Skip to content

Commit e6cfbfa

Browse files
committed
mod_ssl: Check the SSLProtocol directive when loading the configuration
Previously, the SSLProtocol directive was checked at runtime. Apache quit if the directive contained an invalid combination of protocols, and logged the message "AH02231: No SSL protocols available [hint: SSLProtocol]". With this change, most invalid SSLProtocol directives are detected when checking the configuration, e.g. with \"httpd -t -f httpd.conf\". Examples of invalid protocol combinations that are caught: * SSLProtocol "-TLSv1" * SSLProtocol "-all" * SSLProtocol "TLSv1.2 -TLSv1.2" Submitted by: Michael Kaufmann <mail michael-kaufmann.ch> Github: closes #523 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1924955 13f79535-47bb-0310-9956-ffa450edef68
1 parent b3a52be commit e6cfbfa

File tree

2 files changed

+8
-0
lines changed

2 files changed

+8
-0
lines changed
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
*) mod_ssl: Fail when parsing SSLProtocol if the configuration
2+
would prevent use of all protocols.
3+
[Michael Kaufmann <mail michael-kaufmann.ch>]

modules/ssl/ssl_engine_config.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1610,6 +1610,11 @@ static const char *ssl_cmd_protocol_parse(cmd_parms *parms,
16101610
}
16111611
}
16121612

1613+
if (*options == SSL_PROTOCOL_NONE) {
1614+
return "SSLProtocol: No SSL protocols available";
1615+
}
1616+
1617+
16131618
return NULL;
16141619
}
16151620

0 commit comments

Comments
 (0)