Fix DoS vulnerabilities causing unresponsive servers #1
Conversation
| //ignored | ||
| }elseif(($packet = $this->getPacketFromPool($pid)) !== null){ | ||
| $packet->buffer = $buffer; | ||
| $this->getSession($source, $port)->handlePacket($packet); |
There was a problem hiding this comment.
I don't have time to review thoroughly.
Looks OK if you are sure you're calling this method from the proper thread?
dktapps
changed the title
dktapps
changed the title
All users are encouraged to upgrade immediately. See pmmp/RakLib#1 for details.
See pmmp/RakLib#1 for details. All users are encouraged to upgrade immediately.
|
So in theory, you could take down a server with just an app? That is scary... |
|
@legoboy0215 It's no theory. People have been doing this for a long time. |
|
Ok, Mind = Blown. Some DoS we can't prevent, some we can. |
|
Why so much trouble? You just need to DDoS robot clients to a 100-slot server from 100 different IPs. Now let's see if they have the patience and courage to ban all these IPs. Robot-client-based DoS is easier to prevent, but it is still deadly if you have no admins online. |
|
Nah just make a custom player like @Falkirk's Spectre plugin |
|
@KairusDarkSeeker for the last time, Specter only spawns players server-side. It works internally, just like you create another user on your own computer. Other people can't create a specter on your server. Therefore it has absolutely no relationship with DoS, unless you have a strange favour of DoS'ing yourself. |
|
@SOF3 okay |
|
This is getting real funny and off-topic. |
DoSing a server with empty packets will currently cause the server to become unresponsive for hours, not allowing anyone to connect. The occasional client may connect successfully, but lose connection within minutes.
EDIT: Further investigation revealed that the same bug also occurs with UNCONNECTED_PING and UNCONNECTED_PONG. These vulnerabilities have also been patched.
Explanation
The SessionManager reads packets from sockets every 20th of a second. readPacket() returns false for packets with a zero-length buffer, causing no more packets to be processed on that tick.
100,000 packets -> 100,000 ticks -> 83 minutes of downtime.
This patch fixes that by returning true for empty packets, allowing packets to continue being processed on the same tick after empty packets are processed.
Changes
Tests
Tested with Packet Generator with 2000 packets @ 50 times, both before and after patch.