Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Eliminate IO/logging initiated by unauthenticated code paths #47

Open
Tracked by #27
stv0g opened this issue Jul 31, 2023 · 0 comments
Open
Tracked by #27

Eliminate IO/logging initiated by unauthenticated code paths #47

stv0g opened this issue Jul 31, 2023 · 0 comments

Comments

@stv0g
Copy link
Collaborator

stv0g commented Jul 31, 2023

By @koraa in #27 (comment)

https://github.com/stv0g/go-rosenpass/blob/d7e38ecaf9e7803f2824a03ac24ac34944a53af6/handshake_initiator.go#L101

https://github.com/stv0g/go-rosenpass/blob/d7e38ecaf9e7803f2824a03ac24ac34944a53af6/server.go#L143

Severity: 3 (Dangerous) – No IO should be performed in response to maliciously crafted messages as performing IO opens up pandoras box in regards to DOS attacks (think of logs filling up, disk exhaustion, ghastly stuff like that).

Note that this performs a lot of allocations even if log level Debug was used.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant