search

bloocoin / bloocoin-server

The server software required to run a BlooCoin instance.
4 stars 10 forks source link

Incoming Connection Handling Needs to be Fixed #11

Open ajvpot opened 11 years ago

ajvpot commented 11 years ago

The current socket listen loop doesn't send the data off to a thread until it receives data. If you open a socket to the Bloocoin server and don't send any data, it blocks the main thread indefinitely. This creates a very simple DoS vulnerability.

JosephRedfern commented 11 years ago

It might be possible to use the SocketServer Python Module to fix this fairly easily.

f-prime commented 11 years ago

Ahh, this is why there is this random down time.

sysr-q commented 11 years ago

You should move to an async lib like gevent or Twisted if you feel serious about it. Whilst those are reasonably larger dependencies, they'd make it fucking easy as shit to run.

JosephRedfern commented 11 years ago

@plausibility - agreed, we need something more "robust". My commit was just meant to be a quick fix.

sysr-q commented 11 years ago

@JosephRedfern: It wouldn't be a small update, you'd probably be rewriting a significant amount of core code - the only bit which would stay reasonably similar would be how your commands are dispatched to classes. @Max00355 is the guy to ask for all things rewrite-y.

JosephRedfern commented 11 years ago

@plausibility - I was suggesting that https://github.com/bloocoin/bloocoin-server/issues/12 is a quick fix, with your suggestion of gevent/Twisted being something more long-term.

sysr-q commented 11 years ago

Definitely worth looking into, since as demonstrated, a non-closed socket can hang the entire operation.