www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2026-01-06 09:01:14 +03:00
Code Activity

* server/mpm_unix.c (dummy_connection): Use a TLS 1.0 close_notify

Browse Source 
alert if the chosen listener is configured for https; not perfect
  but better than sending an HTTP request.  Adjust comments.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1327036 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Joe Orton
2012-04-17 10:45:53 +00:00
parent dc6d7847de
commit 172439f1fd
1 changed files with 34 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
server/mpm_unix.c
View File

@@ -501,14 +501,14 @@ static apr_status_t pod_signal_internal(ap_pod_t *pod)
return rv;
}
/* This function connects to the server, then immediately closes the connection.
* This permits the MPM to skip the poll when there is only one listening
* socket, because it provides a alternate way to unblock an accept() when
* the pod is used.
*/
/* This function connects to the server and sends enough data to
* ensure the child wakes up and processes a new connection. This
* permits the MPM to skip the poll when there is only one listening
* socket, because it provides a alternate way to unblock an accept()
* when the pod is used. */
static apr_status_t dummy_connection(ap_pod_t *pod)
{
char *srequest;
const char *data;
apr_status_t rv;
apr_socket_t *sock;
apr_pool_t *p;
@@ -574,24 +574,37 @@ static apr_status_t dummy_connection(ap_pod_t *pod)
return rv;
}
/* Create the request string. We include a User-Agent so that
* adminstrators can track down the cause of the odd-looking
* requests in their logs.
*/
srequest = apr_pstrcat(p, "OPTIONS * HTTP/1.0\r\nUser-Agent: ",
if (lp->protocol && strcasecmp(lp->protocol, "https") == 0) {
/* Send a TLS 1.0 close_notify alert. This is perhaps the
* "least wrong" way to open and cleanly terminate an SSL
* connection. It should "work" without noisy error logs if
* the server actually expects SSLv3/TLSv1. With
* SSLv23_server_method() OpenSSL's SSL_accept() fails
* ungracefully on receipt of this message, since it requires
* an 11-byte ClientHello message and this is to short. */
static const unsigned char tls10_close_notify[7] = {
'\x15', /* TLSPlainText.type = Alert (21) */
'\x03', '\x01', /* TLSPlainText.version = {3, 1} */
'\x00', '\x02', /* TLSPlainText.length = 2 */
'\x01', /* Alert.level = warning (1) */
'\x00' /* Alert.description = close_notify (0) */
};
data = (const char *)tls10_close_notify;
len = sizeof(tls10_close_notify);
}
else /* ... XXX other request types here? */ {
/* Create an HTTP request string. We include a User-Agent so
* that adminstrators can track down the cause of the
* odd-looking requests in their logs. A complete request is
* used since kernel-level filtering may require that much
* data before returning from accept(). */
data = apr_pstrcat(p, "OPTIONS * HTTP/1.0\r\nUser-Agent: ",
ap_get_server_description(),
" (internal dummy connection)\r\n\r\n", NULL);
len = strlen(data);
}
/* Since some operating systems support buffering of data or entire
* requests in the kernel, we send a simple request, to make sure
* the server pops out of a blocking accept().
*/
/* XXX: This is HTTP specific. We should look at the Protocol for each
* listener, and send the correct type of request to trigger any Accept
* Filters.
*/
len = strlen(srequest);
apr_socket_send(sock, srequest, &len);
apr_socket_send(sock, data, &len);
apr_socket_close(sock);
apr_pool_destroy(p);