Backport of:

From 54e0c857b1b019c147b778c09d5e72d99183ff61 Mon Sep 17 00:00:00 2001
From: Jim Jagielski <jim@apache.org>
Date: Tue, 30 May 2017 12:26:05 +0000
Subject: [PATCH] Merge r1796343 from trunk:

mod_ssl: fix ctx passed to ssl_io_filter_error()

Consistently pass the expected bio_filter_in_ctx_t
to ssl_io_filter_error().

Submitted By: Yann Ylavic



Submitted by: covener
Reviewed by: covener, ylavic, jim


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1796854 13f79535-47bb-0310-9956-ffa450edef68
---
 CHANGES                     |  3 +++
 STATUS                      |  6 ------
 modules/ssl/ssl_engine_io.c | 15 ++++++++-------
 3 files changed, 11 insertions(+), 13 deletions(-)

#diff --git a/CHANGES b/CHANGES
#index ddf722da2a2..1b815557a37 100644
#--- a/CHANGES
#+++ b/CHANGES
#@@ -18,6 +18,9 @@ Changes with Apache 2.4.26
#   *) core: EBCDIC fixes for interim responses with additional headers.
#      [Eric Covener]
# 
#+  *) mod_ssl: Consistently pass the expected bio_filter_in_ctx_t
#+     to ssl_io_filter_error(). [Yann Ylavic]
#+
#   *) mod_env: when processing a 'SetEnv' directive, warn if the environment
#      variable name includes a '='. It is likely a configuration error.
#      PR 60249 [Christophe Jaillet]
#diff --git a/STATUS b/STATUS
#index 28add1d0f42..1ce64c6b43b 100644
#--- a/STATUS
#+++ b/STATUS
#@@ -120,12 +120,6 @@ RELEASE SHOWSTOPPERS:
# PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
#   [ start all new proposals below, under PATCHES PROPOSED. ]
# 
#-  *) mod_ssl: Consistently pass the expected bio_filter_in_ctx_t
#-     to ssl_io_filter_error(). [Yann Ylavic]
#-     trunk patch: http://svn.apache.org/r1796343
#-     2.4.x patch: svn merge -c 1796343 ^/httpd/httpd/trunk . (modulo CHANGES)
#-     +1: covener, ylavic, jim
#-
#   *) core: Deprecate ap_get_basic_auth_pw() and add 
#      ap_get_basic_auth_components(). 
#      trunk patch: http://svn.apache.org/r1796348
Index: apache2-2.4.7/modules/ssl/ssl_engine_io.c
===================================================================
--- apache2-2.4.7.orig/modules/ssl/ssl_engine_io.c	2017-06-26 07:59:16.614059669 -0400
+++ apache2-2.4.7/modules/ssl/ssl_engine_io.c	2017-06-26 08:03:56.053052369 -0400
@@ -845,19 +845,20 @@ static apr_status_t ssl_filter_write(ap_
  * establish an outgoing SSL connection. */
 #define MODSSL_ERROR_BAD_GATEWAY (APR_OS_START_USERERR + 1)
 
-static void ssl_io_filter_disable(SSLConnRec *sslconn, ap_filter_t *f)
+static void ssl_io_filter_disable(SSLConnRec *sslconn,
+                                  bio_filter_in_ctx_t *inctx)
 {
-    bio_filter_in_ctx_t *inctx = f->ctx;
     SSL_free(inctx->ssl);
     sslconn->ssl = NULL;
     inctx->ssl = NULL;
     inctx->filter_ctx->pssl = NULL;
 }
 
-static apr_status_t ssl_io_filter_error(ap_filter_t *f,
+static apr_status_t ssl_io_filter_error(bio_filter_in_ctx_t *inctx,
                                         apr_bucket_brigade *bb,
                                         apr_status_t status)
 {
+    ap_filter_t *f = inctx->f;
     SSLConnRec *sslconn = myConnConfig(f->c);
     apr_bucket *bucket;
     int send_eos = 1;
@@ -871,7 +872,7 @@ static apr_status_t ssl_io_filter_error(
             ssl_log_ssl_error(SSLLOG_MARK, APLOG_INFO, sslconn->server);
 
             sslconn->non_ssl_request = NON_SSL_SEND_HDR_SEP;
-            ssl_io_filter_disable(sslconn, f);
+            ssl_io_filter_disable(sslconn, inctx);
 
             /* fake the request line */
             bucket = HTTP_ON_HTTPS_PORT_BUCKET(f->c->bucket_alloc);
@@ -1348,7 +1349,7 @@ static apr_status_t ssl_io_filter_input(
      * rather than have SSLEngine On configured.
      */
     if ((status = ssl_io_filter_handshake(inctx->filter_ctx)) != APR_SUCCESS) {
-        return ssl_io_filter_error(f, bb, status);
+        return ssl_io_filter_error(inctx, bb, status);
     }
 
     if (is_init) {
@@ -1402,7 +1403,7 @@ static apr_status_t ssl_io_filter_input(
 
     /* Handle custom errors. */
     if (status != APR_SUCCESS) {
-        return ssl_io_filter_error(f, bb, status);
+        return ssl_io_filter_error(inctx, bb, status);
     }
 
     /* Create a transient bucket out of the decrypted data. */
@@ -1588,7 +1589,7 @@ static apr_status_t ssl_io_filter_output
     inctx->block = APR_BLOCK_READ;
 
     if ((status = ssl_io_filter_handshake(filter_ctx)) != APR_SUCCESS) {
-        return ssl_io_filter_error(f, bb, status);
+        return ssl_io_filter_error(inctx, bb, status);
     }
 
     while (!APR_BRIGADE_EMPTY(bb)) {
