Paper/patches/server/0273-Add-Velocity-IP-Forwarding-Support.patch

182 lines
9.7 KiB
Diff
Raw Normal View History

2021-06-11 14:02:28 +02:00
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Andrew Steinborn <git@steinborn.me>
Date: Mon, 8 Oct 2018 14:36:14 -0400
Subject: [PATCH] Add Velocity IP Forwarding Support
While Velocity supports BungeeCord-style IP forwarding, it is not secure. Users
have a lot of problems setting up firewalls or setting up plugins like IPWhitelist.
Further, the BungeeCord IP forwarding protocol still retains essentially its original
form, when there is brand new support for custom login plugin messages in 1.13.
Velocity's modern IP forwarding uses an HMAC-SHA256 code to ensure authenticity
of messages, is packed into a binary format that is smaller than BungeeCord's
forwarding, and is integrated into the Minecraft login process by using the 1.13
login plugin message packet.
diff --git a/src/main/java/com/destroystokyo/paper/proxy/VelocityProxy.java b/src/main/java/com/destroystokyo/paper/proxy/VelocityProxy.java
new file mode 100644
index 0000000000000000000000000000000000000000..74b3265bba78491f462c15709a31bc44b4e4bea8
2021-06-11 14:02:28 +02:00
--- /dev/null
+++ b/src/main/java/com/destroystokyo/paper/proxy/VelocityProxy.java
@@ -0,0 +1,66 @@
+package com.destroystokyo.paper.proxy;
+
+import io.papermc.paper.configuration.GlobalConfiguration;
2021-06-11 14:02:28 +02:00
+import com.google.common.net.InetAddresses;
+import com.mojang.authlib.GameProfile;
+import com.mojang.authlib.properties.Property;
+import java.net.InetAddress;
+import java.security.InvalidKeyException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+import net.minecraft.network.FriendlyByteBuf;
+import net.minecraft.resources.ResourceLocation;
+
+public class VelocityProxy {
+ private static final int SUPPORTED_FORWARDING_VERSION = 1;
+ public static final ResourceLocation PLAYER_INFO_CHANNEL = new ResourceLocation("velocity", "player_info");
+
+ public static boolean checkIntegrity(final FriendlyByteBuf buf) {
+ final byte[] signature = new byte[32];
+ buf.readBytes(signature);
+
+ final byte[] data = new byte[buf.readableBytes()];
+ buf.getBytes(buf.readerIndex(), data);
+
+ try {
+ final Mac mac = Mac.getInstance("HmacSHA256");
+ mac.init(new SecretKeySpec(GlobalConfiguration.get().proxies.velocity.secret.getBytes(java.nio.charset.StandardCharsets.UTF_8), "HmacSHA256"));
2021-06-11 14:02:28 +02:00
+ final byte[] mySignature = mac.doFinal(data);
+ if (!MessageDigest.isEqual(signature, mySignature)) {
+ return false;
+ }
+ } catch (final InvalidKeyException | NoSuchAlgorithmException e) {
+ throw new AssertionError(e);
+ }
+
+ int version = buf.readVarInt();
+ if (version != SUPPORTED_FORWARDING_VERSION) {
+ throw new IllegalStateException("Unsupported forwarding version " + version + ", wanted " + SUPPORTED_FORWARDING_VERSION);
+ }
+
+ return true;
+ }
+
+ public static InetAddress readAddress(final FriendlyByteBuf buf) {
2021-06-13 08:48:25 +02:00
+ return InetAddresses.forString(buf.readUtf(Short.MAX_VALUE));
2021-06-11 14:02:28 +02:00
+ }
+
+ public static GameProfile createProfile(final FriendlyByteBuf buf) {
2021-06-13 08:48:25 +02:00
+ final GameProfile profile = new GameProfile(buf.readUUID(), buf.readUtf(16));
2021-06-11 14:02:28 +02:00
+ readProperties(buf, profile);
+ return profile;
+ }
+
+ private static void readProperties(final FriendlyByteBuf buf, final GameProfile profile) {
+ final int properties = buf.readVarInt();
+ for (int i1 = 0; i1 < properties; i1++) {
2021-06-13 08:48:25 +02:00
+ final String name = buf.readUtf(Short.MAX_VALUE);
+ final String value = buf.readUtf(Short.MAX_VALUE);
+ final String signature = buf.readBoolean() ? buf.readUtf(Short.MAX_VALUE) : null;
2021-06-11 14:02:28 +02:00
+ profile.getProperties().put(name, new Property(name, value, signature));
+ }
+ }
+}
diff --git a/src/main/java/net/minecraft/server/network/ServerLoginPacketListenerImpl.java b/src/main/java/net/minecraft/server/network/ServerLoginPacketListenerImpl.java
2022-06-09 23:11:43 +02:00
index 1b075033f0640433341957f6e26ebe25f18928ee..b070624c7ee85b6692f1f44ded6c78139925b669 100644
2021-06-11 14:02:28 +02:00
--- a/src/main/java/net/minecraft/server/network/ServerLoginPacketListenerImpl.java
+++ b/src/main/java/net/minecraft/server/network/ServerLoginPacketListenerImpl.java
@@ -69,6 +69,7 @@ public class ServerLoginPacketListenerImpl implements ServerLoginPacketListener
2021-06-13 08:48:25 +02:00
@Nullable
2022-06-08 02:42:07 +02:00
private ProfilePublicKey playerProfilePublicKey;
2021-06-11 14:02:28 +02:00
public String hostname = ""; // CraftBukkit - add field
+ private int velocityLoginMessageId = -1; // Paper - Velocity support
public ServerLoginPacketListenerImpl(MinecraftServer server, Connection connection) {
this.state = ServerLoginPacketListenerImpl.State.HELLO;
@@ -279,6 +280,14 @@ public class ServerLoginPacketListenerImpl implements ServerLoginPacketListener
2022-06-08 02:42:07 +02:00
this.state = ServerLoginPacketListenerImpl.State.KEY;
this.connection.send(new ClientboundHelloPacket("", this.server.getKeyPair().getPublic().getEncoded(), this.nonce));
} else {
+ // Paper start - Velocity support
+ if (io.papermc.paper.configuration.GlobalConfiguration.get().proxies.velocity.enabled) {
2022-06-08 02:42:07 +02:00
+ this.velocityLoginMessageId = java.util.concurrent.ThreadLocalRandom.current().nextInt();
+ net.minecraft.network.protocol.login.ClientboundCustomQueryPacket packet1 = new net.minecraft.network.protocol.login.ClientboundCustomQueryPacket(this.velocityLoginMessageId, com.destroystokyo.paper.proxy.VelocityProxy.PLAYER_INFO_CHANNEL, new net.minecraft.network.FriendlyByteBuf(io.netty.buffer.Unpooled.EMPTY_BUFFER));
2022-06-08 02:42:07 +02:00
+ this.connection.send(packet1);
+ return;
+ }
+ // Paper end
// Spigot start
2021-06-11 14:02:28 +02:00
// Paper start - Cache authenticator threads
authenticatorPool.execute(new Runnable() {
2022-06-09 23:11:43 +02:00
@@ -388,6 +397,12 @@ public class ServerLoginPacketListenerImpl implements ServerLoginPacketListener
2021-06-11 14:02:28 +02:00
public class LoginHandler {
public void fireEvents() throws Exception {
2021-06-13 08:48:25 +02:00
+ // Paper start - Velocity support
+ if (ServerLoginPacketListenerImpl.this.velocityLoginMessageId == -1 && io.papermc.paper.configuration.GlobalConfiguration.get().proxies.velocity.enabled) {
2021-06-13 08:48:25 +02:00
+ disconnect("This server requires you to connect with Velocity.");
+ return;
+ }
+ // Paper end
String playerName = ServerLoginPacketListenerImpl.this.gameProfile.getName();
java.net.InetAddress address = ((java.net.InetSocketAddress) ServerLoginPacketListenerImpl.this.connection.getRemoteAddress()).getAddress();
java.util.UUID uniqueId = ServerLoginPacketListenerImpl.this.gameProfile.getId();
2022-06-09 23:11:43 +02:00
@@ -435,6 +450,40 @@ public class ServerLoginPacketListenerImpl implements ServerLoginPacketListener
2021-06-11 14:02:28 +02:00
// Spigot end
public void handleCustomQueryPacket(ServerboundCustomQueryPacket packet) {
+ // Paper start - Velocity support
+ if (io.papermc.paper.configuration.GlobalConfiguration.get().proxies.velocity.enabled && packet.getTransactionId() == this.velocityLoginMessageId) {
2022-06-08 02:42:07 +02:00
+ net.minecraft.network.FriendlyByteBuf buf = packet.getData();
2021-06-11 14:02:28 +02:00
+ if (buf == null) {
+ this.disconnect("This server requires you to connect with Velocity.");
+ return;
+ }
+
+ if (!com.destroystokyo.paper.proxy.VelocityProxy.checkIntegrity(buf)) {
+ this.disconnect("Unable to verify player details");
+ return;
+ }
+
+ java.net.SocketAddress listening = this.connection.getRemoteAddress();
+ int port = 0;
+ if (listening instanceof java.net.InetSocketAddress) {
+ port = ((java.net.InetSocketAddress) listening).getPort();
+ }
+ this.connection.address = new java.net.InetSocketAddress(com.destroystokyo.paper.proxy.VelocityProxy.readAddress(buf), port);
+
2021-06-13 08:48:25 +02:00
+ this.gameProfile = com.destroystokyo.paper.proxy.VelocityProxy.createProfile(buf);
2021-06-11 14:02:28 +02:00
+
+ // Proceed with login
+ authenticatorPool.execute(() -> {
+ try {
+ new LoginHandler().fireEvents();
+ } catch (Exception ex) {
+ disconnect("Failed to verify username!");
+ server.server.getLogger().log(java.util.logging.Level.WARNING, "Exception verifying " + gameProfile.getName(), ex);
+ }
+ });
+ return;
+ }
+ // Paper end
2022-06-08 02:42:07 +02:00
this.disconnect(Component.translatable("multiplayer.disconnect.unexpected_query_response"));
2021-06-11 14:02:28 +02:00
}
diff --git a/src/main/java/org/bukkit/craftbukkit/CraftServer.java b/src/main/java/org/bukkit/craftbukkit/CraftServer.java
index ac7a1408efe242d34200d3f27333a1df72b5b7dd..9a9b6ceab49e78a6b5523825e571186f6f610212 100644
2021-06-11 14:02:28 +02:00
--- a/src/main/java/org/bukkit/craftbukkit/CraftServer.java
+++ b/src/main/java/org/bukkit/craftbukkit/CraftServer.java
2022-06-08 02:42:07 +02:00
@@ -755,7 +755,7 @@ public final class CraftServer implements Server {
2021-06-11 14:02:28 +02:00
@Override
public long getConnectionThrottle() {
// Spigot Start - Automatically set connection throttle for bungee configurations
- if (org.spigotmc.SpigotConfig.bungee) {
+ if (org.spigotmc.SpigotConfig.bungee || io.papermc.paper.configuration.GlobalConfiguration.get().proxies.velocity.enabled) { // Paper - Velocity support
2021-06-11 14:02:28 +02:00
return -1;
} else {
return this.configuration.getInt("settings.connection-throttle");