zeroc-ice 3.7.0 → 3.7.5

data/ext/ice/cpp/src/IceSSL/ConnectorI.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/ConnectorI.h>
 #include <IceSSL/Instance.h>
@@ -31,9 +26,7 @@ IceSSL::ConnectorI::connect()
     //
     if(!_instance->initialized())
     {
-        PluginInitializationException ex(__FILE__, __LINE__);
-        ex.reason = "IceSSL: plug-in is not initialized";
-        throw ex;
+        throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: plug-in is not initialized");
     }
 
     return _instance->engine()->createTransceiver(_instance, _delegate->connect(), _host, false);

data/ext/ice/cpp/src/IceSSL/ConnectorI.h

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_CONNECTOR_I_H
 #define ICESSL_CONNECTOR_I_H

data/ext/ice/cpp/src/IceSSL/EndpointI.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/EndpointI.h>
 #include <IceSSL/AcceptorI.h>
@@ -58,7 +53,7 @@ IceSSL::EndpointI::streamWriteImpl(Ice::OutputStream* stream) const
 }
 
 Ice::EndpointInfoPtr
-IceSSL::EndpointI::getInfo() const
+IceSSL::EndpointI::getInfo() const ICE_NOEXCEPT
 {
     EndpointInfoPtr info = ICE_MAKE_SHARED(IceInternal::InfoI<EndpointInfo>, ICE_SHARED_FROM_CONST_THIS(EndpointI));
     info->underlying = _delegate->getInfo();
@@ -342,36 +337,36 @@ IceSSL::EndpointI::operator<(const Ice::LocalObject& r) const
 }
 
 bool
-IceSSL::EndpointI::checkOption(const string& option, const string& argument, const string& endpoint)
+IceSSL::EndpointI::checkOption(const string& /*option*/, const string& /*argument*/, const string& /*endpoint*/)
 {
     return false;
 }
 
 IceSSL::EndpointFactoryI::EndpointFactoryI(const InstancePtr& instance, Short type) :
-    IceInternal::EndpointFactoryWithUnderlying(instance, type), _instance(instance.get())
+    IceInternal::EndpointFactoryWithUnderlying(instance, type), _sslInstance(instance.get())
 {
 }
 
 void
 IceSSL::EndpointFactoryI::destroy()
 {
-    _instance = 0;
+    _sslInstance = 0;
 }
 
 IceInternal::EndpointFactoryPtr
 IceSSL::EndpointFactoryI::cloneWithUnderlying(const IceInternal::ProtocolInstancePtr& instance, Short underlying) const
 {
-    return new EndpointFactoryI(new Instance(_instance->engine(), instance->type(), instance->protocol()), underlying);
+    return new EndpointFactoryI(new Instance(_sslInstance->engine(), instance->type(), instance->protocol()), underlying);
 }
 
 IceInternal::EndpointIPtr
 IceSSL::EndpointFactoryI::createWithUnderlying(const IceInternal::EndpointIPtr& underlying, vector<string>&, bool) const
 {
-    return ICE_MAKE_SHARED(EndpointI, _instance, underlying);
+    return ICE_MAKE_SHARED(EndpointI, _sslInstance, underlying);
 }
 
 IceInternal::EndpointIPtr
-IceSSL::EndpointFactoryI::readWithUnderlying(const IceInternal::EndpointIPtr& underlying, Ice::InputStream* s) const
+IceSSL::EndpointFactoryI::readWithUnderlying(const IceInternal::EndpointIPtr& underlying, Ice::InputStream*) const
 {
-    return ICE_MAKE_SHARED(EndpointI, _instance, underlying);
+    return ICE_MAKE_SHARED(EndpointI, _sslInstance, underlying);
 }

data/ext/ice/cpp/src/IceSSL/EndpointI.h

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_ENDPOINT_I_H
 #define ICESSL_ENDPOINT_I_H
@@ -32,7 +27,7 @@ public:
 
     virtual void streamWriteImpl(Ice::OutputStream*) const;
 
-    virtual Ice::EndpointInfoPtr getInfo() const;
+    virtual Ice::EndpointInfoPtr getInfo() const ICE_NOEXCEPT;
     virtual Ice::Short type() const;
     virtual const std::string& protocol() const;
 
@@ -97,7 +92,7 @@ protected:
 
 private:
 
-    InstancePtr _instance;
+    InstancePtr _sslInstance;
 };
 
 }

data/ext/ice/cpp/src/IceSSL/EndpointInfo.cpp

@@ -1,13 +1,8 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
 //
-// **********************************************************************
-//
-// Ice version 3.7.0
+// Ice version 3.7.5
 //
 // <auto-generated>
 //
@@ -39,10 +34,10 @@
 #   if ICE_INT_VERSION / 100 != 307
 #       error Ice version mismatch!
 #   endif
-#   if ICE_INT_VERSION % 100 > 50
+#   if ICE_INT_VERSION % 100 >= 50
 #       error Beta header file detected
 #   endif
-#   if ICE_INT_VERSION % 100 < 0
+#   if ICE_INT_VERSION % 100 < 5
 #       error Ice patch level mismatch!
 #   endif
 #endif
@@ -69,7 +64,9 @@ IceSSL::EndpointInfo::~EndpointInfo()
 {
 }
 
-ICESSL_API ::Ice::LocalObject* IceSSL::upCast(::IceSSL::EndpointInfo* p) { return p; }
+/// \cond INTERNAL
+ICESSL_API ::Ice::LocalObject* IceSSL::upCast(EndpointInfo* p) { return p; }
+/// \endcond
 
 namespace Ice
 {

data/ext/ice/cpp/src/IceSSL/Instance.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/Instance.h>
 #include <IceSSL/SSLEngine.h>

data/ext/ice/cpp/src/IceSSL/Instance.h

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_INSTANCE_H
 #define ICESSL_INSTANCE_H

data/ext/ice/cpp/src/IceSSL/InstanceF.h

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_INSTANCE_F_H
 #define ICESSL_INSTANCE_F_H

data/ext/ice/cpp/src/IceSSL/OpenSSLCertificateI.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/Plugin.h>
 #include <IceSSL/OpenSSL.h>
@@ -214,26 +209,23 @@ ASMUtcTimeToTime(const ASN1_UTCTIME* s)
     }
 #  undef g2
 
-    //
-    // If timegm was on all systems this code could be
-    // return IceUtil::Time::seconds(timegm(&tm) - offset*60);
-    //
-    // Windows doesn't support the re-entrant _r versions.
-    //
-#if defined(_MSC_VER)
-#   pragma warning(disable:4996) // localtime is depercated
-#endif
     time_t tzone;
     {
         IceUtilInternal::MutexPtrLock<IceUtil::Mutex> sync(mut);
         time_t now = time(0);
-        tzone = mktime(localtime(&now)) - mktime(gmtime(&now));
-    }
+        struct tm localTime;
+        struct tm gmTime;
 #if defined(_MSC_VER)
-#   pragma warning(default:4996) // localtime is depercated
+        localtime_s(&localTime, &now);
+        gmtime_s(&gmTime, &now);
+#else
+        localtime_r(&now, &localTime);
+        gmtime_r(&now, &gmTime);
 #endif
+        tzone = mktime(&localTime) - mktime(&gmTime);
+    }
 
-    IceUtil::Time time = IceUtil::Time::seconds(mktime(&tm) - offset * 60 + tzone);
+    IceUtil::Time time = IceUtil::Time::seconds(mktime(&tm) - IceUtil::Int64(offset) * 60 + tzone);
 
 #ifdef ICE_CPP11_MAPPING
     return chrono::system_clock::time_point(chrono::microseconds(time.toMicroSeconds()));

data/ext/ice/cpp/src/IceSSL/OpenSSLEngine.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/Config.h>
 
@@ -31,6 +26,10 @@
 #include <openssl/ssl.h>
 #include <openssl/pkcs12.h>
 
+#ifdef _MSC_VER
+#   pragma warning(disable:4127) // conditional expression is constant
+#endif
+
 using namespace std;
 using namespace Ice;
 using namespace IceSSL;
@@ -85,7 +84,7 @@ IceSSL_opensslThreadIdCallback()
     // On some platforms, pthread_t is a pointer to a per-thread structure.
     //
     return reinterpret_cast<unsigned long>(pthread_self());
-#  elif defined(__linux) || defined(__sun) || defined(__hpux) || defined(_AIX) || defined(__GLIBC__)
+#  elif defined(__linux__) || defined(__sun) || defined(__hpux) || defined(_AIX) || defined(__GLIBC__)
     //
     // On Linux, Solaris, HP-UX and AIX, pthread_t is an integer.
     //
@@ -201,8 +200,6 @@ OpenSSL::SSLEngine::SSLEngine(const CommunicatorPtr& communicator) :
     IceSSL::SSLEngine(communicator),
     _ctx(0)
 {
-    __setNoDelete(true);
-
     //
     // Initialize OpenSSL if necessary.
     //
@@ -279,6 +276,7 @@ OpenSSL::SSLEngine::SSLEngine(const CommunicatorPtr& communicator) :
 
                 if(!IceUtilInternal::splitString(randFiles, IceUtilInternal::pathsep, files))
                 {
+                    cleanup();
                     throw PluginInitializationException(__FILE__, __LINE__,
                                                         "IceSSL: invalid value for IceSSL.Random:\n" + randFiles);
                 }
@@ -288,11 +286,13 @@ OpenSSL::SSLEngine::SSLEngine(const CommunicatorPtr& communicator) :
                     string resolved;
                     if(!checkPath(file, defaultDir, false, resolved))
                     {
+                        cleanup();
                         throw PluginInitializationException(__FILE__, __LINE__,
                                                             "IceSSL: entropy data file not found:\n" + file);
                     }
                     if(!RAND_load_file(resolved.c_str(), 1024))
                     {
+                        cleanup();
                         throw PluginInitializationException(__FILE__, __LINE__,
                                                             "IceSSL: unable to load entropy data from " + resolved);
                     }
@@ -308,6 +308,7 @@ OpenSSL::SSLEngine::SSLEngine(const CommunicatorPtr& communicator) :
             {
                 if(RAND_egd(entropyDaemon.c_str()) <= 0)
                 {
+                    cleanup();
                     throw PluginInitializationException(__FILE__, __LINE__,
                                                         "IceSSL: EGD failure using file " + entropyDaemon);
                 }
@@ -332,21 +333,24 @@ OpenSSL::SSLEngine::SSLEngine(const CommunicatorPtr& communicator) :
 #endif
         }
     }
-    __setNoDelete(false);
 }
 
-OpenSSL::SSLEngine::~SSLEngine()
+void
+OpenSSL::SSLEngine::cleanup()
 {
-//
-// OpenSSL 1.1.0 remove the need for library initialization and cleanup.
-//
+    //
+    // Must be called with the static mutex locked.
+    //
+    --instanceCount;
+    //
+    // OpenSSL 1.1.0 remove the need for library initialization and cleanup. We
+    // still need to decrement instanceCount
+    //
 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
     //
     // Clean up OpenSSL resources.
     //
-    IceUtilInternal::MutexPtrLock<IceUtil::Mutex> sync(staticMutex);
-
-    if(--instanceCount == 0 && initOpenSSL)
+    if(instanceCount == 0 && initOpenSSL)
     {
         //
         // NOTE: We can't destroy the locks here: threads which might have called openssl methods
@@ -366,6 +370,12 @@ OpenSSL::SSLEngine::~SSLEngine()
 #endif
 }
 
+OpenSSL::SSLEngine::~SSLEngine()
+{
+    IceUtilInternal::MutexPtrLock<IceUtil::Mutex> sync(staticMutex);
+    cleanup();
+}
+
 void
 OpenSSL::SSLEngine::initialize()
 {
@@ -387,9 +397,21 @@ OpenSSL::SSLEngine::initialize()
         // TLS1.1 and TLS1.2 to avoid security issues with SSLv3
         //
         vector<string> defaultProtocols;
+#if defined(TLS1_VERSION) && !defined(OPENSSL_NO_TLS1_METHOD)
         defaultProtocols.push_back("tls1_0");
+#endif
+
+#if defined(TLS1_1_VERSION) && !defined(OPENSSL_NO_TLS1_1_METHOD)
         defaultProtocols.push_back("tls1_1");
+#endif
+
+#if defined(TLS1_2_VERSION) && !defined(OPENSSL_NO_TLS1_2_METHOD)
         defaultProtocols.push_back("tls1_2");
+#endif
+
+#if defined(TLS1_3_VERSION) && !defined(OPENSSL_NO_TLS1_3_METHOD)
+        defaultProtocols.push_back("tls1_3");
+#endif
 
         const int protocols =
                 parseProtocols(properties->getPropertyAsListWithDefault(propPrefix + "Protocols", defaultProtocols));
@@ -485,7 +507,7 @@ OpenSSL::SSLEngine::initialize()
                     while(count < passwordRetryMax)
                     {
                         ERR_clear_error();
-                        if((success = SSL_CTX_load_verify_locations(_ctx, file, dir)) || !passwordError())
+                        if((success = SSL_CTX_load_verify_locations(_ctx, file, dir)) != 0 || !passwordError())
                         {
                             break;
                         }
@@ -529,8 +551,9 @@ OpenSSL::SSLEngine::initialize()
                 vector<string> files;
                 if(!IceUtilInternal::splitString(certFile, IceUtilInternal::pathsep, files) || files.size() > 2)
                 {
-                    PluginInitializationException ex(__FILE__, __LINE__,
-                                            "IceSSL: invalid value for " + propPrefix + "CertFile:\n" + certFile);
+                    throw PluginInitializationException(__FILE__, __LINE__,
+                                                        "IceSSL: invalid value for " + propPrefix + "CertFile:\n" +
+                                                        certFile);
                 }
                 numCerts = files.size();
                 for(vector<string>::iterator p = files.begin(); p != files.end(); ++p)
@@ -539,8 +562,8 @@ OpenSSL::SSLEngine::initialize()
                     string resolved;
                     if(!checkPath(file, defaultDir, false, resolved))
                     {
-                        PluginInitializationException ex(__FILE__, __LINE__,
-                                                         "IceSSL: certificate file not found:\n" + file);
+                        throw PluginInitializationException(__FILE__, __LINE__,
+                                                            "IceSSL: certificate file not found:\n" + file);
                     }
                     file = resolved;
 
@@ -573,7 +596,7 @@ OpenSSL::SSLEngine::initialize()
                                 key = 0;
                                 cert = 0;
                                 chain = 0;
-                                if(!(success = PKCS12_parse(p12, password(false).c_str(), &key, &cert, &chain)))
+                                if((success = PKCS12_parse(p12, password(false).c_str(), &key, &cert, &chain)) == 0)
                                 {
                                     if(passwordError())
                                     {
@@ -586,14 +609,14 @@ OpenSSL::SSLEngine::initialize()
                                 if(!cert || !SSL_CTX_use_certificate(_ctx, cert))
                                 {
                                     throw PluginInitializationException(__FILE__, __LINE__,
-                                                                "IceSSL: unable to establish SSL certificate:\n" +
+                                                                "IceSSL: unable to load SSL certificate:\n" +
                                                                 (cert ? sslErrors() : "certificate not found"));
                                 }
 
                                 if(!key || !SSL_CTX_use_PrivateKey(_ctx, key))
                                 {
                                     throw PluginInitializationException(__FILE__, __LINE__,
-                                                                "IceSSL: unable to establish SSL private key:\n" +
+                                                                "IceSSL: unable to load SSL private key:\n" +
                                                                 (key ? sslErrors() : "key not found"));
                                 }
                                 keyLoaded = true;
@@ -655,7 +678,7 @@ OpenSSL::SSLEngine::initialize()
                         while(count < passwordRetryMax)
                         {
                             ERR_clear_error();
-                            if(!(success = SSL_CTX_use_certificate_chain_file(_ctx, file.c_str())))
+                            if((success = SSL_CTX_use_certificate_chain_file(_ctx, file.c_str())) == 0)
                             {
                                 if(passwordError())
                                 {
@@ -737,10 +760,10 @@ OpenSSL::SSLEngine::initialize()
                         }
                         else
                         {
-                            string err = sslErrors();
-                            if(!err.empty())
+                            string errStr = sslErrors();
+                            if(!errStr.empty())
                             {
-                                msg += ":\n" + err;
+                                msg += ":\n" + errStr;
                             }
                         }
                         throw PluginInitializationException(__FILE__, __LINE__, msg);
@@ -836,13 +859,13 @@ OpenSSL::SSLEngine::initialize()
         //
         // Establish the cipher list.
         //
-        string ciphers = properties->getProperty(propPrefix + "Ciphers");
-        if(!ciphers.empty())
+        string ciphersStr = properties->getProperty(propPrefix + "Ciphers");
+        if(!ciphersStr.empty())
         {
-            if(!SSL_CTX_set_cipher_list(_ctx, ciphers.c_str()))
+            if(!SSL_CTX_set_cipher_list(_ctx, ciphersStr.c_str()))
             {
                 throw PluginInitializationException(__FILE__, __LINE__,
-                                        "IceSSL: unable to set ciphers using `" + ciphers + "':\n" + sslErrors());
+                                        "IceSSL: unable to set ciphers using `" + ciphersStr + "':\n" + sslErrors());
             }
         }
 
@@ -908,22 +931,10 @@ OpenSSL::SSLEngine::destroy()
     if(_ctx)
     {
         SSL_CTX_free(_ctx);
+        _ctx = 0;
     }
 }
 
-void
-OpenSSL::SSLEngine::verifyPeer(const string& address, const IceSSL::ConnectionInfoPtr& info, const string& desc)
-{
-#if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER < 0x10002000L
-    //
-    // Peer hostname verification is new in OpenSSL 1.0.2 for older versions
-    //  we use IceSSL build in hostname verification.
-    //
-    verifyPeerCertName(address, info);
-#endif
-    IceSSL::SSLEngine::verifyPeer(address, info, desc);
-}
-
 IceInternal::TransceiverPtr
 OpenSSL::SSLEngine::createTransceiver(const InstancePtr& instance,
                                       const IceInternal::TransceiverPtr& delegate,
@@ -951,19 +962,48 @@ OpenSSL::SSLEngine::parseProtocols(const StringSeq& protocols) const
         string prot = IceUtilInternal::toUpper(*p);
         if(prot == "SSL3" || prot == "SSLV3")
         {
+#if defined(OPENSSL_NO_SSL3_METHOD) || !defined(SSL3_VERSION)
+            throw PluginInitializationException(__FILE__, __LINE__,
+                                                "IceSSL: OpenSSL was build without SSLv3 support");
+#else
             v |= SSLv3;
+#endif
         }
         else if(prot == "TLS" || prot == "TLS1" || prot == "TLSV1" || prot == "TLS1_0" || prot == "TLSV1_0")
         {
+#if defined(OPENSSL_NO_TLS1_METHOD) || !defined(TLS1_VERSION)
+            throw PluginInitializationException(__FILE__, __LINE__,
+                                                "IceSSL: OpenSSL was build without TLS 1.0 support");
+#else
             v |= TLSv1_0;
+#endif
         }
         else if(prot == "TLS1_1" || prot == "TLSV1_1")
         {
+#if defined(OPENSSL_NO_TLS1_1_METHOD) || !defined(TLS1_1_VERSION)
+            throw PluginInitializationException(__FILE__, __LINE__,
+                                                "IceSSL: OpenSSL was build without TLS 1.1 support");
+#else
             v |= TLSv1_1;
+#endif
         }
         else if(prot == "TLS1_2" || prot == "TLSV1_2")
         {
+#if defined(OPENSSL_NO_TLS1_2_METHOD) || !defined(TLS1_2_VERSION)
+            throw PluginInitializationException(__FILE__, __LINE__,
+                                                "IceSSL: OpenSSL was build without TLS 1.2 support");
+#else
             v |= TLSv1_2;
+#endif
+        }
+        else if(prot == "TLS1_3" || prot == "TLSV1_3")
+        {
+#if defined(OPENSSL_NO_TLS1_3_METHOD) || !defined(TLS1_3_VERSION)
+            throw PluginInitializationException(__FILE__, __LINE__,
+                                                "IceSSL: OpenSSL was build without TLS 1.3 support");
+#else
+            v |= TLSv1_3;
+#endif
         }
         else
         {
@@ -1002,14 +1042,21 @@ void
 OpenSSL::SSLEngine::setOptions(int protocols)
 {
     long opts = SSL_OP_NO_SSLv2; // SSLv2 is not supported.
+
+#ifdef SSL_OP_NO_SSLv3
     if(!(protocols & SSLv3))
     {
         opts |= SSL_OP_NO_SSLv3;
     }
+#endif
+
+#ifdef SSL_OP_NO_TLSv1
     if(!(protocols & TLSv1_0))
     {
         opts |= SSL_OP_NO_TLSv1;
     }
+#endif
+
 #ifdef SSL_OP_NO_TLSv1_1
     if(!(protocols & TLSv1_1))
     {
@@ -1030,5 +1077,12 @@ OpenSSL::SSLEngine::setOptions(int protocols)
         opts |= SSL_OP_NO_TLSv1_2;
     }
 #endif
+
+#ifdef SSL_OP_NO_TLSv1_3
+    if(!(protocols & TLSv1_3))
+    {
+        opts |= SSL_OP_NO_TLSv1_3;
+    }
+#endif
     SSL_CTX_set_options(_ctx, opts);
 }