|
 |
8ed14c |
From a6e5d53a358f3871d8ae646b252250d215d09883 Mon Sep 17 00:00:00 2001
|
|
|
8ed14c |
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
|
|
|
8ed14c |
Date: Wed, 16 Jun 2021 15:28:28 +0200
|
|
|
8ed14c |
Subject: [PATCH] kcm: terminate client on bad message
|
|
|
8ed14c |
|
|
|
8ed14c |
The debug message clearly says that the original intention was to
|
|
|
8ed14c |
abort the client, not send an error message.
|
|
|
8ed14c |
|
|
|
8ed14c |
We may end up in a state where we get into an infinit loop, fo example
|
|
|
8ed14c |
when the client send an message that indicates 0 lenght, but there is
|
|
|
8ed14c |
actually more data written. In this case, we never read the rest of the
|
|
|
8ed14c |
message but the file descriptor is still readable so the fd handler gets
|
|
|
8ed14c |
fired again and again.
|
|
|
8ed14c |
|
|
|
8ed14c |
More information can be seen in relevant FreeIPA ticket:
|
|
|
8ed14c |
https://pagure.io/freeipa/issue/8877
|
|
|
8ed14c |
|
|
|
8ed14c |
Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
|
|
|
8ed14c |
Reviewed-by: Pawel Polawski <ppolawsk@redhat.com>
|
|
|
8ed14c |
---
|
|
|
8ed14c |
src/responder/kcm/kcmsrv_cmd.c | 11 +++++------
|
|
|
8ed14c |
1 file changed, 5 insertions(+), 6 deletions(-)
|
|
|
8ed14c |
|
|
|
8ed14c |
diff --git a/src/responder/kcm/kcmsrv_cmd.c b/src/responder/kcm/kcmsrv_cmd.c
|
|
|
8ed14c |
index 49518920b..9b27bbdcc 100644
|
|
|
8ed14c |
--- a/src/responder/kcm/kcmsrv_cmd.c
|
|
|
8ed14c |
+++ b/src/responder/kcm/kcmsrv_cmd.c
|
|
|
8ed14c |
@@ -548,7 +548,8 @@ static void kcm_recv(struct cli_ctx *cctx)
|
|
|
8ed14c |
DEBUG(SSSDBG_FATAL_FAILURE,
|
|
|
8ed14c |
"Failed to parse data (%d, %s), aborting client\n",
|
|
|
8ed14c |
ret, sss_strerror(ret));
|
|
|
8ed14c |
- goto fail;
|
|
|
8ed14c |
+ talloc_free(cctx);
|
|
|
8ed14c |
+ return;
|
|
|
8ed14c |
}
|
|
|
8ed14c |
|
|
|
8ed14c |
/* do not read anymore, client is done sending */
|
|
|
8ed14c |
@@ -559,15 +560,13 @@ static void kcm_recv(struct cli_ctx *cctx)
|
|
|
8ed14c |
DEBUG(SSSDBG_FATAL_FAILURE,
|
|
|
8ed14c |
"Failed to dispatch KCM operation [%d]: %s\n",
|
|
|
8ed14c |
ret, sss_strerror(ret));
|
|
|
8ed14c |
- goto fail;
|
|
|
8ed14c |
+ /* Fail with reply */
|
|
|
8ed14c |
+ kcm_reply_error(cctx, ret, &req->repbuf);
|
|
|
8ed14c |
+ return;
|
|
|
8ed14c |
}
|
|
|
8ed14c |
|
|
|
8ed14c |
/* Dispatched request resumes in kcm_cmd_request_done */
|
|
|
8ed14c |
return;
|
|
|
8ed14c |
-
|
|
|
8ed14c |
-fail:
|
|
|
8ed14c |
- /* Fail with reply */
|
|
|
8ed14c |
- kcm_reply_error(cctx, ret, &req->repbuf);
|
|
|
8ed14c |
}
|
|
|
8ed14c |
|
|
|
8ed14c |
static int kcm_send_data(struct cli_ctx *cctx)
|
|
|
8ed14c |
--
|
|
|
8ed14c |
2.26.3
|
|
|
8ed14c |
|