[issue1745035] DoS smtpd vulnerability

2010-11-23 Thread Savio Sena
Savio Sena added the comment: size_limits are not class attributes instead of instance attributes, as suggested by giampaolo.rodola. -- Added file: http://bugs.python.org/file19790/issue1745035-101123-saviosena.diff ___ Python tracker <h

[issue1745035] DoS smtpd vulnerability

2010-11-23 Thread Savio Sena
Savio Sena added the comment: Previous patch was incorrect. I'm attaching another one, I'm really sorry. @giampaolo, about making the limits class attributes, it's not a good idea IMHO. According to RFC1869 command sizes can change depending on which Service Extension

[issue1745035] DoS smtpd vulnerability

2010-11-23 Thread Savio Sena
Savio Sena added the comment: Attaching a more concise patch, as requested by georg.brandl. -- Added file: http://bugs.python.org/file19787/issue1745035-101123-saviosena.diff ___ Python tracker <http://bugs.python.org/issue1745

[issue1745035] DoS smtpd vulnerability

2010-11-21 Thread Savio Sena
Savio Sena added the comment: The attached patch adopts the minimalistic approach described in previous post. It pretends to implement Message Size Extension, defining a maximum message data size to 32M bytes and maximum command length to 512 bytes. In my opinion this is the best way to

[issue1745035] DoS smtpd vulnerability

2010-11-20 Thread Savio Sena
Savio Sena added the comment: The definite (and only?) solution would be to implement 'Message Size Declaration[1]' Service Extension[2]. We can limit the size of commands and text lines, but not the message size as a whole[3]. RFC1870 was created exactly with the purpose of s

[issue1745035] DoS smtpd vulnerability

2010-11-20 Thread Savio Sena
Changes by Savio Sena : -- nosy: +saviosena ___ Python tracker <http://bugs.python.org/issue1745035> ___ ___ Python-bugs-list mailing list Unsubscribe: