Server Crash From Client Sending Bad Packets? In IRIS

Development Programming & Scripting Multiplayer & Networking
, ,
1

This has occured a few times in live for us, we have a mitigation on our side but hoping for a official epic solution.

[Attachment Removed]

2

Steps to Reproduce
I have written a automation test that will repro this crash 100% of the time, its because a bad packet/s is sent by client, we have seen it on live for our game 3 times in last 3 weeks:

```

#include "Iris/ReplicationSystem/NetTokenStore.h"
#include "Iris/ReplicationSystem/StringTokenStore.h"
#include "Iris/Serialization/NetBitStreamReader.h"
#include "Iris/Serialization/NetSerializationContext.h"
#include "Misc/AutomationTest.h"
#include "Tests/EnsureScope.h"

#if WITH_DEV_AUTOMATION_TESTS

IMPLEMENT_SIMPLE_AUTOMATION_TEST(FNetTokenMissingStoreTest, "Net.Iris.NetTokenStore.MissingStore",
    EAutomationTestFlags::EditorContext | EAutomationTestFlags::NegativeFilter)

bool FNetTokenMissingStoreTest::RunTest(const FString& Parameters)
{
    using namespace UE::Net;

    FNetTokenStore TokenStore;
    FNetTokenStore::FInitParams InitParams = {};
    InitParams.Authority = FNetToken::ENetTokenAuthority::Authority;
    InitParams.MaxConnections = 2;
    TokenStore.Init(InitParams);
    TokenStore.InitRemoteNetTokenStoreState(1);

    if (!TestTrue(TEXT("Register string store"), TokenStore.CreateAndRegisterDataStore<FStringTokenStore>()))
    {
       return false;
    }

    const FNetToken Token = TokenStore.GetDataStore<FStringTokenStore>()->GetOrCreateToken(TEXT("Test"));
    if (!TestTrue(TEXT("Token is valid"), Token.IsValid())
       || !TestTrue(TEXT("Unregister string store"), TokenStore.DeleteAndUnRegisterDataStore<FStringTokenStore>()))
    {
       return false;
    }

    uint32 Buffer = 0;
    FNetBitStreamReader Reader;
    Reader.InitBits(&Buffer, sizeof(Buffer) * 8);
    FNetSerializationContext Context(&Reader);

    AddExpectedErrorPlain(TEXT("Failed to read ReadTokenData for ") + Token.ToString());
    {
       // Unregistration leaves an in-range null slot. Without the guard, this call crashes.
       FEnsureScope ExpectedEnsure;
       TokenStore.ReadTokenData(Context, Token, *TokenStore.GetRemoteNetTokenStoreState(1));
    }

    return TestEqual(TEXT("Missing store is rejected"), Context.GetError(), GNetError_InvalidValue);
}

#endif // WITH_DEV_AUTOMATION_TESTS

```

[Attachment Removed]

3

Hi,

Thank you for the report and repro test. I’ve opened a new issue for this, UE-402176, which should be visible on the public tracker in a day or so.

In the meanwhile, would you be willing to share the mitigation you’re currently using, and is that that mitigation working for you? Are you doing something like checking if the DataStore pointer in ReadTokenData is null before using it, or removing the unregistered entries from TokenDataStores in FNetTokenStore::UnRegisterDataStore?

Thanks,

Alex

[Attachment Removed]

4

in NetStoreToken.cpp i put two lines:

L445

if (TokenTypeId >= (uint32)TokenDataStores.Num() || !TokenDataStores[TokenTypeId].Get<1>().IsValid())

and also

L476

if (Ar.IsError() || TokenTypeId >= (uint32)TokenDataStores.Num() || !TokenDataStores[TokenTypeId].Get<1>().IsValid())

[Attachment Removed]

5

Hi,

Thank you for providing the workaround. I’ll include this info on our internal tracker for the issue.

Thanks,

Alex

[Attachment Removed]