Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Browse files

While eliminating all but TLSv1 (the only FIPS-complient handshaking

  mechansim), I noticed that we have several other single-case methods
  similar to the SSLv2 exception; use the explicit method in preference
  to the generic SSLv23_client|server_method() calls if exactly one
  method is supported.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/fips-dev@264620 13f79535-47bb-0310-9956-ffa450edef68
  • Loading branch information...
commit 2b7cf2edfc4ea539a416198e800dc192ef8dd9b4 1 parent 452b337
@wrowe wrowe authored
Showing with 12 additions and 3 deletions.
  1. +12 −3 modules/ssl/ssl_engine_init.c
View
15 modules/ssl/ssl_engine_init.c
@@ -446,14 +446,23 @@ static void ssl_init_ctx_protocol(server_rec *s,
method = mctx->pkp ?
SSLv2_client_method() : /* proxy */
SSLv2_server_method(); /* server */
- ctx = SSL_CTX_new(method); /* only SSLv2 is left */
}
- else {
+ else if (protocol == SSL_PROTOCOL_SSLV3) {
+ method = mctx->pkp ?
+ SSLv3_client_method() : /* proxy */
+ SSLv3_server_method(); /* server */
+ }
+ else if (protocol == SSL_PROTOCOL_TLSV1) {
+ method = mctx->pkp ?
+ TLSv1_client_method() : /* proxy */
+ TLSv1_server_method(); /* server */
+ }
+ else { /* For multiple protocols, we need a flexible method */
method = mctx->pkp ?
SSLv23_client_method() : /* proxy */
SSLv23_server_method(); /* server */
- ctx = SSL_CTX_new(method); /* be more flexible */
}
+ ctx = SSL_CTX_new(method);
mctx->ssl_ctx = ctx;
Please sign in to comment.
Something went wrong with that request. Please try again.