288 Zeilen
14 KiB
Diff
288 Zeilen
14 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Andrew Steinborn <git@steinborn.me>
|
|
Date: Mon, 8 Oct 2018 14:36:14 -0400
|
|
Subject: [PATCH] Add Velocity IP Forwarding Support
|
|
|
|
While Velocity supports BungeeCord-style IP forwarding, it is not secure. Users
|
|
have a lot of problems setting up firewalls or setting up plugins like IPWhitelist.
|
|
Further, the BungeeCord IP forwarding protocol still retains essentially its original
|
|
form, when there is brand new support for custom login plugin messages in 1.13.
|
|
|
|
Velocity's modern IP forwarding uses an HMAC-SHA256 code to ensure authenticity
|
|
of messages, is packed into a binary format that is smaller than BungeeCord's
|
|
forwarding, and is integrated into the Minecraft login process by using the 1.13
|
|
login plugin message packet.
|
|
|
|
diff --git a/src/main/java/com/destroystokyo/paper/PaperConfig.java b/src/main/java/com/destroystokyo/paper/PaperConfig.java
|
|
index 20524795840a06cfe60de6ffd0a77b6814132af4..1697687405392198d2df653220465671675362c2 100644
|
|
--- a/src/main/java/com/destroystokyo/paper/PaperConfig.java
|
|
+++ b/src/main/java/com/destroystokyo/paper/PaperConfig.java
|
|
@@ -8,6 +8,7 @@ import java.io.IOException;
|
|
import java.lang.reflect.InvocationTargetException;
|
|
import java.lang.reflect.Method;
|
|
import java.lang.reflect.Modifier;
|
|
+import java.nio.charset.StandardCharsets;
|
|
import java.util.HashMap;
|
|
import java.util.List;
|
|
import java.util.Map;
|
|
@@ -247,7 +248,7 @@ public class PaperConfig {
|
|
}
|
|
|
|
public static boolean isProxyOnlineMode() {
|
|
- return Bukkit.getOnlineMode() || (SpigotConfig.bungee && bungeeOnlineMode);
|
|
+ return Bukkit.getOnlineMode() || (SpigotConfig.bungee && bungeeOnlineMode) || (velocitySupport && velocityOnlineMode);
|
|
}
|
|
|
|
public static int packetInSpamThreshold = 300;
|
|
@@ -319,4 +320,18 @@ public class PaperConfig {
|
|
}
|
|
tabSpamLimit = getInt("settings.spam-limiter.tab-spam-limit", tabSpamLimit);
|
|
}
|
|
+
|
|
+ public static boolean velocitySupport;
|
|
+ public static boolean velocityOnlineMode;
|
|
+ public static byte[] velocitySecretKey;
|
|
+ private static void velocitySupport() {
|
|
+ velocitySupport = getBoolean("settings.velocity-support.enabled", false);
|
|
+ velocityOnlineMode = getBoolean("settings.velocity-support.online-mode", false);
|
|
+ String secret = getString("settings.velocity-support.secret", "");
|
|
+ if (velocitySupport && secret.isEmpty()) {
|
|
+ fatal("Velocity support is enabled, but no secret key was specified. A secret key is required!");
|
|
+ } else {
|
|
+ velocitySecretKey = secret.getBytes(StandardCharsets.UTF_8);
|
|
+ }
|
|
+ }
|
|
}
|
|
diff --git a/src/main/java/com/destroystokyo/paper/proxy/VelocityProxy.java b/src/main/java/com/destroystokyo/paper/proxy/VelocityProxy.java
|
|
new file mode 100644
|
|
index 0000000000000000000000000000000000000000..fdd8708f974700c7cde6e436c2f189d94d336f1f
|
|
--- /dev/null
|
|
+++ b/src/main/java/com/destroystokyo/paper/proxy/VelocityProxy.java
|
|
@@ -0,0 +1,67 @@
|
|
+package com.destroystokyo.paper.proxy;
|
|
+
|
|
+import com.destroystokyo.paper.PaperConfig;
|
|
+import com.google.common.net.InetAddresses;
|
|
+import com.mojang.authlib.GameProfile;
|
|
+import com.mojang.authlib.properties.Property;
|
|
+import net.minecraft.server.MinecraftKey;
|
|
+import net.minecraft.server.PacketDataSerializer;
|
|
+
|
|
+import java.net.InetAddress;
|
|
+import java.security.InvalidKeyException;
|
|
+import java.security.MessageDigest;
|
|
+import java.security.NoSuchAlgorithmException;
|
|
+
|
|
+import javax.crypto.Mac;
|
|
+import javax.crypto.spec.SecretKeySpec;
|
|
+
|
|
+public class VelocityProxy {
|
|
+ private static final int SUPPORTED_FORWARDING_VERSION = 1;
|
|
+ public static final MinecraftKey PLAYER_INFO_CHANNEL = new MinecraftKey("velocity", "player_info");
|
|
+
|
|
+ public static boolean checkIntegrity(final PacketDataSerializer buf) {
|
|
+ final byte[] signature = new byte[32];
|
|
+ buf.readBytes(signature);
|
|
+
|
|
+ final byte[] data = new byte[buf.readableBytes()];
|
|
+ buf.getBytes(buf.readerIndex(), data);
|
|
+
|
|
+ try {
|
|
+ final Mac mac = Mac.getInstance("HmacSHA256");
|
|
+ mac.init(new SecretKeySpec(PaperConfig.velocitySecretKey, "HmacSHA256"));
|
|
+ final byte[] mySignature = mac.doFinal(data);
|
|
+ if (!MessageDigest.isEqual(signature, mySignature)) {
|
|
+ return false;
|
|
+ }
|
|
+ } catch (final InvalidKeyException | NoSuchAlgorithmException e) {
|
|
+ throw new AssertionError(e);
|
|
+ }
|
|
+
|
|
+ int version = buf.readVarInt();
|
|
+ if (version != SUPPORTED_FORWARDING_VERSION) {
|
|
+ throw new IllegalStateException("Unsupported forwarding version " + version + ", wanted " + SUPPORTED_FORWARDING_VERSION);
|
|
+ }
|
|
+
|
|
+ return true;
|
|
+ }
|
|
+
|
|
+ public static InetAddress readAddress(final PacketDataSerializer buf) {
|
|
+ return InetAddresses.forString(buf.readUTF(Short.MAX_VALUE));
|
|
+ }
|
|
+
|
|
+ public static GameProfile createProfile(final PacketDataSerializer buf) {
|
|
+ final GameProfile profile = new GameProfile(buf.readUUID(), buf.readUTF(16));
|
|
+ readProperties(buf, profile);
|
|
+ return profile;
|
|
+ }
|
|
+
|
|
+ private static void readProperties(final PacketDataSerializer buf, final GameProfile profile) {
|
|
+ final int properties = buf.readVarInt();
|
|
+ for (int i1 = 0; i1 < properties; i1++) {
|
|
+ final String name = buf.readUTF(Short.MAX_VALUE);
|
|
+ final String value = buf.readUTF(Short.MAX_VALUE);
|
|
+ final String signature = buf.readBoolean() ? buf.readUTF(Short.MAX_VALUE) : null;
|
|
+ profile.getProperties().put(name, new Property(name, value, signature));
|
|
+ }
|
|
+ }
|
|
+}
|
|
diff --git a/src/main/java/net/minecraft/server/LoginListener.java b/src/main/java/net/minecraft/server/LoginListener.java
|
|
index 066b0dbdbc101a8235fb872c2d1e9d427dfd6bb8..ddad076c7eb6d30f2e0f187e004c9e198f7ff777 100644
|
|
--- a/src/main/java/net/minecraft/server/LoginListener.java
|
|
+++ b/src/main/java/net/minecraft/server/LoginListener.java
|
|
@@ -27,6 +27,7 @@ import org.bukkit.craftbukkit.util.Waitable;
|
|
import org.bukkit.event.player.AsyncPlayerPreLoginEvent;
|
|
import org.bukkit.event.player.PlayerPreLoginEvent;
|
|
// CraftBukkit end
|
|
+import io.netty.buffer.Unpooled; // Paper
|
|
|
|
public class LoginListener implements PacketLoginInListener {
|
|
|
|
@@ -43,6 +44,7 @@ public class LoginListener implements PacketLoginInListener {
|
|
private SecretKey loginKey;
|
|
private EntityPlayer l;
|
|
public String hostname = ""; // CraftBukkit - add field
|
|
+ private int velocityLoginMessageId = -1; // Paper - Velocity support
|
|
|
|
public LoginListener(MinecraftServer minecraftserver, NetworkManager networkmanager) {
|
|
this.g = LoginListener.EnumProtocolState.HELLO;
|
|
@@ -194,6 +196,14 @@ public class LoginListener implements PacketLoginInListener {
|
|
this.g = LoginListener.EnumProtocolState.KEY;
|
|
this.networkManager.sendPacket(new PacketLoginOutEncryptionBegin("", this.server.getKeyPair().getPublic().getEncoded(), this.e));
|
|
} else {
|
|
+ // Paper start - Velocity support
|
|
+ if (com.destroystokyo.paper.PaperConfig.velocitySupport) {
|
|
+ this.velocityLoginMessageId = java.util.concurrent.ThreadLocalRandom.current().nextInt();
|
|
+ PacketLoginOutCustomPayload packet = new PacketLoginOutCustomPayload(this.velocityLoginMessageId, com.destroystokyo.paper.proxy.VelocityProxy.PLAYER_INFO_CHANNEL, new PacketDataSerializer(Unpooled.EMPTY_BUFFER));
|
|
+ this.networkManager.sendPacket(packet);
|
|
+ return;
|
|
+ }
|
|
+ // Paper end
|
|
// Spigot start
|
|
// Paper start - Cache authenticator threads
|
|
authenticatorPool.execute(new Runnable() {
|
|
@@ -295,6 +305,12 @@ public class LoginListener implements PacketLoginInListener {
|
|
public class LoginHandler {
|
|
|
|
public void fireEvents() throws Exception {
|
|
+ // Paper start - Velocity support
|
|
+ if (LoginListener.this.velocityLoginMessageId == -1 && com.destroystokyo.paper.PaperConfig.velocitySupport) {
|
|
+ disconnect("This server requires you to connect with Velocity.");
|
|
+ return;
|
|
+ }
|
|
+ // Paper end
|
|
String playerName = i.getName();
|
|
java.net.InetAddress address = ((java.net.InetSocketAddress) networkManager.getSocketAddress()).getAddress();
|
|
java.util.UUID uniqueId = i.getId();
|
|
@@ -342,6 +358,35 @@ public class LoginListener implements PacketLoginInListener {
|
|
// Spigot end
|
|
|
|
public void a(PacketLoginInCustomPayload packetloginincustompayload) {
|
|
+ // Paper start - Velocity support
|
|
+ if (com.destroystokyo.paper.PaperConfig.velocitySupport && packetloginincustompayload.getId() == this.velocityLoginMessageId) {
|
|
+ PacketDataSerializer buf = packetloginincustompayload.getBuf();
|
|
+ if (buf == null) {
|
|
+ this.disconnect("This server requires you to connect with Velocity.");
|
|
+ return;
|
|
+ }
|
|
+
|
|
+ if (!com.destroystokyo.paper.proxy.VelocityProxy.checkIntegrity(buf)) {
|
|
+ this.disconnect("Unable to verify player details");
|
|
+ return;
|
|
+ }
|
|
+
|
|
+ this.networkManager.socketAddress = new java.net.InetSocketAddress(com.destroystokyo.paper.proxy.VelocityProxy.readAddress(buf), ((java.net.InetSocketAddress) this.networkManager.getSocketAddress()).getPort());
|
|
+
|
|
+ this.setGameProfile(com.destroystokyo.paper.proxy.VelocityProxy.createProfile(buf));
|
|
+
|
|
+ // Proceed with login
|
|
+ authenticatorPool.execute(() -> {
|
|
+ try {
|
|
+ new LoginHandler().fireEvents();
|
|
+ } catch (Exception ex) {
|
|
+ disconnect("Failed to verify username!");
|
|
+ server.server.getLogger().log(java.util.logging.Level.WARNING, "Exception verifying " + i.getName(), ex);
|
|
+ }
|
|
+ });
|
|
+ return;
|
|
+ }
|
|
+ // Paper end
|
|
this.disconnect(new ChatMessage("multiplayer.disconnect.unexpected_query_response"));
|
|
}
|
|
|
|
diff --git a/src/main/java/net/minecraft/server/PacketDataSerializer.java b/src/main/java/net/minecraft/server/PacketDataSerializer.java
|
|
index 3d6fbde63d110559b552d052ef9a934318a00682..4be310ada6477b2040f2ea11010f429c3f38c4ac 100644
|
|
--- a/src/main/java/net/minecraft/server/PacketDataSerializer.java
|
|
+++ b/src/main/java/net/minecraft/server/PacketDataSerializer.java
|
|
@@ -173,6 +173,7 @@ public class PacketDataSerializer extends ByteBuf {
|
|
return this.d(oenum.ordinal());
|
|
}
|
|
|
|
+ public int readVarInt() { return i(); } // Paper - OBFHELPER
|
|
public int i() {
|
|
int i = 0;
|
|
int j = 0;
|
|
@@ -213,6 +214,7 @@ public class PacketDataSerializer extends ByteBuf {
|
|
return this;
|
|
}
|
|
|
|
+ public UUID readUUID() { return k(); } // Paper - OBFHELPER
|
|
public UUID k() {
|
|
return new UUID(this.readLong(), this.readLong());
|
|
}
|
|
@@ -340,6 +342,7 @@ public class PacketDataSerializer extends ByteBuf {
|
|
}
|
|
}
|
|
|
|
+ public String readUTF(int maxLength) { return this.e(maxLength); } // Paper - OBFHELPER
|
|
public String e(int i) {
|
|
int j = this.i();
|
|
|
|
diff --git a/src/main/java/net/minecraft/server/PacketLoginInCustomPayload.java b/src/main/java/net/minecraft/server/PacketLoginInCustomPayload.java
|
|
index 4d1f44139535cae0df90615d29121ff85cc964de..c1ca6f950162f53ebcb16efabb3064809472673f 100644
|
|
--- a/src/main/java/net/minecraft/server/PacketLoginInCustomPayload.java
|
|
+++ b/src/main/java/net/minecraft/server/PacketLoginInCustomPayload.java
|
|
@@ -4,8 +4,8 @@ import java.io.IOException;
|
|
|
|
public class PacketLoginInCustomPayload implements Packet<PacketLoginInListener> {
|
|
|
|
- private int a;
|
|
- private PacketDataSerializer b;
|
|
+ private int a; public int getId() { return a; } // Paper - OBFHELPER
|
|
+ private PacketDataSerializer b; public PacketDataSerializer getBuf() { return b; } // Paper - OBFHELPER
|
|
|
|
public PacketLoginInCustomPayload() {}
|
|
|
|
diff --git a/src/main/java/net/minecraft/server/PacketLoginOutCustomPayload.java b/src/main/java/net/minecraft/server/PacketLoginOutCustomPayload.java
|
|
index b52e8b72eaee87e227b7cc2fd66101550262cb7e..990cfea6c2339cd3cf688e4645de76dcee1d351a 100644
|
|
--- a/src/main/java/net/minecraft/server/PacketLoginOutCustomPayload.java
|
|
+++ b/src/main/java/net/minecraft/server/PacketLoginOutCustomPayload.java
|
|
@@ -10,6 +10,14 @@ public class PacketLoginOutCustomPayload implements Packet<PacketLoginOutListene
|
|
|
|
public PacketLoginOutCustomPayload() {}
|
|
|
|
+ // Paper start
|
|
+ public PacketLoginOutCustomPayload(int id, MinecraftKey channel, PacketDataSerializer buf) {
|
|
+ this.a = id;
|
|
+ this.b = channel;
|
|
+ this.c = buf;
|
|
+ }
|
|
+ // Paper end
|
|
+
|
|
@Override
|
|
public void a(PacketDataSerializer packetdataserializer) throws IOException {
|
|
this.a = packetdataserializer.i();
|
|
diff --git a/src/main/java/org/bukkit/craftbukkit/CraftServer.java b/src/main/java/org/bukkit/craftbukkit/CraftServer.java
|
|
index 760c5d3b1e9aba0946937f7a9263dbd0c4e295a7..0463e546fba266df3984022e3e1122750fc9bb06 100644
|
|
--- a/src/main/java/org/bukkit/craftbukkit/CraftServer.java
|
|
+++ b/src/main/java/org/bukkit/craftbukkit/CraftServer.java
|
|
@@ -685,7 +685,7 @@ public final class CraftServer implements Server {
|
|
@Override
|
|
public long getConnectionThrottle() {
|
|
// Spigot Start - Automatically set connection throttle for bungee configurations
|
|
- if (org.spigotmc.SpigotConfig.bungee) {
|
|
+ if (org.spigotmc.SpigotConfig.bungee || com.destroystokyo.paper.PaperConfig.velocitySupport) { // Paper - Velocity support
|
|
return -1;
|
|
} else {
|
|
return this.configuration.getInt("settings.connection-throttle");
|