478c21a · skrepka · git.iko.soy

git.iko.soy/skrepka

on master help sign in

Fix 3 bugs: block bare local/internal in SSRF checks, correct sendBatchedGossip effect type, cap forwards storage

478c21aiko6 months ago

client/obj/Debug/net10.0-maccatalyst/maccatalyst-arm64/Skrepka.AssemblyInfo.fs+1−1

compare with master

unifiedsplit

@@ -10,7 +10,7 @@ open System.Reflection

10[<assembly: System.Reflection.AssemblyCompanyAttribute("Skrepka")>]

11[<assembly: System.Reflection.AssemblyConfigurationAttribute("Debug")>]

12[<assembly: System.Reflection.AssemblyFileVersionAttribute("1.0.0.0")>]

13−[<assembly: System.Reflection.AssemblyInformationalVersionAttribute("1.0+2cefad750ee6496b16b87d5fe04a25c6a9d248f1")>]

13+[<assembly: System.Reflection.AssemblyInformationalVersionAttribute("1.0+e5192b2de772542ae399a240271fba3ee7c0e3ca")>]

14[<assembly: System.Reflection.AssemblyProductAttribute("Skrepka")>]

15[<assembly: System.Reflection.AssemblyTitleAttribute("Skrepka")>]

16[<assembly: System.Reflection.AssemblyVersionAttribute("1.0.0.0")>]

client/obj/Debug/net10.0-maccatalyst/maccatalyst-arm64/Skrepka.AssemblyInfoInputs.cache+1−1

@@ -1 +1 @@

1−5c9deceee23c212b89ef57fbff84d1f16f41bfdcba9bd75e9315f9ab75e2107e

1+d8467ba846d7ed88c0541898cd2c1f66917869d9f94d557eda33bdf279806cc5

server.knot+11−4

@@ -297,7 +297,9 @@ isBadServerName = \s ->

297 || sn == "localhost" || take 10 sn == "localhost:"

298 || sn == "localhost.localdomain" || take 22 sn == "localhost.localdomain:"

299 || containsLocalhostSuffix sn

300+ || sn == "local" || take 6 sn == "local:"

300 || containsLocalSuffix sn

301 || containsLocalSuffix sn

302+ || sn == "internal" || take 9 sn == "internal:"

301 || containsInternalSuffix sn

303 || containsInternalSuffix sn

302 || sn == "metadata" || take 9 sn == "metadata:"

304 || sn == "metadata" || take 9 sn == "metadata:"

303 || take 4 sn == "127." || take 3 sn == "10."

305 || take 4 sn == "127." || take 3 sn == "10."

@@ -483,7 +485,7 @@ sendBatchedGossipToServer = \server allEvents ->

483 Err _ -> yield {}

485 Err _ -> yield {}

484 sendBatchedGossipToServer server rest

486 sendBatchedGossipToServer server rest

485

487

486−sendBatchedGossip : [Text] -> [{eventType: Text, pubkey: Text, server: Text, timestamp: Int, ttl: Int}] -> IO {} {}

488+sendBatchedGossip : [Text] -> [{eventType: Text, pubkey: Text, server: Text, timestamp: Int, ttl: Int}] -> IO {network} {}

487sendBatchedGossip = \peerServers allEvents ->

489sendBatchedGossip = \peerServers allEvents ->

488 if count allEvents == 0

490 if count allEvents == 0

489 then yield {}

491 then yield {}

@@ -841,8 +843,12 @@ serve = \req -> case req of

841 else "queued"

843 else "queued"

842 forwards <- *forwards

844 forwards <- *forwards

843 let forwardsAtCapacity = count forwards >= maxForwardsEntries

845 let forwardsAtCapacity = count forwards >= maxForwardsEntries

846+ let forwardSlots = maxForwardsEntries - count forwards

847+ let forwardServers = fold (\acc s ->

848+ if count acc >= forwardSlots then acc

849+ else union acc [s]) [] remoteServers

844− set *forwards = if shouldInsert && not forwardsAtCapacity && count remoteServers > 0 && not (federationSecret == "")

850+ set *forwards = if shouldInsert && not forwardsAtCapacity && count forwardServers > 0 && not (federationSecret == "")

845− then union forwards (do s <- remoteServers; yield {messageId: msgId, toServer: s, createdAt: t, toKey: to, fromKey: fromKey, encryptedBlob: encryptedBlob, timestamp: clampedTs})

851+ then union forwards (do s <- forwardServers; yield {messageId: msgId, toServer: s, createdAt: t, toKey: to, fromKey: fromKey, encryptedBlob: encryptedBlob, timestamp: clampedTs})

846 else forwards

852 else forwards

847 yield {status: status, remoteServers: remoteServers, fromKey: fromKey, expiredLocal: pr.expiredLocal, peerServers: pr.peerServers, forwardsAtCapacity: forwardsAtCapacity}

853 yield {status: status, remoteServers: remoteServers, fromKey: fromKey, expiredLocal: pr.expiredLocal, peerServers: pr.peerServers, forwardsAtCapacity: forwardsAtCapacity}

848 let finalStatus = if result.status == "federated" && (federationSecret == "" || result.forwardsAtCapacity) then "queued" else result.status

854 let finalStatus = if result.status == "federated" && (federationSecret == "" || result.forwardsAtCapacity) then "queued" else result.status

@@ -860,7 +866,8 @@ serve = \req -> case req of

860 x <- forwards

866 x <- forwards

861 where not (x.messageId == msgId && x.toServer == server)

867 where not (x.messageId == msgId && x.toServer == server)

862 yield x

868 yield x

863− Err _ -> yield {})

869+ Err _ -> yield {}

870+ )

864 else yield {}

871 else yield {}

865 if result.forwardsAtCapacity && count result.remoteServers > 0 && not (result.status == "unauthorized") && not (result.status == "invalid") && not (result.status == "rejected")

872 if result.forwardsAtCapacity && count result.remoteServers > 0 && not (result.status == "unauthorized") && not (result.status == "invalid") && not (result.status == "rejected")

866 then println ("sendMessage: forwards at capacity (" ++ show maxForwardsEntries ++ "), skipping forward tracking")

873 then println ("sendMessage: forwards at capacity (" ++ show maxForwardsEntries ++ "), skipping forward tracking")