docs/userguide/httpd.conf

#
# Apache HTTP Server Configuration for Axis2/C HTTP/2 JSON Services
# Custom build at /usr/local/apache2
#
# This configuration provides:
# - HTTP/2 with TLS 1.2+ (HTTPS-only)
# - Defense-in-depth request limits
# - Per-service payload limits
# - Integer overflow protection at Apache level
# - Security headers
#

ServerRoot "/usr/local/apache2"
ServerName localhost:443
ServerAdmin admin@localhost

# Listen on HTTPS only (HTTP/2 requires TLS)
Listen 443

# =============================================================================
# CORE MODULES
# =============================================================================
LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authn_core_module modules/mod_authn_core.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule authz_core_module modules/mod_authz_core.so
LoadModule access_compat_module modules/mod_access_compat.so
LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule reqtimeout_module modules/mod_reqtimeout.so
LoadModule filter_module modules/mod_filter.so
LoadModule mime_module modules/mod_mime.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule env_module modules/mod_env.so
LoadModule headers_module modules/mod_headers.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule version_module modules/mod_version.so
LoadModule proxy_module modules/mod_proxy.so
LoadModule unixd_module modules/mod_unixd.so
LoadModule status_module modules/mod_status.so
LoadModule autoindex_module modules/mod_autoindex.so
LoadModule dir_module modules/mod_dir.so
LoadModule alias_module modules/mod_alias.so
LoadModule rewrite_module modules/mod_rewrite.so

# SSL/TLS and HTTP/2 modules
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
LoadModule ssl_module modules/mod_ssl.so
LoadModule http2_module modules/mod_http2.so

# Axis2/C module
LoadModule axis2_module /usr/local/axis2c/lib/libmod_axis2.so

# =============================================================================
# PROCESS/USER CONFIGURATION
# =============================================================================
<IfModule unixd_module>
    User www-data
    Group www-data
</IfModule>

# Use event MPM for HTTP/2 (required for multiplexing)
<IfModule mpm_event_module>
    StartServers             2
    MinSpareThreads         25
    MaxSpareThreads         75
    ThreadLimit             64
    ThreadsPerChild         25
    MaxRequestWorkers      150
    MaxConnectionsPerChild   0
</IfModule>
# CVE-2026-49975 backstop: cap per-worker memory at the OS level (this is NOT an
# httpd directive) so a bombed worker gets OOM-killed and respawned before it
# drags the box into swap. With systemd, set MemoryMax= on the apache2 unit; or
# run under a cgroup / `ulimit -v`. A worker rarely needs gigabytes, and an early
# kernel kill is a far better failure mode than the attacker pinning the machine.

# =============================================================================
# AXIS2/C CONFIGURATION
# =============================================================================
Axis2RepoPath /usr/local/axis2c
Axis2LogFile /var/log/axis2c/axis2.log
Axis2LogLevel info

# =============================================================================
# DEFENSE IN DEPTH: REQUEST LIMITS
# Apache enforces these limits BEFORE payloads reach Axis2/C code
# This protects against memory exhaustion, overflow attacks, and DoS
# =============================================================================

# Global default: 10MB max request body (matches Axis2/C max_buffer)
LimitRequestBody 10485760

# Limit request line (URL + method + protocol) - prevents long URL attacks
LimitRequestLine 8190

# Limit total header fields - prevents classic header flooding.
# NOTE (CVE-2026-49975 "HTTP/2 Bomb"): before mod_http2 2.0.41, duplicate HTTP/2
# Cookie crumbs are NOT counted against LimitRequestFields, so this alone does
# not stop the cookie-crumb HPACK amplification. The real fix is mod_http2 >= 2.0.41
# (not yet in a 2.4.x release as of Jun 2026); pull the standalone mod_http2 build.
LimitRequestFields 100

# Limit individual header size - prevents header overflow attacks AND caps the
# merged Cookie size, which bounds the per-stream HTTP/2 Bomb crumb count.
# Partial mitigation per CVE-2026-49975 (lowered 8190 -> 4096); an attacker can
# still multiply the effect across streams/connections, so it is not a full fix.
LimitRequestFieldSize 4096

# Request timeout protection (slowloris defense)
<IfModule reqtimeout_module>
    RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500
</IfModule>

# =============================================================================
# HTTP/2 CONFIGURATION
# =============================================================================
<IfModule http2_module>
    # HTTP/2 performance settings for enterprise big data
    H2WindowSize 65536
    H2MaxWorkers 256

    # --- CVE-2026-49975 "HTTP/2 Bomb" hardening -------------------------------
    # Attack = HPACK indexed-reference bomb (cheap-to-send headers that each cost
    # the server a full allocation) + a zero-window flow-control stall that pins
    # that memory open via a Slowloris-style WINDOW_UPDATE drip. Amplification is
    # only half the problem; the *hold* is what turns it into an OOM. The real fix
    # is mod_http2 >= 2.0.41. Until then, bound the per-connection blast radius:

    # Fewer concurrent streams per connection -> smaller per-connection footprint
    # (was 100). Attackers can still open more connections, so pair with the
    # per-worker memory cap noted below.
    H2MaxSessionStreams 50

    # Per-stream output buffer = the DOMINANT blast-radius knob: a stalled stream
    # pins up to this much RAM, multiplied by streams x connections. Keep it only
    # as large as BigDataH2Service genuinely needs; lower it if the demo allows.
    H2StreamMaxMemSize 104857600

    # Bound how long a zero-window-stalled stream may live (was 300s). A short
    # timeout stops the WINDOW_UPDATE drip from holding allocations for minutes.
    H2StreamTimeout 30
    # --------------------------------------------------------------------------

    # Security: HTTP/2 only over TLS 1.2+
    H2ModernTLSOnly on
    H2Upgrade off
    H2Direct on
</IfModule>

# =============================================================================
# SSL/TLS CONFIGURATION
# =============================================================================
<IfModule ssl_module>
    SSLRandomSeed startup builtin
    SSLRandomSeed connect builtin

    # OCSP Stapling — enable only with CA-signed certificates.
    # Self-signed certs have no OCSP responder and will cause Apache errors.
    # SSLStaplingCache shmcb:/tmp/stapling_cache(128000)
</IfModule>

# =============================================================================
# DIRECTORY AND LOGGING CONFIGURATION
# =============================================================================
<Directory />
    AllowOverride none
    Require all denied
</Directory>

DocumentRoot "/usr/local/apache2/htdocs"
<Directory "/usr/local/apache2/htdocs">
    Options Indexes FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

<IfModule dir_module>
    DirectoryIndex index.html
</IfModule>

<Files ".ht*">
    Require all denied
</Files>

ErrorLog "logs/error_log"
LogLevel warn

<IfModule log_config_module>
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%h %l %u %t \"%r\" %>s %b" common
    CustomLog "logs/access_log" combined
</IfModule>

<IfModule mime_module>
    TypesConfig conf/mime.types
    AddType application/x-compress .Z
    AddType application/x-gzip .gz .tgz
    AddType application/json .json
</IfModule>

# =============================================================================
# HTTPS VIRTUAL HOST WITH HTTP/2
# =============================================================================
<VirtualHost *:443>
    ServerName localhost:443
    DocumentRoot /usr/local/apache2/htdocs

    # HTTP/2 first, HTTP/1.1 fallback
    Protocols h2 http/1.1

    # SSL/TLS Configuration
    SSLEngine on
    SSLCertificateFile /usr/local/apache2/conf/ssl/apache-selfsigned.crt
    SSLCertificateKeyFile /usr/local/apache2/conf/ssl/apache-selfsigned.key

    # TLS 1.2+ required for HTTP/2
    SSLProtocol -all +TLSv1.2 +TLSv1.3

    # Modern cipher suites for HTTP/2
    SSLCipherSuite ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:!aNULL:!MD5:!DSS
    SSLHonorCipherOrder off

    # OCSP Stapling — disabled for self-signed certs (no OCSP responder)
    # SSLUseStapling on

    # =========================================================================
    # SECURITY HEADERS
    # =========================================================================
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Header always set X-Content-Type-Options nosniff
    Header always set X-Frame-Options DENY

    # =========================================================================
    # AXIS2/C SERVICES HANDLER
    # =========================================================================
    <Location /services>
        SetHandler axis2_module
        SSLRequireSSL

        # CORS headers for API access
        Header always set Access-Control-Allow-Origin "*"
        Header always set Access-Control-Allow-Methods "GET, POST, OPTIONS"
        Header always set Access-Control-Allow-Headers "Content-Type, Authorization, Accept"
    </Location>

    # =========================================================================
    # PER-SERVICE REQUEST LIMITS (Defense in Depth)
    # These limits are enforced by Apache BEFORE Axis2/C code executes
    # =========================================================================

    # Camera Control Service - IoT payloads are small
    <Location /services/CameraControlService>
        # IoT endpoints: 64KB max (camera commands are ~24 bytes)
        LimitRequestBody 65536
        Header always set Cache-Control "no-cache, no-store, must-revalidate"
    </Location>

    # Financial Benchmark Service - Enterprise payloads up to 50MB
    # Portfolio variance payload is O(n²): 500 assets = ~6 MB, 1000 assets = ~22 MB.
    <Location /services/FinancialBenchmarkService>
        LimitRequestBody 52428800
        Header always set Cache-Control "no-cache, no-store, must-revalidate"
    </Location>

    # Big Data H2 Service - Large payloads up to 50MB
    <Location /services/BigDataH2Service>
        # Big data payloads: 50MB max
        LimitRequestBody 52428800
        Header always set Cache-Control "no-cache, no-store, must-revalidate"
    </Location>

    # Login Service - Authentication payloads are small
    <Location /services/LoginService>
        # Auth payloads: 64KB max (credentials are small)
        LimitRequestBody 65536
        Header always set X-XSS-Protection "1; mode=block"
        Header always set Content-Security-Policy "default-src 'self'"
    </Location>

    # Test WS Service - XSS demonstration with small payloads
    <Location /services/TestwsService>
        # Test payloads: 1MB max
        LimitRequestBody 1048576
        Header always set X-XSS-Protection "1; mode=block"
        Header always set Content-Security-Policy "default-src 'self'; script-src 'none'"
    </Location>

    # =========================================================================
    # HTTP/2 ENFORCEMENT (Optional - uncomment to require HTTP/2)
    # =========================================================================
    # RewriteEngine On
    # RewriteCond %{SERVER_PROTOCOL} ^HTTP/1\.1$
    # RewriteRule ^/services/.* - [R=426,L]
    # ErrorDocument 426 "HTTP/2 Required: Use --http2 flag"

</VirtualHost>