diff options
author | Joey Hess <joeyh@joeyh.name> | 2016-12-09 13:34:00 -0400 |
---|---|---|
committer | Joey Hess <joeyh@joeyh.name> | 2016-12-09 13:34:32 -0400 |
commit | 6aac10c5215e822b2252897b777b41b97abbfb33 (patch) | |
tree | 27e4dccea180a5f44e9fbc96977ba08a9566de9f /Command | |
parent | 2ae57936186caad6c025184104efb2bb9d28571a (diff) |
git-annex-shell, remotedaemon, git remote: Fix some memory DOS attacks.
The attacker could just send a very lot of data, with no \n and it would
all be buffered in memory until the kernel killed git-annex or perhaps OOM
killed some other more valuable process.
This is a low impact security hole, only affecting communication between
local git-annex and git-annex-shell on the remote system. (With either
able to be the attacker). Only those with the right ssh key can do it. And,
there are probably lots of ways to construct git repositories that make git
use a lot of memory in various ways, which would have similar impact as
this attack.
The fix in P2P/IO.hs would have been higher impact, if it had made it to a
released version, since it would have allowed DOSing the tor hidden
service without needing to authenticate.
(The LockContent and NotifyChanges instances may not be really
exploitable; since the line is read and ignored, it probably gets read
lazily and does not end up staying buffered in memory.)
Diffstat (limited to 'Command')
-rw-r--r-- | Command/LockContent.hs | 3 | ||||
-rw-r--r-- | Command/NotifyChanges.hs | 3 | ||||
-rw-r--r-- | Command/TransferInfo.hs | 3 |
3 files changed, 6 insertions, 3 deletions
diff --git a/Command/LockContent.hs b/Command/LockContent.hs index 35342c529..202ba20d1 100644 --- a/Command/LockContent.hs +++ b/Command/LockContent.hs @@ -10,6 +10,7 @@ module Command.LockContent where import Command import Annex.Content import Remote.Helper.Ssh (contentLockedMarker) +import Utility.SimpleProtocol cmd :: Command cmd = noCommit $ @@ -37,7 +38,7 @@ start [ks] = do ( liftIO $ do putStrLn contentLockedMarker hFlush stdout - _ <- getLine + _ <- getProtocolLine stdin return True , return False ) diff --git a/Command/NotifyChanges.hs b/Command/NotifyChanges.hs index f1c149d54..bb9b10eee 100644 --- a/Command/NotifyChanges.hs +++ b/Command/NotifyChanges.hs @@ -13,6 +13,7 @@ import Utility.DirWatcher.Types import qualified Git import Git.Sha import RemoteDaemon.Transport.Ssh.Types +import Utility.SimpleProtocol import Control.Concurrent import Control.Concurrent.Async @@ -52,7 +53,7 @@ start = do -- No messages need to be received from the caller, -- but when it closes the connection, notice and terminate. - let receiver = forever $ void getLine + let receiver = forever $ void $ getProtocolLine stdin void $ liftIO $ concurrently sender receiver stop diff --git a/Command/TransferInfo.hs b/Command/TransferInfo.hs index 6870c84f0..1db633484 100644 --- a/Command/TransferInfo.hs +++ b/Command/TransferInfo.hs @@ -13,6 +13,7 @@ import Types.Transfer import Logs.Transfer import qualified CmdLine.GitAnnexShell.Fields as Fields import Utility.Metered +import Utility.SimpleProtocol cmd :: Command cmd = noCommit $ @@ -62,4 +63,4 @@ start (k:[]) = do start _ = giveup "wrong number of parameters" readUpdate :: IO (Maybe Integer) -readUpdate = readish <$> getLine +readUpdate = maybe Nothing readish <$> getProtocolLine stdin |