ASPLes / nopoll

OpenSource WebSocket toolkit
http://www.aspl.es/nopoll
GNU Lesser General Public License v2.1
124 stars 74 forks source link

non-TLS socket accepted is blocking by default #56

Open veeg opened 6 years ago

veeg commented 6 years ago

The documentation for nopoll_conn_get_msg() states that the accepted socket will be non-blocking by default. This is not the case when the accepted socket has not enabled TLS.

The following line in the internal accept method states it will set non-blocking, and then it sets blocking. https://github.com/ASPLes/nopoll/blob/e80b74aa653b1395759bce7f256ce7e94645f39f/src/nopoll_conn.c#L4692-L4693

This is not the case for TLS sockets, as evident by this line: https://github.com/ASPLes/nopoll/blob/e80b74aa653b1395759bce7f256ce7e94645f39f/src/nopoll_conn.c#L4874-L4877

Documentation for nopoll_conn_get_msg() states that default is non-blocking https://github.com/ASPLes/nopoll/blob/e80b74aa653b1395759bce7f256ce7e94645f39f/src/nopoll_conn.c#L3034-L3036

This confusing behavior has tripped up multiple co-workers of mine, including me for a time, until I fully comprehended both the websocket standard and the nopoll implementation

xhsjdm commented 5 years ago

I've gotten the same problem while non-TLS. Could I simply move "nopoll_conn_set_sock_block (conn->session, nopoll_false);" from " /* don't complete here the operation but flag it as

I tried and test simply, it works.

samisallinen commented 3 years ago

This issue leaves a server using libnopoll victim for a super-easy denial-of-service attack: just telnet to the non-tls port of the server and send one character (e.g. press ctrl-c) . The nopoll thread will be waiting forever to receive a full line of text, blocking traffic on all other connections. The fix suggested above seems to work.