No per-message receive timeout allows slow loris / hang DoS #116

New Issue

2026-07-21T16:20:47+02:00

TapTap commented

2026-07-21 16:20:47 +02:00

Description

receive_n_data() loops until all bytes arrive or the connection closes. There is no per-message timeout beyond the socket-level SO_RCVTIMEO (30s). An attacker can send partial data byte-by-byte and stall indefinitely, tying up server processes.

Location

src/shared/protocol.c:97-125 (receive_n_data)

How to trigger

Connect to the server and send one byte, then wait 29 seconds, then send another byte. The server will wait for the full message indefinitely within the 30s socket timeout window, but the connection can be kept alive for a very long time with slow trickle sends.

Suggested Fix

Add a per-message deadline (e.g., 60 seconds from the start of each receive_n_data call). Track elapsed time with clock_gettime(CLOCK_MONOTONIC) and abort the receive if the deadline is exceeded. Alternatively, reduce SO_RCVTIMEO to a lower value.

Severity

medium

Sub-Agent

security-screener (SC-5)

This issue was automatically generated by the issue-creator agent.

## Description `receive_n_data()` loops until all bytes arrive or the connection closes. There is no per-message timeout beyond the socket-level SO_RCVTIMEO (30s). An attacker can send partial data byte-by-byte and stall indefinitely, tying up server processes. ## Location src/shared/protocol.c:97-125 (receive_n_data) ## How to trigger Connect to the server and send one byte, then wait 29 seconds, then send another byte. The server will wait for the full message indefinitely within the 30s socket timeout window, but the connection can be kept alive for a very long time with slow trickle sends. ## Suggested Fix Add a per-message deadline (e.g., 60 seconds from the start of each `receive_n_data` call). Track elapsed time with `clock_gettime(CLOCK_MONOTONIC)` and abort the receive if the deadline is exceeded. Alternatively, reduce SO_RCVTIMEO to a lower value. ## Severity medium ## Category security ## Sub-Agent security-screener (SC-5) --- _This issue was automatically generated by the issue-creator agent._

TapTap referenced this issue

2026-07-21 16:48:29 +02:00

Security hardening: path traversal, TLS verification, DOS protections (#112-#118) #138

TapTap closed this issue

2026-07-29 18:27:14 +02:00

TapTap commented

2026-07-29 18:27:32 +02:00