Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

added comments for probing resistance #30

Merged
merged 1 commit into from
Sep 11, 2019
Merged

added comments for probing resistance #30

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@ import (

var logger *logging.Logger

// 59 seconds is most common timeout for servers that do not respond to invalid requests
const tcpReadTimeout time.Duration = 59 * time.Second

func init() {
Expand Down
3 changes: 3 additions & 0 deletions shadowsocks/tcp.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -191,6 +191,7 @@ func (s *tcpService) Start() {
}()
connStart := time.Now()
clientConn.(*net.TCPConn).SetKeepAlive(true)
// Set a deadline for connection authentication
clientConn.SetReadDeadline(connStart.Add(s.readTimeout))
keyID := ""
var proxyMetrics metrics.ProxyMetrics
Expand All @@ -213,11 +214,13 @@ func (s *tcpService) Start() {
timeToCipher = time.Now().Sub(findStartTime)

if err != nil {
// Keep the connection open until we hit the authentication deadline to protect against probing attacks
logger.Debugf("Failed to find a valid cipher after reading %v bytes: %v", proxyMetrics.ClientProxy, err)
io.Copy(ioutil.Discard, clientConn) // drain socket
return onet.NewConnectionError("ERR_CIPHER", "Failed to find a valid cipher", err)
}

// Clear the authentication deadline
clientConn.SetReadDeadline(time.Time{})
return proxyConnection(clientConn, &proxyMetrics)
}()
Expand Down