Browse code

use new upstream dh patch

Hanno Böck authored on 01/10/2013 12:53:21
Showing 3 changed files
... ...
@@ -1,10 +1,16 @@
1
+AUX 00_systemd.conf 88 SHA256 487e7451ce2d834d8af09a1db09bfe235fbc87b17b13a88bf849f0739b023ce3 SHA512 c510b77450f45d8ca5b8f00ebae5de9e3dc0ecb45f9857e391ac923dadb6b5193b13e9bc372790de20bb8829f2bee5bfc0e85ad03b3a72818c5dd6a0d7f45353 WHIRLPOOL 35ff7234f1ac513a522481ed08d2281dc331835cccd1049dbbadd9f2dff7fce1700a3ae9fd8f2f490f09d82edd960f4a0b4f00a91db2bafb7c647e3b54733cef
1 2
 AUX 2.2.22-envvars-std.in 1071 SHA256 1721b424f2335640e49d71e671a4be15424d29fe90f55fe4f52bd241a998d3ee SHA512 c18fd461f02ab79fc456a1ad99bf91c8891ecdabd90f41437ebf87e20b3d28d2006a10d6726164c2f0333e7aee350bd125838abaff3a188d8ab2f5f34d3e5466 WHIRLPOOL 59cbee68fc8012df01229b8d5e38045eb974bab3f08ebf5b01097dabb5275bb83e28cd09a058ce71949ca4a2439811cff457d4c7df88d7b3fc5318c6b7ef0075
2 3
 AUX apache-2.2.14-staticdhparameters.diff 11745 SHA256 1fecd496f7df6438cf44b331a0b15d6ceaa0522fcb20d7246772f10f7c3c41df SHA512 5c7fa11b29efd430ddc7144ed8d656c82d9609c9da720cd5d217626505b2257c074bea1ef0f4f2c50b123be58d82fbefac3240b71c3b8c3b9b087c30b090bcf9 WHIRLPOOL ced66883bd7fc4ec868a5d6091cdc765424541c183e53283749d73d4f4b53d0c9221950df816625de9bd115f610931e91b1fac819530294fcb12a0a39b7f6f2c
3 4
 AUX apache-2.2.23-tls-compression-option.diff 4211 SHA256 6ccc0003f486734e660292ac2640d99af830443c09a2d5c9d6aaf371b636d9bd SHA512 915044023b10afca9a67ca90fa4d1175d4d3ef7274308df74c78b0972fd7ec54e3fdb3f4b03ecbfc543b64153b232a140cc8e095b2f74abfcfa0cb86e21fb612 WHIRLPOOL 028be436ac78adcb631b109a23ab7f4b5c2349a95202f8ed33a111b9b2048675892b160ac737875ebe7a73937f8868d665d016a61bdbaec301eacbbad0d1cc05
4 5
 AUX apache-2.4.3-dhparam.diff 12684 SHA256 5185da7eecf04f26cc496a25fabe420db065e59dd088eca51b8c08f0238d12ad SHA512 c49e4c6e607cf5bf11e59c929791d806b15ff30d11e8473e633f2ef406e5d926a2ced1910672e5263f8ea45de6f30eb37048065c1d9fbd11fb7c52603e93bd4b WHIRLPOOL 41e2ac7c8c0734e3132639db7222e488b8ffd18a6c2f2e76b401fdc0b71fc528f3d80eb3d95710084b9fa88e29ce916df215c79b47d80c3ae25188f4cea79e9c
6
+AUX apache-2.4.6-modssl-dhparams.diff 48302 SHA256 529b747ab1858966011ed4ffab14bb8c1f015c98ecbdf72cd3a53c70a6a8f220 SHA512 9f8b0710c9b5134213415dc6dceaaad17536072250d403794b074fb690ad1168b9b408996a192017f988728b656d1cff2e18a66c5a9792580870970a6026a3f2 WHIRLPOOL 2252302acb1366c064a7f304282d480b7920989f2b0022ce8487a1da28b86164759f28fa57bd4d9ff0abf65550290e8feea4de4125bcd75cac35b7269d43a868
5 7
 AUX apache-noip.diff 417 SHA256 c9ed84fec20e69f711600261a395a3d4b3ae2685318f6354c4d2ebd01c0ec4cc SHA512 fa684688e707f5fb511b228b8fa9b0f996dbf615f2f9b6478ab478e801f14c65a7381137cdbda648d68f7818891085c744da3a8249843e73bdf5ef247a90d3fe WHIRLPOOL d2636a34b0d48139adef125e76ef477d84bf7cd9785f094fe57c1d81b45e7392622d232bee5f53896d8b48eb9b3241cd48cbb585ea70d97a872c5cd3f6bfe420
6 8
 AUX apache-npn 9799 SHA256 6e41b59680832b074246dd24a41aec56f9bb35ab4f34674cd20e32f1289c21ab SHA512 60d9c6f750562f087b607edf7939195f31b7e0101b9c8d1c883e3b01da192d354fc291d45832757ab50c029f99ac4ad06fa9b7ce4e5928367d1f89278fa79fa3 WHIRLPOOL 162dba8354efeccbb100a86cb61e47c0a96be11a057cfffccc194abd31721b99f4ef3e5fc9b4a7e82a7495d1369af1be3f7b3d4339ec33af24858a0049474331
9
+AUX apache.conf 55 SHA256 ea616c5cc37979a006d69c51bda43fca15a4327d33175762652b29f5cdea1c7b SHA512 3a53beb7a283d17c14383f16ad14c0602681ac1b193cce8f5aca50ae9d9af3a71054ce4a9ab11cbcb72fe913459e1b306fd54660154e66afe10272f8c0f149f3 WHIRLPOOL fa348414f320a9f70001386dfb77d57ca4836c3ef3d251976077b7ad545d7f6752e534efadbf28c7dcb777388e3d844eba84b939dcf48881983388daf6ac23f0
10
+AUX apache2.2.service 716 SHA256 e850ad73585fbba52ade58a39ca91adbfd52f56a0bbd426ebcadb340a7dcb62b SHA512 5f736c803772077598248bbb41f76dff396dfd2f11a60d1ba929a619275efb8c1b4c0dab78cbcdf83b9ec94db67b958b3333b01f67d71eb3b2e07dba4bca2a7c WHIRLPOOL 776a928422b8f37a12099111a1503674ca901934b60dca8596dc8bc287390be9a0e912d7ba6226dcb22eb7c669fa298ddc20fd7bf5c275b0cf019bae0d594839
11
+AUX apache2.4.service 728 SHA256 4420af10d1237f90ae519e56e75f1cc84e9f7c7b63aca9decf91a77f88ae0390 SHA512 6b43e5638d5da68a5408d45befd10a9e42197c1a393764e945ba22d47d0736e2b28bad36a96f4f4ad4ff928db6f2c1377bd22ce401056b2f21fb38933a3cd972 WHIRLPOOL 5526995c5f4772353fcccbd83ed93c8186cb47f80f5d1244dc454ca886189ac92539572c43978d2868b77002a2397ff4794b3c8f6c655fecb432b8013afaf38e
7 12
 AUX httpd-2.2.16-ecc.diff 8236 SHA256 e7fe97852875de06372d8413248fa20419946e2ab7de5198c93bffa6b5a68461 SHA512 8b54c30f9edc76bd8969ee894038f267d722d1ab8c7332a84fe21704bde0451e1a27503252fa87bd0f749dac3281eb266cda36aa7faec1a36ee6e67a8f9ae6c7 WHIRLPOOL 2d8ad3cd12b27937dcafef31df8c9fa048fb4e1ed06109e745fbe12dc869ceaa21fa2e62aa9bcb729d7fb426c1ee0a82171b5038cac56f8b8ebbc3cd3569daa9
13
+AUX httpd-2.4.3-mod_systemd.patch 5396 SHA256 d8f5c76dd5eb0edc9759ea300d3b320ee96b6e6f9fabb8a4043f8d1b77b646a2 SHA512 0db785fac6034aa431e9d816bd06020a5b287dbdae794f8b94eb267805981a1d2a97fdb92bd13e32d35329e6db3f799a03e98456329f6a80c5863e72a26e5c59 WHIRLPOOL 4016b9626af1a8ca001518e8a45262ca4dd27a998727db988a8f1234aa7c5d56d439f4ecfdc6219510f57c97991884a7f57eaa83535988cb72e9fd8ffdee7b6e
8 14
 DIST gentoo-apache-2.2.22-20120213.tar.bz2 64507 SHA256 737730dabf1e1ccfe9d409067dc3c4d37d16f7fa1e792f5bf39268d904ce1c31 SHA512 f364bdbee967b3bc797d2053b9eb347af963f99275441093930d0057465e1a12567106f5c5ac21a45a4bbd4b353ce67553038d6146f469a7bf980a9148471170 WHIRLPOOL f5a3ab44fc14ddf67ccf0785006b1d9f5c49b915114f9d7e97858fba447a5ee872c741e73c17e121b61cc0aa678b42dc154616cd64054461c552d3a8c29f4f17
9 15
 DIST gentoo-apache-2.2.23-20121012.tar.bz2 64135 SHA256 711a88f26c58b10b082f7ff411366cd768f9450101da050438a2f77abeab7333 SHA512 92a49f954b82d4427862f41977625a60641731cc25ab3efdd666be8db839038e7b1c2ef2f878d5efed243eaa63237e88ee4993cd25cca1dfbb0f56a6b2093d57 WHIRLPOOL 221d9c0cf999430afc11a8e48ae67019c7f31daca827a5db7615aca24859788743e5da00e4c99b7b7b375e58fafd6c148339e5671be939dbc30735031e12c49f
10 16
 DIST gentoo-apache-2.4.3-20121012.tar.bz2 24541 SHA256 aeed23c716f05d7430a6d905fb75c192418c9ba90feb96fcc474138c4addfd69 SHA512 fe37c91328bf090aacd4012030845b2e4461a116b9b60d95108c4a4749729bef5ac526d4bd3570406f3d7afe41b0f634c2e9a167ee416a56f5f82f46eb27cc26 WHIRLPOOL 421efb4a7940b52cbc2e054c5ef2f79ff19c13a3140941ec659da3ff61a70491485c1c375db29b1fa6c4dc45761df1f0fc63bd3d867c8937d33f5b6c948bade0
... ...
@@ -26,4 +32,4 @@ EBUILD apache-2.2.25.ebuild 3297 SHA256 f2a97144d474359d89e67248fa1f7a58c22e1268
26 32
 EBUILD apache-2.4.3.ebuild 7203 SHA256 082ee4bc36fe78621a32ad8ae3f3117943b5572e1456618d1b547cf344c4d687 SHA512 56786dc2e5f835e1894760ad85bfba6ffd531b50e7e9f782240ac2deb7464a2aa222cd04495ab7bd81f0e30c91972f417857c9fd4ee53587ebc91ba6a542c41e WHIRLPOOL 4e8e22861a21d8defd9c8eb57fc5548ba38a911db640fc63b6a15fdcfcf86c8fbf50b09f78321ea784bf81340718242d5a7fa6c6ed1c4e0c31a4e79affc64d24
27 33
 EBUILD apache-2.4.4-r1.ebuild 7252 SHA256 64b4537ade811698d002a19da3b32dc54fc590c76cab613095f7086502b34dca SHA512 30f72175c5093f6fcee56892b79e3c72106c7f160a5dff3f7f29c0be376ed94271b35f536ec4d3d539f352a90c9d741b368eb8aaeada501da8a22f1f8cfa67dc WHIRLPOOL 0bd24504dcbab1e364209e622f93a5baf78976761f9e4de7a85686417e6077829f8ca1ab7a87724f3c03362249de3fada01c06e9f553ec8bd24cf1bead516a4b
28 34
 EBUILD apache-2.4.6-r1.ebuild 7476 SHA256 6d6b9331dce777b11cfef9bd8b5e9ac006e93728f549225ab6945cb81037a1a9 SHA512 c5ceb713601e2372bb36bdb705d9a7d7dd8c76ffa09339124b11b0054c180606243b21e2c1e95346a7ac0d0ab302ff88e238a8447b553abf08b8a42b390d9e42 WHIRLPOOL 974cf7113269dfb87c138635abd610aaddf92aa94d9dad508b1c11c3636715d9dcce969e0d7e13db1bf854b0f9c2100c428c351795987708659d3ad3ab9ca9b1
29
-EBUILD apache-2.4.6-r2.ebuild 7479 SHA256 f03c11e0c4faf54b368158249ab5591d92d9a215ced2f345940c65d462843fac SHA512 16a1f8dbb234feb054b05146f190dab26df1f6b325b0dc4fae429d4864087df915e8a2cffb38395aebe121ff2028c7b7edbb302ce19f2d0781a57e00a59bae03 WHIRLPOOL a386b5572216edffbf829fa51ed65d3896204d0a6562b06bb89d33ffda74c5bc5eb9201ad449a3567f47232f1a5881fb9b84a233cb72ba888f7ceb28042fdd2c
35
+EBUILD apache-2.4.6-r2.ebuild 7487 SHA256 6d15eef1bc7ca1b70be5f61e2dfed5f8ae9feb5c3b42142c06ffc1c3a132c2cb SHA512 84d0cb9cf92a09775116702b65fc87cae08cdf0316602f9e1f05278414a9e3a9ebbbd05e4a6c2e61d7100dfb25db9b5535d3e6cc51f7294889ba370166c58be7 WHIRLPOOL 68b4c5223776d6e08c1da9e4caa93245fcf0a6f83327d6a719c0f202eb14b4a339e7105f872ca062e5f4f1f6fced87e6ddab6fc3c3f412fa6117d545e27a3dc2
... ...
@@ -136,7 +136,7 @@ RDEPEND="${RDEPEND}
136 136
 
137 137
 # init script fixup - should be rolled into next tarball #389965
138 138
 src_prepare() {
139
-	epatch "${FILESDIR}/apache-2.4.3-dhparam.diff"
139
+	epatch "${FILESDIR}/apache-2.4.6-modssl-dhparams.diff"
140 140
 
141 141
 	# the following patch can be removed once it is included in
142 142
 	# GENTOO_PATCHNAME="gentoo-apache-2.4.1" ...
143 143
new file mode 100644
... ...
@@ -0,0 +1,1552 @@
1
+diff -Naur httpd-2.4.6-orig/LAYOUT httpd-2.4.6/LAYOUT
2
+--- httpd-2.4.6-orig/LAYOUT	2013-10-01 12:20:45.706812951 +0200
3
+@@ -108,7 +108,6 @@
4
+     mod_ssl.c ............... main source file containing API structures
5
+     mod_ssl.h ............... common header file of mod_ssl
6
+     ssl_engine_config.c ..... module configuration handling
7
+-    ssl_engine_dh.c ......... DSA/DH support
8
+     ssl_engine_init.c ....... module initialization
9
+     ssl_engine_io.c ......... I/O support
10
+     ssl_engine_kernel.c ..... SSL engine kernel
11
+diff -Naur httpd-2.4.6-orig/modules/ssl/config.m4 httpd-2.4.6/modules/ssl/config.m4
12
+--- httpd-2.4.6-orig/modules/ssl/config.m4	2013-10-01 12:20:45.774812101 +0200
13
+@@ -20,7 +20,6 @@
14
+ ssl_objs="dnl
15
+ mod_ssl.lo dnl
16
+ ssl_engine_config.lo dnl
17
+-ssl_engine_dh.lo dnl
18
+ ssl_engine_init.lo dnl
19
+ ssl_engine_io.lo dnl
20
+ ssl_engine_kernel.lo dnl
21
+diff -Naur httpd-2.4.6-orig/modules/ssl/mod_ssl.c httpd-2.4.6/modules/ssl/mod_ssl.c
22
+--- httpd-2.4.6-orig/modules/ssl/mod_ssl.c	2013-10-01 12:20:45.775812088 +0200
23
+@@ -148,7 +148,7 @@
24
+     SSL_CMD_SRV(StrictSNIVHostCheck, FLAG,
25
+                 "Strict SNI virtual host checking")
26
+ 
27
+-#ifndef OPENSSL_NO_SRP
28
++#ifdef HAVE_SRP
29
+     SSL_CMD_SRV(SRPVerifierFile, TAKE1,
30
+                 "SRP verifier file "
31
+                 "('/path/to/file' - created by srptool)")
32
+@@ -471,15 +471,6 @@
33
+ 
34
+     sslconn->ssl = ssl;
35
+ 
36
+-    /*
37
+-     *  Configure callbacks for SSL connection
38
+-     */
39
+-    SSL_set_tmp_rsa_callback(ssl, ssl_callback_TmpRSA);
40
+-    SSL_set_tmp_dh_callback(ssl,  ssl_callback_TmpDH);
41
+-#ifndef OPENSSL_NO_EC
42
+-    SSL_set_tmp_ecdh_callback(ssl, ssl_callback_TmpECDH);
43
+-#endif
44
+-
45
+     SSL_set_verify_result(ssl, X509_V_OK);
46
+ 
47
+     ssl_io_filter_init(c, r, ssl);
48
+diff -Naur httpd-2.4.6-orig/modules/ssl/mod_ssl.dsp httpd-2.4.6/modules/ssl/mod_ssl.dsp
49
+--- httpd-2.4.6-orig/modules/ssl/mod_ssl.dsp	2013-10-01 12:20:45.775812088 +0200
50
+@@ -112,10 +112,6 @@
51
+ # End Source File
52
+ # Begin Source File
53
+ 
54
+-SOURCE=.\ssl_engine_dh.c
55
+-# End Source File
56
+-# Begin Source File
57
+-
58
+ SOURCE=.\ssl_engine_init.c
59
+ # End Source File
60
+ # Begin Source File
61
+diff -Naur httpd-2.4.6-orig/modules/ssl/ssl_engine_config.c httpd-2.4.6/modules/ssl/ssl_engine_config.c
62
+--- httpd-2.4.6-orig/modules/ssl/ssl_engine_config.c	2013-10-01 12:20:45.776812076 +0200
63
+@@ -75,8 +75,6 @@
64
+     mc->stapling_mutex         = NULL;
65
+ #endif
66
+ 
67
+-    memset(mc->pTmpKeys, 0, sizeof(mc->pTmpKeys));
68
+-
69
+     apr_pool_userdata_set(mc, SSL_MOD_CONFIG_KEY,
70
+                           apr_pool_cleanup_null,
71
+                           pool);
72
+@@ -150,7 +148,7 @@
73
+     mctx->stapling_force_url         = NULL;
74
+ #endif
75
+ 
76
+-#ifndef OPENSSL_NO_SRP
77
++#ifdef HAVE_SRP
78
+     mctx->srp_vfile =             NULL;
79
+     mctx->srp_unknown_user_seed = NULL;
80
+     mctx->srp_vbase =             NULL;
81
+@@ -208,7 +206,7 @@
82
+     sc->proxy_ssl_check_peer_expire = SSL_ENABLED_UNSET;
83
+     sc->proxy_ssl_check_peer_cn     = SSL_ENABLED_UNSET;
84
+     sc->proxy_ssl_check_peer_name   = SSL_ENABLED_UNSET;
85
+-#ifndef OPENSSL_NO_TLSEXT
86
++#ifdef HAVE_TLSEXT
87
+     sc->strict_sni_vhost_check = SSL_ENABLED_UNSET;
88
+ #endif
89
+ #ifdef HAVE_FIPS
90
+@@ -282,7 +280,7 @@
91
+     cfgMerge(stapling_force_url, NULL);
92
+ #endif
93
+ 
94
+-#ifndef OPENSSL_NO_SRP
95
++#ifdef HAVE_SRP
96
+     cfgMergeString(srp_vfile);
97
+     cfgMergeString(srp_unknown_user_seed);
98
+ #endif
99
+@@ -338,7 +336,7 @@
100
+     cfgMerge(proxy_ssl_check_peer_expire, SSL_ENABLED_UNSET);
101
+     cfgMerge(proxy_ssl_check_peer_cn, SSL_ENABLED_UNSET);
102
+     cfgMerge(proxy_ssl_check_peer_name, SSL_ENABLED_UNSET);
103
+-#ifndef OPENSSL_NO_TLSEXT
104
++#ifdef HAVE_TLSEXT
105
+     cfgMerge(strict_sni_vhost_check, SSL_ENABLED_UNSET);
106
+ #endif
107
+ #ifdef HAVE_FIPS
108
+@@ -645,6 +643,9 @@
109
+     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
110
+     SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
111
+ 
112
++    /* always disable null and export ciphers */
113
++    arg = apr_pstrcat(cmd->pool, "!aNULL:!eNULL:!EXP:", arg, NULL);
114
++
115
+     if (cmd->path) {
116
+         dc->szCipherSuite = arg;
117
+     }
118
+@@ -1384,6 +1385,9 @@
119
+ {
120
+     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
121
+ 
122
++    /* always disable null and export ciphers */
123
++    arg = apr_pstrcat(cmd->pool, "!aNULL:!eNULL:!EXP:", arg, NULL);
124
++
125
+     sc->proxy->auth.cipher_suite = arg;
126
+ 
127
+     return NULL;
128
+@@ -1645,7 +1649,7 @@
129
+ 
130
+ const char  *ssl_cmd_SSLStrictSNIVHostCheck(cmd_parms *cmd, void *dcfg, int flag)
131
+ {
132
+-#ifndef OPENSSL_NO_TLSEXT
133
++#ifdef HAVE_TLSEXT
134
+     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
135
+ 
136
+     sc->strict_sni_vhost_check = flag ? SSL_ENABLED_TRUE : SSL_ENABLED_FALSE;
137
+@@ -1804,7 +1808,7 @@
138
+ 
139
+ #endif /* HAVE_OCSP_STAPLING */
140
+ 
141
+-#ifndef OPENSSL_NO_SRP
142
++#ifdef HAVE_SRP
143
+ 
144
+ const char *ssl_cmd_SSLSRPVerifierFile(cmd_parms *cmd, void *dcfg,
145
+                                        const char *arg)
146
+@@ -1828,7 +1832,7 @@
147
+     return NULL;
148
+ }
149
+ 
150
+-#endif /* OPENSSL_NO_SRP */
151
++#endif /* HAVE_SRP */
152
+ 
153
+ void ssl_hook_ConfigTest(apr_pool_t *pconf, server_rec *s)
154
+ {
155
+diff -Naur httpd-2.4.6-orig/modules/ssl/ssl_engine_dh.c httpd-2.4.6/modules/ssl/ssl_engine_dh.c
156
+--- httpd-2.4.6-orig/modules/ssl/ssl_engine_dh.c	2013-10-01 12:20:45.777812063 +0200
157
+@@ -1,244 +0,0 @@
158
+-#if 0
159
+-=pod
160
+-#endif
161
+-
162
+-/* Licensed to the Apache Software Foundation (ASF) under one or more
163
+- * contributor license agreements.  See the NOTICE file distributed with
164
+- * this work for additional information regarding copyright ownership.
165
+- * The ASF licenses this file to You under the Apache License, Version 2.0
166
+- * (the "License"); you may not use this file except in compliance with
167
+- * the License.  You may obtain a copy of the License at
168
+- *
169
+- *     http://www.apache.org/licenses/LICENSE-2.0
170
+- *
171
+- * Unless required by applicable law or agreed to in writing, software
172
+- * distributed under the License is distributed on an "AS IS" BASIS,
173
+- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
174
+- * See the License for the specific language governing permissions and
175
+- * limitations under the License.
176
+- */
177
+-
178
+-/*                      _             _
179
+- *  _ __ ___   ___   __| |    ___ ___| |  mod_ssl
180
+- * | '_ ` _ \ / _ \ / _` |   / __/ __| |  Apache Interface to OpenSSL
181
+- * | | | | | | (_) | (_| |   \__ \__ \ |
182
+- * |_| |_| |_|\___/ \__,_|___|___/___/_|
183
+- *                      |_____|
184
+- * ssl_engine_dh.c
185
+- * Diffie-Hellman Built-in Temporary Parameters
186
+- */
187
+-
188
+-#include "ssl_private.h"
189
+-
190
+-/* ----BEGIN GENERATED SECTION-------- */
191
+-
192
+-/*
193
+-** Diffie-Hellman-Parameters: (512 bit)
194
+-**     prime:
195
+-**         00:9f:db:8b:8a:00:45:44:f0:04:5f:17:37:d0:ba:
196
+-**         2e:0b:27:4c:df:1a:9f:58:82:18:fb:43:53:16:a1:
197
+-**         6e:37:41:71:fd:19:d8:d8:f3:7c:39:bf:86:3f:d6:
198
+-**         0e:3e:30:06:80:a3:03:0c:6e:4c:37:57:d0:8f:70:
199
+-**         e6:aa:87:10:33
200
+-**     generator: 2 (0x2)
201
+-** Diffie-Hellman-Parameters: (1024 bit)
202
+-**     prime:
203
+-**         00:d6:7d:e4:40:cb:bb:dc:19:36:d6:93:d3:4a:fd:
204
+-**         0a:d5:0c:84:d2:39:a4:5f:52:0b:b8:81:74:cb:98:
205
+-**         bc:e9:51:84:9f:91:2e:63:9c:72:fb:13:b4:b4:d7:
206
+-**         17:7e:16:d5:5a:c1:79:ba:42:0b:2a:29:fe:32:4a:
207
+-**         46:7a:63:5e:81:ff:59:01:37:7b:ed:dc:fd:33:16:
208
+-**         8a:46:1a:ad:3b:72:da:e8:86:00:78:04:5b:07:a7:
209
+-**         db:ca:78:74:08:7d:15:10:ea:9f:cc:9d:dd:33:05:
210
+-**         07:dd:62:db:88:ae:aa:74:7d:e0:f4:d6:e2:bd:68:
211
+-**         b0:e7:39:3e:0f:24:21:8e:b3
212
+-**     generator: 2 (0x2)
213
+-*/
214
+-
215
+-static unsigned char dh512_p[] = {
216
+-    0x9F, 0xDB, 0x8B, 0x8A, 0x00, 0x45, 0x44, 0xF0, 0x04, 0x5F, 0x17, 0x37,
217
+-    0xD0, 0xBA, 0x2E, 0x0B, 0x27, 0x4C, 0xDF, 0x1A, 0x9F, 0x58, 0x82, 0x18,
218
+-    0xFB, 0x43, 0x53, 0x16, 0xA1, 0x6E, 0x37, 0x41, 0x71, 0xFD, 0x19, 0xD8,
219
+-    0xD8, 0xF3, 0x7C, 0x39, 0xBF, 0x86, 0x3F, 0xD6, 0x0E, 0x3E, 0x30, 0x06,
220
+-    0x80, 0xA3, 0x03, 0x0C, 0x6E, 0x4C, 0x37, 0x57, 0xD0, 0x8F, 0x70, 0xE6,
221
+-    0xAA, 0x87, 0x10, 0x33,
222
+-};
223
+-static unsigned char dh512_g[] = {
224
+-    0x02,
225
+-};
226
+-
227
+-static DH *get_dh512(void)
228
+-{
229
+-    DH *dh;
230
+-
231
+-    if (!(dh = DH_new())) {
232
+-        return NULL;
233
+-    }
234
+-
235
+-    dh->p = BN_bin2bn(dh512_p, sizeof(dh512_p), NULL);
236
+-    dh->g = BN_bin2bn(dh512_g, sizeof(dh512_g), NULL);
237
+-    if (!(dh->p && dh->g)) {
238
+-        DH_free(dh);
239
+-        return NULL;
240
+-    }
241
+-
242
+-    return dh;
243
+-}
244
+-
245
+-static unsigned char dh1024_p[] = {
246
+-    0xD6, 0x7D, 0xE4, 0x40, 0xCB, 0xBB, 0xDC, 0x19, 0x36, 0xD6, 0x93, 0xD3,
247
+-    0x4A, 0xFD, 0x0A, 0xD5, 0x0C, 0x84, 0xD2, 0x39, 0xA4, 0x5F, 0x52, 0x0B,
248
+-    0xB8, 0x81, 0x74, 0xCB, 0x98, 0xBC, 0xE9, 0x51, 0x84, 0x9F, 0x91, 0x2E,
249
+-    0x63, 0x9C, 0x72, 0xFB, 0x13, 0xB4, 0xB4, 0xD7, 0x17, 0x7E, 0x16, 0xD5,
250
+-    0x5A, 0xC1, 0x79, 0xBA, 0x42, 0x0B, 0x2A, 0x29, 0xFE, 0x32, 0x4A, 0x46,
251
+-    0x7A, 0x63, 0x5E, 0x81, 0xFF, 0x59, 0x01, 0x37, 0x7B, 0xED, 0xDC, 0xFD,
252
+-    0x33, 0x16, 0x8A, 0x46, 0x1A, 0xAD, 0x3B, 0x72, 0xDA, 0xE8, 0x86, 0x00,
253
+-    0x78, 0x04, 0x5B, 0x07, 0xA7, 0xDB, 0xCA, 0x78, 0x74, 0x08, 0x7D, 0x15,
254
+-    0x10, 0xEA, 0x9F, 0xCC, 0x9D, 0xDD, 0x33, 0x05, 0x07, 0xDD, 0x62, 0xDB,
255
+-    0x88, 0xAE, 0xAA, 0x74, 0x7D, 0xE0, 0xF4, 0xD6, 0xE2, 0xBD, 0x68, 0xB0,
256
+-    0xE7, 0x39, 0x3E, 0x0F, 0x24, 0x21, 0x8E, 0xB3,
257
+-};
258
+-static unsigned char dh1024_g[] = {
259
+-    0x02,
260
+-};
261
+-
262
+-static DH *get_dh1024(void)
263
+-{
264
+-    DH *dh;
265
+-
266
+-    if (!(dh = DH_new())) {
267
+-        return NULL;
268
+-    }
269
+-
270
+-    dh->p = BN_bin2bn(dh1024_p, sizeof(dh1024_p), NULL);
271
+-    dh->g = BN_bin2bn(dh1024_g, sizeof(dh1024_g), NULL);
272
+-    if (!(dh->p && dh->g)) {
273
+-        DH_free(dh);
274
+-        return NULL;
275
+-    }
276
+-
277
+-    return dh;
278
+-}
279
+-
280
+-/* ----END GENERATED SECTION---------- */
281
+-
282
+-DH *ssl_dh_GetTmpParam(int nKeyLen)
283
+-{
284
+-    DH *dh;
285
+-
286
+-    if (nKeyLen == 512)
287
+-        dh = get_dh512();
288
+-    else if (nKeyLen == 1024)
289
+-        dh = get_dh1024();
290
+-    else
291
+-        dh = get_dh1024();
292
+-    return dh;
293
+-}
294
+-
295
+-DH *ssl_dh_GetParamFromFile(char *file)
296
+-{
297
+-    DH *dh = NULL;
298
+-    BIO *bio;
299
+-
300
+-    if ((bio = BIO_new_file(file, "r")) == NULL)
301
+-        return NULL;
302
+-    dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
303
+-    BIO_free(bio);
304
+-    return (dh);
305
+-}
306
+-
307
+-/*
308
+-=cut
309
+-##
310
+-##  Embedded Perl script for generating the temporary DH parameters
311
+-##
312
+-
313
+-require 5.003;
314
+-use strict;
315
+-
316
+-#   configuration
317
+-my $file  = $0;
318
+-my $begin = '----BEGIN GENERATED SECTION--------';
319
+-my $end   = '----END GENERATED SECTION----------';
320
+-
321
+-#   read ourself and keep a backup
322
+-open(FP, "<$file") || die;
323
+-my $source = '';
324
+-$source .= $_ while (<FP>);
325
+-close(FP);
326
+-open(FP, ">$file.bak") || die;
327
+-print FP $source;
328
+-close(FP);
329
+-
330
+-#   generate the DH parameters
331
+-print "1. Generate 512 and 1024 bit Diffie-Hellman parameters (p, g)\n";
332
+-my $rand = '';
333
+-foreach $file (qw(/var/log/messages /var/adm/messages
334
+-                  /kernel /vmunix /vmlinuz /etc/hosts /etc/resolv.conf)) {
335
+-    if (-f $file) {
336
+-        $rand = $file     if ($rand eq '');
337
+-        $rand .= ":$file" if ($rand ne '');
338
+-    }
339
+-}
340
+-$rand = "-rand $rand" if ($rand ne '');
341
+-system("openssl gendh $rand -out dh512.pem 512");
342
+-system("openssl gendh $rand -out dh1024.pem 1024");
343
+-
344
+-#   generate DH param info
345
+-my $dhinfo = '';
346
+-open(FP, "openssl dh -noout -text -in dh512.pem |") || die;
347
+-$dhinfo .= $_ while (<FP>);
348
+-close(FP);
349
+-open(FP, "openssl dh -noout -text -in dh1024.pem |") || die;
350
+-$dhinfo .= $_ while (<FP>);
351
+-close(FP);
352
+-$dhinfo =~ s|^|** |mg;
353
+-$dhinfo = "\n\/\*\n$dhinfo\*\/\n\n";
354
+-
355
+-my $indent_args = "-i4 -npsl -di0 -br -nce -d0 -cli0 -npcs -nfc1";
356
+-
357
+-#   generate C source from DH params
358
+-my $dhsource = '';
359
+-open(FP, "openssl dh -noout -C -in dh512.pem | indent $indent_args | expand |") || die;
360
+-$dhsource .= $_ while (<FP>);
361
+-close(FP);
362
+-open(FP, "openssl dh -noout -C -in dh1024.pem | indent $indent_args | expand |") || die;
363
+-$dhsource .= $_ while (<FP>);
364
+-close(FP);
365
+-$dhsource =~ s|(DH\s+\*get_dh)(\d+)[^}]*\n}|static $1$2(void)
366
+-{
367
+-    DH *dh;
368
+-
369
+-    if (!(dh = DH_new())) {
370
+-        return NULL;
371
+-    }
372
+-
373
+-    dh->p = BN_bin2bn(dh$2_p, sizeof(dh$2_p), NULL);
374
+-    dh->g = BN_bin2bn(dh$2_g, sizeof(dh$2_g), NULL);
375
+-    if (!(dh->p && dh->g)) {
376
+-        DH_free(dh);
377
+-        return NULL;
378
+-    }
379
+-
380
+-    return dh;
381
+-}
382
+-|sg;
383
+-
384
+-#   generate output
385
+-my $o = $dhinfo . $dhsource;
386
+-
387
+-#   insert the generated code at the target location
388
+-$source =~ s|(\/\* $begin.+?\n).*\n(.*?\/\* $end)|$1$o$2|s;
389
+-
390
+-#   and update the source on disk
391
+-print "Updating file `$file'\n";
392
+-open(FP, ">$file") || die;
393
+-print FP $source;
394
+-close(FP);
395
+-
396
+-#   cleanup
397
+-unlink("dh512.pem");
398
+-unlink("dh1024.pem");
399
+-
400
+-=pod
401
+-*/
402
+diff -Naur httpd-2.4.6-orig/modules/ssl/ssl_engine_init.c httpd-2.4.6/modules/ssl/ssl_engine_init.c
403
+--- httpd-2.4.6-orig/modules/ssl/ssl_engine_init.c	2013-10-01 12:20:45.777812063 +0200
404
+@@ -35,7 +35,7 @@
405
+ **  _________________________________________________________________
406
+ */
407
+ 
408
+-#ifndef OPENSSL_NO_EC
409
++#ifdef HAVE_ECC
410
+ #define KEYTYPES "RSA, DSA or ECC"
411
+ #else 
412
+ #define KEYTYPES "RSA or DSA"
413
+@@ -56,180 +56,6 @@
414
+                  modver, AP_SERVER_BASEVERSION, incver);
415
+ }
416
+ 
417
+-
418
+-/*
419
+- * Handle the Temporary RSA Keys and DH Params
420
+- */
421
+-
422
+-#define MODSSL_TMP_KEY_FREE(mc, type, idx) \
423
+-    if (mc->pTmpKeys[idx]) { \
424
+-        type##_free((type *)mc->pTmpKeys[idx]); \
425
+-        mc->pTmpKeys[idx] = NULL; \
426
+-    }
427
+-
428
+-#define MODSSL_TMP_KEYS_FREE(mc, type) \
429
+-    MODSSL_TMP_KEY_FREE(mc, type, SSL_TMP_KEY_##type##_512); \
430
+-    MODSSL_TMP_KEY_FREE(mc, type, SSL_TMP_KEY_##type##_1024)
431
+-
432
+-static void ssl_tmp_keys_free(server_rec *s)
433
+-{
434
+-    SSLModConfigRec *mc = myModConfig(s);
435
+-
436
+-    MODSSL_TMP_KEYS_FREE(mc, RSA);
437
+-    MODSSL_TMP_KEYS_FREE(mc, DH);
438
+-#ifndef OPENSSL_NO_EC
439
+-    MODSSL_TMP_KEY_FREE(mc, EC_KEY, SSL_TMP_KEY_EC_256);
440
+-#endif
441
+-}
442
+-
443
+-static int ssl_tmp_key_init_rsa(server_rec *s,
444
+-                                int bits, int idx)
445
+-{
446
+-    SSLModConfigRec *mc = myModConfig(s);
447
+-
448
+-#ifdef HAVE_FIPS
449
+-
450
+-    if (FIPS_mode() && bits < 1024) {
451
+-        mc->pTmpKeys[idx] = NULL;
452
+-        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01877)
453
+-                     "Init: Skipping generating temporary "
454
+-                     "%d bit RSA private key in FIPS mode", bits);
455
+-        return OK;
456
+-    }
457
+-
458
+-#endif
459
+-#ifdef HAVE_GENERATE_EX
460
+-    {
461
+-        RSA *tkey;
462
+-        BIGNUM *bn_f4;
463
+-        if (!(tkey = RSA_new())
464
+-          || !(bn_f4 = BN_new())
465
+-          || !BN_set_word(bn_f4, RSA_F4)
466
+-          || !RSA_generate_key_ex(tkey, bits, bn_f4, NULL))
467
+-        {
468
+-            ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01878)
469
+-                         "Init: Failed to generate temporary "
470
+-                         "%d bit RSA private key", bits);
471
+-            ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, s);
472
+-            return !OK;
473
+-        }
474
+-        BN_free(bn_f4);
475
+-        mc->pTmpKeys[idx] = tkey;
476
+-    }
477
+-#else
478
+-    if (!(mc->pTmpKeys[idx] =
479
+-          RSA_generate_key(bits, RSA_F4, NULL, NULL)))
480
+-    {
481
+-        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01879)
482
+-                     "Init: Failed to generate temporary "
483
+-                     "%d bit RSA private key", bits);
484
+-        ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, s);
485
+-        return !OK;
486
+-    }
487
+-#endif
488
+-
489
+-    return OK;
490
+-}
491
+-
492
+-static int ssl_tmp_key_init_dh(server_rec *s,
493
+-                               int bits, int idx)
494
+-{
495
+-    SSLModConfigRec *mc = myModConfig(s);
496
+-
497
+-#ifdef HAVE_FIPS
498
+-
499
+-    if (FIPS_mode() && bits < 1024) {
500
+-        mc->pTmpKeys[idx] = NULL;
501
+-        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01880)
502
+-                     "Init: Skipping generating temporary "
503
+-                     "%d bit DH parameters in FIPS mode", bits);
504
+-        return OK;
505
+-    }
506
+-
507
+-#endif
508
+-
509
+-    if (!(mc->pTmpKeys[idx] =
510
+-          ssl_dh_GetTmpParam(bits)))
511
+-    {
512
+-        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01881)
513
+-                     "Init: Failed to generate temporary "
514
+-                     "%d bit DH parameters", bits);
515
+-        return !OK;
516
+-    }
517
+-
518
+-    return OK;
519
+-}
520
+-
521
+-#ifndef OPENSSL_NO_EC
522
+-static int ssl_tmp_key_init_ec(server_rec *s,
523
+-                               int bits, int idx)
524
+-{
525
+-    SSLModConfigRec *mc = myModConfig(s);
526
+-    EC_KEY *ecdh = NULL;
527
+-
528
+-    /* XXX: Are there any FIPS constraints we should enforce? */
529
+-
530
+-    if (bits != 256) {
531
+-        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02298)
532
+-                     "Init: Failed to generate temporary "
533
+-                     "%d bit EC parameters, only 256 bits supported", bits);
534
+-        return !OK;
535
+-    }
536
+-
537
+-    if ((ecdh = EC_KEY_new()) == NULL ||
538
+-        EC_KEY_set_group(ecdh, EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1)) != 1)
539
+-    {
540
+-        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02299)
541
+-                     "Init: Failed to generate temporary "
542
+-                     "%d bit EC parameters", bits);
543
+-        return !OK;
544
+-    }
545
+-
546
+-    mc->pTmpKeys[idx] = ecdh;
547
+-    return OK;
548
+-}
549
+-
550
+-#define MODSSL_TMP_KEY_INIT_EC(s, bits) \
551
+-    ssl_tmp_key_init_ec(s, bits, SSL_TMP_KEY_EC_##bits)
552
+-
553
+-#endif
554
+-
555
+-#define MODSSL_TMP_KEY_INIT_RSA(s, bits) \
556
+-    ssl_tmp_key_init_rsa(s, bits, SSL_TMP_KEY_RSA_##bits)
557
+-
558
+-#define MODSSL_TMP_KEY_INIT_DH(s, bits) \
559
+-    ssl_tmp_key_init_dh(s, bits, SSL_TMP_KEY_DH_##bits)
560
+-
561
+-static int ssl_tmp_keys_init(server_rec *s)
562
+-{
563
+-    ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s,
564
+-                 "Init: Generating temporary RSA private keys (512/1024 bits)");
565
+-
566
+-    if (MODSSL_TMP_KEY_INIT_RSA(s, 512) ||
567
+-        MODSSL_TMP_KEY_INIT_RSA(s, 1024)) {
568
+-        return !OK;
569
+-    }
570
+-
571
+-    ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s,
572
+-                 "Init: Generating temporary DH parameters (512/1024 bits)");
573
+-
574
+-    if (MODSSL_TMP_KEY_INIT_DH(s, 512) ||
575
+-        MODSSL_TMP_KEY_INIT_DH(s, 1024)) {
576
+-        return !OK;
577
+-    }
578
+-
579
+-#ifndef OPENSSL_NO_EC
580
+-    ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s,
581
+-                 "Init: Generating temporary EC parameters (256 bits)");
582
+-
583
+-    if (MODSSL_TMP_KEY_INIT_EC(s, 256)) {
584
+-        return !OK;
585
+-    }
586
+-#endif
587
+-
588
+-    return OK;
589
+-}
590
+-
591
+ /*
592
+  *  Per-module initialization
593
+  */
594
+@@ -367,10 +193,6 @@
595
+      */
596
+     ssl_pphrase_Handle(base_server, ptemp);
597
+ 
598
+-    if (ssl_tmp_keys_init(base_server)) {
599
+-        return !OK;
600
+-    }
601
+-
602
+     /*
603
+      * initialize the mutex handling
604
+      */
605
+@@ -481,7 +303,7 @@
606
+      */
607
+     if (mctx->pks->certs[SSL_AIDX_RSA] ||
608
+         mctx->pks->certs[SSL_AIDX_DSA]
609
+-#ifndef OPENSSL_NO_EC
610
++#ifdef HAVE_ECC
611
+       || mctx->pks->certs[SSL_AIDX_ECC]
612
+ #endif
613
+         )
614
+@@ -493,7 +315,7 @@
615
+     }
616
+ }
617
+ 
618
+-#ifndef OPENSSL_NO_TLSEXT
619
++#ifdef HAVE_TLSEXT
620
+ static void ssl_init_ctx_tls_extensions(server_rec *s,
621
+                                         apr_pool_t *p,
622
+                                         apr_pool_t *ptemp,
623
+@@ -527,7 +349,7 @@
624
+     }
625
+ #endif
626
+ 
627
+-#ifndef OPENSSL_NO_SRP
628
++#ifdef HAVE_SRP
629
+     /*
630
+      * TLS-SRP support
631
+      */
632
+@@ -660,7 +482,7 @@
633
+ #ifdef SSL_OP_NO_COMPRESSION
634
+         /* OpenSSL >= 1.0 only */
635
+         SSL_CTX_set_options(ctx, SSL_OP_NO_COMPRESSION);
636
+-#elif OPENSSL_VERSION_NUMBER >= 0x00908000L
637
++#else
638
+         sk_SSL_COMP_zero(SSL_COMP_get_compression_methods());
639
+ #endif
640
+     }
641
+@@ -678,6 +500,9 @@
642
+      * Configure additional context ingredients
643
+      */
644
+     SSL_CTX_set_options(ctx, SSL_OP_SINGLE_DH_USE);
645
++#ifdef HAVE_ECC
646
++    SSL_CTX_set_options(ctx, SSL_OP_SINGLE_ECDH_USE);
647
++#endif
648
+ 
649
+ #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
650
+     /*
651
+@@ -718,11 +543,7 @@
652
+ {
653
+     SSL_CTX *ctx = mctx->ssl_ctx;
654
+ 
655
+-    SSL_CTX_set_tmp_rsa_callback(ctx, ssl_callback_TmpRSA);
656
+     SSL_CTX_set_tmp_dh_callback(ctx,  ssl_callback_TmpDH);
657
+-#ifndef OPENSSL_NO_EC
658
+-    SSL_CTX_set_tmp_ecdh_callback(ctx,ssl_callback_TmpECDH);
659
+-#endif
660
+ 
661
+     SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
662
+ }
663
+@@ -818,14 +639,16 @@
664
+                                       modssl_ctx_t *mctx)
665
+ {
666
+     SSL_CTX *ctx = mctx->ssl_ctx;
667
+-    const char *suite = mctx->auth.cipher_suite;
668
++    const char *suite;
669
+ 
670
+     /*
671
+-     *  Configure SSL Cipher Suite
672
++     *  Configure SSL Cipher Suite. Always disable NULL and export ciphers,
673
++     *  see also ssl_engine_config.c:ssl_cmd_SSLCipherSuite().
674
++     *  OpenSSL's SSL_DEFAULT_CIPHER_LIST already includes !aNULL:!eNULL,
675
++     *  so only prepend !EXP in this case.
676
+      */
677
+-    if (!suite) {
678
+-        return;
679
+-    }
680
++    suite = mctx->auth.cipher_suite ? mctx->auth.cipher_suite :
681
++            apr_pstrcat(ptemp, "!EXP:", SSL_DEFAULT_CIPHER_LIST, NULL);
682
+ 
683
+     ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s,
684
+                  "Configuring permitted SSL ciphers [%s]",
685
+@@ -988,7 +811,7 @@
686
+     if (mctx->pks) {
687
+         /* XXX: proxy support? */
688
+         ssl_init_ctx_cert_chain(s, p, ptemp, mctx);
689
+-#ifndef OPENSSL_NO_TLSEXT
690
++#ifdef HAVE_TLSEXT
691
+         ssl_init_ctx_tls_extensions(s, p, ptemp, mctx);
692
+ #endif
693
+     }
694
+@@ -1001,7 +824,7 @@
695
+ {
696
+     SSLModConfigRec *mc = myModConfig(s);
697
+     ssl_asn1_t *asn1;
698
+-    MODSSL_D2I_X509_CONST unsigned char *ptr;
699
++    const unsigned char *ptr;
700
+     const char *type = ssl_asn1_keystr(idx);
701
+     X509 *cert;
702
+ 
703
+@@ -1048,12 +871,12 @@
704
+ {
705
+     SSLModConfigRec *mc = myModConfig(s);
706
+     ssl_asn1_t *asn1;
707
+-    MODSSL_D2I_PrivateKey_CONST unsigned char *ptr;
708
++    const unsigned char *ptr;
709
+     const char *type = ssl_asn1_keystr(idx);
710
+     int pkey_type;
711
+     EVP_PKEY *pkey;
712
+ 
713
+-#ifndef OPENSSL_NO_EC
714
++#ifdef HAVE_ECC
715
+     if (idx == SSL_AIDX_ECC)
716
+       pkey_type = EVP_PKEY_EC;
717
+     else
718
+@@ -1157,30 +980,34 @@
719
+                                   modssl_ctx_t *mctx)
720
+ {
721
+     const char *rsa_id, *dsa_id;
722
+-#ifndef OPENSSL_NO_EC
723
++#ifdef HAVE_ECC
724
+     const char *ecc_id;
725
++    EC_GROUP *ecparams;
726
++    int nid;
727
++    EC_KEY *eckey;
728
+ #endif
729
+     const char *vhost_id = mctx->sc->vhost_id;
730
+     int i;
731
+     int have_rsa, have_dsa;
732
+-#ifndef OPENSSL_NO_EC
733
++    DH *dhparams;
734
++#ifdef HAVE_ECC
735
+     int have_ecc;
736
+ #endif
737
+ 
738
+     rsa_id = ssl_asn1_table_keyfmt(ptemp, vhost_id, SSL_AIDX_RSA);
739
+     dsa_id = ssl_asn1_table_keyfmt(ptemp, vhost_id, SSL_AIDX_DSA);
740
+-#ifndef OPENSSL_NO_EC
741
++#ifdef HAVE_ECC
742
+     ecc_id = ssl_asn1_table_keyfmt(ptemp, vhost_id, SSL_AIDX_ECC);
743
+ #endif
744
+ 
745
+     have_rsa = ssl_server_import_cert(s, mctx, rsa_id, SSL_AIDX_RSA);
746
+     have_dsa = ssl_server_import_cert(s, mctx, dsa_id, SSL_AIDX_DSA);
747
+-#ifndef OPENSSL_NO_EC
748
++#ifdef HAVE_ECC
749
+     have_ecc = ssl_server_import_cert(s, mctx, ecc_id, SSL_AIDX_ECC);
750
+ #endif
751
+ 
752
+     if (!(have_rsa || have_dsa
753
+-#ifndef OPENSSL_NO_EC
754
++#ifdef HAVE_ECC
755
+         || have_ecc
756
+ #endif
757
+ )) {
758
+@@ -1196,12 +1023,12 @@
759
+ 
760
+     have_rsa = ssl_server_import_key(s, mctx, rsa_id, SSL_AIDX_RSA);
761
+     have_dsa = ssl_server_import_key(s, mctx, dsa_id, SSL_AIDX_DSA);
762
+-#ifndef OPENSSL_NO_EC
763
++#ifdef HAVE_ECC
764
+     have_ecc = ssl_server_import_key(s, mctx, ecc_id, SSL_AIDX_ECC);
765
+ #endif
766
+ 
767
+     if (!(have_rsa || have_dsa
768
+-#ifndef OPENSSL_NO_EC
769
++#ifdef HAVE_ECC
770
+         || have_ecc
771
+ #endif
772
+           )) {
773
+@@ -1209,6 +1036,40 @@
774
+                 "Oops, no " KEYTYPES " server private key found?!");
775
+         ssl_die(s);
776
+     }
777
++
778
++    /*
779
++     * Try to read DH parameters from the (first) SSLCertificateFile
780
++     */
781
++    if ((mctx->pks->cert_files[0] != NULL) &&
782
++        (dhparams = ssl_dh_GetParamFromFile(mctx->pks->cert_files[0]))) {
783
++        SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams);
784
++        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
785
++                     "Custom DH parameters (%d bits) for %s loaded from %s",
786
++                     BN_num_bits(dhparams->p), vhost_id,
787
++                     mctx->pks->cert_files[0]);
788
++    }
789
++
790
++#ifdef HAVE_ECC
791
++    /*
792
++     * Similarly, try to read the ECDH curve name from SSLCertificateFile...
793
++     */
794
++    if ((mctx->pks->cert_files[0] != NULL) &&
795
++        (ecparams = ssl_ec_GetParamFromFile(mctx->pks->cert_files[0])) &&
796
++        (nid = EC_GROUP_get_curve_name(ecparams)) &&
797
++        (eckey = EC_KEY_new_by_curve_name(nid))) {
798
++        SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey);
799
++        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02541)
800
++                     "ECDH curve %s for %s specified in %s",
801
++                     OBJ_nid2sn(nid), vhost_id, mctx->pks->cert_files[0]);
802
++    }
803
++    /*
804
++     * ...otherwise, configure NIST P-256 (required to enable ECDHE)
805
++     */
806
++    else {
807
++        SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx,
808
++                             EC_KEY_new_by_curve_name(NID_X9_62_prime256v1));
809
++    }
810
++#endif
811
+ }
812
+ 
813
+ #ifdef HAVE_TLS_SESSION_TICKETS
814
+@@ -1516,7 +1377,7 @@
815
+         klen = strlen(key);
816
+ 
817
+         if ((ps = (server_rec *)apr_hash_get(table, key, klen))) {
818
+-#ifdef OPENSSL_NO_TLSEXT
819
++#ifndef HAVE_TLSEXT
820
+             int level = APLOG_WARNING;
821
+             const char *problem = "conflict";
822
+ #else
823
+@@ -1540,7 +1401,7 @@
824
+     }
825
+ 
826
+     if (conflict) {
827
+-#ifdef OPENSSL_NO_TLSEXT
828
++#ifndef HAVE_TLSEXT
829
+         ap_log_error(APLOG_MARK, APLOG_WARNING, 0, base_server, APLOGNO(01917)
830
+                      "Init: You should not use name-based "
831
+                      "virtual hosts in conjunction with SSL!!");
832
+@@ -1689,7 +1550,7 @@
833
+ {
834
+     MODSSL_CFG_ITEM_FREE(SSL_CTX_free, mctx->ssl_ctx);
835
+ 
836
+-#ifndef OPENSSL_NO_SRP
837
++#ifdef HAVE_SRP
838
+     if (mctx->srp_vbase != NULL) {
839
+         SRP_VBASE_free(mctx->srp_vbase);
840
+         mctx->srp_vbase = NULL;
841
+@@ -1745,11 +1606,6 @@
842
+     ssl_scache_kill(base_server);
843
+ 
844
+     /*
845
+-     * Destroy the temporary keys and params
846
+-     */
847
+-    ssl_tmp_keys_free(base_server);
848
+-
849
+-    /*
850
+      * Free the non-pool allocated structures
851
+      * in the per-server configurations
852
+      */
853
+diff -Naur httpd-2.4.6-orig/modules/ssl/ssl_engine_io.c httpd-2.4.6/modules/ssl/ssl_engine_io.c
854
+--- httpd-2.4.6-orig/modules/ssl/ssl_engine_io.c	2013-10-01 12:20:45.775812088 +0200
855
+@@ -1048,7 +1048,7 @@
856
+ 
857
+     server = sslconn->server;
858
+     if (sslconn->is_proxy) {
859
+-#ifndef OPENSSL_NO_TLSEXT
860
++#ifdef HAVE_TLSEXT
861
+         apr_ipsubnet_t *ip;
862
+ #endif
863
+         const char *hostname_note = apr_table_get(c->notes,
864
+@@ -1056,7 +1056,7 @@
865
+         BOOL proxy_ssl_check_peer_ok = TRUE;
866
+         sc = mySrvConfig(server);
867
+ 
868
+-#ifndef OPENSSL_NO_TLSEXT
869
++#ifdef HAVE_TLSEXT
870
+         /*
871
+          * Enable SNI for backend requests. Make sure we don't do it for
872
+          * pure SSLv3 connections, and also prevent IP addresses
873
+diff -Naur httpd-2.4.6-orig/modules/ssl/ssl_engine_kernel.c httpd-2.4.6/modules/ssl/ssl_engine_kernel.c
874
+--- httpd-2.4.6-orig/modules/ssl/ssl_engine_kernel.c	2013-10-01 12:20:45.776812076 +0200
875
+@@ -32,7 +32,7 @@
876
+ #include "util_md5.h"
877
+ 
878
+ static void ssl_configure_env(request_rec *r, SSLConnRec *sslconn);
879
+-#ifndef OPENSSL_NO_TLSEXT
880
++#ifdef HAVE_TLSEXT
881
+ static int ssl_find_vhost(void *servername, conn_rec *c, server_rec *s);
882
+ #endif
883
+ 
884
+@@ -119,7 +119,7 @@
885
+     SSLSrvConfigRec *sc = mySrvConfig(r->server);
886
+     SSLConnRec *sslconn;
887
+     const char *upgrade;
888
+-#ifndef OPENSSL_NO_TLSEXT
889
++#ifdef HAVE_TLSEXT
890
+     const char *servername;
891
+ #endif
892
+     SSL *ssl;
893
+@@ -162,7 +162,7 @@
894
+     if (!ssl) {
895
+         return DECLINED;
896
+     }
897
+-#ifndef OPENSSL_NO_TLSEXT
898
++#ifdef HAVE_TLSEXT
899
+     if ((servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name))) {
900
+         char *host, *scope_id;
901
+         apr_port_t port;
902
+@@ -329,7 +329,7 @@
903
+         return DECLINED;
904
+     }
905
+ 
906
+-#ifndef OPENSSL_NO_SRP
907
++#ifdef HAVE_SRP
908
+     /*
909
+      * Support for per-directory reconfigured SSL connection parameters
910
+      *
911
+@@ -1101,7 +1101,7 @@
912
+     "SSL_SERVER_A_SIG",
913
+     "SSL_SESSION_ID",
914
+     "SSL_SESSION_RESUMED",
915
+-#ifndef OPENSSL_NO_SRP
916
++#ifdef HAVE_SRP
917
+     "SSL_SRP_USER",
918
+     "SSL_SRP_USERINFO",
919
+ #endif
920
+@@ -1115,7 +1115,7 @@
921
+     SSLDirConfigRec *dc = myDirConfig(r);
922
+     apr_table_t *env = r->subprocess_env;
923
+     char *var, *val = "";
924
+-#ifndef OPENSSL_NO_TLSEXT
925
++#ifdef HAVE_TLSEXT
926
+     const char *servername;
927
+ #endif
928
+     STACK_OF(X509) *peer_certs;
929
+@@ -1144,7 +1144,7 @@
930
+     /* the always present HTTPS (=HTTP over SSL) flag! */
931
+     apr_table_setn(env, "HTTPS", "on");
932
+ 
933
+-#ifndef OPENSSL_NO_TLSEXT
934
++#ifdef HAVE_TLSEXT
935
+     /* add content of SNI TLS extension (if supplied with ClientHello) */
936
+     if ((servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name))) {
937
+         apr_table_set(env, "SSL_TLS_SNI", servername);
938
+@@ -1287,117 +1287,70 @@
939
+ */
940
+ 
941
+ /*
942
+- * Handle out temporary RSA private keys on demand
943
+- *
944
+- * The background of this as the TLSv1 standard explains it:
945
+- *
946
+- * | D.1. Temporary RSA keys
947
+- * |
948
+- * |    US Export restrictions limit RSA keys used for encryption to 512
949
+- * |    bits, but do not place any limit on lengths of RSA keys used for
950
+- * |    signing operations. Certificates often need to be larger than 512
951
+- * |    bits, since 512-bit RSA keys are not secure enough for high-value
952
+- * |    transactions or for applications requiring long-term security. Some
953
+- * |    certificates are also designated signing-only, in which case they
954
+- * |    cannot be used for key exchange.
955
+- * |
956
+- * |    When the public key in the certificate cannot be used for encryption,
957
+- * |    the server signs a temporary RSA key, which is then exchanged. In
958
+- * |    exportable applications, the temporary RSA key should be the maximum
959
+- * |    allowable length (i.e., 512 bits). Because 512-bit RSA keys are
960
+- * |    relatively insecure, they should be changed often. For typical
961
+- * |    electronic commerce applications, it is suggested that keys be
962
+- * |    changed daily or every 500 transactions, and more often if possible.
963
+- * |    Note that while it is acceptable to use the same temporary key for
964
+- * |    multiple transactions, it must be signed each time it is used.
965
+- * |
966
+- * |    RSA key generation is a time-consuming process. In many cases, a
967
+- * |    low-priority process can be assigned the task of key generation.
968
+- * |    Whenever a new key is completed, the existing temporary key can be
969
+- * |    replaced with the new one.
970
+- *
971
+- * XXX: base on comment above, if thread support is enabled,
972
+- * we should spawn a low-priority thread to generate new keys
973
+- * on the fly.
974
+- *
975
+- * So we generated 512 and 1024 bit temporary keys on startup
976
+- * which we now just hand out on demand....
977
++ * Grab well-defined DH parameters from OpenSSL, see <openssl/bn.h>
978
++ * (get_rfc*) for all available primes.
979
+  */
980
+-
981
+-RSA *ssl_callback_TmpRSA(SSL *ssl, int export, int keylen)
982
+-{
983
+-    conn_rec *c = (conn_rec *)SSL_get_app_data(ssl);
984
+-    SSLModConfigRec *mc = myModConfigFromConn(c);
985
+-    int idx;
986
+-
987
+-    ap_log_cerror(APLOG_MARK, APLOG_TRACE2, 0, c,
988
+-                  "handing out temporary %d bit RSA key", keylen);
989
+-
990
+-    /* doesn't matter if export flag is on,
991
+-     * we won't be asked for keylen > 512 in that case.
992
+-     * if we are asked for a keylen > 1024, it is too expensive
993
+-     * to generate on the fly.
994
+-     * XXX: any reason not to generate 2048 bit keys at startup?
995
+-     */
996
+-
997
+-    switch (keylen) {
998
+-      case 512:
999
+-        idx = SSL_TMP_KEY_RSA_512;
1000
+-        break;
1001
+-
1002
+-      case 1024:
1003
+-      default:
1004
+-        idx = SSL_TMP_KEY_RSA_1024;
1005
+-    }
1006
+-
1007
+-    return (RSA *)mc->pTmpKeys[idx];
1008
++#define make_get_dh(rfc,size,gen) \
1009
++static DH *get_dh##size(void) \
1010
++{ \
1011
++    DH *dh; \
1012
++    if (!(dh = DH_new())) { \
1013
++        return NULL; \
1014
++    } \
1015
++    dh->p = get_##rfc##_prime_##size(NULL); \
1016
++    BN_dec2bn(&dh->g, #gen); \
1017
++    if (!dh->p || !dh->g) { \
1018
++        DH_free(dh); \
1019
++        return NULL; \
1020
++    } \
1021
++    return dh; \
1022
+ }
1023
+ 
1024
+ /*
1025
+- * Hand out the already generated DH parameters...
1026
++ * Prepare DH parameters from 1024 to 4096 bits, in 1024-bit increments
1027
++ */
1028
++make_get_dh(rfc2409, 1024, 2)
1029
++make_get_dh(rfc3526, 2048, 2)
1030
++make_get_dh(rfc3526, 3072, 2)
1031
++make_get_dh(rfc3526, 4096, 2)
1032
++
1033
++/*
1034
++ * Hand out standard DH parameters, based on the authentication strength
1035
+  */
1036
+ DH *ssl_callback_TmpDH(SSL *ssl, int export, int keylen)
1037
+ {
1038
+     conn_rec *c = (conn_rec *)SSL_get_app_data(ssl);
1039
+-    SSLModConfigRec *mc = myModConfigFromConn(c);
1040
+-    int idx;
1041
+-
1042
+-    ap_log_cerror(APLOG_MARK, APLOG_TRACE2, 0, c,
1043
+-                  "handing out temporary %d bit DH key", keylen);
1044
++    EVP_PKEY *pkey = SSL_get_privatekey(ssl);
1045
++    int type = pkey ? EVP_PKEY_type(pkey->type) : EVP_PKEY_NONE;
1046
+ 
1047
+-    switch (keylen) {
1048
+-      case 512:
1049
+-        idx = SSL_TMP_KEY_DH_512;
1050
+-        break;
1051
+-
1052
+-      case 1024:
1053
+-      default:
1054
+-        idx = SSL_TMP_KEY_DH_1024;
1055
++    /*
1056
++     * OpenSSL will call us with either keylen == 512 or keylen == 1024
1057
++     * (see the definition of SSL_EXPORT_PKEYLENGTH in ssl_locl.h).
1058
++     * Adjust the DH parameter length according to the size of the
1059
++     * RSA/DSA private key used for the current connection, and always
1060
++     * use at least 1024-bit parameters.
1061
++     * Note: This may cause interoperability issues with implementations
1062
++     * which limit their DH support to 1024 bit - e.g. Java 7 and earlier.
1063
++     * In this case, SSLCertificateFile can be used to specify fixed
1064
++     * 1024-bit DH parameters (with the effect that OpenSSL skips this
1065
++     * callback).
1066
++     */
1067
++    if ((type == EVP_PKEY_RSA) || (type == EVP_PKEY_DSA)) {
1068
++        keylen = EVP_PKEY_bits(pkey);
1069
+     }
1070
+ 
1071
+-    return (DH *)mc->pTmpKeys[idx];
1072
+-}
1073
+-
1074
+-#ifndef OPENSSL_NO_EC
1075
+-EC_KEY *ssl_callback_TmpECDH(SSL *ssl, int export, int keylen)
1076
+-{
1077
+-    conn_rec *c = (conn_rec *)SSL_get_app_data(ssl);
1078
+-    SSLModConfigRec *mc = myModConfigFromConn(c);
1079
+-    int idx;
1080
+-
1081
+-    /* XXX Uses 256-bit key for now. TODO: support other sizes. */
1082
+     ap_log_cerror(APLOG_MARK, APLOG_TRACE2, 0, c,
1083
+-                  "handing out temporary 256 bit ECC key");
1084
++                  "handing out built-in DH parameters for %d-bit authenticated connection", keylen);
1085
+ 
1086
+-    switch (keylen) {
1087
+-      case 256:
1088
+-      default:
1089
+-        idx = SSL_TMP_KEY_EC_256;
1090
+-    }
1091
+-
1092
+-    return (EC_KEY *)mc->pTmpKeys[idx];
1093
++    if (keylen >= 4096)
1094
++        return get_dh4096();
1095
++    else if (keylen >= 3072)
1096
++        return get_dh3072();
1097
++    else if (keylen >= 2048)
1098
++        return get_dh2048();
1099
++    else
1100
++        return get_dh1024();
1101
+ }
1102
+-#endif
1103
+ 
1104
+ /*
1105
+  * This OpenSSL callback function is called when OpenSSL
1106
+@@ -1938,7 +1891,7 @@
1107
+     }
1108
+ }
1109
+ 
1110
+-#ifndef OPENSSL_NO_TLSEXT
1111
++#ifdef HAVE_TLSEXT
1112
+ /*
1113
+  * This callback function is executed when OpenSSL encounters an extended
1114
+  * client hello with a server name indication extension ("SNI", cf. RFC 4366).
1115
+@@ -2089,7 +2042,7 @@
1116
+ 
1117
+     return 0;
1118
+ }
1119
+-#endif /* OPENSSL_NO_TLSEXT */
1120
++#endif /* HAVE_TLSEXT */
1121
+ 
1122
+ #ifdef HAVE_TLS_SESSION_TICKETS
1123
+ /*
1124
+@@ -2161,7 +2114,7 @@
1125
+ }
1126
+ #endif /* HAVE_TLS_SESSION_TICKETS */
1127
+ 
1128
+-#ifndef OPENSSL_NO_SRP
1129
++#ifdef HAVE_SRP
1130
+ 
1131
+ int ssl_callback_SRPServerParams(SSL *ssl, int *ad, void *arg)
1132
+ {
1133
+@@ -2185,4 +2138,4 @@
1134
+     return SSL_ERROR_NONE;
1135
+ }
1136
+ 
1137
+-#endif /* OPENSSL_NO_SRP */
1138
++#endif /* HAVE_SRP */
1139
+diff -Naur httpd-2.4.6-orig/modules/ssl/ssl_engine_pphrase.c httpd-2.4.6/modules/ssl/ssl_engine_pphrase.c
1140
+--- httpd-2.4.6-orig/modules/ssl/ssl_engine_pphrase.c	2013-10-01 12:20:45.777812063 +0200
1141
+@@ -708,7 +708,7 @@
1142
+                     ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(01966)
1143
+                                  "Init: Failed to create pass phrase pipe '%s'",
1144
+                                  sc->server->pphrase_dialog_path);
1145
+-                    PEMerr(PEM_F_DEF_CALLBACK,PEM_R_PROBLEMS_GETTING_PASSWORD);
1146
++                    PEMerr(PEM_F_PEM_DEF_CALLBACK,PEM_R_PROBLEMS_GETTING_PASSWORD);
1147
+                     memset(buf, 0, (unsigned int)bufsize);
1148
+                     return (-1);
1149
+                 }
1150
+@@ -718,7 +718,7 @@
1151
+         }
1152
+         else { /* sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN */
1153
+ #ifdef WIN32
1154
+-            PEMerr(PEM_F_DEF_CALLBACK,PEM_R_PROBLEMS_GETTING_PASSWORD);
1155
++            PEMerr(PEM_F_PEM_DEF_CALLBACK,PEM_R_PROBLEMS_GETTING_PASSWORD);
1156
+             memset(buf, 0, (unsigned int)bufsize);
1157
+             return (-1);
1158
+ #else
1159
+@@ -769,7 +769,7 @@
1160
+                 i = EVP_read_pw_string(buf, bufsize, "", FALSE);
1161
+             }
1162
+             if (i != 0) {
1163
+-                PEMerr(PEM_F_DEF_CALLBACK,PEM_R_PROBLEMS_GETTING_PASSWORD);
1164
++                PEMerr(PEM_F_PEM_DEF_CALLBACK,PEM_R_PROBLEMS_GETTING_PASSWORD);
1165
+                 memset(buf, 0, (unsigned int)bufsize);
1166
+                 return (-1);
1167
+             }
1168
+diff -Naur httpd-2.4.6-orig/modules/ssl/ssl_engine_vars.c httpd-2.4.6/modules/ssl/ssl_engine_vars.c
1169
+--- httpd-2.4.6-orig/modules/ssl/ssl_engine_vars.c	2013-10-01 12:20:45.775812088 +0200
1170
+@@ -382,7 +382,7 @@
1171
+     else if (ssl != NULL && strcEQ(var, "COMPRESS_METHOD")) {
1172
+         result = ssl_var_lookup_ssl_compress_meth(ssl);
1173
+     }
1174
+-#ifndef OPENSSL_NO_TLSEXT
1175
++#ifdef HAVE_TLSEXT
1176
+     else if (ssl != NULL && strcEQ(var, "TLS_SNI")) {
1177
+         result = apr_pstrdup(p, SSL_get_servername(ssl,
1178
+                                                    TLSEXT_NAMETYPE_host_name));
1179
+@@ -395,7 +395,7 @@
1180
+ #endif
1181
+         result = apr_pstrdup(p, flag ? "true" : "false");
1182
+     }
1183
+-#ifndef OPENSSL_NO_SRP
1184
++#ifdef HAVE_SRP
1185
+     else if (ssl != NULL && strcEQ(var, "SRP_USER")) {
1186
+         if ((result = SSL_get_srp_username(ssl)) != NULL) {
1187
+             result = apr_pstrdup(p, result);
1188
+@@ -879,7 +879,7 @@
1189
+  * success and writes the string to the given bio. */
1190
+ static int dump_extn_value(BIO *bio, ASN1_OCTET_STRING *str)
1191
+ {
1192
+-    MODSSL_D2I_ASN1_type_bytes_CONST unsigned char *pp = str->data;
1193
++    const unsigned char *pp = str->data;
1194
+     ASN1_STRING *ret = ASN1_STRING_new();
1195
+     int rv = 0;
1196
+ 
1197
+@@ -975,7 +975,7 @@
1198
+ static char *ssl_var_lookup_ssl_compress_meth(SSL *ssl)
1199
+ {
1200
+     char *result = "NULL";
1201
+-#if (OPENSSL_VERSION_NUMBER >= 0x00908000) && !defined(OPENSSL_NO_COMP)
1202
++#ifndef OPENSSL_NO_COMP
1203
+     SSL_SESSION *pSession = SSL_get_session(ssl);
1204
+ 
1205
+     if (pSession) {
1206
+diff -Naur httpd-2.4.6-orig/modules/ssl/ssl_private.h httpd-2.4.6/modules/ssl/ssl_private.h
1207
+--- httpd-2.4.6-orig/modules/ssl/ssl_private.h	2013-10-01 12:20:45.774812101 +0200
1208
+@@ -105,65 +105,55 @@
1209
+ #include <openssl/engine.h>
1210
+ #endif
1211
+ 
1212
+-#if (OPENSSL_VERSION_NUMBER < 0x0090700f)
1213
+-#error mod_ssl requires OpenSSL 0.9.7 or later
1214
+-#endif
1215
+-
1216
+-/* ...shifting sands of OpenSSL... */
1217
+-#if (OPENSSL_VERSION_NUMBER >= 0x0090707f)
1218
+-#define MODSSL_D2I_SSL_SESSION_CONST const
1219
+-#else
1220
+-#define MODSSL_D2I_SSL_SESSION_CONST
1221
+-#endif
1222
+-
1223
+-#if (OPENSSL_VERSION_NUMBER >= 0x00908000)
1224
+-#define HAVE_GENERATE_EX
1225
+-#define MODSSL_D2I_ASN1_type_bytes_CONST const
1226
+-#define MODSSL_D2I_PrivateKey_CONST const
1227
+-#define MODSSL_D2I_X509_CONST const
1228
+-#else
1229
+-#define MODSSL_D2I_ASN1_type_bytes_CONST
1230
+-#define MODSSL_D2I_PrivateKey_CONST
1231
+-#define MODSSL_D2I_X509_CONST
1232
+-#endif
1233
+-
1234
+-#if OPENSSL_VERSION_NUMBER >= 0x00908080 && !defined(OPENSSL_NO_OCSP) \
1235
+-    && !defined(OPENSSL_NO_TLSEXT)
1236
+-#define HAVE_OCSP_STAPLING
1237
+-#if (OPENSSL_VERSION_NUMBER < 0x10000000)
1238
+-#define sk_OPENSSL_STRING_pop sk_pop
1239
+-#endif
1240
+-#endif
1241
+-
1242
+-#if (OPENSSL_VERSION_NUMBER >= 0x009080a0) && defined(OPENSSL_FIPS)
1243
+-#define HAVE_FIPS
1244
++#if (OPENSSL_VERSION_NUMBER < 0x0090801f)
1245
++#error mod_ssl requires OpenSSL 0.9.8a or later
1246
+ #endif
1247
+ 
1248
++/**
1249
++ * ...shifting sands of OpenSSL...
1250
++ * Note: when adding support for new OpenSSL features, avoid explicit
1251
++ * version number checks whenever possible, and use "feature-based"
1252
++ * detection instead (check for definitions of constants or functions)
1253
++ */
1254
+ #if (OPENSSL_VERSION_NUMBER >= 0x10000000)
1255
+ #define MODSSL_SSL_CIPHER_CONST const
1256
+ #define MODSSL_SSL_METHOD_CONST const
1257
+ #else
1258
+ #define MODSSL_SSL_CIPHER_CONST
1259
+ #define MODSSL_SSL_METHOD_CONST
1260
+-/* ECC support came along in OpenSSL 1.0.0 */
1261
+-#define OPENSSL_NO_EC
1262
+ #endif
1263
+ 
1264
+-#ifndef PEM_F_DEF_CALLBACK
1265
+-#ifdef PEM_F_PEM_DEF_CALLBACK
1266
+-/** In OpenSSL 0.9.8 PEM_F_DEF_CALLBACK was renamed */
1267
+-#define PEM_F_DEF_CALLBACK PEM_F_PEM_DEF_CALLBACK
1268
++#if defined(OPENSSL_FIPS)
1269
++#define HAVE_FIPS
1270
+ #endif
1271
++
1272
++#if defined(SSL_OP_NO_TLSv1_2)
1273
++#define HAVE_TLSV1_X
1274
+ #endif
1275
+ 
1276
+-#ifndef OPENSSL_NO_TLSEXT
1277
+-#ifndef SSL_CTRL_SET_TLSEXT_HOSTNAME
1278
+-#define OPENSSL_NO_TLSEXT
1279
++/**
1280
++  * The following features all depend on TLS extension support.
1281
++  * Within this block, check again for features (not version numbers).
1282
++  */
1283
++#if !defined(OPENSSL_NO_TLSEXT) && defined(SSL_set_tlsext_host_name)
1284
++
1285
++#define HAVE_TLSEXT
1286
++
1287
++/* ECC: make sure we have at least 1.0.0 */
1288
++#if !defined(OPENSSL_NO_EC) && defined(TLSEXT_ECPOINTFORMAT_uncompressed)
1289
++#define HAVE_ECC
1290
++#endif
1291
++
1292
++/* OCSP stapling */
1293
++#if !defined(OPENSSL_NO_OCSP) && defined(SSL_CTX_set_tlsext_status_cb)
1294
++#define HAVE_OCSP_STAPLING
1295
++#ifndef sk_OPENSSL_STRING_pop
1296
++#define sk_OPENSSL_STRING_pop sk_pop
1297
+ #endif
1298
+ #endif
1299
+ 
1300
+-#ifndef OPENSSL_NO_TLSEXT
1301
+-#ifdef SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB
1302
++/* TLS session tickets */
1303
++#if defined(SSL_CTX_set_tlsext_ticket_key_cb)
1304
+ #define HAVE_TLS_SESSION_TICKETS
1305
+ #define TLSEXT_TICKET_KEY_LEN 48
1306
+ #ifndef tlsext_tick_md
1307
+@@ -174,26 +164,15 @@
1308
+ #endif
1309
+ #endif
1310
+ #endif
1311
+-#endif
1312
+ 
1313
+-#ifdef SSL_OP_NO_TLSv1_2
1314
+-#define HAVE_TLSV1_X
1315
+-#endif
1316
+-
1317
+-#if !defined(OPENSSL_NO_COMP) && !defined(SSL_OP_NO_COMPRESSION) \
1318
+-    && OPENSSL_VERSION_NUMBER < 0x00908000L
1319
+-#define OPENSSL_NO_COMP
1320
+-#endif
1321
+-
1322
+-/* SRP support came in OpenSSL 1.0.1 */
1323
+-#ifndef OPENSSL_NO_SRP
1324
+-#ifdef SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB
1325
++/* Secure Remote Password */
1326
++#if !defined(OPENSSL_NO_SRP) && defined(SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB)
1327
++#define HAVE_SRP
1328
+ #include <openssl/srp.h>
1329
+-#else
1330
+-#define OPENSSL_NO_SRP
1331
+-#endif
1332
+ #endif
1333
+ 
1334
++#endif /* !defined(OPENSSL_NO_TLSEXT) && defined(SSL_set_tlsext_host_name) */
1335
++
1336
+ /* mod_ssl headers */
1337
+ #include "ssl_util_ssl.h"
1338
+ 
1339
+@@ -287,7 +266,7 @@
1340
+ #define SSL_ALGO_UNKNOWN (0)
1341
+ #define SSL_ALGO_RSA     (1<<0)
1342
+ #define SSL_ALGO_DSA     (1<<1)
1343
+-#ifndef OPENSSL_NO_EC
1344
++#ifdef HAVE_ECC
1345
+ #define SSL_ALGO_ECC     (1<<2)
1346
+ #define SSL_ALGO_ALL     (SSL_ALGO_RSA|SSL_ALGO_DSA|SSL_ALGO_ECC)
1347
+ #else
1348
+@@ -296,29 +275,13 @@
1349
+ 
1350
+ #define SSL_AIDX_RSA     (0)
1351
+ #define SSL_AIDX_DSA     (1)
1352
+-#ifndef OPENSSL_NO_EC
1353
++#ifdef HAVE_ECC
1354
+ #define SSL_AIDX_ECC     (2)
1355
+ #define SSL_AIDX_MAX     (3)
1356
+ #else
1357
+ #define SSL_AIDX_MAX     (2)
1358
+ #endif
1359
+ 
1360
+-
1361
+-/**
1362
+- * Define IDs for the temporary RSA keys and DH params
1363
+- */