Limiting message size

[plonkster]

Is there any way to limit maximum websocket message size with Ratchet? As it is, an attacker can just send a 100MB message on a bunch of concurrent connections and effectively bring the server down due to memory exhaustion.

Thanks!

The message size can be limited when implementing the onMessage() method as per Ratchet\MessageInterface. The example below stops processing the request if exceeding 4096 bytes.

// ...

    public function onMessage(ConnectionInterface $from, $msg)
    {
        if (strlen($msg) > 4096) {
            return;
        }

        // ...
    }

// ...

[quakemmo]

This does not fix the issue as the memory has already been consumed before onMessage is called.

This needs to be done in Ratchet itself.

The following commit hardcodes a limit of 1000 bytes and solves the issue, ideally that would be some kind of configuration option.

fd3127e

😉 That's the frame size in WebSocket parlance I suppose.

[clue]

@plonkster Thanks for bringing this up, I agree this makes perfect sense and should be promoted and documented more obviously.

Ratchet uses https://github.com/ratchetphp/RFC6455 internally to handle the WebSocket connection logic. This package does provide two separate $maxMessagePayloadSize and $maxFramePayloadSize parameters (https://github.com/ratchetphp/RFC6455/blob/859d95f85dda0912c6d5b936d036d044e3af47ef/src/Messaging/MessageBuffer.php#L65) that Ratchet does not currently pass:

Ratchet/src/Ratchet/WebSocket/WsServer.php

Lines 128 to 139 in e5cd54c

	$streamer = new MessageBuffer(
	$this->closeFrameChecker,
	function(MessageInterface $msg) use ($wsConn) {
	$cb = $this->msgCb;
	$cb($wsConn, $msg);
	},
	function(FrameInterface $frame) use ($wsConn) {
	$this->onControlFrame($frame, $wsConn);
	},
	true,
	$this->ueFlowFactory
	);

As a result, it will apply default values of 1/4 of your memory_limit PHP setting (https://github.com/ratchetphp/RFC6455/blob/859d95f85dda0912c6d5b936d036d044e3af47ef/src/Messaging/MessageBuffer.php#L90-L95). Using PHP's default of 128M, this would mean frames/messages could be up to 32 MiB in size.

If the client tries to send a message that exceeds this limit, it will automatically be closed (https://github.com/ratchetphp/RFC6455/blob/859d95f85dda0912c6d5b936d036d044e3af47ef/src/Messaging/MessageBuffer.php#L158-L165) with an appropriate error message.

For reference, other projects such as https://github.com/websockets/ws have a default maxPayload of 100 MiB.

I'm not sure when I'll have a chance to get back to this again, so PRs very much welcome! 👍

If you'd like to support Ratchet, consider sponsoring the project – sponsorships really do make a difference. ❤️