www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2025-08-08 15:02:10 +03:00
Code Activity

drop SSLv2 support (set SSL_OP_NO_SSLv2 for any new SSL_CTX)

Browse Source 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1203491 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Kaspar Brand
2011-11-18 05:27:00 +00:00
parent d83de18ca9
commit 304e9c4c08
7 changed files with 22 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
modules/ssl/ssl_engine_init.c
View File

@@ -499,7 +499,6 @@ static void ssl_init_ctx_protocol(server_rec *s,
}
cp = apr_pstrcat(p,
(protocol & SSL_PROTOCOL_SSLV2 ? "SSLv2, " : ""),
(protocol & SSL_PROTOCOL_SSLV3 ? "SSLv3, " : ""),
(protocol & SSL_PROTOCOL_TLSV1 ? "TLSv1, " : ""),
NULL);
@@ -513,13 +512,6 @@ static void ssl_init_ctx_protocol(server_rec *s,
SSLv3_client_method() : /* proxy */
SSLv3_server_method(); /* server */
}
#ifndef OPENSSL_NO_SSL2
else if (protocol == SSL_PROTOCOL_SSLV2) {
method = mctx->pkp ?
SSLv2_client_method() : /* proxy */
SSLv2_server_method(); /* server */
}
#endif
else if (protocol == SSL_PROTOCOL_TLSV1) {
method = mctx->pkp ?
TLSv1_client_method() : /* proxy */
@@ -536,9 +528,8 @@ static void ssl_init_ctx_protocol(server_rec *s,
SSL_CTX_set_options(ctx, SSL_OP_ALL);
if (!(protocol & SSL_PROTOCOL_SSLV2)) {
SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2);
}
/* always disable SSLv2, as per RFC 6176 */
SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2);
if (!(protocol & SSL_PROTOCOL_SSLV3)) {
SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv3);