-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 09/02/2010 02:12 PM, Stephen Gallagher wrote:
This is a follow-up to the patch in the thread "[PATCH] Handle
multiple
simultaneous enumeration requests". It addresses the vulnerability that
would be introduced by that earlier patch.
Patches 0001 and 0002 are nearly identical, they are just divided into
one patch for setpwent and another for setgrent to make reviewing easier.
In order to ensure that a slow or malicious client cannot hold
onto a reference for the setpwent result object indefinitely, we
set an expiration on the object. We use the enum_cache_timeout
here, since that is an appropriate value.
If the timeout fires during the normal operation of the getpwent()
loop of a client program, we will save the current values of the
read index so that we can resume as soon as the object has been
refreshed by an implicit setpwent call.
Also attached is a simple test program that I wrote to verify the fix.
It will start an enumeration read, then pause partway through (I picked
70 because that was firmly within the sss results and after the files
results) for 35 seconds. I set enum_cache_timeout = 30 in the [nss]
section of my sssd.conf for testing this.
The final count should be the same as received from
getent group |wc -l
The output can be verified by inspection to see that all of the groups
are as expected.
This patch is now obsoleted by the latest patch in the thread "Handle
multiple simultaneous enumeration request"
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAkyGX94ACgkQeiVVYja6o6Oz5ACcDSDLAVvhz+TiuuPVFhZqLUyb
0qkAoKbr27iQRc1er/TVZgsAjn9DvUPO
=4A8Y
-----END PGP SIGNATURE-----