Support for Debian/Ubuntu mutilated SSLv3 support.

Ubuntu 16.04 LTS, in a misguided attempt to avoid SSLv3 without breaking
the API, does not declare SSLv3 unsupported through the headers, so
applications can only detect this situation at run-time.

The symptom is that SSL_CTX_new errors out with
SSL_R_NULL_SSL_METHOD_PASSED on the error stack, issue an additional
note telling the user to select a newer version.

1 files changed, 4 insertions, 0 deletions

diff --git a/socket.c b/socket.c
index 0187b9ec..f6a3b19c 100644
--- a/socket.c
+++ b/socket.c
@@ -1064,7 +1064,11 @@ int SSLOpen(int sock, char *mycert, char *mykey, const char *myproto, int certck
 		_ctx[sock] = SSL_CTX_new(SSLv23_client_method());
 	}
 	if(_ctx[sock] == NULL) {
+		unsigned long ec = ERR_peek_last_error();
 		ERR_print_errors_fp(stderr);
+		if (ERR_GET_REASON(ec) == SSL_R_NULL_SSL_METHOD_PASSED) {
+		    report(stderr, GT_("Note that some distributions disable older protocol versions in weird non-standard ways. Try a newer protocol version.\n"));
+		}
 		return(-1);
 	}