|
 |
232633 |
From 5da265eb9a023964f00d3ff6b54bcc64107dcf5a Mon Sep 17 00:00:00 2001
|
|
|
232633 |
From: Thierry Bordaz <tbordaz@redhat.com>
|
|
|
232633 |
Date: Wed, 15 May 2019 17:46:14 +0200
|
|
|
232633 |
Subject: [PATCH] Ticket 50329 - (2nd) Possible Security Issue: DOS due to
|
|
|
232633 |
ioblocktimeout not applying to TLS
|
|
|
232633 |
|
|
|
232633 |
Bug Description:
|
|
|
232633 |
A secure socket is configured in blocking mode. If an event
|
|
|
232633 |
is detected on a secure socket a worker tries to receive the request.
|
|
|
232633 |
If handshake occurs during the read, it can hang longer than
|
|
|
232633 |
ioblocktimeout because it takes into account the socket option
|
|
|
232633 |
rather than the timeout used for the ssl_Recv
|
|
|
232633 |
|
|
|
232633 |
Fix Description:
|
|
|
232633 |
The fix is specific to secure socket and set this socket option
|
|
|
232633 |
to do non blocking IO.
|
|
|
232633 |
|
|
|
232633 |
https://pagure.io/389-ds-base/issue/50329
|
|
|
232633 |
|
|
|
232633 |
Reviewed by: ?
|
|
|
232633 |
|
|
|
232633 |
Platforms tested: F28, RHEL7.6
|
|
|
232633 |
|
|
|
232633 |
Flag Day: no
|
|
|
232633 |
|
|
|
232633 |
Doc impact: no
|
|
|
232633 |
---
|
|
|
232633 |
ldap/servers/slapd/daemon.c | 2 +-
|
|
|
232633 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
232633 |
|
|
|
232633 |
diff --git a/ldap/servers/slapd/daemon.c b/ldap/servers/slapd/daemon.c
|
|
|
232633 |
index 2daa21034..519fd2f86 100644
|
|
|
232633 |
--- a/ldap/servers/slapd/daemon.c
|
|
|
232633 |
+++ b/ldap/servers/slapd/daemon.c
|
|
|
232633 |
@@ -3174,7 +3174,7 @@ configure_pr_socket(PRFileDesc **pr_socket, int secure, int local)
|
|
|
232633 |
|
|
|
232633 |
if (secure) {
|
|
|
232633 |
pr_socketoption.option = PR_SockOpt_Nonblocking;
|
|
|
232633 |
- pr_socketoption.value.non_blocking = 0;
|
|
|
232633 |
+ pr_socketoption.value.non_blocking = 1;
|
|
|
232633 |
if (PR_SetSocketOption(*pr_socket, &pr_socketoption) == PR_FAILURE) {
|
|
|
232633 |
PRErrorCode prerr = PR_GetError();
|
|
|
232633 |
slapi_log_err(SLAPI_LOG_ERR,
|
|
|
232633 |
--
|
|
|
232633 |
2.21.0
|
|
|
232633 |
|