From 93f20aaeba6aa071be8764bbbace1432e732738b Mon Sep 17 00:00:00 2001 From: Stefan Eissing Date: Tue, 12 Mar 2019 09:21:17 +0000 Subject: [PATCH] *) mod_http2: when SSL renegotiation is inhibited and a 403 ErrorDocument is in play, the proper HTTP/2 stream reset did not trigger with H2_ERR_HTTP_1_1_REQUIRED. Fixed. [Michael Kaufmann] git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1855295 13f79535-47bb-0310-9956-ffa450edef68 --- CHANGES | 4 ++++ modules/http2/h2_headers.c | 24 ++++++++++++++---------- 2 files changed, 18 insertions(+), 10 deletions(-) diff --git a/CHANGES b/CHANGES index 9991922735..4c2bf10c08 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,10 @@ -*- coding: utf-8 -*- Changes with Apache 2.5.1 + *) mod_http2: when SSL renegotiation is inhibited and a 403 ErrorDocument is + in play, the proper HTTP/2 stream reset did not trigger with H2_ERR_HTTP_1_1_REQUIRED. + Fixed. [Michael Kaufmann] + *) mod_http2: new configuration directive: ```H2Padding numbits``` to control padding of HTTP/2 payload frames. 'numbits' is a number from 0-8, controlling the range of padding bytes added to a frame. The actual number diff --git a/modules/http2/h2_headers.c b/modules/http2/h2_headers.c index 1f7a8ede73..fe6ba790f4 100644 --- a/modules/http2/h2_headers.c +++ b/modules/http2/h2_headers.c @@ -129,16 +129,20 @@ h2_headers *h2_headers_rcreate(request_rec *r, int status, { h2_headers *headers = h2_headers_create(status, header, r->notes, 0, pool); if (headers->status == HTTP_FORBIDDEN) { - const char *cause = apr_table_get(r->notes, "ssl-renegotiate-forbidden"); - if (cause) { - /* This request triggered a TLS renegotiation that is now allowed - * in HTTP/2. Tell the client that it should use HTTP/1.1 for this. - */ - ap_log_rerror(APLOG_MARK, APLOG_DEBUG, headers->status, r, - APLOGNO(03061) - "h2_headers(%ld): renegotiate forbidden, cause: %s", - (long)r->connection->id, cause); - headers->status = H2_ERR_HTTP_1_1_REQUIRED; + request_rec *r_prev; + for (r_prev = r; r_prev != NULL; r_prev = r_prev->prev) { + const char *cause = apr_table_get(r_prev->notes, "ssl-renegotiate-forbidden"); + if (cause) { + /* This request triggered a TLS renegotiation that is not allowed + * in HTTP/2. Tell the client that it should use HTTP/1.1 for this. + */ + ap_log_rerror(APLOG_MARK, APLOG_DEBUG, headers->status, r, + APLOGNO(03061) + "h2_headers(%ld): renegotiate forbidden, cause: %s", + (long)r->connection->id, cause); + headers->status = H2_ERR_HTTP_1_1_REQUIRED; + break; + } } } if (is_unsafe(r->server)) { -- 2.40.0