Changeset 0dc1a31 in mod_gnutls

Timestamp:

Jan 15, 2020, 11:14:50 AM (15 months ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

asyncio, master, proxy-ticket

Children:

a9e0738

Parents:

346c03b

git-author:

Fiona Klute <fiona.klute@…> (01/15/20 11:13:01)

git-committer:

Fiona Klute <fiona.klute@…> (01/15/20 11:14:50)

Message:

Always return DECLINED instead of OK from mgs_cert_verify

The return value may be returned from mgs_hook_authz in turn, and in
that case OK would prevent other modules' authz hooks from being
called. DECLINED basically means that the current module has no
objections.

File:

• src/gnutls_hooks.c (modified) (2 diffs)

src/gnutls_hooks.c

@@ -1656 +1656 @@
          */
         if (ctxt->sc->client_verify_mode == GNUTLS_CERT_REQUEST)
-            return OK;
+            return DECLINED;
 
         /* no certificate provided by the client, but one was required. */
@@ -1834 +1834 @@
         apr_table_setn(r->subprocess_env, "SSL_CLIENT_VERIFY",
                 "SUCCESS");
-        ret = OK;
+        ret = DECLINED;
     } else {
         apr_table_setn(r->subprocess_env, "SSL_CLIENT_VERIFY",