Use single method constructor and disable unwanted protocols via options

  - In OpenSSL 1.1.0 the individual constructors are deprecated
  - The removal of __typeof__ fixes an issue with MSVC

1 files changed, 61 insertions, 31 deletions

diff --git a/src/openssl.c b/src/openssl.c
index 2cfad4a..8500815 100644
--- a/src/openssl.c
+++ b/src/openssl.c
@@ -325,12 +325,12 @@
 #define HAVE_SSL_UP_REF OPENSSL_PREREQ(1,1,0)
 #endif
 
-#ifndef HAVE_SSLV2_CLIENT_METHOD
-#define HAVE_SSLV2_CLIENT_METHOD (!OPENSSL_PREREQ(1,1,0) && !defined OPENSSL_NO_SSL2)
+#ifndef HAVE_SSL_OP_NO_SSL_MASK
+#define HAVE_SSL_OP_NO_SSL_MASK OPENSSL_PREREQ(1,0,2)
 #endif
 
-#ifndef HAVE_SSLV2_SERVER_METHOD
-#define HAVE_SSLV2_SERVER_METHOD (!OPENSSL_PREREQ(1,1,0) && !defined OPENSSL_NO_SSL2)
+#ifndef HAVE_SSL_OP_NO_DTLS_MASK
+#define HAVE_SSL_OP_NO_DTLS_MASK OPENSSL_PREREQ(1,1,0)
 #endif
 
 #ifndef HAVE_STACK_OPENSSL_STRING_FUNCS
@@ -1686,6 +1686,22 @@ static int compat_SSL_up_ref(SSL *ssl) {
 } /* compat_SSL_up_ref() */
 #endif
 
+#if !HAVE_SSL_OP_NO_SSL_MASK
+/* SSL_OP_NO_SSL_MASK was introduced in 1.0.2
+   1.0.1 had up to TLSv1_2
+   0.9.8-1.0.0 had up to TLSv1
+*/
+#ifdef SSL_OP_NO_TLSv1_2
+#define SSL_OP_NO_SSL_MASK (SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1|SSL_OP_NO_TLSv1_1|SSL_OP_NO_TLSv1_2)
+#else
+#define SSL_OP_NO_SSL_MASK (SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1)
+#endif
+#endif
+
+#if !HAVE_SSL_OP_NO_DTLS_MASK && HAVE_DTLS_CLIENT_METHOD
+#define SSL_OP_NO_DTLS_MASK (SSL_OP_NO_DTLSv1|SSL_OP_NO_DTLSv1_2)
+#endif
+
 #if !HAVE_SSL_CTX_GET0_PARAM
 #define SSL_CTX_get0_param(ctx) compat_SSL_CTX_get0_param((ctx))
 
@@ -7751,11 +7767,6 @@ int luaopen__openssl_pkcs12(lua_State *L) {
  *
  * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
 
-/*
- * NOTE: TLS methods and flags were added in tandem. For example, if the
- * macro SSL_OP_NO_TLSv1_1 is defined we know TLSv1_1_server_method is also
- * declared and defined.
- */
 static int sx_new(lua_State *L) {
 	static const char *const opts[] = {
 		[0] = "SSL",
@@ -7771,77 +7782,96 @@ static int sx_new(lua_State *L) {
 		[14] = "DTLSv1_2", [15] = "DTLSv1.2",
 		NULL
 	};
-	/* later versions of SSL declare a const qualifier on the return type */
-	__typeof__(&TLSv1_client_method) method = &TLSv1_client_method;
+	int method_enum;
 	_Bool srv;
 	SSL_CTX **ud;
 	int options = 0;
 
 	lua_settop(L, 2);
+	method_enum = auxL_checkoption(L, 1, "TLS", opts, 1);
 	srv = lua_toboolean(L, 2);
 
-	switch (auxL_checkoption(L, 1, "TLS", opts, 1)) {
+	switch (method_enum) {
 	case 0: /* SSL */
-		method = (srv)? &SSLv23_server_method : &SSLv23_client_method;
 		options = SSL_OP_NO_SSLv2;
 		break;
 	case 1: /* TLS */
-		method = (srv)? &SSLv23_server_method : &SSLv23_client_method;
 		options = SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3;
 		break;
-#if HAVE_SSLV2_CLIENT_METHOD && HAVE_SSLV2_SERVER_METHOD
 	case 2: /* SSLv2 */
-		method = (srv)? &SSLv2_server_method : &SSLv2_client_method;
+		options = SSL_OP_NO_SSL_MASK & ~SSL_OP_NO_SSLv2;
 		break;
-#endif
-#ifndef OPENSSL_NO_SSL3
 	case 3: /* SSLv3 */
-		method = (srv)? &SSLv3_server_method : &SSLv3_client_method;
+		options = SSL_OP_NO_SSL_MASK & ~SSL_OP_NO_SSLv3;
 		break;
-#endif
 	case 4: /* SSLv23 */
-		method = (srv)? &SSLv23_server_method : &SSLv23_client_method;
 		break;
 	case 5: /* TLSv1 */
 	case 6: /* TLSv1.0 */
-		method = (srv)? &TLSv1_server_method : &TLSv1_client_method;
+		options = SSL_OP_NO_SSL_MASK & ~SSL_OP_NO_TLSv1;
 		break;
 #if defined SSL_OP_NO_TLSv1_1
 	case 7: /* TLSv1_1 */
 	case 8: /* TLSv1.1 */
-		method = (srv)? &TLSv1_1_server_method : &TLSv1_1_client_method;
+		options = SSL_OP_NO_SSL_MASK & ~SSL_OP_NO_TLSv1_1;
 		break;
 #endif
 #if defined SSL_OP_NO_TLSv1_2
 	case 9: /* TLSv1_2 */
 	case 10: /* TLSv1.2 */
-		method = (srv)? &TLSv1_2_server_method : &TLSv1_2_client_method;
+		options = SSL_OP_NO_SSL_MASK & ~SSL_OP_NO_TLSv1_2;
 		break;
 #endif
 #if HAVE_DTLS_CLIENT_METHOD
 	case 11: /* DTLS */
-		method = (srv)? &DTLS_server_method : &DTLS_client_method;
 		break;
-#endif
-#if HAVE_DTLSV1_CLIENT_METHOD
+#ifdef SSL_OP_NO_DTLSv1
 	case 12: /* DTLSv1 */
 	case 13: /* DTLSv1.0 */
-		method = (srv)? &DTLSv1_server_method : &DTLSv1_client_method;
+		options = SSL_OP_NO_DTLS_MASK & ~SSL_OP_NO_DTLSv1;
 		break;
 #endif
-#if HAVE_DTLSV1_2_CLIENT_METHOD
+#ifdef SSL_OP_NO_DTLSv1_2
 	case 14: /* DTLSv1_2 */
 	case 15: /* DTLSv1.2 */
-		method = (srv)? &DTLSv1_server_method : &DTLSv1_client_method;
+		options = SSL_OP_NO_DTLS_MASK & ~SSL_OP_NO_DTLSv1_2;
 		break;
 #endif
+#endif
 	default:
 		return luaL_argerror(L, 1, "invalid option");
 	}
 
 	ud = prepsimple(L, SSL_CTX_CLASS);
 
-	if (!(*ud = SSL_CTX_new(method())))
+	switch (method_enum) {
+	case 0: /* SSL */
+	case 1: /* TLS */
+	case 2: /* SSLv2 */
+	case 3: /* SSLv3 */
+	case 4: /* SSLv23 */
+	case 5: /* TLSv1 */
+	case 6: /* TLSv1.0 */
+	case 7: /* TLSv1_1 */
+	case 8: /* TLSv1.1 */
+	case 9: /* TLSv1_2 */
+	case 10: /* TLSv1.2 */
+		*ud = SSL_CTX_new(srv?SSLv23_server_method():SSLv23_client_method());
+		break;
+#if HAVE_DTLS_CLIENT_METHOD
+	case 11: /* DTLS */
+	case 12: /* DTLSv1 */
+	case 13: /* DTLSv1.0 */
+	case 14: /* DTLSv1_2 */
+	case 15: /* DTLSv1.2 */
+		*ud = SSL_CTX_new(srv?DTLS_server_method():DTLS_client_method());
+		break;
+#endif
+	default:
+		NOTREACHED;
+	}
+
+	if (!*ud)
 		return auxL_error(L, auxL_EOPENSSL, "ssl.context.new");
 
 	SSL_CTX_set_options(*ud, options);