Skip to content

Commit

Permalink
tests: add test demonstrating subneg DoS
Browse files Browse the repository at this point in the history
The parser logic for processing subnegotiations allows a peer to cause
unbounded memory consumption by starting a subnegotiation but never
finishing it. Applications consuming events from the parser will never
receive any indication the peer sent data. The parser's internal buffer
will grow unbounded.

This commit adds a test demonstrating the issue, but does not offer
a fix.
  • Loading branch information
cpu committed Oct 3, 2024
1 parent 5c95119 commit c248bda
Showing 1 changed file with 20 additions and 0 deletions.
20 changes: 20 additions & 0 deletions tests/tests.rs
Original file line number Diff line number Diff line change
Expand Up @@ -319,6 +319,26 @@ fn test_bad_subneg_dbuffer() {
Parser::with_support(opts).receive(&[cmd::IAC, cmd::SB, cmd::IAC, cmd::SE]);
}

#[test]
fn test_subneg_dos() {
let mut instance: Parser = Parser::new();
instance.options.support_local(opt::GMCP);

// Receive the start of a supported subnegotiation
let mut events = instance.receive(&[cmd::IAC, cmd::SB, opt::GMCP]);
assert!(events.is_empty());

// Receive data forever, breaking only when an item is yielded. With the current code
// this will never happen: the parser will indefinitely buffer as much data as the peer
// sends, consuming all available memory.
loop {
events = instance.receive(&[0x01]);
if !events.is_empty() {
break;
}
}
}

#[test]
fn test_into_bytes() {
let bytes = libmudtelnet::events::TelnetIAC::new(cmd::IAC).to_bytes();
Expand Down

0 comments on commit c248bda

Please sign in to comment.