#3066: Put ReadTimeoutHandler after frame decoder.
This reduces the impact of attacks that send a large packet size first and then send data very slowly but frequently enough to not trigger a timeout (as the timeout handler was before the Varint21FrameDecoder). This causes connections to stay open for a long time without much effort from an attacker, while the packet never leaves the Varint21FrameDecpder stage of the netty pipeline (causing no additional checks to happen and no logs of the connection to be created). This will not have an impact on bad connections as without recieving full packets the underlying spigot server would timeout instead.
This commit is contained in:
parent
ac371bb596
commit
71d1246374
@ -172,8 +172,8 @@ public class PipelineUtils
|
|||||||
ch.config().setAllocator( PooledByteBufAllocator.DEFAULT );
|
ch.config().setAllocator( PooledByteBufAllocator.DEFAULT );
|
||||||
ch.config().setWriteBufferWaterMark( MARK );
|
ch.config().setWriteBufferWaterMark( MARK );
|
||||||
|
|
||||||
ch.pipeline().addLast( TIMEOUT_HANDLER, new ReadTimeoutHandler( BungeeCord.getInstance().config.getTimeout(), TimeUnit.MILLISECONDS ) );
|
|
||||||
ch.pipeline().addLast( FRAME_DECODER, new Varint21FrameDecoder() );
|
ch.pipeline().addLast( FRAME_DECODER, new Varint21FrameDecoder() );
|
||||||
|
ch.pipeline().addLast( TIMEOUT_HANDLER, new ReadTimeoutHandler( BungeeCord.getInstance().config.getTimeout(), TimeUnit.MILLISECONDS ) );
|
||||||
ch.pipeline().addLast( FRAME_PREPENDER, framePrepender );
|
ch.pipeline().addLast( FRAME_PREPENDER, framePrepender );
|
||||||
|
|
||||||
ch.pipeline().addLast( BOSS_HANDLER, new HandlerBoss() );
|
ch.pipeline().addLast( BOSS_HANDLER, new HandlerBoss() );
|
||||||
|
Loading…
Reference in New Issue
Block a user