X-Git-Url: https://vcs.fsf.org/?p=exim.git;a=blobdiff_plain;f=src%2Fsrc%2Ftls-openssl.c;h=22c0730c39c1ed2de9f41d61f5e0c07e473050fe;hp=43b79634ed4793091931151c361501e18936c061;hb=3ecab1575ef1f45a5e7cd3c48cd937ffa8eb0ad9;hpb=4789da3a20432b8ce9cdccfb0713c027f91447c9

diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index 43b79634e..22c0730c3 100644
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -744,7 +744,13 @@ list of available digests. */
 EVP_add_digest(EVP_sha256());
 #endif
 
-/* Create a context */
+/* Create a context.
+The OpenSSL docs in 1.0.1b have not been updated to clarify TLS variant
+negotiation in the different methods; as far as I can tell, the only
+*_{server,client}_method which allows negotiation is SSLv23, which exists even
+when OpenSSL is built without SSLv2 support.
+By disabling with openssl_options, we can let admins re-enable with the
+existing knob. */
 
 ctx = SSL_CTX_new((host == NULL)?
   SSLv23_server_method() : SSLv23_client_method());
@@ -1872,6 +1878,9 @@ BOOL adding, item_parsed;
 result = 0L;
 /* Prior to 4.80 we or'd in SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS; removed
  * from default because it increases BEAST susceptibility. */
+#ifdef SSL_OP_NO_SSLv2
+result |= SSL_OP_NO_SSLv2;
+#endif
 
 if (option_spec == NULL)
   {