search

gammazero / nexus

Full-feature WAMP v2 router and client written in Go
MIT License
268 stars 58 forks source link

Abort connection on receiving non-sequential request ID #293

Open KSDaemon opened 1 year ago

KSDaemon commented 1 year ago

Right now Nexus doesn't take into account the request ID sequence number. That is not aligned with WAMP SPEC.

Under IDs:

IDs in the session scope MUST be incremented by 1 beginning with 1 (for each direction - Client-to-Router and Router-to-Client) {#session_scope_id}

And under Protocol Errors (recently added in PR https://github.com/wamp-proto/wamp-proto/pull/437):

Receiving message with non-sequential session scope request ID, such as SUBSCRIBE, UNSUBSCRIBE, PUBLISH, REGISTER, UNREGISTER, CALL and YIELD.

And further below:

In all such cases WAMP implementations:

  1. MUST send an ABORT message to the offending peer, having reason wamp.error.protocol_violation and optional attributes in ABORT.Details such as a human readable error message.
  2. MUST abort the WAMP session by disposing any allocated subscriptions/registrations for that particular client and without waiting for or processing any messages subsequently received from the peer,
  3. SHOULD also drop the WAMP connection at transport level (recommended to prevent denial of service attacks)
KSDaemon commented 1 year ago

https://github.com/wamp-proto/wamp-proto/issues/448