Socket Leak Denial of Service

Hi. I'm one of the owners of a small Minecraft network using Waterfall and SubServers 2. After many "too many file descriptors" errors for the last few months, me and the other owner (cc @ilikestohack) have isolated the issue. There appears to be some sort of socket leak in Waterfall where non-Minecraft packets are accepted (of course) and never properly closed, leaving them in the CLOSE_WAIT state.

We use a tool called Uptime Kuma for status monitoring, which sends very simple TCP pings to every monitor we have set up. One of those monitors is :25565 (Waterfall) and we then discover the proxy's Java process is over the allocated process maximum file descriptors. We assumed this was a SubServers bug, but later discovered it was actually a bunch of open SOCKETS all originating from my IP address. I had been un-knowingly DoSing my own Minecraft server.

What currently occurs:

• Connection comes in and is established (syn, syn-ack, ack)
• Ping packet of some sort is sent
• Kuma attempts to disconnect (fin packet)
• Connection is stuck in CLOSE_WAIT waiting for Waterfall to send the FIN-ACK packet.

What should occur:

• Waterfall sends the FIN-ACK packet.

Unusual conditions:

• TCP pinging service

The resolution for this is quick, but this results in almost a complete crash of the proxy. No new connections are accepted and the log file is filled with errors. Over 524285 file descriptors were opened by Waterfall around once every two weeks during the leak.

Start by reproducing the issue with Uptime Kuma's TCP ping against the Waterfall listener, then inspect CLOSE_WAIT connections and the Java process's file-descriptor count. Done means the proxy closes these connections after the ping disconnects and file descriptors no longer accumulate.