Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix buffer use after it was released when sending an INVALID_TOKEN error #2524

Merged
merged 1 commit into from
May 5, 2020
Merged

fix buffer use after it was released when sending an INVALID_TOKEN error #2524

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
32 changes: 14 additions & 18 deletions server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -292,7 +292,7 @@ func (s *baseServer) handlePacket(p *receivedPacket) {
}
}

func (s *baseServer) handlePacketImpl(p *receivedPacket) bool /* was the packet handled */ {
func (s *baseServer) handlePacketImpl(p *receivedPacket) bool /* should the buffer be released */ {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems quite brittle, similar to manual mem management in C. Is there a way to have all free-ing always be done by a single function? If not, maybe it's worth copying the buf contents in those cases? I think we could take a small perf hit over the risk of serious security issues…?

Is there a way we can avoid similar bugs in the future, make sure we always release buffers properly? With tests we probably can't guarantee full coverage.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The race detector will help us with that. In fact, that's how I found this issue.
When you use a buffer that you already released, and this buffer is used again, this is a race condition. Even if the detection is not 100% guaranteed, at least the test will be flaky...

// If we're creating a new session, the packet will be passed to the session.
// The header will then be parsed again.
hdr, _, _, err := wire.ParsePacket(p.data, s.config.ConnectionIDLength)
Expand Down Expand Up @@ -328,24 +328,18 @@ func (s *baseServer) handlePacketImpl(p *receivedPacket) bool /* was the packet

s.logger.Debugf("<- Received Initial packet.")

sess, err := s.handleInitialImpl(p, hdr)
if err != nil {
if err := s.handleInitialImpl(p, hdr); err != nil {
s.logger.Errorf("Error occurred handling initial packet: %s", err)
return false
}
// A retry was done, or the connection attempt was rejected,
// or if the Initial was a duplicate.
if sess == nil {
return false
}
// Don't put the packet buffer back if a new session was created.
// The session will handle the packet and take of that.
// Don't put the packet buffer back.
// handleInitialImpl deals with the buffer.
return true
}

func (s *baseServer) handleInitialImpl(p *receivedPacket, hdr *wire.Header) (quicSession, error) {
func (s *baseServer) handleInitialImpl(p *receivedPacket, hdr *wire.Header) error {
if len(hdr.Token) == 0 && hdr.DestConnectionID.Len() < protocol.MinConnectionIDLenInitial {
return nil, errors.New("too short connection ID")
p.buffer.Release()
return errors.New("too short connection ID")
}

var token *Token
Expand All @@ -363,6 +357,7 @@ func (s *baseServer) handleInitialImpl(p *receivedPacket, hdr *wire.Header) (qui
}
if !s.config.AcceptToken(p.remoteAddr, token) {
go func() {
defer p.buffer.Release()
if token != nil && token.IsRetryToken {
if err := s.maybeSendInvalidToken(p, hdr); err != nil {
s.logger.Debugf("Error sending INVALID_TOKEN error: %s", err)
Expand All @@ -373,7 +368,7 @@ func (s *baseServer) handleInitialImpl(p *receivedPacket, hdr *wire.Header) (qui
s.logger.Debugf("Error sending Retry: %s", err)
}
}()
return nil, nil
return nil
}

if queueLen := atomic.LoadInt32(&s.sessionQueueLen); queueLen >= protocol.MaxAcceptQueueSize {
Expand All @@ -383,12 +378,12 @@ func (s *baseServer) handleInitialImpl(p *receivedPacket, hdr *wire.Header) (qui
s.logger.Debugf("Error rejecting connection: %s", err)
}
}()
return nil, nil
return nil
}

connID, err := protocol.GenerateConnectionID(s.config.ConnectionIDLength)
if err != nil {
return nil, err
return err
}
s.logger.Debugf("Changing connection ID to %s.", connID)
sess := s.createNewSession(
Expand All @@ -400,7 +395,8 @@ func (s *baseServer) handleInitialImpl(p *receivedPacket, hdr *wire.Header) (qui
hdr.Version,
)
if sess == nil {
return nil, nil
p.buffer.Release()
return nil
}
sess.handlePacket(p)
for {
Expand All @@ -410,7 +406,7 @@ func (s *baseServer) handleInitialImpl(p *receivedPacket, hdr *wire.Header) (qui
}
sess.handlePacket(p)
}
return sess, nil
return nil
}

func (s *baseServer) createNewSession(
Expand Down
11 changes: 5 additions & 6 deletions server_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,18 +14,17 @@ import (
"sync/atomic"
"time"

"github.com/lucas-clemente/quic-go/internal/qerr"

"github.com/lucas-clemente/quic-go/qlog"

"github.com/golang/mock/gomock"
"github.com/lucas-clemente/quic-go/internal/handshake"
"github.com/lucas-clemente/quic-go/internal/protocol"
"github.com/lucas-clemente/quic-go/internal/qerr"
"github.com/lucas-clemente/quic-go/internal/testdata"
"github.com/lucas-clemente/quic-go/internal/utils"
"github.com/lucas-clemente/quic-go/internal/wire"
"github.com/lucas-clemente/quic-go/qlog"
"github.com/lucas-clemente/quic-go/quictrace"

"github.com/golang/mock/gomock"

. "github.com/onsi/ginkgo"
. "github.com/onsi/gomega"
)
Expand Down Expand Up @@ -580,7 +579,7 @@ var _ = Describe("Server", func() {
p := getInitial(protocol.ConnectionID{1, 2, 3, 4, 5, 6, 7, 8, 9})
phm.EXPECT().GetStatelessResetToken(gomock.Any())
phm.EXPECT().Add(protocol.ConnectionID{1, 2, 3, 4, 5, 6, 7, 8, 9}, sess).Return(false)
Expect(serv.handlePacketImpl(p)).To(BeFalse())
Expect(serv.handlePacketImpl(p)).To(BeTrue())
Expect(createdSession).To(BeTrue())
})

Expand Down