diff options
| author | mrg <mrg@NetBSD.org> | 2019-02-28 08:28:21 +0000 |
|---|---|---|
| committer | mrg <mrg@NetBSD.org> | 2019-02-28 08:28:21 +0000 |
| commit | 81d1eb120d2e02a5eab855a427292ca19c022286 (patch) | |
| tree | 31f3c41d4dca3cd8d2cc1d4b4d842cbd8a7e1e65 /libexec | |
| parent | bb7b0503545bf63566dcbac7415fc6549adc935f (diff) | |
add ssl specific timeout value (30s). if SSL_accept() doesn't
work with in this timeout value, ssl setup now fails.
mostly different from, but inspired from the patch in PR 50655
Diffstat (limited to 'libexec')
| -rw-r--r-- | libexec/httpd/auth-bozo.c | 4 | ||||
| -rw-r--r-- | libexec/httpd/bozohttpd.8 | 10 | ||||
| -rw-r--r-- | libexec/httpd/bozohttpd.c | 36 | ||||
| -rw-r--r-- | libexec/httpd/bozohttpd.h | 8 | ||||
| -rw-r--r-- | libexec/httpd/dir-index-bozo.c | 4 | ||||
| -rw-r--r-- | libexec/httpd/ssl-bozo.c | 14 |
6 files changed, 52 insertions, 24 deletions
diff --git a/libexec/httpd/auth-bozo.c b/libexec/httpd/auth-bozo.c index ee83281c332..994e88c9199 100644 --- a/libexec/httpd/auth-bozo.c +++ b/libexec/httpd/auth-bozo.c @@ -1,9 +1,9 @@ -/* $NetBSD: auth-bozo.c,v 1.23 2019/01/22 05:32:57 mrg Exp $ */ +/* $NetBSD: auth-bozo.c,v 1.24 2019/02/28 08:28:21 mrg Exp $ */ /* $eterna: auth-bozo.c,v 1.17 2011/11/18 09:21:15 mrg Exp $ */ /* - * Copyright (c) 1997-2018 Matthew R. Green + * Copyright (c) 1997-2019 Matthew R. Green * All rights reserved. * * Redistribution and use in source and binary forms, with or without diff --git a/libexec/httpd/bozohttpd.8 b/libexec/httpd/bozohttpd.8 index 167f6a26bd8..a23791e4875 100644 --- a/libexec/httpd/bozohttpd.8 +++ b/libexec/httpd/bozohttpd.8 @@ -1,8 +1,8 @@ -.\" $NetBSD: bozohttpd.8,v 1.78 2019/01/17 07:46:16 mrg Exp $ +.\" $NetBSD: bozohttpd.8,v 1.79 2019/02/28 08:28:21 mrg Exp $ .\" .\" $eterna: bozohttpd.8,v 1.101 2011/11/18 01:25:11 mrg Exp $ .\" -.\" Copyright (c) 1997-2018 Matthew R. Green +.\" Copyright (c) 1997-2019 Matthew R. Green .\" All rights reserved. .\" .\" Redistribution and use in source and binary forms, with or without @@ -26,7 +26,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd January 7, 2019 +.Dd February 27, 2019 .Dt BOZOHTTPD 8 .Os .Sh NAME @@ -245,11 +245,13 @@ to The valid values of .Ar type are +.Dq ssl timeout , .Dq initial timeout , .Dq header timeout , and .Dq request timeout . -The default values are 30 seconds, 10 seconds and 600 seconds, respectively. +The default values are 30 seconds, 30 seconds, 10 seconds and 600 seconds, +respectively. .It Fl t Ar chrootdir Makes .Nm diff --git a/libexec/httpd/bozohttpd.c b/libexec/httpd/bozohttpd.c index 6a07302fbf2..60608b587fb 100644 --- a/libexec/httpd/bozohttpd.c +++ b/libexec/httpd/bozohttpd.c @@ -1,4 +1,4 @@ -/* $NetBSD: bozohttpd.c,v 1.111 2019/01/22 05:32:57 mrg Exp $ */ +/* $NetBSD: bozohttpd.c,v 1.112 2019/02/28 08:28:21 mrg Exp $ */ /* $eterna: bozohttpd.c,v 1.178 2011/11/18 09:21:15 mrg Exp $ */ @@ -137,7 +137,6 @@ #include <netdb.h> #include <pwd.h> #include <grp.h> -#include <signal.h> #include <stdarg.h> #include <stdlib.h> #include <strings.h> @@ -148,6 +147,9 @@ #include "bozohttpd.h" +#ifndef SSL_TIMEOUT +#define SSL_TIMEOUT "30" /* wait for 30 seconds for ssl handshake */ +#endif #ifndef INITIAL_TIMEOUT #define INITIAL_TIMEOUT "30" /* wait for 30 seconds initially */ #endif @@ -183,7 +185,7 @@ struct { { NULL, NULL }, }; -volatile sig_atomic_t timeout_hit; +volatile sig_atomic_t bozo_timeout_hit; /* * check there's enough space in the prefs and names arrays. @@ -371,18 +373,19 @@ bozo_clean_request(bozo_httpreq_t *request) static void alarmer(int sig) { - timeout_hit = 1; + bozo_timeout_hit = 1; } /* - * set a timeout for "initial", "header", or "request". + * set a timeout for "ssl", "initial", "header", or "request". */ int bozo_set_timeout(bozohttpd_t *httpd, bozoprefs_t *prefs, const char *target, const char *val) { const char **cur, *timeouts[] = { + "ssl timeout", "initial timeout", "header timeout", "request timeout", @@ -602,14 +605,10 @@ bozo_read_request(bozohttpd_t *httpd) /* * if we're in daemon mode, bozo_daemon_fork() will return here twice * for each call. once in the child, returning 0, and once in the - * parent, returning 1. for each child, then we can setup SSL, and - * the parent can signal the caller there was no request to process - * and it will wait for another. + * parent, returning 1 for each child. */ if (bozo_daemon_fork(httpd)) return NULL; - if (bozo_ssl_accept(httpd)) - return NULL; request = bozomalloc(httpd, sizeof(*request)); memset(request, 0, sizeof(*request)); @@ -685,6 +684,14 @@ bozo_read_request(bozohttpd_t *httpd) goto cleanup; } + /* + * now to try to setup SSL, and upon failure parent can signal the + * caller there was no request to process and it will wait for + * another. + */ + if (bozo_ssl_accept(httpd)) + return NULL; + alarm(httpd->initial_timeout); while ((str = bozodgetln(httpd, STDIN_FILENO, &len, bozo_read)) != NULL) { alarm(0); @@ -707,9 +714,9 @@ bozo_read_request(bozohttpd_t *httpd) if (ts.tv_sec > ots.tv_sec && ts.tv_sec > httpd->request_timeout && ts.tv_sec - httpd->request_timeout > ots.tv_sec) - timeout_hit = 1; + bozo_timeout_hit = 1; - if (timeout_hit) { + if (bozo_timeout_hit) { bozo_http_error(httpd, 408, NULL, "request timed out"); goto cleanup; } @@ -2464,6 +2471,8 @@ bozo_init_prefs(bozohttpd_t *httpd, bozoprefs_t *prefs) rv = 1; if (!bozo_set_pref(httpd, prefs, "public_html", PUBLIC_HTML)) rv = 1; + if (!bozo_set_pref(httpd, prefs, "ssl timeout", SSL_TIMEOUT)) + rv = 1; if (!bozo_set_pref(httpd, prefs, "initial timeout", INITIAL_TIMEOUT)) rv = 1; if (!bozo_set_pref(httpd, prefs, "header timeout", HEADER_WAIT_TIME)) @@ -2564,6 +2573,9 @@ bozo_setup(bozohttpd_t *httpd, bozoprefs_t *prefs, const char *vhost, if ((cp = bozo_get_pref(prefs, "public_html")) != NULL) { httpd->public_html = bozostrdup(httpd, NULL, cp); } + if ((cp = bozo_get_pref(prefs, "ssl timeout")) != NULL) { + httpd->ssl_timeout = atoi(cp); + } if ((cp = bozo_get_pref(prefs, "initial timeout")) != NULL) { httpd->initial_timeout = atoi(cp); } diff --git a/libexec/httpd/bozohttpd.h b/libexec/httpd/bozohttpd.h index 2045f9398f3..1be031510b1 100644 --- a/libexec/httpd/bozohttpd.h +++ b/libexec/httpd/bozohttpd.h @@ -1,9 +1,9 @@ -/* $NetBSD: bozohttpd.h,v 1.58 2019/01/22 05:32:57 mrg Exp $ */ +/* $NetBSD: bozohttpd.h,v 1.59 2019/02/28 08:28:21 mrg Exp $ */ /* $eterna: bozohttpd.h,v 1.39 2011/11/18 09:21:15 mrg Exp $ */ /* - * Copyright (c) 1997-2018 Matthew R. Green + * Copyright (c) 1997-2019 Matthew R. Green * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -35,6 +35,7 @@ #include "netbsd_queue.h" #include <stdbool.h> +#include <signal.h> #include <sys/stat.h> @@ -119,6 +120,7 @@ typedef struct bozohttpd_t { int hide_dots; /* hide .* */ int process_cgi; /* use the cgi handler */ char *cgibin; /* cgi-bin directory */ + unsigned ssl_timeout; /* ssl timeout */ unsigned initial_timeout;/* first line timeout */ unsigned header_timeout; /* header lines timeout */ unsigned request_timeout;/* total session timeout */ @@ -434,4 +436,6 @@ char *bozo_get_pref(bozoprefs_t *, const char *); int bozo_get_version(char */*buf*/, size_t /*size*/); +extern volatile sig_atomic_t bozo_timeout_hit; + #endif /* BOZOHTTOPD_H_ */ diff --git a/libexec/httpd/dir-index-bozo.c b/libexec/httpd/dir-index-bozo.c index 07ba72143dc..1a56c5fc73d 100644 --- a/libexec/httpd/dir-index-bozo.c +++ b/libexec/httpd/dir-index-bozo.c @@ -1,9 +1,9 @@ -/* $NetBSD: dir-index-bozo.c,v 1.31 2019/01/22 05:32:57 mrg Exp $ */ +/* $NetBSD: dir-index-bozo.c,v 1.32 2019/02/28 08:28:21 mrg Exp $ */ /* $eterna: dir-index-bozo.c,v 1.20 2011/11/18 09:21:15 mrg Exp $ */ /* - * Copyright (c) 1997-2018 Matthew R. Green + * Copyright (c) 1997-2019 Matthew R. Green * All rights reserved. * * Redistribution and use in source and binary forms, with or without diff --git a/libexec/httpd/ssl-bozo.c b/libexec/httpd/ssl-bozo.c index c93bf241b9f..b621ac700c4 100644 --- a/libexec/httpd/ssl-bozo.c +++ b/libexec/httpd/ssl-bozo.c @@ -1,9 +1,9 @@ -/* $NetBSD: ssl-bozo.c,v 1.25 2018/11/22 08:54:08 mrg Exp $ */ +/* $NetBSD: ssl-bozo.c,v 1.26 2019/02/28 08:28:21 mrg Exp $ */ /* $eterna: ssl-bozo.c,v 1.15 2011/11/18 09:21:15 mrg Exp $ */ /* - * Copyright (c) 1997-2018 Matthew R. Green + * Copyright (c) 1997-2019 Matthew R. Green * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -263,6 +263,8 @@ bozo_ssl_accept(bozohttpd_t *httpd) if (sslinfo == NULL || !sslinfo->ssl_context) return 0; + alarm(httpd->ssl_timeout); + sslinfo->bozossl = SSL_new(sslinfo->ssl_context); if (sslinfo->bozossl == NULL) bozoerr(httpd, 1, "SSL_new failed"); @@ -273,6 +275,14 @@ bozo_ssl_accept(bozohttpd_t *httpd) const int ret = SSL_accept(sslinfo->bozossl); bozo_check_error_queue(httpd, "accept", ret); + alarm(0); + + if (bozo_timeout_hit) { + SSL_free(sslinfo->bozossl); + sslinfo->bozossl = NULL; + return 1; + } + return ret != 1; } |
