Commit a7379ee8 authored by Joe Orton's avatar Joe Orton
Browse files

* modules/ssl/ssl_engine_kernel.c (ssl_hook_Access_modern): Fail with 

  403 if SSL_verify_client_post_handshake() fails, e.g. when the
  TLS/1.3 client didn't send the Post-Handshake Authentication
  extension.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1840585 13f79535-47bb-0310-9956-ffa450edef68
parent d33674a0

docs/log-message-tags/next-number

+1 −1
Changes for docs/log-message-tags/next-number: 1 added line, 1 removed line.
Original line number Diff line number Diff line 
10158
 
10159

modules/ssl/ssl_engine_kernel.c

+9 −1
Changes for modules/ssl/ssl_engine_kernel.c: 9 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -1219,7 +1219,15 @@ static int ssl_hook_Access_modern(request_rec *r, SSLSrvConfigRec *sc, SSLDirCon 
            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10129) "verify client post handshake");



            SSL_set_verify(ssl, vmode_needed, ssl_callback_SSLVerify);

            SSL_verify_client_post_handshake(ssl);



            if (SSL_verify_client_post_handshake(ssl) != 1) {

                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10158)

                              "cannot perform post-handshake authentication");

                ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);

                apr_table_setn(r->notes, "error-notes",

                               "Reason: Cannot perform Post-Handshake Authentication.<br />");

                return HTTP_FORBIDDEN;

            }

            

            old_state = sslconn->reneg_state;

            sslconn->reneg_state = RENEG_ALLOW;