mirror of
https://blitiri.com.ar/repos/chasquid
synced 2026-10-29 15:02:30 +00:00
Alberto Bertogli
6dc05d2aad
Today, if Accept returns an error, we exit the daemon. Unfortunately this is not that difficult to trigger: a remote client can open a large number of connections to reach the limit of file descriptors. This patch makes the server retry instead, with an exponential backoff (up to 1s). This is a compromise to improve handling of such scenarios without introducing a lot of complexity. The problem can still be triggered but this change makes the daemon more resilient to it (and it will be improved further in follow-up patches). Users who have to be very defensive can deploy OS-level safeguards (such as firewall rules to limit number of connections, etc.) which are more effective and tunable. Thanks to John JEAN <john@wargan.com> for finding and reporting this problem. The detailed report can be found in https://johnjean.io/advisories/chasquid-unauthenticated-remote-dos/.