From 070d6672c9d659087e89932a3feb79dd7058e97a Mon Sep 17 00:00:00 2001 From: Jeff Trawick Date: Sat, 12 Jul 2014 14:48:04 +0000 Subject: [PATCH] Set an error note for requests rejected due to SSLStrictSNIVHostCheck. This allows custom error documents to include the specific reason for denying access to the server. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1609936 13f79535-47bb-0310-9956-ffa450edef68 --- CHANGES | 3 +++ modules/ssl/ssl_engine_kernel.c | 4 ++++ 2 files changed, 7 insertions(+) diff --git a/CHANGES b/CHANGES index 9f4c6ecf94..70843df14d 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,9 @@ -*- coding: utf-8 -*- Changes with Apache 2.5.0 + *) mod_ssl: Set an error note for requests rejected due to + SSLStrictSNIVHostCheck. [Jeff Trawick] + *) mod_ssl: Fix issue with redirects to error documents when handling SNI errors. [Jeff Trawick] diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c index ea1298a5b8..a14e6afe3e 100644 --- a/modules/ssl/ssl_engine_kernel.c +++ b/modules/ssl/ssl_engine_kernel.c @@ -220,6 +220,10 @@ int ssl_hook_ReadReq(request_rec *r) ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server, APLOGNO(02033) "No hostname was provided via SNI for a name based" " virtual host"); + apr_table_setn(r->notes, "error-notes", + "Reason: The client software did not provide a " + "hostname using Server Name Indication (SNI), " + "which is required to access this server.
\n"); return HTTP_FORBIDDEN; } } -- 2.40.0