Security: sleep(5) on error + aggregating identical messages

diff --git a/bacula/src/dird/authenticate.c b/bacula/src/dird/authenticate.c
index 0d044b122f9191584290ae86eeab0219bddf25e7..0be30b7a36bb98fd8f0701796eae8b434501ab2b 100644 (file)
--- a/bacula/src/dird/authenticate.c
+++ b/bacula/src/dird/authenticate.c
@@ -328,6 +328,7 @@ int authenticate_user_agent(UAContext *uac)
    if (ua->msglen < 16 || ua->msglen >= MAX_NAME_LENGTH + 15) {
       Jmsg4(NULL, M_SECURITY, 0, _("UA Hello from %s:%s:%d is invalid. Len=%d\n"), ua->who(),
             ua->host(), ua->port(), ua->msglen);
+      sleep(5);
       return 0;
    }
 
@@ -336,6 +337,7 @@ int authenticate_user_agent(UAContext *uac)
       ua->msg[100] = 0;               /* terminate string */
       Jmsg4(NULL, M_SECURITY, 0, _("UA Hello from %s:%s:%d is invalid. Got: %s\n"), ua->who(),
             ua->host(), ua->port(), ua->msg);
+      sleep(5);
       return 0;
    }
 

diff --git a/bacula/src/filed/job.c b/bacula/src/filed/job.c
index 0d31ed19402cf13e9ad19bd4b13ee51fd9d8b8dd..8de8e3d6b87cb83f0af395d05017ff2010670992 100644 (file)
--- a/bacula/src/filed/job.c
+++ b/bacula/src/filed/job.c
@@ -506,6 +506,7 @@ bail_out:
    char addr[64];
    char *who = bs->get_peer(addr, sizeof(addr)) ? bs->who() : addr;
    Qmsg2(NULL, M_SECURITY, 0, _("FD expecting Hello got bad command from %s. Len=%d.\n"), who, bs->msglen);
+   sleep(5);
    bs->destroy();
    return NULL;
 }

diff --git a/bacula/src/lib/bsock.c b/bacula/src/lib/bsock.c
index ee7fbed3b899040b269f91223a71da0b588f284a..9269e5206d734f2abdce0fc95474a6bde34da0c5 100644 (file)
--- a/bacula/src/lib/bsock.c
+++ b/bacula/src/lib/bsock.c
@@ -512,10 +512,17 @@ int32_t BSOCK::recv()
    /* If signal or packet size too big */
    if (pktsiz < 0 || pktsiz > 1000000) {
       if (pktsiz > 0) {            /* if packet too big */
-         Qmsg4(m_jcr, M_FATAL, 0,
+         int m_type = M_FATAL;
+         if (!m_jcr) {
+            m_type = M_SECURITY;
+         }
+         Qmsg4(m_jcr, m_type, 0,
                _("Packet size=%d too big from \"%s:%s:%d\". Maximum permitted 1000000. Terminating connection.\n"),
                pktsiz, m_who, m_host, m_port);
          pktsiz = BNET_TERMINATE;  /* hang up */
+         if (m_type == M_SECURITY) {
+            sleep(5);
+         }
       }
       if (pktsiz == BNET_TERMINATE) {
          set_terminated();

diff --git a/bacula/src/lib/message.c b/bacula/src/lib/message.c
index 602d0d07f717aef62d6b9f9550d583d33e71e701..786853b7de282ded0407ea8e6f8b214f841743bb 100644 (file)
--- a/bacula/src/lib/message.c
+++ b/bacula/src/lib/message.c
@@ -11,7 +11,7 @@
    Public License, v3.0 ("AGPLv3") and some additional permissions and
    terms pursuant to its AGPLv3 Section 7.
 
-   This notice must be preserved when any source code is 
+   This notice must be preserved when any source code is
    conveyed and/or propagated.
 
    Bacula(R) is a registered trademark of Kern Sibbald.
@@ -1697,7 +1697,7 @@ void Qmsg(JCR *jcr, int type, utime_t mtime, const char *fmt,...)
    va_list   arg_ptr;
    int len, maxlen;
    POOLMEM *pool_buf;
-   MQUEUE_ITEM *item;
+   MQUEUE_ITEM *item, *last_item;
 
    pool_buf = get_pool_memory(PM_EMSG);
 
@@ -1714,6 +1714,7 @@ void Qmsg(JCR *jcr, int type, utime_t mtime, const char *fmt,...)
    }
    item = (MQUEUE_ITEM *)malloc(sizeof(MQUEUE_ITEM) + strlen(pool_buf) + 1);
    item->type = type;
+   item->repeat = 0;
    item->mtime = time(NULL);
    strcpy(item->msg, pool_buf);
    if (!jcr) {
@@ -1729,7 +1730,20 @@ void Qmsg(JCR *jcr, int type, utime_t mtime, const char *fmt,...)
       syslog(LOG_DAEMON|LOG_ERR, "%s", item->msg);
       P(daemon_msg_queue_mutex);
       if (daemon_msg_queue) {
-         daemon_msg_queue->append(item);
+         if (item->type == M_SECURITY) {  /* can be repeated */
+            /* Keep repeat count of identical messages */
+            last_item = (MQUEUE_ITEM *)daemon_msg_queue->last();
+            if (last_item) {
+               if (strcmp(last_item->msg, item->msg) == 0) {
+                  last_item->repeat++;
+                  free(item);
+                  item = NULL;
+               }
+            }
+         }
+         if (item) {
+            daemon_msg_queue->append(item);
+         }
       }
       V(daemon_msg_queue_mutex);
    } else {
@@ -1761,7 +1775,12 @@ void dequeue_daemon_messages(JCR *jcr)
          if (item->type == M_FATAL || item->type == M_ERROR) {
             item->type = M_SECURITY;
          }
-         Jmsg(jcr, item->type, item->mtime, "%s", item->msg);
+         if (item->repeat == 0) {
+            Jmsg(jcr, item->type, item->mtime, "%s", item->msg);
+         } else {
+            Jmsg(jcr, item->type, item->mtime, "Message repeated %d times: %s",
+                 item->repeat, item->msg);
+         }
       }
       if (jcr->dir_bsock) jcr->dir_bsock->suppress_error_messages(false);
       /* Remove messages just sent */

diff --git a/bacula/src/lib/message.h b/bacula/src/lib/message.h
index b76f36e1d05958aa6b5325e27e0e160114495867..f4a63818f2ade6c7bbcad0c0ea3a2ecf2b6f1d3e 100644 (file)
--- a/bacula/src/lib/message.h
+++ b/bacula/src/lib/message.h
@@ -1,7 +1,7 @@
 /*
    Bacula(R) - The Network Backup Solution
 
-   Copyright (C) 2000-2017 Kern Sibbald
+   Copyright (C) 2000-2018 Kern Sibbald
 
    The original author of Bacula is Kern Sibbald, with contributions
    from many others, a complete list can be found in the file AUTHORS.
@@ -11,7 +11,7 @@
    Public License, v3.0 ("AGPLv3") and some additional permissions and
    terms pursuant to its AGPLv3 Section 7.
 
-   This notice must be preserved when any source code is 
+   This notice must be preserved when any source code is
    conveyed and/or propagated.
 
    Bacula(R) is a registered trademark of Kern Sibbald.
@@ -63,8 +63,8 @@
  *
  *  M_RESTORED    An ls -l of each restored file.
  *
- *  M_SECURITY    For security viloations. This is equivalent to FATAL.
- *                (note, this is currently being implemented in 1.33).
+ *  M_SECURITY    For security alerts. This is equivalent to FATAL, but
+ *                  generally occurs in a daemon with no JCR.
  *
  *  M_ALERT       For Tape Alert messages.
  *
@@ -127,9 +127,10 @@ enum {
 /* Queued message item */
 struct MQUEUE_ITEM {
    dlink link;
-   int type;
-   utime_t mtime;
-   char msg[1];
+   int type;                          /* message M_ type */
+   int repeat;                        /* count of identical messages */
+   utime_t mtime;                     /* time stamp message queued */
+   char msg[1];                       /* message text */
 };
 
 /* Debug options */

diff --git a/bacula/src/stored/hello.c b/bacula/src/stored/hello.c
index 4c5ac2a091517739482348da807294f11454236d..e027836ad07ef5820a97909465346f1ec683c449 100644 (file)
--- a/bacula/src/stored/hello.c
+++ b/bacula/src/stored/hello.c
@@ -75,6 +75,7 @@ bool validate_dir_hello(JCR* jcr)
             dir->who(), dir->msglen);
       Qmsg2(jcr, M_SECURITY, 0, _("Bad Hello command from Director at %s. Len=%d.\n"),
             dir->who(), dir->msglen);
+      sleep(5);
       return false;
    }
    dirname = get_pool_memory(PM_MESSAGE);
@@ -90,6 +91,7 @@ bool validate_dir_hello(JCR* jcr)
       Qmsg2(jcr, M_SECURITY, 0, _("Bad Hello command from Director at %s: %s\n"),
             dir->who(), dir->msg);
       free_pool_memory(dirname);
+      sleep(5);
       return false;
    }
 
@@ -113,6 +115,7 @@ bool validate_dir_hello(JCR* jcr)
             "Please see " MANUAL_AUTH_URL " for help.\n"),
             dirname, dir->who());
       free_pool_memory(dirname);
+      sleep(5);
       return false;
    }
    jcr->director = director;
@@ -150,6 +153,7 @@ void handle_client_connection(BSOCK *fd)
        sscanf(fd->msg, "Hello FD: Bacula Storage calling Start Job %127s %d", job_name, &sd_version) != 2 &&
        sscanf(fd->msg, "Hello Start Job %127s", job_name) != 1) {
       Qmsg2(NULL, M_SECURITY, 0, _("Invalid Hello from %s. Len=%d\n"), fd->who(), fd->msglen);
+      sleep(5);
       fd->destroy();
       return;
    }
@@ -157,6 +161,7 @@ void handle_client_connection(BSOCK *fd)
    if (!(jcr=get_jcr_by_full_name(job_name))) {
       Qmsg1(NULL, M_SECURITY, 0, _("Client connect failed: Job name not found: %s\n"), job_name);
       Dmsg1(3, "**** Job \"%s\" not found.\n", job_name);
+      sleep(5);
       fd->destroy();
       return;
    }
@@ -224,6 +229,9 @@ bail_out:
    }
    pthread_cond_signal(&jcr->job_start_wait); /* wake waiting job */
    free_jcr(jcr);
+   if (!jcr->authenticated) {
+      sleep(5);
+   }
    return;
 }