Merge remote-tracking branch 'origin/mdb.RE/0.9'

[openldap] / libraries / libldap / tls_m.c

diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
index c1d0c2eefe4384aa03cf437ecdead3e3ed235cf9..9dfa2f00bd268372c32299fe224e4f9b7b9863dc 100644 (file)
--- a/libraries/libldap/tls_m.c
+++ b/libraries/libldap/tls_m.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2008-2014 The OpenLDAP Foundation.
+ * Copyright 2008-2015 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -1641,6 +1641,8 @@ tlsm_deferred_init( void *arg )
        NSSInitContext *initctx = NULL;
        PK11SlotInfo *certdb_slot = NULL;
 #endif
+       SSLVersionRange range;
+       SSLProtocolVariant variant;
        SECStatus rc;
        int done = 0;
 
@@ -1825,6 +1827,16 @@ tlsm_deferred_init( void *arg )
                        ctx->tc_using_pem = PR_TRUE;
                }
 
+               /*
+                * Set the SSL version range.  MozNSS SSL versions are the same as openldap's:
+                *
+                * SSL_LIBRARY_VERSION_TLS_1_* are equivalent to LDAP_OPT_X_TLS_PROTOCOL_TLS1_*
+                */
+               SSL_VersionRangeGetSupported(ssl_variant_stream, &range); /* this sets the max */
+               range.min = lt->lt_protocol_min ? lt->lt_protocol_min : range.min;
+               variant = ssl_variant_stream;
+               SSL_VersionRangeSetDefault(variant, &range);
+
                NSS_SetDomesticPolicy();
 
                PK11_SetPasswordFunc( tlsm_pin_prompt );
@@ -2850,7 +2862,11 @@ tlsm_session_unique( tls_session *sess, struct berval *buf, int is_server)
        return 0;
 }
 
-/* Yet again, we're pasting in glue that MozNSS ought to provide itself. */
+/*
+ * Yet again, we're pasting in glue that MozNSS ought to provide itself.
+ *
+ * SSL_LIBRARY_VERSION_TLS_1_* are equivalent to LDAP_OPT_X_TLS_PROTOCOL_TLS1_*
+ */
 static struct {
        const char *name;
        int num;
@@ -2859,6 +2875,8 @@ static struct {
        { "SSLv3", SSL_LIBRARY_VERSION_3_0 },
        { "TLSv1", SSL_LIBRARY_VERSION_TLS_1_0 },
        { "TLSv1.1", SSL_LIBRARY_VERSION_TLS_1_1 },
+       { "TLSv1.2", SSL_LIBRARY_VERSION_TLS_1_2 },
+       { "TLSv1.3", SSL_LIBRARY_VERSION_TLS_1_3 },
        { NULL, 0 }
 };