yahns Ruby server user/dev discussion
 help / color / Atom feed
From: Eric Wong <e@80x24.org>
To: yahns-public@yhbt.net
Cc: Eric Wong <e@80x24.org>
Subject: [PATCH 1/3] proxy_pass: avoid TOCTTOU race when unbuffering, too
Date: Tue,  5 Jul 2016 13:50:14 +0000
Message-ID: <20160705135016.14274-2-e@80x24.org> (raw)
In-Reply-To: <20160705135016.14274-1-e@80x24.org>

proxy_unbuffer is vulnerable to the same race condition
we avoided in commit 5328992829b2
("proxy_pass: fix race condition due to flawed hijack check")
---
 lib/yahns/proxy_http_response.rb | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/lib/yahns/proxy_http_response.rb b/lib/yahns/proxy_http_response.rb
index 0ca2c34..a37b387 100644
--- a/lib/yahns/proxy_http_response.rb
+++ b/lib/yahns/proxy_http_response.rb
@@ -13,10 +13,8 @@ module Yahns::HttpResponse # :nodoc:
   def proxy_unbuffer(wbuf, nxt = :ignore)
     @state = wbuf
     wbuf.req_res = nil if nxt.nil? && wbuf.respond_to?(:req_res=)
-    tc = Thread.current
-    tc[:yahns_fdmap].remember(self) # Yahns::HttpClient
-    tc[:yahns_queue].queue_mod(self, wbuf.busy == :wait_readable ?
-                               Yahns::Queue::QEV_RD : Yahns::Queue::QEV_WR)
+    proxy_wait_next(wbuf.busy == :wait_readable ? Yahns::Queue::QEV_RD :
+                    Yahns::Queue::QEV_WR)
     nxt
   end
 
-- 
EW


  reply index

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-07-05 13:50 [PATCH 0/3] another round of proxy_pass fixes Eric Wong
2016-07-05 13:50 ` Eric Wong [this message]
2016-07-05 13:50 ` [PATCH 2/3] proxy_pass: avoid accessing logger in env after hijacking Eric Wong
2016-07-05 13:50 ` [PATCH 3/3] proxy_pass: avoid stuck responses in "proxy_buffering: false" Eric Wong

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://yhbt.net/yahns/README

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20160705135016.14274-2-e@80x24.org \
    --to=e@80x24.org \
    --cc=yahns-public@yhbt.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

yahns Ruby server user/dev discussion

Archives are clonable:
	git clone --mirror https://yhbt.net/yahns-public
	git clone --mirror http://ou63pmih66umazou.onion/yahns-public

Newsgroups are available over NNTP:
	nntp://news.public-inbox.org/inbox.comp.lang.ruby.yahns
	nntp://ou63pmih66umazou.onion/inbox.comp.lang.ruby.yahns

 note: .onion URLs require Tor: https://www.torproject.org/

AGPL code for this site: git clone https://public-inbox.org/ public-inbox