upstream/openvpn
1
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn.git synced 2026-05-28 04:03:29 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fixed port-share bug with DoS potential

Browse source 
Fixed port-share bug that can cause segfault when the number
of concurrent connections is large.

The issue is that the port-share code calls openvpn_connect()
which in turn calls select().  When there are a high number
of concurrent port-share connections, the fd passed to select
can potentially exceed FD_SETSIZE, causing undefined behavior.

The fix is to use poll() (if available) instead of select().

Signed-off-by: James Yonan <james@openvpn.net>
Acked-by: Steffan Karger <steffan.karger@fox-it.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <CAA1Abx+2E2FZN-y6P=mkKpSuZ7bOV5m6rUMTx3V7UP2qPMjZPg@mail.gmail.com>
URL: http://article.gmane.org/gmane.network.openvpn.devel/11626
Signed-off-by: Gert Doering <gert@greenie.muc.de>
This commit is contained in:
James Yonan 2016-03-03 00:48:12 -07:00 committed by Gert Doering
parent f40f10ea96
commit 007738e9d6
1 changed files with 7 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/openvpn/socket.c
View file

@ -1149,6 +1149,12 @@ openvpn_connect (socket_descriptor_t sd,
{
while (true)
{
#if POLL
struct pollfd fds[1];
fds[0].fd = sd;
fds[0].events = POLLOUT;
status = poll(fds, 1, 0);
#else
fd_set writes;
struct timeval tv;
@ -1158,7 +1164,7 @@ openvpn_connect (socket_descriptor_t sd,
tv.tv_usec = 0;
status = select (sd + 1, NULL, &writes, NULL, &tv);
#endif
if (signal_received)
{
get_signal (signal_received);