From ec3f0678b0b08ac9117a02f61f6bd9a3972a735b Mon Sep 17 00:00:00 2001 From: Jan Romann Date: Sun, 10 Dec 2023 11:49:49 +0100 Subject: [PATCH 1/3] fix(coap-server): ignore incoming messages with an invalid source port --- packages/binding-coap/src/coap-server.ts | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/packages/binding-coap/src/coap-server.ts b/packages/binding-coap/src/coap-server.ts index af9529edf..e91da3dc4 100644 --- a/packages/binding-coap/src/coap-server.ts +++ b/packages/binding-coap/src/coap-server.ts @@ -435,6 +435,12 @@ export default class CoapServer implements ProtocolServer { } private async handleRequest(req: IncomingMessage, res: OutgoingMessage) { + if (req.rsinfo.port === 0) { + // Ignore requests with an invalid source port + // See https://github.com/eclipse-thingweb/node-wot/issues/1182 + return; + } + const origin = this.formatRequestOrigin(req); debug( From a640d6cfb8247f386d89d86e6a5f0fe8fb13625b Mon Sep 17 00:00:00 2001 From: Jan Romann Date: Mon, 11 Dec 2023 22:52:06 +0100 Subject: [PATCH 2/3] fixup! fix(coap-server): ignore incoming messages with an invalid source port --- packages/binding-coap/src/coap-server.ts | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/packages/binding-coap/src/coap-server.ts b/packages/binding-coap/src/coap-server.ts index e91da3dc4..4d1850c96 100644 --- a/packages/binding-coap/src/coap-server.ts +++ b/packages/binding-coap/src/coap-server.ts @@ -435,7 +435,9 @@ export default class CoapServer implements ProtocolServer { } private async handleRequest(req: IncomingMessage, res: OutgoingMessage) { - if (req.rsinfo.port === 0) { + const sourcePort = req.rsinfo.port; + const hasInvalidPortRange = sourcePort < 1 || sourcePort > 65535; + if (hasInvalidPortRange) { // Ignore requests with an invalid source port // See https://github.com/eclipse-thingweb/node-wot/issues/1182 return; From ba92879e1184b4282b6ae0690a20c8980903fd47 Mon Sep 17 00:00:00 2001 From: Jan Romann Date: Mon, 11 Dec 2023 22:54:02 +0100 Subject: [PATCH 3/3] fixup! fix(coap-server): ignore incoming messages with an invalid source port --- packages/binding-coap/src/coap-server.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/binding-coap/src/coap-server.ts b/packages/binding-coap/src/coap-server.ts index 4d1850c96..474538737 100644 --- a/packages/binding-coap/src/coap-server.ts +++ b/packages/binding-coap/src/coap-server.ts @@ -436,7 +436,7 @@ export default class CoapServer implements ProtocolServer { private async handleRequest(req: IncomingMessage, res: OutgoingMessage) { const sourcePort = req.rsinfo.port; - const hasInvalidPortRange = sourcePort < 1 || sourcePort > 65535; + const hasInvalidPortRange = sourcePort < 1 || sourcePort > 65535; if (hasInvalidPortRange) { // Ignore requests with an invalid source port // See https://github.com/eclipse-thingweb/node-wot/issues/1182