Function ssl_callback_Info

modules/ssl/ssl_engine_kernel.c:2097–2143

* This callback function is executed while OpenSSL processes the SSL * handshake and does SSL record layer stuff. It's used to trap * client-initiated renegotiations (where SSL_OP_NO_RENEGOTIATION is * not available), and for dumping everything to the log. */

 * not available), and for dumping everything to the log.
 */
void ssl_callback_Info(const SSL *ssl, int where, int rc)
{
    conn_rec *c;
    server_rec *s;

    /* Retrieve the conn_rec and the associated SSLConnRec. */
    if ((c = (conn_rec *)SSL_get_app_data((SSL *)ssl)) == NULL) {
        return;
    }

#ifndef SSL_OP_NO_RENEGOTIATION
    /* With OpenSSL < 1.1.1 (implying TLS v1.2 or earlier), this
     * callback is used to block client-initiated renegotiation.  With
     * TLSv1.3 it is unnecessary since renegotiation is forbidden at
     * protocol level.  Otherwise (TLSv1.2 with OpenSSL >=1.1.1),
     * SSL_OP_NO_RENEGOTIATION is used to block renegotiation. */
    {
        SSLConnRec *sslconn;

        if ((sslconn = myConnConfig(c)) == NULL) {
            return;
        }

        /* If the reneg state is to reject renegotiations, check the SSL
         * state machine and move to ABORT if a Client Hello is being
         * read. */
        if (!c->outgoing &&
                (where & SSL_CB_HANDSHAKE_START) &&
                sslconn->reneg_state == RENEG_REJECT) {
            sslconn->reneg_state = RENEG_ABORT;
            ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(02042)
                          "rejecting client initiated renegotiation");
        }
        /* If the first handshake is complete, change state to reject any
         * subsequent client-initiated renegotiation. */
        else if ((where & SSL_CB_HANDSHAKE_DONE)
                 && sslconn->reneg_state == RENEG_INIT) {
            sslconn->reneg_state = RENEG_REJECT;
        }
    }
#endif

    s = mySrvFromConn(c);
    if (s && APLOGdebug(s)) {
        log_tracing_state(ssl, c, s, where, rc);
    }
}

#ifdef HAVE_TLSEXT