Allow for selective disabling of TLSv1.1 and TLSv1.2

diff --git a/src/include/tls-h b/src/include/tls-h
index 52779e1..ccf3feb 100644 (file)
--- a/src/include/tls-h
+++ b/src/include/tls-h
@@ -350,6 +350,8 @@ struct fr_tls_server_conf_t {
        uint32_t        verify_depth;
        bool            file_type;
        bool            include_length;
+       bool            disable_tlsv1_1;
+       bool            disable_tlsv1_2;
 
        /*
         *      Always < 4096 (due to radius limit), 0 by default = 2048

diff --git a/src/main/tls.c b/src/main/tls.c
index d61df18..a2d90c4 100644 (file)
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -958,6 +958,9 @@ static CONF_PARSER tls_server_config[] = {
 #endif
 #endif
 
+       { "disable_tlsv1_1", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, fr_tls_server_conf_t, disable_tlsv1_1), NULL },
+       { "disable_tlsv1_2", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, fr_tls_server_conf_t, disable_tlsv1_2), NULL },
+
        { "cache", FR_CONF_POINTER(PW_TYPE_SUBSECTION, NULL), (void const *) cache_config },
 
        { "verify", FR_CONF_POINTER(PW_TYPE_SUBSECTION, NULL), (void const *) verify_config },
@@ -997,6 +1000,9 @@ static CONF_PARSER tls_client_config[] = {
 #endif
 #endif
 
+       { "disable_tlsv1_1", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, fr_tls_server_conf_t, disable_tlsv1_1), NULL },
+       { "disable_tlsv1_2", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, fr_tls_server_conf_t, disable_tlsv1_2), NULL },
+
        { NULL, -1, 0, NULL, NULL }        /* end the list */
 };
 
@@ -2382,10 +2388,18 @@ post_ca:
 #endif
 
        /*
-        *      Set ctx_options
+        *      We never want SSLv2 or SSLv3.
         */
        ctx_options |= SSL_OP_NO_SSLv2;
        ctx_options |= SSL_OP_NO_SSLv3;
+
+       /*
+        *      As of 3.0.5, we always allow TLSv1.1 and TLSv1.2.
+        *      Though they can be *globally* disabled if necessary.x
+        */
+       if (conf->disable_tlsv1_1) ctx_options |= SSL_OP_NO_TLSv1_1;
+       if (conf->disable_tlsv1_2) ctx_options |= SSL_OP_NO_TLSv1_2;
+
 #ifdef SSL_OP_NO_TICKET
        ctx_options |= SSL_OP_NO_TICKET ;
 #endif