disable SSLv3 by default and allow setting raw ssl options

core/ssl.c

@@ -210,6 +210,10 @@ SSL_CTX *uwsgi_ssl_new_server_context(char *name, char *crt, char *key, char *ci
         ssloptions |= SSL_OP_NO_COMPRESSION;
 #endif
 
+	if (!uwsgi.sslv3) {
+		ssloptions |= SSL_OP_NO_SSLv3;
+	}
+
 // release/reuse buffers as soon as possibile
 #ifdef SSL_MODE_RELEASE_BUFFERS
         SSL_CTX_set_mode(ctx, SSL_MODE_RELEASE_BUFFERS);
@@ -396,6 +400,11 @@ SSL_CTX *uwsgi_ssl_new_server_context(char *name, char *crt, char *key, char *ci
 
         SSL_CTX_set_timeout(ctx, uwsgi.ssl_sessions_timeout);
 
+	struct uwsgi_string_list *usl = NULL;
+	uwsgi_foreach(usl, uwsgi.ssl_options) {
+		ssloptions |= atoi(usl->value);
+	}
+
         SSL_CTX_set_options(ctx, ssloptions);
 
 

core/uwsgi.c

@@ -668,6 +668,8 @@ static struct uwsgi_option uwsgi_base_options[] = {
 	{"sni", required_argument, 0, "add an SNI-governed SSL context", uwsgi_opt_sni, NULL, 0},
 	{"sni-dir", required_argument, 0, "check for cert/key/client_ca file in the specified directory and create a sni/ssl context on demand", uwsgi_opt_set_str, &uwsgi.sni_dir, 0},
 	{"sni-dir-ciphers", required_argument, 0, "set ssl ciphers for sni-dir option", uwsgi_opt_set_str, &uwsgi.sni_dir_ciphers, 0},
+	{"ssl-enable3", no_argument, 0, "enable SSLv3 (insecure)", uwsgi_opt_true, &uwsgi.sslv3, 0},
+	{"ssl-option", no_argument, 0, "set a raw ssl option (numeric value)", uwsgi_opt_add_string_list, &uwsgi.ssl_options, 0},
 #ifdef UWSGI_PCRE
 	{"sni-regexp", required_argument, 0, "add an SNI-governed SSL context (the key is a regexp)", uwsgi_opt_sni, NULL, 0},
 #endif

uwsgi.h

@@ -2749,6 +2749,10 @@ struct uwsgi_server {
 	struct uwsgi_string_list *wait_for_file;
 	int wait_for_fs_timeout;
 	struct uwsgi_string_list *wait_for_mountpoint;
+#ifdef UWSGI_SSL
+	int sslv3;
+	struct uwsgi_string_list *ssl_options;
+#endif
 
 	// uWSGI 2.1
 	char *fork_socket;