Attachment 870333 Details for Bug 1038007 – backported patch

[patch] backported patch

net-snmp-5.3.2.2-agentx-disconnect-crash.patch (text/plain), 9.32 KB, created by Jan Safranek on 2014-03-04 11:26:00 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jan Safranek

Created: 2014-03-04 11:26:00 UTC

Size: 9.32 KB

patch

obsolete

>1038007 - (CVE-2012-6151) CVE-2012-6151 net-snmp: snmpd crashes/hangs when AgentX subagent times-out
>Based on usptream commit 793d596838ff7cb48a73b675d62897c56c9e62df,
>heavily backported to net-snmp-5.3.2.2
>
>diff -up net-snmp-5.3.2.2/agent/mibgroup/agentx/master_admin.ctest net-snmp-5.3.2.2/agent/mibgroup/agentx/master_admin.c
>--- net-snmp-5.3.2.2/agent/mibgroup/agentx/master_admin.ctest	2007-01-22 17:19:47.000000000 +0100
>+++ net-snmp-5.3.2.2/agent/mibgroup/agentx/master_admin.c	2014-01-10 12:04:11.168841264 +0100
>@@ -161,6 +161,7 @@ close_agentx_session(netsnmp_session * s
>     for (sp = session->subsession; sp != NULL; sp = sp->next) {
> 
>         if (sp->sessid == sessid) {
>+            netsnmp_remove_delegated_requests_for_session(sp);
>             unregister_mibs_by_session(sp);
>             unregister_index_by_session(sp);
>             snmp_call_callbacks(SNMP_CALLBACK_APPLICATION,
>diff -up net-snmp-5.3.2.2/agent/mibgroup/agentx/master.ctest net-snmp-5.3.2.2/agent/mibgroup/agentx/master.c
>--- net-snmp-5.3.2.2/agent/mibgroup/agentx/master.ctest	2007-08-16 15:25:54.000000000 +0200
>+++ net-snmp-5.3.2.2/agent/mibgroup/agentx/master.c	2014-01-10 12:04:11.169841263 +0100
>@@ -226,7 +226,7 @@ agentx_got_response(int operation,
>     if (!cache) {
>         DEBUGMSGTL(("agentx/master", "response too late on session %08p\n",
>                     session));
>-        return 0;
>+        return 1;
>     }
>     requests = cache->requests;
> 
>diff -up net-snmp-5.3.2.2/agent/snmp_agent.ctest net-snmp-5.3.2.2/agent/snmp_agent.c
>--- net-snmp-5.3.2.2/agent/snmp_agent.ctest	2014-01-10 12:03:46.486884660 +0100
>+++ net-snmp-5.3.2.2/agent/snmp_agent.c	2014-01-10 12:03:02.000000000 +0100
>@@ -1336,6 +1336,7 @@ free_agent_snmp_session(netsnmp_agent_se
>         netsnmp_free_cachemap(asp->cache_store);
>         asp->cache_store = NULL;
>     }
>+    agent_snmp_session_release_cancelled(asp);
>     SNMP_FREE(asp);
> }
> 
>@@ -1347,6 +1348,10 @@ netsnmp_check_for_delegated(netsnmp_agen
> 
>     if (NULL == asp->treecache)
>         return 0;
>+
>+    if (agent_snmp_session_is_cancelled(asp)) {
>+        return 0;
>+    }
>     
>     for (i = 0; i <= asp->treecache_num; i++) {
>         for (request = asp->treecache[i].requests_begin; request;
>@@ -1425,39 +1431,46 @@ int
> netsnmp_remove_delegated_requests_for_session(netsnmp_session *sess)
> {
>     netsnmp_agent_session *asp;
>-    int count = 0;
>+    int total_count = 0;
>     
>     for (asp = agent_delegated_list; asp; asp = asp->next) {
>         /*
>          * check each request
>          */
>+        int i;
>+        int count = 0;
>         netsnmp_request_info *request;
>-        for(request = asp->requests; request; request = request->next) {
>-            /*
>-             * check session
>-             */
>-            netsnmp_assert(NULL!=request->subtree);
>-            if(request->subtree->session != sess)
>-                continue;
>-
>-            /*
>-             * matched! mark request as done
>-             */
>-            netsnmp_request_set_error(request, SNMP_ERR_GENERR);
>-            ++count;
>+        for (i = 0; i <= asp->treecache_num; i++) {
>+            for (request = asp->treecache[i].requests_begin; request;
>+                 request = request->next) {
>+                /*
>+                 * check session
>+                 */
>+                netsnmp_assert(NULL!=request->subtree);
>+                if(request->subtree->session != sess)
>+                    continue;
>+                /*
>+                 * matched! mark request as done
>+                 */
>+                netsnmp_request_set_error(request, SNMP_ERR_GENERR);
>+                ++count;
>+            }
>+        }
>+        if (count) {
>+            agent_snmp_session_mark_cancelled(asp);
>+            total_count += count;
>         }
>     }
>-
>     /*
>      * if we found any, that request may be finished now
>      */
>-    if(count) {
>+    if(total_count) {
>         DEBUGMSGTL(("snmp_agent", "removed %d delegated request(s) for session "
>-                    "%08p\n", count, sess));
>-        netsnmp_check_outstanding_agent_requests();
>+                    "%8p\n", total_count, sess));
>+        netsnmp_check_delegated_requests();
>     }
>-    
>-    return count;
>+
>+    return total_count;
> }
> 
> int
>@@ -2606,19 +2619,11 @@ handle_var_requests(netsnmp_agent_sessio
>     return final_status;
> }
> 
>-/*
>- * loop through our sessions known delegated sessions and check to see
>- * if they've completed yet. If there are no more delegated sessions,
>- * check for and process any queued requests
>- */
> void
>-netsnmp_check_outstanding_agent_requests(void)
>+netsnmp_check_delegated_requests(void)
> {
>     netsnmp_agent_session *asp, *prev_asp = NULL, *next_asp = NULL;
> 
>-    /*
>-     * deal with delegated requests
>-     */
>     for (asp = agent_delegated_list; asp; asp = next_asp) {
>         next_asp = asp->next;   /* save in case we clean up asp */
>         if (!netsnmp_check_for_delegated(asp)) {
>@@ -2657,6 +2662,22 @@ netsnmp_check_outstanding_agent_requests
>             prev_asp = asp;
>         }
>     }
>+}
>+
>+/*
>+ * loop through our sessions known delegated sessions and check to see
>+ * if they've completed yet. If there are no more delegated sessions,
>+ * check for and process any queued requests
>+ */
>+void
>+netsnmp_check_outstanding_agent_requests(void)
>+{
>+    netsnmp_agent_session *asp;
>+
>+    /*
>+     * deal with delegated requests
>+     */
>+    netsnmp_check_delegated_requests();
> 
>     /*
>      * if we are processing a set and there are more delegated
>@@ -2685,7 +2706,8 @@ netsnmp_check_outstanding_agent_requests
> 
>             netsnmp_processing_set = netsnmp_agent_queued_list;
>             DEBUGMSGTL(("snmp_agent", "SET request remains queued while "
>-                        "delegated requests finish, asp = %08p\n", asp));
>+                        "delegated requests finish, asp = %08p\n",
>+                        agent_delegated_list));
>             break;
>         }
> 
>@@ -2745,6 +2767,10 @@ check_delayed_request(netsnmp_agent_sess
>     case SNMP_MSG_GETBULK:
>     case SNMP_MSG_GETNEXT:
>         netsnmp_check_all_requests_status(asp, 0);
>+        if (agent_snmp_session_is_cancelled(asp)) {
>+            DEBUGMSGTL(("snmp_agent","canceling next walk for asp %p\n", asp));
>+            break;
>+        }
>         handle_getnext_loop(asp);
>         if (netsnmp_check_for_delegated(asp) &&
>             netsnmp_check_transaction_id(asp->pdu->transid) !=
>@@ -3701,3 +3728,71 @@ netsnmp_set_all_requests_error(netsnmp_a
>     return error_value;
> }
> /** @} */
>+
>+
>+/*
>+ * Ugly hack to fix bug #950602 and preserve ABI
>+ * (the official patch adds netsnmp_agent_session->flags).
>+ * We must create parallel database of netsnmp_agent_sessions
>+ * and put cancelled requests there instead of marking
>+ * netsnmp_agent_session->flags.
>+ */
>+static netsnmp_agent_session **cancelled_agent_snmp_sessions;
>+static int cancelled_agent_snmp_sessions_count;
>+static int cancelled_agent_snmp_sessions_max;
>+
>+int
>+agent_snmp_session_mark_cancelled(netsnmp_agent_session *session)
>+{
>+    DEBUGMSGTL(("agent:cancelled", "Cancelling session %p\n", session));
>+    if (!session)
>+        return 0;
>+    if (cancelled_agent_snmp_sessions_count + 1 > cancelled_agent_snmp_sessions_max) {
>+        netsnmp_agent_session **aux;
>+        int max = cancelled_agent_snmp_sessions_max + 10;
>+        aux = realloc(cancelled_agent_snmp_sessions, sizeof(netsnmp_agent_session*) * max);
>+        if (!aux)
>+            return SNMP_ERR_GENERR;
>+        cancelled_agent_snmp_sessions = aux;
>+        cancelled_agent_snmp_sessions_max = max;
>+    }
>+    cancelled_agent_snmp_sessions[cancelled_agent_snmp_sessions_count] = session;
>+    cancelled_agent_snmp_sessions_count++;
>+    return 0;
>+}
>+
>+int
>+agent_snmp_session_is_cancelled(netsnmp_agent_session *session)
>+{
>+    int i;
>+    for (i=0; i<cancelled_agent_snmp_sessions_count; i++)
>+        if (cancelled_agent_snmp_sessions[i] == session) {
>+            DEBUGMSGTL(("agent:cancelled", "session %p is cancelled\n", session));
>+            return TRUE;
>+    }
>+    return FALSE;
>+}
>+
>+int
>+agent_snmp_session_release_cancelled(netsnmp_agent_session *session)
>+{
>+    int i, j;
>+
>+    if (!session)
>+        return 0;
>+
>+    DEBUGMSGTL(("agent:cancelled", "Removing session %p\n", session));
>+
>+    /* delete the session from cancelled_agent_snmp_sessions */
>+    for (i=0, j=0; j<cancelled_agent_snmp_sessions_count; i++, j++)
>+        if (cancelled_agent_snmp_sessions[j] == session)
>+            i--; /* don't increase i in this loop iteration */
>+        else
>+            cancelled_agent_snmp_sessions[i] = cancelled_agent_snmp_sessions[j];
>+
>+    cancelled_agent_snmp_sessions_count = i;
>+
>+    for (; i< cancelled_agent_snmp_sessions_max; i++)
>+        cancelled_agent_snmp_sessions[i] = NULL;
>+    return 0;
>+}
>diff -up net-snmp-5.3.2.2/include/net-snmp/agent/snmp_agent.htest net-snmp-5.3.2.2/include/net-snmp/agent/snmp_agent.h
>--- net-snmp-5.3.2.2/include/net-snmp/agent/snmp_agent.htest	2007-01-03 17:39:48.000000000 +0100
>+++ net-snmp-5.3.2.2/include/net-snmp/agent/snmp_agent.h	2014-01-10 12:04:11.171841259 +0100
>@@ -231,6 +231,7 @@ extern          "C" {
>     int             init_master_agent(void);
>     void            shutdown_master_agent(void);
>     int             agent_check_and_process(int block);
>+    void            netsnmp_check_delegated_requests(void);
>     void            netsnmp_check_outstanding_agent_requests(void);
> 
>     int             netsnmp_request_set_error(netsnmp_request_info *request,

Actions: View | Diff

Attachments on bug 1038007: 870332 | 870333