Merge pull request #1350 from p12tic/fix-file-handles-leak

Fix file descriptor leak on incomplete connections [SECURITY VULNERABILITY CVE-2021-42075]

doc/newsfragments/close-failed-handshake-connections.bugfix

@@ -0,0 +1,6 @@
+SECURITY ISSUE
+
+Barrier will now correctly close connections when the app-level handshake fails (fixes CVE-2021-42075).
+
+Previously repeated failing connections would leak file descriptors leading to Barrier being unable
+to receive new connections from clients.

src/lib/server/ClientListener.cpp

@@ -194,6 +194,11 @@ ClientListener::handleUnknownClient(const Event&, void* vclient)
                             new TMethodEventJob<ClientListener>(this,
                                 &ClientListener::handleClientDisconnected,
                                 client));
+    } else {
+        auto* stream = unknownClient->getStream();
+        if (stream) {
+            stream->close();
+        }
     }
 
     // now finished with unknown client