Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Date: Thu, 10 Sep 2015 13:40:11 +0200
From: Stefan Sperling <stsp@apache.org>
To: dev@httpd.apache.org
Cc: Stuart Henderson <sthen@openbsd.org>
Subject: Re: patch (mod_ssl/ab) to support OPENSSL_NO_SSL3 builds
Message-ID: <20150910114011.GJ24023@jim.stsp.name>
References: <slrnmv2nbo.ouq.stu@naiad.spacehopper.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <slrnmv2nbo.ouq.stu@naiad.spacehopper.org>
User-Agent: Mutt/1.5.23 (2014-03-12)

On Thu, Sep 10, 2015 at 10:37:44AM +0000, Stuart Henderson wrote:
> I've opened a ticket for this already (bz 58349) but it was suggested
> that I send mail here as well.
> 
> Currently httpd builds fail with libressl as SSLv3 has been disabled
> (OPENSSL_NO_SSL3); ab.c and mod_ssl unconditionally use SSLv3_method()
> functions.
> 
> ab.c fails at build time, mod_ssl is slightly nastier as this isn't
> picked up until trying to start a server with ssl enabled.
> 
> Thanks,
> Stuart

Does OpenSSL use the name OPENSSL_NO_SSL3 too?
Or is this macro defined by LibreSSL only?

> --- support/ab.c.orig	Fri Jul 17 22:55:57 2015
> +++ support/ab.c	Fri Jul 17 22:56:13 2015
> @@ -2314,8 +2314,10 @@ int main(int argc, const char * const argv[])
>                  } else if (strncasecmp(opt_arg, "SSL2", 4) == 0) {
>                      meth = SSLv2_client_method();
>  #endif
> +#ifndef OPENSSL_NO_SSL3
>                  } else if (strncasecmp(opt_arg, "SSL3", 4) == 0) {
>                      meth = SSLv3_client_method();
> +#endif
>  #ifdef HAVE_TLSV1_X
>                  } else if (strncasecmp(opt_arg, "TLS1.1", 6) == 0) {
>                      meth = TLSv1_1_client_method();
> 
> --- modules/ssl/ssl_engine_init.c.orig	Sun Sep  6 15:23:52 2015
> +++ modules/ssl/ssl_engine_init.c	Sun Sep  6 15:57:35 2015
> @@ -484,9 +484,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *
>                   "Creating new SSL context (protocols: %s)", cp);
>  
>      if (protocol == SSL_PROTOCOL_SSLV3) {
> +#ifndef OPENSSL_NO_SSL3
>          method = mctx->pkp ?
>              SSLv3_client_method() : /* proxy */
>              SSLv3_server_method();  /* server */
> +#else
> +        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s,
> +            "SSLv3 protocol not available");
> +        return ssl_die(s);
> +#endif
>      }
>      else if (protocol == SSL_PROTOCOL_TLSV1) {
>          method = mctx->pkp ?
>