Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jsherwood0 update apache_rocketmq_update_config.rb to eliminate hang on check #19038

Conversation

jsherwood0
Copy link
Contributor

Add a timeout to eliminate the hang in the check method

This fix is to ensure that if all else fails, the check will timeout and allow progress to continue instead of hanging on a host that does not reply as expected. This addresses Issue #19035.

Verification

List the steps needed to make sure this thing works

  • Start msfconsole
  • use exploit/multi/http/apache_rocketmq_update_config
  • Set RHOSTS and RPORT to host/port that is not responding as RocketMQ should (e.g., it's down or its not RocketMQ)
  • check
  • Verify that the check will eventually time out even if it does not receive an expected RocketMQ response.
  • Verify that the check does not hang on servers that fail to respond as expected.

Add a timeout to eliminate the hang in the check method
Eliminate rescue with no specific exception types.
Comment on lines +74 to +76
::Timeout.timeout(datastore['ConnectTimeout']) do
@version_request_response = send_version_request
end
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My same concerns from here apply as well.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My same response from here applies to this change also.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This would be better implemented as a change of this to be timed_read(1024) and then an adjustment here to handle nil and return CheckCode::Unknown.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That seems to work pretty well, though the rescue after the timed_read should probably only print the stack trace when VERBOSE is set. There's no point in dumping a stack trace for known situations like timeouts, refused connections, unreachable hosts, etc. Did you want me to close this pull request so that you can submit your fix?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you want to make the changes, I can get them landed since we're both familiar with the issue at this point. If you'd prefer to not, then sure I can get a PR submitted.

@smcintyre-r7
Copy link
Contributor

These changes were implemented in #19141 so I'm going to close this out as a duplicate. Thanks for raising the issue to our attention.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

2 participants