wrowe at apache
Aug 18, 2012, 12:32 PM
Post #1 of 1
svn commit: r1374640 - /httpd/httpd/branches/2.2.x/STATUS
Date: Sat Aug 18 19:32:38 2012
New Revision: 1374640
Patch and STATUS updated to reflect the fix to [+]SSLv2 noted by kbrand.
--- httpd/httpd/branches/2.2.x/STATUS (original)
+++ httpd/httpd/branches/2.2.x/STATUS Sat Aug 18 19:32:38 2012
@@ -145,7 +145,7 @@ PATCHES PROPOSED TO BACKPORT FROM TRUNK:
Backport version for 2.2.x of the patches above:
kbrand: The #define HAVE_TLSV1_X stuff should go to ssl_toolkit_compat.h,
[wrowe] disagree, since that API was deprecated
@@ -160,6 +160,15 @@ PATCHES PROPOSED TO BACKPORT FROM TRUNK:
to drop the #ifndef around SSL_PROTOCOL_SSLV2 in ssl_private.h,
this should also make some of the other "#if[n]def OPENSSL_NO_SSL2"
+ [wrowe] agreed the patch was wrong, the #ifdef needed to be moved
+ up four lines. Behavior is now correct in patch .2
+ Diagree about retaining SSL_PROTOCOL_SSLV2; this is one
+ of the most basic design patterns which exists to ensure
+ that we don't have some lingering code which is still
+ attempting to pursue SSLV2 games, not to mention that
+ the various macros and functions in those blocks may
+ simply disappear disappear inan OPENSSL_NO_SSL2 build.
+ Bad idea, it helps us catch current and future problems.
- ssl_engine_init.c: misses two "ctx = SSL_CTX_new(method);" calls
(or move the existing ones after the if blocks).