search

lidgren / lidgren-network-gen3

Lidgren Network Library
https://groups.google.com/forum/#!forum/lidgren-network-gen3
MIT License
1.19k stars 331 forks source link

Incorrect network messages/malformed packets could easily overwhelm the server #132

Closed aienabled closed 4 years ago

aienabled commented 4 years ago

Hello! It seems the massive number of incorrect packets could easily overwhelm the server. I'm especially confused as I see simple return; https://github.com/lidgren/lidgren-network-gen3/blob/c18c8b96329772f49ec43362d4a219c1820870d6/Lidgren.Network/NetPeer.Internal.cs#L517 from the Heartbeat method instead of graceful handling of the issue. Especially weird as the Heartbeat method supposed to process all received packets but it breaks out of the loop quickly when any of the issue happens. I guess it's not intended to return; from the whole method, the intended behavior should be just skip this message (and drop the client if it's spamming such messages too often).

Regards!

lidgren commented 4 years ago

You are correct; it should be a break instead of a return. I don't really support this library actively any more, but if you make a merge request I will approve it.

aienabled commented 4 years ago

Thanks for a quick reply, Michael! I've submitted a pull request. Yes, I know the library is no longer actively supported and I didn't actually expected a quick reply. It's still possible to overwhelm the server with a massive number of packets as it will create incredible number of log entries but it's straightforward to suppress. I've tested and with the suppressed logging the library was able to sustain 1 Gbps UDP flood DDoS attack very well (before the fix+log suppression I had a problem sustaining even ~30 Mbps attack as the server was becoming unresponsive).

Also, I want to thank you for a good job done when making this library, Michael. I'm using it in my (quite heavy loaded) online game projects since 2013 with a major success. My livelihood depends on the library reliability and thankfully it works great most of the time. I will consider making pull requests for a few other issues I was able to locate and fix during these years.

Regards!