| 716 | #endif |
| 717 | |
| 718 | static apr_status_t ssl_init_ctx_protocol(server_rec *s, |
| 719 | apr_pool_t *p, |
| 720 | apr_pool_t *ptemp, |
| 721 | modssl_ctx_t *mctx) |
| 722 | { |
| 723 | SSL_CTX *ctx = NULL; |
| 724 | MODSSL_SSL_METHOD_CONST SSL_METHOD *method = NULL; |
| 725 | char *cp; |
| 726 | int protocol = mctx->protocol; |
| 727 | SSLSrvConfigRec *sc = mySrvConfig(s); |
| 728 | #if OPENSSL_VERSION_NUMBER >= 0x10100000L |
| 729 | /* default is highest supported version, will be overridden below */ |
| 730 | #if SSL_HAVE_PROTOCOL_TLSV1_3 |
| 731 | int prot = TLS1_3_VERSION; |
| 732 | #else |
| 733 | int prot = TLS1_2_VERSION; |
| 734 | #endif |
| 735 | #endif |
| 736 | |
| 737 | /* |
| 738 | * Create the new per-server SSL context |
| 739 | */ |
| 740 | if (protocol == SSL_PROTOCOL_NONE) { |
| 741 | ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02231) |
| 742 | "No SSL protocols available [hint: SSLProtocol]"); |
| 743 | return ssl_die(s); |
| 744 | } |
| 745 | |
| 746 | cp = apr_pstrcat(p, |
| 747 | #ifndef OPENSSL_NO_SSL3 |
| 748 | (protocol & SSL_PROTOCOL_SSLV3 ? "SSLv3, " : ""), |
| 749 | #endif |
| 750 | (protocol & SSL_PROTOCOL_TLSV1 ? "TLSv1, " : ""), |
| 751 | #ifdef HAVE_TLSV1_X |
| 752 | (protocol & SSL_PROTOCOL_TLSV1_1 ? "TLSv1.1, " : ""), |
| 753 | (protocol & SSL_PROTOCOL_TLSV1_2 ? "TLSv1.2, " : ""), |
| 754 | #if SSL_HAVE_PROTOCOL_TLSV1_3 |
| 755 | (protocol & SSL_PROTOCOL_TLSV1_3 ? "TLSv1.3, " : ""), |
| 756 | #endif |
| 757 | #endif |
| 758 | NULL); |
| 759 | cp[strlen(cp)-2] = NUL; |
| 760 | |
| 761 | ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s, |
| 762 | "Creating new SSL context (protocols: %s)", cp); |
| 763 | |
| 764 | #if OPENSSL_VERSION_NUMBER < 0x10100000L |
| 765 | #ifndef OPENSSL_NO_SSL3 |
| 766 | if (protocol == SSL_PROTOCOL_SSLV3) { |
| 767 | method = mctx->pkp ? |
| 768 | SSLv3_client_method() : /* proxy */ |
| 769 | SSLv3_server_method(); /* server */ |
| 770 | } |
| 771 | else |
| 772 | #endif |
| 773 | if (protocol == SSL_PROTOCOL_TLSV1) { |
| 774 | method = mctx->pkp ? |
| 775 | TLSv1_client_method() : /* proxy */ |
no test coverage detected