From fc439273c88123186d203f7b2a4025567ca5cb11 Mon Sep 17 00:00:00 2001 From: Teodor Calin Date: Sat, 25 Jul 2026 10:41:21 +0300 Subject: [PATCH] security: recover() in connection handler + common v0.5.9 (panic-DoS hardening) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The handshake decodes a peer-supplied public_key and calls crypto.Verify; a wrong-length key made ed25519.Verify panic, and handleConnection runs in its own goroutine — an unrecovered panic there crashes the daemon. common v0.5.9 makes crypto.Verify reject wrong-length keys (root fix); the recover() is defense-in-depth against any future panic in this unauthenticated path. Co-Authored-By: Claude Opus 4.8 --- go.mod | 2 +- go.sum | 4 ++-- handshake.go | 5 +++++ 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 3e3763f..8200d70 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/pilot-protocol/handshake go 1.25.12 require ( - github.com/pilot-protocol/common v0.5.7 + github.com/pilot-protocol/common v0.5.9 github.com/pilot-protocol/pilotprotocol v1.13.2 ) diff --git a/go.sum b/go.sum index c0b1431..5599793 100644 --- a/go.sum +++ b/go.sum @@ -1,7 +1,7 @@ github.com/coder/websocket v1.8.15 h1:6B2JPeOGlpff2Uz6vOEH1Vzpi0iUz20A+lPVhPHtNUA= github.com/coder/websocket v1.8.15/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg= -github.com/pilot-protocol/common v0.5.7 h1:GY6KhB+PwV713HAAhVrVEZJN9e5DsnbfElPiOAEpzJE= -github.com/pilot-protocol/common v0.5.7/go.mod h1:Y6yaOsywr8J4aGvyoyuOtDpwZTheFM7GOjDt6Y/ZB9I= +github.com/pilot-protocol/common v0.5.9 h1:oCeIxMl8PtJowSU9UfSdzFXQ4s2pxxQBAitsg6P6pm8= +github.com/pilot-protocol/common v0.5.9/go.mod h1:Ybc6f1A37s3ShoEh1nBMVL9DPyYlxvkqPTvtbxaNWg4= github.com/pilot-protocol/pilotprotocol v1.13.2 h1:ZZh+KQtAciX0hIxC111djs4fWCYwzbxIU0WnWoq2uKA= github.com/pilot-protocol/pilotprotocol v1.13.2/go.mod h1:eMkx7zGmtktfF4tlksYmLtIbP4DMKNdJITG2SGvVdbQ= github.com/pilot-protocol/rendezvous v0.2.5 h1:PvApwKHU2DnvK8pA6K9RAohUomZNu6vX6ccIEoTogvo= diff --git a/handshake.go b/handshake.go index ffee263..1c51d78 100644 --- a/handshake.go +++ b/handshake.go @@ -500,6 +500,11 @@ func (hm *Manager) Start() error { // single bounded Read rather than io.ReadAll so we return as soon as the // message bytes land, without waiting for the sender to close the stream. func (hm *Manager) handleConnection(stream coreapi.Stream) { + defer func() { + if r := recover(); r != nil { + slog.Error("handshake: recovered from panic in connection handler", "panic", r) + } + }() const maxMsgSize = 64 * 1024 type readResult struct {