|
 |
1ef406 |
From 5709d481a3cd327c157a1f39a2e9018e0feefd75 Mon Sep 17 00:00:00 2001
|
|
|
1ef406 |
From: Rob Crittenden <rcritten@redhat.com>
|
|
|
1ef406 |
Date: Tue, 7 Feb 2017 10:46:56 -0500
|
|
|
1ef406 |
Subject: [PATCH] Fix the TLS Session ID cache
|
|
|
1ef406 |
|
|
|
1ef406 |
At some point that I never noticed the way I was trying to
|
|
|
1ef406 |
determine whether the worker or prefork model was being used
|
|
|
1ef406 |
broke such that the reverse of what I intended was happening
|
|
|
1ef406 |
causing no session ID caching at all.
|
|
|
1ef406 |
|
|
|
1ef406 |
My first crack at this fixed the query to be used which fixed
|
|
|
1ef406 |
the prefork model but the worker model was only caching about
|
|
|
1ef406 |
20% of requests. This is because it is a hybrid of
|
|
|
1ef406 |
forked/threading so still needs the MP cache.
|
|
|
1ef406 |
|
|
|
1ef406 |
By configuring MP for all I now get the expected level of
|
|
|
1ef406 |
caching. I used the NSS tool strsclnt to confirm levels of
|
|
|
1ef406 |
caching.
|
|
|
1ef406 |
---
|
|
|
1ef406 |
nss_engine_init.c | 19 +++++--------------
|
|
|
1ef406 |
1 file changed, 5 insertions(+), 14 deletions(-)
|
|
|
1ef406 |
|
|
|
1ef406 |
diff --git a/nss_engine_init.c b/nss_engine_init.c
|
|
|
1ef406 |
index aec845a..2ffff53 100644
|
|
|
1ef406 |
--- a/nss_engine_init.c
|
|
|
1ef406 |
+++ b/nss_engine_init.c
|
|
|
1ef406 |
@@ -430,7 +430,6 @@ int nss_init_Module(apr_pool_t *p, apr_pool_t *plog,
|
|
|
1ef406 |
server_rec *s;
|
|
|
1ef406 |
int sslenabled = FALSE;
|
|
|
1ef406 |
int fipsenabled = FALSE;
|
|
|
1ef406 |
- int threaded = 0;
|
|
|
1ef406 |
struct semid_ds status;
|
|
|
1ef406 |
char *split_vhost_id = NULL;
|
|
|
1ef406 |
char *last1;
|
|
|
1ef406 |
@@ -637,11 +636,7 @@ int nss_init_Module(apr_pool_t *p, apr_pool_t *plog,
|
|
|
1ef406 |
|
|
|
1ef406 |
ap_log_error(APLOG_MARK, APLOG_INFO, 0, base_server,
|
|
|
1ef406 |
"Initializing SSL Session Cache of size %d. SSL3/TLS timeout = %d.", mc->session_cache_size, mc->ssl3_session_cache_timeout);
|
|
|
1ef406 |
- ap_mpm_query(AP_MPMQ_MAX_THREADS, &threaded);
|
|
|
1ef406 |
- if (!threaded)
|
|
|
1ef406 |
- SSL_ConfigMPServerSIDCache(mc->session_cache_size, (PRUint32) mc->session_cache_timeout, (PRUint32) mc->ssl3_session_cache_timeout, NULL);
|
|
|
1ef406 |
- else
|
|
|
1ef406 |
- SSL_ConfigServerSessionIDCache(mc->session_cache_size, (PRUint32) mc->session_cache_timeout, (PRUint32) mc->ssl3_session_cache_timeout, NULL);
|
|
|
1ef406 |
+ SSL_ConfigMPServerSIDCache(mc->session_cache_size, (PRUint32) mc->session_cache_timeout, (PRUint32) mc->ssl3_session_cache_timeout, NULL);
|
|
|
1ef406 |
|
|
|
1ef406 |
/* Load our layer */
|
|
|
1ef406 |
nss_io_layer_init();
|
|
|
1ef406 |
@@ -1525,7 +1520,6 @@ void nss_init_Child(apr_pool_t *p, server_rec *base_server)
|
|
|
1ef406 |
SSLModConfigRec *mc = myModConfig(base_server);
|
|
|
1ef406 |
SSLSrvConfigRec *sc;
|
|
|
1ef406 |
server_rec *s;
|
|
|
1ef406 |
- int threaded = 0;
|
|
|
1ef406 |
int sslenabled = FALSE;
|
|
|
1ef406 |
|
|
|
1ef406 |
mc->pid = getpid(); /* only call getpid() once per-process */
|
|
|
1ef406 |
@@ -1555,13 +1549,10 @@ void nss_init_Child(apr_pool_t *p, server_rec *base_server)
|
|
|
1ef406 |
return;
|
|
|
1ef406 |
}
|
|
|
1ef406 |
|
|
|
1ef406 |
- ap_mpm_query(AP_MPMQ_MAX_THREADS, &threaded);
|
|
|
1ef406 |
- if (!threaded) {
|
|
|
1ef406 |
- if (SSL_InheritMPServerSIDCache(NULL) != SECSuccess) {
|
|
|
1ef406 |
- ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL,
|
|
|
1ef406 |
- "SSL_InheritMPServerSIDCache failed");
|
|
|
1ef406 |
- nss_log_nss_error(APLOG_MARK, APLOG_ERR, NULL);
|
|
|
1ef406 |
- }
|
|
|
1ef406 |
+ if (SSL_InheritMPServerSIDCache(NULL) != SECSuccess) {
|
|
|
1ef406 |
+ ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL,
|
|
|
1ef406 |
+ "SSL_InheritMPServerSIDCache failed");
|
|
|
1ef406 |
+ nss_log_nss_error(APLOG_MARK, APLOG_ERR, NULL);
|
|
|
1ef406 |
}
|
|
|
1ef406 |
|
|
|
1ef406 |
nss_init_SSLLibrary(base_server, mc->pPool);
|
|
|
1ef406 |
--
|
|
|
1ef406 |
2.9.4
|
|
|
1ef406 |
|