From 7455ac56eb59a78c8d458817442a295dd18f819b Mon Sep 17 00:00:00 2001 From: JackDoan Date: Wed, 29 Jul 2026 17:11:58 -0500 Subject: [PATCH] outside: drop oversized test requests regardless of log level The return lived inside a log-level-gated else-if, so with debug logging off, control fell out of both switches. Nothing follows the switch today, making it a silent drop by luck; any future code added after the switch would have run for oversized Test requests only when debug logging was disabled. Make the drop a guard clause. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_014ugV2edVqoz3tBvq9J6yWp --- outside.go | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/outside.go b/outside.go index 3dea72bd..85d5d752 100644 --- a/outside.go +++ b/outside.go @@ -161,13 +161,14 @@ func (f *Interface) readOutsidePackets(via ViaSender, scratch []byte, packet []b case header.TestRequest: const maxCipherOverhead = 16 //todo we use this too often, needs a real importable const const maxOverhead = header.Len + header.Len + maxCipherOverhead + maxCipherOverhead - if maxOverhead+len(out) <= len(scratch) { - f.send(header.Test, header.TestReply, hostinfo.ConnectionState, hostinfo, out, nb, scratch[:0]) - return - } else if f.l.Enabled(context.Background(), slog.LevelDebug) { - hostinfo.logger(f.l).Debug("dropping oversized test request", "payloadLen", len(out), "from", via) + if maxOverhead+len(out) > len(scratch) { + // A reply that cannot fit in scratch is dropped no matter the log level. + if f.l.Enabled(context.Background(), slog.LevelDebug) { + hostinfo.logger(f.l).Debug("dropping oversized test request", "payloadLen", len(out), "from", via) + } return } + f.send(header.Test, header.TestReply, hostinfo.ConnectionState, hostinfo, out, nb, scratch[:0]) default: hostinfo.logger(f.l).Error("IsValidSubType was true, but unexpected test subtype seen", "from", via, "header", h) return