8000
Skip to content

Assorted minor security concerns - #2289

Merged
gdamore merged 8 commits into
mainfrom
gdamore/assorted-fixes
Jul 12, 2026
Merged

Assorted minor security concerns#2289
gdamore merged 8 commits into
mainfrom
gdamore/assorted-fixes

Conversation

@gdamore
@gdamore gdamore commented Jul 10, 2026
Copy link
Copy Markdown
Contributor

This fixes a few different minor (unlikely to be remotely exploitable) security concerns that were found during a comprehensive security audit of our code.

Summary by CodeRabbit

  • Bug Fixes
    • Corrected DTLS refresh parameter encoding/decoding in connection acknowledgements.
    • Improved UDP receive processing to consistently use the validated payload length.
    • Fixed WebSocket behavior to immediately close on unsupported text frames.
    • Prevented WebSocket accept-side work when the listener is already closed.
    • Improved decoding/termination of abstract socket names and added header-length validation for 32-bit trimming.
  • New Tests
    • Added an IPC abstract-socket auto-bind test.
    • Added a WebSocket test verifying rejected text handling.
  • Tests
    • Broadened mutual bad-certificate TLS test to accept multiple failure outcomes.
  • Chores
    • Refreshed copyright years in affected components.

gdamore added 5 commits July 10, 2026 07:10
This is a correctness issue that could allow certain kinds of data smuggling,
and result in higher than expected data allocations, but did not necessarily
result in protocol errors with well behaved clients.  Unlikely to be anything
that could be exploited remotely.
@coderabbitai
coderabbitai Bot commented Jul 10, 2026
Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

The changes add message-header validation, terminate abstract socket names, correct DTLS refresh encoding and decoding, preserve validated UDP lengths, prevent WebSocket control-flow fallthrough, guard closed listeners, and add regression coverage.

Changes

Protocol and transport safety fixes

Layer / File(s) Summary
Message and abstract socket safety
src/core/message.c, src/platform/posix/posix_ipclisten.c
Message header trimming validates sufficient bytes; abstract socket handling documents the kernel address format and explicitly terminates the derived name.
DTLS and UDP data handling
src/sp/transport/dtls/dtls.c, src/sp/transport/udp/udp.c
DTLS refresh values are encoded and decoded through us_params[1] with millisecond-to-second conversion; UDP stores the validated payload length before scheduling and trimming.
WebSocket frame and listener control
src/supplemental/websocket/websocket.c, src/sp/transport/ws/websocket.c, src/supplemental/websocket/websocket_test.c
Unsupported text frames return after closing, closed listeners stop accepted-stream processing, and a test verifies rejected text receives return NNG_ECLOSED.
Transport regression coverage
src/sp/transport/ipc/ipc_test.c, src/sp/transport/tls/tls_tran_test.c
IPC coverage exercises abstract-socket autobinding, while the mbedTLS certificate test accepts either NNG_ECRYPTO or NNG_ECONNSHUT.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description lacks the template-required 'fixes # ' line. Add the issue reference and a brief synopsis in the required format, then keep the short explanatory comments.
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title matches the PR's security-audit fixes, though it's broad and not very specific.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch gdamore/assorted-fixes

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
src/platform/posix/posix_ipclisten.c (1)

427-429: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Null termination is correct; comment claim about kernel name format warrants verification.

The explicit null termination at line 443 is safe: the bounds check at line 436 (len <= sizeof(l->sa.s_abstract.sa_name)) combined with the two subtractions (lines 438–439) guarantees sa_name[len] is well within the buffer. The terminator is placed at index sa_len, so it doesn't overwrite any name bytes or alter sa_len—preserving length-based semantics for abstract names that may contain embedded NULs (as exercised by test_abstract_null in src/sp/transport/ipc/ipc_test.c).

The expanded comment at lines 427–429 states the kernel-assigned name is "the leading NULL byte, followed by 5 ascii characters." The exact length and format of kernel-auto-assigned abstract socket names varies across Linux kernel versions (older kernels use PID/counter-based schemes, newer ones use random values). The code correctly handles this dynamically via getsockname, but the "5 ascii characters" claim is overly specific and may be inaccurate on some kernels. Consider softening to "followed by a short sequence of ascii characters" or similar.

Also applies to: 443-443

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/platform/posix/posix_ipclisten.c` around lines 427 - 429, The comment
describing kernel-assigned abstract socket names is overly specific and may be
inaccurate across Linux versions. Update the comment near the abstract-name
handling and explicit terminator assignment to describe a leading NUL followed
by a short, kernel-defined sequence of characters, without asserting an exact
five-character length; leave the bounds checks and null-termination logic
unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/platform/posix/posix_ipclisten.c`:
- Around line 427-429: The comment describing kernel-assigned abstract socket
names is overly specific and may be inaccurate across Linux versions. Update the
comment near the abstract-name handling and explicit terminator assignment to
describe a leading NUL followed by a short, kernel-defined sequence of
characters, without asserting an exact five-character length; leave the bounds
checks and null-termination logic unchanged.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 4c65ccec-451b-4877-80d1-a38126535383

📥 Commits

Reviewing files that changed from the base of the PR and between 6c02021 and 39f7b82.

📒 Files selected for processing (5)
  • src/core/message.c
  • src/platform/posix/posix_ipclisten.c
  • src/sp/transport/dtls/dtls.c
  • src/sp/transport/udp/udp.c
  • src/supplemental/websocket/websocket.c

@codecov
codecov Bot commented Jul 10, 2026
Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 72.72727% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.47%. Comparing base (45f8116) to head (f90e42a).
⚠️ Report is 729 commits behind head on main.

Files with missing lines Patch % Lines
src/sp/transport/ws/websocket.c 25.00% 3 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #2289      +/-   ##
==========================================
+ Coverage   78.11%   83.47%   +5.35%     
==========================================
  Files          93       99       +6     
  Lines       20782    22701    +1919     
  Branches        0     3280    +3280     
==========================================
+ Hits        16234    18949    +2715     
+ Misses       4548     3669     -879     
- Partials        0       83      +83     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@coderabbitai coderabbitai Bot left a comment
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/sp/transport/ws/websocket.c`:
- Around line 513-517: Update the l->closed branch in the accept completion flow
to route through the existing error path instead of freeing ws and returning
directly, ensuring uaio is removed and completed with NNG_ECLOSED. Preserve the
listener mutex handling and use the existing error cleanup logic.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e3b9a9f5-b2e8-4dc8-993c-fa17284abe7b

📥 Commits

Reviewing files that changed from the base of the PR and between ac2b344 and f90e42a.

📒 Files selected for processing (1)
  • src/sp/transport/ws/websocket.c

Comment on lines +513 to +517
if (l->closed) {
nng_stream_free(ws);
nni_mtx_unlock(&l->mtx);
return;
}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Complete the pending accept AIO before returning.

When the underlying accept succeeds but listener shutdown wins the race, this branch frees ws and returns without removing or completing uaio. Since wstran_listener_close does not drain l->aios, callers can remain blocked indefinitely instead of receiving NNG_ECLOSED. Route this case through the existing error path.

Proposed fix
 	if (l->closed) {
 		nng_stream_free(ws);
-		nni_mtx_unlock(&l->mtx);
-		return;
+		rv = NNG_ECLOSED;
+		goto error;
 	}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
if (l->closed) {
nng_stream_free(ws);
nni_mtx_unlock(&l->mtx);
return;
}
if (l->closed) {
nng_stream_free(ws);
rv = NNG_ECLOSED;
goto error;
}
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/sp/transport/ws/websocket.c` around lines 513 - 517, Update the l->closed
branch in the accept completion flow to route through the existing error path
instead of freeing ws and returning directly, ensuring uaio is removed and
completed with NNG_ECLOSED. Preserve the listener mutex handling and use the
existing error cleanup logic.

@gdamore
gdamore merged commit 21c4ca3 into main Jul 12, 2026
23 of 24 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

0