Files
deb-python-eventlet/eventlet/greenio
Sergey Shepelev 52472ac9c6 ssl: IMPORTANT DoS FIX do_handshake_connect=False in server accept(); Thanks to Garth Mollett
Default is: accept - handshake (blocking) - return new connection
Now: accept - return new connection, some time later handshake will be done implicitly

Usual server code:

    while server.alive:
      conn, addr = listener.accept()
      server.pool.spawn(server.process, conn, addr)

is vulnerable to a simple DoS attack, where evil client connects to HTTPS socket and does not perform handshake,
thus blocking server in `accept()` so no other clients can be accepted.
2016-02-29 00:54:08 +05:00
..
2015-10-13 13:36:20 +03:00