On Thu, Sep 10, 2015 at 10:37:44AM +0000, Stuart Henderson wrote:
> I've opened a ticket for this already (bz 58349) but it was suggested
> that I send mail here as well.
>
> Currently httpd builds fail with libressl as SSLv3 has been disabled
> (OPENSSL_NO_SSL3); ab.c and mod_ssl unconditionally use SSLv3_method()
> functions.
>
> ab.c fails at build time, mod_ssl is slightly nastier as this isn't
> picked up until trying to start a server with ssl enabled.
>
> Thanks,
> Stuart
Does OpenSSL use the name OPENSSL_NO_SSL3 too?
Or is this macro defined by LibreSSL only?
> --- support/ab.c.orig Fri Jul 17 22:55:57 2015
> +++ support/ab.c Fri Jul 17 22:56:13 2015
> @@ -2314,8 +2314,10 @@ int main(int argc, const char * const argv[])
> } else if (strncasecmp(opt_arg, "SSL2", 4) == 0) {
> meth = SSLv2_client_method();
> #endif
> +#ifndef OPENSSL_NO_SSL3
> } else if (strncasecmp(opt_arg, "SSL3", 4) == 0) {
> meth = SSLv3_client_method();
> +#endif
> #ifdef HAVE_TLSV1_X
> } else if (strncasecmp(opt_arg, "TLS1.1", 6) == 0) {
> meth = TLSv1_1_client_method();
>
> --- modules/ssl/ssl_engine_init.c.orig Sun Sep 6 15:23:52 2015
> +++ modules/ssl/ssl_engine_init.c Sun Sep 6 15:57:35 2015
> @@ -484,9 +484,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *
> "Creating new SSL context (protocols: %s)", cp);
>
> if (protocol == SSL_PROTOCOL_SSLV3) {
> +#ifndef OPENSSL_NO_SSL3
> method = mctx->pkp ?
> SSLv3_client_method() : /* proxy */
> SSLv3_server_method(); /* server */
> +#else
> + ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s,
> + "SSLv3 protocol not available");
> + return ssl_die(s);
> +#endif
> }
> else if (protocol == SSL_PROTOCOL_TLSV1) {
> method = mctx->pkp ?
>
