56 lines
1.9 KiB
Diff
56 lines
1.9 KiB
Diff
From 30e8bcf40b559c795cf73d9b537256ea1ebd1867 Mon Sep 17 00:00:00 2001
|
|
From: Eric Covener <covener@apache.org>
|
|
Date: Sun, 26 Apr 2026 16:02:37 +0000
|
|
Subject: [PATCH] Merge r1933351 from trunk:
|
|
|
|
ocsp limits
|
|
|
|
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933352 13f79535-47bb-0310-9956-ffa450edef68
|
|
---
|
|
src/md_ocsp.c | 22 +++++++++++++++++++++-
|
|
1 file changed, 21 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/md_ocsp.c b/src/md_ocsp.c
|
|
index 8276137..6e65e74 100644
|
|
--- a/src/md_ocsp.c
|
|
+++ b/src/md_ocsp.c
|
|
@@ -46,7 +46,21 @@
|
|
#include "md_ocsp.h"
|
|
|
|
#define MD_OCSP_ID_LENGTH SHA_DIGEST_LENGTH
|
|
-
|
|
+
|
|
+/* Max acceptable OCSP response size (DER-encoded responses are typically <2 KiB) */
|
|
+#define MD_OCSP_MAX_RESPONSE_LEN (64 * 1024)
|
|
+/* Timeout for OCSP responses */
|
|
+#define MD_OCSP_DEFAULT_TIMEOUT apr_time_from_sec(60)
|
|
+/* Timeout for connecting to OCSP servers */
|
|
+#define MD_OCSP_CONNECT_TIMEOUT apr_time_from_sec(30)
|
|
+/*
|
|
+ * Below this throughput in bytes per second an OCSP response is regarded as
|
|
+ * stalled.
|
|
+ */
|
|
+#define MD_OCSP_STALLING_BYTES 10
|
|
+/* Maximum duration for a stalled period during an OCSP response */
|
|
+#define MD_OCSP_STALLING_TIME apr_time_from_sec(30)
|
|
+
|
|
struct md_ocsp_reg_t {
|
|
apr_pool_t *p;
|
|
md_store_t *store;
|
|
@@ -900,6 +914,12 @@ void md_ocsp_renew(md_ocsp_reg_t *reg, apr_pool_t *p, apr_pool_t *ptemp, apr_tim
|
|
|
|
rv = md_http_create(&http, ptemp, reg->user_agent, reg->proxy_url);
|
|
if (APR_SUCCESS != rv) goto cleanup;
|
|
+
|
|
+ md_http_set_response_limit(http, MD_OCSP_MAX_RESPONSE_LEN);
|
|
+ md_http_set_timeout_default(http, MD_OCSP_DEFAULT_TIMEOUT);
|
|
+ md_http_set_connect_timeout_default(http, MD_OCSP_CONNECT_TIMEOUT);
|
|
+ md_http_set_stalling_default(http, MD_OCSP_STALLING_BYTES,
|
|
+ MD_OCSP_STALLING_TIME);
|
|
|
|
rv = md_http_multi_perform(http, next_todo, &ctx);
|
|
|
|
--
|
|
2.52.0
|
|
|