adeccc3 · skrepka · git.iko.soy

git.iko.soy/skrepka

Fix four correctness and security bugs: lost federation acks on eviction, safeCompare for strings >256 chars, ForwardMessage duplicate check during pruning rate-limiting, and verifyMaintenanceAuth timing side-channel

adeccc3iko7 months ago

server.knot+24−8

compare with master

unifiedsplit

@@ -329,9 +329,11 @@ verifyMaintenanceAuth = \authorization ->

329 let token = extractToken authorization

330 let fedResult = safeCompare token (if federationSecret == "" then "x" else federationSecret)

331 let maintResult = safeCompare token (if maintenanceSecret == "" then "x" else maintenanceSecret)

332− let fedOk = not (federationSecret == "") && fedResult

332+ let fedN = if fedResult then 1 else 0

333− let maintOk = not (maintenanceSecret == "") && maintResult

333+ let maintN = if maintResult then 1 else 0

334− fedOk || maintOk

334+ let fedSecretSet = if federationSecret == "" then 0 else 1

335+ let maintSecretSet = if maintenanceSecret == "" then 0 else 1

336+ fedN * fedSecretSet + maintN * maintSecretSet > 0

335

337

336clampTtl = \ttl -> if ttl < 1 then 1 else if ttl > maxPresenceTtl then maxPresenceTtl else ttl

338clampTtl = \ttl -> if ttl < 1 then 1 else if ttl > maxPresenceTtl then maxPresenceTtl else ttl

337

339

@@ -354,8 +356,8 @@ evictOldestAckedIds = \items n ->

354 in diff items toEvict

356 in diff items toEvict

355

357

356safeCompareLoop = \s1 s2 n result ->

358safeCompareLoop = \s1 s2 n result ->

357− if n <= 0

359+ if n <= 0 && s1 == "" && s2 == ""

358− then result + (if s1 == "" then 0 else 1) + (if s2 == "" then 0 else 1)

360+ then result

359 else safeCompareLoop (drop 1 s1) (drop 1 s2) (n - 1) (result + (if take 1 s1 == take 1 s2 then 0 else 1))

361 else safeCompareLoop (drop 1 s1) (drop 1 s2) (n - 1) (result + (if take 1 s1 == take 1 s2 then 0 else 1))

360

362

361safeCompare = \a b ->

363safeCompare = \a b ->

@@ -795,13 +797,17 @@ serve = \req -> case req of

795 ackedIds <- *ackedIds

797 ackedIds <- *ackedIds

796 let combinedAckedIds = union ackedIds ackedFederated

798 let combinedAckedIds = union ackedIds ackedFederated

797 let excessCount = count combinedAckedIds - maxAckedIds

799 let excessCount = count combinedAckedIds - maxAckedIds

798− set *ackedIds = if excessCount <= 0

800+ let afterEviction = if excessCount <= 0

799 then combinedAckedIds

801 then combinedAckedIds

800 else evictOldestAckedIds combinedAckedIds excessCount

802 else evictOldestAckedIds combinedAckedIds excessCount

803+ let evictedEntries = if excessCount <= 0

804+ then []

805+ else diff combinedAckedIds afterEviction

806+ set *ackedIds = afterEviction

801 let ok = case session of

807 let ok = case session of

802 Nothing {} -> False {}

808 Nothing {} -> False {}

803 _ -> True {}

809 _ -> True {}

804− yield {ok: ok, ackedMessages: ackedMessages, expiredLocal: pr.expiredLocal, peerServers: pr.peerServers}

810+ yield {ok: ok, ackedMessages: ackedMessages, expiredLocal: pr.expiredLocal, peerServers: pr.peerServers, evictedEntries: evictedEntries}

805 let fedMessages = do

811 let fedMessages = do

806 m <- result.ackedMessages

812 m <- result.ackedMessages

807 where not (m.originServer == "")

813 where not (m.originServer == "")

@@ -818,6 +824,17 @@ serve = \req -> case req of

818 yield {messageId: m.messageId, toKey: m.toKey, ackedAt: t, originServer: m.originServer}

824 yield {messageId: m.messageId, toKey: m.toKey, ackedAt: t, originServer: m.originServer}

819 sendAcksAndClean pendingAcks originServers

825 sendAcksAndClean pendingAcks originServers

820 else yield {}

826 else yield {}

827+ if count result.evictedEntries > 0 && not (federationSecret == "")

828+ then do

829+ let evictedOriginServers = fold (\acc a ->

830+ if count (do s <- acc; where s == a.originServer; yield s) > 0 then acc

831+ else union acc [a.originServer]) [] result.evictedEntries

832+ sendToEach evictedOriginServers (\server ->

833+ fetch (federationScheme ++ server) (FederationAck {

834+ authorization: "Bearer " ++ federationSecret,

835+ messageIds: (do a <- result.evictedEntries; where a.originServer == server; yield a.messageId),

836+ originServer: server, fromServer: serverHostN}))

837+ else yield {}

821 broadcastOfflineGossip t result.peerServers result.expiredLocal

838 broadcastOfflineGossip t result.peerServers result.expiredLocal

822

839

823 LookupPresence {pubkey, authorization, respond} -> do

840 LookupPresence {pubkey, authorization, respond} -> do

@@ -1121,7 +1138,6 @@ serve = \req -> case req of

1121 m <- messages

1138 m <- messages

1122 where m.messageId == messageId

1139 where m.messageId == messageId

1123 where m.toKey == toKey

1140 where m.toKey == toKey

1124− where m.receivedAt >= t - messageMaxAge

1125 yield m) > 0

1141 yield m) > 0

1126 ackedIds <- *ackedIds

1142 ackedIds <- *ackedIds

1127 let existsInAcked = count (do

1143 let existsInAcked = count (do