From 5b1edb79aa2d0f8e4424de64879c46c1942e460a Mon Sep 17 00:00:00 2001 From: Eric Covener Date: Sun, 26 Apr 2026 16:02:37 +0000 Subject: [PATCH] Merge r1933351 from trunk: ocsp limits git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933352 13f79535-47bb-0310-9956-ffa450edef68 --- modules/md/md_ocsp.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/modules/md/md_ocsp.c b/modules/md/md_ocsp.c index d2dfd73b68..b44458676f 100644 --- a/modules/md/md_ocsp.c +++ b/modules/md/md_ocsp.c @@ -46,7 +46,21 @@ #include "md_ocsp.h" #define MD_OCSP_ID_LENGTH SHA_DIGEST_LENGTH - + +/* Max acceptable OCSP response size (DER-encoded responses are typically <2 KiB) */ +#define MD_OCSP_MAX_RESPONSE_LEN (64 * 1024) +/* Timeout for OCSP responses */ +#define MD_OCSP_DEFAULT_TIMEOUT apr_time_from_sec(60) +/* Timeout for connecting to OCSP servers */ +#define MD_OCSP_CONNECT_TIMEOUT apr_time_from_sec(30) +/* + * Below this throughput in bytes per second an OCSP response is regarded as + * stalled. + */ +#define MD_OCSP_STALLING_BYTES 10 +/* Maximum duration for a stalled period during an OCSP response */ +#define MD_OCSP_STALLING_TIME apr_time_from_sec(30) + struct md_ocsp_reg_t { apr_pool_t *p; md_store_t *store; @@ -901,6 +915,12 @@ void md_ocsp_renew(md_ocsp_reg_t *reg, apr_pool_t *p, apr_pool_t *ptemp, apr_tim rv = md_http_create(&http, ptemp, reg->user_agent, reg->proxy_url); if (APR_SUCCESS != rv) goto cleanup; + + md_http_set_response_limit(http, MD_OCSP_MAX_RESPONSE_LEN); + md_http_set_timeout_default(http, MD_OCSP_DEFAULT_TIMEOUT); + md_http_set_connect_timeout_default(http, MD_OCSP_CONNECT_TIMEOUT); + md_http_set_stalling_default(http, MD_OCSP_STALLING_BYTES, + MD_OCSP_STALLING_TIME); rv = md_http_multi_perform(http, next_todo, &ctx); -- 2.47.3