File httpd-2.4.37-sslcipherdefault.patch of Package httpd-2.4.37

File httpd-2.4.37-sslcipherdefault.patch of Package httpd-2.4.37 (Revision 4)

Currently displaying revision 4, show latest

--- httpd-2.4.37/modules/ssl/ssl_engine_config.c.orig	2018-12-12 13:31:38.114955358 +0100
+++ httpd-2.4.37/modules/ssl/ssl_engine_config.c	2018-12-12 13:34:15.342955500 +0100
@@ -776,8 +776,10 @@
     }
     
     if (!strcmp("SSL", arg1)) {
-        /* always disable null and export ciphers */
-        arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
+       /* Disable null and export ciphers by default, except for PROFILE=
+        * configs where the parser doesn't cope. */
+        if (strncmp(arg2, "PROFILE=", 8) != 0)
+            arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
         if (cmd->path) {
             dc->szCipherSuite = arg2;
         }
@@ -1538,8 +1540,10 @@
     }
     
     if (!strcmp("SSL", arg1)) {
-        /* always disable null and export ciphers */
-        arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
+        /* Disable null and export ciphers by default, except for PROFILE=
+         * configs where the parser doesn't cope. */
+        if (strncmp(arg2, "PROFILE=", 8) != 0)
+           arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL);
         dc->proxy->auth.cipher_suite = arg2;
         return NULL;
     }