httpd
httpd copied to clipboard
mod_ssl: directly abort connection when receiving HTTP requests
Shutdown the ssl filter and abort the connection instead of disabling is and pass a fake request to the core handler. The current implementation allows to exhaust workers by sendin HTTP request to HTTPS port. Additionally the Openssl lib doesn't detect the http methods PATCH, DELETE, OPTIONS and TRACE. So the current implementation only works partially. See openssl PR: https://github.com/openssl/openssl/pull/26968