{"action":"created","issue":{"url":"https://api.github.com/repos/nats-io/gnatsd/issues/168","repository_url":"https://api.github.com/repos/nats-io/gnatsd","labels_url":"https://api.github.com/repos/nats-io/gnatsd/issues/168/labels{/name}","comments_url":"https://api.github.com/repos/nats-io/gnatsd/issues/168/comments","events_url":"https://api.github.com/repos/nats-io/gnatsd/issues/168/events","html_url":"https://github.com/nats-io/gnatsd/issues/168","id":124003145,"number":168,"title":"Client can prematurely decrement pending pings.","user":{"login":"xorgy","id":1272018,"avatar_url":"https://avatars.githubusercontent.com/u/1272018?v=3","gravatar_id":"","url":"https://api.github.com/users/xorgy","html_url":"https://github.com/xorgy","followers_url":"https://api.github.com/users/xorgy/followers","following_url":"https://api.github.com/users/xorgy/following{/other_user}","gists_url":"https://api.github.com/users/xorgy/gists{/gist_id}","starred_url":"https://api.github.com/users/xorgy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xorgy/subscriptions","organizations_url":"https://api.github.com/users/xorgy/orgs","repos_url":"https://api.github.com/users/xorgy/repos","events_url":"https://api.github.com/users/xorgy/events{/privacy}","received_events_url":"https://api.github.com/users/xorgy/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"derekcollison","id":90097,"avatar_url":"https://avatars.githubusercontent.com/u/90097?v=3","gravatar_id":"","url":"https://api.github.com/users/derekcollison","html_url":"https://github.com/derekcollison","followers_url":"https://api.github.com/users/derekcollison/followers","following_url":"https://api.github.com/users/derekcollison/following{/other_user}","gists_url":"https://api.github.com/users/derekcollison/gists{/gist_id}","starred_url":"https://api.github.com/users/derekcollison/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/derekcollison/subscriptions","organizations_url":"https://api.github.com/users/derekcollison/orgs","repos_url":"https://api.github.com/users/derekcollison/repos","events_url":"https://api.github.com/users/derekcollison/events{/privacy}","received_events_url":"https://api.github.com/users/derekcollison/received_events","type":"User","site_admin":false},"milestone":null,"comments":5,"created_at":"2015-12-28T00:35:45Z","updated_at":"2016-03-02T19:32:19Z","closed_at":null,"body":"gnatsd [will decrement client.pout below zero][1] when the client sends a `PONG`. As a result, the client can send any number of `PONG`s in advance to avoid timeout.\r\n\r\nPerhaps this could lead to DoS if malicious clients open a large number of connections which are not properly closed.\r\n\r\nIn addition to the practical concerns, this also disagrees with the protocol description.\r\n\"If the client fails to respond with a PONG message within the configured response interval, the server will terminate its connection.\"\r\n\r\n[1]: https://github.com/nats-io/gnatsd/blob/e9b5839bf0dff0f5c453d0741efa20509c2f2aed/server/client.go#L336"},"comment":{"url":"https://api.github.com/repos/nats-io/gnatsd/issues/comments/191388773","html_url":"https://github.com/nats-io/gnatsd/issues/168#issuecomment-191388773","issue_url":"https://api.github.com/repos/nats-io/gnatsd/issues/168","id":191388773,"user":{"login":"xorgy","id":1272018,"avatar_url":"https://avatars.githubusercontent.com/u/1272018?v=3","gravatar_id":"","url":"https://api.github.com/users/xorgy","html_url":"https://github.com/xorgy","followers_url":"https://api.github.com/users/xorgy/followers","following_url":"https://api.github.com/users/xorgy/following{/other_user}","gists_url":"https://api.github.com/users/xorgy/gists{/gist_id}","starred_url":"https://api.github.com/users/xorgy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xorgy/subscriptions","organizations_url":"https://api.github.com/users/xorgy/orgs","repos_url":"https://api.github.com/users/xorgy/repos","events_url":"https://api.github.com/users/xorgy/events{/privacy}","received_events_url":"https://api.github.com/users/xorgy/received_events","type":"User","site_admin":false},"created_at":"2016-03-02T19:32:19Z","updated_at":"2016-03-02T19:32:19Z","body":"The more I look at the protocol document, the more I think that PONG should reset pout to 0 rather than decrementing it.\r\n\r\n>`PING` and `PONG` implement a simple keep-alive mechanism between client and server. Once a client establishes a connection to the NATS server, the server will continuously send `PING` messages to the client at a configurable interval. If the client fails to **respond with a `PONG` message within the configured response interval**, the server will terminate its connection.\r\n\r\nNote that it doesn't say you have to respond to _each_ of the PING requests, only that you have to respond with a `PONG` in time."}}