Attachment 1477558 Details for Bug 1618371 – Proposed patch

[patch] Proposed patch

0001-Do-not-set-default-TLS-protocol-s-and-rely-on-crypto.patch (text/plain), 2.56 KB, created by Rob Crittenden on 2018-08-21 14:22:38 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Rob Crittenden

Created: 2018-08-21 14:22:38 UTC

Size: 2.56 KB

patch

obsolete

>From d68b80ba74ed0ee6a7cccc0a53bdcebf668ee71f Mon Sep 17 00:00:00 2001
>From: Rob Crittenden <rcritten@redhat.com>
>Date: Tue, 21 Aug 2018 08:53:44 -0400
>Subject: [PATCH] Do not set default TLS protocol(s) and rely on crypto policy
>
>---
> modules/ssl/ssl_engine_config.c |  2 +-
> modules/ssl/ssl_engine_init.c   | 20 ++++++--------------
> 2 files changed, 7 insertions(+), 15 deletions(-)
>
>diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
>index 517ce30..bf8521b 100644
>--- a/modules/ssl/ssl_engine_config.c
>+++ b/modules/ssl/ssl_engine_config.c
>@@ -119,7 +119,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p)
>     mctx->ticket_key          = NULL;
> #endif
> 
>-    mctx->protocol            = SSL_PROTOCOL_DEFAULT;
>+    mctx->protocol            = SSL_PROTOCOL_NONE;
>     mctx->protocol_set        = 0;
> 
>     mctx->pphrase_dialog_type = SSL_PPTYPE_UNSET;
>diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
>index 60df45f..c02fca4 100644
>--- a/modules/ssl/ssl_engine_init.c
>+++ b/modules/ssl/ssl_engine_init.c
>@@ -554,12 +554,6 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
>     /*
>      *  Create the new per-server SSL context
>      */
>-    if (protocol == SSL_PROTOCOL_NONE) {
>-        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02231)
>-                "No SSL protocols available [hint: SSLProtocol]");
>-        return ssl_die(s);
>-    }
>-
>     cp = apr_pstrcat(p,
> #ifndef OPENSSL_NO_SSL3
>                      (protocol & SSL_PROTOCOL_SSLV3 ? "SSLv3, " : ""),
>@@ -674,14 +668,10 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
>     } else if (protocol & SSL_PROTOCOL_SSLV3) {
>         prot = SSL3_VERSION;
> #endif
>-    } else {
>-        SSL_CTX_free(ctx);
>-        mctx->ssl_ctx = NULL;
>-        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(03378)
>-                "No SSL protocols available [hint: SSLProtocol]");
>-        return ssl_die(s);
>     }
>-    SSL_CTX_set_max_proto_version(ctx, prot);
>+    if (protocol != SSL_PROTOCOL_NONE) {
>+        SSL_CTX_set_max_proto_version(ctx, prot);
>+    }
> 
>     /* Next we scan for the minimal protocol version we should provide,
>      * but we do not allow holes between max and min */
>@@ -701,7 +691,9 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
>         prot = SSL3_VERSION;
>     }
> #endif
>-    SSL_CTX_set_min_proto_version(ctx, prot);
>+    if (protocol != SSL_PROTOCOL_NONE) {
>+        SSL_CTX_set_min_proto_version(ctx, prot);
>+    }
> #endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L */
> 
> #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE
>-- 
>2.18.0
>

Actions: View | Diff

Attachments on bug 1618371: 1477558