|
 |
39f53b |
From 6e5b9924b172be4f33c7fc264a8ff1d6109b79fe Mon Sep 17 00:00:00 2001
|
|
|
39f53b |
From: Frediano Ziglio <freddy77@gmail.com>
|
|
|
39f53b |
Date: Sun, 20 Sep 2020 08:05:37 +0100
|
|
|
39f53b |
Subject: [PATCH vd_agent_linux 12/17] Avoids unlimited agent connections
|
|
|
39f53b |
|
|
|
39f53b |
Limit the number of agents that can be connected.
|
|
|
39f53b |
Avoids reaching the maximum number of files in a process.
|
|
|
39f53b |
Beside one file descriptor per agent the daemon open just some
|
|
|
39f53b |
other fixed number of files.
|
|
|
39f53b |
|
|
|
39f53b |
This issue was reported by SUSE security team.
|
|
|
39f53b |
|
|
|
39f53b |
Signed-off-by: Frediano Ziglio <freddy77@gmail.com>
|
|
|
39f53b |
---
|
|
|
39f53b |
src/udscs.c | 12 ++++++++++++
|
|
|
39f53b |
1 file changed, 12 insertions(+)
|
|
|
39f53b |
|
|
|
39f53b |
diff --git a/src/udscs.c b/src/udscs.c
|
|
|
39f53b |
index 7c99eed..3df67b3 100644
|
|
|
39f53b |
--- a/src/udscs.c
|
|
|
39f53b |
+++ b/src/udscs.c
|
|
|
39f53b |
@@ -30,6 +30,12 @@
|
|
|
39f53b |
#include "vdagentd-proto-strings.h"
|
|
|
39f53b |
#include "vdagent-connection.h"
|
|
|
39f53b |
|
|
|
39f53b |
+// Maximum number of connected agents.
|
|
|
39f53b |
+// Avoid DoS from agents.
|
|
|
39f53b |
+// As each connection end up taking a file descriptor is good to have a limit
|
|
|
39f53b |
+// less than the number of file descriptors in the process (by default 1024).
|
|
|
39f53b |
+#define MAX_CONNECTED_AGENTS 128
|
|
|
39f53b |
+
|
|
|
39f53b |
struct _UdscsConnection {
|
|
|
39f53b |
VDAgentConnection parent_instance;
|
|
|
39f53b |
int debug;
|
|
|
39f53b |
@@ -254,6 +260,12 @@ static gboolean udscs_server_accept_cb(GSocketService *service,
|
|
|
39f53b |
struct udscs_server *server = user_data;
|
|
|
39f53b |
UdscsConnection *new_conn;
|
|
|
39f53b |
|
|
|
39f53b |
+ /* prevents DoS having too many agents attached */
|
|
|
39f53b |
+ if (g_list_length(server->connections) >= MAX_CONNECTED_AGENTS) {
|
|
|
39f53b |
+ syslog(LOG_ERR, "Too many agents connected");
|
|
|
39f53b |
+ return TRUE;
|
|
|
39f53b |
+ }
|
|
|
39f53b |
+
|
|
|
39f53b |
new_conn = g_object_new(UDSCS_TYPE_CONNECTION, NULL);
|
|
|
39f53b |
new_conn->debug = server->debug;
|
|
|
39f53b |
new_conn->read_callback = server->read_callback;
|
|
|
39f53b |
--
|
|
|
39f53b |
2.26.2
|
|
|
39f53b |
|