Files
itsRevela ba3ebe666c feat: dedicated server security hardening
Comprehensive security system to protect against packet-sniffing attacks,
XUID harvesting, privilege escalation, bot flooding, and XUID impersonation.

- Stream cipher: per-session XOR cipher with 4-message handshake via
  CustomPayloadPacket (MC|CKey, MC|CAck, MC|COn). Negotiated per-connection,
  backwards compatible (old clients/servers fall back to plaintext).
- Security gate: buffers all game data until cipher handshake completes,
  preventing unsecured clients from receiving any XUIDs or game state.
- Cipher handshake enforcer: kicks clients that don't complete the handshake
  within 5 seconds (configurable via require-secure-client).
- Identity tokens: persistent per-XUID tokens in identity-tokens.json,
  issued over the encrypted channel, verified on reconnect. Prevents XUID
  replay attacks. Client stores server-specific tokens.
- PROXY protocol v1: parses real client IPs from playit.gg tunnel headers
  so rate limiting, IP bans, and XUID spoof detection work per-player.
- Rate limiting: per-IP sliding window (default 5 connections/30s) with
  pending connection cap (default 10).
- Privilege hardening: OP requires ops.json, live checks on every command
  and privilege packet. Host-only server settings changes.
- XUID stripping: PreLoginPacket response sends INVALID_XUID placeholders.
- Packet validation: readUtf global string cap, reduced max packet size,
  stream desync protection on oversized strings.
- OpManager: persistent ops.json with XUID-based OP list.
- Whitelist improvements: whitelist add accepts player names with ambiguity
  detection, XUID cache from login attempts.
- revoketoken command: revoke identity tokens for players who lost theirs.
- server.log: persistent log file written alongside console output with
  flush-per-write to survive crashes.
- CLI security logging: consolidated per-join security summary with cipher
  status, token status, XUID, and real IP. Security warnings for kicks,
  spoofing, and unauthorized commands.
2026-03-28 19:18:06 -05:00

79 lines
1.5 KiB
C++

#include "stdafx.h"
#include "RateLimiter.h"
namespace ServerRuntime
{
namespace Security
{
RateLimiter::RateLimiter()
{
InitializeCriticalSection(&m_lock);
}
RateLimiter::~RateLimiter()
{
DeleteCriticalSection(&m_lock);
}
bool RateLimiter::AllowConnection(const std::string &ip, int maxPerWindow, int windowMs)
{
if (maxPerWindow <= 0 || windowMs <= 0)
{
return true;
}
ULONGLONG now = GetTickCount64();
ULONGLONG windowDuration = static_cast<ULONGLONG>(windowMs);
EnterCriticalSection(&m_lock);
auto &timestamps = m_connectionTimes[ip];
// Remove timestamps outside the sliding window
while (!timestamps.empty() && (now - timestamps.front()) > windowDuration)
{
timestamps.pop_front();
}
bool allowed = timestamps.size() < static_cast<size_t>(maxPerWindow);
if (allowed)
{
timestamps.push_back(now);
}
LeaveCriticalSection(&m_lock);
return allowed;
}
void RateLimiter::EvictStale(int evictionAgeMs)
{
ULONGLONG now = GetTickCount64();
ULONGLONG evictionAge = static_cast<ULONGLONG>(evictionAgeMs);
EnterCriticalSection(&m_lock);
auto it = m_connectionTimes.begin();
while (it != m_connectionTimes.end())
{
if (it->second.empty() ||
(now - it->second.back()) > evictionAge)
{
it = m_connectionTimes.erase(it);
}
else
{
++it;
}
}
LeaveCriticalSection(&m_lock);
}
RateLimiter &GetGlobalRateLimiter()
{
static RateLimiter s_instance;
return s_instance;
}
}
}