Attachment 602904 Details for Bug 841314 – Updated version of pmcd event-driven programming flaw patch

[patch] Updated version of pmcd event-driven programming flaw patch

pmcd_timeout (text/plain), 2.82 KB, created by Nathan Scott on 2012-08-08 02:08:53 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Nathan Scott

Created: 2012-08-08 02:08:53 UTC

Size: 2.82 KB

patch

obsolete

>Resolve event-driven programming flaw in pmcd
>
>Fix an issue where a misbehaving client could prevent pmcd from
>responding to other legitimate requests.  Now uses a dead-hand
>timer to ensure a client does not feed tiny pieces of PDUs into
>pmcd, preventing service to genuine clients.
>
>Original report and fixes reviewed by Florian Weimer of the Red Hat
>Security team.  Red Hat bugzilla bug #841706.
>
>Security advisory CVE-2012-3421.
>
>Index: pcp/man/man1/pmcd.1
>===================================================================
>--- pcp.orig/man/man1/pmcd.1	2012-08-06 21:12:59.457711563 +1000
>+++ pcp/man/man1/pmcd.1	2012-08-06 21:15:23.181700014 +1000
>@@ -164,10 +164,10 @@ option allows an alternative timeout int
> zero) to be specified.  The unit of time is seconds.
> .TP
> \f3\-t\f1 \f2timeout\f1
>-To prevent misbehaving agents from hanging the entire Performance Metrics
>+To prevent misbehaving clients or agents from hanging the entire Performance Metrics
> Collection System (PMCS),
> .B pmcd
>-uses timeouts on PDU exchanges with agents running as processes.
>+uses timeouts on PDU exchanges with clients and agents running as processes.
> By
> default the timeout interval is five seconds.
> The
>Index: pcp/src/libpcp/src/pdu.c
>===================================================================
>--- pcp.orig/src/libpcp/src/pdu.c	2012-08-06 21:15:23.038700227 +1000
>+++ pcp/src/libpcp/src/pdu.c	2012-08-08 12:01:15.565914642 +1000
>@@ -96,6 +96,9 @@ pduread(int fd, char *buf, int len, int 
>     int			status = 0;
>     int			have = 0;
>     int			size;
>+    int			onetrip = 1;
>+    struct timeval	dead_hand;
>+    struct timeval	now;
>     fd_set		onefd;
> 
>     while (len) {
>@@ -168,9 +171,35 @@ pduread(int fd, char *buf, int len, int 
> 		}
> 		else
> 		    wait = def_wait;
>+		if (onetrip) {
>+		    /*
>+		     * Need all parts of the PDU to be received by dead_hand
>+		     * This enforces a low overall timeout for the whole PDU
>+		     * (as opposed to just a timeout for individual calls to
>+		     * recv).  A more invasive alternative (better) approach
>+		     * would see all I/O performed in the main event loop,
>+		     * and I/O routines transformed to continuation-passing
>+		     * style.
>+		     */
>+		    gettimeofday(&dead_hand, NULL);
>+		    dead_hand.tv_sec += wait.tv_sec;
>+		    dead_hand.tv_usec += wait.tv_usec;
>+		    while (dead_hand.tv_usec >= 1000000) {
>+			dead_hand.tv_usec -= 1000000;
>+			dead_hand.tv_sec++;
>+		    }
>+		    onetrip = 0;
>+		}
> 		FD_ZERO(&onefd);
> 		FD_SET(fd, &onefd);
> 		status = select(fd+1, &onefd, NULL, NULL, &wait);
>+		if (status > 0) {
>+		    gettimeofday(&now, NULL);
>+		    if (now.tv_sec > dead_hand.tv_sec ||
>+		        (now.tv_sec == dead_hand.tv_sec &&
>+			 now.tv_usec > dead_hand.tv_usec))
>+		    status = 0;
>+		}
> 		if (status == 0) {
> 		    if (__pmGetInternalState() != PM_STATE_APPL) {
> 			/* special for PMCD and friends

Actions: View | Diff

Attachments on bug 841314: 602593 | 602904