|
 |
906948 |
diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
|
|
|
906948 |
index 979489c..3d6443b 100644
|
|
|
906948 |
--- a/modules/ssl/ssl_engine_config.c
|
|
|
906948 |
+++ b/modules/ssl/ssl_engine_config.c
|
|
|
906948 |
@@ -1485,6 +1485,10 @@ static const char *ssl_cmd_protocol_parse(cmd_parms *parms,
|
|
|
906948 |
#endif
|
|
|
906948 |
else if (strcEQ(w, "all")) {
|
|
|
906948 |
thisopt = SSL_PROTOCOL_ALL;
|
|
|
906948 |
+#ifndef OPENSSL_NO_SSL3
|
|
|
906948 |
+ /* by default, ALL kw doesn't turn on SSLv3 */
|
|
|
906948 |
+ thisopt &= ~SSL_PROTOCOL_SSLV3;
|
|
|
906948 |
+#endif
|
|
|
906948 |
}
|
|
|
906948 |
else {
|
|
|
906948 |
return apr_pstrcat(parms->temp_pool,
|
|
|
906948 |
diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
|
|
|
906948 |
index b0fcf81..ab6f263 100644
|
|
|
906948 |
--- a/modules/ssl/ssl_engine_init.c
|
|
|
906948 |
+++ b/modules/ssl/ssl_engine_init.c
|
|
|
906948 |
@@ -568,6 +568,28 @@ static apr_status_t ssl_init_ctx_tls_extensions(server_rec *s,
|
|
|
906948 |
}
|
|
|
906948 |
#endif
|
|
|
906948 |
|
|
|
906948 |
+/*
|
|
|
906948 |
+ * Enable/disable SSLProtocol. If the mod_ssl enables protocol
|
|
|
906948 |
+ * which is disabled by default by OpenSSL, show a warning.
|
|
|
906948 |
+ * "option" is for example SSL_OP_NO_SSLv3.
|
|
|
906948 |
+ */
|
|
|
906948 |
+static void ssl_set_ctx_protocol_option(server_rec *s,
|
|
|
906948 |
+ SSL_CTX *ctx,
|
|
|
906948 |
+ long option,
|
|
|
906948 |
+ int enabled,
|
|
|
906948 |
+ const char *name)
|
|
|
906948 |
+{
|
|
|
906948 |
+ if (!enabled) {
|
|
|
906948 |
+ SSL_CTX_set_options(ctx, option);
|
|
|
906948 |
+ }
|
|
|
906948 |
+ else if (SSL_CTX_get_options(ctx) & option) {
|
|
|
906948 |
+ SSL_CTX_clear_options(ctx, option);
|
|
|
906948 |
+ ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s, APLOGNO(02904)
|
|
|
906948 |
+ "Allowing SSLProtocol %s even though it is disabled "
|
|
|
906948 |
+ "by OpenSSL by default on this system", name);
|
|
|
906948 |
+ }
|
|
|
906948 |
+}
|
|
|
906948 |
+
|
|
|
906948 |
static apr_status_t ssl_init_ctx_protocol(server_rec *s,
|
|
|
906948 |
apr_pool_t *p,
|
|
|
906948 |
apr_pool_t *ptemp,
|
|
|
906948 |
@@ -735,9 +757,13 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
|
|
|
906948 |
}
|
|
|
906948 |
if (prot == TLS1_1_VERSION && protocol & SSL_PROTOCOL_TLSV1) {
|
|
|
906948 |
prot = TLS1_VERSION;
|
|
|
906948 |
+ ssl_set_ctx_protocol_option(s, ctx, SSL_OP_NO_TLSv1,
|
|
|
906948 |
+ protocol & SSL_PROTOCOL_TLSV1, "TLSv1");
|
|
|
906948 |
}
|
|
|
906948 |
#ifndef OPENSSL_NO_SSL3
|
|
|
906948 |
if (prot == TLS1_VERSION && protocol & SSL_PROTOCOL_SSLV3) {
|
|
|
906948 |
+ ssl_set_ctx_protocol_option(s, ctx, SSL_OP_NO_SSLv3,
|
|
|
906948 |
+ protocol & SSL_PROTOCOL_SSLV3, "SSLv3");
|
|
|
906948 |
prot = SSL3_VERSION;
|
|
|
906948 |
}
|
|
|
906948 |
#endif
|