Commit 60dc4a16 authored by Joe Orton's avatar Joe Orton
Browse files

Merge r1556473 from trunk: 

* modules/ssl/ssl_engine_config.c (ssl_cmd_SSLCompression): Fail if
  enabled *and* if OpenSSL does not make any compression methods
  available.  Tweak wording for failure without SSL_OP_NO_COMPRESSION.

Submitted by: jorton
Reviewed by: jorton, jim, ylavic


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1823625 13f79535-47bb-0310-9956-ffa450edef68
parent 5e0dbb9f

CHANGES

+4 −0
Original line number Diff line number Diff line 
                                                         -*- coding: utf-8 -*-

Changes with Apache 2.4.30

 

  *) mod_ssl: The SSLCompression directive will now give an error if used

     with an OpenSSL build which does not support any compression methods.

     [Joe Orton]



  *) mpm_event,worker: Mask signals for threads created by modules in child

     init, so that they don't receive (implicitely) the ones meant for the MPM.

     PR 62009. [Armin Abfalterer <a.abfalterer gmail com>, Yann Ylavic]

modules/ssl/ssl_engine_config.c

+13 −2
Original line number Diff line number Diff line
@@ -781,9 +781,20 @@ const char *ssl_cmd_SSLCompression(cmd_parms *cmd, void *dcfg, int flag) 
#ifndef SSL_OP_NO_COMPRESSION

    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);

    if (err)

        return "This version of openssl does not support configuring "

               "compression within <VirtualHost> sections.";

        return "This version of OpenSSL does not support enabling "

               "SSLCompression within <VirtualHost> sections.";

#endif

    if (flag) {

        /* Some (packaged) versions of OpenSSL do not support

         * compression by default.  Enabling this directive would not

         * have the desired effect, so fail with an error. */

        STACK_OF(SSL_COMP) *meths = SSL_COMP_get_compression_methods();



        if (sk_SSL_COMP_num(meths) == 0) {

            return "This version of OpenSSL does not have any compression methods "

                "available, cannot enable SSLCompression.";

        }

    }

    sc->compression = flag ? TRUE : FALSE;

    return NULL;

#else