From 8b7cbc2dcced1334e2829a722d456cfa4105cf1c Mon Sep 17 00:00:00 2001
From: Valera V Harseko <vharseko@3a-systems.ru>
Date: Wed, 21 Oct 2026 08:53:55 +0000
Subject: [PATCH] GHSA-7778-jm7p-68g5 LDAP listener lets unauthenticated clients hold connections until the server stops accepting new ones
---
opendj-server-legacy/src/main/java/org/opends/server/config/AdministrationConnector.java | 20 ++++++++++++++++++++
1 files changed, 20 insertions(+), 0 deletions(-)
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/config/AdministrationConnector.java b/opendj-server-legacy/src/main/java/org/opends/server/config/AdministrationConnector.java
index 0e86df7..0643bc8 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/config/AdministrationConnector.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/config/AdministrationConnector.java
@@ -13,6 +13,7 @@
*
* Copyright 2006-2010 Sun Microsystems, Inc.
* Portions Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
*/
package org.opends.server.config;
@@ -100,6 +101,13 @@
private static final int ADMIN_MAX_REQUEST_SIZE = 5000000;
private static final int ADMIN_WRITE_BUFFER_SIZE = 4096;
private static final int ADMIN_NUM_REQUEST_HANDLERS = 4;
+ /** 1mn, the default of an LDAP connection handler. */
+ private static final long ADMIN_FIRST_REQUEST_TIME_LIMIT = 60000;
+ /**
+ * The default of an LDAP connection handler: the only bound on the connections from one address, since
+ * max-allowed-client-connections never rejects a connection to the administration connector.
+ */
+ private static final int ADMIN_MAX_CLIENT_CONNECTIONS_PER_ADDRESS = 1024;
private static final boolean ADMIN_SEND_REJECTION_NOTICE = true;
private static final boolean ADMIN_USE_TCP_KEEP_ALIVE = true;
private static final boolean ADMIN_USE_TCP_NO_DELAY = true;
@@ -289,6 +297,18 @@
}
@Override
+ public long getFirstRequestTimeLimit()
+ {
+ return ADMIN_FIRST_REQUEST_TIME_LIMIT;
+ }
+
+ @Override
+ public int getMaxClientConnectionsPerAddress()
+ {
+ return ADMIN_MAX_CLIENT_CONNECTIONS_PER_ADDRESS;
+ }
+
+ @Override
public long getBufferSize()
{
return ADMIN_WRITE_BUFFER_SIZE;
--
Gitblit v1.10.0