kbrand at apache
Aug 19, 2012, 11:29 AM
Post #1 of 1
svn commit: r1374813 - /httpd/httpd/branches/2.2.x/STATUS
Date: Sun Aug 19 18:29:21 2012
New Revision: 1374813
--- httpd/httpd/branches/2.2.x/STATUS (original)
+++ httpd/httpd/branches/2.2.x/STATUS Sun Aug 19 18:29:21 2012
@@ -146,29 +146,11 @@ PATCHES PROPOSED TO BACKPORT FROM TRUNK:
Backport version for 2.2.x of the patches above:
- +1: wrowe, sf
- kbrand: The #define HAVE_TLSV1_X stuff should go to ssl_toolkit_compat.h,
- [wrowe] disagree, since that API was deprecated
- kbrand: ok, won't insist on that, but as long as 2.2 still
- has ssl_toolkit_compat.h, I would prefer to see all
- OpenSSL version number checking etc. in a single place
- patch .1 now has an issue with handling "SSLProtocol SSLv2"
- or "SSLProtocol +SSLv2" (which are pretty nonsensical settings,
- but nevertheless): ssl_cmd_protocol_parse will reject these
- with "SSLv2 not supported by this version of OpenSSL", even
- if OpenSSL hasn't been compiled with OPENSSL_NO_SSL2. I suggest
- to drop the #ifndef around SSL_PROTOCOL_SSLV2 in ssl_private.h,
- this should also make some of the other "#if[n]def OPENSSL_NO_SSL2"
- encapsulations unnecessary.
- [wrowe] agreed the patch was wrong, the #ifdef needed to be moved
- up four lines. Behavior is now correct in patch .2
- Diagree about retaining SSL_PROTOCOL_SSLV2; this is one
- of the most basic design patterns which exists to ensure
- that we don't have some lingering code which is still
- attempting to pursue SSLV2 games, not to mention that
- the various macros and functions in those blocks may
- simply disappear disappear inan OPENSSL_NO_SSL2 build.
- Bad idea, it helps us catch current and future problems.
+ +1: wrowe, sf, kbrand
+ kbrand: explicitly including <openssl/opensslconf.h> in ssl_toolkit_compat.h
+ would make sense, since we're relying on OPENSSL_NO_SSL2 being
+ properly reported by OpenSSL (currently opensslconf.h is only
+ indirectly included, which seems somewhat brittle)
sf: I would also have taken the approach suggested by kbrand,
but I am OK with the approach from patch .2, too.
Minor (CTR) issues: