Repository navigation
fix(velocity): verify transfer cookies before the shared IP login limit - #335
Merged
Merged
Conversation
This was referenced Oct 31, 2026
Merged
lusu007
marked this pull request as ready for review
October 31, 2026 19:47
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automatic restart transfers can hit Velocity's shared-IP login limit before plugin-player's handoff check. Extend the existing checksum-guarded build pipeline with two exact early-login hooks: request the handoff cookie before encryption, reserve it with service-player, then resume Velocity's original online authentication.
Normal LOGIN keeps its existing limiter. TRANSFER alone never opens authentication. Bound pending/authentication slots, cookie size and verification time; close/timeout sends a bounded exact admission abort. The feature is OFF by default and requires the matching service-player API plus plugin-player bridge.
Validation: reproducible pinned-artifact build; checksum, reapplication and bytecode-drift guards; real LOGIN packets with the flag on/off, distinct profiles behind one NAT IP, replay across two actual Velocity processes, forged profile, invalid/missing/oversized cookie, slow authority and a full pending budget. The HTTP admission authority is an isolated fixture; this does not claim a live Mojang-authenticated smoke test.
Rollout and route inventory: scripts/transfer-admission/README.md. Publish API/plugins and bake the new plugin-agones before Stage canary activation. Public Stage activation requires authenticated-player smoke evidence. Local/PROXY changes remain gated because Cilium's current audit mode does not enforce the router trust boundary. No live settings or IP framing change here.
Review fixes: global 64-attempt/s budget (burst64) covers fast failures/direct connections; closed connections cancel timers. The 200-fast-failure regression was observed RED before the fix and is now GREEN. Broader planned-restart coordination and arbitrary shared-host capability discovery remain unfinished public-activation gates; the feature stays off.
Related changes: service-player#152, plugin-player#79, plugin-agones#103, plugin-proxy#116, containers#335.