[prev in list] [next in list] [prev in thread] [next in thread] 

List:       mandoc-source
Subject:    mdocml: limit CGI process execution time to make REDoS attacks less
From:       schwarze () mdocml ! bsd ! lv
Date:       2014-08-21 16:05:22
Message-ID: 201408211605.s7LG5M9m024498 () krisdoz ! my ! domain
[Download RAW message or body]

Log Message:
-----------
limit CGI process execution time to make REDoS attacks less effective;
attack surface pointed out by Sebastien Marie

Modified Files:
--------------
    mdocml:
        cgi.c

Revision Data
-------------
Index: cgi.c
===================================================================
RCS file: /usr/vhosts/mdocml.bsd.lv/cvs/mdocml/cgi.c,v
retrieving revision 1.94
retrieving revision 1.95
diff -Lcgi.c -Lcgi.c -u -p -r1.94 -r1.95
--- cgi.c
+++ cgi.c
@@ -18,6 +18,7 @@
 #include "config.h"
 
 #include <sys/types.h>
+#include <sys/time.h>
 
 #include <ctype.h>
 #include <errno.h>
@@ -1029,9 +1030,22 @@ int
 main(void)
 {
 	struct req	 req;
+	struct itimerval itimer;
 	const char	*path;
 	const char	*querystring;
 	int		 i;
+
+	/* Poor man's ReDoS mitigation. */
+
+	itimer.it_value.tv_sec = 1;
+	itimer.it_value.tv_usec = 0;
+	itimer.it_interval.tv_sec = 1;
+	itimer.it_interval.tv_usec = 0;
+	if (setitimer(ITIMER_VIRTUAL, &itimer, NULL) == -1) {
+		fprintf(stderr, "setitimer: %s\n", strerror(errno));
+		pg_error_internal();
+		return(EXIT_FAILURE);
+	}
 
 	/* Scan our run-time environment. */
 
--
 To unsubscribe send an email to source+unsubscribe@mdocml.bsd.lv

[prev in list] [next in list] [prev in thread] [next in thread]