|
 |
cce4bc |
--- a/modules/ssl/ssl_engine_kernel.c 2015/02/27 06:05:11 1662639
|
|
|
cce4bc |
+++ b/modules/ssl/ssl_engine_kernel.c 2015/02/27 06:18:31 1662640
|
|
|
cce4bc |
@@ -80,7 +80,8 @@
|
|
|
cce4bc |
|
|
|
cce4bc |
if (SSL_get_state(ssl) != SSL_ST_OK) {
|
|
|
cce4bc |
ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02030)
|
|
|
cce4bc |
- "TLS upgrade handshake failed: not accepted by client!?");
|
|
|
cce4bc |
+ "TLS upgrade handshake failed");
|
|
|
cce4bc |
+ ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);
|
|
|
cce4bc |
|
|
|
cce4bc |
return APR_ECONNABORTED;
|
|
|
cce4bc |
}
|
|
|
cce4bc |
@@ -314,6 +315,16 @@
|
|
|
cce4bc |
int depth, verify_old, verify, n;
|
|
|
cce4bc |
|
|
|
cce4bc |
if (ssl) {
|
|
|
cce4bc |
+ /*
|
|
|
cce4bc |
+ * We should have handshaken here (on handshakeserver),
|
|
|
cce4bc |
+ * otherwise we are being redirected (ErrorDocument) from
|
|
|
cce4bc |
+ * a renegotiation failure below. The access is still
|
|
|
cce4bc |
+ * forbidden in the latter case, let ap_die() handle
|
|
|
cce4bc |
+ * this recursive (same) error.
|
|
|
cce4bc |
+ */
|
|
|
cce4bc |
+ if (SSL_get_state(ssl) != SSL_ST_OK) {
|
|
|
cce4bc |
+ return HTTP_FORBIDDEN;
|
|
|
cce4bc |
+ }
|
|
|
cce4bc |
ctx = SSL_get_SSL_CTX(ssl);
|
|
|
cce4bc |
}
|
|
|
cce4bc |
|
|
|
cce4bc |
@@ -828,8 +839,8 @@
|
|
|
cce4bc |
|
|
|
cce4bc |
if (SSL_get_state(ssl) != SSL_ST_OK) {
|
|
|
cce4bc |
ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02261)
|
|
|
cce4bc |
- "Re-negotiation handshake failed: "
|
|
|
cce4bc |
- "Not accepted by client!?");
|
|
|
cce4bc |
+ "Re-negotiation handshake failed");
|
|
|
cce4bc |
+ ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);
|
|
|
cce4bc |
|
|
|
cce4bc |
r->connection->keepalive = AP_CONN_CLOSE;
|
|
|
cce4bc |
return HTTP_FORBIDDEN;
|