Commit 9e81e70a authored by Christophe Jaillet's avatar Christophe Jaillet
Browse files

Merge r1644498 from trunk 

   * mod_ssl: Fix renegotiation failures redirected to an ErrorDocument.
              (segfault flaw) PR 57334.

Submitted by: ylavic
Reviewed by: ylavic, wrowe, minfrin
Backported by: jailletc36

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1662640 13f79535-47bb-0310-9956-ffa450edef68
parent 2e9aafea

CHANGES

+3 −0
Changes for CHANGES: 3 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -2,6 +2,9 @@ 


Changes with Apache 2.4.13



  *) mod_ssl: Fix renegotiation failures redirected to an ErrorDocument.

     PR 57334.  [Yann Ylavic].



  *) mod_proxy_ajp: Forward SSL protocol name (SSLv3, TLSv1.1 etc.) as a

     request attribute to the backend. Recent Tomcat versions will extract

     it and provide it as a servlet request attribute named

modules/ssl/ssl_engine_kernel.c

+14 −3
Changes for modules/ssl/ssl_engine_kernel.c: 14 added lines, 3 removed lines.
Original line number Diff line number Diff line
@@ -80,7 +80,8 @@ static apr_status_t upgrade_connection(request_rec *r) 


    if (SSL_get_state(ssl) != SSL_ST_OK) {

        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02030)

                      "TLS upgrade handshake failed: not accepted by client!?");

                      "TLS upgrade handshake failed");

        ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);



        return APR_ECONNABORTED;

    }
@@ -314,6 +315,16 @@ int ssl_hook_Access(request_rec *r) 
    int depth, verify_old, verify, n;



    if (ssl) {

        /*

         * We should have handshaken here (on handshakeserver),

         * otherwise we are being redirected (ErrorDocument) from

         * a renegotiation failure below. The access is still 

         * forbidden in the latter case, let ap_die() handle

         * this recursive (same) error.

         */

        if (SSL_get_state(ssl) != SSL_ST_OK) {

            return HTTP_FORBIDDEN;

        }

        ctx = SSL_get_SSL_CTX(ssl);

    }
@@ -828,8 +839,8 @@ int ssl_hook_Access(request_rec *r) 


            if (SSL_get_state(ssl) != SSL_ST_OK) {

                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02261)

                              "Re-negotiation handshake failed: "

                              "Not accepted by client!?");

                              "Re-negotiation handshake failed");

                ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);



                r->connection->keepalive = AP_CONN_CLOSE;

                return HTTP_FORBIDDEN;