3
0
Mirror von https://github.com/PaperMC/Paper.git synchronisiert 2024-12-15 19:10:09 +01:00
Paper/patches/server/0857-Add-Velocity-IP-Forwarding-Support.patch

228 Zeilen
13 KiB
Diff

2021-06-11 14:02:28 +02:00
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Andrew Steinborn <git@steinborn.me>
Date: Mon, 8 Oct 2018 14:36:14 -0400
Subject: [PATCH] Add Velocity IP Forwarding Support
While Velocity supports BungeeCord-style IP forwarding, it is not secure. Users
have a lot of problems setting up firewalls or setting up plugins like IPWhitelist.
Further, the BungeeCord IP forwarding protocol still retains essentially its original
form, when there is brand new support for custom login plugin messages in 1.13.
Velocity's modern IP forwarding uses an HMAC-SHA256 code to ensure authenticity
of messages, is packed into a binary format that is smaller than BungeeCord's
forwarding, and is integrated into the Minecraft login process by using the 1.13
login plugin message packet.
diff --git a/src/main/java/com/destroystokyo/paper/proxy/VelocityProxy.java b/src/main/java/com/destroystokyo/paper/proxy/VelocityProxy.java
new file mode 100644
index 0000000000000000000000000000000000000000..c4934979b1ed85bfc4f8d9e6f8848b2beaad95c3
2021-06-11 14:02:28 +02:00
--- /dev/null
+++ b/src/main/java/com/destroystokyo/paper/proxy/VelocityProxy.java
@@ -0,0 +1,75 @@
2021-06-11 14:02:28 +02:00
+package com.destroystokyo.paper.proxy;
+
+import io.papermc.paper.configuration.GlobalConfiguration;
2021-06-11 14:02:28 +02:00
+import com.google.common.net.InetAddresses;
+import com.mojang.authlib.GameProfile;
+import com.mojang.authlib.properties.Property;
+import java.net.InetAddress;
+import java.security.InvalidKeyException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
2022-08-08 17:25:41 +02:00
+import java.util.UUID;
2021-06-11 14:02:28 +02:00
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+import net.minecraft.network.FriendlyByteBuf;
+import net.minecraft.resources.ResourceLocation;
+import net.minecraft.world.entity.player.ProfilePublicKey;
2021-06-11 14:02:28 +02:00
+
+public class VelocityProxy {
+ private static final int SUPPORTED_FORWARDING_VERSION = 1;
+ public static final int MODERN_FORWARDING_WITH_KEY = 2;
2022-08-08 17:25:41 +02:00
+ public static final int MODERN_FORWARDING_WITH_KEY_V2 = 3;
+ public static final int MODERN_LAZY_SESSION = 4;
+ public static final byte MAX_SUPPORTED_FORWARDING_VERSION = MODERN_LAZY_SESSION;
2021-06-11 14:02:28 +02:00
+ public static final ResourceLocation PLAYER_INFO_CHANNEL = new ResourceLocation("velocity", "player_info");
+
+ public static boolean checkIntegrity(final FriendlyByteBuf buf) {
+ final byte[] signature = new byte[32];
+ buf.readBytes(signature);
+
+ final byte[] data = new byte[buf.readableBytes()];
+ buf.getBytes(buf.readerIndex(), data);
+
+ try {
+ final Mac mac = Mac.getInstance("HmacSHA256");
+ mac.init(new SecretKeySpec(GlobalConfiguration.get().proxies.velocity.secret.getBytes(java.nio.charset.StandardCharsets.UTF_8), "HmacSHA256"));
2021-06-11 14:02:28 +02:00
+ final byte[] mySignature = mac.doFinal(data);
+ if (!MessageDigest.isEqual(signature, mySignature)) {
+ return false;
+ }
+ } catch (final InvalidKeyException | NoSuchAlgorithmException e) {
+ throw new AssertionError(e);
+ }
+
+ return true;
+ }
+
+ public static InetAddress readAddress(final FriendlyByteBuf buf) {
2021-06-13 08:48:25 +02:00
+ return InetAddresses.forString(buf.readUtf(Short.MAX_VALUE));
2021-06-11 14:02:28 +02:00
+ }
+
+ public static GameProfile createProfile(final FriendlyByteBuf buf) {
2021-06-13 08:48:25 +02:00
+ final GameProfile profile = new GameProfile(buf.readUUID(), buf.readUtf(16));
2021-06-11 14:02:28 +02:00
+ readProperties(buf, profile);
+ return profile;
+ }
+
+ private static void readProperties(final FriendlyByteBuf buf, final GameProfile profile) {
+ final int properties = buf.readVarInt();
+ for (int i1 = 0; i1 < properties; i1++) {
2021-06-13 08:48:25 +02:00
+ final String name = buf.readUtf(Short.MAX_VALUE);
+ final String value = buf.readUtf(Short.MAX_VALUE);
+ final String signature = buf.readBoolean() ? buf.readUtf(Short.MAX_VALUE) : null;
2021-06-11 14:02:28 +02:00
+ profile.getProperties().put(name, new Property(name, value, signature));
+ }
+ }
+
+ public static ProfilePublicKey.Data readForwardedKey(FriendlyByteBuf buf) {
+ return new ProfilePublicKey.Data(buf);
+ }
2022-08-08 17:25:41 +02:00
+
+ public static UUID readSignerUuidOrElse(FriendlyByteBuf buf, UUID orElse) {
+ return buf.readBoolean() ? buf.readUUID() : orElse;
+ }
2021-06-11 14:02:28 +02:00
+}
diff --git a/src/main/java/net/minecraft/server/dedicated/DedicatedServer.java b/src/main/java/net/minecraft/server/dedicated/DedicatedServer.java
index 8115cf64a30b6438721769df6045e1b77acf88ce..9f422cbeaa52b3e6a0a27af4f8ad4ddb7808483f 100644
--- a/src/main/java/net/minecraft/server/dedicated/DedicatedServer.java
+++ b/src/main/java/net/minecraft/server/dedicated/DedicatedServer.java
@@ -274,13 +274,20 @@ public class DedicatedServer extends MinecraftServer implements ServerInterface
server.enablePlugins(org.bukkit.plugin.PluginLoadOrder.STARTUP);
// CraftBukkit end
+ // Paper start
+ boolean usingProxy = org.spigotmc.SpigotConfig.bungee || io.papermc.paper.configuration.GlobalConfiguration.get().proxies.velocity.enabled;
+ String proxyFlavor = (io.papermc.paper.configuration.GlobalConfiguration.get().proxies.velocity.enabled) ? "Velocity" : "BungeeCord";
+ String proxyLink = (io.papermc.paper.configuration.GlobalConfiguration.get().proxies.velocity.enabled) ? "https://docs.papermc.io/velocity/security" : "http://www.spigotmc.org/wiki/firewall-guide/";
+ // Paper end
if (!this.usesAuthentication()) {
DedicatedServer.LOGGER.warn("**** SERVER IS RUNNING IN OFFLINE/INSECURE MODE!");
DedicatedServer.LOGGER.warn("The server will make no attempt to authenticate usernames. Beware.");
// Spigot start
- if (org.spigotmc.SpigotConfig.bungee) {
- DedicatedServer.LOGGER.warn("Whilst this makes it possible to use BungeeCord, unless access to your server is properly restricted, it also opens up the ability for hackers to connect with any username they choose.");
- DedicatedServer.LOGGER.warn("Please see http://www.spigotmc.org/wiki/firewall-guide/ for further information.");
+ // Paper start
+ if (usingProxy) {
+ DedicatedServer.LOGGER.warn("Whilst this makes it possible to use " + proxyFlavor + ", unless access to your server is properly restricted, it also opens up the ability for hackers to connect with any username they choose.");
+ DedicatedServer.LOGGER.warn("Please see " + proxyLink + " for further information.");
+ // Paper end
} else {
DedicatedServer.LOGGER.warn("While this makes the game possible to play without internet access, it also opens up the ability for hackers to connect with any username they choose.");
}
2021-06-11 14:02:28 +02:00
diff --git a/src/main/java/net/minecraft/server/network/ServerLoginPacketListenerImpl.java b/src/main/java/net/minecraft/server/network/ServerLoginPacketListenerImpl.java
2023-03-15 00:10:18 +01:00
index 3fcd7bfdb8945b276c94a263e9da6b85ce470366..3431b1132e55c53cda7cf47f021f23068b63322d 100644
2021-06-11 14:02:28 +02:00
--- a/src/main/java/net/minecraft/server/network/ServerLoginPacketListenerImpl.java
+++ b/src/main/java/net/minecraft/server/network/ServerLoginPacketListenerImpl.java
2022-12-07 22:57:15 +01:00
@@ -61,6 +61,7 @@ public class ServerLoginPacketListenerImpl implements ServerLoginPacketListener,
@Nullable
2022-12-07 22:57:15 +01:00
private ServerPlayer delayedAcceptPlayer;
2022-08-08 17:25:41 +02:00
public boolean iKnowThisMayNotBeTheBestIdeaButPleaseDisableUsernameValidation = false; // Paper - username validation overriding
2021-06-11 14:02:28 +02:00
+ private int velocityLoginMessageId = -1; // Paper - Velocity support
public ServerLoginPacketListenerImpl(MinecraftServer server, Connection connection) {
this.state = ServerLoginPacketListenerImpl.State.HELLO;
2022-12-07 22:57:15 +01:00
@@ -256,6 +257,16 @@ public class ServerLoginPacketListenerImpl implements ServerLoginPacketListener,
2022-06-08 02:42:07 +02:00
this.state = ServerLoginPacketListenerImpl.State.KEY;
2022-12-07 22:57:15 +01:00
this.connection.send(new ClientboundHelloPacket("", this.server.getKeyPair().getPublic().getEncoded(), this.challenge));
2022-06-08 02:42:07 +02:00
} else {
+ // Paper start - Velocity support
+ if (io.papermc.paper.configuration.GlobalConfiguration.get().proxies.velocity.enabled) {
2022-06-08 02:42:07 +02:00
+ this.velocityLoginMessageId = java.util.concurrent.ThreadLocalRandom.current().nextInt();
+ net.minecraft.network.FriendlyByteBuf buf = new net.minecraft.network.FriendlyByteBuf(io.netty.buffer.Unpooled.buffer());
+ buf.writeByte(com.destroystokyo.paper.proxy.VelocityProxy.MAX_SUPPORTED_FORWARDING_VERSION);
+ net.minecraft.network.protocol.login.ClientboundCustomQueryPacket packet1 = new net.minecraft.network.protocol.login.ClientboundCustomQueryPacket(this.velocityLoginMessageId, com.destroystokyo.paper.proxy.VelocityProxy.PLAYER_INFO_CHANNEL, buf);
2022-06-08 02:42:07 +02:00
+ this.connection.send(packet1);
+ return;
+ }
+ // Paper end
// Spigot start
2021-06-11 14:02:28 +02:00
// Paper start - Cache authenticator threads
authenticatorPool.execute(new Runnable() {
2022-12-07 22:57:15 +01:00
@@ -363,6 +374,12 @@ public class ServerLoginPacketListenerImpl implements ServerLoginPacketListener,
2021-06-11 14:02:28 +02:00
public class LoginHandler {
public void fireEvents() throws Exception {
+ // Paper start - Velocity support
+ if (ServerLoginPacketListenerImpl.this.velocityLoginMessageId == -1 && io.papermc.paper.configuration.GlobalConfiguration.get().proxies.velocity.enabled) {
+ disconnect("This server requires you to connect with Velocity.");
+ return;
+ }
+ // Paper end
2021-06-13 08:48:25 +02:00
String playerName = ServerLoginPacketListenerImpl.this.gameProfile.getName();
java.net.InetAddress address = ((java.net.InetSocketAddress) ServerLoginPacketListenerImpl.this.connection.getRemoteAddress()).getAddress();
2023-03-15 00:10:18 +01:00
java.net.InetAddress rawAddress = ((java.net.InetSocketAddress) connection.channel.remoteAddress()).getAddress(); // Paper
@@ -411,6 +428,47 @@ public class ServerLoginPacketListenerImpl implements ServerLoginPacketListener,
2021-06-11 14:02:28 +02:00
// Spigot end
public void handleCustomQueryPacket(ServerboundCustomQueryPacket packet) {
+ // Paper start - Velocity support
+ if (io.papermc.paper.configuration.GlobalConfiguration.get().proxies.velocity.enabled && packet.getTransactionId() == this.velocityLoginMessageId) {
2022-06-08 02:42:07 +02:00
+ net.minecraft.network.FriendlyByteBuf buf = packet.getData();
2021-06-11 14:02:28 +02:00
+ if (buf == null) {
+ this.disconnect("This server requires you to connect with Velocity.");
+ return;
+ }
+
+ if (!com.destroystokyo.paper.proxy.VelocityProxy.checkIntegrity(buf)) {
+ this.disconnect("Unable to verify player details");
+ return;
+ }
+
+ int version = buf.readVarInt();
+ if (version > com.destroystokyo.paper.proxy.VelocityProxy.MAX_SUPPORTED_FORWARDING_VERSION) {
+ throw new IllegalStateException("Unsupported forwarding version " + version + ", wanted upto " + com.destroystokyo.paper.proxy.VelocityProxy.MAX_SUPPORTED_FORWARDING_VERSION);
+ }
+
2021-06-11 14:02:28 +02:00
+ java.net.SocketAddress listening = this.connection.getRemoteAddress();
+ int port = 0;
+ if (listening instanceof java.net.InetSocketAddress) {
+ port = ((java.net.InetSocketAddress) listening).getPort();
+ }
+ this.connection.address = new java.net.InetSocketAddress(com.destroystokyo.paper.proxy.VelocityProxy.readAddress(buf), port);
+
2021-06-13 08:48:25 +02:00
+ this.gameProfile = com.destroystokyo.paper.proxy.VelocityProxy.createProfile(buf);
2021-06-11 14:02:28 +02:00
+
+ //TODO Update handling for lazy sessions, might not even have to do anything?
+
2021-06-11 14:02:28 +02:00
+ // Proceed with login
+ authenticatorPool.execute(() -> {
+ try {
+ new LoginHandler().fireEvents();
+ } catch (Exception ex) {
+ disconnect("Failed to verify username!");
+ server.server.getLogger().log(java.util.logging.Level.WARNING, "Exception verifying " + gameProfile.getName(), ex);
+ }
+ });
+ return;
+ }
+ // Paper end
2022-06-08 02:42:07 +02:00
this.disconnect(Component.translatable("multiplayer.disconnect.unexpected_query_response"));
2021-06-11 14:02:28 +02:00
}
diff --git a/src/main/java/org/bukkit/craftbukkit/CraftServer.java b/src/main/java/org/bukkit/craftbukkit/CraftServer.java
Updated Upstream (Bukkit/CraftBukkit) (#9485) Upstream has released updates that appear to apply and compile correctly. This update has not been tested by PaperMC and as with ANY update, please do your own testing Bukkit Changes: 82af5dc6 SPIGOT-7396: Add PlayerSignOpenEvent 3f0281ca SPIGOT-7063, PR-763: Add DragonBattle#initiateRespawn with custom EnderCrystals f83c8df4 PR-873: Add PlayerRecipeBookClickEvent 14560d39 SPIGOT-7435: Add TeleportCause#EXIT_BED 2cc6db92 SPIGOT-7422, PR-887: Add API to set sherds on decorated pots 36022f02 PR-883: Add ItemFactory#getSpawnEgg 12eb5c46 PR-881: Update Scoreboard Javadocs, remove explicit exception throwing f6d8d44a PR-882: Add modern time API methods to ban API 21a7b710 Upgrade some Maven plugins to reduce warnings 11fd1225 PR-886: Deprecate the SmithingRecipe constructor as it now does nothing dbd1761d SPIGOT-7406: Improve documentation for getDragonBattle CraftBukkit Changes: d548daac2 SPIGOT-7446: BlockState#update not updating a spawner's type to null 70e0bc050 SPIGOT-7447: Fix --forceUpgrade 6752f1d63 SPIGOT-7396: Add PlayerSignOpenEvent 847b4cad5 SPIGOT-7063, PR-1071: Add DragonBattle#initiateRespawn with custom EnderCrystals c335a555f PR-1212: Add PlayerRecipeBookClickEvent 4be756ecb SPIGOT-7445: Fix opening smithing inventory db70bd6ed SPIGOT-7441: Fix issue placing certain items in creative/op f7fa6d993 SPIGOT-7435: Add TeleportCause#EXIT_BED b435e8e8d SPIGOT-7349: Player#setDisplayName not working when message/format unmodified a2fafdd1d PR-1232: Re-add fix for player rotation 7cf863de1 PR-1233: Remove some old MC bug fixes now fixed in vanilla 08ec344ad Fix ChunkGenerator#generateCaves never being called 5daeb502a SPIGOT-7422, PR-1228: Add API to set sherds on decorated pots 52faa6b32 PR-1224: Add ItemFactory#getSpawnEgg 01cae71b7 SPIGOT-7429: Fix LEFT_CLICK_AIR not working for passable entities and spectators a94277a18 PR-1223: Remove non-existent scoreboard display name/prefix/suffix limits 36b107660 PR-1225: Add modern time API methods to ban API 59ead25bc Upgrade some Maven plugins to reduce warnings 202fc5c4e Increase outdated build delay ce545de57 SPIGOT-7398: TextDisplay#setInterpolationDuration incorrectly updates the line width Spigot Changes: b41c46db Rebuild patches 3374045a SPIGOT-7431: Fix EntityMountEvent returning opposite entities 0ca4eb66 Rebuild patches
2023-08-06 02:21:59 +02:00
index f5f69968aa80c58b5325d4b6a3d03439149b7375..cd4c2e4c0d9d9003273fe04bbe9a61b3024547dd 100644
2021-06-11 14:02:28 +02:00
--- a/src/main/java/org/bukkit/craftbukkit/CraftServer.java
+++ b/src/main/java/org/bukkit/craftbukkit/CraftServer.java
Updated Upstream (Bukkit/CraftBukkit) (#9485) Upstream has released updates that appear to apply and compile correctly. This update has not been tested by PaperMC and as with ANY update, please do your own testing Bukkit Changes: 82af5dc6 SPIGOT-7396: Add PlayerSignOpenEvent 3f0281ca SPIGOT-7063, PR-763: Add DragonBattle#initiateRespawn with custom EnderCrystals f83c8df4 PR-873: Add PlayerRecipeBookClickEvent 14560d39 SPIGOT-7435: Add TeleportCause#EXIT_BED 2cc6db92 SPIGOT-7422, PR-887: Add API to set sherds on decorated pots 36022f02 PR-883: Add ItemFactory#getSpawnEgg 12eb5c46 PR-881: Update Scoreboard Javadocs, remove explicit exception throwing f6d8d44a PR-882: Add modern time API methods to ban API 21a7b710 Upgrade some Maven plugins to reduce warnings 11fd1225 PR-886: Deprecate the SmithingRecipe constructor as it now does nothing dbd1761d SPIGOT-7406: Improve documentation for getDragonBattle CraftBukkit Changes: d548daac2 SPIGOT-7446: BlockState#update not updating a spawner's type to null 70e0bc050 SPIGOT-7447: Fix --forceUpgrade 6752f1d63 SPIGOT-7396: Add PlayerSignOpenEvent 847b4cad5 SPIGOT-7063, PR-1071: Add DragonBattle#initiateRespawn with custom EnderCrystals c335a555f PR-1212: Add PlayerRecipeBookClickEvent 4be756ecb SPIGOT-7445: Fix opening smithing inventory db70bd6ed SPIGOT-7441: Fix issue placing certain items in creative/op f7fa6d993 SPIGOT-7435: Add TeleportCause#EXIT_BED b435e8e8d SPIGOT-7349: Player#setDisplayName not working when message/format unmodified a2fafdd1d PR-1232: Re-add fix for player rotation 7cf863de1 PR-1233: Remove some old MC bug fixes now fixed in vanilla 08ec344ad Fix ChunkGenerator#generateCaves never being called 5daeb502a SPIGOT-7422, PR-1228: Add API to set sherds on decorated pots 52faa6b32 PR-1224: Add ItemFactory#getSpawnEgg 01cae71b7 SPIGOT-7429: Fix LEFT_CLICK_AIR not working for passable entities and spectators a94277a18 PR-1223: Remove non-existent scoreboard display name/prefix/suffix limits 36b107660 PR-1225: Add modern time API methods to ban API 59ead25bc Upgrade some Maven plugins to reduce warnings 202fc5c4e Increase outdated build delay ce545de57 SPIGOT-7398: TextDisplay#setInterpolationDuration incorrectly updates the line width Spigot Changes: b41c46db Rebuild patches 3374045a SPIGOT-7431: Fix EntityMountEvent returning opposite entities 0ca4eb66 Rebuild patches
2023-08-06 02:21:59 +02:00
@@ -801,7 +801,7 @@ public final class CraftServer implements Server {
2021-06-11 14:02:28 +02:00
@Override
public long getConnectionThrottle() {
// Spigot Start - Automatically set connection throttle for bungee configurations
- if (org.spigotmc.SpigotConfig.bungee) {
+ if (org.spigotmc.SpigotConfig.bungee || io.papermc.paper.configuration.GlobalConfiguration.get().proxies.velocity.enabled) { // Paper - Velocity support
2021-06-11 14:02:28 +02:00
return -1;
} else {
return this.configuration.getInt("settings.connection-throttle");