Merge pull request #172 from reaperhulk/add-ssl-ctx-set-get-options

add support for SSL_CTX_set_options and SSL_CTX_get_options

3 files changed, 84 insertions, 0 deletions

diff --git a/openssl/src/lib.rs b/openssl/src/lib.rs
index df998ff0..bfebc2f8 100644
--- a/openssl/src/lib.rs
+++ b/openssl/src/lib.rs
@@ -2,6 +2,9 @@
 #![cfg_attr(test, feature(net, fs))]
 #![doc(html_root_url="https://sfackler.github.io/rust-openssl/doc/openssl")]
 
+#[macro_use]
+extern crate bitflags;
+
 extern crate libc;
 #[cfg(test)]
 extern crate "rustc-serialize" as serialize;
diff --git a/openssl/src/ssl/mod.rs b/openssl/src/ssl/mod.rs
index 06e37aac..a26c0578 100644
--- a/openssl/src/ssl/mod.rs
+++ b/openssl/src/ssl/mod.rs
@@ -40,6 +40,39 @@ fn init() {
     }
 }
 
+bitflags! {
+    flags SslContextOptions: c_long {
+        const SSL_OP_LEGACY_SERVER_CONNECT = 0x00000004,
+        const SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG = 0x00000008,
+        const SSL_OP_TLSEXT_PADDING = 0x00000010,
+        const SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER = 0x00000020,
+        const SSL_OP_SAFARI_ECDHE_ECDSA_BUG = 0x00000040,
+        const SSL_OP_SSLEAY_080_CLIENT_DH_BUG = 0x00000080,
+        const SSL_OP_TLS_D5_BUG = 0x00000100,
+        const SSL_OP_TLS_BLOCK_PADDING_BUG = 0x00000200,
+        const SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS = 0x00000800,
+        const SSL_OP_ALL = 0x80000BFF,
+        const SSL_OP_NO_QUERY_MTU = 0x00001000,
+        const SSL_OP_COOKIE_EXCHANGE = 0x00002000,
+        const SSL_OP_NO_TICKET = 0x00004000,
+        const SSL_OP_CISCO_ANYCONNECT = 0x00008000,
+        const SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION = 0x00010000,
+        const SSL_OP_NO_COMPRESSION = 0x00020000,
+        const SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION = 0x00040000,
+        const SSL_OP_SINGLE_ECDH_USE = 0x00080000,
+        const SSL_OP_SINGLE_DH_USE = 0x00100000,
+        const SSL_OP_CIPHER_SERVER_PREFERENCE = 0x00400000,
+        const SSL_OP_TLS_ROLLBACK_BUG = 0x00800000,
+        const SSL_OP_NO_SSLV2 = 0x00000000,
+        const SSL_OP_NO_SSLV3 = 0x02000000,
+        const SSL_OP_NO_TLSV1 = 0x04000000,
+        const SSL_OP_NO_TLSV1_2 = 0x08000000,
+        const SSL_OP_NO_TLSV1_1 = 0x10000000,
+        const SSL_OP_NO_DTLSV1 = 0x04000000,
+        const SSL_OP_NO_DTLSV1_2 = 0x08000000
+    }
+}
+
 /// Determines the SSL method supported
 #[allow(non_camel_case_types)]
 #[derive(Copy, Clone, Debug, Hash, PartialEq, Eq)]
@@ -286,6 +319,29 @@ impl SslContext {
                 ffi::SSL_CTX_set_cipher_list(*self.ctx, cipher_list.as_ptr())
             })
     }
+
+    pub fn set_options(&mut self, option: SslContextOptions) -> SslContextOptions {
+        let raw_bits = option.bits();
+        let ret = unsafe {
+            ffi::SSL_CTX_set_options(*self.ctx, raw_bits)
+        };
+        SslContextOptions::from_bits(ret).unwrap()
+    }
+
+    pub fn get_options(&mut self) -> SslContextOptions {
+        let ret = unsafe {
+            ffi::SSL_CTX_get_options(*self.ctx)
+        };
+        SslContextOptions::from_bits(ret).unwrap()
+    }
+
+    pub fn clear_options(&mut self, option: SslContextOptions) -> SslContextOptions {
+        let raw_bits = option.bits();
+        let ret = unsafe {
+            ffi::SSL_CTX_clear_options(*self.ctx, raw_bits)
+        };
+        SslContextOptions::from_bits(ret).unwrap()
+    }
 }
 
 #[allow(dead_code)]
diff --git a/openssl/src/ssl/tests.rs b/openssl/src/ssl/tests.rs
index 41e54baa..5196b870 100644
--- a/openssl/src/ssl/tests.rs
+++ b/openssl/src/ssl/tests.rs
@@ -5,6 +5,7 @@ use std::io::prelude::*;
 use std::path::Path;
 
 use crypto::hash::Type::{SHA256};
+use ssl;
 use ssl::SslMethod::Sslv23;
 use ssl::{SslContext, SslStream, VerifyCallback};
 use ssl::SslVerifyMode::SslVerifyPeer;
@@ -175,6 +176,30 @@ fn test_verify_callback_data() {
     }
 }
 
+#[test]
+fn test_get_ctx_options() {
+    let mut ctx = SslContext::new(Sslv23).unwrap();
+    ctx.get_options();
+}
+
+#[test]
+fn test_set_ctx_options() {
+    let mut ctx = SslContext::new(Sslv23).unwrap();
+    let opts = ctx.set_options(ssl::SSL_OP_NO_TICKET);
+    assert!(opts.contains(ssl::SSL_OP_NO_TICKET));
+    assert!(!opts.contains(ssl::SSL_OP_CISCO_ANYCONNECT));
+    let more_opts = ctx.set_options(ssl::SSL_OP_CISCO_ANYCONNECT);
+    assert!(more_opts.contains(ssl::SSL_OP_NO_TICKET));
+    assert!(more_opts.contains(ssl::SSL_OP_CISCO_ANYCONNECT));
+}
+
+#[test]
+fn test_clear_ctx_options() {
+    let mut ctx = SslContext::new(Sslv23).unwrap();
+    ctx.set_options(ssl::SSL_OP_ALL);
+    let opts = ctx.clear_options(ssl::SSL_OP_ALL);
+    assert!(!opts.contains(ssl::SSL_OP_ALL));
+}
 
 #[test]
 fn test_write() {