Attachment #37264 for bug #61179

View | Details | Raw Unified | Return to bug 61179
Collapse All | Expand All




</usage>
</directivesynopsis>

<directivesynopsis>
<name>TTLimit</name>
<description>Maximum TTL value which will be accepted</description>
<syntax>TTLimit <var>number</var></syntax>
<default>TTLimit 0</default>
<contextlist><context>server config</context></contextlist>
<modulelist><module>event</module><module>worker</module>
<module>prefork</module><module>mpm_winnt</module>
<module>mpm_netware</module><module>mpmt_os2</module>
</modulelist>

<usage>
    <p>Enabling this feature prevents attempts to bypass the frontend proxy layer.
    If set to a value larger than 0, it won't accept any requests if TTL is
    larger than specified.</p>

    <p>For example, if TTLimit is set to 1, then requests will be handled only
    from a local network. In other words, no more than one hop.
    </p>
</usage>
</directivesynopsis>

<directivesynopsis>
<name>ServerLimit</name>
<description>Upper limit on configurable number of processes</description>

Lines 146-151 AP_DECLARE_NONSTD(int) ap_close_selected_listeners(ap_slave_t *); Link Here

(-)a/include/ap_listen.h (+3 lines)
146	* LISTEN_COMMANDS in their command_rec table so that these functions are	146	* LISTEN_COMMANDS in their command_rec table so that these functions are
147	* called.	147	* called.
148	*/	148	*/
		149	AP_DECLARE_NONSTD(const char ) ap_set_ttl_limit(cmd_parms cmd, void dummy, const char arg);
149	AP_DECLARE_NONSTD(const char ) ap_set_listenbacklog(cmd_parms cmd, void dummy, const char arg);	150	AP_DECLARE_NONSTD(const char ) ap_set_listenbacklog(cmd_parms cmd, void dummy, const char arg);
150	AP_DECLARE_NONSTD(const char ) ap_set_listencbratio(cmd_parms cmd, void dummy, const char arg);	151	AP_DECLARE_NONSTD(const char ) ap_set_listencbratio(cmd_parms cmd, void dummy, const char arg);
151	AP_DECLARE_NONSTD(const char ) ap_set_listener(cmd_parms cmd, void *dummy,	152	AP_DECLARE_NONSTD(const char ) ap_set_listener(cmd_parms cmd, void *dummy,
Lines 161-166 AP_DECLARE_NONSTD(const char ) ap_set_accept_errors_nonfatal(cmd_parms cmd, Link Here
161	int flag);	162	int flag);
162		163
163	#define LISTEN_COMMANDS \	164	#define LISTEN_COMMANDS \
		165	AP_INIT_TAKE1("TTLimit", ap_set_ttl_limit, NULL, RSRC_CONF, \
		166	"Maximum TTL value which will be accepted"), \
164	AP_INIT_TAKE1("ListenBacklog", ap_set_listenbacklog, NULL, RSRC_CONF, \	167	AP_INIT_TAKE1("ListenBacklog", ap_set_listenbacklog, NULL, RSRC_CONF, \
165	"Maximum length of the queue of pending connections, as used by listen(2)"), \	168	"Maximum length of the queue of pending connections, as used by listen(2)"), \
166	AP_INIT_TAKE1("ListenCoresBucketsRatio", ap_set_listencbratio, NULL, RSRC_CONF, \	169	AP_INIT_TAKE1("ListenCoresBucketsRatio", ap_set_listencbratio, NULL, RSRC_CONF, \




        }
    }

    if (ap_ttl_limit) {
        int thesock;

        apr_os_sock_get(&thesock, s);
        if (setsockopt(thesock, IPPROTO_IP, IP_TTL,
                       &ap_ttl_limit, sizeof(int)) < 0) {
            stat = apr_get_netos_error();
            ap_log_perror(APLOG_MARK, APLOG_CRIT, stat, p, APLOGNO(02638)
                          "make_sock: for address %pI, apr_socket_opt_set: (IP_TTL)"
                          server->bind_addr);
            apr_socket_close(s);
            return stat;
        }
    }

#ifdef WIN32
    /* I seriously doubt that this would work on Unix; I have doubts that
     * it entirely solves the problem on Win32.  However, since setting

    ap_listen_buckets = NULL;
    ap_num_listen_buckets = 0;
    ap_listenbacklog = DEFAULT_LISTENBACKLOG;
    ap_ttl_limit = 0;
    ap_listencbratio = 0;

    /* Check once whether or not SO_REUSEPORT is supported. */

    return NULL;
}

AP_DECLARE_NONSTD(const char *) ap_set_ttl_limit(cmd_parms *cmd,
                                                 void *dummy,
                                                 const char *arg)
{
    int b;
    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);

    if (err != NULL)
        return err;

    b = atoi(arg);
    if (b < 1 || b > 255)
        return "TTLimit > 0 and TTLimit < 255";

    ap_ttl_limit = b;

    return NULL;
}

AP_DECLARE_NONSTD(const char *) ap_set_listencbratio(cmd_parms *cmd,
                                                     void *dummy,
                                                     const char *arg)

Return to bug 61179

Lines 659-664 Apache HTTP Server</a></seealso> Link Here

(-)a/docs/manual/mod/mpm_common.xml (+22 lines)
659	</usage>	659	</usage>
660	</directivesynopsis>	660	</directivesynopsis>
661		661
		662	<directivesynopsis>
		663	<name>TTLimit</name>
		664	<description>Maximum TTL value which will be accepted</description>
		665	<syntax>TTLimit <var>number</var></syntax>
		666	<default>TTLimit 0</default>
		667	<contextlist><context>server config</context></contextlist>
		668	<modulelist><module>event</module><module>worker</module>
		669	<module>prefork</module><module>mpm_winnt</module>
		670	<module>mpm_netware</module><module>mpmt_os2</module>
		671	</modulelist>
		672
		673	<usage>
		674	<p>Enabling this feature prevents attempts to bypass the frontend proxy layer.
		675	If set to a value larger than 0, it won't accept any requests if TTL is
		676	larger than specified.</p>
		677
		678	<p>For example, if TTLimit is set to 1, then requests will be handled only
		679	from a local network. In other words, no more than one hop.
		680	</p>
		681	</usage>
		682	</directivesynopsis>
		683
662	<directivesynopsis>	684	<directivesynopsis>
663	<name>ServerLimit</name>	685	<name>ServerLimit</name>
664	<description>Upper limit on configurable number of processes</description>	686	<description>Upper limit on configurable number of processes</description>

Lines 215-220 static apr_status_t make_sock(apr_pool_t p, ap_listen_rec server, int do_bind_ Link Here

(-)a/server/listen.c (+35 lines)
215	}	215	}
216	}	216	}
217		217
		218	if (ap_ttl_limit) {
		219	int thesock;
		220
		221	apr_os_sock_get(&thesock, s);
		222	if (setsockopt(thesock, IPPROTO_IP, IP_TTL,
		223	&ap_ttl_limit, sizeof(int)) < 0) {
		224	stat = apr_get_netos_error();
		225	ap_log_perror(APLOG_MARK, APLOG_CRIT, stat, p, APLOGNO(02638)
		226	"make_sock: for address %pI, apr_socket_opt_set: (IP_TTL)"
		227	server->bind_addr);
		228	apr_socket_close(s);
		229	return stat;
		230	}
		231	}
		232
218	#ifdef WIN32	233	#ifdef WIN32
219	/* I seriously doubt that this would work on Unix; I have doubts that	234	/* I seriously doubt that this would work on Unix; I have doubts that
220	* it entirely solves the problem on Win32. However, since setting	235	* it entirely solves the problem on Win32. However, since setting
Lines 989-994 AP_DECLARE(void) ap_listen_pre_config(void) Link Here
989	ap_listen_buckets = NULL;	1004	ap_listen_buckets = NULL;
990	ap_num_listen_buckets = 0;	1005	ap_num_listen_buckets = 0;
991	ap_listenbacklog = DEFAULT_LISTENBACKLOG;	1006	ap_listenbacklog = DEFAULT_LISTENBACKLOG;
		1007	ap_ttl_limit = 0;
992	ap_listencbratio = 0;	1008	ap_listencbratio = 0;
993		1009
994	/* Check once whether or not SO_REUSEPORT is supported. */	1010	/* Check once whether or not SO_REUSEPORT is supported. */
Lines 1178-1183 AP_DECLARE_NONSTD(const char ) ap_set_listenbacklog(cmd_parms cmd, Link Here
1178	return NULL;	1194	return NULL;
1179	}	1195	}
1180		1196
		1197	AP_DECLARE_NONSTD(const char ) ap_set_ttl_limit(cmd_parms cmd,
		1198	void *dummy,
		1199	const char *arg)
		1200	{
		1201	int b;
		1202	const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
		1203
		1204	if (err != NULL)
		1205	return err;
		1206
		1207	b = atoi(arg);
		1208	if (b < 1 \|\| b > 255)
		1209	return "TTLimit > 0 and TTLimit < 255";
		1210
		1211	ap_ttl_limit = b;
		1212
		1213	return NULL;
		1214	}
		1215
1181	AP_DECLARE_NONSTD(const char ) ap_set_listencbratio(cmd_parms cmd,	1216	AP_DECLARE_NONSTD(const char ) ap_set_listencbratio(cmd_parms cmd,
1182	void *dummy,	1217	void *dummy,
1183	const char *arg)	1218	const char *arg)