If an SSLv2 method is explicitly asked for use the SSLv2 cipher string:

assume an application *really* wants SSLv2 if they do that.

Otherwise stick with the default which excludes all SSLv2 cipher suites.

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 2ad60fe649f1cf87e2961affaa4eeda394b98452..7b911ae1eac610d591688c174f45e14651dc3c92 100644 (file)
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -259,7 +259,8 @@ int SSL_CTX_set_ssl_version(SSL_CTX *ctx,const SSL_METHOD *meth)
        ctx->method=meth;
 
        sk=ssl_create_cipher_list(ctx->method,&(ctx->cipher_list),
-               &(ctx->cipher_list_by_id),SSL_DEFAULT_CIPHER_LIST);
+               &(ctx->cipher_list_by_id),
+               meth->version == SSL2_VERSION ? "SSLv2" : SSL_DEFAULT_CIPHER_LIST);
        if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0))
                {
                SSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION,SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);
@@ -1528,7 +1529,7 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
 
        ssl_create_cipher_list(ret->method,
                &ret->cipher_list,&ret->cipher_list_by_id,
-               SSL_DEFAULT_CIPHER_LIST);
+               meth->version == SSL2_VERSION ? "SSLv2" : SSL_DEFAULT_CIPHER_LIST);
        if (ret->cipher_list == NULL
            || sk_SSL_CIPHER_num(ret->cipher_list) <= 0)
                {