You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by rp...@apache.org on 2018/04/10 06:39:32 UTC
svn commit: r1828790 - /httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c
Author: rpluem
Date: Tue Apr 10 06:39:31 2018
New Revision: 1828790
URL: http://svn.apache.org/viewvc?rev=1828790&view=rev
Log:
* Whitespace fixes. No functional change
Modified:
httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c
Modified: httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c?rev=1828790&r1=1828789&r2=1828790&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c (original)
+++ httpd/httpd/trunk/modules/ssl/ssl_engine_kernel.c Tue Apr 10 06:39:31 2018
@@ -440,31 +440,31 @@ static int ssl_check_post_client_verify(
(sc->server->auth.verify_mode != SSL_CVERIFY_NONE)) {
BOOL do_verify = ((dc->nVerifyClient == SSL_CVERIFY_REQUIRE) ||
(sc->server->auth.verify_mode == SSL_CVERIFY_REQUIRE));
-
+
if (do_verify && (SSL_get_verify_result(ssl) != X509_V_OK)) {
ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02262)
"Re-negotiation handshake failed: "
"Client verification failed");
-
+
return HTTP_FORBIDDEN;
}
-
+
if (do_verify) {
X509 *peercert;
-
+
if ((peercert = SSL_get_peer_certificate(ssl)) == NULL) {
ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02263)
"Re-negotiation handshake failed: "
"Client certificate missing");
-
+
return HTTP_FORBIDDEN;
}
-
+
X509_free(peercert);
}
}
return OK;
-}
+}
/*
* Access Handler, classic flavour, for SSL/TLS up to v1.2
@@ -1139,7 +1139,7 @@ static int ssl_hook_Access_modern(reques
int vmode_inplace, vmode_needed;
int change_vmode = FALSE;
int old_state, n, rc;
-
+
vmode_inplace = SSL_get_verify_mode(ssl);
vmode_needed = SSL_VERIFY_NONE;
@@ -1159,11 +1159,11 @@ static int ssl_hook_Access_modern(reques
if (vmode_needed == SSL_VERIFY_NONE) {
return DECLINED;
}
-
+
vmode_needed |= SSL_VERIFY_CLIENT_ONCE;
if (vmode_inplace != vmode_needed) {
/* Need to change, if new setting is more restrictive than existing one */
-
+
if ((vmode_inplace == SSL_VERIFY_NONE)
|| (!(vmode_inplace & SSL_VERIFY_PEER)
&& (vmode_needed & SSL_VERIFY_PEER))
@@ -1203,7 +1203,7 @@ static int ssl_hook_Access_modern(reques
}
}
}
-
+
if (change_vmode) {
char peekbuf[1];
@@ -1215,9 +1215,9 @@ static int ssl_hook_Access_modern(reques
apr_table_setn(r->notes, "ssl-renegotiate-forbidden", "verify-client");
return HTTP_FORBIDDEN;
}
-
+
ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO() "verify client post handshake");
-
+
SSL_set_verify(ssl, vmode_needed, ssl_callback_SSLVerify);
SSL_verify_client_post_handshake(ssl);
@@ -1243,7 +1243,7 @@ static int ssl_hook_Access_modern(reques
}
}
}
-
+
return DECLINED;
}
#endif
@@ -1261,7 +1261,7 @@ int ssl_hook_Access(request_rec *r)
sslconn = myConnConfig(r->connection->master);
ssl = sslconn ? sslconn->ssl : NULL;
}
-
+
/*
* We should have handshaken here, otherwise we are being
* redirected (ErrorDocument) from a renegotiation failure below.
@@ -1304,7 +1304,7 @@ int ssl_hook_Access(request_rec *r)
if (sc->enabled == SSL_ENABLED_FALSE || !ssl) {
return DECLINED;
}
-
+
#ifdef SSL_OP_NO_TLSv1_3
/* TLSv1.3+ is less complicated here. Branch off into a new codeline
* and avoid messing with the past. */