# ./pullrev.sh 1870095 1870097

http://svn.apache.org/viewvc?view=revision&revision=1870095

http://svn.apache.org/viewvc?view=revision&revision=1870097

--- httpd-2.4.37/modules/ssl/ssl_engine_kernel.c

+++ httpd-2.4.37/modules/ssl/ssl_engine_kernel.c

@@ -114,6 +114,45 @@

     return result;

 }

+/* If a renegotiation is required for the location, and the request

+ * includes a message body (and the client has not requested a "100

+ * Continue" response), then the client will be streaming the request

+ * body over the wire already.  In that case, it is not possible to

+ * stop and perform a new SSL handshake immediately; once the SSL

+ * library moves to the "accept" state, it will reject the SSL packets

+ * which the client is sending for the request body.

+ *

+ * To allow authentication to complete in the hook, the solution used

+ * here is to fill a (bounded) buffer with the request body, and then

+ * to reinject that request body later.

+ *

+ * This function is called to fill the renegotiation buffer for the

+ * location as required, or fail.  Returns zero on success or HTTP_

+ * error code on failure.

+ */

+static int fill_reneg_buffer(request_rec *r, SSLDirConfigRec *dc)

+{

+    int rv;

+    apr_size_t rsize;

+

+    /* ### this is HTTP/1.1 specific, special case for protocol? */

+    if (r->expecting_100 || !ap_request_has_body(r)) {

+        return 0;

+    }

+

+    rsize = dc->nRenegBufferSize == UNSET ? DEFAULT_RENEG_BUFFER_SIZE : dc->nRenegBufferSize;

+    if (rsize > 0) {

+        /* Fill the I/O buffer with the request body if possible. */

+        rv = ssl_io_buffer_fill(r, rsize);

+    }

+    else {

+        /* If the reneg buffer size is set to zero, just fail. */

+        rv = HTTP_REQUEST_ENTITY_TOO_LARGE;

+    }

+

+    return rv;

+}

+

 #ifdef HAVE_TLSEXT

 static int ap_array_same_str_set(apr_array_header_t *s1, apr_array_header_t *s2)

 {

@@ -814,41 +853,14 @@

         }

     }

-    /* If a renegotiation is now required for this location, and the

-     * request includes a message body (and the client has not

-     * requested a "100 Continue" response), then the client will be

-     * streaming the request body over the wire already.  In that

-     * case, it is not possible to stop and perform a new SSL

-     * handshake immediately; once the SSL library moves to the

-     * "accept" state, it will reject the SSL packets which the client

-     * is sending for the request body.

-     *

-     * To allow authentication to complete in this auth hook, the

-     * solution used here is to fill a (bounded) buffer with the

-     * request body, and then to reinject that request body later.

-     */

-    if (renegotiate && !renegotiate_quick

-        && !r->expecting_100

-        && ap_request_has_body(r)) {

-        int rv;

-        apr_size_t rsize;

-

-        rsize = dc->nRenegBufferSize == UNSET ? DEFAULT_RENEG_BUFFER_SIZE :

-                                                dc->nRenegBufferSize;

-        if (rsize > 0) {

-            /* Fill the I/O buffer with the request body if possible. */

-            rv = ssl_io_buffer_fill(r, rsize);

-        }

-        else {

-            /* If the reneg buffer size is set to zero, just fail. */

-            rv = HTTP_REQUEST_ENTITY_TOO_LARGE;

-        }

-

-        if (rv) {

+    /* Fill reneg buffer if required. */

+    if (renegotiate && !renegotiate_quick) {

+        rc = fill_reneg_buffer(r, dc);

+        if (rc) {

             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02257)

                           "could not buffer message body to allow "

                           "SSL renegotiation to proceed");

-            return rv;

+            return rc;

         }

     }

@@ -1132,6 +1144,17 @@

             }

         }

+        /* Fill reneg buffer if required. */

+        if (change_vmode) {

+            rc = fill_reneg_buffer(r, dc);

+            if (rc) {

+                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10228)

+                              "could not buffer message body to allow "

+                              "TLS Post-Handshake Authentication to proceed");

+                return rc;

+            }

+        }

+

         if (change_vmode) {

             char peekbuf[1];