From: William A. Rowe Jr <wrowe@apache.org>
Date: Mon, 29 Aug 2005 19:57:26 +0000 (+0000)
Subject:   While eliminating all but TLSv1 (the only FIPS-complient handshaking
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fheads%2Ffips-dev;p=thirdparty%2Fapache%2Fhttpd.git

  While eliminating all but TLSv1 (the only FIPS-complient handshaking
  mechansim), I noticed that we have several other single-case methods
  similar to the SSLv2 exception; use the explicit method in preference
  to the generic SSLv23_client|server_method() calls if exactly one
  method is supported.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/fips-dev@264620 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
index 2e7993986fa..78d4162a289 100644
--- a/modules/ssl/ssl_engine_init.c
+++ b/modules/ssl/ssl_engine_init.c
@@ -446,14 +446,23 @@ static void ssl_init_ctx_protocol(server_rec *s,
         method = mctx->pkp ?
             SSLv2_client_method() : /* proxy */
             SSLv2_server_method();  /* server */
-        ctx = SSL_CTX_new(method);  /* only SSLv2 is left */
     }
-    else {
+    else if (protocol == SSL_PROTOCOL_SSLV3) {
+        method = mctx->pkp ?
+            SSLv3_client_method() : /* proxy */
+            SSLv3_server_method();  /* server */
+    }
+    else if (protocol == SSL_PROTOCOL_TLSV1) {
+        method = mctx->pkp ?
+            TLSv1_client_method() : /* proxy */
+            TLSv1_server_method();  /* server */
+    }
+    else { /* For multiple protocols, we need a flexible method */
         method = mctx->pkp ?
             SSLv23_client_method() : /* proxy */
             SSLv23_server_method();  /* server */
-        ctx = SSL_CTX_new(method); /* be more flexible */
     }
+    ctx = SSL_CTX_new(method);
 
     mctx->ssl_ctx = ctx;