mirror of
https://git.revela.dev/itsRevela/LCE-Revelations.git
synced 2026-05-22 03:36:14 +00:00
ba3ebe666c
Comprehensive security system to protect against packet-sniffing attacks, XUID harvesting, privilege escalation, bot flooding, and XUID impersonation. - Stream cipher: per-session XOR cipher with 4-message handshake via CustomPayloadPacket (MC|CKey, MC|CAck, MC|COn). Negotiated per-connection, backwards compatible (old clients/servers fall back to plaintext). - Security gate: buffers all game data until cipher handshake completes, preventing unsecured clients from receiving any XUIDs or game state. - Cipher handshake enforcer: kicks clients that don't complete the handshake within 5 seconds (configurable via require-secure-client). - Identity tokens: persistent per-XUID tokens in identity-tokens.json, issued over the encrypted channel, verified on reconnect. Prevents XUID replay attacks. Client stores server-specific tokens. - PROXY protocol v1: parses real client IPs from playit.gg tunnel headers so rate limiting, IP bans, and XUID spoof detection work per-player. - Rate limiting: per-IP sliding window (default 5 connections/30s) with pending connection cap (default 10). - Privilege hardening: OP requires ops.json, live checks on every command and privilege packet. Host-only server settings changes. - XUID stripping: PreLoginPacket response sends INVALID_XUID placeholders. - Packet validation: readUtf global string cap, reduced max packet size, stream desync protection on oversized strings. - OpManager: persistent ops.json with XUID-based OP list. - Whitelist improvements: whitelist add accepts player names with ambiguity detection, XUID cache from login attempts. - revoketoken command: revoke identity tokens for players who lost theirs. - server.log: persistent log file written alongside console output with flush-per-write to survive crashes. - CLI security logging: consolidated per-join security summary with cipher status, token status, XUID, and real IP. Security warnings for kicks, spoofing, and unauthorized commands.
85 lines
2.3 KiB
C++
85 lines
2.3 KiB
C++
#include "stdafx.h"
|
|
#include "InputOutputStream.h"
|
|
#include "PacketListener.h"
|
|
#include "BasicTypeContainers.h"
|
|
#include "CustomPayloadPacket.h"
|
|
|
|
// Mojang-defined custom packets
|
|
const wstring CustomPayloadPacket::CUSTOM_BOOK_PACKET = L"MC|BEdit";
|
|
const wstring CustomPayloadPacket::CUSTOM_BOOK_SIGN_PACKET = L"MC|BSign";
|
|
const wstring CustomPayloadPacket::TEXTURE_PACK_PACKET = L"MC|TPack";
|
|
const wstring CustomPayloadPacket::TRADER_LIST_PACKET = L"MC|TrList";
|
|
const wstring CustomPayloadPacket::TRADER_SELECTION_PACKET = L"MC|TrSel";
|
|
const wstring CustomPayloadPacket::SET_ADVENTURE_COMMAND_PACKET = L"MC|AdvCdm";
|
|
const wstring CustomPayloadPacket::SET_BEACON_PACKET = L"MC|Beacon";
|
|
const wstring CustomPayloadPacket::SET_ITEM_NAME_PACKET = L"MC|ItemName";
|
|
|
|
const wstring CustomPayloadPacket::CIPHER_KEY_CHANNEL = L"MC|CKey";
|
|
const wstring CustomPayloadPacket::CIPHER_ACK_CHANNEL = L"MC|CAck";
|
|
const wstring CustomPayloadPacket::CIPHER_ON_CHANNEL = L"MC|COn";
|
|
|
|
const wstring CustomPayloadPacket::IDENTITY_TOKEN_ISSUE = L"MC|CTIssue";
|
|
const wstring CustomPayloadPacket::IDENTITY_TOKEN_CHALLENGE = L"MC|CTChallenge";
|
|
const wstring CustomPayloadPacket::IDENTITY_TOKEN_RESPONSE = L"MC|CTResponse";
|
|
|
|
CustomPayloadPacket::CustomPayloadPacket()
|
|
: length(0)
|
|
{
|
|
}
|
|
|
|
CustomPayloadPacket::CustomPayloadPacket(const wstring &identifier, byteArray data)
|
|
{
|
|
this->identifier = identifier;
|
|
this->data = data;
|
|
this->length = 0;
|
|
|
|
if (data.data != nullptr)
|
|
{
|
|
length = data.length;
|
|
|
|
if (length > Short::MAX_VALUE)
|
|
{
|
|
app.DebugPrintf("Payload may not be larger than 32K\n");
|
|
#ifndef _CONTENT_PACKAGE
|
|
__debugbreak();
|
|
#endif
|
|
//throw new IllegalArgumentException("Payload may not be larger than 32k");
|
|
}
|
|
}
|
|
}
|
|
|
|
void CustomPayloadPacket::read(DataInputStream *dis)
|
|
{
|
|
identifier = readUtf(dis, 20);
|
|
length = dis->readShort();
|
|
|
|
if (length > 0 && length <= Short::MAX_VALUE)
|
|
{
|
|
if(data.data != nullptr)
|
|
{
|
|
delete [] data.data;
|
|
}
|
|
data = byteArray(length);
|
|
dis->readFully(data);
|
|
}
|
|
}
|
|
|
|
void CustomPayloadPacket::write(DataOutputStream *dos)
|
|
{
|
|
writeUtf(identifier, dos);
|
|
dos->writeShort(static_cast<short>(length));
|
|
if (data.data != nullptr)
|
|
{
|
|
dos->write(data);
|
|
}
|
|
}
|
|
|
|
void CustomPayloadPacket::handle(PacketListener *listener)
|
|
{
|
|
listener->handleCustomPayload( shared_from_this() );
|
|
}
|
|
|
|
int CustomPayloadPacket::getEstimatedSize()
|
|
{
|
|
return 2 + identifier.length() * 2 + 2 + length;
|
|
} |