| 1134 | } |
| 1135 | |
| 1136 | static apr_status_t ssl_init_ctx_cipher_suite(server_rec *s, |
| 1137 | apr_pool_t *p, |
| 1138 | apr_pool_t *ptemp, |
| 1139 | modssl_ctx_t *mctx) |
| 1140 | { |
| 1141 | SSL_CTX *ctx = mctx->ssl_ctx; |
| 1142 | const char *suite; |
| 1143 | |
| 1144 | /* |
| 1145 | * Configure SSL Cipher Suite. Always disable NULL and export ciphers, |
| 1146 | * see also ssl_engine_config.c:ssl_cmd_SSLCipherSuite(). |
| 1147 | * OpenSSL's SSL_DEFAULT_CIPHER_LIST includes !aNULL:!eNULL from 0.9.8f, |
| 1148 | * and !EXP from 0.9.8zf/1.0.1m/1.0.2a, so append them while we support |
| 1149 | * earlier versions. |
| 1150 | */ |
| 1151 | suite = mctx->auth.cipher_suite ? mctx->auth.cipher_suite : |
| 1152 | apr_pstrcat(ptemp, SSL_DEFAULT_CIPHER_LIST, ":!aNULL:!eNULL:!EXP", |
| 1153 | NULL); |
| 1154 | |
| 1155 | ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s, |
| 1156 | "Configuring permitted SSL ciphers [%s]", |
| 1157 | suite); |
| 1158 | |
| 1159 | if (!SSL_CTX_set_cipher_list(ctx, suite)) { |
| 1160 | ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01898) |
| 1161 | "Unable to configure permitted SSL ciphers"); |
| 1162 | ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); |
| 1163 | return ssl_die(s); |
| 1164 | } |
| 1165 | #if SSL_HAVE_PROTOCOL_TLSV1_3 |
| 1166 | if (mctx->auth.tls13_ciphers |
| 1167 | && !SSL_CTX_set_ciphersuites(ctx, mctx->auth.tls13_ciphers)) { |
| 1168 | ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10127) |
| 1169 | "Unable to configure permitted TLSv1.3 ciphers"); |
| 1170 | ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); |
| 1171 | return ssl_die(s); |
| 1172 | } |
| 1173 | #endif |
| 1174 | return APR_SUCCESS; |
| 1175 | } |
| 1176 | |
| 1177 | static APR_INLINE |
| 1178 | int modssl_X509_STORE_load_locations(X509_STORE *store, |
no test coverage detected