NetworkTaskState should check peer address before accepting TLS handshake
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
- Issue type
- Refactor
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- rust
- Domain
- networking, security
Research direction
Start by tracing handle_connection() and read_and_handle_message(), including how the latter handles responses after outbound messages. Clarify the rearchitecture needed so peer-address checks happen before accepting a TLS handshake while the correct per-peer authentication remains for outbound connections.
Written by the indexing model from the issue text.
Description
It's cheaper to reject spammy connection based on just the IP address instead of accepting the TLS handshake and rejecting. Additionally, it lowers the risk of vulnerabilities in rustls being exploited.
<spb> val: the NetworkTaskState could build a big list of authorised IP addresses and have handle_connection test against that
[...]
<spb> i'm not sure it's a massive priority right now, but might be nice to improve
<spb> though i think if i were doing that, i'd be inclined to rework that a bit more
<val> it's a little annoying because I first need to check in handle_connection() that it's in the allowlist, but read_and_handle_message still needs to check it's the right address for that particular peer
<val> so yeah it needs more rearchitecturing
<spb> that's what i meant by reworking more
<spb> read_and_handle_message isn't really the right place for that because it's also called to handle responses after we send an outbound message
<spb> so it ends up doing all the peer authentication on a connection that we opened ourselves, after we sent network events to it
- Dominant language
- Rust
- Stars
- 132
- Forks
- 14
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from Libera-Chat/sable
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
Libera-Chat/sable#178 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
Libera-Chat/sable#172 ·
-
Rate limiting Open
Difficulty 5/5 Over a week Newbie friendliness 30/100
Libera-Chat/sable#170 · 1 reaction ·
-
Difficulty 4/5 3-5 days Newbie friendliness 42/100
Libera-Chat/sable#169 ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
Libera-Chat/sable#156 · 1 comment ·
All issues in Libera-Chat/sable
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
kwakseongjae/auto-hwp#319 ·
-
area:cli bug filter-quality good first issue priority:medium
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
bevyengine/bevy#25861 ·
-
comp-datalake
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
ClickHouse/ClickHouse#121222 ·
-
enhancement remote
Difficulty 2/5 1-3 hours Newbie friendliness 68/100