[SSSD] [PATCHES] Add a setent result object timeout

Stephen Gallagher sgallagh at redhat.com
Thu Sep 2 18:12:14 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is a follow-up to the patch in the thread "[PATCH] Handle multiple
simultaneous enumeration requests". It addresses the vulnerability that
would be introduced by that earlier patch.

Patches 0001 and 0002 are nearly identical, they are just divided into
one patch for setpwent and another for setgrent to make reviewing easier.

In order to ensure that a slow or malicious client cannot hold
onto a reference for the setpwent result object indefinitely, we
set an expiration on the object. We use the enum_cache_timeout
here, since that is an appropriate value.

If the timeout fires during the normal operation of the getpwent()
loop of a client program, we will save the current values of the
read index so that we can resume as soon as the object has been
refreshed by an implicit setpwent call.

Also attached is a simple test program that I wrote to verify the fix.
It will start an enumeration read, then pause partway through (I picked
70 because that was firmly within the sss results and after the files
results) for 35 seconds. I set enum_cache_timeout = 30 in the [nss]
section of my sssd.conf for testing this.

The final count should be the same as received from
getent group |wc -l

The output can be verified by inspection to see that all of the groups
are as expected.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkx/6P0ACgkQeiVVYja6o6NSlgCfbypL4Wy4NweoC7yaIIFYYjOy
umkAniVMpnyphBIFMujKR0/8III+mGmS
=ikGR
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Add-a-setpwent-result-object-timeout.patch
Type: text/x-patch
Size: 5611 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20100902/f7971289/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Add-a-setgrent-result-object-timeout.patch
Type: text/x-patch
Size: 5448 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20100902/f7971289/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: slow_getent_test.c
Type: text/x-csrc
Size: 642 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20100902/f7971289/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Add-a-setpwent-result-object-timeout.patch.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20100902/f7971289/attachment.sig>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Add-a-setgrent-result-object-timeout.patch.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20100902/f7971289/attachment-0001.sig>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: slow_getent_test.c.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20100902/f7971289/attachment-0002.sig>


More information about the sssd-devel mailing list