Blame SOURCES/httpd-2.4.6-r1662640.patch

cce4bc
--- a/modules/ssl/ssl_engine_kernel.c  2015/02/27 06:05:11 1662639
cce4bc
+++ b/modules/ssl/ssl_engine_kernel.c  2015/02/27 06:18:31 1662640
cce4bc
@@ -80,7 +80,8 @@
cce4bc
 
cce4bc
     if (SSL_get_state(ssl) != SSL_ST_OK) {
cce4bc
         ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02030)
cce4bc
-                      "TLS upgrade handshake failed: not accepted by client!?");
cce4bc
+                      "TLS upgrade handshake failed");
cce4bc
+        ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);
cce4bc
 
cce4bc
         return APR_ECONNABORTED;
cce4bc
     }
cce4bc
@@ -314,6 +315,16 @@
cce4bc
     int depth, verify_old, verify, n;
cce4bc
 
cce4bc
     if (ssl) {
cce4bc
+        /*
cce4bc
+         * We should have handshaken here (on handshakeserver),
cce4bc
+         * otherwise we are being redirected (ErrorDocument) from
cce4bc
+         * a renegotiation failure below. The access is still 
cce4bc
+         * forbidden in the latter case, let ap_die() handle
cce4bc
+         * this recursive (same) error.
cce4bc
+         */
cce4bc
+        if (SSL_get_state(ssl) != SSL_ST_OK) {
cce4bc
+            return HTTP_FORBIDDEN;
cce4bc
+        }
cce4bc
         ctx = SSL_get_SSL_CTX(ssl);
cce4bc
     }
cce4bc
 
cce4bc
@@ -828,8 +839,8 @@
cce4bc
 
cce4bc
             if (SSL_get_state(ssl) != SSL_ST_OK) {
cce4bc
                 ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02261)
cce4bc
-                              "Re-negotiation handshake failed: "
cce4bc
-                              "Not accepted by client!?");
cce4bc
+                              "Re-negotiation handshake failed");
cce4bc
+                ssl_log_ssl_error(SSLLOG_MARK, APLOG_ERR, r->server);
cce4bc
 
cce4bc
                 r->connection->keepalive = AP_CONN_CLOSE;
cce4bc
                 return HTTP_FORBIDDEN;