Check whether a transition from vhost sc1 to sc2 from SNI to Host: * vhost selection is permitted according to the SSLVHostSNIPolicy * setting. Returns 1 if the policy treats the vhosts as compatible, * else 0. */
| 106 | * setting. Returns 1 if the policy treats the vhosts as compatible, |
| 107 | * else 0. */ |
| 108 | static int ssl_check_vhost_sni_policy(SSLSrvConfigRec *sc1, |
| 109 | SSLSrvConfigRec *sc2) |
| 110 | { |
| 111 | modssl_snivhpolicy_t policy = sc1->mc->snivh_policy; |
| 112 | |
| 113 | /* Policy: insecure => allow everything. */ |
| 114 | if (policy == MODSSL_SNIVH_INSECURE) |
| 115 | return 1; |
| 116 | |
| 117 | /* Policy: strict => fail for any vhost transition. */ |
| 118 | if (policy == MODSSL_SNIVH_STRICT) |
| 119 | return sc1 == sc2; |
| 120 | |
| 121 | /* For authonly/secure policy, compare the hash. */ |
| 122 | AP_DEBUG_ASSERT(sc1->sni_policy_hash); |
| 123 | AP_DEBUG_ASSERT(sc2->sni_policy_hash); |
| 124 | |
| 125 | return strcmp(sc1->sni_policy_hash, sc2->sni_policy_hash) == 0; |
| 126 | } |
| 127 | #endif |
| 128 | |
| 129 | /* |