Skip to content

Missing error handling in message receive loop #9

@rafabd1

Description

@rafabd1

In receive_loop() (session.rs:434-450), errors are silently logged but the stream is just closed:

match read_framed(&mut reader).await {
    Ok(frame) => {
        if let Err(e) = handle_incoming_message(&app, &frame).await {
        }
    }
    Err(e) => {
        *state.session.lock().await = None;
        let _ = app.emit("session_closed", ());
    }
}

Problems:

  1. Individual message errors don't close session: If one message fails to decrypt/process, the loop continues but the peer may have sent a critical message
  2. No user notification: User doesn't know there was an error. Messages may appear to not be received.
  3. Decryption errors silently ignored: Could indicate:
    • Ratchet desynchronization (key mismatch)
    • Peer sent malformed data
    • Network corruption
    • Active attack (?)

Examples:

  • Peer sends message with counter=2, but we expected counter=1
  • Ratchet.decrypt() fails but we ignore it and keep the stream open
  • Later messages (counter=3,4,...) also fail, but user has no idea

Proposed solution:

  • Treat decryption errors as fatal (close session, show user "decryption failed")
  • Log failures with more context (counter, error type)
  • Show user a warning: "Lost sync with peer, please reconnect"

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions