Module Name: src
Committed By: mrg
Date: Thu Feb 28 08:28:22 UTC 2019
Modified Files:
src/libexec/httpd: auth-bozo.c bozohttpd.8 bozohttpd.c bozohttpd.h
dir-index-bozo.c ssl-bozo.c
Log Message:
add ssl specific timeout value (30s). if SSL_accept() doesn't
work with in this timeout value, ssl setup now fails.
mostly different from, but inspired from the patch in PR 50655
To generate a diff of this commit:
cvs rdiff -u -r1.23 -r1.24 src/libexec/httpd/auth-bozo.c
cvs rdiff -u -r1.78 -r1.79 src/libexec/httpd/bozohttpd.8
cvs rdiff -u -r1.111 -r1.112 src/libexec/httpd/bozohttpd.c
cvs rdiff -u -r1.58 -r1.59 src/libexec/httpd/bozohttpd.h
cvs rdiff -u -r1.31 -r1.32 src/libexec/httpd/dir-index-bozo.c
cvs rdiff -u -r1.25 -r1.26 src/libexec/httpd/ssl-bozo.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/libexec/httpd/auth-bozo.c
diff -u src/libexec/httpd/auth-bozo.c:1.23 src/libexec/httpd/auth-bozo.c:1.24
--- src/libexec/httpd/auth-bozo.c:1.23 Tue Jan 22 05:32:57 2019
+++ src/libexec/httpd/auth-bozo.c Thu Feb 28 08:28:21 2019
@@ -1,9 +1,9 @@
-/* $NetBSD: auth-bozo.c,v 1.23 2019/01/22 05:32:57 mrg Exp $ */
+/* $NetBSD: auth-bozo.c,v 1.24 2019/02/28 08:28:21 mrg Exp $ */
/* $eterna: auth-bozo.c,v 1.17 2011/11/18 09:21:15 mrg Exp $ */
/*
- * Copyright (c) 1997-2018 Matthew R. Green
+ * Copyright (c) 1997-2019 Matthew R. Green
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
Index: src/libexec/httpd/bozohttpd.8
diff -u src/libexec/httpd/bozohttpd.8:1.78 src/libexec/httpd/bozohttpd.8:1.79
--- src/libexec/httpd/bozohttpd.8:1.78 Thu Jan 17 07:46:16 2019
+++ src/libexec/httpd/bozohttpd.8 Thu Feb 28 08:28:21 2019
@@ -1,8 +1,8 @@
-.\" $NetBSD: bozohttpd.8,v 1.78 2019/01/17 07:46:16 mrg Exp $
+.\" $NetBSD: bozohttpd.8,v 1.79 2019/02/28 08:28:21 mrg Exp $
.\"
.\" $eterna: bozohttpd.8,v 1.101 2011/11/18 01:25:11 mrg Exp $
.\"
-.\" Copyright (c) 1997-2018 Matthew R. Green
+.\" Copyright (c) 1997-2019 Matthew R. Green
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
@@ -26,7 +26,7 @@
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
-.Dd January 7, 2019
+.Dd February 27, 2019
.Dt BOZOHTTPD 8
.Os
.Sh NAME
@@ -245,11 +245,13 @@ to
The valid values of
.Ar type
are
+.Dq ssl timeout ,
.Dq initial timeout ,
.Dq header timeout ,
and
.Dq request timeout .
-The default values are 30 seconds, 10 seconds and 600 seconds, respectively.
+The default values are 30 seconds, 30 seconds, 10 seconds and 600 seconds,
+respectively.
.It Fl t Ar chrootdir
Makes
.Nm
Index: src/libexec/httpd/bozohttpd.c
diff -u src/libexec/httpd/bozohttpd.c:1.111 src/libexec/httpd/bozohttpd.c:1.112
--- src/libexec/httpd/bozohttpd.c:1.111 Tue Jan 22 05:32:57 2019
+++ src/libexec/httpd/bozohttpd.c Thu Feb 28 08:28:21 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: bozohttpd.c,v 1.111 2019/01/22 05:32:57 mrg Exp $ */
+/* $NetBSD: bozohttpd.c,v 1.112 2019/02/28 08:28:21 mrg Exp $ */
/* $eterna: bozohttpd.c,v 1.178 2011/11/18 09:21:15 mrg Exp $ */
@@ -137,7 +137,6 @@
#include <netdb.h>
#include <pwd.h>
#include <grp.h>
-#include <signal.h>
#include <stdarg.h>
#include <stdlib.h>
#include <strings.h>
@@ -148,6 +147,9 @@
#include "bozohttpd.h"
+#ifndef SSL_TIMEOUT
+#define SSL_TIMEOUT "30" /* wait for 30 seconds for ssl handshake */
+#endif
#ifndef INITIAL_TIMEOUT
#define INITIAL_TIMEOUT "30" /* wait for 30 seconds initially */
#endif
@@ -183,7 +185,7 @@ struct {
{ NULL, NULL },
};
-volatile sig_atomic_t timeout_hit;
+volatile sig_atomic_t bozo_timeout_hit;
/*
* check there's enough space in the prefs and names arrays.
@@ -371,18 +373,19 @@ bozo_clean_request(bozo_httpreq_t *reque
static void
alarmer(int sig)
{
- timeout_hit = 1;
+ bozo_timeout_hit = 1;
}
/*
- * set a timeout for "initial", "header", or "request".
+ * set a timeout for "ssl", "initial", "header", or "request".
*/
int
bozo_set_timeout(bozohttpd_t *httpd, bozoprefs_t *prefs,
const char *target, const char *val)
{
const char **cur, *timeouts[] = {
+ "ssl timeout",
"initial timeout",
"header timeout",
"request timeout",
@@ -602,14 +605,10 @@ bozo_read_request(bozohttpd_t *httpd)
/*
* if we're in daemon mode, bozo_daemon_fork() will return here twice
* for each call. once in the child, returning 0, and once in the
- * parent, returning 1. for each child, then we can setup SSL, and
- * the parent can signal the caller there was no request to process
- * and it will wait for another.
+ * parent, returning 1 for each child.
*/
if (bozo_daemon_fork(httpd))
return NULL;
- if (bozo_ssl_accept(httpd))
- return NULL;
request = bozomalloc(httpd, sizeof(*request));
memset(request, 0, sizeof(*request));
@@ -685,6 +684,14 @@ bozo_read_request(bozohttpd_t *httpd)
goto cleanup;
}
+ /*
+ * now to try to setup SSL, and upon failure parent can signal the
+ * caller there was no request to process and it will wait for
+ * another.
+ */
+ if (bozo_ssl_accept(httpd))
+ return NULL;
+
alarm(httpd->initial_timeout);
while ((str = bozodgetln(httpd, STDIN_FILENO, &len, bozo_read)) != NULL) {
alarm(0);
@@ -707,9 +714,9 @@ bozo_read_request(bozohttpd_t *httpd)
if (ts.tv_sec > ots.tv_sec &&
ts.tv_sec > httpd->request_timeout &&
ts.tv_sec - httpd->request_timeout > ots.tv_sec)
- timeout_hit = 1;
+ bozo_timeout_hit = 1;
- if (timeout_hit) {
+ if (bozo_timeout_hit) {
bozo_http_error(httpd, 408, NULL, "request timed out");
goto cleanup;
}
@@ -2464,6 +2471,8 @@ bozo_init_prefs(bozohttpd_t *httpd, bozo
rv = 1;
if (!bozo_set_pref(httpd, prefs, "public_html", PUBLIC_HTML))
rv = 1;
+ if (!bozo_set_pref(httpd, prefs, "ssl timeout", SSL_TIMEOUT))
+ rv = 1;
if (!bozo_set_pref(httpd, prefs, "initial timeout", INITIAL_TIMEOUT))
rv = 1;
if (!bozo_set_pref(httpd, prefs, "header timeout", HEADER_WAIT_TIME))
@@ -2564,6 +2573,9 @@ bozo_setup(bozohttpd_t *httpd, bozoprefs
if ((cp = bozo_get_pref(prefs, "public_html")) != NULL) {
httpd->public_html = bozostrdup(httpd, NULL, cp);
}
+ if ((cp = bozo_get_pref(prefs, "ssl timeout")) != NULL) {
+ httpd->ssl_timeout = atoi(cp);
+ }
if ((cp = bozo_get_pref(prefs, "initial timeout")) != NULL) {
httpd->initial_timeout = atoi(cp);
}
Index: src/libexec/httpd/bozohttpd.h
diff -u src/libexec/httpd/bozohttpd.h:1.58 src/libexec/httpd/bozohttpd.h:1.59
--- src/libexec/httpd/bozohttpd.h:1.58 Tue Jan 22 05:32:57 2019
+++ src/libexec/httpd/bozohttpd.h Thu Feb 28 08:28:21 2019
@@ -1,9 +1,9 @@
-/* $NetBSD: bozohttpd.h,v 1.58 2019/01/22 05:32:57 mrg Exp $ */
+/* $NetBSD: bozohttpd.h,v 1.59 2019/02/28 08:28:21 mrg Exp $ */
/* $eterna: bozohttpd.h,v 1.39 2011/11/18 09:21:15 mrg Exp $ */
/*
- * Copyright (c) 1997-2018 Matthew R. Green
+ * Copyright (c) 1997-2019 Matthew R. Green
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -35,6 +35,7 @@
#include "netbsd_queue.h"
#include <stdbool.h>
+#include <signal.h>
#include <sys/stat.h>
@@ -119,6 +120,7 @@ typedef struct bozohttpd_t {
int hide_dots; /* hide .* */
int process_cgi; /* use the cgi handler */
char *cgibin; /* cgi-bin directory */
+ unsigned ssl_timeout; /* ssl timeout */
unsigned initial_timeout;/* first line timeout */
unsigned header_timeout; /* header lines timeout */
unsigned request_timeout;/* total session timeout */
@@ -434,4 +436,6 @@ char *bozo_get_pref(bozoprefs_t *, const
int bozo_get_version(char */*buf*/, size_t /*size*/);
+extern volatile sig_atomic_t bozo_timeout_hit;
+
#endif /* BOZOHTTOPD_H_ */
Index: src/libexec/httpd/dir-index-bozo.c
diff -u src/libexec/httpd/dir-index-bozo.c:1.31 src/libexec/httpd/dir-index-bozo.c:1.32
--- src/libexec/httpd/dir-index-bozo.c:1.31 Tue Jan 22 05:32:57 2019
+++ src/libexec/httpd/dir-index-bozo.c Thu Feb 28 08:28:21 2019
@@ -1,9 +1,9 @@
-/* $NetBSD: dir-index-bozo.c,v 1.31 2019/01/22 05:32:57 mrg Exp $ */
+/* $NetBSD: dir-index-bozo.c,v 1.32 2019/02/28 08:28:21 mrg Exp $ */
/* $eterna: dir-index-bozo.c,v 1.20 2011/11/18 09:21:15 mrg Exp $ */
/*
- * Copyright (c) 1997-2018 Matthew R. Green
+ * Copyright (c) 1997-2019 Matthew R. Green
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
Index: src/libexec/httpd/ssl-bozo.c
diff -u src/libexec/httpd/ssl-bozo.c:1.25 src/libexec/httpd/ssl-bozo.c:1.26
--- src/libexec/httpd/ssl-bozo.c:1.25 Thu Nov 22 08:54:08 2018
+++ src/libexec/httpd/ssl-bozo.c Thu Feb 28 08:28:21 2019
@@ -1,9 +1,9 @@
-/* $NetBSD: ssl-bozo.c,v 1.25 2018/11/22 08:54:08 mrg Exp $ */
+/* $NetBSD: ssl-bozo.c,v 1.26 2019/02/28 08:28:21 mrg Exp $ */
/* $eterna: ssl-bozo.c,v 1.15 2011/11/18 09:21:15 mrg Exp $ */
/*
- * Copyright (c) 1997-2018 Matthew R. Green
+ * Copyright (c) 1997-2019 Matthew R. Green
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -263,6 +263,8 @@ bozo_ssl_accept(bozohttpd_t *httpd)
if (sslinfo == NULL || !sslinfo->ssl_context)
return 0;
+ alarm(httpd->ssl_timeout);
+
sslinfo->bozossl = SSL_new(sslinfo->ssl_context);
if (sslinfo->bozossl == NULL)
bozoerr(httpd, 1, "SSL_new failed");
@@ -273,6 +275,14 @@ bozo_ssl_accept(bozohttpd_t *httpd)
const int ret = SSL_accept(sslinfo->bozossl);
bozo_check_error_queue(httpd, "accept", ret);
+ alarm(0);
+
+ if (bozo_timeout_hit) {
+ SSL_free(sslinfo->bozossl);
+ sslinfo->bozossl = NULL;
+ return 1;
+ }
+
return ret != 1;
}
