{"action":"opened","issue":{"url":"https://api.github.com/repos/weaveworks/weave/issues/912","labels_url":"https://api.github.com/repos/weaveworks/weave/issues/912/labels{/name}","comments_url":"https://api.github.com/repos/weaveworks/weave/issues/912/comments","events_url":"https://api.github.com/repos/weaveworks/weave/issues/912/events","html_url":"https://github.com/weaveworks/weave/issues/912","id":87978227,"number":912,"title":"DoS vector in protocol message stream","user":{"login":"rade","id":109109,"avatar_url":"https://avatars.githubusercontent.com/u/109109?v=3","gravatar_id":"","url":"https://api.github.com/users/rade","html_url":"https://github.com/rade","followers_url":"https://api.github.com/users/rade/followers","following_url":"https://api.github.com/users/rade/following{/other_user}","gists_url":"https://api.github.com/users/rade/gists{/gist_id}","starred_url":"https://api.github.com/users/rade/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rade/subscriptions","organizations_url":"https://api.github.com/users/rade/orgs","repos_url":"https://api.github.com/users/rade/repos","events_url":"https://api.github.com/users/rade/events{/privacy}","received_events_url":"https://api.github.com/users/rade/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/weaveworks/weave/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/weaveworks/weave/milestones/5","html_url":"https://github.com/weaveworks/weave/milestones/1.0","labels_url":"https://api.github.com/repos/weaveworks/weave/milestones/5/labels","id":1133594,"number":5,"title":"1.0","description":"","creator":{"login":"rade","id":109109,"avatar_url":"https://avatars.githubusercontent.com/u/109109?v=3","gravatar_id":"","url":"https://api.github.com/users/rade","html_url":"https://github.com/rade","followers_url":"https://api.github.com/users/rade/followers","following_url":"https://api.github.com/users/rade/following{/other_user}","gists_url":"https://api.github.com/users/rade/gists{/gist_id}","starred_url":"https://api.github.com/users/rade/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rade/subscriptions","organizations_url":"https://api.github.com/users/rade/orgs","repos_url":"https://api.github.com/users/rade/repos","events_url":"https://api.github.com/users/rade/events{/privacy}","received_events_url":"https://api.github.com/users/rade/received_events","type":"User","site_admin":false},"open_issues":10,"closed_issues":116,"state":"open","created_at":"2015-05-26T11:54:10Z","updated_at":"2015-06-13T10:20:19Z","due_on":"2015-06-17T23:00:00Z","closed_at":null},"comments":0,"created_at":"2015-06-13T10:20:19Z","updated_at":"2015-06-13T10:20:19Z","closed_at":null,"body":"I haven't tested this, but I reckon there is DoS vector in the protocol message stream that attackers can exploit without breaking our crypto.\r\n\r\nThe weave TCP protocol is a stream of gob encoded messages: a `map[string][string]` for the first message, the handshake, followed by `[]byte` messages. The latter are all encrypted when crypto is enabled. Note that it's the *individual messages* that are encrypted, *not* the stream. And the first message - the handshake - is always unencrypted.\r\n\r\nIt is therefore possible for an attacker to exploit weaknesses in gob. The following spring to mind:\r\n\r\n1. triggering an OOM crash by sending a very large gob message\r\n2. triggering an OOM crash by sending a sequence of octets that triggers a large memory allocation in gob\r\n3. triggering a loop in the gob decoder\r\n\r\nI am quite sure 1 is possible. There is a [1GB limit](http://golang.org/src/encoding/gob/decoder.go?h=tooBig#L15) in place but a) that's still quite large, and b) doesn't apply everywhere.\r\n\r\n2 is different from 1 because it does not require network capacity and is therefore impossible to guard against with firewalls that enforce capacity limits. And I think it is possible, based on my reading of the gob decoder, i.e. there are [places](http://golang.org/src/encoding/gob/decode.go#L378) where a capacity is read and then an allocation of that capacity is performed.\r\n\r\nI don't think 3 is possible, based on the description of gob. But I could well be wrong."}}