| 430 | } |
| 431 | |
| 432 | int h2_protocol_is_acceptable_c1(conn_rec *c, request_rec *r, int require_all) |
| 433 | { |
| 434 | int is_tls = ap_ssl_conn_is_ssl(c); |
| 435 | |
| 436 | if (is_tls && h2_config_cgeti(c, H2_CONF_MODERN_TLS_ONLY) > 0) { |
| 437 | /* Check TLS connection for modern TLS parameters, as defined in |
| 438 | * RFC 7540 and https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility |
| 439 | */ |
| 440 | apr_pool_t *pool = c->pool; |
| 441 | server_rec *s = c->base_server; |
| 442 | const char *val; |
| 443 | |
| 444 | /* Need Tlsv1.2 or higher, rfc 7540, ch. 9.2 |
| 445 | */ |
| 446 | val = ap_ssl_var_lookup(pool, s, c, NULL, "SSL_PROTOCOL"); |
| 447 | if (val && *val) { |
| 448 | if (strncmp("TLS", val, 3) |
| 449 | || !strcmp("TLSv1", val) |
| 450 | || !strcmp("TLSv1.1", val)) { |
| 451 | ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(03050) |
| 452 | "h2_h2(%ld): tls protocol not suitable: %s", |
| 453 | (long)c->id, val); |
| 454 | return 0; |
| 455 | } |
| 456 | } |
| 457 | else if (require_all) { |
| 458 | ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(03051) |
| 459 | "h2_h2(%ld): tls protocol is indetermined", (long)c->id); |
| 460 | return 0; |
| 461 | } |
| 462 | |
| 463 | if (val && !strcmp("TLSv1.2", val)) { |
| 464 | /* Check TLS cipher blacklist, defined pre-TLSv1.3, so only |
| 465 | * checking for 1.2 */ |
| 466 | val = ap_ssl_var_lookup(pool, s, c, NULL, "SSL_CIPHER"); |
| 467 | if (val && *val) { |
| 468 | const char *source; |
| 469 | if (cipher_is_blacklisted(val, &source)) { |
| 470 | ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(03052) |
| 471 | "h2_h2(%ld): tls cipher %s blacklisted by %s", |
| 472 | (long)c->id, val, source); |
| 473 | return 0; |
| 474 | } |
| 475 | } |
| 476 | else if (require_all) { |
| 477 | ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(03053) |
| 478 | "h2_h2(%ld): tls cipher is indetermined", (long)c->id); |
| 479 | return 0; |
| 480 | } |
| 481 | } |
| 482 | } |
| 483 | return 1; |
| 484 | } |
| 485 |
no test coverage detected