Add maximum packet size check

[creikey]

No description provided.

[treeform]

Sorry, I don't think this is a realistic attack vector. Have you encountered this in the wild?

Do you have an example of a webSocket library that supports this?

Although this might help in the case where the attacker sends you a large packet, its just one of many networked based attacks. Attacker can make a ton of connections, don't reply, reply in bursts, send a ton of small packets etc...

You need a wholistic system to handle such attacks.

I feel its better to limit the attack at the network layer, where if an IP is spamming you with junk you ban them, maybe with iptables? https://serverfault.com/questions/594012/ban-an-ip-when-the-server-received-an-amount-of-data-from-it

You probably have multiple servers, again I feel its better to handle this at the load balancing layer. I would investigate nginx, haproxy, or couldflare.

[creikey]

Sorry, I don't think this is a realistic attack vector. Have you encountered this in the wild?

Do you have an example of a webSocket library that supports this?

Although this might help in the case where the attacker sends you a large packet, its just one of many networked based attacks. Attacker can make a ton of connections, don't reply, reply in bursts, send a ton of small packets etc...

You need a wholistic system to handle such attacks.

I feel its better to limit the attack at the network layer, where if an IP is spamming you with junk you ban them, maybe with iptables? https://serverfault.com/questions/594012/ban-an-ip-when-the-server-received-an-amount-of-data-from-it

You probably have multiple servers, again I feel its better to handle this at the load balancing layer. I would investigate nginx, haproxy, or couldflare.

This makes sense to me, nginx unfortunately doesn't support websocket protection. I was hoping I could just do client side load balancing to just randomly select an available lobby server to simplify the stack, but that would require cloudflare protection on each server...

[creikey]

Sorry, I don't think this is a realistic attack vector. Have you encountered this in the wild?

Do you have an example of a webSocket library that supports this?

Although this might help in the case where the attacker sends you a large packet, its just one of many networked based attacks. Attacker can make a ton of connections, don't reply, reply in bursts, send a ton of small packets etc...

You need a wholistic system to handle such attacks.

I feel its better to limit the attack at the network layer, where if an IP is spamming you with junk you ban them, maybe with iptables? https://serverfault.com/questions/594012/ban-an-ip-when-the-server-received-an-amount-of-data-from-it

You probably have multiple servers, again I feel its better to handle this at the load balancing layer. I would investigate nginx, haproxy, or couldflare.

import asyncdispatch, asynchttpserver, ws

proc main() {.async.} =
  var ws = await newWebSocket("wss://the-server.org")
  await ws.send(newString(1024*1024*1024))
  echo await ws.receiveStrPacket()
  ws.close()

waitFor main()

Something like this can completely hang the server on ram, this is ignoring that you can provide an invalid length in the header of the websocket packet that's something like 10 gigabytes, and the server will recv that length, causing the socket to wait forever (does this matter if it's async?) as there's no timeout specified and the socket is buffered.

[creikey]

@treeform In a server protected by cloudflare this attack still works #42 , I think the actual websocket code needs to reject data unreasonably large for the application, as nginx does nothing to the proxied websocket packets, and for some applications sending this much data over a websocket is reasonable, so cloudflare can't just ban all large packets.

[treeform]

In fact the application I use it for needs to send very large packets over WS.

But that still can be exploited, see my thoughts on #42