protocol_openssl.c File Reference

#include "postgres.h"
#include "common/openssl.h"

Include dependency graph for protocol_openssl.c:

Go to the source code of this file.

Functions
int	SSL_CTX_set_min_proto_version (SSL_CTX *ctx, int version)
int	SSL_CTX_set_max_proto_version (SSL_CTX *ctx, int version)

Function Documentation

SSL_CTX_set_max_proto_version()

int SSL_CTX_set_max_proto_version	(	SSL_CTX *	ctx,
		int	version
	)

Definition at line 80 of file protocol_openssl.c.

{
    int         ssl_options = 0;
 
    Assert(version != 0);
 
    /*
     * Some OpenSSL versions define TLS*_VERSION macros but not the
     * corresponding SSL_OP_NO_* macro, so in those cases we have to return
     * unsuccessfully here.
     */
#ifdef TLS1_1_VERSION
    if (version < TLS1_1_VERSION)
    {
#ifdef SSL_OP_NO_TLSv1_1
        ssl_options |= SSL_OP_NO_TLSv1_1;
#else
        return 0;
#endif
    }
#endif
#ifdef TLS1_2_VERSION
    if (version < TLS1_2_VERSION)
    {
#ifdef SSL_OP_NO_TLSv1_2
        ssl_options |= SSL_OP_NO_TLSv1_2;
#else
        return 0;
#endif
    }
#endif
 
    SSL_CTX_set_options(ctx, ssl_options);
 
    return 1;                   /* success */
}

References Assert.

Referenced by be_tls_init(), and initialize_SSL().

SSL_CTX_set_min_proto_version()

int SSL_CTX_set_min_proto_version	(	SSL_CTX *	ctx,
		int	version
	)

Definition at line 41 of file protocol_openssl.c.

{
    int         ssl_options = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
 
    if (version > TLS1_VERSION)
        ssl_options |= SSL_OP_NO_TLSv1;
 
    /*
     * Some OpenSSL versions define TLS*_VERSION macros but not the
     * corresponding SSL_OP_NO_* macro, so in those cases we have to return
     * unsuccessfully here.
     */
#ifdef TLS1_1_VERSION
    if (version > TLS1_1_VERSION)
    {
#ifdef SSL_OP_NO_TLSv1_1
        ssl_options |= SSL_OP_NO_TLSv1_1;
#else
        return 0;
#endif
    }
#endif
#ifdef TLS1_2_VERSION
    if (version > TLS1_2_VERSION)
    {
#ifdef SSL_OP_NO_TLSv1_2
        ssl_options |= SSL_OP_NO_TLSv1_2;
#else
        return 0;
#endif
    }
#endif
 
    SSL_CTX_set_options(ctx, ssl_options);
 
    return 1;                   /* success */
}

Referenced by be_tls_init(), and initialize_SSL().