Re: LuaSocket: No way to protect against fuzzing attacks?

[Sam Roberts <vieuxtech@...>]

On Wed, Oct 12, 2011 at 10:15 PM, HyperHacker <hyperhacker@gmail.com> wrote:
> Does setfd() exist without the patch?

setfd()/getfd() are part of Diego's luasocket (he won't document them,
but he has mentioned them in answer to questions).

> And is that method guaranteed
> not to cause problems?

Guarantees are hard to come by, try and see [1]. I've tried to limit
my patching of luasocket to things that cannot be done in lua, since
code relying on a patch is guaranteed not to work in most
environments. But thats for you to decide, I'm just pointing out that
the patch appears implementable in lua.

> (setfd(-1) is valid,

See meth_setfd(), it just assigns the number into the object, and
Diego has described using it on this list.

>  -1 is never a valid fd,

True on unix, and see SOCKET_INVALID in usocket.h.

> closing a socket with an invalid fd is legal, etc.)

The side-effect of calling :close() is to set the internal fd to -1,
see meth_close() and socket_destroy().  :close() is documented as
being repeatably callable on a closed socket
(http://w3.impa.br/~diego/software/luasocket/tcp.html#close).

As far as the suggestions that receive(n) doesn't return partials on
timeout, that's enough of a bug I'm pretty sure Diego would fix it.

It still surprises me, luasocket's buffering is pretty widely used,
and its hard to understand it working sporadically. If its true, it
might bite me some time, which is why I offered to help with it, if I
can get more info. Frankly, once lanes and threads are mixed in,
luasocket might not be the most likely source of problems.

Cheers,
Sam

[1] That the socket allocated is not closed by luasocket after the
:setfd() is easily verifiable:

strace lua -l socket -e 's=socket.tcp() s:setfd(-1) print("!! fd:",
s:getfd()) print("!! close:", s:close()) '

....
socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3
fcntl64(3, F_GETFL)                     = 0x2 (flags O_RDWR)
fcntl64(3, F_SETFL, O_RDWR|O_NONBLOCK)  = 0
gettimeofday({1318534362, 910574}, NULL) = 0
fstat64(1, {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 10), ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0xb76ea000
write(1, "!! fd:\t-1\n", 10!! fd:       -1
)            = 10
write(1, "!! close:\t1\n", 12!! close:  1
)          = 12
rt_sigaction(SIGINT, {SIG_DFL, [INT], SA_RESTART}, {0x804b620, [INT],
SA_RESTART}, 8) = 0
munmap(0xb76eb000, 42144)               = 0
exit_group(0)                           = ?