fix: Telepathy updated to latest version: protect against allocation …

…attacks via MaxMessageSize. Can be configured in the TelepathyTransport component now.
MirageNet · Mar 23, 2019 · 67d715f · 67d715f
1 parent b0af876
commit 67d715f
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/Assets/Mirror/Runtime/Transport/Telepathy/Telepathy.dll b/Assets/Mirror/Runtime/Transport/Telepathy/Telepathy.dll
diff --git a/Assets/Mirror/Runtime/Transport/TelepathyTransport.cs b/Assets/Mirror/Runtime/Transport/TelepathyTransport.cs
@@ -10,6 +10,9 @@ public class TelepathyTransport : Transport
         [Tooltip("Nagle Algorithm can be disabled by enabling NoDelay")]
         public bool NoDelay = true;
 
+        [Tooltip("Protect against allocation attacks by keeping the max message size small. Otherwise an attacker might send multiple fake packets with 2GB headers, causing the server to run out of memory after allocating multiple large packets.")]
+        public int MaxMessageSize = 16 * 1024;
+
         protected Telepathy.Client client = new Telepathy.Client();
         protected Telepathy.Server server = new Telepathy.Server();
 
@@ -22,7 +25,9 @@ void Awake()
 
             // configure
             client.NoDelay = NoDelay;
+            client.MaxMessageSize = MaxMessageSize;
             server.NoDelay = NoDelay;
+            server.MaxMessageSize = MaxMessageSize;
 
             // HLAPI's local connection uses hard coded connectionId '0', so we
             // need to make sure that external connections always start at '1'