Commit 2b7cf2ed authored by William A. Rowe Jr's avatar William A. Rowe Jr
Browse files 

  While eliminating all but TLSv1 (the only FIPS-complient handshaking
  mechansim), I noticed that we have several other single-case methods
  similar to the SSLv2 exception; use the explicit method in preference
  to the generic SSLv23_client|server_method() calls if exactly one
  method is supported.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/fips-dev@264620 13f79535-47bb-0310-9956-ffa450edef68
parent 452b337d

modules/ssl/ssl_engine_init.c

+12 −3
Original line number Diff line number Diff line
@@ -446,14 +446,23 @@ static void ssl_init_ctx_protocol(server_rec *s, 
        method = mctx->pkp ?

            SSLv2_client_method() : /* proxy */

            SSLv2_server_method();  /* server */

        ctx = SSL_CTX_new(method);  /* only SSLv2 is left */

    }

    else {

    else if (protocol == SSL_PROTOCOL_SSLV3) {

        method = mctx->pkp ?

            SSLv3_client_method() : /* proxy */

            SSLv3_server_method();  /* server */

    }

    else if (protocol == SSL_PROTOCOL_TLSV1) {

        method = mctx->pkp ?

            TLSv1_client_method() : /* proxy */

            TLSv1_server_method();  /* server */

    }

    else { /* For multiple protocols, we need a flexible method */

        method = mctx->pkp ?

            SSLv23_client_method() : /* proxy */

            SSLv23_server_method();  /* server */

        ctx = SSL_CTX_new(method); /* be more flexible */

    }

    ctx = SSL_CTX_new(method);



    mctx->ssl_ctx = ctx;