username length limit

4 files changed, 17 insertions, 4 deletions

diff --git a/locale/en.ini b/locale/en.ini
index e1013727..c99b8e31 100644
--- a/locale/en.ini
+++ b/locale/en.ini
@@ -229,7 +229,7 @@ s.error.quoting_invalid=Command quoting invalid
 s.error.self_interact=Interacting with yourself. This is impossible.
 s.error.tutorial_already_running=Tutorial already running
 s.error.tutorial_no_running=No tutorial running
-s.error.username_length_limit=Username length limit of 64 bytes exceeded
+s.error.username_length_limit=Username length limit of {0} characters or {1} bytes exceeded.
 s.error.too_many_players=Too many players joined
 s.replay.cannot_join=Replays cannot be joined.
 s.state.abort_no_players=Game was aborted due to a lack of players.
diff --git a/protocol.md b/protocol.md
index 9562ab6f..35a13076 100644
--- a/protocol.md
+++ b/protocol.md
@@ -75,3 +75,12 @@ latency. For this reason it implemented three times:
 - In Rust (for server, pixelcurry and customers):
   [movement.rs](./server/protocol/src/movement.rs)
 - In TypeScript (for test-client): [movement.ts](./test-client/movement.ts)
+
+## Limits
+
+The server currently enforces the following network limits:
+
+- Server inbound json packets are at most 8196 bytes in size
+- Server inbound binary packets are at most 4096 bytes in size
+- Player names are no longer than 32 characters
+- Player names are no longer than 64 bytes
diff --git a/server/src/main.rs b/server/src/main.rs
index 2d5ba390..7f3de073 100644
--- a/server/src/main.rs
+++ b/server/src/main.rs
@@ -248,7 +248,7 @@ async fn run(args: Args) -> anyhow::Result<()> {
             info!("{id:?} connected");
             while let Some(Ok(message)) = read.next().await {
                 let packet = match message {
-                    Message::Text(line) => match serde_json::from_str(&line) {
+                    Message::Text(line) if line.len() < 8196 => match serde_json::from_str(&line) {
                         Ok(p) => p,
                         Err(e) => {
                             warn!("Invalid json packet: {e}");
diff --git a/server/src/server.rs b/server/src/server.rs
index 9928ac90..462e95d4 100644
--- a/server/src/server.rs
+++ b/server/src/server.rs
@@ -369,8 +369,12 @@ impl Server {
                 id,
                 class,
             } => {
-                if name.len() > 64 {
-                    return Err(tre!("s.error.username_length_limit"));
+                if name.chars().count() > 32 || name.len() > 64 {
+                    return Err(tre!(
+                        "s.error.username_length_limit",
+                        s = "32".to_string(),
+                        s = "64".to_string()
+                    ));
                 }
                 if self.game.players.len() > 64 {
                     return Err(tre!("s.error.too_many_players"));