Skip to content

v0.2.2 - concurrency hardening

Choose a tag to compare

View all tags
@swayyaam swayyaam released this 23 Aug 21:09
· 113 commits to main since this release
v0.2.2
94f0122

Fixes a set of concurrency and data-corruption bugs (see CHANGELOG.md for impact
and operator action per item):

  • team stranded with a non-member captain under concurrent leaves (+ startup self-heal)
  • max team size bypassable under concurrent joins
  • post-freeze solves could leak into the frozen scoreboard (re-check + SETNX)
  • event-end teardown was not phase-gated
  • host-port leak via lost instances
  • login blocked for a shared-NAT venue (per-IP login limit, GitHub issue #4)
  • sign-in burst could OOM the host via unbounded argon2id hashing (GitHub issue #3)

Found by two test tiers built this cycle - an in-process soak harness and a
randomized property-test suite (per-step invariants over adversarial sequences) -
alongside the auth policy matrix and enumeration/flag-containment scanners from v0.2.1.

Operator action required on upgrade: none. A startup consistency check repairs any
team already left with a non-member captain, and every other fix applies on deploy.
No OpenAPI or database-schema change. Optional: tune OSCTF_LOGIN_IP_* /
OSCTF_REGISTER_IP_* and the process RLIMIT_NOFILE for large public events.

Assets 2
Loading