Uploaded image for project: 'CFEngine Community'
  1. CFEngine Community
  2. CFE-2556

PROTOCOL_COMMAND_GET should close connection when reading of file fails

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Open
    • Priority: Medium
    • Resolution: Unresolved
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: cf-serverd
    • Labels:
      None

      Description

      When a GET operation fails (e.g. because file exists but is not readable by the user running cf-serverd), the client will stuck in TLSRecv() until a timeout happens.

      Details: in server_tls.c GET is implemented as

          case PROTOCOL_COMMAND_GET:
              ...
              CfGetFile(&get_args);
      
              return true;
      

      and CfGetFile() as

          if ((fd = safe_open(filename, O_RDONLY)) == -1)
          {
              Log(LOG_LEVEL_ERR, "Open error of file '%s'. (open: %s)",
                  filename, GetErrorStr());
              snprintf(sendbuffer, CF_BUFSIZE, "%s", CF_FAILEDSTR);
      
                  TLSSend(ConnectionInfoSSL(conn_info), sendbuffer, args->buf_size);
      

      SECURITY-NOTE: this leaks stack content (a little bit less than 2048 bytes) to the client!

      Counter part on client does

              case CF_PROTOCOL_TLS:
                  n_read = TLSRecv(conn->conn_info->ssl, buf, toget);
      

      which will run into a timeout.

      NOTES: this happens here very often because '.tramp_history' files with 0600 permissions are created by the editor.

        Attachments

          Activity

            People

            • Assignee:
              a10003 Eystein Maloy Stenberg
              Reporter:
              ensc Enrico Scholz
            • Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

              • Created:
                Updated:

                Summary Panel