{"record":{"id":"5597e66c473907db","repo":"Pumpkin-MC/Pumpkin","slug":"vine-timestamp-expired-or-desynchronized-skew-of","errorCode":null,"errorMessage":"Vine timestamp expired or desynchronized: skew of {0}s exceeds limit of {1}s","messagePattern":"Vine timestamp expired or desynchronized: skew of (.+?)s exceeds limit of (.+?)s","errorType":"error_code","errorClass":"VineError","httpStatus":null,"severity":"error","filePath":"crates/pumpkin/src/net/proxy/vine.rs","lineNumber":40,"sourceCode":"pub const MAX_TIMESTAMP_DRIFT_SECS: i64 = 30;\n\n#[derive(Error, Debug)]\npub enum VineError {\n    #[error(\"No response data received\")]\n    NoData,\n    #[error(\"Vine response data too short (minimum 89 bytes)\")]\n    DataTooShort,\n    #[error(\"No public key or secret configured for Vine proxy\")]\n    MissingKeyConfig,\n    #[error(\"Invalid Ed25519 public key\")]\n    InvalidPublicKey,\n    #[error(\"Failed to verify Ed25519 signature\")]\n    InvalidSignature,\n    #[error(\"Failed to read forward version\")]\n    FailedReadForwardVersion,\n    #[error(\"Unsupported forwarding version {0}. Expected {1}\")]\n    UnsupportedForwardVersion(i32, i32),\n    #[error(\"Vine timestamp expired or desynchronized: skew of {0}s exceeds limit of {1}s\")]\n    TimestampExpired(i64, i64),\n    #[error(\"Vine challenge nonce mismatch\")]\n    ChallengeMismatch,\n    #[error(\"Missing expected challenge from pending connection\")]\n    MissingChallenge,\n    #[error(\"Failed to read address\")]\n    FailedReadAddress,\n    #[error(\"Failed to parse address\")]\n    FailedParseAddress,\n    #[error(\"Failed to read game profile name\")]\n    FailedReadProfileName,\n    #[error(\"Failed to read game profile UUID\")]\n    FailedReadProfileUUID,\n    #[error(\"Failed to read game profile properties\")]\n    FailedReadProfileProperties,\n}\n\n/// Initiates Vine modern forwarding handshake by sending a `CLoginPluginRequest`","sourceCodeStart":22,"sourceCodeEnd":58,"githubUrl":"https://github.com/Pumpkin-MC/Pumpkin/blob/8d4639e25a57c15e47448ec327c780d41bbf2356/crates/pumpkin/src/net/proxy/vine.rs#L22-L58","documentation":"VineError::TimestampExpired is returned when the absolute difference between the current server time and the u64 big-endian Unix timestamp in the Vine payload exceeds MAX_TIMESTAMP_DRIFT_SECS (30 seconds) (vine.rs:180-194). This replay-protection check rejects old or future-dated responses. The error reports the observed skew and the allowed limit.","triggerScenarios":"The computed drift (now - payload timestamp) has abs() > 30 in receive_vine_plugin_response: the proxy's clock is skewed, the packet was delayed/replayed, or the server clock is wrong.","commonSituations":"Proxy host clock drifts (no NTP, VM suspended/resumed); network delay plus clock skew combined push the payload past 30s; server was restored from a snapshot with a stale clock; timezone/UTC misconfiguration on either host.","solutions":["Enable NTP/time synchronization on both the proxy and server hosts and confirm both report the same UTC time","Check for long-lived queued/delayed connections and eliminate replayed packets","Fix the server's system clock/timezone (timestamps must be Unix epoch seconds)","If drift is persistent, investigate virtualization clock skew (VM pause, guest additions)"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// check clock health before accepting logins\nlet now = SystemTime::now().duration_since(UNIX_EPOCH)?.as_secs();\n// `now` should be within a few seconds of a trusted time source (NTP); alert if not","typeGuard":null,"tryCatchPattern":"match receive_vine_plugin_response(port, &config, response, challenge) {\n    Err(VineError::TimestampExpired(drift, limit)) => {\n        tracing::warn!(\"Vine timestamp skew {}s > {}s — sync clocks via NTP\", drift, limit);\n        disconnect(DisconnectReason::ForwardingTimestamp);\n    }\n    result => result?,\n}","preventionTips":["Run NTP/chrony on both proxy and server hosts and monitor clock offset","Avoid VM suspensions or configure clock resync after resume","Keep proxy-to-server latency well under the 30-second drift window (rarely an issue in practice)","Alert when TimestampExpired occurs — usually the first symptom of clock drift"],"tags":["time-skew","security","replay-protection","minecraft"],"backgroundTag":"clock-skew-detected","analyzedSha":"8d4639e25a57c15e47448ec327c780d41bbf2356","analyzedAt":"2026-09-09T15:32:22.916Z","contentChangedAt":"2026-09-09T15:32:22.916Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}