Merge pull request #128 from lewisgibson/htpdate-socket

Close the HTPDate socket and time out its connection

build.gradle

@@ -26,7 +26,7 @@ plugins {
 // --
 // Variables
 // --
-version = '2.6.0'
+version = '2.8.1'
 group = 'net.tcpshield.tcpshield'
 archivesBaseName = 'TCPShield'
 
@@ -60,8 +60,8 @@ sourceSets {
 }
 
 compileJava {
-    sourceCompatibility = "8"
-    targetCompatibility = "8"
+    sourceCompatibility = 17
+    targetCompatibility = 17
     options.encoding = 'UTF-8'
 }
 
@@ -82,10 +82,7 @@ repositories {
         url = 'https://oss.sonatype.org/content/repositories/snapshots'
     }
     maven {
-        url = 'https://papermc.io/repo/repository/maven-public/'
-    }
-    maven {
-        url = 'https://repo.velocitypowered.com/snapshots/'
+        url = 'https://repo.papermc.io/repository/maven-public/'
     }
     maven {
         url = "https://repo.opencollab.dev/maven-snapshots/"
@@ -94,17 +91,18 @@ repositories {
 
 dependencies {
     // Bukkit
-    compileOnly group: 'org.spigotmc', name: 'spigot-api', version: '1.11-R0.1-SNAPSHOT'
-    compileOnly group: 'com.comphenix.protocol', name: 'ProtocolLib', version: '5.0.0-SNAPSHOT'
+//    compileOnly group: 'com.comphenix.protocol', name: 'ProtocolLib', version: '5.3.0-SNAPSHOT'
 
-    // Paper
-    compileOnly group: 'com.destroystokyo.paper', name: 'paper-api', version: '1.15.2-R0.1-SNAPSHOT'
+    compileOnly(files("libs/ProtocolLib.jar")) // Temporary, currently using build #726 from the CI server since the maven repository is out of date.
+
+    // Paper - 1.19.4 so we can bump from JDK 8 -> JDK 17, using 1.20.x as a dependency would require bumping from JDK 8 -> JDK 21
+    compileOnly group: 'io.papermc.paper', name: 'paper-api', version: '1.19.4-R0.1-SNAPSHOT'
 
     // BungeeCord
     compileOnly group: 'net.md-5', name: 'bungeecord-api', version: '1.14-SNAPSHOT'
 
     // Velocity
-    compileOnly group: 'com.velocitypowered', name: 'velocity-api', version: '1.0.0-SNAPSHOT'
+    compileOnly group: 'com.velocitypowered', name: 'velocity-api', version: '3.3.0-SNAPSHOT'
 
     // Testing
     testImplementation group: 'org.junit.jupiter', name: 'junit-jupiter-api', version: '5.7.0-M1'

src/main/java/net/tcpshield/tcpshield/TCPShieldPacketHandler.java

@@ -14,6 +14,7 @@ import net.tcpshield.tcpshield.util.validation.timestamp.TimestampValidator;
 import net.tcpshield.tcpshield.util.validation.timestamp.impl.HTPDateTimestampValidator;
 
 import java.io.IOException;
+import java.lang.reflect.InvocationTargetException;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.net.UnknownHostException;
@@ -108,7 +109,7 @@ public class TCPShieldPacketHandler {
 
 			String hostname = payload[0];
 			String ipData = payload[1];
-			int timestamp = Integer.parseInt(payload[2]);
+			long timestamp = Long.parseLong(payload[2]);
 			String signature = payload[3];
 
 			String[] ipParts;

src/main/java/net/tcpshield/tcpshield/bukkit/TCPShieldBukkit.java

@@ -1,5 +1,6 @@
 package net.tcpshield.tcpshield.bukkit;
 
+import java.util.logging.Logger;
 import net.tcpshield.tcpshield.TCPShieldPacketHandler;
 import net.tcpshield.tcpshield.TCPShieldPlugin;
 import net.tcpshield.tcpshield.bukkit.paper.BukkitPaper;
@@ -9,6 +10,7 @@ import net.tcpshield.tcpshield.geyser.GeyserUtils;
 import net.tcpshield.tcpshield.provider.ConfigProvider;
 import net.tcpshield.tcpshield.util.Debugger;
 import net.tcpshield.tcpshield.util.exception.phase.InitializationException;
+import org.bukkit.Bukkit;
 import org.bukkit.plugin.java.JavaPlugin;
 
 /**
@@ -31,7 +33,25 @@ public class TCPShieldBukkit extends JavaPlugin implements TCPShieldPlugin {
 
 			// check force plib option -> paper -> plib -> error
 			if (this.configProvider.preferProtocolLib() && getServer().getPluginManager().getPlugin("ProtocolLib") != null) {
-				bukkitImpl = new BukkitProtocolLib(this);
+				try {
+					String[] protocolLibVersion = getServer().getPluginManager().getPlugin("ProtocolLib").getDescription().getVersion().split("-")[0].split("\\.");
+					int major = Integer.parseInt(protocolLibVersion[0]);
+					int minor = Integer.parseInt(protocolLibVersion[1]);
+					int patch = Integer.parseInt(protocolLibVersion[2]);
+
+					String minecraftVersion = Bukkit.getBukkitVersion().split("-")[0];
+					if (BukkitImplProvider.hasPaperEvent() && major <= 5 && minor <= 2 && patch <= 1 && (minecraftVersion.equals("1.20.5") || minecraftVersion.equals("1.20.6"))) {
+						getLogger().severe("TCPShield is incompatible with ProtocolLib <= 5.2.1 on Paper 1.20.5/1.20.6 due to lack of support from ProtocolLib. Reverting to default Paper handler to prevent issues. This error can be avoided by disabling 'prefer-protocollib' in the config.");
+						bukkitImpl = new BukkitPaper(this);
+					} else {
+						bukkitImpl = new BukkitProtocolLib(this);
+					}
+				} catch (Exception t) {
+					getLogger().warning("Failed to check Paper or ProtocolLib version. This is not a critical error unless you are running Paper 1.20.5/1.20.6 with ProtocolLib version 5.2.1 or below.");
+					getDebugger().exception(t);
+
+					bukkitImpl = new BukkitProtocolLib(this);
+				}
 			} else if (BukkitImplProvider.hasPaperEvent()) {
 				bukkitImpl = new BukkitPaper(this);
 			} else if (getServer().getPluginManager().getPlugin("ProtocolLib") != null) {
@@ -72,4 +92,9 @@ public class TCPShieldBukkit extends JavaPlugin implements TCPShieldPlugin {
 		return configProvider;
 	}
 
+	@Override
+	public Logger getLogger() {
+		return super.getLogger();
+	}
+
 }

src/main/java/net/tcpshield/tcpshield/bukkit/paper/handler/PaperPlayer.java

@@ -57,7 +57,7 @@ public class PaperPlayer implements PlayerProvider {
 	@Override
 	public void disconnect() {
 		handshakeEvent.setCancelled(false); // Caused issues with newer versions of Paper (Thanks https://github.com/realDragonium)
-		handshakeEvent.setFailMessage("Connection failed. Please try again or contract an administrator.");
+		handshakeEvent.setFailMessage("Connection failed. Please try again or contact an administrator.");
 		handshakeEvent.setFailed(true);
 	}
 

src/main/java/net/tcpshield/tcpshield/bukkit/protocollib/handler/ProtocolLibPlayer.java

@@ -1,6 +1,6 @@
 package net.tcpshield.tcpshield.bukkit.protocollib.handler;
 
-import com.comphenix.protocol.injector.temporary.MinimalInjector;
+import com.comphenix.protocol.injector.netty.Injector;
 import com.comphenix.protocol.injector.temporary.TemporaryPlayerFactory;
 import net.tcpshield.tcpshield.provider.PlayerProvider;
 import net.tcpshield.tcpshield.util.ReflectionUtil;
@@ -71,13 +71,12 @@ public class ProtocolLibPlayer implements PlayerProvider {
 		try {
 			this.ip = ip.getAddress().getHostAddress();
 
-			MinimalInjector ignored = TemporaryPlayerFactory.getInjectorFromPlayer(player);
-			Object injector = ReflectionUtil.getObjectInPrivateField(ignored, "injector");
-			Object networkManager = ReflectionUtil.getObjectInPrivateField(injector, "networkManager");
+			Injector ignored = TemporaryPlayerFactory.getInjectorFromPlayer(player);
+			Object networkManager = ReflectionUtil.getObjectInPrivateField(ignored, "networkManager");
 
 			ReflectionUtil.setFinalField(networkManager, ReflectionUtil.searchFieldByClass(networkManager.getClass(), SocketAddress.class), ip);
 
-			Object channel = ReflectionUtil.getObjectInPrivateField(injector, "wrappedChannel");
+			Object channel = ReflectionUtil.getObjectInPrivateField(ignored, "channel");
 			ReflectionUtil.setFinalField(channel, ReflectionUtil.getDeclaredField(abstractChannelClass, "remoteAddress"), ip);
 		} catch (Exception e) {
 			throw new PlayerManipulationException(e);

src/main/java/net/tcpshield/tcpshield/util/validation/cidr/CIDRMatcher.java

@@ -34,25 +34,33 @@ public abstract class CIDRMatcher {
 		String[] split = cidrMatchString.split("/");
 
 		String parsedIPAddress;
-		if (split.length != 0) {
+		if (split.length > 1) {
 			parsedIPAddress = split[0];
 
 			this.maskBits = Integer.parseInt(split[1]);
-			this.simpleCIDR = maskBits == 32;
+			if (maskBits < 0)
+				throw new CIDRException("Invalid mask: " + split[1]);
 		} else {
 			parsedIPAddress = cidrMatchString;
 
 			this.maskBits = -1;
-			this.simpleCIDR = true;
 		}
 
-		this.maskBytes = simpleCIDR ? -1 : maskBits / 8;
+		if (parsedIPAddress.isEmpty())
+			throw new CIDRException("Empty CIDR entry");
 
 		try {
 			cidrAddress = InetAddress.getByName(parsedIPAddress);
 		} catch (UnknownHostException e) {
 			throw new CIDRException(e);
 		}
+
+		int addressBits = cidrAddress.getAddress().length * 8;
+		if (maskBits > addressBits)
+			throw new CIDRException("Invalid mask: " + maskBits + " is longer than the " + addressBits + " bit address " + parsedIPAddress);
+
+		this.simpleCIDR = maskBits == -1 || maskBits == addressBits;
+		this.maskBytes = simpleCIDR ? -1 : maskBits / 8;
 	}
 
 	/**

src/main/java/net/tcpshield/tcpshield/util/validation/cidr/CIDRValidator.java

@@ -7,6 +7,7 @@ import java.io.File;
 import java.io.FileNotFoundException;
 import java.net.InetAddress;
 import java.util.*;
+import java.util.concurrent.ConcurrentHashMap;
 
 /**
  * A CIDR validator for TCPShield
@@ -18,7 +19,7 @@ public class CIDRValidator {
 	private final File ipWhitelistFolder;
 
 	private final List<CIDRMatcher> cidrMatchers;
-	private final Set<String> cache = new HashSet<>(); // Max potential size is equilivent to the amount of whitelisted IP's
+	private final Set<String> cache = ConcurrentHashMap.newKeySet(); // Max potential size is equilivent to the amount of whitelisted IP's
 
 	public CIDRValidator(TCPShieldPlugin plugin) throws CIDRException {
 		this.plugin = plugin;

src/main/java/net/tcpshield/tcpshield/util/validation/timestamp/impl/HTPDateTimestampValidator.java

@@ -7,6 +7,7 @@ import net.tcpshield.tcpshield.util.validation.timestamp.TimestampValidator;
 import java.io.BufferedReader;
 import java.io.IOException;
 import java.io.InputStreamReader;
+import java.net.InetSocketAddress;
 import java.net.Socket;
 import java.nio.charset.StandardCharsets;
 import java.text.ParseException;
@@ -24,6 +25,8 @@ import java.util.stream.Collectors;
  */
 public class HTPDateTimestampValidator extends TimestampValidator {
 
+	private static final int TIMEOUT = 10000; // In milliseconds
+
 	private volatile long htpDateOffset = 0;
 
 	public HTPDateTimestampValidator(TCPShieldPlugin plugin) {
@@ -40,20 +43,23 @@ public class HTPDateTimestampValidator extends TimestampValidator {
 
 
 	private void updateHTPDateOffset() throws IOException {
-		Socket socket = new Socket("google.com", 80);
+		try (Socket socket = new Socket()) {
+			socket.connect(new InetSocketAddress("google.com", 80), TIMEOUT);
+			socket.setSoTimeout(TIMEOUT);
 
-		String payload = "HEAD http://google.com/ HTTP/1.1\r\nHost: google.com\r\nUser-Agent: tcpshield/1.0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nConnection: close\r\n\r\n";
-		socket.getOutputStream().write(payload.getBytes());
+			String payload = "HEAD http://google.com/ HTTP/1.1\r\nHost: google.com\r\nUser-Agent: tcpshield/1.0\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nConnection: close\r\n\r\n";
+			socket.getOutputStream().write(payload.getBytes());
 
-		long readTime = System.currentTimeMillis(); // assuming server -> client time is negligible
+			long readTime = System.currentTimeMillis(); // assuming server -> client time is negligible
 
-		List<String> response = new BufferedReader(new InputStreamReader(socket.getInputStream(), StandardCharsets.UTF_8))
-				.lines()
-				.collect(Collectors.toList());
+			List<String> response = new BufferedReader(new InputStreamReader(socket.getInputStream(), StandardCharsets.UTF_8))
+					.lines()
+					.collect(Collectors.toList());
 
-		Date serverDate = parseDate(response);
+			Date serverDate = parseDate(response);
 
-		htpDateOffset = Math.round((serverDate.getTime() - readTime) / 1000.0) * 1000; // the HTTP protocol only returns time in seconds; round offset
+			htpDateOffset = Math.round((serverDate.getTime() - readTime) / 1000.0) * 1000; // the HTTP protocol only returns time in seconds; round offset
+		}
 	}
 
 	private Date parseDate(List<String> response) {

src/main/java/net/tcpshield/tcpshield/velocity/handler/VelocityHandshakeHandler.java

@@ -16,6 +16,17 @@ public class VelocityHandshakeHandler {
 
 	private final TCPShieldPlugin plugin;
 
+
+	private static Class<?> CONNECTED_PLAYER_CONNECTION_CLASS;
+
+	static {
+		try {
+			CONNECTED_PLAYER_CONNECTION_CLASS = Class.forName("com.velocitypowered.proxy.connection.client.ConnectedPlayer");
+		} catch (Exception e) {
+			// ignore for old velocity versions
+		}
+	}
+
 	public VelocityHandshakeHandler(TCPShieldPlugin plugin) {
 		this.plugin = plugin;
 	}
@@ -42,6 +53,12 @@ public class VelocityHandshakeHandler {
 	@Subscribe(order = PostOrder.FIRST)
 	public void onProxyPing(ProxyPingEvent e) {
 		InboundConnection connection = e.getConnection();
+
+		if (connection.getClass() == CONNECTED_PLAYER_CONNECTION_CLASS) {
+			// new ServerData (0x42) packet on connect, we don't care about it
+			return;
+		}
+
 		handleEvent(connection, "onProxyPing");
 	}
 

src/main/java/net/tcpshield/tcpshield/velocity/handler/VelocityPacket.java

@@ -31,7 +31,15 @@ public class VelocityPacket implements PacketProvider {
 			Class<?> inboundConnection = Class.forName("com.velocitypowered.proxy.connection.client.InitialInboundConnection");
 
 			HANDSHAKE_FIELD = ReflectionUtil.getPrivateField(inboundConnection, "handshake");
-			HOSTNAME_FIELD = ReflectionUtil.getPrivateField(Class.forName("com.velocitypowered.proxy.protocol.packet.Handshake"), "serverAddress");
+
+			Field hostnameField;
+			try {
+				hostnameField = ReflectionUtil.getPrivateField(Class.forName("com.velocitypowered.proxy.protocol.packet.HandshakePacket"), "serverAddress");
+			} catch (Exception e) {
+				hostnameField = ReflectionUtil.getPrivateField(Class.forName("com.velocitypowered.proxy.protocol.packet.Handshake"), "serverAddress");
+			}
+			HOSTNAME_FIELD = hostnameField;
+
 			CLEANED_ADDRESS_FIELD = ReflectionUtil.getPrivateField(inboundConnection, "cleanedAddress");
 		} catch (Exception e) {
 			throw new InitializationException(new ReflectionException(e));

src/main/java/net/tcpshield/tcpshield/velocity/handler/VelocityPlayer.java

@@ -4,7 +4,6 @@ import com.velocitypowered.api.proxy.InboundConnection;
 import net.tcpshield.tcpshield.provider.PlayerProvider;
 import net.tcpshield.tcpshield.util.ReflectionUtil;
 import net.tcpshield.tcpshield.util.exception.manipulate.PlayerManipulationException;
-import net.tcpshield.tcpshield.util.exception.phase.HandshakeException;
 import net.tcpshield.tcpshield.util.exception.phase.InitializationException;
 import net.tcpshield.tcpshield.util.exception.phase.ReflectionException;
 
@@ -27,6 +26,7 @@ public class VelocityPlayer implements PlayerProvider {
 	private static final Method CLOSE_CHANNEL_METHOD;
 
 	// new velocity support
+
 	private static Class<?> LOGIN_INBOUND_CONNECTION_CLASS;
 	private static Field LOGIN_INBOUND_CONNECTION_DELEGATE_FIELD;
 
@@ -149,7 +149,7 @@ public class VelocityPlayer implements PlayerProvider {
 	}
 
 	enum ConnectionType {
-		LOGIN_INBOUND, INITIAL_INBOUND, LEGACY;
+		LOGIN_INBOUND, INITIAL_INBOUND, LEGACY
 	}
 
 }

src/main/resources/bungee.yml

@@ -1,5 +1,5 @@
 name: TCPShield
-version: 2.6.0
+version: 2.8.1
 main: net.tcpshield.tcpshield.bungee.TCPShieldBungee
 author: https://tcpshield.com
 softdepends:

src/main/resources/config.yml

@@ -11,4 +11,4 @@ debug-mode: false
 enable-geyser-support: false
 
 # Spigot/Paper option only, does not affect bungeecord
-prefer-protocollib: true
+prefer-protocollib: false

src/main/resources/plugin.yml

@@ -1,5 +1,5 @@
 name: TCPShield
-version: 2.6.0
+version: 2.8.1
 main: net.tcpshield.tcpshield.bukkit.TCPShieldBukkit
 softdepend:
 - ProtocolLib
@@ -7,3 +7,4 @@ softdepend:
 author: https://tcpshield.com
 description: TCPShield IP parsing capabilities for Velocity
 api-version: 1.16
+folia-supported: true

src/main/resources/velocity-plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "tcpshield",
   "name": "TCPShield",
-  "version": "2.6.0",
+  "version": "2.8.1",
   "description": "TCPShield IP parsing capabilities for Velocity",
   "authors": [
     "TCPShield"

src/test/java/net/tcpshield/tcpshield/util/validation/cidr/CIDRMatcherTest.java

@@ -0,0 +1,103 @@
+package net.tcpshield.tcpshield.util.validation.cidr;
+
+import net.tcpshield.tcpshield.util.exception.phase.CIDRException;
+import org.junit.jupiter.api.Test;
+
+import java.net.InetAddress;
+import java.net.UnknownHostException;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+public class CIDRMatcherTest {
+
+	private static boolean matches(String cidr, String address) throws UnknownHostException {
+		return CIDRMatcher.create(cidr).match(InetAddress.getByName(address));
+	}
+
+	@Test
+	public void bareAddressMatchesOnlyItself() throws UnknownHostException {
+		assertTrue(matches("203.0.113.7", "203.0.113.7"));
+		assertFalse(matches("203.0.113.7", "203.0.113.8"));
+	}
+
+	@Test
+	public void bareIPv6AddressMatchesOnlyItself() throws UnknownHostException {
+		assertTrue(matches("2001:db8::1", "2001:db8::1"));
+		assertFalse(matches("2001:db8::1", "2001:db8::2"));
+	}
+
+	@Test
+	public void emptyEntryIsRejected() {
+		assertThrows(CIDRException.class, () -> CIDRMatcher.create(""));
+	}
+
+	@Test
+	public void ipv6PrefixOf32BitsMatchesTheWholePrefix() throws UnknownHostException {
+		assertTrue(matches("2001:db8::/32", "2001:db8::"));
+		assertTrue(matches("2001:db8::/32", "2001:db8:ffff:ffff:ffff:ffff:ffff:ffff"));
+		assertFalse(matches("2001:db8::/32", "2001:db9::"));
+		assertFalse(matches("2001:db8::/32", "2002:db8::"));
+	}
+
+	@Test
+	public void ipv6PrefixOf128BitsMatchesOnlyItself() throws UnknownHostException {
+		assertTrue(matches("2001:db8::1/128", "2001:db8::1"));
+		assertFalse(matches("2001:db8::1/128", "2001:db8::2"));
+	}
+
+	@Test
+	public void ipv4PrefixOf32BitsMatchesOnlyItself() throws UnknownHostException {
+		assertTrue(matches("203.0.113.7/32", "203.0.113.7"));
+		assertFalse(matches("203.0.113.7/32", "203.0.113.8"));
+	}
+
+	@Test
+	public void masksLongerThanTheAddressAreRejected() {
+		assertThrows(CIDRException.class, () -> CIDRMatcher.create("203.0.113.0/33"));
+		assertThrows(CIDRException.class, () -> CIDRMatcher.create("2001:db8::/129"));
+	}
+
+	@Test
+	public void negativeMasksAreRejected() {
+		assertThrows(CIDRException.class, () -> CIDRMatcher.create("203.0.113.0/-1"));
+	}
+
+	@Test
+	public void ipv4MaskEdges() throws UnknownHostException {
+		assertTrue(matches("0.0.0.0/0", "203.0.113.7"));
+		assertTrue(matches("128.0.0.0/1", "203.0.113.7"));
+		assertFalse(matches("128.0.0.0/1", "127.255.255.255"));
+		assertTrue(matches("203.0.0.0/8", "203.255.255.255"));
+		assertFalse(matches("203.0.0.0/8", "204.0.0.0"));
+		assertTrue(matches("203.0.0.0/9", "203.127.255.255"));
+		assertFalse(matches("203.0.0.0/9", "203.128.0.0"));
+		assertTrue(matches("203.0.112.0/23", "203.0.113.255"));
+		assertFalse(matches("203.0.112.0/23", "203.0.114.0"));
+		assertTrue(matches("203.0.113.0/24", "203.0.113.255"));
+		assertFalse(matches("203.0.113.0/24", "203.0.112.255"));
+		assertTrue(matches("203.0.113.128/25", "203.0.113.255"));
+		assertFalse(matches("203.0.113.128/25", "203.0.113.127"));
+		assertTrue(matches("203.0.113.6/31", "203.0.113.7"));
+		assertFalse(matches("203.0.113.6/31", "203.0.113.8"));
+	}
+
+	@Test
+	public void ipv6MaskEdges() throws UnknownHostException {
+		assertTrue(matches("::/0", "2001:db8::1"));
+		assertTrue(matches("8000::/1", "ffff::1"));
+		assertFalse(matches("8000::/1", "7fff::1"));
+		assertTrue(matches("2001:db8::/48", "2001:db8:0:ffff::1"));
+		assertFalse(matches("2001:db8::/48", "2001:db8:1::1"));
+		assertTrue(matches("2001:db8::/49", "2001:db8:0:7fff::1"));
+		assertFalse(matches("2001:db8::/49", "2001:db8:0:8000::1"));
+		assertTrue(matches("2001:db8::/127", "2001:db8::1"));
+		assertFalse(matches("2001:db8::/127", "2001:db8::2"));
+	}
+
+	@Test
+	public void addressFamiliesNeverMatchEachOther() throws UnknownHostException {
+		assertFalse(matches("0.0.0.0/0", "2001:db8::1"));
+		assertFalse(matches("::/0", "203.0.113.7"));
+	}
+
+}