Merge r1679470 from trunk:

mod_ssl: follow up to r1527291.
Always prepend "!aNULL:!eNULL:" to SSL_DEFAULT_CIPHER_LIST (default for
SSL[Proxy]CipherSuite) since we support OpenSSL versions where this was
not yet included by default.

Submitted by: ylavic
Reviewed/backported by: jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679989 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/STATUS b/STATUS
index 5c05cf4ec256cd2bc17a647f0fadaa9a01c3d5dc..ebbad96adafd400d8834d081360f242f0edd86e0 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -105,13 +105,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
-  *) Always prepend "!aNULL:!eNULL:" to SSL_DEFAULT_CIPHER_LIST (default for
-     SSL[Proxy]CipherSuite) since we support OpenSSL versions where this was
-     not yet included by default (follow up to merge r1542327 in 2.4.7).
-     trunk patch: http://svn.apache.org/r1679470
-     2.4.x patch: trunk works (modulo CHANGES)
-     +1: ylavic, wrowe, jim
-
   *) mod_dir: backport r1679620 which reverts r1675103. This change makes 
      FallBackResource hijack requests that mod_autoindex might want to handle
      later.

diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
index 931011c6c9b45e87dd510f3a1a33ad11c1bac4f7..46e022c3defa8c6b9ba9df678479ddbd4cae4b29 100644 (file)
--- a/modules/ssl/ssl_engine_init.c
+++ b/modules/ssl/ssl_engine_init.c
@@ -725,11 +725,13 @@ static apr_status_t ssl_init_ctx_cipher_suite(server_rec *s,
     /*
      *  Configure SSL Cipher Suite. Always disable NULL and export ciphers,
      *  see also ssl_engine_config.c:ssl_cmd_SSLCipherSuite().
-     *  OpenSSL's SSL_DEFAULT_CIPHER_LIST already includes !aNULL:!eNULL,
-     *  so only prepend !EXP in this case.
+     *  OpenSSL's SSL_DEFAULT_CIPHER_LIST includes !aNULL:!eNULL from 0.9.8f,
+     *  and !EXP from 0.9.8zf/1.0.1m/1.0.2a, so prepend them while we support
+     *  earlier versions.
      */
     suite = mctx->auth.cipher_suite ? mctx->auth.cipher_suite :
-            apr_pstrcat(ptemp, "!EXP:", SSL_DEFAULT_CIPHER_LIST, NULL);
+            apr_pstrcat(ptemp, "!aNULL:!eNULL:!EXP:", SSL_DEFAULT_CIPHER_LIST,
+                        NULL);
 
     ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s,
                  "Configuring permitted SSL ciphers [%s]",