commit effc92568744e89c8918f03b4f91d71f806fe9aa
author Robert Swiecki <robert@swiecki.net> Sat May 11 19:13:30 2019 +0200
committer Robert Swiecki <robert@swiecki.net> Sat May 11 19:13:30 2019 +0200
tree 46a80e4a9eb25c55c374baccff8ed8e5607cdd03
parent dfb83475879120a332450b32cf0fd415060978b0

examples/openssl: move init to CTX

examples/openssl/client.c

diff --git a/examples/openssl/client.c b/examples/openssl/client.c
index a3a85b1..a709f97 100644
--- a/examples/openssl/client.c
+++ b/examples/openssl/client.c
@@ -556,6 +556,15 @@
 #endif /* defined(HF_SSL_IS_BORINGSSL) */
 
     SSL_CTX_set_ecdh_auto(ctx, 1);
+    SSL_CTX_set_min_proto_version(ctx, SSL3_VERSION);
+    SSL_CTX_set_max_proto_version(ctx, TLS1_3_VERSION);
+#if defined(HF_SSL_IS_OPENSSL_GE_1_1)
+    SSL_CTX_enable_ct(ctx, SSL_CT_VALIDATION_STRICT);
+    SSL_CTX_set_max_early_data(ctx, 1024);
+#endif /* defined(HF_SSL_IS_OPENSSL_GE_1_1) */
+#if !defined(HF_SSL_IS_BORINGSSL)
+    SSL_CTX_set_dh_auto(ctx, 1);
+#endif /* !defined(HF_SSL_IS_BORINGSSL) */
 
     long opts = SSL_CTX_get_options(ctx);
     opts |= SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;
@@ -579,9 +588,6 @@
     SSL_set_renegotiate_mode(client, ssl_renegotiate_freely);
 #endif /* defined(HF_SSL_IS_BORINGSSL) */
 
-    SSL_set_min_proto_version(client, SSL3_VERSION);
-    SSL_set_max_proto_version(client, TLS1_3_VERSION);
-
 #if defined(HF_SSL_FROM_STDIN)
     BIO* in = BIO_new(BIO_s_fd());
     BIO_set_fd(in, 0, BIO_NOCLOSE);
@@ -597,10 +603,6 @@
     SSL_set_connect_state(client);
 
 #if defined(HF_SSL_IS_OPENSSL_GE_1_1)
-    SSL_enable_ct(client, SSL_CT_VALIDATION_PERMISSIVE);
-    SSL_set_dh_auto(client, 1);
-
-    SSL_set_max_early_data(client, 1024);
     for (;;) {
         size_t sz;
         uint8_t edata_rbuf[128];

examples/openssl/server.c

diff --git a/examples/openssl/server.c b/examples/openssl/server.c
index fe117ba..46566c0 100644
--- a/examples/openssl/server.c
+++ b/examples/openssl/server.c
@@ -612,6 +612,15 @@
     SSL_CTX_set_alpn_select_cb(ctx, alpn_callback, NULL);
     SSL_CTX_set_next_protos_advertised_cb(ctx, npn_callback, NULL);
     SSL_CTX_set_ecdh_auto(ctx, 1);
+    SSL_CTX_set_min_proto_version(ctx, SSL3_VERSION);
+    SSL_CTX_set_max_proto_version(ctx, TLS1_3_VERSION);
+#if defined(HF_SSL_IS_OPENSSL_GE_1_1)
+    SSL_CTX_enable_ct(ctx, SSL_CT_VALIDATION_STRICT);
+    SSL_CTX_set_max_early_data(ctx, 1024);
+#endif /* defined(HF_SSL_IS_OPENSSL_GE_1_1) */
+#if !defined(HF_SSL_IS_BORINGSSL)
+    SSL_CTX_set_dh_auto(ctx, 1);
+#endif /* !defined(HF_SSL_IS_BORINGSSL) */
 
     long opts = SSL_CTX_get_options(ctx);
     opts |= SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;
@@ -633,9 +642,6 @@
 
     SSL* server = SSL_new(ctx);
 
-    SSL_set_min_proto_version(server, SSL3_VERSION);
-    SSL_set_max_proto_version(server, TLS1_3_VERSION);
-
 #if defined(HF_SSL_FROM_STDIN)
     BIO* in = BIO_new(BIO_s_fd());
     BIO_set_fd(in, 0, BIO_NOCLOSE);
@@ -651,10 +657,6 @@
     SSL_set_accept_state(server);
 
 #if defined(HF_SSL_IS_OPENSSL_GE_1_1)
-    SSL_enable_ct(server, SSL_CT_VALIDATION_STRICT);
-    SSL_set_dh_auto(server, 1);
-
-    SSL_set_max_early_data(server, 1024);
     for (;;) {
         size_t sz;
         uint8_t edata_rbuf[128];