Source-Changes-HG archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

[src/trunk]: src/libexec/httpd add ssl specific timeout value (30s). if SSL_...



details:   https://anonhg.NetBSD.org/src/rev/e390b6a9ce97
branches:  trunk
changeset: 997232:e390b6a9ce97
user:      mrg <mrg%NetBSD.org@localhost>
date:      Thu Feb 28 08:28:21 2019 +0000

description:
add ssl specific timeout value (30s).  if SSL_accept() doesn't
work with in this timeout value, ssl setup now fails.

mostly different from, but inspired from the patch in PR 50655

diffstat:

 libexec/httpd/auth-bozo.c      |   4 ++--
 libexec/httpd/bozohttpd.8      |  10 ++++++----
 libexec/httpd/bozohttpd.c      |  36 ++++++++++++++++++++++++------------
 libexec/httpd/bozohttpd.h      |   8 ++++++--
 libexec/httpd/dir-index-bozo.c |   4 ++--
 libexec/httpd/ssl-bozo.c       |  14 ++++++++++++--
 6 files changed, 52 insertions(+), 24 deletions(-)

diffs (265 lines):

diff -r 81b59da8c330 -r e390b6a9ce97 libexec/httpd/auth-bozo.c
--- a/libexec/httpd/auth-bozo.c Thu Feb 28 05:40:58 2019 +0000
+++ b/libexec/httpd/auth-bozo.c Thu Feb 28 08:28:21 2019 +0000
@@ -1,9 +1,9 @@
-/*     $NetBSD: auth-bozo.c,v 1.23 2019/01/22 05:32:57 mrg Exp $       */
+/*     $NetBSD: auth-bozo.c,v 1.24 2019/02/28 08:28:21 mrg Exp $       */
 
 /*     $eterna: auth-bozo.c,v 1.17 2011/11/18 09:21:15 mrg Exp $       */
 
 /*
- * Copyright (c) 1997-2018 Matthew R. Green
+ * Copyright (c) 1997-2019 Matthew R. Green
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff -r 81b59da8c330 -r e390b6a9ce97 libexec/httpd/bozohttpd.8
--- a/libexec/httpd/bozohttpd.8 Thu Feb 28 05:40:58 2019 +0000
+++ b/libexec/httpd/bozohttpd.8 Thu Feb 28 08:28:21 2019 +0000
@@ -1,8 +1,8 @@
-.\"    $NetBSD: bozohttpd.8,v 1.78 2019/01/17 07:46:16 mrg Exp $
+.\"    $NetBSD: bozohttpd.8,v 1.79 2019/02/28 08:28:21 mrg Exp $
 .\"
 .\"    $eterna: bozohttpd.8,v 1.101 2011/11/18 01:25:11 mrg Exp $
 .\"
-.\" Copyright (c) 1997-2018 Matthew R. Green
+.\" Copyright (c) 1997-2019 Matthew R. Green
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
@@ -26,7 +26,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd January 7, 2019
+.Dd February 27, 2019
 .Dt BOZOHTTPD 8
 .Os
 .Sh NAME
@@ -245,11 +245,13 @@
 The valid values of
 .Ar type
 are
+.Dq ssl timeout ,
 .Dq initial timeout ,
 .Dq header timeout ,
 and
 .Dq request timeout .
-The default values are 30 seconds, 10 seconds and 600 seconds, respectively.
+The default values are 30 seconds, 30 seconds, 10 seconds and 600 seconds,
+respectively.
 .It Fl t Ar chrootdir
 Makes
 .Nm
diff -r 81b59da8c330 -r e390b6a9ce97 libexec/httpd/bozohttpd.c
--- a/libexec/httpd/bozohttpd.c Thu Feb 28 05:40:58 2019 +0000
+++ b/libexec/httpd/bozohttpd.c Thu Feb 28 08:28:21 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: bozohttpd.c,v 1.111 2019/01/22 05:32:57 mrg Exp $      */
+/*     $NetBSD: bozohttpd.c,v 1.112 2019/02/28 08:28:21 mrg Exp $      */
 
 /*     $eterna: bozohttpd.c,v 1.178 2011/11/18 09:21:15 mrg Exp $      */
 
@@ -137,7 +137,6 @@
 #include <netdb.h>
 #include <pwd.h>
 #include <grp.h>
-#include <signal.h>
 #include <stdarg.h>
 #include <stdlib.h>
 #include <strings.h>
@@ -148,6 +147,9 @@
 
 #include "bozohttpd.h"
 
+#ifndef SSL_TIMEOUT
+#define        SSL_TIMEOUT             "30"    /* wait for 30 seconds for ssl handshake  */
+#endif
 #ifndef INITIAL_TIMEOUT
 #define        INITIAL_TIMEOUT         "30"    /* wait for 30 seconds initially */
 #endif
@@ -183,7 +185,7 @@
        { NULL,               NULL },
 };
 
-volatile sig_atomic_t  timeout_hit;
+volatile sig_atomic_t  bozo_timeout_hit;
 
 /*
  * check there's enough space in the prefs and names arrays.
@@ -371,18 +373,19 @@
 static void
 alarmer(int sig)
 {
-       timeout_hit = 1;
+       bozo_timeout_hit = 1;
 }
 
 
 /*
- * set a timeout for "initial", "header", or "request".
+ * set a timeout for "ssl", "initial", "header", or "request".
  */
 int
 bozo_set_timeout(bozohttpd_t *httpd, bozoprefs_t *prefs,
                 const char *target, const char *val)
 {
        const char **cur, *timeouts[] = {
+               "ssl timeout",
                "initial timeout",
                "header timeout",
                "request timeout",
@@ -602,14 +605,10 @@
        /*
         * if we're in daemon mode, bozo_daemon_fork() will return here twice
         * for each call.  once in the child, returning 0, and once in the
-        * parent, returning 1.  for each child, then we can setup SSL, and
-        * the parent can signal the caller there was no request to process
-        * and it will wait for another.
+        * parent, returning 1 for each child.
         */
        if (bozo_daemon_fork(httpd))
                return NULL;
-       if (bozo_ssl_accept(httpd))
-               return NULL;
 
        request = bozomalloc(httpd, sizeof(*request));
        memset(request, 0, sizeof(*request));
@@ -685,6 +684,14 @@
                goto cleanup;
        }
 
+       /*
+        * now to try to setup SSL, and upon failure parent can signal the
+        * caller there was no request to process and it will wait for
+        * another.
+        */
+       if (bozo_ssl_accept(httpd))
+               return NULL;
+
        alarm(httpd->initial_timeout);
        while ((str = bozodgetln(httpd, STDIN_FILENO, &len, bozo_read)) != NULL) {
                alarm(0);
@@ -707,9 +714,9 @@
                if (ts.tv_sec > ots.tv_sec &&
                    ts.tv_sec > httpd->request_timeout &&
                    ts.tv_sec - httpd->request_timeout > ots.tv_sec)
-                       timeout_hit = 1;
+                       bozo_timeout_hit = 1;
 
-               if (timeout_hit) {
+               if (bozo_timeout_hit) {
                        bozo_http_error(httpd, 408, NULL, "request timed out");
                        goto cleanup;
                }
@@ -2464,6 +2471,8 @@
                rv = 1;
        if (!bozo_set_pref(httpd, prefs, "public_html", PUBLIC_HTML))
                rv = 1;
+       if (!bozo_set_pref(httpd, prefs, "ssl timeout", SSL_TIMEOUT))
+               rv = 1;
        if (!bozo_set_pref(httpd, prefs, "initial timeout", INITIAL_TIMEOUT))
                rv = 1;
        if (!bozo_set_pref(httpd, prefs, "header timeout", HEADER_WAIT_TIME))
@@ -2564,6 +2573,9 @@
        if ((cp = bozo_get_pref(prefs, "public_html")) != NULL) {
                httpd->public_html = bozostrdup(httpd, NULL, cp);
        }
+       if ((cp = bozo_get_pref(prefs, "ssl timeout")) != NULL) {
+               httpd->ssl_timeout = atoi(cp);
+       }
        if ((cp = bozo_get_pref(prefs, "initial timeout")) != NULL) {
                httpd->initial_timeout = atoi(cp);
        }
diff -r 81b59da8c330 -r e390b6a9ce97 libexec/httpd/bozohttpd.h
--- a/libexec/httpd/bozohttpd.h Thu Feb 28 05:40:58 2019 +0000
+++ b/libexec/httpd/bozohttpd.h Thu Feb 28 08:28:21 2019 +0000
@@ -1,9 +1,9 @@
-/*     $NetBSD: bozohttpd.h,v 1.58 2019/01/22 05:32:57 mrg Exp $       */
+/*     $NetBSD: bozohttpd.h,v 1.59 2019/02/28 08:28:21 mrg Exp $       */
 
 /*     $eterna: bozohttpd.h,v 1.39 2011/11/18 09:21:15 mrg Exp $       */
 
 /*
- * Copyright (c) 1997-2018 Matthew R. Green
+ * Copyright (c) 1997-2019 Matthew R. Green
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -35,6 +35,7 @@
 #include "netbsd_queue.h"
 
 #include <stdbool.h>
+#include <signal.h>
 
 #include <sys/stat.h>
 
@@ -119,6 +120,7 @@
        int              hide_dots;     /* hide .* */
        int              process_cgi;   /* use the cgi handler */
        char            *cgibin;        /* cgi-bin directory */
+       unsigned        ssl_timeout;    /* ssl timeout */
        unsigned        initial_timeout;/* first line timeout */
        unsigned        header_timeout; /* header lines timeout */
        unsigned        request_timeout;/* total session timeout */
@@ -434,4 +436,6 @@
 
 int bozo_get_version(char */*buf*/, size_t /*size*/);
 
+extern volatile sig_atomic_t   bozo_timeout_hit;
+
 #endif /* BOZOHTTOPD_H_ */
diff -r 81b59da8c330 -r e390b6a9ce97 libexec/httpd/dir-index-bozo.c
--- a/libexec/httpd/dir-index-bozo.c    Thu Feb 28 05:40:58 2019 +0000
+++ b/libexec/httpd/dir-index-bozo.c    Thu Feb 28 08:28:21 2019 +0000
@@ -1,9 +1,9 @@
-/*     $NetBSD: dir-index-bozo.c,v 1.31 2019/01/22 05:32:57 mrg Exp $  */
+/*     $NetBSD: dir-index-bozo.c,v 1.32 2019/02/28 08:28:21 mrg Exp $  */
 
 /*     $eterna: dir-index-bozo.c,v 1.20 2011/11/18 09:21:15 mrg Exp $  */
 
 /*
- * Copyright (c) 1997-2018 Matthew R. Green
+ * Copyright (c) 1997-2019 Matthew R. Green
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff -r 81b59da8c330 -r e390b6a9ce97 libexec/httpd/ssl-bozo.c
--- a/libexec/httpd/ssl-bozo.c  Thu Feb 28 05:40:58 2019 +0000
+++ b/libexec/httpd/ssl-bozo.c  Thu Feb 28 08:28:21 2019 +0000
@@ -1,9 +1,9 @@
-/*     $NetBSD: ssl-bozo.c,v 1.25 2018/11/22 08:54:08 mrg Exp $        */
+/*     $NetBSD: ssl-bozo.c,v 1.26 2019/02/28 08:28:21 mrg Exp $        */
 
 /*     $eterna: ssl-bozo.c,v 1.15 2011/11/18 09:21:15 mrg Exp $        */
 
 /*
- * Copyright (c) 1997-2018 Matthew R. Green
+ * Copyright (c) 1997-2019 Matthew R. Green
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -263,6 +263,8 @@
        if (sslinfo == NULL || !sslinfo->ssl_context)
                return 0;
 
+       alarm(httpd->ssl_timeout);
+
        sslinfo->bozossl = SSL_new(sslinfo->ssl_context);
        if (sslinfo->bozossl == NULL)
                bozoerr(httpd, 1, "SSL_new failed");
@@ -273,6 +275,14 @@
        const int ret = SSL_accept(sslinfo->bozossl);
        bozo_check_error_queue(httpd, "accept", ret);
 
+       alarm(0);
+
+       if (bozo_timeout_hit) {
+               SSL_free(sslinfo->bozossl);
+               sslinfo->bozossl = NULL;
+               return 1;
+       }
+
        return ret != 1;
 }
 



Home | Main Index | Thread Index | Old Index