TLSv1_method et al deprecated in OpenSSL 1.1.0+

[droe]

Version-specific SSL/TLS methods were deprecated in OpenSSL 1.1.0. Figure out how to control protocol support without the deprecated OpenSSL methods and migrate the code accordingly.

[sonertari]

Do you think that this means we cannot force SSL/TLS version using -r with OPENSSL_VERSION_NUMBER >= 0x10100000L? That's what I thought, hence applied the following patch to hush the warnings about those deprecated methods (on Linux):

--- a/opts.c
+++ b/opts.c
@@ -162,13 +162,14 @@
  * Calls exit() on failure.
  */
 void
-opts_proto_force(opts_t *opts, const char *optarg, const char *argv0)
+opts_proto_force(opts_t *opts, UNUSED const char *optarg, const char *argv0)
 {
 	if (opts->sslmethod != SSLv23_method) {
 		fprintf(stderr, "%s: cannot use -r multiple times\n", argv0);
 		exit(EXIT_FAILURE);
 	}
 
+#if (OPENSSL_VERSION_NUMBER < 0x10100000L) || defined(LIBRESSL_VERSION_NUMBER)
 #ifdef HAVE_SSLV2
 	if (!strcmp(optarg, "ssl2")) {
 		opts->sslmethod = SSLv2_method;
@@ -199,6 +200,11 @@
 		                argv0, optarg);
 		exit(EXIT_FAILURE);
 	}
+#else /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
+	fprintf(stderr, "%s: cannot force SSL/TLS protocol '%s' with OPENSSL_VERSION_NUMBER >= 0x10100000L, will only negotiate\n",
+					argv0, optarg);
+	exit(EXIT_FAILURE);
+#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
 }
 
 /*
@@ -247,6 +253,7 @@
 opts_proto_dbg_dump(opts_t *opts)
 {
 	log_dbg_printf("SSL/TLS protocol: %s%s%s%s%s%s\n",
+#if (OPENSSL_VERSION_NUMBER < 0x10100000L) || defined(LIBRESSL_VERSION_NUMBER)
 #ifdef HAVE_SSLV2
 	               (opts->sslmethod == SSLv2_method) ? "nossl2" :
 #endif /* HAVE_SSLV2 */
@@ -262,6 +269,7 @@
 #ifdef HAVE_TLSV12
 	               (opts->sslmethod == TLSv1_2_method) ? "tls12" :
 #endif /* HAVE_TLSV12 */
+#endif /* (OPENSSL_VERSION_NUMBER < 0x10100000L) || defined(LIBRESSL_VERSION_NUMBER) */
 	               "negotiate",
 #ifdef HAVE_SSLV2
 	               opts->no_ssl2 ? " -ssl2" :

[droe]

I suspect this may be the case, but haven't looked into it yet. Looking at the latest source of the openssl s_client command line utility may yield some clues.

[droe]

Solved by #186.