mirror of
https://github.com/v2fly/v2ray-core.git
synced 2026-05-04 19:49:08 -04:00
96dc2c1c81
This fix addresses a potential denial-of-service (DoS) vector that can cause an integer overflow in the presence of malicious WebSocket frames. The fix adds additional checks against the remaining bytes on a connection, as well as a test to prevent regression. Credit to Max Justicz (https://justi.cz/) for discovering and reporting this, as well as providing a robust PoC and review. * bugfix: fix DoS vector caused by readLimit bypass * bugfix: payload length 127 should read bytes as uint64 * bugfix: defend against readLength overflows
Gorilla WebSocket
Gorilla WebSocket is a Go implementation of the WebSocket protocol.
Documentation
Status
The Gorilla WebSocket package provides a complete and tested implementation of the WebSocket protocol. The package API is stable.
Installation
go get github.com/gorilla/websocket
Protocol Compliance
The Gorilla WebSocket package passes the server tests in the Autobahn Test Suite using the application in the examples/autobahn subdirectory.
Gorilla WebSocket compared with other packages
| github.com/gorilla | golang.org/x/net | |
|---|---|---|
| RFC 6455 Features | ||
| Passes Autobahn Test Suite | Yes | No |
| Receive fragmented message | Yes | No, see note 1 |
| Send close message | Yes | No |
| Send pings and receive pongs | Yes | No |
| Get the type of a received data message | Yes | Yes, see note 2 |
| Other Features | ||
| Compression Extensions | Experimental | No |
| Read message using io.Reader | Yes | No, see note 3 |
| Write message using io.WriteCloser | Yes | No, see note 3 |
Notes:
- Large messages are fragmented in Chrome's new WebSocket implementation.
- The application can get the type of a received data message by implementing a Codec marshal function.
- The go.net io.Reader and io.Writer operate across WebSocket frame boundaries. Read returns when the input buffer is full or a frame boundary is encountered. Each call to Write sends a single frame message. The Gorilla io.Reader and io.WriteCloser operate on a single WebSocket message.