arif/xcat-core
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

-Fix xcatd DoS/SSL negotiation global hang

Browse Source 
git-svn-id: https://svn.code.sf.net/p/xcat/code/xcat-core/trunk@943 8638fb3e-16cb-4fca-ae20-7b5d299a9bcd
This commit is contained in:
jbjohnso 2008-03-31 14:21:16 +00:00
parent 34a4a89bcc
commit bd9ad989ff
1 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
xCAT-server-2.0/sbin/xcatd
View File

@ -371,14 +371,10 @@ unless ($pid) {
}
$$progname="xcatd: SSL listener";
openlog("xCAT SSL","","local4");
my $listener = IO::Socket::SSL->new(
my $listener = IO::Socket::INET->new(
LocalPort => $port,
Listen => 64,
Reuse => 1,
SSL_key_file=>$xcatdir."/cert/server-key.pem",
SSL_cert_file=>$xcatdir."/cert/server-cert.pem",
SSL_ca_file=>$xcatdir."/cert/ca.pem",
SSL_verify_mode=> 1
);
unless ($listener) {
@ -397,7 +393,8 @@ xCAT_monitoring::monitorctrl::start($$);
my $peername;
until ($quit) {
next unless my $connection=$listener->accept;
next unless my $cnnection=$listener->accept;
my $connection;
my $child = xCAT::Utils->xfork(); #Yes we fork, IO::Socket::SSL is not threadsafe..
unless (defined $child) {
@ -406,6 +403,13 @@ until ($quit) {
if ($child == 0) {
$listener->close;
$connection = IO::Socket::SSL->start_SSL($cnnection,
SSL_key_file=>$xcatdir."/cert/server-key.pem",
SSL_cert_file=>$xcatdir."/cert/server-cert.pem",
SSL_ca_file=>$xcatdir."/cert/ca.pem",
SSL_server=>1,
SSL_verify_mode=> 1
);
my $peerhost=undef;
my $peer=$connection->peer_certificate("owner");
if ($peer) {
@ -438,7 +442,7 @@ if ($inet6support) {
service_connection($connection,$peername,$peerhost);
exit(0);
}
$connection->close(SSL_no_shutdown => 1); #Without no shutdown, you can guess what the client ends up thinking..
$cnnection->close();
}
$listener->close;