*) mod_ldap: Add LDAPConnectionPoolTTL to give control over lifetime (2090e65d) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP Apache Httpd

CHANGES

+3 −0

Changes for CHANGES: 3 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -2,6 +2,9 @@

		Changes with Apache 2.3.12

		*) mod_ldap: Add LDAPConnectionPoolTTL to give control over lifetime
		of bound backend LDAP connections. PR47634 [Eric Covener]

		*) mod_cache: Make CacheEnable and CacheDisable configurable per
		directory in addition to per server, making them work from within
		a LocationMatch. [Graham Leggett]

modules/ldap/util_ldap.c

+46 −6

Changes for modules/ldap/util_ldap.c: 46 added lines, 6 removed lines.
Original line number	Diff line number	Diff line
		@@ -63,6 +63,9 @@
		#define AP_LDAP_CHASEREFERRALS_OFF 0
		#define AP_LDAP_CHASEREFERRALS_ON 1

		#define AP_LDAP_CONNPOOL_DEFAULT -1
		#define AP_LDAP_CONNPOOL_INFINITE -2

		module AP_MODULE_DECLARE_DATA ldap_module;
		static const char *ldap_cache_mutex_type = "ldap-cache";
		static apr_status_t uldap_connection_unbind(void *param);
		@@ -152,6 +155,7 @@ static void uldap_connection_close(util_ldap_connection_t *ldc)
		}
		else {
		/* mark our connection as available for reuse */
		ldc->freed = apr_time_now();
		#if APR_HAS_THREADS
		apr_thread_mutex_unlock(ldc->lock);
		#endif
		@@ -632,6 +636,7 @@ static util_ldap_connection_t *
		{
		struct util_ldap_connection_t l, p; /* To traverse the linked list */
		int secureflag = secure;
		apr_time_t now = apr_time_now();

		util_ldap_state_t *st =
		(util_ldap_state_t *)ap_get_module_config(r->server->module_config,
		@@ -663,8 +668,20 @@ static util_ldap_connection_t *
		&& (l->deref == deref) && (l->secure == secureflag)
		&& !compare_client_certs(dc->client_certs, l->client_certs))
		{
		if (st->connectionPoolTTL > 0) {
		if (l->bound && (now - l->freed) > st->connectionPoolTTL) {
		ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r,
		"Removing LDAP connection last used %" APR_TIME_T_FMT " seconds ago",
		(now - l->freed) / APR_USEC_PER_SEC);
		uldap_connection_unbind(l);
		/* Go ahead and use it, so we don't create more just to unbind some other old ones */
		break;
		}
		}
		else {
		break;
		}
		}
		#if APR_HAS_THREADS
		/* If this connection didn't match the criteria, then we
		* need to unlock the mutex so it is available to be reused.
		@@ -689,13 +706,9 @@ static util_ldap_connection_t *
		!compare_client_certs(dc->client_certs, l->client_certs))
		{
		/* the bind credentials have changed */
		/* no check for connectionPoolTTL, since we are unbinding any way */
		uldap_connection_unbind(l);

		/* forget the rebind info for this conn */
		if (l->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {
		apr_ldap_rebind_remove(l->ldap);
		}

		util_ldap_strdup((char**)&(l->binddn), binddn);
		util_ldap_strdup((char**)&(l->bindpw), bindpw);
		break;
		@@ -762,7 +775,8 @@ static util_ldap_connection_t *
		/* save away a copy of the client cert list that is presently valid */
		l->client_certs = apr_array_copy_hdr(l->pool, dc->client_certs);

		l->keep = 1;
		/* whether or not to keep this connection in the pool when it's returned */
		l->keep = (st->connectionPoolTTL == 0) ? 0 : 1;

		if (l->ChaseReferrals == AP_LDAP_CHASEREFERRALS_ON) {
		if (apr_pool_create(&(l->rebind_pool), l->pool) != APR_SUCCESS) {
		@@ -2559,6 +2573,23 @@ static const char util_ldap_set_op_timeout(cmd_parms cmd,
		return NULL;
		}

		static const char util_ldap_set_conn_ttl(cmd_parms cmd,
		void *dummy,
		const char *val)
		{
		apr_interval_time_t timeout;
		util_ldap_state_t *st =
		(util_ldap_state_t *)ap_get_module_config(cmd->server->module_config,
		&ldap_module);

		if (ap_timeout_parameter_parse(val, &timeout, "s") != APR_SUCCESS) {
		return "LDAPConnPoolTTL has wrong format";
		}

		st->connectionPoolTTL = timeout;
		return NULL;
		}



		static void util_ldap_create_config(apr_pool_t p, server_rec *s)
		@@ -2589,6 +2620,7 @@ static void util_ldap_create_config(apr_pool_t p, server_rec *s)
		st->opTimeout = apr_pcalloc(p, sizeof(struct timeval));
		st->opTimeout->tv_sec = 60;
		st->verify_svr_cert = 1;
		st->connectionPoolTTL = AP_LDAP_CONNPOOL_DEFAULT; /* no limit */

		return st;
		}
		@@ -2640,6 +2672,9 @@ static void util_ldap_merge_config(apr_pool_t p, void *basev,
		st->verify_svr_cert = base->verify_svr_cert;
		st->debug_level = base->debug_level;

		st->connectionPoolTTL = (overrides->connectionPoolTTL == AP_LDAP_CONNPOOL_DEFAULT) ?
		base->connectionPoolTTL : overrides->connectionPoolTTL;

		return st;
		}

		@@ -2914,6 +2949,11 @@ static const command_rec util_ldap_cmds[] = {
		NULL, RSRC_CONF,
		"Specify the LDAP bind/search timeout in seconds "
		"(0 = no limit). Default: 60"),
		AP_INIT_TAKE1("LDAPConnectionPoolTTL", util_ldap_set_conn_ttl,
		NULL, RSRC_CONF,
		"Specify the maximum amount of time a bound connection can sit "
		"idle and still be considered valid for reuse"
		"(0 = no pool, -1 = no limit, n = time in seconds). Default: -1"),

		{NULL}
		};