Merge pull request #3 from TCPShield/timestamp-valdiation

Add timestamp validation

README.md

@@ -1,2 +1,13 @@
 # RealIP
 Bungee/Spigot plugin which parses client IP addresses passed from the TCPShield network.
+
+### Compiling
+To compile this project, install maven and run the following command:
+```
+mvn clean install
+```
+
+### Support
+Please contact [@RyanDeLap](https://t.me/RyanDeLap) on Telegram for all support related to this product.
+
+Before contact, ensure you have tested with no Bungee Plugins installed. Plugins like BungeePluginManager will break this plugin!

src/main/java/net/tcpshield/realip/PacketHandler.java

@@ -29,11 +29,13 @@ public class PacketHandler
     private String properField = null;
     private final Logger logger;
     private final boolean onlyProxy;
+    private final boolean debugMode;
 
-    public PacketHandler(Logger logger, boolean onlyProxy) {
+    public PacketHandler(Logger logger, boolean onlyProxy, boolean debugMode) {
         super(TCPShieldBukkit.getInstance(), new PacketType[]{PacketType.Handshake.Client.SET_PROTOCOL});
         this.logger = logger;
         this.onlyProxy = onlyProxy;
+        this.debugMode = debugMode;
     }
 
     public void onPacketReceiving(PacketEvent event) {
@@ -56,6 +58,11 @@ public class PacketHandler
                     int port = Integer.parseInt(hostnameParts[1]);
 
                     String reconstructedPayload = hostname + "///" + host + ":" + port + "///" + timestamp;
+
+                    if (signature.contains("%%%")) {
+                        signature = signature.split("%%%", 2)[0];
+                    }
+
                     if (!Signing.verify(reconstructedPayload.getBytes(StandardCharsets.UTF_8), signature)) {
                         throw new Exception("Couldn't verify signature.");
                     }
@@ -85,10 +92,13 @@ public class PacketHandler
             Player player;
             ex.printStackTrace();
         } finally {
-            if ((this.onlyProxy) &&
-                    (!proxyConnection)) {
+            if ((this.onlyProxy) && (!proxyConnection)) {
                 Player player = event.getPlayer();
-                this.logger.warning("Disconnecting " + player.getAddress() + " because no proxy info was received and only-allow-proxy-connections is enabled.");
+
+                if(this.debugMode) {
+                    this.logger.warning("Disconnecting " + player.getAddress() + " because no proxy info was received and only-allow-proxy-connections is enabled.");
+                }
+
                 if(raw != null) {
                     this.logger.warning(raw);
                 }

src/main/java/net/tcpshield/realip/TCPShieldBukkit.java

@@ -16,6 +16,7 @@ public class TCPShieldBukkit
     private static TCPShieldBukkit INSTANCE;
     private static Boolean stopping = Boolean.valueOf(false);
     private boolean onlyProxy;
+    private boolean debugMode;
 
     public void onEnable() {
         INSTANCE = this;
@@ -28,8 +29,9 @@ public class TCPShieldBukkit
         saveDefaultConfig();
         FileConfiguration config = getConfig();
         this.onlyProxy = config.getBoolean("only-allow-proxy-connections");
+        this.debugMode = config.getBoolean("debug-mode");
 
-        ProtocolLibrary.getProtocolManager().addPacketListener(new PacketHandler(getLogger(), this.onlyProxy));
+        ProtocolLibrary.getProtocolManager().addPacketListener(new PacketHandler(getLogger(), this.onlyProxy, this.debugMode));
     }
 
     public void onDisable() {

src/main/java/net/tcpshield/realip/TCPShieldBungee.java

@@ -32,6 +32,7 @@ public class TCPShieldBungee
         extends Plugin
         implements Listener {
     private boolean onlyProxy;
+    private boolean debugMode;
 
     public void onEnable() {
         saveDefaultConfig();
@@ -43,6 +44,7 @@ public class TCPShieldBungee
             throw new RuntimeException(e);
         }
         this.onlyProxy = config.getBoolean("only-allow-proxy-connections");
+        this.debugMode = config.getBoolean("debug-mode");
 
         ProxyServer proxy = getProxy();
         PluginManager pluginManager = proxy.getPluginManager();
@@ -146,9 +148,26 @@ public class TCPShieldBungee
                         int port = Integer.parseInt(hostnameParts[1]);
 
                         String reconstructedPayload = hostname + "///" + host + ":" + port + "///" + timestamp;
+
+                        if (signature.contains("%%%")) {
+                            signature = signature.split("%%%", 2)[0];
+                        }
+
                         if (!Signing.verify(reconstructedPayload.getBytes(StandardCharsets.UTF_8), signature)) {
                             throw new Exception("Couldn't verify signature.");
                         }
+
+                        long currentTime = System.currentTimeMillis() / 1000;
+
+                        if(!(timestamp >= (currentTime - 2) && timestamp <= (currentTime + 2))) {
+                            if(this.debugMode) {
+                                getLogger().warning("Current time: " + currentTime + ", Timestamp Time: "  + timestamp);
+                            }
+                            throw new Exception("Invalid signature timestamp, please check system's local clock if error persists.");
+                        }
+
+                        hostname = hostname.replace("%%%", "\0");
+
                         PendingConnection connection = e.getConnection();
 
                         InetSocketAddress sockadd = new InetSocketAddress(host, port);
@@ -187,15 +206,14 @@ public class TCPShieldBungee
                 }
             }
         } catch (Exception localException) {
-            Logger logger;
-            PendingConnection connection;
             localException.printStackTrace();
         } finally {
-            if ((this.onlyProxy) &&
-                    (!proxyConnection)) {
+            if (this.onlyProxy && !proxyConnection) {
                 Logger logger = getLogger();
                 PendingConnection connection = e.getConnection();
-                logger.warning("Disconnecting " + connection.getAddress() + " because no proxy info was received and only-allow-proxy-connections is enabled.");
+                if(this.debugMode) {
+                    logger.warning("Disconnecting " + connection.getAddress() + " because no proxy info was received and only-allow-proxy-connections is enabled.");
+                }
                 if (channel != null) {
                     channel.flush().close();
                 } else {

src/main/resources/bungee.yml

@@ -1,4 +1,4 @@
 name: TCPShield
-version: 1.3
+version: 1.6
 main: net.tcpshield.realip.TCPShieldBungee
 author: 'https://tcpshield.com'

src/main/resources/config.yml

@@ -1 +1,5 @@
-only-allow-proxy-connections: true
+# Please keep this as true in while using TCPShield!
+only-allow-proxy-connections: true
+
+# Turn on to diagnose connection issues
+debug-mode: false

src/main/resources/plugin.yml

@@ -1,5 +1,5 @@
 name: TCPShield
-version: 1.3
+version: 1.6
 main: net.tcpshield.realip.TCPShieldBukkit
 depend: ['ProtocolLib']
 author: 'https://tcpshield.com'