Merge r1556473 from trunk:

* modules/ssl/ssl_engine_config.c (ssl_cmd_SSLCompression): Fail if
  enabled *and* if OpenSSL does not make any compression methods
  available.  Tweak wording for failure without SSL_OP_NO_COMPRESSION.

Submitted by: jorton
Reviewed by: jorton, jim, ylavic

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1823625 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 85357b27157934a35a6abcdb9583feacaaa146ed..e706b53061e2ae35d7b84590f9626e8dfcb10bbf 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,10 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.4.30
  
+  *) mod_ssl: The SSLCompression directive will now give an error if used
+     with an OpenSSL build which does not support any compression methods.
+     [Joe Orton]
+
   *) mpm_event,worker: Mask signals for threads created by modules in child
      init, so that they don't receive (implicitely) the ones meant for the MPM.
      PR 62009. [Armin Abfalterer <a.abfalterer gmail com>, Yann Ylavic]

diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
index 6750b98a8a78e3b4873573241b81501acf1ae186..78d058cb16769163ffaeeb98cc860709b819b45f 100644 (file)
--- a/modules/ssl/ssl_engine_config.c
+++ b/modules/ssl/ssl_engine_config.c
@@ -781,9 +781,20 @@ const char *ssl_cmd_SSLCompression(cmd_parms *cmd, void *dcfg, int flag)
 #ifndef SSL_OP_NO_COMPRESSION
     const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
     if (err)
-        return "This version of openssl does not support configuring "
-               "compression within <VirtualHost> sections.";
+        return "This version of OpenSSL does not support enabling "
+               "SSLCompression within <VirtualHost> sections.";
 #endif
+    if (flag) {
+        /* Some (packaged) versions of OpenSSL do not support
+         * compression by default.  Enabling this directive would not
+         * have the desired effect, so fail with an error. */
+        STACK_OF(SSL_COMP) *meths = SSL_COMP_get_compression_methods();
+
+        if (sk_SSL_COMP_num(meths) == 0) {
+            return "This version of OpenSSL does not have any compression methods "
+                "available, cannot enable SSLCompression.";
+        }
+    }
     sc->compression = flag ? TRUE : FALSE;
     return NULL;
 #else