From 6d6a8a16f1695fe121da0f2dc3220f2cb7421bc8 Mon Sep 17 00:00:00 2001 From: Eric Covener Date: Thu, 22 Jan 2015 15:19:39 +0000 Subject: [PATCH] Fix merge problem with SSLProtocol that made SSLProtocol ALL ignored in virtualhost context. Submitted By: Michael Kaufmann Commited By: covener git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1653906 13f79535-47bb-0310-9956-ffa450edef68 --- CHANGES | 3 +++ modules/ssl/ssl_engine_config.c | 4 ++-- modules/ssl/ssl_engine_init.c | 9 +++++++++ modules/ssl/ssl_private.h | 13 +++++++------ 4 files changed, 21 insertions(+), 8 deletions(-) diff --git a/CHANGES b/CHANGES index 59eda117c2..9f4d736349 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,9 @@ -*- coding: utf-8 -*- Changes with Apache 2.5.0 + *) mod_ssl: 'SSLProtocol ALL' was being ignored in virtual host context. + PR 57100. [Michael Kaufmann ] + *) mod_rewrite: Improve 'bad flag delimeters' startup error by showing how the input was tokenized. PR 56528. [Edward Lu ] diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c index eed4e084c3..738a00cf6e 100644 --- a/modules/ssl/ssl_engine_config.c +++ b/modules/ssl/ssl_engine_config.c @@ -110,7 +110,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p) mctx->ticket_key = NULL; #endif - mctx->protocol = SSL_PROTOCOL_ALL; + mctx->protocol = SSL_PROTOCOL_UNSET; mctx->pphrase_dialog_type = SSL_PPTYPE_UNSET; mctx->pphrase_dialog_path = NULL; @@ -254,7 +254,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p, modssl_ctx_t *add, modssl_ctx_t *mrg) { - cfgMerge(protocol, SSL_PROTOCOL_ALL); + cfgMerge(protocol, SSL_PROTOCOL_UNSET); cfgMerge(pphrase_dialog_type, SSL_PPTYPE_UNSET); cfgMergeString(pphrase_dialog_path); diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c index b44e01f1c2..903a5477a1 100644 --- a/modules/ssl/ssl_engine_init.c +++ b/modules/ssl/ssl_engine_init.c @@ -209,10 +209,19 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog, if (sc->enabled == SSL_ENABLED_UNSET) { sc->enabled = SSL_ENABLED_FALSE; } + if (sc->proxy_enabled == UNSET) { sc->proxy_enabled = FALSE; } + if (sc->server && sc->server->protocol == SSL_PROTOCOL_UNSET) { + sc->server->protocol = SSL_PROTOCOL_ALL; + } + + if (sc->proxy && sc->proxy->protocol == SSL_PROTOCOL_UNSET) { + sc->proxy->protocol = SSL_PROTOCOL_ALL; + } + if (sc->session_cache_timeout == UNSET) { sc->session_cache_timeout = SSL_SESSION_CACHE_TIMEOUT; } diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h index 140b9c3099..69c4704fda 100644 --- a/modules/ssl/ssl_private.h +++ b/modules/ssl/ssl_private.h @@ -286,13 +286,14 @@ typedef int ssl_opt_t; /** * Define the SSL Protocol options */ -#define SSL_PROTOCOL_NONE (0) -#define SSL_PROTOCOL_SSLV2 (1<<0) -#define SSL_PROTOCOL_SSLV3 (1<<1) -#define SSL_PROTOCOL_TLSV1 (1<<2) +#define SSL_PROTOCOL_UNSET (0) +#define SSL_PROTOCOL_NONE (1<<0) +#define SSL_PROTOCOL_SSLV2 (1<<1) +#define SSL_PROTOCOL_SSLV3 (1<<2) +#define SSL_PROTOCOL_TLSV1 (1<<3) #ifdef HAVE_TLSV1_X -#define SSL_PROTOCOL_TLSV1_1 (1<<3) -#define SSL_PROTOCOL_TLSV1_2 (1<<4) +#define SSL_PROTOCOL_TLSV1_1 (1<<4) +#define SSL_PROTOCOL_TLSV1_2 (1<<5) #define SSL_PROTOCOL_ALL (SSL_PROTOCOL_SSLV3|SSL_PROTOCOL_TLSV1| \ SSL_PROTOCOL_TLSV1_1|SSL_PROTOCOL_TLSV1_2) #else -- 2.40.0