diff options
| author |   henning <henning@openbsd.org> | 2004-10-20 14:02:40 +0000 |
|---|---|---|
| committer | henning <henning@openbsd.org> | 2004-10-20 14:02:40 +0000 |
| commit | be7cd333f254b585931462027a1c07b652b17649 (patch) | |
| tree | 166679e4aa0d714f200b362458e107192cba463f /usr.sbin/httpd/src/modules/ssl/ssl_engine_kernel.c | |
| parent | put newline at right place during attach (diff) | |
| download | wireguard-openbsd-be7cd333f254b585931462027a1c07b652b17649.tar.xz wireguard-openbsd-be7cd333f254b585931462027a1c07b652b17649.zip | |
merge changes from mod_ssl 2.8.20, in particular a fix for CAN-2004-0885
Diffstat (limited to 'usr.sbin/httpd/src/modules/ssl/ssl_engine_kernel.c')
| -rw-r--r-- | usr.sbin/httpd/src/modules/ssl/ssl_engine_kernel.c | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/usr.sbin/httpd/src/modules/ssl/ssl_engine_kernel.c b/usr.sbin/httpd/src/modules/ssl/ssl_engine_kernel.c index dd135e4ee89..8bec6d690bf 100644 --- a/usr.sbin/httpd/src/modules/ssl/ssl_engine_kernel.c +++ b/usr.sbin/httpd/src/modules/ssl/ssl_engine_kernel.c @@ -672,7 +672,7 @@ int ssl_hook_Access(request_rec *r) X509_STORE_CTX certstorectx; int depth; STACK_OF(SSL_CIPHER) *skCipherOld; - STACK_OF(SSL_CIPHER) *skCipher; + STACK_OF(SSL_CIPHER) *skCipher = NULL; SSL_CIPHER *pCipher; ap_ctx *apctx; int nVerifyOld; @@ -1067,6 +1067,20 @@ int ssl_hook_Access(request_rec *r) if (cert != NULL) X509_free(cert); } + + /* + * Also check that SSLCipherSuite has been enforced as expected + */ + if (skCipher != NULL) { + pCipher = SSL_get_current_cipher(ssl); + if (sk_SSL_CIPHER_find(skCipher, pCipher) < 0) { + ssl_log(r->server, SSL_LOG_ERROR, + "SSL cipher suite not renegotiated: " + "access to %s denied using cipher %s", + r->filename, SSL_CIPHER_get_name(pCipher)); + return FORBIDDEN; + } + } } /* |