = SSL_CTX_new(SSLv23_server_method());
+ ctx = SSL_CTX_new(TLS_server_method());
if (!SSL_CTX_use_certificate_file(ctx, CERT_FILE, SSL_FILETYPE_PEM))
goto err;
if (!SSL_CTX_use_PrivateKey_file(ctx, CERT_FILE, SSL_FILETYPE_PEM))
diff --git a/demos/bio/server-arg.c b/demos/bio/server-arg.c
index b188f6a4ed..242ca6c0af 100644
--- a/demos/bio/server-arg.c
+++ b/demos/bio/server-arg.c
@@ -29,7 +29,7 @@ int main(int argc, char *argv[])
/* Add ciphers and message digests */
OpenSSL_add_ssl_algorithms();
- ctx = SSL_CTX_new(SSLv23_server_method());
+ ctx = SSL_CTX_new(TLS_server_method());
cctx = SSL_CONF_CTX_new();
SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_SERVER);
diff --git a/demos/bio/server-conf.c b/demos/bio/server-conf.c
index cc9fe8a828..bf3dd067e5 100644
--- a/demos/bio/server-conf.c
+++ b/demos/bio/server-conf.c
@@ -49,7 +49,7 @@ int main(int argc, char *argv[])
goto err;
}
- ctx = SSL_CTX_new(SSLv23_server_method());
+ ctx = SSL_CTX_new(TLS_server_method());
cctx = SSL_CONF_CTX_new();
SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_SERVER);
SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_CERTIFICATE);