From 8664d74966035c17d1582c19df199f7ad0beef3d Mon Sep 17 00:00:00 2001 From: =?utf8?q?Giampaolo=20Rodol=C3=A0?= Date: Mon, 23 Aug 2010 22:48:51 +0000 Subject: [PATCH] Merged revisions 84289 via svnmerge from svn+ssh://pythondev@svn.python.org/python/branches/py3k ........ r84289 | giampaolo.rodola | 2010-08-24 00:28:13 +0200 (mar, 24 ago 2010) | 1 line fix issue 9129: adds proper error handling on accept() when smtpd accepts new incoming connections. ........ --- Lib/smtpd.py | 25 +++++++++++++++++++++++-- Misc/NEWS | 3 +++ 2 files changed, 26 insertions(+), 2 deletions(-) diff --git a/Lib/smtpd.py b/Lib/smtpd.py index c3bd6a5add..2d17b8ddd1 100755 --- a/Lib/smtpd.py +++ b/Lib/smtpd.py @@ -121,7 +121,15 @@ class SMTPChannel(asynchat.async_chat): self.__rcpttos = [] self.__data = '' self.__fqdn = socket.getfqdn() - self.__peer = conn.getpeername() + try: + self.__peer = conn.getpeername() + except socket.error, err: + # a race condition may occur if the other end is closing + # before we can get the peername + self.close() + if err[0] != errno.ENOTCONN: + raise + return print >> DEBUGSTREAM, 'Peer:', repr(self.__peer) self.push('220 %s %s' % (self.__fqdn, __version__)) self.set_terminator('\r\n') @@ -291,7 +299,20 @@ class SMTPServer(asyncore.dispatcher): localaddr, remoteaddr) def handle_accept(self): - conn, addr = self.accept() + try: + conn, addr = self.accept() + except TypeError: + # sometimes accept() might return None + return + except socket.error, err: + # ECONNABORTED might be thrown + if err[0] != errno.ECONNABORTED: + raise + return + else: + # sometimes addr == None instead of (ip, port) + if addr == None: + return print >> DEBUGSTREAM, 'Incoming connection from %s' % repr(addr) channel = SMTPChannel(self, conn, addr) diff --git a/Misc/NEWS b/Misc/NEWS index fe9be71603..1e352bce9a 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -31,6 +31,9 @@ Core and Builtins Library ------- +- Issue #9129: smtpd.py is vulnerable to DoS attacks deriving from missing + error handling when accepting a new connection. + - Issue #658749: asyncore's connect() method now correctly interprets winsock errors. -- 2.50.1