From 359c24598e30d2bf4466b2e8630a84044c87e740 Mon Sep 17 00:00:00 2001 From: Christophe Jaillet Date: Fri, 27 Feb 2015 06:18:31 +0000 Subject: [PATCH] Merge r1644498 from trunk * mod_ssl: Fix renegotiation failures redirected to an ErrorDocument. (segfault flaw) PR 57334. Submitted by: ylavic Reviewed by: ylavic, wrowe, minfrin Backported by: jailletc36 git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1662640 13f79535-47bb-0310-9956-ffa450edef68 --- CHANGES | 3 +++ modules/ssl/ssl_engine_kernel.c | 17 ++++++++++++++--- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/CHANGES b/CHANGES index 74fa4cb250..0a6da3b3d7 100644 --- a/CHANGES +++ b/CHANGES @@ -2,6 +2,9 @@ Changes with Apache 2.4.13 + *) mod_ssl: Fix renegotiation failures redirected to an ErrorDocument. + PR 57334. [Yann Ylavic]. + *) mod_proxy_ajp: Forward SSL protocol name (SSLv3, TLSv1.1 etc.) as a request attribute to the backend. Recent Tomcat versions will extract it and provide it as a servlet request attribute named diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c index 14afbf4a45..7911b2629b 100644 --- a/modules/ssl/ssl_engine_kernel.c +++ b/modules/ssl/ssl_engine_kernel.c @@ -80,7 +80,8 @@ static apr_status_t upgrade_connection(request_rec *r) if (SSL_get_state(ssl) != SSL_ST_OK) { ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02030) - "TLS upgrade handshake failed: not accepted by client!?"); + "TLS upgrade handshake failed"); + ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server); return APR_ECONNABORTED; } @@ -314,6 +315,16 @@ int ssl_hook_Access(request_rec *r) int depth, verify_old, verify, n; if (ssl) { + /* + * We should have handshaken here (on handshakeserver), + * otherwise we are being redirected (ErrorDocument) from + * a renegotiation failure below. The access is still + * forbidden in the latter case, let ap_die() handle + * this recursive (same) error. + */ + if (SSL_get_state(ssl) != SSL_ST_OK) { + return HTTP_FORBIDDEN; + } ctx = SSL_get_SSL_CTX(ssl); } @@ -828,8 +839,8 @@ int ssl_hook_Access(request_rec *r) if (SSL_get_state(ssl) != SSL_ST_OK) { ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02261) - "Re-negotiation handshake failed: " - "Not accepted by client!?"); + "Re-negotiation handshake failed"); + ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server); r->connection->keepalive = AP_CONN_CLOSE; return HTTP_FORBIDDEN; -- 2.50.1