websockets-rs / rust-websocket

A WebSocket (RFC6455) library written in Rust

Home Page:http://websockets-rs.github.io/rust-websocket/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Single client can prevent new clients from connecting to the server

kellerkindt opened this issue · comments

Build and start the example async-server. Connecting to the port 2794 with a valid websocket works. To break it, we need to emulate a defect or malicious client by connecting a tcp stream to port 2794 but without send any data (for example via "telnet localhost 2794" without typing any data, just connect to that port). As long as this connection is held, the server wont accept and/or handle any new connection.

The problem is, that in .incoming() (https://github.com/websockets-rs/rust-websocket/blob/master/src/server/async.rs#L52) no new connection will be turned into a websocket until the previous attempt was successful (inner future: https://github.com/websockets-rs/rust-websocket/blob/master/src/server/async.rs#L64).

My workaround for this problem was to not use .incoming() from this crate, but instead the TcpListener from tokio, calling their .incoming() and spawn the future of eachs' stream.into_ws() separately.

Proof that the first connection blocks any further connection:
Open another terminal and also connect via telnet, but this time enter some things, like

ABC DEF
INVALID INPUT
I LIKE CATS

(note empty newline at the end).

The server doesnt care about the invalid data, but as soon as you type any invalid data into the first connection, like:

CATS ARE EVIL

(note empty newline at the end)
it`ll (rightfully) panic:

thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: Parsing(Header)', src/libcore/result.rs:1009:5