Source-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[src/trunk]: src/libexec/httpd add ssl specific timeout value (30s). if SSL_...
details: https://anonhg.NetBSD.org/src/rev/b79dfa9b4b34
branches: trunk
changeset: 449243:b79dfa9b4b34
user: mrg <mrg%NetBSD.org@localhost>
date: Thu Feb 28 08:28:21 2019 +0000
description:
add ssl specific timeout value (30s). if SSL_accept() doesn't
work with in this timeout value, ssl setup now fails.
mostly different from, but inspired from the patch in PR 50655
diffstat:
libexec/httpd/auth-bozo.c | 4 ++--
libexec/httpd/bozohttpd.8 | 10 ++++++----
libexec/httpd/bozohttpd.c | 36 ++++++++++++++++++++++++------------
libexec/httpd/bozohttpd.h | 8 ++++++--
libexec/httpd/dir-index-bozo.c | 4 ++--
libexec/httpd/ssl-bozo.c | 14 ++++++++++++--
6 files changed, 52 insertions(+), 24 deletions(-)
diffs (265 lines):
diff -r cc418d3bce2e -r b79dfa9b4b34 libexec/httpd/auth-bozo.c
--- a/libexec/httpd/auth-bozo.c Thu Feb 28 05:40:58 2019 +0000
+++ b/libexec/httpd/auth-bozo.c Thu Feb 28 08:28:21 2019 +0000
@@ -1,9 +1,9 @@
-/* $NetBSD: auth-bozo.c,v 1.23 2019/01/22 05:32:57 mrg Exp $ */
+/* $NetBSD: auth-bozo.c,v 1.24 2019/02/28 08:28:21 mrg Exp $ */
/* $eterna: auth-bozo.c,v 1.17 2011/11/18 09:21:15 mrg Exp $ */
/*
- * Copyright (c) 1997-2018 Matthew R. Green
+ * Copyright (c) 1997-2019 Matthew R. Green
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
diff -r cc418d3bce2e -r b79dfa9b4b34 libexec/httpd/bozohttpd.8
--- a/libexec/httpd/bozohttpd.8 Thu Feb 28 05:40:58 2019 +0000
+++ b/libexec/httpd/bozohttpd.8 Thu Feb 28 08:28:21 2019 +0000
@@ -1,8 +1,8 @@
-.\" $NetBSD: bozohttpd.8,v 1.78 2019/01/17 07:46:16 mrg Exp $
+.\" $NetBSD: bozohttpd.8,v 1.79 2019/02/28 08:28:21 mrg Exp $
.\"
.\" $eterna: bozohttpd.8,v 1.101 2011/11/18 01:25:11 mrg Exp $
.\"
-.\" Copyright (c) 1997-2018 Matthew R. Green
+.\" Copyright (c) 1997-2019 Matthew R. Green
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
@@ -26,7 +26,7 @@
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
-.Dd January 7, 2019
+.Dd February 27, 2019
.Dt BOZOHTTPD 8
.Os
.Sh NAME
@@ -245,11 +245,13 @@
The valid values of
.Ar type
are
+.Dq ssl timeout ,
.Dq initial timeout ,
.Dq header timeout ,
and
.Dq request timeout .
-The default values are 30 seconds, 10 seconds and 600 seconds, respectively.
+The default values are 30 seconds, 30 seconds, 10 seconds and 600 seconds,
+respectively.
.It Fl t Ar chrootdir
Makes
.Nm
diff -r cc418d3bce2e -r b79dfa9b4b34 libexec/httpd/bozohttpd.c
--- a/libexec/httpd/bozohttpd.c Thu Feb 28 05:40:58 2019 +0000
+++ b/libexec/httpd/bozohttpd.c Thu Feb 28 08:28:21 2019 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: bozohttpd.c,v 1.111 2019/01/22 05:32:57 mrg Exp $ */
+/* $NetBSD: bozohttpd.c,v 1.112 2019/02/28 08:28:21 mrg Exp $ */
/* $eterna: bozohttpd.c,v 1.178 2011/11/18 09:21:15 mrg Exp $ */
@@ -137,7 +137,6 @@
#include <netdb.h>
#include <pwd.h>
#include <grp.h>
-#include <signal.h>
#include <stdarg.h>
#include <stdlib.h>
#include <strings.h>
@@ -148,6 +147,9 @@
#include "bozohttpd.h"
+#ifndef SSL_TIMEOUT
+#define SSL_TIMEOUT "30" /* wait for 30 seconds for ssl handshake */
+#endif
#ifndef INITIAL_TIMEOUT
#define INITIAL_TIMEOUT "30" /* wait for 30 seconds initially */
#endif
@@ -183,7 +185,7 @@
{ NULL, NULL },
};
-volatile sig_atomic_t timeout_hit;
+volatile sig_atomic_t bozo_timeout_hit;
/*
* check there's enough space in the prefs and names arrays.
@@ -371,18 +373,19 @@
static void
alarmer(int sig)
{
- timeout_hit = 1;
+ bozo_timeout_hit = 1;
}
/*
- * set a timeout for "initial", "header", or "request".
+ * set a timeout for "ssl", "initial", "header", or "request".
*/
int
bozo_set_timeout(bozohttpd_t *httpd, bozoprefs_t *prefs,
const char *target, const char *val)
{
const char **cur, *timeouts[] = {
+ "ssl timeout",
"initial timeout",
"header timeout",
"request timeout",
@@ -602,14 +605,10 @@
/*
* if we're in daemon mode, bozo_daemon_fork() will return here twice
* for each call. once in the child, returning 0, and once in the
- * parent, returning 1. for each child, then we can setup SSL, and
- * the parent can signal the caller there was no request to process
- * and it will wait for another.
+ * parent, returning 1 for each child.
*/
if (bozo_daemon_fork(httpd))
return NULL;
- if (bozo_ssl_accept(httpd))
- return NULL;
request = bozomalloc(httpd, sizeof(*request));
memset(request, 0, sizeof(*request));
@@ -685,6 +684,14 @@
goto cleanup;
}
+ /*
+ * now to try to setup SSL, and upon failure parent can signal the
+ * caller there was no request to process and it will wait for
+ * another.
+ */
+ if (bozo_ssl_accept(httpd))
+ return NULL;
+
alarm(httpd->initial_timeout);
while ((str = bozodgetln(httpd, STDIN_FILENO, &len, bozo_read)) != NULL) {
alarm(0);
@@ -707,9 +714,9 @@
if (ts.tv_sec > ots.tv_sec &&
ts.tv_sec > httpd->request_timeout &&
ts.tv_sec - httpd->request_timeout > ots.tv_sec)
- timeout_hit = 1;
+ bozo_timeout_hit = 1;
- if (timeout_hit) {
+ if (bozo_timeout_hit) {
bozo_http_error(httpd, 408, NULL, "request timed out");
goto cleanup;
}
@@ -2464,6 +2471,8 @@
rv = 1;
if (!bozo_set_pref(httpd, prefs, "public_html", PUBLIC_HTML))
rv = 1;
+ if (!bozo_set_pref(httpd, prefs, "ssl timeout", SSL_TIMEOUT))
+ rv = 1;
if (!bozo_set_pref(httpd, prefs, "initial timeout", INITIAL_TIMEOUT))
rv = 1;
if (!bozo_set_pref(httpd, prefs, "header timeout", HEADER_WAIT_TIME))
@@ -2564,6 +2573,9 @@
if ((cp = bozo_get_pref(prefs, "public_html")) != NULL) {
httpd->public_html = bozostrdup(httpd, NULL, cp);
}
+ if ((cp = bozo_get_pref(prefs, "ssl timeout")) != NULL) {
+ httpd->ssl_timeout = atoi(cp);
+ }
if ((cp = bozo_get_pref(prefs, "initial timeout")) != NULL) {
httpd->initial_timeout = atoi(cp);
}
diff -r cc418d3bce2e -r b79dfa9b4b34 libexec/httpd/bozohttpd.h
--- a/libexec/httpd/bozohttpd.h Thu Feb 28 05:40:58 2019 +0000
+++ b/libexec/httpd/bozohttpd.h Thu Feb 28 08:28:21 2019 +0000
@@ -1,9 +1,9 @@
-/* $NetBSD: bozohttpd.h,v 1.58 2019/01/22 05:32:57 mrg Exp $ */
+/* $NetBSD: bozohttpd.h,v 1.59 2019/02/28 08:28:21 mrg Exp $ */
/* $eterna: bozohttpd.h,v 1.39 2011/11/18 09:21:15 mrg Exp $ */
/*
- * Copyright (c) 1997-2018 Matthew R. Green
+ * Copyright (c) 1997-2019 Matthew R. Green
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -35,6 +35,7 @@
#include "netbsd_queue.h"
#include <stdbool.h>
+#include <signal.h>
#include <sys/stat.h>
@@ -119,6 +120,7 @@
int hide_dots; /* hide .* */
int process_cgi; /* use the cgi handler */
char *cgibin; /* cgi-bin directory */
+ unsigned ssl_timeout; /* ssl timeout */
unsigned initial_timeout;/* first line timeout */
unsigned header_timeout; /* header lines timeout */
unsigned request_timeout;/* total session timeout */
@@ -434,4 +436,6 @@
int bozo_get_version(char */*buf*/, size_t /*size*/);
+extern volatile sig_atomic_t bozo_timeout_hit;
+
#endif /* BOZOHTTOPD_H_ */
diff -r cc418d3bce2e -r b79dfa9b4b34 libexec/httpd/dir-index-bozo.c
--- a/libexec/httpd/dir-index-bozo.c Thu Feb 28 05:40:58 2019 +0000
+++ b/libexec/httpd/dir-index-bozo.c Thu Feb 28 08:28:21 2019 +0000
@@ -1,9 +1,9 @@
-/* $NetBSD: dir-index-bozo.c,v 1.31 2019/01/22 05:32:57 mrg Exp $ */
+/* $NetBSD: dir-index-bozo.c,v 1.32 2019/02/28 08:28:21 mrg Exp $ */
/* $eterna: dir-index-bozo.c,v 1.20 2011/11/18 09:21:15 mrg Exp $ */
/*
- * Copyright (c) 1997-2018 Matthew R. Green
+ * Copyright (c) 1997-2019 Matthew R. Green
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
diff -r cc418d3bce2e -r b79dfa9b4b34 libexec/httpd/ssl-bozo.c
--- a/libexec/httpd/ssl-bozo.c Thu Feb 28 05:40:58 2019 +0000
+++ b/libexec/httpd/ssl-bozo.c Thu Feb 28 08:28:21 2019 +0000
@@ -1,9 +1,9 @@
-/* $NetBSD: ssl-bozo.c,v 1.25 2018/11/22 08:54:08 mrg Exp $ */
+/* $NetBSD: ssl-bozo.c,v 1.26 2019/02/28 08:28:21 mrg Exp $ */
/* $eterna: ssl-bozo.c,v 1.15 2011/11/18 09:21:15 mrg Exp $ */
/*
- * Copyright (c) 1997-2018 Matthew R. Green
+ * Copyright (c) 1997-2019 Matthew R. Green
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -263,6 +263,8 @@
if (sslinfo == NULL || !sslinfo->ssl_context)
return 0;
+ alarm(httpd->ssl_timeout);
+
sslinfo->bozossl = SSL_new(sslinfo->ssl_context);
if (sslinfo->bozossl == NULL)
bozoerr(httpd, 1, "SSL_new failed");
@@ -273,6 +275,14 @@
const int ret = SSL_accept(sslinfo->bozossl);
bozo_check_error_queue(httpd, "accept", ret);
+ alarm(0);
+
+ if (bozo_timeout_hit) {
+ SSL_free(sslinfo->bozossl);
+ sslinfo->bozossl = NULL;
+ return 1;
+ }
+
return ret != 1;
}
Home |
Main Index |
Thread Index |
Old Index