[IVY-854] Evil behavior form resolve latest.status: performs DOS attacks

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.0-beta-2
• Fix Version/s: 2.0-RC1
• Component/s: Core

Environment

windows xp sp2, linux fedora core 9, running Ivy repository through http for remote resolving and Hudson CI server (publishing to the repo).

• Assignee: Maarten Coene
• Reporter: Hans Lund
• Created: 04/Jul/08 09:41
• Updated: 27/Jul/09 19:27
• Resolved: 15/Sep/08 08:40

Description

Ivy is extremely aggressive towards repositories . This can result in
resolving fails, even towards a healthy repository.

The symptom:

[ivy:resolve] 01-07-2008 13:16:24
org.apache.commons.httpclient.HttpMethodDirector executeWithRetry
[ivy:resolve] INFO: I/O exception (java.net.BindException) caught when
processing request: Address already in use: connect.

In effect this happens when Ivy has performed a successfully DOS attack against the repository.

This is especially a problem when having large repositories (lost of revisions) and resolve against latest.status -> as this will fetch ivy.xml md5 and sha1 files for every revision.

Issue Links

• is cloned by: IVY-1105 Excessive hits to missing URLs uses up all ports on Windows