fix: bound JMAP pre-auth connections #27

Merged

ober merged 1 commit from fix/astra-jmap-resource-limits into main

2026-09-23 18:04:09 -04:00

ober commented

2026-09-23 17:45:24 -04:00

Owner

Problem

JMAP accepted allowlisted status only after TLS setup and request parsing. The configured max_connections value was used as the listen backlog while pre-auth workers had no per-peer cap or bounded TLS/socket I/O. Native TLS close could also contend with a blocked read and race descriptor reuse.

Changes

Reject disallowed peers immediately after accept, before TLS state or worker creation.
Enforce global and per-IP active worker caps with exact release accounting.
Apply bounded native socket read/write timeouts to handshake, request, and response I/O.
Add mutex-independent TLS abort using an independently owned duplicated socket descriptor.
Shut down the transport before removing the native connection entry.
Add allowlist regression coverage.
Stop cached DB actors before init-db! opens raw connections, fixing test and maintenance reset races.
Bump VERSION and jpkg.sexp to 0.2.32.

Verification

make test — all Scheme tests pass.
make verify — security gates, Scheme tests, native Rust tests, Android native tests, build, and e2e pass.
make binary passes.
./jjmapd --help passes.
./support/e2e-local.sh passes.
Native Rust tests: 9 passed; Android native tests: 6 passed.

The generated jjmapd and FFI symbol list are included because this repository tracks the executable release artifact.

## Problem JMAP accepted allowlisted status only after TLS setup and request parsing. The configured `max_connections` value was used as the listen backlog while pre-auth workers had no per-peer cap or bounded TLS/socket I/O. Native TLS close could also contend with a blocked read and race descriptor reuse. ## Changes - Reject disallowed peers immediately after accept, before TLS state or worker creation. - Enforce global and per-IP active worker caps with exact release accounting. - Apply bounded native socket read/write timeouts to handshake, request, and response I/O. - Add mutex-independent TLS abort using an independently owned duplicated socket descriptor. - Shut down the transport before removing the native connection entry. - Add allowlist regression coverage. - Stop cached DB actors before `init-db!` opens raw connections, fixing test and maintenance reset races. - Bump `VERSION` and `jpkg.sexp` to `0.2.32`. ## Verification - `make test` — all Scheme tests pass. - `make verify` — security gates, Scheme tests, native Rust tests, Android native tests, build, and e2e pass. - `make binary` passes. - `./jjmapd --help` passes. - `./support/e2e-local.sh` passes. - Native Rust tests: 9 passed; Android native tests: 6 passed. The generated `jjmapd` and FFI symbol list are included because this repository tracks the executable release artifact.

ober added 1 commit

2026-09-23 17:45:24 -04:00