PandacubeFr/BungeeCord
1
0
Fork 0
Code Releases Activity

#3066: Put ReadTimeoutHandler after frame decoder.

Browse Source 
This reduces the impact of attacks that send a large packet size first and then send data very slowly but frequently enough to not trigger a timeout (as the timeout handler was before the Varint21FrameDecoder). This causes connections to stay open for a long time without much effort from an attacker, while the packet never leaves the Varint21FrameDecpder stage of the netty pipeline (causing no additional checks to happen and no logs of the connection to be created).

This will not have an impact on bad connections as without recieving full packets the underlying spigot server would timeout instead.
This commit is contained in:
Janmm14 2021-04-28 16:52:00 +10:00 committed by md_5
parent ac371bb596
commit 71d1246374
No known key found for this signature in database
GPG Key ID: E8E901AC7C617C11
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
proxy/src/main/java/net/md_5/bungee/netty/PipelineUtils.java
View File

@ -172,8 +172,8 @@ public class PipelineUtils
ch.config().setAllocator( PooledByteBufAllocator.DEFAULT );
ch.config().setWriteBufferWaterMark( MARK );
ch.pipeline().addLast( TIMEOUT_HANDLER, new ReadTimeoutHandler( BungeeCord.getInstance().config.getTimeout(), TimeUnit.MILLISECONDS ) );
ch.pipeline().addLast( FRAME_DECODER, new Varint21FrameDecoder() );
ch.pipeline().addLast( TIMEOUT_HANDLER, new ReadTimeoutHandler( BungeeCord.getInstance().config.getTimeout(), TimeUnit.MILLISECONDS ) );
ch.pipeline().addLast( FRAME_PREPENDER, framePrepender );
ch.pipeline().addLast( BOSS_HANDLER, new HandlerBoss() );