389-ds-base

#50398 Ticket 50329 - (2nd) Possible Security Issue: DOS due to ioblocktimeout not applying to TLS
Closed by spichugi. Opened by tbordaz.
tbordaz/389-ds-base ticket-50329  into  master

Download 50398.patch

Bug Description:
A secure socket is configured in blocking mode. If an event
is detected on a secure socket a worker tries to receive the request.
If handshake occurs during the read, it can hang longer than
ioblocktimeout because it takes into account the socket option
rather than the timeout used for the ssl_Recv

Fix Description:
The fix is specific to secure socket and set this socket option
to do non blocking IO.

https://bugzilla.redhat.com/show_bug.cgi?id=1668457

Reviewed by: ?

Platforms tested: F28

Flag Day: no

Doc impact: no

This patch has been tested since May 17th. So far no regression reported and original issues (hanging ssl connection and replication delay/hang) do no longer happen

rebased onto f20e982c68a700b5ba2c41e5b6f3cdeb5fcb5fab

anyone would be interested reviewing it ? :)

LGTM

You have my ack, Thierry, although somehow halffolded. ;)

Thanks @mreynolds thanks @mhonek

Pull-Request has been merged by tbordaz

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/3456

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.

Pull-Request has been closed by spichugi
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.