Disable-TLS-1.1-and-older-openssl-1.0.2.patch

From cf3b5ee321a762c7de62669ce29ac377344c3697 Mon Sep 17 00:00:00 2001
From: Matyas Selmeci <matyas@cs.wisc.edu>
Date: Wed, 18 Sep 2019 17:25:12 -0500
Subject: [PATCH] Disable TLS 1.1 and older (openssl 1.0.2)

This method is deprecated (but not removed) in openssl 1.1
---
 src/socklib/Server.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/socklib/Server.cpp b/src/socklib/Server.cpp
index e893612..024e7d2 100644
--- a/src/socklib/Server.cpp
+++ b/src/socklib/Server.cpp
@@ -327,6 +327,10 @@ GSISocketServer::AcceptGSIAuthentication()
   SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, proxy_verify_callback);
   SSL_CTX_set_verify_depth(ctx, 100);
   SSL_CTX_set_cert_verify_callback(ctx, proxy_app_verify_callback, 0);
+  if (!SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1)) {
+    SetErrorOpenSSL("Cannot set minimum TLS protocol version");
+    goto err;
+  }
 
   if (own_stack) {
     /*
-- 
2.6.3