diff options
| author | Anton <anton@picapica.im> | 2026-08-24 05:05:29 +0400 |
|---|---|---|
| committer | Anton <anton@picapica.im> | 2026-08-24 05:05:29 +0400 |
| commit | 5c5fe2b41da2f4f1da32b12909a9b982e5dec70a (patch) | |
| tree | 8fd45b361da382ae689c0c2cf7c54f52eb9765ad /PICA_client.c | |
| parent | 1f9da8f90605b844b635505b0379ee7732345948 (diff) | |
| download | pica-pica-5c5fe2b41da2f4f1da32b12909a9b982e5dec70a.tar.gz pica-pica-5c5fe2b41da2f4f1da32b12909a9b982e5dec70a.zip | |
Build against OpenSSL 4.0: replace TLSv1_2_method()
TLSv1_2_method() was deprecated in OpenSSL 1.1.0 and is gone from 4.0, which
is what MXE now builds, so the Windows cross build failed to link it.
The replacement is TLS_method() plus an explicit version range. Pinning both
ends of that range to 1.2 is not tidiness, it is what keeps the protocol where
it was: PICA_TLS_CIPHERLIST and PICA_TLS_ANONDHCIPHERLIST both name TLS 1.2
suites, TLS 1.3 has no anonymous key exchange at all, and
SSL_CTX_set_cipher_list() has no say over which 1.3 suites get used. Letting
1.3 be negotiated would quietly ignore the first list and leave the second
with nothing to offer.
The range lives in PICA_security.h with the other security parameters, so
raising it later is a deliberate edit in one place rather than a side effect.
Also carries a PICA_TIMETOLERANCE define that was already in the tree.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CBqDgvq3Ty6C6BjLFH16bw
Diffstat (limited to 'PICA_client.c')
| -rw-r--r-- | PICA_client.c | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/PICA_client.c b/PICA_client.c index c8a873e..3218dbb 100644 --- a/PICA_client.c +++ b/PICA_client.c @@ -1516,7 +1516,11 @@ int PICA_open_acc(const char *cert_file, a->cert_file = strdup(cert_file); a->password_cb = password_cb; +#if OPENSSL_VERSION_NUMBER >= 0x10100000L + a->ctx = SSL_CTX_new(TLS_method());//(2) +#else a->ctx = SSL_CTX_new(TLSv1_2_method());//(2) +#endif if (!a->ctx) { @@ -1524,7 +1528,11 @@ int PICA_open_acc(const char *cert_file, goto error_ret_1; } +#if OPENSSL_VERSION_NUMBER >= 0x10100000L + a->anon_ctx = SSL_CTX_new(TLS_method());//(3) +#else a->anon_ctx = SSL_CTX_new(TLSv1_2_method());//(3) +#endif if (!a->anon_ctx) { @@ -1532,6 +1540,22 @@ int PICA_open_acc(const char *cert_file, goto error_ret_2; } +#if OPENSSL_VERSION_NUMBER >= 0x10100000L + /* TLS_method() on its own would negotiate the highest version both ends + * know. Narrowing it back to 1.2 is what keeps this the same protocol + * TLSv1_2_method() used to give - see PICA_TLS_MINVERSION for why the + * ceiling matters as much as the floor. + */ + if (!SSL_CTX_set_min_proto_version(a->ctx, PICA_TLS_MINVERSION) || + !SSL_CTX_set_max_proto_version(a->ctx, PICA_TLS_MAXVERSION) || + !SSL_CTX_set_min_proto_version(a->anon_ctx, PICA_TLS_MINVERSION) || + !SSL_CTX_set_max_proto_version(a->anon_ctx, PICA_TLS_MAXVERSION)) + { + ret_err = PICA_ERRSSL; + goto error_ret_3; + } +#endif + /* mediac2c connections, see PICA_media.h. Not fatal if it cannot be * created - calls then keep their media on the c2c connection. */ |