Harden vote listener resource limits and add optional V1 disable mode

[BenCodez]

Summary

• add DisableV1: false to Bukkit, BungeeCord, and Velocity configuration
• preserve legacy compatibility by default
• reject both pre-sent and delayed Votifier V1 packets when DisableV1 is enabled
• force a V2 handshake when V1 is disabled, even if TokenSupport was left false
• warn when TokenSupport is enabled while V1 compatibility remains enabled
• refresh the V1 policy immediately on Bukkit reload
• replace unbounded connection and forwarding executor queues with bounded queues and backpressure
• close connections rejected because the listener queue is full and discard stale queued connections
• read fragmented V1 packets through the parser instead of relying on InputStream.available()
• bound PROXY v1 and HTTP CONNECT line/header parsing
• use one cumulative five-second deadline for PROXY v1, PROXY v2, and CONNECT parsing
• stream-discard PROXY v2 extension data instead of allocating from the attacker-provided length

Protocol behavior

TokenSupport	DisableV1	Accepted protocols
false	false	V1
true	false	V1 and V2, with a startup warning
false	true	V2 only
true	true	V2 only

DisableV1 is intentionally separate from TokenSupport, so existing voting sites that still require V1 are not broken by enabling token support.

Parser limits

• PROXY v1: 107 bytes maximum
• CONNECT line: 8 KiB maximum
• CONNECT headers: 100 maximum
• CONNECT aggregate header data: 32 KiB maximum
• PROXY/CONNECT cumulative read deadline: 5 seconds

Tests

Added regression coverage for:

• token compatibility mode continuing to accept V1
• fragmented V1 packets arriving in multiple TCP writes
• immediate and delayed V1 rejection when DisableV1 is enabled
• valid V2 acceptance in V2-only mode
• full listener queue rejection and socket closure
• valid PROXY v1 and CONNECT forwarding behavior
• oversized PROXY v1 headers
• oversized CONNECT lines, header counts, and aggregate headers
• decreasing PROXY v2 socket timeouts under the cumulative deadline

Codex security findings addressed

• Token mode still accepts legacy RSA vote packets (9300e9612d908191ba0f301dca7aa339)
• Unbounded vote connection executor enables remote DoS (9c22c997e39c8191b6873dcb0ba0d75f)
• Unbounded PROXY header read enables remote DoS (6b8ef4f9eb4881919f00aa4b2ebcd3e0)
• Unbounded CONNECT header parsing enables vote listener DoS (88a30d7af76881918cc5532a5be8ffa1)
• PROXY v2 slow-read lets one client stall vote listener (c647164235f48191a75ffd85544947b4)

The inherent V1 public-key forgery limitation remains available only for compatibility; operators can now close that path explicitly with DisableV1: true.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e4931fd8f9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BenCodez]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 378fc73caf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".