Commit 5f90ca77 authored by Jim Jagielski's avatar Jim Jagielski
Browse files

Merge r1679470 from trunk: 

mod_ssl: follow up to r1527291.
Always prepend "!aNULL:!eNULL:" to SSL_DEFAULT_CIPHER_LIST (default for
SSL[Proxy]CipherSuite) since we support OpenSSL versions where this was
not yet included by default.

Submitted by: ylavic
Reviewed/backported by: jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1679989 13f79535-47bb-0310-9956-ffa450edef68
parent 2727b7a7

STATUS

+0 −7
Changes for STATUS: 0 added lines, 7 removed lines.
Original line number Diff line number Diff line
@@ -105,13 +105,6 @@ RELEASE SHOWSTOPPERS: 
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ start all new proposals below, under PATCHES PROPOSED. ]



  *) Always prepend "!aNULL:!eNULL:" to SSL_DEFAULT_CIPHER_LIST (default for

     SSL[Proxy]CipherSuite) since we support OpenSSL versions where this was

     not yet included by default (follow up to merge r1542327 in 2.4.7).

     trunk patch: http://svn.apache.org/r1679470

     2.4.x patch: trunk works (modulo CHANGES)

     +1: ylavic, wrowe, jim



  *) mod_dir: backport r1679620 which reverts r1675103. This change makes 

     FallBackResource hijack requests that mod_autoindex might want to handle

     later.

modules/ssl/ssl_engine_init.c

+5 −3
Changes for modules/ssl/ssl_engine_init.c: 5 added lines, 3 removed lines.
Original line number Diff line number Diff line
@@ -725,11 +725,13 @@ static apr_status_t ssl_init_ctx_cipher_suite(server_rec *s, 
    /*

     *  Configure SSL Cipher Suite. Always disable NULL and export ciphers,

     *  see also ssl_engine_config.c:ssl_cmd_SSLCipherSuite().

     *  OpenSSL's SSL_DEFAULT_CIPHER_LIST already includes !aNULL:!eNULL,

     *  so only prepend !EXP in this case.

     *  OpenSSL's SSL_DEFAULT_CIPHER_LIST includes !aNULL:!eNULL from 0.9.8f,

     *  and !EXP from 0.9.8zf/1.0.1m/1.0.2a, so prepend them while we support

     *  earlier versions.

     */

    suite = mctx->auth.cipher_suite ? mctx->auth.cipher_suite :

            apr_pstrcat(ptemp, "!EXP:", SSL_DEFAULT_CIPHER_LIST, NULL);

            apr_pstrcat(ptemp, "!aNULL:!eNULL:!EXP:", SSL_DEFAULT_CIPHER_LIST,

                        NULL);



    ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s,

                 "Configuring permitted SSL ciphers [%s]",