[Users] [Carpet] checkpoint at run-time request

[Erik Schnetter]

On Oct 30, 2006, at 14:01:53, Frank Loeffler wrote:

> Hi,
>
>> On Oct 18, 2006, at 09:15:59, Bela Szilagyi wrote:
>>> I know there is the web-interface
>>> option of
>>> steering parameters, but I never trusted that enough to try...
>
>>> More generically, it would be quite useful to have a simple,   
>>> usable, and
>>> trustworthy way of modifying parameters of a run, while it's
>>> running.
>
> Erik Schnetter wrote:
>> Cactus has a web server thorn.
>
> I think this is what Bela meant by 'web interface' and what is somehow
> connected to 'insecure' in my mind - without reasons to directly  
> put my
> finger on at the moment. Does someone already did a security audit  
> on this?

Steve White looked at the code extensively a while ago; he corrected  
all the string manipulations.  Your finding is probably a leftover  
oversight, a missing check for an error condition.

The routines that display images, grid functions, or parameters are  
insecure if the web server runs multi-threaded (which it should),  
since then the web server follows pointers which may vanish at any  
time.  The parameter steering, however, seems secure, since the  
steering requests are batched up until a specific point in time in  
the evolution.

-erik

-- 
Erik Schnetter <schnetter at cct.lsu.edu>

My email is as private as my paper mail.  I therefore support encrypting
and signing email messages.  Get my PGP key from www.keyserver.net.



-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 186 bytes
Desc: This is a digitally signed message part
Url : http://www.cactuscode.org/pipermail/users/attachments/20061030/cab8de7a/attachment.bin