Skip to content

Fix handshake hostname length limit and plugin message drop during join #1783

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SendableMetatype wants to merge 2 commits into
base: dev/3.0.0
Choose a base branch
from
+17 −20
Open

Fix handshake hostname length limit and plugin message drop during join #1783

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
88d865f
Fix handshake hostname length limit and plugin message drop during join
SendableMetatype May 11, 2026
0c1599e
Fix LegacyPingDecoder false positive on 0xFE varint length
SendableMetatype May 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 3 additions & 8 deletions ...y/src/main/java/com/velocitypowered/proxy/connection/client/ClientPlaySessionHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,6 @@
import com.velocitypowered.proxy.connection.backend.BackendConnectionPhases;
import com.velocitypowered.proxy.connection.backend.BungeeCordMessageResponder;
import com.velocitypowered.proxy.connection.backend.VelocityServerConnection;
import com.velocitypowered.proxy.connection.forge.legacy.LegacyForgeConstants;
import com.velocitypowered.proxy.connection.player.resourcepack.ResourcePackResponseBundle;
import com.velocitypowered.proxy.protocol.MinecraftPacket;
import com.velocitypowered.proxy.protocol.StateRegistry;
Expand Down Expand Up @@ -299,13 +298,9 @@ public boolean handle(TabCompleteRequestPacket packet) {

@Override
public boolean handle(PluginMessagePacket packet) {
// Handling edge case when packet with FML client handshake (state COMPLETE)
// arrives after JoinGame packet from destination server
VelocityServerConnection serverConn =
(player.getConnectedServer() == null
&& packet.getChannel().equals(
LegacyForgeConstants.FORGE_LEGACY_HANDSHAKE_CHANNEL))
? player.getConnectionInFlight() : player.getConnectedServer();
final VelocityServerConnection connected = player.getConnectedServer();
final VelocityServerConnection serverConn =
connected != null ? connected : player.getConnectionInFlight();

MinecraftConnection backendConn = serverConn != null ? serverConn.getConnection() : null;
if (serverConn != null && backendConn != null) {
Expand Down
17 changes: 12 additions & 5 deletions proxy/src/main/java/com/velocitypowered/proxy/protocol/netty/LegacyPingDecoder.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,13 +57,20 @@ protected void decode(ChannelHandlerContext ctx, ByteBuf in, List<Object> out) t
}

short next = in.readUnsignedByte();
if (next == 1 && !in.isReadable()) {
out.add(new LegacyPingPacket(LegacyMinecraftPingVersion.MINECRAFT_1_4));
return;
if (next == 1) {
if (!in.isReadable()) {
out.add(new LegacyPingPacket(LegacyMinecraftPingVersion.MINECRAFT_1_4));
return;
}
if (in.getUnsignedByte(in.readerIndex()) == 0xFA) {
out.add(readExtended16Data(in));
return;
}
}

// We got a 1.6.x ping. Let's chomp off the stuff we don't need.
out.add(readExtended16Data(in));
// Not a legacy ping. Reset and let the modern decoder handle it.
in.readerIndex(originalReaderIndex);
ctx.pipeline().remove(this);
} else if (first == 0x02 && in.isReadable()) {
in.skipBytes(in.readableBytes());
out.add(new LegacyHandshakePacket());
Expand Down
9 changes: 2 additions & 7 deletions proxy/src/main/java/com/velocitypowered/proxy/protocol/packet/HandshakePacket.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,6 @@

package com.velocitypowered.proxy.protocol.packet;

import static com.velocitypowered.proxy.connection.forge.legacy.LegacyForgeConstants.HANDSHAKE_HOSTNAME_TOKEN;

import com.velocitypowered.api.network.HandshakeIntent;
import com.velocitypowered.api.network.ProtocolVersion;
import com.velocitypowered.proxy.connection.MinecraftSessionHandler;
Expand All @@ -29,9 +27,6 @@

public class HandshakePacket implements MinecraftPacket {

// This size was chosen to ensure Forge clients can still connect even with very long hostnames.
// While DNS technically allows any character to be used, in practice ASCII is used.
private static final int MAXIMUM_HOSTNAME_LENGTH = 255 + HANDSHAKE_HOSTNAME_TOKEN.length() + 1;
private ProtocolVersion protocolVersion;
private String serverAddress = "";
private int port;
Expand Down Expand Up @@ -89,7 +84,7 @@ public String toString() {
public void decode(ByteBuf buf, ProtocolUtils.Direction direction, ProtocolVersion ignored) {
int realProtocolVersion = ProtocolUtils.readVarInt(buf);
this.protocolVersion = ProtocolVersion.getProtocolVersion(realProtocolVersion);
this.serverAddress = ProtocolUtils.readString(buf, MAXIMUM_HOSTNAME_LENGTH);
this.serverAddress = ProtocolUtils.readString(buf, Short.MAX_VALUE);
this.port = buf.readUnsignedShort();
this.nextStatus = ProtocolUtils.readVarInt(buf);
this.intent = HandshakeIntent.getById(nextStatus);
Expand Down Expand Up @@ -117,7 +112,7 @@ public int decodeExpectedMinLength(ByteBuf buf, ProtocolUtils.Direction directio
@Override
public int decodeExpectedMaxLength(ByteBuf buf, ProtocolUtils.Direction direction,
ProtocolVersion version) {
return 9 + (MAXIMUM_HOSTNAME_LENGTH * 3);
return 9 + (Short.MAX_VALUE * 3);
}

@Override
Expand Down