|
 |
369db50 |
|
|
|
369db50 |
https://bugzilla.redhat.com/show_bug.cgi?id=1109119
|
|
|
369db50 |
|
|
|
369db50 |
Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite.
|
|
|
369db50 |
|
|
|
369db50 |
--- httpd-2.4.34/modules/ssl/ssl_engine_config.c.sslciphdefault
|
|
|
369db50 |
+++ httpd-2.4.34/modules/ssl/ssl_engine_config.c
|
|
|
369db50 |
@@ -774,9 +774,11 @@
|
|
|
369db50 |
}
|
|
|
369db50 |
|
|
|
369db50 |
if (!strcmp("SSL", arg1)) {
|
|
|
369db50 |
- /* always disable null and export ciphers */
|
|
|
369db50 |
- arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
|
|
|
369db50 |
if (cmd->path) {
|
|
|
369db50 |
+ /* Disable null and export ciphers by default, except for PROFILE=
|
|
|
369db50 |
+ * configs where the parser doesn't cope. */
|
|
|
369db50 |
+ if (strncmp(arg2, "PROFILE=", 8) != 0)
|
|
|
369db50 |
+ arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
|
|
|
369db50 |
dc->szCipherSuite = arg2;
|
|
|
369db50 |
}
|
|
|
369db50 |
else {
|
|
|
369db50 |
@@ -1540,8 +1542,10 @@
|
|
|
369db50 |
}
|
|
|
369db50 |
|
|
|
369db50 |
if (!strcmp("SSL", arg1)) {
|
|
|
369db50 |
- /* always disable null and export ciphers */
|
|
|
369db50 |
- arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
|
|
|
369db50 |
+ /* Disable null and export ciphers by default, except for PROFILE=
|
|
|
369db50 |
+ * configs where the parser doesn't cope. */
|
|
|
369db50 |
+ if (strncmp(arg2, "PROFILE=", 8) != 0)
|
|
|
369db50 |
+ arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
|
|
|
369db50 |
dc->proxy->auth.cipher_suite = arg2;
|
|
|
369db50 |
return NULL;
|
|
|
369db50 |
}
|