gh-95095: Use SSL_CTX_get_max_proto_version instead of SSL_CTX_ctrl (GH-95096)

davidben · web-flow · commit 936f71e5d4f5 · 2022-07-21T11:44:30.000-07:00
The wrapper macros are more readable and match the form recommended in the OpenSSL documentation. They also slightly less error-prone, as the mapping of arguments to SSL_CTX_ctrl is not always clear. (Though in this case it's straightforward.) https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_get_max_proto_version.html
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
@@ -3515,7 +3515,7 @@ set_min_max_proto_version(PySSLContext *self, PyObject *arg, int what)
 static PyObject *
 get_minimum_version(PySSLContext *self, void *c)
 {
-    int v = SSL_CTX_ctrl(self->ctx, SSL_CTRL_GET_MIN_PROTO_VERSION, 0, NULL);
+    int v = SSL_CTX_get_min_proto_version(self->ctx);
     if (v == 0) {
         v = PY_PROTO_MINIMUM_SUPPORTED;
     }
@@ -3531,7 +3531,7 @@ set_minimum_version(PySSLContext *self, PyObject *arg, void *c)
 static PyObject *
 get_maximum_version(PySSLContext *self, void *c)
 {
-    int v = SSL_CTX_ctrl(self->ctx, SSL_CTRL_GET_MAX_PROTO_VERSION, 0, NULL);
+    int v = SSL_CTX_get_max_proto_version(self->ctx);
     if (v == 0) {
         v = PY_PROTO_MAXIMUM_SUPPORTED;
     }

Original file line number	Diff line number	Diff line change
`@@ -3515,7 +3515,7 @@ set_min_max_proto_version(PySSLContext self, PyObject arg, int what)`
`3515`	`3515`	`static PyObject *`
`3516`	`3516`	`get_minimum_version(PySSLContext self, void c)`
`3517`	`3517`	`{`
`3518`		`- int v = SSL_CTX_ctrl(self->ctx, SSL_CTRL_GET_MIN_PROTO_VERSION, 0, NULL);`
	`3518`	`+ int v = SSL_CTX_get_min_proto_version(self->ctx);`
`3519`	`3519`	`if (v == 0) {`
`3520`	`3520`	`v = PY_PROTO_MINIMUM_SUPPORTED;`
`3521`	`3521`	`}`
`@@ -3531,7 +3531,7 @@ set_minimum_version(PySSLContext self, PyObject arg, void *c)`
`3531`	`3531`	`static PyObject *`
`3532`	`3532`	`get_maximum_version(PySSLContext self, void c)`
`3533`	`3533`	`{`
`3534`		`- int v = SSL_CTX_ctrl(self->ctx, SSL_CTRL_GET_MAX_PROTO_VERSION, 0, NULL);`
	`3534`	`+ int v = SSL_CTX_get_max_proto_version(self->ctx);`
`3535`	`3535`	`if (v == 0) {`
`3536`	`3536`	`v = PY_PROTO_MAXIMUM_SUPPORTED;`
`3537`	`3537`	`}`