Security: No connection limits or timeouts enables fork-bomb / slowloris #190

New Issue

2026-07-30T18:34:43+02:00

TapTap commented

2026-07-30 18:34:43 +02:00

Severity: medium
Category: security
Location: src/server/server.c:65-90, src/shared/protocol.c:92-115

Description:
The TCP server accepts every incoming connection and immediately fork()s a child process in src/shared/transport_tcp.c:81. There is no limit on concurrent connections, no connection timeout, and no rate limiting. An unauthenticated attacker can open many slow or idle connections to exhaust process slots, memory, or file descriptors (fork bomb / slowloris).

This is related to the timeouts feature request but is tracked here as a security hardening item.

Suggested fix:

Set socket-level timeouts (SO_RCVTIMEO, SO_SNDTIMEO) or use poll() with a timeout in all receive_n_data/send_n_data loops.
Limit the number of concurrent child processes (e.g., semaphore or counter) and reject or queue additional connections.
Optionally enable SO_KEEPALIVE and TCP_USER_TIMEOUT.
Log abnormal connection counts.

Labels: security, dos, threading

**Severity:** medium **Category:** security **Location:** `src/server/server.c:65-90`, `src/shared/protocol.c:92-115` **Description:** The TCP server accepts every incoming connection and immediately `fork()`s a child process in `src/shared/transport_tcp.c:81`. There is no limit on concurrent connections, no connection timeout, and no rate limiting. An unauthenticated attacker can open many slow or idle connections to exhaust process slots, memory, or file descriptors (fork bomb / slowloris). This is related to the timeouts feature request but is tracked here as a security hardening item. **Suggested fix:** 1. Set socket-level timeouts (`SO_RCVTIMEO`, `SO_SNDTIMEO`) or use `poll()` with a timeout in all `receive_n_data`/`send_n_data` loops. 2. Limit the number of concurrent child processes (e.g., semaphore or counter) and reject or queue additional connections. 3. Optionally enable `SO_KEEPALIVE` and `TCP_USER_TIMEOUT`. 4. Log abnormal connection counts. **Labels:** security, dos, threading

TapTap added the security needs-triage threading labels 2026-07-30 18:34:43 +02:00

TapTap referenced this issue from a commit

2026-07-30 18:49:31 +02:00

fix: security issues #192 #191 #190 #189 #188 #187

TapTap closed this issue

2026-07-30 19:38:27 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: TapTap/FastSync#190