Reverb Version

1.4.1

Laravel Version

11.27.2

PHP Version

8.3.6

Description

Exposed a laravel reverb app. User has programmed his client a little wrong in java. Reconnects all the time, coming over 1024 connectsions (<5 expected).

So when I broadcast a new event, it sometimes failes, because there are already 1024 open connections:

Illuminate\Broadcasting\BroadcastException: Pusher error: cURL error 7: Failed to connect to 127.0.0.1 port 8080 after 0 ms: Couldn't connect to server (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for http://127.0.0.1:8080/apps/493533/events?auth_key=xxxx&auth_timestamp=1730487038&auth_version=1.0&body_md5=0a01f3833650db5de7baf1b4a39114f8&auth_signature=xxxxxx. in /var/www/default/vendor/laravel/framework/src/Illuminate/Broadcasting/Broadcasters/PusherBroadcaster.php:164

In the reverb log I see:

ErrorException

  stream_select(): You MUST recompile PHP with a larger value of FD_SETSIZE.
It is set to 1024, but you have descriptors numbered at least as high as 1024.
 --enable-fd-setsize=2048 is recommended, but you may want to set it
to equal the maximum number of open files supported by your system,
in order to avoid seeing this error again at a later date.

  at /var/www/default/vendor/react/event-loop/src/StreamSelectLoop.php:304
    300▕                 return ($previous !== null) ? \call_user_func_array($previous, \func_get_args()) : false;
    301▕             });
    302▕
    303▕             try {
  ➜ 304▕                 $ret = \stream_select($read, $write, $except, $timeout === null ? null : 0, $timeout);
    305▕                 \restore_error_handler();
    306▕             } catch (\Throwable $e) { // @codeCoverageIgnoreStart
    307▕                 \restore_error_handler();
    308▕                 throw $e;

      +17 vendor frames

  18  /var/www/default/artisan:35
      Illuminate\Foundation\Console\Kernel::handle()


   INFO  Starting server on 0.0.0.0:8080 (127.0.0.1).

So I think it would be good to prevent this in some way, as one could bring down the whole reverb with just a faulty client. So my ideas are:

• rate / connection limit per IP
• reserve connections for local app (sender)

Steps To Reproduce

1. Set up a working reverb app
2. Set up a faulty client, that opens as many connections as possible
3. Try to broadcast an event