search

Exceptionflug / protocolize

A lightweight BungeeCord / Velocity protocol framework supporting items
MIT License
294 stars 39 forks source link

Server crash with pipeline not initialized #221

Open zestian56 opened 7 months ago

zestian56 commented 7 months ago

Describe the bug A clear and concise description of what the bug is. image

To Reproduce Not sure how this can be reproduced

Expected behavior Server doesnt crash

Screenshots https://pastebin.com/eRmJZyHU

Proxy environment Velocity latest version

Minecraft versions used Only proxy

NaTorOG commented 7 months ago

Exactly same spamming happened to us, we have discovered with our host that this is related to an exploit involving handshakes. Basically attacker is sending multiple malformed handshakes, server doesn't crash due to the host filtering most of the attack but there is huge console spam

zestian56 commented 7 months ago

I just have a lot of bot attacks, and even the lowest one was crashing the server. the issue was with protocolozy.

The issue is that protocolize fails a packet on PLAYER PING, each time a player pings the server it executes a packet event and that can saturate de cpu.

here is the output of what was happening. https://pastebin.com/eRmJZyHU

Exceptionflug commented 7 months ago

Hey, what plugins do you have installed on Velocity? This issue currently only occurs when having Geyser installed, which is currently incompatible with protocolize.

Exceptionflug commented 7 months ago

I just have a lot of bot attacks, and even the lowest one was crashing the server. the issue was with protocolozy.

The issue is that protocolize fails a packet on PLAYER PING, each time a player pings the server it executes a packet event and that can saturate de cpu.

here is the output of what was happening. https://pastebin.com/eRmJZyHU

From the error beside, Protocolize is doing everything right here. It is it's job to process incoming events. If you want to mitigate dos attacks, you should consider adding a TCPShield proxy in front or use dedicated anti DDoS hard- and software like SteelShield for example.