A flaw was found in the way that qpidd handled incoming connections. If a client application were to send a large number of connections to qpidd, without terminating the connections with an incomplete handshake, qpidd would keep a file descriptor open for each connection. This could lead to excessive resource consumption by qpidd and could also block other legitimate connection requests. This flaw has also been reported upstream: https://issues.apache.org/jira/browse/QPID-2616 (RFE for disconnecting clients on incomplete handshakes) https://issues.apache.org/jira/browse/QPID-4021 (the actual flaw)
To work-around this issue, you can use the iptables connlimit feature to the qpid broker port so that any IP/Host gets a limited number of connections: /sbin/iptables -A INPUT -p tcp --syn --dport $brokerPort -m connlimit --connlimit-above N -j REJECT --reject-with tcp-reset
Created qpid-cpp tracking bugs for this issue Affects: fedora-all [bug 820298]
This is corrected in upstream svn: http://svn.apache.org/viewvc?view=revision&revision=1341263
Sorry, it was _partially_ corrected upstream. See QPID-4021 (https://issues.apache.org/jira/browse/QPID-4021) where it notes that the default timeout still leaves a gap for where a misbehaving client can tie up the broker. This has not yet been corrected upstream. As well, the commit noted in #c5 is the second third of the fix, the first third is: http://svn.apache.org/viewvc?view=revision&revision=1341262 We are still waiting for the fix to fully resolve the flaw (QPID-4021).
Additional related commits: http://svn.apache.org/viewvc?view=revision&revision=1331549 http://svn.apache.org/viewvc?view=revision&revision=1332788 which add per-user and per-IP connection limits (acl-max-connect-per-user and acl-max-connect-per-ip).
This issue has been addressed in following products: MRG for RHEL-5 v. 2 Via RHSA-2012:1277 https://rhn.redhat.com/errata/RHSA-2012-1277.html
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2012:1269 https://rhn.redhat.com/errata/RHSA-2012-1269.html
Statement: (none)