|
 |
0e3136 |
diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
|
|
|
0e3136 |
index 27e7a53..b53f3f8 100644
|
|
|
0e3136 |
--- a/modules/ssl/ssl_engine_config.c
|
|
|
0e3136 |
+++ b/modules/ssl/ssl_engine_config.c
|
|
|
0e3136 |
@@ -119,7 +119,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p)
|
|
|
0e3136 |
mctx->ticket_key = NULL;
|
|
|
0e3136 |
#endif
|
|
|
0e3136 |
|
|
|
0e3136 |
- mctx->protocol = SSL_PROTOCOL_DEFAULT;
|
|
|
0e3136 |
+ mctx->protocol = SSL_PROTOCOL_NONE;
|
|
|
0e3136 |
mctx->protocol_set = 0;
|
|
|
0e3136 |
|
|
|
0e3136 |
mctx->pphrase_dialog_type = SSL_PPTYPE_UNSET;
|
|
|
0e3136 |
@@ -263,6 +263,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p,
|
|
|
0e3136 |
if (add->protocol_set) {
|
|
|
0e3136 |
mrg->protocol_set = 1;
|
|
|
0e3136 |
mrg->protocol = add->protocol;
|
|
|
0e3136 |
+ mrg->protocol_set = 1;
|
|
|
0e3136 |
}
|
|
|
0e3136 |
else {
|
|
|
0e3136 |
mrg->protocol_set = base->protocol_set;
|
|
|
0e3136 |
|
|
|
0e3136 |
diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
|
|
|
0e3136 |
index bfad47a..b0fcf81 100644
|
|
|
0e3136 |
--- a/modules/ssl/ssl_engine_init.c
|
|
|
0e3136 |
+++ b/modules/ssl/ssl_engine_init.c
|
|
|
0e3136 |
@@ -577,6 +577,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
|
|
|
0e3136 |
MODSSL_SSL_METHOD_CONST SSL_METHOD *method = NULL;
|
|
|
0e3136 |
char *cp;
|
|
|
0e3136 |
int protocol = mctx->protocol;
|
|
|
0e3136 |
+ int protocol_set = mctx->protocol_set;
|
|
|
0e3136 |
SSLSrvConfigRec *sc = mySrvConfig(s);
|
|
|
0e3136 |
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
|
|
|
0e3136 |
int prot;
|
|
|
0e3136 |
@@ -586,12 +587,18 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
|
|
|
0e3136 |
* Create the new per-server SSL context
|
|
|
0e3136 |
*/
|
|
|
0e3136 |
if (protocol == SSL_PROTOCOL_NONE) {
|
|
|
0e3136 |
- ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02231)
|
|
|
0e3136 |
- "No SSL protocols available [hint: SSLProtocol]");
|
|
|
0e3136 |
- return ssl_die(s);
|
|
|
0e3136 |
- }
|
|
|
0e3136 |
+ if (protocol_set) {
|
|
|
0e3136 |
+ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02231)
|
|
|
0e3136 |
+ "No SSL protocols available [hint: SSLProtocol]");
|
|
|
0e3136 |
+ return ssl_die(s);
|
|
|
0e3136 |
+ }
|
|
|
0e3136 |
|
|
|
0e3136 |
- cp = apr_pstrcat(p,
|
|
|
0e3136 |
+ ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s,
|
|
|
0e3136 |
+ "Using OpenSSL/system default SSL/TLS protocols");
|
|
|
0e3136 |
+ cp = "default";
|
|
|
0e3136 |
+ }
|
|
|
0e3136 |
+ else {
|
|
|
0e3136 |
+ cp = apr_pstrcat(p,
|
|
|
0e3136 |
#ifndef OPENSSL_NO_SSL3
|
|
|
0e3136 |
(protocol & SSL_PROTOCOL_SSLV3 ? "SSLv3, " : ""),
|
|
|
0e3136 |
#endif
|
|
|
0e3136 |
@@ -604,7 +611,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
|
|
|
0e3136 |
#endif
|
|
|
0e3136 |
#endif
|
|
|
0e3136 |
NULL);
|
|
|
0e3136 |
- cp[strlen(cp)-2] = NUL;
|
|
|
0e3136 |
+ cp[strlen(cp)-2] = NUL;
|
|
|
0e3136 |
+ }
|
|
|
0e3136 |
|
|
|
0e3136 |
ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s,
|
|
|
0e3136 |
"Creating new SSL context (protocols: %s)", cp);
|
|
|
0e3136 |
@@ -705,13 +713,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
|
|
|
0e3136 |
prot = SSL3_VERSION;
|
|
|
0e3136 |
#endif
|
|
|
0e3136 |
} else {
|
|
|
0e3136 |
- SSL_CTX_free(ctx);
|
|
|
0e3136 |
- mctx->ssl_ctx = NULL;
|
|
|
0e3136 |
- ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(03378)
|
|
|
0e3136 |
- "No SSL protocols available [hint: SSLProtocol]");
|
|
|
0e3136 |
- return ssl_die(s);
|
|
|
0e3136 |
+ if (protocol_set) {
|
|
|
0e3136 |
+ SSL_CTX_free(ctx);
|
|
|
0e3136 |
+ mctx->ssl_ctx = NULL;
|
|
|
0e3136 |
+ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(03378)
|
|
|
0e3136 |
+ "No SSL protocols available [hint: SSLProtocol]");
|
|
|
0e3136 |
+ return ssl_die(s);
|
|
|
0e3136 |
+ }
|
|
|
0e3136 |
}
|
|
|
0e3136 |
- SSL_CTX_set_max_proto_version(ctx, prot);
|
|
|
0e3136 |
+ if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_max_proto_version(ctx, prot);
|
|
|
0e3136 |
|
|
|
0e3136 |
/* Next we scan for the minimal protocol version we should provide,
|
|
|
0e3136 |
* but we do not allow holes between max and min */
|
|
|
0e3136 |
@@ -731,7 +741,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
|
|
|
0e3136 |
prot = SSL3_VERSION;
|
|
|
0e3136 |
}
|
|
|
0e3136 |
#endif
|
|
|
0e3136 |
- SSL_CTX_set_min_proto_version(ctx, prot);
|
|
|
0e3136 |
+ if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_min_proto_version(ctx, prot);
|
|
|
0e3136 |
#endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L */
|
|
|
0e3136 |
|
|
|
0e3136 |
#ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
|