Commit 31c42f0b authored by Eric Covener's avatar Eric Covener
Browse files

Merge r726109, r733465, r733467, r733695 from trunk: 

mod_ssl: Make the size of the per-dir-reneg request-body buffer
configurable, by popular demand:

* modules/ssl/ssl_private.h: Define DEFAULT_RENEG_BUFFER_SIZE.
  (SSLDirConfigRec): Add nRenegBufferSize field.

* modules/ssl/ssl_engine_config.c (ssl_cmd_SSLRenegBufferSize): New
  function.
  (ssl_config_perdir_create, ssl_config_perdir_merge): Handle
  nRenegBufferSize.

* modules/ssl/ssl_engine_io.c (ssl_io_buffer_fill): Take max buffer
  size as an argument rather than compile-time constant.

* modules/ssl/ssl_engine_kernel.c (ssl_hook_Access): Pass
  nRenegBufferSize to ssl_io_buffer_fill.

* modules/ssl/mod_ssl.c (ssl_config_cmds): Add SSLRenegBufferSize.

PR: 39243


* Correctly merge SSLRenegBufferSize directive.

PR: 46508
Submitted by: <tlhackque yahoo.com>
Reviewed by: rpluem, jorton, pgollucci

* Add a stub documentation for SSLRenegBufferSize.


* docs/manual/mod/mod_ssl.xml: Flesh out SSLRenegBufferSize
 docs a little - thanks rpluem!



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@739605 13f79535-47bb-0310-9956-ffa450edef68
parent 73387a61

CHANGES

+4 −0
Original line number Diff line number Diff line 
                                                         -*- coding: utf-8 -*-

Changes with Apache 2.2.12

  

  *) mod_ssl: Add SSLRenegBufferSize directive to allow changing the

     size of the buffer used for the request-body where necessary

     during a per-dir renegotiation.  PR 39243.  [Joe Orton]



 *) mod_rewrite: Introduce DiscardPathInfo|DPI flag to stop the troublesome

    way that per-directory rewrites append the previous notion of PATH_INFO

    to each substitution before evaluating subsequent rules.

STATUS

+0 −13
Original line number Diff line number Diff line
@@ -86,19 +86,6 @@ RELEASE SHOWSTOPPERS: 
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ start all new proposals below, under PATCHES PROPOSED. ]



 * mod_ssl: Add SSLRenegBufferSize to configure the amount of memory that will

   be used for buffering the request body if a per-location SSL renegotiationi

   is required due to changed access control requirements.

   PR 39243, 46508

   Trunk version of patch:

      http://svn.apache.org/viewvc?rev=726109&view=rev

      http://svn.apache.org/viewvc?rev=733465&view=rev

      http://svn.apache.org/viewvc?rev=733467&view=rev

      http://svn.apache.org/viewvc?rev=733695&view=rev

   Backport version for 2.2.x of patch:

      Trunk version of patch works

   +1: rpluem, jorton, pgollucci



 * prefork: release mutex when exiting in single-process mode,

   add timeout to pollset-poll to avoid hanging during graceful

   stop/restart with multiple listening sockets

docs/manual/mod/mod_ssl.html.en

+31 −0
Original line number Diff line number Diff line
@@ -71,6 +71,7 @@ to provide the cryptography engine.</p> 
<li><img alt="" src="../images/down.gif" /> <a href="#sslproxyverify">SSLProxyVerify</a></li>

<li><img alt="" src="../images/down.gif" /> <a href="#sslproxyverifydepth">SSLProxyVerifyDepth</a></li>

<li><img alt="" src="../images/down.gif" /> <a href="#sslrandomseed">SSLRandomSeed</a></li>

<li><img alt="" src="../images/down.gif" /> <a href="#sslrenegbuffersize">SSLRenegBufferSize</a></li>

<li><img alt="" src="../images/down.gif" /> <a href="#sslrequire">SSLRequire</a></li>

<li><img alt="" src="../images/down.gif" /> <a href="#sslrequiressl">SSLRequireSSL</a></li>

<li><img alt="" src="../images/down.gif" /> <a href="#sslsessioncache">SSLSessionCache</a></li>
@@ -1353,6 +1354,36 @@ SSLRandomSeed connect file:/dev/random<br /> 
SSLRandomSeed connect file:/dev/urandom 1024<br />

</code></p></div>



</div>

<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

<div class="directive-section"><h2><a name="SSLRenegBufferSize" id="SSLRenegBufferSize">SSLRenegBufferSize</a> <a name="sslrenegbuffersize" id="sslrenegbuffersize">Directive</a></h2>

<table class="directive">

<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Set the size for the SSL renegotiation buffer</td></tr>

<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>SSLRenegBufferSize <var>bytes</var></code></td></tr>

<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>SSLRenegBufferSize 131072</code></td></tr>

<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>

<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>

<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>

<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_ssl</td></tr>

</table>



<p>If an SSL renegotiation is required in per-location context, for

example, any use of <code class="directive"><a href="#sslverifyclient">SSLVerifyClient</a></code> in a Directory or

Location block, then <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> must buffer any HTTP

request body into memory until the new SSL handshake can be performed.

This directive can be used to set the amount of memory that will be

used for this buffer. </p>



<div class="warning"><p>

Note that in many configurations, the client sending the request body

will be untrusted so a denial of service attack by consumption of

memory must be considered when changing this configuration setting.

</p></div>



<div class="example"><h3>Example</h3><p><code>

SSLRenegBufferSize 262144

</code></p></div>



</div>

<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

<div class="directive-section"><h2><a name="SSLRequire" id="SSLRequire">SSLRequire</a> <a name="sslrequire" id="sslrequire">Directive</a></h2>

docs/manual/mod/mod_ssl.xml

+31 −0
Original line number Diff line number Diff line
@@ -1323,6 +1323,37 @@ SSL_VERSION_INTERFACE SSL_CLIENT_S_DN_OU SSL_SERVER_S_DN_OU 
</usage>

</directivesynopsis>



<directivesynopsis>

<name>SSLRenegBufferSize</name>

<description>Set the size for the SSL renegotiation buffer</description>

<syntax>SSLRenegBufferSize <var>bytes</var></syntax>

<default>SSLRenegBufferSize 131072</default>

<contextlist><context>directory</context>

<context>.htaccess</context></contextlist>

<override>AuthConfig</override>



<usage>



<p>If an SSL renegotiation is required in per-location context, for

example, any use of <directive

module="mod_ssl">SSLVerifyClient</directive> in a Directory or

Location block, then <module>mod_ssl</module> must buffer any HTTP

request body into memory until the new SSL handshake can be performed.

This directive can be used to set the amount of memory that will be

used for this buffer. </p>



<note type="warning"><p>

Note that in many configurations, the client sending the request body

will be untrusted so a denial of service attack by consumption of

memory must be considered when changing this configuration setting.

</p></note>



<example><title>Example</title>

SSLRenegBufferSize 262144

</example>

</usage>

</directivesynopsis>



<directivesynopsis>

<name>SSLProxyMachineCertificatePath</name>

<description>Directory of PEM-encoded client certificates and keys to be used by the proxy</description>

modules/ssl/mod_ssl.c

+4 −0
Original line number Diff line number Diff line
@@ -195,6 +195,10 @@ static const command_rec ssl_config_cmds[] = { 
    SSL_CMD_DIR(Require, AUTHCFG, RAW_ARGS,

               "Require a boolean expression to evaluate to true for granting access"

               "(arbitrary complex boolean expression - see manual)")

    SSL_CMD_DIR(RenegBufferSize, AUTHCFG, TAKE1,

                "Configure the amount of memory that will be used for buffering the "

                "request body if a per-location SSL renegotiation is required due to "

                "changed access control requirements")



    /* Deprecated directives. */

    AP_INIT_RAW_ARGS("SSLLog", ap_set_deprecated, NULL, OR_ALL,