Release 2.0.18 (#202)

* feat: optimize bandwidth counting by recoding the channel handler

* fix: verification breaking new connections if disabled

* fix: add exception handlers to ensure that no error can reach the server

.github/README.md

@@ -25,7 +25,7 @@
   |
   [Discord](https://jonesdev.xyz/discord)
   |
-  [License](https://github.com/jonesdevelopment/sonar/blob/main/README.md#license)
+  [License](https://github.com/jonesdevelopment/sonar/?tab=readme-ov-file#license)
 </div>
 
 ## Design and Goal
@@ -33,27 +33,21 @@
 * Effective, lightweight, and easy-to-use
 * No unnecessary features and clean code
 * Protection against all kinds of bot attacks
-* No player should be annoyed by any sort of captcha
+* No player should be annoyed by any sort of [CAPTCHA](https://en.wikipedia.org/wiki/CAPTCHA)
 * No sort of checking for VPNs or proxies
-* Multi-platform support (Velocity, BungeeCord, and Bukkit)
+* Multi-platform support (See [supported versions](https://docs.jonesdev.xyz/sonar/supported-versions))
 
 ## Checks
 
-- New player logins are queued to prevent spam login attacks.
-- [Fallback](https://github.com/jonesdevelopment/sonar#fallback) is Sonar's main component designed to prevent
-  all types of bots.
-- Spigot & BungeeCord
-  - Duplicate login/status packet spam fix
-  - Run server ping handling asynchronously
-  - The Varint decoder is updated to Velocity's
-    improved [MinecraftVarintFrameDecoder](https://github.com/PaperMC/Velocity/blob/dev/3.0.0/proxy/src/main/java/com/velocitypowered/proxy/protocol/netty/MinecraftVarintFrameDecoder.java).
+- [Fallback](https://github.com/jonesdevelopment/sonar#fallback) is Sonar's main anti-bot component
+- Sonar queues new player logins to prevent spam login attacks
+- Sonar checks the handshake packets for legitimacy
+- Sonar makes sure some packets cannot be duplicated illegitimately
 
 ### Fallback
 
-Fallback analyzes a player's behavior before joining the actual server, therefore stopping malicious traffic from ever
-reaching the backend.
-It is supposed to be an instant, powerful, and invisible method of verification that should prevent all typical and
-advanced types of bots.
+Fallback analyzes a player's behavior before joining the actual server, therefore stopping malicious traffic from ever reaching the backend.
+It is supposed to be an instant, powerful, and invisible method of verification that should prevent all typical and advanced types of bots.
 
 * Sends the player to a lightweight fake server when they connect for the first time.
 * Analyzes if the player is sending the necessary packets.
@@ -61,16 +55,11 @@ advanced types of bots.
 * Checks if the player is obeying client gravity.
 * Checks if the player is colliding with blocks correctly.
 
-Fallback also protects from huge spambot attacks since it queues the incoming connections, therefore making it
-technically impossible to have a ton of bots join the server at the same time.
+Fallback also protects against huge spambot attacks since it queues the incoming connections, therefore making it technically impossible to have a ton of bots join the server at the same time.
 
 ### False positives
 
-Fallback is unlikely to ever falsely prevent a player from joining the server since Minecraft uses the TCP protocol which means that packets are always sent in the correct order. Therefore, lag or ping should not affect the bot check.
-However, there are some edge cases where Fallback might not receive packets within the necessary time period. In this case, Sonar tries to account for these edge cases in order to prevent false positives. For example, some higher Minecraft versions have a bug where the client sometimes sends a packet out of order. Sonar accounts for that and does not falsely blacklist clients.
-If you or one of your players experiences a false positive, make sure to report it by opening
-a [GitHub issue](https://github.com/jonesdevelopment/sonar/issues) or a ticket
-on [Discord](https://jonesdev.xyz/discord/).
+Fallback is unlikely to ever falsely prevent a player from joining the server since Minecraft uses the TCP protocol, which means that packets are always sent in the correct order. Therefore, lag or ping should not affect the bot check. However, there are some edge cases where Fallback might not receive packets within the necessary time period. In this case, Sonar tries to account for these edge cases in order to prevent false positives. If you or one of your players experiences a false positive, make sure to report it by opening a [GitHub issue](https://github.com/jonesdevelopment/sonar/issues) or a ticket on [Discord](https://jonesdev.xyz/discord/).
 
 ## Building
 
@@ -80,9 +69,7 @@ You can also take a look at the [gradle documentation](https://docs.gradle.org/c
 
 ## Contributing
 
-If you are interested in contributing, you can check out
-the [Contributing Guidelines](https://github.com/jonesdevelopment/sonar/blob/main/.github/CONTRIBUTING.md) for detailed
-instructions.
+If you are interested in contributing, you can check out the [Contributing Guidelines](https://github.com/jonesdevelopment/sonar/blob/main/.github/CONTRIBUTING.md) for detailed instructions.
 
 ## License
 

.github/SECURITY.md

@@ -13,13 +13,9 @@ If you discover a security vulnerability within Sonar, please follow these steps
 
 ## Contact
 
-If you have any questions or concerns regarding the security of this project, please open a ticket on Discord or contact me via email at admin@jonesdev.xyz.
+If you have any questions or concerns regarding the security of this project, please open a ticket on Discord or contact me via email at contact@jonesdev.xyz.
 
 ## Acknowledgments
 
-Special thanks to the following people for their contributions:
-- [xism4](https://github.com/xism4)
-  - fixed serious issues with packet decode logic on BungeeCord [#5](https://github.com/jonesdevelopment/sonar-legacy/pull/5) (Severity: medium)
-  - fixed a false blacklisting issue when a player looses connection [#9](https://github.com/jonesdevelopment/sonar-legacy/pull/9) (Severity: low)
-- [NoGodHenry](https://github.com/NoGodHenry)
-  - fixed a ConcurrentModificationException in the configuration [#3](https://github.com/jonesdevelopment/sonar-legacy/pull/3) (Severity: low)
+- Special thanks to the [contributors of Sonar](https://github.com/jonesdevelopment/sonar/graphs/contributors),
+  and also those who reported security issues or bugs.

.github/workflows/gradle.yml

@@ -22,10 +22,10 @@ jobs:
 
     steps:
     - uses: actions/checkout@v3
-    - name: Set up JDK 11
+    - name: Set up JDK 17
       uses: actions/setup-java@v3
       with:
-        java-version: '11'
+        java-version: '17'
         distribution: 'temurin'
     - name: Build with Gradle
       uses: gradle/gradle-build-action@bd5760595778326ba7f1441bcf7e88b49de61a25 # v2.6.0

build.gradle.kts

@@ -21,8 +21,8 @@ versioner {
 allprojects {
   repositories {
     mavenCentral() // Lombok
-    maven(url = "https://jitpack.io") // simple-yaml
     maven(url = "https://repo.jonesdev.xyz/releases/") // Bungee & Velocity proxy module
+    maven(url = "https://s01.oss.sonatype.org/content/repositories/snapshots/") // libby
   }
 
   apply(plugin = "java")
@@ -43,10 +43,12 @@ allprojects {
     // adventure nbt
     implementation("net.kyori:adventure-nbt:$adventureVersion")
 
-    implementation("com.j256.ormlite:ormlite-jdbc:6.1") // ORM
-    implementation("xyz.jonesdev:cappuccino:0.1.6-SNAPSHOT") // expiring cache
+    compileOnly("com.j256.ormlite:ormlite-jdbc:6.1") // ORMLite
+    compileOnly("com.github.ben-manes.caffeine:caffeine:3.1.8") // caching
+    compileOnly("io.netty:netty-all:4.1.106.Final") // netty
 
-    compileOnly("io.netty:netty-all:4.1.104.Final") // netty
+    // Library/dependency loading
+    compileOnly("com.alessiodp.libby:libby-core:2.0.0-SNAPSHOT")
   }
 }
 
@@ -69,7 +71,7 @@ tasks {
 
   shadowJar {
     // Set the file name of the shadowed jar
-    archiveFileName.set("Sonar.jar")
+    archiveFileName.set("${rootProject.name}.jar")
 
     // Remove file timestamps
     isPreserveFileTimestamps = false
@@ -80,17 +82,23 @@ tasks {
 
     // https://github.com/jonesdevelopment/sonar/issues/46
     // Relocate some packages, so we don't run into issues where we accidentally use Velocity's classes
-    relocate("org.simpleyaml", "xyz.jonesdev.sonar.libs.yaml")
-    relocate("com.google.gson", "xyz.jonesdev.sonar.libs.gson")
-    relocate("com.j256.ormlite", "xyz.jonesdev.sonar.libs.ormlite")
+    relocate("com.alessiodp.libby", "xyz.jonesdev.sonar.libs.libby")
     relocate("xyz.jonesdev.cappuccino", "xyz.jonesdev.sonar.libs.cappuccino")
-    relocate("net.kyori.examination", "xyz.jonesdev.sonar.libs.examination")
-    relocate("net.kyori.option", "xyz.jonesdev.sonar.libs.option")
     // We have to be careful here, so we don't accidentally break adventure
     relocate("net.kyori.adventure", "xyz.jonesdev.sonar.libs.adventure") {
       exclude("net.kyori.adventure.text.**")
-      exclude("net.kyori.adventure.audience.**")
+      exclude("net.kyori.adventure.audience.Audience")
+      exclude("net.kyori.adventure.title.*")
     }
+    relocate("net.kyori.examination", "xyz.jonesdev.sonar.libs.examination")
+    relocate("net.kyori.option", "xyz.jonesdev.sonar.libs.option")
+    // Relocate dynamically loaded libraries
+    relocate("com.simpleyaml", "xyz.jonesdev.sonar.libs.yaml")
+    relocate("com.google.code.gson", "xyz.jonesdev.sonar.libs.gson")
+    relocate("com.j256.ormlite", "xyz.jonesdev.sonar.libs.ormlite")
+    relocate("com.github.benmanes.caffeine", "xyz.jonesdev.sonar.libs.caffeine")
+    // We want to load our own Gson dynamically
+    exclude("com/google/gson/**")
 
     // Exclude unnecessary metadata information
     exclude("META-INF/versions/**")

gradle.properties

@@ -1,3 +1,3 @@
 group=xyz.jonesdev.sonar
-version=2.0.12
+version=2.0.18
 description=Effective Anti-bot plugin for Velocity, BungeeCord, and Bukkit (1.7-latest)

settings.gradle.kts

@@ -1,4 +1,4 @@
-rootProject.name = "sonar"
+rootProject.name = "Sonar"
 
 sequenceOf("api", "bukkit", "bungee", "common", "velocity").forEach {
   val path = "sonar-$it"

sonar-api/build.gradle.kts

@@ -1,10 +1,14 @@
+repositories {
+  maven(url = "https://jitpack.io/") // simple-yaml
+}
+
 dependencies {
-  implementation("com.github.Carleslc.Simple-YAML:Simple-Yaml:1.8.4") {
+  compileOnly("com.github.Carleslc.Simple-YAML:Simple-Yaml:1.8.4") {
     exclude(group = "org.yaml")
   }
 
   compileOnly("org.jetbrains:annotations:24.0.1")
 }
 
-java.sourceCompatibility = JavaVersion.VERSION_1_8
-java.targetCompatibility = JavaVersion.VERSION_1_8
+java.sourceCompatibility = JavaVersion.VERSION_11
+java.targetCompatibility = JavaVersion.VERSION_11

sonar-api/src/main/java/xyz/jonesdev/sonar/api/AlreadyInitializedException.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/ReflectiveOperationException.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/Sonar.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -17,8 +17,10 @@
 
 package xyz.jonesdev.sonar.api;
 
+import com.alessiodp.libby.LibraryManager;
 import com.google.gson.Gson;
 import com.google.gson.GsonBuilder;
+import net.kyori.adventure.audience.Audience;
 import org.jetbrains.annotations.NotNull;
 import xyz.jonesdev.sonar.api.attack.AttackTracker;
 import xyz.jonesdev.sonar.api.command.subcommand.SubcommandRegistry;
@@ -27,10 +29,14 @@ import xyz.jonesdev.sonar.api.controller.VerifiedPlayerController;
 import xyz.jonesdev.sonar.api.event.SonarEventManager;
 import xyz.jonesdev.sonar.api.fallback.Fallback;
 import xyz.jonesdev.sonar.api.logger.LoggerWrapper;
+import xyz.jonesdev.sonar.api.timer.SystemTimer;
+import xyz.jonesdev.sonar.api.verbose.Notification;
 import xyz.jonesdev.sonar.api.verbose.Verbose;
 
 import java.io.File;
 import java.text.DecimalFormat;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
 
 public interface Sonar {
   DecimalFormat DECIMAL_FORMAT = new DecimalFormat("#,###.##");
@@ -40,6 +46,12 @@ public interface Sonar {
     .disableInnerClassSerialization()
     .create();
 
+  /**
+   * Since we want to use Adventure on every server platform,
+   * we have to use their platform module to support BungeeCord and Bukkit
+   */
+  Map<String, Audience> AUDIENCES = new ConcurrentHashMap<>();
+
   /**
    * @return The platform the plugin is being run on
    */
@@ -60,12 +72,24 @@ public interface Sonar {
 
   @NotNull Verbose getVerboseHandler();
 
+  @NotNull Notification getNotificationHandler();
+
+  @NotNull SystemTimer getLaunchTimer();
+
+  @NotNull LibraryManager getLibraryManager();
+
   /**
    * Set a custom verbose handler
    */
   @SuppressWarnings("unused")
   void setVerboseHandler(final @NotNull Verbose verboseHandler);
 
+  /**
+   * Set a custom notification handler
+   */
+  @SuppressWarnings("unused")
+  void setNotificationHandler(final @NotNull Notification notificationHandler);
+
   /**
    * Reloads the entire plugin
    */

sonar-api/src/main/java/xyz/jonesdev/sonar/api/SonarPlatform.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/SonarSupplier.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/SonarVersion.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/attack/AttackTracker.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -24,6 +24,7 @@ import xyz.jonesdev.sonar.api.config.SonarConfiguration;
 import xyz.jonesdev.sonar.api.event.impl.AttackDetectedEvent;
 import xyz.jonesdev.sonar.api.event.impl.AttackMitigatedEvent;
 import xyz.jonesdev.sonar.api.profiler.JVMProfiler;
+import xyz.jonesdev.sonar.api.statistics.Counters;
 import xyz.jonesdev.sonar.api.statistics.Statistics;
 import xyz.jonesdev.sonar.api.timer.SystemTimer;
 
@@ -42,7 +43,8 @@ public final class AttackTracker implements JVMProfiler {
   public static final class AttackStatistics {
     private final SystemTimer duration = new SystemTimer();
     private final SystemTimer timer = new SystemTimer();
-    private int peakJoinsPerSecond;
+    private long peakJoinsPerSecond;
+    private long peakConnectionsPerSecond;
     private double peakProcessCPUUsage;
     private long peakProcessMemoryUsage;
     // Calculate during-attack-statistics using their deltas
@@ -50,7 +52,7 @@ public final class AttackTracker implements JVMProfiler {
   }
 
   public void checkIfUnderAttack() {
-    final int joinsPerSecond = Sonar.get().getVerboseHandler().getLoginsPerSecond().estimatedSize();
+    final long joinsPerSecond = Counters.LOGINS_PER_SECOND.estimatedSize();
     final int verifyingPlayers = Sonar.get().getFallback().getConnected().size();
     final int queuedPlayers = Sonar.get().getFallback().getQueue().getQueuedPlayers().size();
     final int minPlayers = Sonar.get().getConfig().getMinPlayersForAttack();
@@ -67,6 +69,7 @@ public final class AttackTracker implements JVMProfiler {
         currentAttack.successfulVerifications = Sonar.get().getVerifiedPlayerController().estimatedSize();
         currentAttack.failedVerifications = Statistics.FAILED_VERIFICATIONS.get();
         Sonar.get().getEventManager().publish(new AttackDetectedEvent());
+        Sonar.get().getNotificationHandler().sendAttackNotification();
       } else {
         // Reset attack timer if we're still under attack
         currentAttack.timer.reset();
@@ -77,6 +80,11 @@ public final class AttackTracker implements JVMProfiler {
         // Update joins per second peak if necessary
         currentAttack.peakJoinsPerSecond = joinsPerSecond;
       }
+      final long connectionsPerSecond = Counters.CONNECTIONS_PER_SECOND.estimatedSize();
+      if (connectionsPerSecond > currentAttack.peakConnectionsPerSecond) {
+        // Update connections per second peak if necessary
+        currentAttack.peakConnectionsPerSecond = connectionsPerSecond;
+      }
       final double processCPUUsage = getProcessCPUUsage();
       if (processCPUUsage > currentAttack.peakProcessCPUUsage) {
         // Update cpu usage peak if necessary
@@ -99,12 +107,13 @@ public final class AttackTracker implements JVMProfiler {
           final String peakCPU = Sonar.DECIMAL_FORMAT.format(currentAttack.peakProcessCPUUsage);
           final String peakMem = formatMemory(currentAttack.peakProcessMemoryUsage);
           final String peakBPS = Sonar.DECIMAL_FORMAT.format(currentAttack.peakJoinsPerSecond);
+          final String peakCPS = Sonar.DECIMAL_FORMAT.format(currentAttack.peakConnectionsPerSecond);
           final long minutes = deltaInMillis / (60 * 1000); // Convert milliseconds to minutes
           final double seconds = (deltaInMillis % (60 * 1000)) / 1000D; // Convert remaining milliseconds to seconds
           final String formattedDuration = String.format("%d minutes, %.0f seconds", minutes, seconds);
           final String startTimestamp = String.valueOf(currentAttack.duration.getStart() / 1000L);
           final String endTimestamp = String.valueOf(System.currentTimeMillis() / 1000L);
-          final long blacklisted = Sonar.get().getFallback().getBlacklisted().estimatedSize();
+          final long blacklisted = Sonar.get().getFallback().getBlacklist().estimatedSize();
           // Calculate during-attack-statistics using their deltas
           final long totalVerified = Sonar.get().getVerifiedPlayerController().estimatedSize();
           final long verified = Math.max(totalVerified - currentAttack.successfulVerifications, 0);
@@ -112,21 +121,23 @@ public final class AttackTracker implements JVMProfiler {
           final long failed = Math.max(totalFailed - currentAttack.failedVerifications, 0);
 
           // Post webhook to Discord
-          Optional.ofNullable(Sonar.get().getConfig().getDiscordWebhook()).ifPresent(webhook -> webhook.post(() -> {
-            final SonarConfiguration.Webhook.Embed config = Sonar.get().getConfig().getWebhook().getEmbed();
-            final String description = config.getDescription()
-              .replace("%start-timestamp%", startTimestamp)
-              .replace("%end-timestamp%", endTimestamp)
-              .replace("%duration%", formattedDuration)
-              .replace("%peak-cpu%", peakCPU)
-              .replace("%peak-memory%", peakMem)
-              .replace("%peak-bps%", peakBPS)
-              .replace("%total-blacklisted%", Sonar.DECIMAL_FORMAT.format(blacklisted))
-              .replace("%total-failed%", Sonar.DECIMAL_FORMAT.format(failed))
-              .replace("%total-success%", Sonar.DECIMAL_FORMAT.format(verified));
-            return new SonarConfiguration.Webhook.Embed(
-              config.getTitle(), config.getTitleUrl(), description, config.getR(), config.getG(), config.getB());
-          }));
+          Optional.ofNullable(Sonar.get().getConfig().getWebhook().getDiscordWebhook())
+            .ifPresent(webhook -> webhook.post(() -> {
+              final SonarConfiguration.Webhook.Embed config = Sonar.get().getConfig().getWebhook().getEmbed();
+              final String description = config.getDescription()
+                .replace("%start-timestamp%", startTimestamp)
+                .replace("%end-timestamp%", endTimestamp)
+                .replace("%duration%", formattedDuration)
+                .replace("%peak-cpu%", peakCPU)
+                .replace("%peak-memory%", peakMem)
+                .replace("%peak-bps%", peakBPS)
+                .replace("%peak-cps%", peakCPS)
+                .replace("%total-blacklisted%", Sonar.DECIMAL_FORMAT.format(blacklisted))
+                .replace("%total-failed%", Sonar.DECIMAL_FORMAT.format(failed))
+                .replace("%total-success%", Sonar.DECIMAL_FORMAT.format(verified));
+              return new SonarConfiguration.Webhook.Embed(
+                config.getTitle(), config.getTitleUrl(), description, config.getR(), config.getG(), config.getB());
+            }));
         }
 
         // Reset the attack status

sonar-api/src/main/java/xyz/jonesdev/sonar/api/command/CommandInvocation.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/command/InvocationSource.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/command/SonarCommand.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -17,15 +17,17 @@
 
 package xyz.jonesdev.sonar.api.command;
 
+import com.github.benmanes.caffeine.cache.Cache;
+import com.github.benmanes.caffeine.cache.Caffeine;
+import net.kyori.adventure.audience.Audience;
 import net.kyori.adventure.text.Component;
 import net.kyori.adventure.text.minimessage.MiniMessage;
 import org.jetbrains.annotations.NotNull;
-import xyz.jonesdev.cappuccino.Cappuccino;
-import xyz.jonesdev.cappuccino.ExpiringCache;
 import xyz.jonesdev.sonar.api.Sonar;
 import xyz.jonesdev.sonar.api.command.subcommand.Subcommand;
 import xyz.jonesdev.sonar.api.command.subcommand.argument.Argument;
 
+import java.time.Duration;
 import java.util.*;
 import java.util.stream.Collectors;
 
@@ -36,7 +38,9 @@ public interface SonarCommand {
 
   Map<String, List<String>> ARG_TAB_SUGGESTIONS = new HashMap<>();
 
-  ExpiringCache<Object> DELAY = Cappuccino.buildExpiring(500L);
+  Cache<Audience, Long> COMMAND_DELAY = Caffeine.newBuilder()
+    .expireAfterWrite(Duration.ofMillis(500))
+    .build();
 
   List<Component> CACHED_HELP_MESSAGE = new ArrayList<>();
 
@@ -47,10 +51,11 @@ public interface SonarCommand {
         source.sendMessage(Sonar.get().getConfig().getNoPermission());
         return;
       }
-      // Checking if it contains will only break more since it can throw
-      // a NullPointerException if the cache is being accessed from parallel threads
-      DELAY.cleanUp(); // Clean up the cache
-      final long mapTimestamp = DELAY.asMap().getOrDefault(source, -1L);
+
+      COMMAND_DELAY.cleanUp(); // Clean up the cache
+
+      final long timestamp = System.currentTimeMillis();
+      final long mapTimestamp = COMMAND_DELAY.asMap().getOrDefault(source.getAudience(), -1L);
 
       // There were some exploits with spamming commands in the past.
       // Spamming should be prevented, especially if some heavy operations are done,
@@ -59,7 +64,6 @@ public interface SonarCommand {
         source.sendMessage(Sonar.get().getConfig().getCommands().getCommandCoolDown());
 
         // Format delay
-        final long timestamp = System.currentTimeMillis();
         final double left = 0.5D - (timestamp - mapTimestamp) / 1000D;
 
         source.sendMessage(Sonar.get().getConfig().getCommands().getCommandCoolDownLeft()
@@ -67,7 +71,7 @@ public interface SonarCommand {
         return;
       }
 
-      DELAY.put(source);
+      COMMAND_DELAY.put(source.getAudience(), timestamp);
     }
 
     if (args.length > 0) {

sonar-api/src/main/java/xyz/jonesdev/sonar/api/command/subcommand/Subcommand.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/command/subcommand/SubcommandInfo.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/command/subcommand/SubcommandRegistry.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/command/subcommand/argument/Argument.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/config/Language.java

@@ -0,0 +1,209 @@
+/*
+ * Copyright (C) 2024 Sonar Contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package xyz.jonesdev.sonar.api.config;
+
+import lombok.Getter;
+import org.jetbrains.annotations.NotNull;
+
+@Getter
+enum Language {
+  SYSTEM("system"),
+  AB("Abkhazian"),
+  AA("Afar"),
+  AF("Afrikaans"),
+  SQ("Albanian"),
+  AM("Amharic"),
+  AR("Arabic"),
+  AN("Aragonese"),
+  HY("Armenian"),
+  AS("Assamese"),
+  AE("Avestan"),
+  AY("Aymara"),
+  AZ("Azerbaijani"),
+  BA("Bashkir"),
+  EU("Basque"),
+  BE("Belarusian"),
+  BN("Bengali"),
+  BH("Bihari"),
+  BI("Bislama"),
+  BS("Bosnian"),
+  BR("Breton"),
+  BG("Bulgarian"),
+  MY("Burmese"),
+  CA("Catalan"),
+  CH("Chamorro"),
+  CE("Chechen"),
+  ZH("Chinese"),
+  CU("Slavic"),
+  CV("Chuvash"),
+  KW("Cornish"),
+  CO("Corsican"),
+  HR("Croatian"),
+  CS("Czech"),
+  DA("Danish"),
+  DV("Maldivian"),
+  NL("Dutch"),
+  DZ("Dzongkha"),
+  EN("English"),
+  EO("Esperanto"),
+  ET("Estonian"),
+  FO("Faroese"),
+  FJ("Fijian"),
+  FI("Finnish"),
+  FR("French"),
+  GD("Gaelic"),
+  GL("Galician"),
+  KA("Georgian"),
+  DE("German"),
+  EL("Greek"),
+  GN("Guarani"),
+  GU("Gujarati"),
+  HT("Haitian Creole"),
+  HA("Hausa"),
+  HE("Hebrew"),
+  HZ("Herero"),
+  HI("Hindi"),
+  HO("Hiri Motu"),
+  HU("Hungarian"),
+  IS("Icelandic"),
+  IO("Ido"),
+  ID("Indonesian"),
+  IE("Interlingue"),
+  IU("Inuktitut"),
+  IK("Inupiaq"),
+  GA("Irish"),
+  IT("Italian"),
+  JA("Japanese"),
+  JV("Javanese"),
+  KL("Kalaallisut"),
+  KN("Kannada"),
+  KS("Kashmiri"),
+  KK("Kazakh"),
+  KM("Khmer"),
+  KI("Kikuyu"),
+  RW("Kinyarwanda"),
+  KY("Kirghiz"),
+  KV("Komi"),
+  KO("Korean"),
+  KJ("Kwanyama"),
+  KU("Kurdish"),
+  LO("Lao"),
+  LA("Latin"),
+  LV("Latvian"),
+  LI("Limburgish"),
+  LN("Lingala"),
+  LT("Lithuanian"),
+  LB("Luxembourgish"),
+  MK("Macedonian"),
+  MG("Malagasy"),
+  MS("Malay"),
+  ML("Malayalam"),
+  MT("Maltese"),
+  GV("Manx"),
+  MI("Maori"),
+  MR("Marathi"),
+  MH("Marshallese"),
+  MO("Moldavian"),
+  MN("Mongolian"),
+  NA("Nauru"),
+  NV("Navajo"),
+  ND("Ndebele, North"),
+  NR("Ndebele, South"),
+  NG("Ndonga"),
+  NE("Nepali"),
+  SE("Northern Sami"),
+  NO("Norwegian"),
+  NB("Norwegian Bokmal"),
+  NN("Norwegian Nynorsk"),
+  NY("Chewa"),
+  OC("Occitan"),
+  OR("Oriya"),
+  OM("Oromo"),
+  OS("Ossetian"),
+  PI("Pali"),
+  PA("Panjabi"),
+  FA("Persian"),
+  PL("Polish"),
+  PT("Portuguese"),
+  PS("Pushto"),
+  QU("Quechua"),
+  RM("Raeto-Romance"),
+  RO("Romanian"),
+  RN("Rundi"),
+  RU("Russian"),
+  SM("Samoan"),
+  SG("Sango"),
+  SA("Sanskrit"),
+  SC("Sardinian"),
+  SR("Serbian"),
+  SN("Shona"),
+  II("Sichuan Yi"),
+  SD("Sindhi"),
+  SI("Sinhala"),
+  SK("Slovak"),
+  SL("Slovenian"),
+  SO("Somali"),
+  ST("Sotho, Southern"),
+  ES("Spanish"),
+  SU("Sundanese"),
+  SW("Swahili"),
+  SS("Swati"),
+  SV("Swedish"),
+  TL("Tagalog"),
+  TY("Tahitian"),
+  TG("Tajik"),
+  TA("Tamil"),
+  TT("Tatar"),
+  TE("Telugu"),
+  TH("Thai"),
+  BO("Tibetan"),
+  TI("Tigrinya"),
+  TO("Tonga"),
+  TS("Tsonga"),
+  TN("Tswana"),
+  TR("Turkish"),
+  TK("Turkmen"),
+  TW("Twi"),
+  UG("Uighur"),
+  UK("Ukrainian"),
+  UR("Urdu"),
+  UZ("Uzbek"),
+  VI("Vietnamese"),
+  VO("Volapuk"),
+  WA("Walloon"),
+  CY("Welsh"),
+  FY("Western Frisian"),
+  WO("Wolof"),
+  XH("Xhosa"),
+  YI("Yiddish"),
+  YO("Yoruba"),
+  ZA("Zhuang"),
+  ZU("Zulu");
+
+  private final String name;
+  private final String code;
+
+  Language(final String name) {
+    this.name = name;
+    this.code = name().toLowerCase();
+  }
+
+  public static Language fromCode(final @NotNull String code) {
+    return Language.valueOf(code.toUpperCase());
+  }
+}

sonar-api/src/main/java/xyz/jonesdev/sonar/api/config/SimpleYamlConfig.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -19,64 +19,69 @@ package xyz.jonesdev.sonar.api.config;
 
 import lombok.Getter;
 import org.jetbrains.annotations.NotNull;
-import org.simpleyaml.configuration.comments.format.YamlCommentFormat;
+import org.simpleyaml.configuration.MemorySection;
 import org.simpleyaml.configuration.file.YamlFile;
-import xyz.jonesdev.sonar.api.Sonar;
 
 import java.io.File;
-import java.io.IOException;
-import java.util.Arrays;
+import java.io.InputStream;
+import java.net.URL;
+import java.nio.file.Files;
+import java.nio.file.StandardCopyOption;
+import java.util.ArrayList;
 import java.util.List;
+import java.util.Map;
 
-import static xyz.jonesdev.sonar.api.Sonar.LINE_SEPARATOR;
+import static xyz.jonesdev.sonar.api.config.SonarConfiguration.LOGGER;
 
 @Getter
 public final class SimpleYamlConfig {
   private final File file;
   private final YamlFile yaml;
 
-  private static final List<String> HEADER = Arrays.asList(
-    "",
-    String.format("Running Sonar version %s on %s",
-      Sonar.get().getVersion(), Sonar.get().getPlatform().getDisplayName()),
-    "Need help or have questions? https://jonesdev.xyz/discord",
-    "https://github.com/jonesdevelopment/sonar",
-    ""
-  );
-
-  public SimpleYamlConfig(final File dataFolder, final String fileName) {
-    this(new File(dataFolder, fileName + ".yml"), dataFolder);
-  }
-
-  private SimpleYamlConfig(final File file, final @NotNull File folder) {
-    if (!folder.exists() && !folder.mkdir()) {
-      throw new IllegalStateException("Could not create folder?!");
-    }
-
+  public SimpleYamlConfig(final @NotNull File file) {
     this.file = file;
     this.yaml = new YamlFile(file.getPath());
   }
 
-  public void save() {
-    try {
-      yaml.save();
-    } catch (IOException exception) {
-      exception.printStackTrace(System.err);
+  private void replaceConfigFile(final @NotNull URL defaultData) throws Exception {
+    try (final InputStream inputStream = defaultData.openStream()) {
+      Files.copy(inputStream, file.toPath(), StandardCopyOption.REPLACE_EXISTING);
     }
   }
 
-  public void load() throws Exception {
-    // https://github.com/jonesdevelopment/sonar/issues/26
-    // Only load the configuration if the file already exists
-    if (yaml.exists()) {
-      yaml.loadWithComments();
-    } else {
-      yaml.createOrLoadWithComments();
+  public void load(final @NotNull URL defaultData) throws Exception {
+    final boolean exists = yaml.exists();
+
+    // Copy the configuration from the translations
+    if (!exists) {
+      replaceConfigFile(defaultData);
     }
 
-    // Always load the comment format and options
-    yaml.setCommentFormat(YamlCommentFormat.DEFAULT);
-    yaml.setHeader(String.join(LINE_SEPARATOR, HEADER));
+    // Load the configuration
+    yaml.loadWithComments();
+
+    // I hate my life... but this works... somehow
+    if (exists) {
+      // First, we store all values from the current (old) config
+      final Map<String, Object> values = yaml.getValues(true);
+      // Then, we replace the old config file with the default one
+      replaceConfigFile(defaultData);
+      // Re-load the configuration
+      yaml.loadWithComments();
+      // Loop through the new values from the new configuration
+      yaml.getValues(true).forEach((path, v) -> {
+        final Object value = values.get(path);
+        // Make sure we actually need to update the value
+        if (value != null && !value.equals(v)
+          && !(v instanceof MemorySection)
+          && !(value instanceof MemorySection)) {
+          // Set the old values to the new values
+          yaml.set(path, value);
+        }
+      });
+      // Save the yaml file to ensure we keep the original values
+      yaml.save();
+    }
   }
 
   public void set(final String path, final Object v) {
@@ -88,33 +93,81 @@ public final class SimpleYamlConfig {
     return yaml.getInt(path, def);
   }
 
+  public int getInt(final String path) {
+    if (!yaml.contains(path)) {
+      LOGGER.warn("Could not find {} in {}.", path, file.getName());
+      return 0;
+    }
+    return yaml.getInt(path);
+  }
+
   public boolean getBoolean(final String path, final boolean def) {
     yaml.addDefault(path, def);
     return yaml.getBoolean(path, def);
   }
 
+  public boolean getBoolean(final String path) {
+    if (!yaml.contains(path)) {
+      LOGGER.warn("Could not find {} in {}.", path, file.getName());
+      return false;
+    }
+    return yaml.getBoolean(path);
+  }
+
   public String getString(final String path, final String def) {
     final Object object = getObject(path, def);
     if (object instanceof String) {
       return (String) object;
     }
-    Sonar.get().getLogger().info("[config] Migrated {} to {}", path, def);
+    LOGGER.info("[config] Migrated {} to {}", path, def);
     set(path, def);
     return def;
   }
 
+  public @NotNull String getString(final String path) {
+    if (!yaml.contains(path)) {
+      LOGGER.warn("Could not find {} in {}.", path, file.getName());
+      return "";
+    }
+    final Object object = getObject(path);
+    if (object instanceof String) {
+      return (String) object;
+    }
+    throw new IllegalStateException("Invalid entry " + path);
+  }
+
   public Object getObject(final String path, final Object def) {
     yaml.addDefault(path, def);
     return yaml.get(path, def);
   }
 
+  public Object getObject(final String path) {
+    return yaml.get(path);
+  }
+
   public List<String> getStringList(final String path, final List<String> def) {
     yaml.addDefault(path, def);
     return yaml.getStringList(path);
   }
 
+  public List<String> getStringList(final String path) {
+    if (!yaml.contains(path)) {
+      LOGGER.warn("Could not find {} in {}.", path, file.getName());
+      return new ArrayList<>(0);
+    }
+    return yaml.getStringList(path);
+  }
+
   public List<Integer> getIntList(final String path, final List<Integer> def) {
     yaml.addDefault(path, def);
     return yaml.getIntegerList(path);
   }
+
+  public List<Integer> getIntList(final String path) {
+    if (!yaml.contains(path)) {
+      LOGGER.warn("Could not find {} in {}.", path, file.getName());
+      return new ArrayList<>(0);
+    }
+    return yaml.getIntegerList(path);
+  }
 }

sonar-api/src/main/java/xyz/jonesdev/sonar/api/controller/VerifiedPlayerController.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -19,6 +19,7 @@ package xyz.jonesdev.sonar.api.controller;
 
 import com.j256.ormlite.dao.Dao;
 import com.j256.ormlite.dao.DaoManager;
+import com.j256.ormlite.jdbc.JdbcSingleConnectionSource;
 import com.j256.ormlite.stmt.QueryBuilder;
 import com.j256.ormlite.support.ConnectionSource;
 import com.j256.ormlite.table.TableUtils;
@@ -28,12 +29,12 @@ import org.jetbrains.annotations.Nullable;
 import org.jetbrains.annotations.Range;
 import xyz.jonesdev.sonar.api.Sonar;
 import xyz.jonesdev.sonar.api.config.SonarConfiguration;
-import xyz.jonesdev.sonar.api.dependencies.DependencyLoader;
+import xyz.jonesdev.sonar.api.logger.LoggerWrapper;
 import xyz.jonesdev.sonar.api.model.VerifiedPlayer;
 
+import java.lang.reflect.Method;
 import java.net.InetAddress;
-import java.sql.SQLException;
-import java.sql.Timestamp;
+import java.sql.*;
 import java.time.Instant;
 import java.time.temporal.ChronoUnit;
 import java.util.*;
@@ -45,6 +46,24 @@ public final class VerifiedPlayerController {
   private static final Map<String, Collection<UUID>> MAP = new ConcurrentHashMap<>();
   private static final ExecutorService DB_UPDATE_SERVICE = Executors.newSingleThreadExecutor();
 
+  private static final LoggerWrapper LOGGER = new LoggerWrapper() {
+
+    @Override
+    public void info(final String message, final Object... args) {
+      Sonar.get().getLogger().info("[database] " + message, args);
+    }
+
+    @Override
+    public void warn(final String message, final Object... args) {
+      Sonar.get().getLogger().warn("[database] " + message, args);
+    }
+
+    @Override
+    public void error(final String message, final Object... args) {
+      Sonar.get().getLogger().error("[database] " + message, args);
+    }
+  };
+
   private @Nullable ConnectionSource connectionSource;
   private Dao<VerifiedPlayer, Integer> dao;
   private QueryBuilder<VerifiedPlayer, Integer> queryBuilder;
@@ -57,11 +76,11 @@ public final class VerifiedPlayerController {
 
     // Don't establish a database connection if the type is NONE
     if (cachedDatabaseType == SonarConfiguration.Database.Type.NONE) {
-      Sonar.get().getLogger().warn("Make sure to configure a database to save verified players.");
+      LOGGER.warn("Configure a database to save verified players.");
       return;
     }
 
-    try (final ConnectionSource connectionSource = DependencyLoader.setUpDriverAndConnect()) {
+    try (final ConnectionSource connectionSource = setupDriverAndConnect()) {
       this.connectionSource = connectionSource;
 
       // Create table
@@ -76,16 +95,89 @@ public final class VerifiedPlayerController {
       dao = DaoManager.createDao(connectionSource, VerifiedPlayer.class);
       queryBuilder = dao.queryBuilder();
 
-      // Make sure to clear all outdated entries first
-      clearOld(Sonar.get().getConfig().getDatabase().getMaximumAge());
-      // Add all entries from the database to the cache
-      dao.queryForAll().forEach(this::_add);
+      // Make sure to run the clean task and the caching task in the same thread
+      // https://github.com/jonesdevelopment/sonar/issues/150
+      DB_UPDATE_SERVICE.execute(() -> {
+        // Make sure to clear all outdated entries first
+        clearOld(Sonar.get().getConfig().getDatabase().getMaximumAge());
+        // Add all entries from the database to the cache
+        try {
+          dao.queryForAll().forEach(this::_add);
+        } catch (SQLException exception) {
+          LOGGER.error("Could not cache entries: {}", exception);
+        }
+      });
     } catch (Throwable throwable) {
-      Sonar.get().getLogger().error("Error setting up database connection: {}", throwable);
+      LOGGER.error("Error setting up database: {}", throwable);
       throwable.printStackTrace(System.err);
     }
   }
 
+  /**
+   * Automatically sets up the database connection using the configured credentials
+   */
+  private static @NotNull ConnectionSource setupDriverAndConnect() throws Throwable {
+    final SonarConfiguration.Database database = Sonar.get().getConfig().getDatabase();
+
+    // Prepare the JDBC connection string
+    // TODO: automatically build best connection string for database type
+    final String jdbcURL = String.format("jdbc:%s://%s:%d/%s",
+      database.getType().name().toLowerCase(), database.getHost(), database.getPort(), database.getName());
+
+    // Use reflection to uncover the driver class
+    final Class<?> driverClass = Class.forName(database.getType().getDriverClassName());
+
+    // Make sure we send the username and password
+    final Properties credentials = new Properties();
+    credentials.put("user", database.getUsername());
+    credentials.put("password", database.getPassword());
+
+    // Return new JDBC connection instance for our controller to handle
+    return new JdbcSingleConnectionSource(jdbcURL, invoke(jdbcURL, driverClass, credentials));
+  }
+
+  /**
+   * Uses reflection to load the database driver from the injected library
+   *
+   * @param connectionString URL of the database
+   * @param driverClass      Class of the database driver
+   * @param credentials      Credentials for the database
+   */
+  private static Connection invoke(final @NotNull String connectionString,
+                                   final @NotNull Class<?> driverClass,
+                                   final @NotNull Properties credentials) throws Throwable {
+    final Object driver = driverClass.getDeclaredConstructor().newInstance();
+    DriverManager.registerDriver((Driver) driver);
+    final Method connect = driverClass.getDeclaredMethod("connect", String.class, Properties.class);
+    connect.setAccessible(true);
+    return (Connection) connect.invoke(driver, connectionString, credentials);
+  }
+
+  /**
+   * Clear all old entries using the given timestamp.
+   */
+  private void clearOld(final @Range(from = 1, to = 365) int maximumAge) {
+    try {
+      final long timestamp = Instant.now()
+        .minus(maximumAge, ChronoUnit.DAYS)
+        .getEpochSecond() * 1000L; // convert to ms
+
+      final List<VerifiedPlayer> oldEntries = queryBuilder.where()
+        .lt("timestamp", new Timestamp(timestamp))
+        .query();
+
+      if (oldEntries != null) {
+        for (final VerifiedPlayer player : oldEntries) {
+          dao.delete(player);
+        }
+        LOGGER.info("Removed {} database entries older than {} days.",
+          oldEntries.size(), maximumAge);
+      }
+    } catch (SQLException exception) {
+      LOGGER.error("Error trying to clear old entries: {}", exception);
+    }
+  }
+
   /**
    * First, remove the player from the local cache and then,
    * secondly, asynchronously add the player to the database.
@@ -118,7 +210,7 @@ public final class VerifiedPlayerController {
           }
         }
       } catch (SQLException exception) {
-        Sonar.get().getLogger().error("Error trying to remove entry: {}", exception);
+        LOGGER.error("Error trying to remove entry: {}", exception);
       }
     });
   }
@@ -156,7 +248,7 @@ public final class VerifiedPlayerController {
       try {
         dao.create(player);
       } catch (SQLException exception) {
-        Sonar.get().getLogger().error("Error trying to add entry: {}", exception);
+        LOGGER.error("Error trying to add entry: {}", exception);
       }
     });
   }
@@ -200,48 +292,10 @@ public final class VerifiedPlayerController {
         dao.deleteBuilder().delete();
       }
     } catch (SQLException exception) {
-      Sonar.get().getLogger().error("Error trying to clear entries: {}", exception);
+      LOGGER.error("Error trying to clear entries: {}", exception);
     }
   }
 
-  /**
-   * Clear all old entries using the given timestamp.
-   */
-  public void clearOld(final @Range(from = 1, to = 365) int maximumAge) {
-    // Don't try to update the column if the database type is NONE
-    if (cachedDatabaseType == SonarConfiguration.Database.Type.NONE) {
-      return;
-    }
-
-    DB_UPDATE_SERVICE.execute(() -> {
-      // We cannot throw a NullPointerException within the executor service
-      // because we want to handle the error instead of simply throwing an exception
-      if (connectionSource == null) {
-        return;
-      }
-
-      try {
-        final long timestamp = Instant.now()
-          .minus(maximumAge, ChronoUnit.DAYS)
-          .getEpochSecond() * 1000L; // convert to ms
-
-        final List<VerifiedPlayer> oldEntries = queryBuilder.where()
-          .lt("timestamp", new Timestamp(timestamp))
-          .query();
-
-        if (oldEntries != null) {
-          for (final VerifiedPlayer player : oldEntries) {
-            dao.delete(player);
-          }
-          Sonar.get().getLogger().info("Removed {} database entries older than {} days.",
-            oldEntries.size(), maximumAge);
-        }
-      } catch (SQLException exception) {
-        Sonar.get().getLogger().error("Error trying to clear old entries: {}", exception);
-      }
-    });
-  }
-
   /**
    * @param inetAddress IP address
    * @param uuid        UUID associated to the IP

sonar-api/src/main/java/xyz/jonesdev/sonar/api/dependencies/Dependency.java

@@ -1,90 +0,0 @@
-/*
- * Copyright (C) 2023 Sonar Contributors
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-package xyz.jonesdev.sonar.api.dependencies;
-
-import org.jetbrains.annotations.NotNull;
-import xyz.jonesdev.sonar.api.Sonar;
-import xyz.jonesdev.sonar.api.timer.SystemTimer;
-
-import java.io.File;
-import java.io.IOException;
-import java.io.InputStream;
-import java.net.MalformedURLException;
-import java.net.URL;
-import java.nio.file.Files;
-import java.nio.file.Path;
-
-import static java.nio.file.StandardCopyOption.REPLACE_EXISTING;
-
-// Mostly taken from
-// https://github.com/Elytrium/LimboAuth/blob/master/src/main/java/net/elytrium/limboauth/dependencies/BaseLibrary.java
-public enum Dependency {
-  // https://mvnrepository.com/artifact/com.mysql/mysql-connector-j
-  MYSQL(
-    "com/mysql",
-    "mysql-connector-j",
-    "8.2.0"
-  ),
-  // TODO: MariaDB still seems to have some issues; investigate!
-  // https://mvnrepository.com/artifact/org.mariadb.jdbc/mariadb-java-client
-  MARIADB(
-    "org/mariadb/jdbc",
-    "mariadb-java-client",
-    "3.1.4"
-  );
-
-  private final Path tempFilePath;
-  private final URL mvnRepoURL;
-
-  Dependency(final @NotNull String groupId,
-             final @NotNull String artifactId,
-             final @NotNull String version) {
-    final String archiveFileName = String.format("%s-%s.jar", artifactId, version);
-    this.tempFilePath = new File(Sonar.get().getDataDirectory(), "libraries/" + archiveFileName).toPath();
-
-    try {
-      final String mvnCentralPath = String.format("%s/%s/%s/%s-%s.jar",
-        groupId, artifactId, version, artifactId, version);
-
-      this.mvnRepoURL = new URL("https://repo1.maven.org/maven2/" + mvnCentralPath);
-    } catch (MalformedURLException exception) {
-      throw new IllegalStateException(exception);
-    }
-  }
-
-  /**
-   * @return URL for the local file used for the external URLClassLoader
-   */
-  public @NotNull URL getClassLoaderURL() throws MalformedURLException {
-    if (!Files.exists(tempFilePath)) {
-      final SystemTimer timer = new SystemTimer();
-      Sonar.get().getLogger().info("Downloading dependency {}...", tempFilePath.getFileName());
-
-      try (final InputStream inputStream = mvnRepoURL.openStream()) {
-        Files.createDirectories(tempFilePath.getParent());
-        Files.copy(inputStream, Files.createFile(tempFilePath), REPLACE_EXISTING);
-      } catch (IOException exception) {
-        throw new IllegalStateException(exception);
-      }
-
-      Sonar.get().getLogger().info("Finished downloading {} ({}s)!", tempFilePath.getFileName(), timer);
-    }
-
-    return tempFilePath.toUri().toURL();
-  }
-}

sonar-api/src/main/java/xyz/jonesdev/sonar/api/dependencies/DependencyLoader.java

@@ -1,81 +0,0 @@
-/*
- * Copyright (C) 2023 Sonar Contributors
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-package xyz.jonesdev.sonar.api.dependencies;
-
-import com.j256.ormlite.jdbc.JdbcSingleConnectionSource;
-import com.j256.ormlite.support.ConnectionSource;
-import lombok.experimental.UtilityClass;
-import org.jetbrains.annotations.NotNull;
-import xyz.jonesdev.sonar.api.Sonar;
-import xyz.jonesdev.sonar.api.SonarPlatform;
-import xyz.jonesdev.sonar.api.config.SonarConfiguration;
-
-import java.io.File;
-import java.lang.reflect.Method;
-import java.net.URL;
-import java.nio.file.Path;
-import java.sql.Connection;
-import java.sql.Driver;
-import java.sql.DriverManager;
-import java.util.Properties;
-
-@UtilityClass
-public class DependencyLoader {
-  public ConnectionSource setUpDriverAndConnect() throws Throwable {
-    final SonarConfiguration.Database database = Sonar.get().getConfig().getDatabase();
-
-    final ClassLoader currentClassLoader = DependencyLoader.class.getClassLoader();
-    ClassLoader classLoader = currentClassLoader;
-
-    // Velocity doesn't include the JDBC driver, which is why we need to load it manually
-    if (Sonar.get().getPlatform() == SonarPlatform.VELOCITY) {
-      final URL url = database.getType().getDependency().getClassLoaderURL();
-
-      final Method addPath = currentClassLoader.getClass().getDeclaredMethod("addPath", Path.class);
-      addPath.setAccessible(true);
-      addPath.invoke(currentClassLoader, new File(url.toURI()).toPath());
-
-      classLoader = new ExternalClassLoader(new URL[]{url});
-    }
-
-    final String jdbcURL = String.format("jdbc:%s://%s:%d/%s",
-      database.getType().name().toLowerCase(), database.getUrl(), database.getPort(), database.getName());
-
-    final Connection connection = connect(classLoader, jdbcURL, database);
-    return new JdbcSingleConnectionSource(jdbcURL, connection);
-  }
-
-  // Mostly taken from
-  // https://github.com/Elytrium/LimboAuth/blob/master/src/main/java/net/elytrium/limboauth/dependencies/DatabaseLibrary.java#L137
-  private Connection connect(final @NotNull ClassLoader classLoader,
-                             final @NotNull String databaseURL,
-                             final @NotNull SonarConfiguration.Database database) throws Throwable {
-    final Class<?> driverClass = classLoader.loadClass(database.getType().getDriverClassName());
-    final Object driver = driverClass.getDeclaredConstructor().newInstance();
-
-    DriverManager.registerDriver((Driver) driver);
-
-    final Properties properties = new Properties();
-    properties.put("user", database.getUsername());
-    properties.put("password", database.getPassword());
-
-    final Method connect = driverClass.getDeclaredMethod("connect", String.class, Properties.class);
-    connect.setAccessible(true);
-    return (Connection) connect.invoke(driver, databaseURL, properties);
-  }
-}

sonar-api/src/main/java/xyz/jonesdev/sonar/api/dependencies/ExternalClassLoader.java

@@ -1,38 +0,0 @@
-/*
- * Copyright (C) 2023 Sonar Contributors
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-package xyz.jonesdev.sonar.api.dependencies;
-
-import java.net.URL;
-import java.net.URLClassLoader;
-
-final class ExternalClassLoader extends URLClassLoader {
-
-  /**
-   * Create a URLClassLoader with the system ClassLoader as parent
-   *
-   * @param url URL for of the local file
-   */
-  public ExternalClassLoader(final URL[] url) {
-    super(url, ClassLoader.getSystemClassLoader().getParent());
-  }
-
-  // Register this URLClassLoader as parallel capable
-  static {
-    ClassLoader.registerAsParallelCapable();
-  }
-}

sonar-api/src/main/java/xyz/jonesdev/sonar/api/event/SonarEvent.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/event/SonarEventListener.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/event/SonarEventManager.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/event/impl/AttackDetectedEvent.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/event/impl/AttackMitigatedEvent.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/event/impl/UserBlacklistedEvent.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -31,5 +31,5 @@ import xyz.jonesdev.sonar.api.fallback.FallbackUser;
 @RequiredArgsConstructor
 public final class UserBlacklistedEvent implements SonarEvent {
   @ApiStatus.Experimental
-  private final FallbackUser<?, ?> user;
+  private final FallbackUser user;
 }

sonar-api/src/main/java/xyz/jonesdev/sonar/api/event/impl/UserVerifyFailedEvent.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -30,11 +30,11 @@ import java.util.Optional;
 @ToString
 @EqualsAndHashCode
 public final class UserVerifyFailedEvent implements SonarEvent {
-  private final FallbackUser<?, ?> user;
+  private final FallbackUser user;
   @SuppressWarnings("OptionalUsedAsFieldOrParameterType")
   private final Optional<String> reason;
 
-  public UserVerifyFailedEvent(final FallbackUser<?, ?> user, final @Nullable String reason) {
+  public UserVerifyFailedEvent(final FallbackUser user, final @Nullable String reason) {
     this.user = user;
     this.reason = Optional.ofNullable(reason);
   }

sonar-api/src/main/java/xyz/jonesdev/sonar/api/event/impl/UserVerifyJoinEvent.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -30,5 +30,5 @@ import xyz.jonesdev.sonar.api.fallback.FallbackUser;
 @RequiredArgsConstructor
 public final class UserVerifyJoinEvent implements SonarEvent {
   private final String username;
-  private final FallbackUser<?, ?> user;
+  private final FallbackUser user;
 }

sonar-api/src/main/java/xyz/jonesdev/sonar/api/event/impl/UserVerifySuccessEvent.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -33,6 +33,6 @@ import java.util.UUID;
 public final class UserVerifySuccessEvent implements SonarEvent {
   private final String username;
   private final UUID offlineUuid;
-  private final FallbackUser<?, ?> user;
+  private final FallbackUser user;
   private final long timeTakenToVerify;
 }

sonar-api/src/main/java/xyz/jonesdev/sonar/api/fallback/Fallback.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -17,12 +17,12 @@
 
 package xyz.jonesdev.sonar.api.fallback;
 
+import com.github.benmanes.caffeine.cache.Cache;
 import lombok.AccessLevel;
 import lombok.Getter;
 import lombok.NoArgsConstructor;
+import lombok.Setter;
 import org.jetbrains.annotations.NotNull;
-import xyz.jonesdev.cappuccino.Cappuccino;
-import xyz.jonesdev.cappuccino.ExpiringCache;
 import xyz.jonesdev.sonar.api.Sonar;
 import xyz.jonesdev.sonar.api.config.SonarConfiguration;
 import xyz.jonesdev.sonar.api.logger.LoggerWrapper;
@@ -31,7 +31,6 @@ import java.net.InetAddress;
 import java.util.Map;
 import java.util.Objects;
 import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.TimeUnit;
 
 @Getter
 @NoArgsConstructor(access = AccessLevel.PRIVATE)
@@ -39,10 +38,14 @@ public final class Fallback {
   public static final Fallback INSTANCE = new Fallback();
   private static final @NotNull Sonar SONAR = Objects.requireNonNull(Sonar.get());
 
+  // Map of all connected usernames and their respective IP addresses (used for fast checking)
   private final Map<String, InetAddress> connected = new ConcurrentHashMap<>(64, 0.75f);
-  // Only block the player for a few minutes to avoid issues
-  private final ExpiringCache<InetAddress> blacklisted = Cappuccino.buildExpiring(
-    10L, TimeUnit.MINUTES, 5000L);
+  // Cache of all blacklisted IP addresses to ensure each entry can expire after the given time
+  @Setter
+  private Cache<InetAddress, Byte> blacklist;
+  @Setter
+  private long blacklistTime;
+
   private final @NotNull FallbackQueue queue = FallbackQueue.INSTANCE;
   private final @NotNull FallbackRatelimiter ratelimiter = FallbackRatelimiter.INSTANCE;
 

sonar-api/src/main/java/xyz/jonesdev/sonar/api/fallback/FallbackPipelines.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -21,6 +21,5 @@ public interface FallbackPipelines {
   String FALLBACK_HANDLER = "sonar-fallback-handler";
   String FALLBACK_PACKET_ENCODER = "sonar-fallback-encoder";
   String FALLBACK_PACKET_DECODER = "sonar-fallback-decoder";
-  String FALLBACK_IN_TRAFFIC = "sonar-traffic-in";
-  String FALLBACK_OUT_TRAFFIC = "sonar-traffic-out";
+  String FALLBACK_BANDWIDTH = "sonar-fallback-bandwidth";
 }

sonar-api/src/main/java/xyz/jonesdev/sonar/api/fallback/FallbackQueue.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -30,26 +30,11 @@ import java.util.concurrent.ConcurrentHashMap;
 @Getter
 @RequiredArgsConstructor(access = AccessLevel.PRIVATE)
 public final class FallbackQueue {
-  public static final FallbackQueue INSTANCE = new FallbackQueue();
-  private final Map<InetAddress, Runnable> queuedPlayers = new ConcurrentHashMap<>(16, 0.5f);
+  static final FallbackQueue INSTANCE = new FallbackQueue();
+  private final Map<InetAddress, Runnable> queuedPlayers = new ConcurrentHashMap<>(64);
 
-  /**
-   * @param inetAddress IP address of the player
-   * @param runnable    Queued action on the netty thread
-   * @see #remove
-   */
-  public void queue(final InetAddress inetAddress, final Runnable runnable) {
-    queuedPlayers.put(inetAddress, runnable);
-  }
-
-  /**
-   * @param inetAddress IP address of the player
-   */
-  public void remove(final InetAddress inetAddress) {
-    queuedPlayers.remove(inetAddress);
-  }
-
-  public void poll() {
+  // Runnable task executed for polling the queue
+  private final Runnable pollTask = () -> {
     final int maxQueuePolls = Sonar.get().getConfig().getQueue().getMaxQueuePolls();
     int index = 0;
 
@@ -71,5 +56,21 @@ public final class FallbackQueue {
     Sonar.get().getAttackTracker().checkIfUnderAttack();
     // Clean up the cache of rate-limited IPs
     Sonar.get().getFallback().getRatelimiter().cleanUpCache();
+  };
+
+  /**
+   * @param inetAddress IP address of the player
+   * @param runnable    Queued action on the netty thread
+   * @see #remove
+   */
+  public void queue(final InetAddress inetAddress, final Runnable runnable) {
+    queuedPlayers.put(inetAddress, runnable);
+  }
+
+  /**
+   * @param inetAddress IP address of the player
+   */
+  public void remove(final InetAddress inetAddress) {
+    queuedPlayers.remove(inetAddress);
   }
 }

sonar-api/src/main/java/xyz/jonesdev/sonar/api/fallback/FallbackRatelimiter.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -17,19 +17,19 @@
 
 package xyz.jonesdev.sonar.api.fallback;
 
+import com.github.benmanes.caffeine.cache.Cache;
 import lombok.AccessLevel;
 import lombok.NoArgsConstructor;
 import lombok.Setter;
 import org.jetbrains.annotations.NotNull;
-import xyz.jonesdev.cappuccino.ExpiringCache;
 
 import java.net.InetAddress;
 
+@Setter
 @NoArgsConstructor(access = AccessLevel.PRIVATE)
 public final class FallbackRatelimiter {
-  public static final FallbackRatelimiter INSTANCE = new FallbackRatelimiter();
-  @Setter
-  private ExpiringCache<InetAddress> expiringCache;
+  static final FallbackRatelimiter INSTANCE = new FallbackRatelimiter();
+  private Cache<InetAddress, Byte> expiringCache;
 
   /**
    * We don't want to clean up the cache in the
@@ -37,7 +37,7 @@ public final class FallbackRatelimiter {
    * it would take up too many resources.
    */
   public void cleanUpCache() {
-    expiringCache.cleanUp(false);
+    expiringCache.cleanUp();
   }
 
   /**
@@ -49,9 +49,9 @@ public final class FallbackRatelimiter {
   @SuppressWarnings("BooleanMethodIsAlwaysInverted")
   public boolean attempt(final @NotNull InetAddress inetAddress) {
     // Cache the IP address if it's not already cached
-    if (!expiringCache.has(inetAddress)) {
+    if (!expiringCache.asMap().containsKey(inetAddress)) {
       // Cache the IP address
-      expiringCache.put(inetAddress);
+      expiringCache.put(inetAddress, (byte) 0);
       return true;
     }
     // Deny the connection attempt

sonar-api/src/main/java/xyz/jonesdev/sonar/api/fallback/FallbackUser.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -17,13 +17,13 @@
 
 package xyz.jonesdev.sonar.api.fallback;
 
+import com.github.benmanes.caffeine.cache.Cache;
+import com.github.benmanes.caffeine.cache.Caffeine;
 import io.netty.channel.Channel;
-import io.netty.channel.ChannelPipeline;
+import io.netty.util.ReferenceCountUtil;
 import net.kyori.adventure.text.Component;
 import org.jetbrains.annotations.NotNull;
 import org.jetbrains.annotations.Nullable;
-import xyz.jonesdev.cappuccino.Cappuccino;
-import xyz.jonesdev.cappuccino.ExpiringCache;
 import xyz.jonesdev.sonar.api.Sonar;
 import xyz.jonesdev.sonar.api.event.impl.UserBlacklistedEvent;
 import xyz.jonesdev.sonar.api.event.impl.UserVerifyFailedEvent;
@@ -31,34 +31,17 @@ import xyz.jonesdev.sonar.api.fallback.protocol.ProtocolVersion;
 import xyz.jonesdev.sonar.api.statistics.Statistics;
 
 import java.net.InetAddress;
-import java.util.concurrent.TimeUnit;
-
-public interface FallbackUser<X, Y> {
-  @NotNull Fallback getFallback();
-
-  @NotNull X getPlayer();
-
-  @NotNull Y getConnection();
+import java.time.Duration;
+import java.util.Objects;
+import java.util.UUID;
 
+public interface FallbackUser {
   @NotNull Channel getChannel();
 
-  @NotNull ChannelPipeline getPipeline();
-
   @NotNull InetAddress getInetAddress();
 
   @NotNull ProtocolVersion getProtocolVersion();
 
-  /**
-   * Kicks the player from the server with
-   * the given disconnect message.
-   *
-   * @param reason Legacy disconnect message string
-   * @see #disconnect(Component)
-   */
-  default void disconnect(final @NotNull String reason) {
-    disconnect(Component.text(reason));
-  }
-
   /**
    * Kicks the player from the server with
    * the given disconnect message.
@@ -67,20 +50,78 @@ public interface FallbackUser<X, Y> {
    */
   void disconnect(final @NotNull Component reason);
 
+  /**
+   * Takes over the channel and begins the verification process
+   *
+   * @param username Username of the player
+   * @param uuid     UUID of the player
+   * @param encoder  Name of the encoder pipeline
+   * @param decoder  Name of the decoder pipeline
+   * @param timeout  Name of the read timeout pipeline
+   * @param boss     Name of the main pipeline
+   */
+  void hijack(final @NotNull String username, final @NotNull UUID uuid,
+              final @NotNull String encoder, final @NotNull String decoder,
+              final @NotNull String timeout, final @NotNull String boss);
+
   /**
    * Sends a packet/message to the player
    *
    * @param msg Message to send to the player
    */
-  void write(final @NotNull Object msg);
+  default void write(final @NotNull Object msg) {
+    if (getChannel().isActive()) {
+      getChannel().writeAndFlush(msg, getChannel().voidPromise());
+    } else {
+      ReferenceCountUtil.release(msg);
+    }
+  }
 
   /**
    * Queues a buffered message that will be
    * sent once all messages are flushed.
    */
-  void delayedWrite(final @NotNull Object msg);
+  default void delayedWrite(final @NotNull Object msg) {
+    if (getChannel().isActive()) {
+      getChannel().write(msg, getChannel().voidPromise());
+    } else {
+      ReferenceCountUtil.release(msg);
+    }
+  }
 
-  ExpiringCache<String> PREVIOUS_FAILS = Cappuccino.buildExpiring(3L, TimeUnit.MINUTES);
+  Cache<InetAddress, Integer> GLOBAL_FAIL_COUNT = Caffeine.newBuilder()
+    .expireAfterWrite(Duration.ofMinutes(5)) // expire after 5 minutes
+    .build();
+
+  /**
+   * Increments the number of times this user (by IP address) has failed the verification
+   */
+  default void incrementFails() {
+    final InetAddress inetAddress = Objects.requireNonNull(getInetAddress());
+    final int failCount = getFailedCount();
+    // Make sure to remove the old values from the cache
+    if (failCount > 0) {
+      GLOBAL_FAIL_COUNT.invalidate(inetAddress);
+    }
+    GLOBAL_FAIL_COUNT.put(inetAddress, failCount + 1);
+  }
+
+  /**
+   * @return The number of times this user (by IP address) has failed the verification
+   * @apiNote Returns 0 if no key/value is present in the cache
+   */
+  default int getFailedCount() {
+    // Make sure to clean up the cache before we try to get cached values
+    GLOBAL_FAIL_COUNT.cleanUp();
+    return GLOBAL_FAIL_COUNT.asMap().getOrDefault(Objects.requireNonNull(getInetAddress()), 0);
+  }
+
+  /**
+   * Removes all previously failed verifications
+   */
+  default void invalidateFails() {
+    GLOBAL_FAIL_COUNT.invalidate(Objects.requireNonNull(getInetAddress()));
+  }
 
   /**
    * Disconnects the player who failed the verification
@@ -95,10 +136,15 @@ public interface FallbackUser<X, Y> {
       disconnect(Sonar.get().getConfig().getVerification().getVerificationFailed());
 
       if (reason != null) {
-        getFallback().getLogger().info(Sonar.get().getConfig().getVerification().getFailedLog()
-          .replace("%ip%", Sonar.get().getConfig().formatAddress(getInetAddress()))
-          .replace("%protocol%", String.valueOf(getProtocolVersion().getProtocol()))
-          .replace("%reason%", reason));
+        // Only log the failed message if the server isn't under attack.
+        // We let the user override this through the configuration.
+        if (!Sonar.get().getAttackTracker().isCurrentlyUnderAttack()
+          || Sonar.get().getConfig().getVerification().isLogDuringAttack()) {
+          Sonar.get().getFallback().getLogger().info(Sonar.get().getConfig().getVerification().getFailedLog()
+            .replace("%ip%", Sonar.get().getConfig().formatAddress(getInetAddress()))
+            .replace("%protocol%", String.valueOf(getProtocolVersion().getProtocol()))
+            .replace("%reason%", reason));
+        }
       }
     }
 
@@ -107,21 +153,32 @@ public interface FallbackUser<X, Y> {
     // Call the VerifyFailedEvent for external API usage
     Sonar.get().getEventManager().publish(new UserVerifyFailedEvent(this, reason));
 
-    // Make sure old entries are removed
-    PREVIOUS_FAILS.cleanUp();
+    // Use a label, so we can easily add more code beneath this method
+    blacklist: {
+      // Check if the player has too many failed attempts
+      final int blacklistThreshold = Sonar.get().getConfig().getVerification().getBlacklistThreshold();
+      // The user is allowed to disable the blacklist entirely by setting the threshold to 0
+      if (blacklistThreshold <= 0) break blacklist;
 
-    // Check if the player has too many failed attempts
-    if (PREVIOUS_FAILS.has(getInetAddress().toString())) {
-      // Call the BotBlacklistedEvent for external API usage
-      Sonar.get().getEventManager().publish(new UserBlacklistedEvent(this));
+      // Add 1 to the amount of fails since we haven't updated the cached entries yet (for performance)
+      final int failCount = getFailedCount() + 1;
+      // Now we simply need to check if the threshold is reached
+      if (failCount >= blacklistThreshold) {
+        // Call the BotBlacklistedEvent for external API usage
+        Sonar.get().getEventManager().publish(new UserBlacklistedEvent(this));
 
-      getFallback().getBlacklisted().put(getInetAddress());
-      getFallback().getLogger().info(Sonar.get().getConfig().getVerification().getBlacklistLog()
-        .replace("%ip%", Sonar.get().getConfig().formatAddress(getInetAddress()))
-        .replace("%protocol%", String.valueOf(getProtocolVersion().getProtocol())));
-    } else {
-      // Cache the InetAddress for 3 minutes
-      PREVIOUS_FAILS.put(getInetAddress().toString());
+        Sonar.get().getFallback().getBlacklist().put(getInetAddress(), (byte) 0);
+        Sonar.get().getFallback().getLogger().info(Sonar.get().getConfig().getVerification().getBlacklistLog()
+          .replace("%ip%", Sonar.get().getConfig().formatAddress(getInetAddress()))
+          .replace("%protocol%", String.valueOf(getProtocolVersion().getProtocol())));
+
+        // Invalidate the cached entry to ensure memory safety
+        invalidateFails();
+        break blacklist;
+      }
+
+      // Make sure we increment the number of fails
+      incrementFails();
     }
   }
 }

sonar-api/src/main/java/xyz/jonesdev/sonar/api/fallback/protocol/ProtocolVersion.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/logger/LoggerWrapper.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/model/VerifiedPlayer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/profiler/JVMProfiler.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/statistics/Bandwidth.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -15,7 +15,7 @@
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
-package xyz.jonesdev.sonar.api.fallback.traffic;
+package xyz.jonesdev.sonar.api.statistics;
 
 import lombok.Getter;
 import lombok.Setter;
@@ -25,7 +25,7 @@ import xyz.jonesdev.sonar.api.profiler.JVMProfiler;
  * This counts all incoming and outgoing traffic.
  */
 @Getter
-public enum TrafficCounter implements JVMProfiler {
+public enum Bandwidth implements JVMProfiler {
   INCOMING,
   OUTGOING;
 
@@ -48,7 +48,7 @@ public enum TrafficCounter implements JVMProfiler {
    * This method is called every second.
    */
   public static synchronized void reset() {
-    for (final TrafficCounter value : values()) {
+    for (final Bandwidth value : values()) {
       value.cacheAndReset();
     }
   }

sonar-api/src/main/java/xyz/jonesdev/sonar/api/statistics/Counters.java

@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2023-2024 Sonar Contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package xyz.jonesdev.sonar.api.statistics;
+
+import com.github.benmanes.caffeine.cache.Cache;
+import com.github.benmanes.caffeine.cache.Caffeine;
+import org.jetbrains.annotations.ApiStatus;
+
+import java.time.Duration;
+
+@SuppressWarnings("unused")
+public interface Counters {
+  @ApiStatus.Internal
+  Cache<Long, Byte> LOGINS_PER_SECOND = Caffeine.newBuilder()
+    .expireAfterWrite(Duration.ofSeconds(1))
+    .build();
+
+  @ApiStatus.Internal
+  Cache<Long, Byte> CONNECTIONS_PER_SECOND = Caffeine.newBuilder()
+    .expireAfterWrite(Duration.ofSeconds(1))
+    .build();
+
+  static long getConnectionsPerSecond() {
+    return CONNECTIONS_PER_SECOND.estimatedSize();
+  }
+
+  static long getLoginsPerSecond() {
+    return LOGINS_PER_SECOND.estimatedSize();
+  }
+}

sonar-api/src/main/java/xyz/jonesdev/sonar/api/statistics/Statistics.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/timer/SystemTimer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-api/src/main/java/xyz/jonesdev/sonar/api/verbose/Notification.java

@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2024 Sonar Contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package xyz.jonesdev.sonar.api.verbose;
+
+import lombok.Getter;
+import net.kyori.adventure.audience.Audience;
+import net.kyori.adventure.text.Component;
+import net.kyori.adventure.text.minimessage.MiniMessage;
+import net.kyori.adventure.title.Title;
+import org.jetbrains.annotations.NotNull;
+import xyz.jonesdev.sonar.api.Sonar;
+import xyz.jonesdev.sonar.api.statistics.Counters;
+import xyz.jonesdev.sonar.api.statistics.Statistics;
+
+import java.util.Collection;
+import java.util.Vector;
+
+import static xyz.jonesdev.sonar.api.Sonar.DECIMAL_FORMAT;
+import static xyz.jonesdev.sonar.api.statistics.Bandwidth.INCOMING;
+import static xyz.jonesdev.sonar.api.statistics.Bandwidth.OUTGOING;
+
+@Getter
+public final class Notification implements Observable, Counters {
+  private final @NotNull Collection<String> subscribers = new Vector<>(0);
+
+  public void sendAttackNotification() {
+    // No need to do anything if we have no subscribers
+    if (subscribers.isEmpty()) {
+      return;
+    }
+    // Prepare the title
+    // TODO: Why do custom title times not work?
+    //  Title.Times.times(Ticks.duration(5L), Ticks.duration(60L), Ticks.duration(10L));
+    final Title title = Title.title(
+      Sonar.get().getConfig().getNotifications().getNotificationTitle(),
+      Sonar.get().getConfig().getNotifications().getNotificationSubtitle());
+    // Prepare the chat message
+    final Component chat = MiniMessage.miniMessage().deserialize(
+      Sonar.get().getConfig().getNotifications().getNotificationChat()
+      .replace("%queued%",
+        DECIMAL_FORMAT.format(Sonar.get().getFallback().getQueue().getQueuedPlayers().size()))
+      .replace("%verifying%", DECIMAL_FORMAT.format(Sonar.get().getFallback().getConnected().size()))
+      .replace("%blacklisted%",
+        DECIMAL_FORMAT.format(Sonar.get().getFallback().getBlacklist().estimatedSize()))
+      .replace("%total-joins%", DECIMAL_FORMAT.format(Statistics.TOTAL_TRAFFIC.get()))
+      .replace("%logins-per-second%", DECIMAL_FORMAT.format(LOGINS_PER_SECOND.estimatedSize()))
+      .replace("%connections-per-second%", DECIMAL_FORMAT.format(CONNECTIONS_PER_SECOND.estimatedSize()))
+      .replace("%verify-total%", DECIMAL_FORMAT.format(Statistics.REAL_TRAFFIC.get()))
+      .replace("%verify-success%",
+        DECIMAL_FORMAT.format(Sonar.get().getVerifiedPlayerController().estimatedSize()))
+      .replace("%verify-failed%", DECIMAL_FORMAT.format(Statistics.FAILED_VERIFICATIONS.get()))
+      .replace("%incoming-traffic%", INCOMING.getCachedSecond())
+      .replace("%outgoing-traffic%", OUTGOING.getCachedSecond())
+      .replace("%incoming-traffic-ttl%", INCOMING.getCachedTtl())
+      .replace("%outgoing-traffic-ttl%", OUTGOING.getCachedTtl()));
+    // Send the title and chat messages to all online players
+    for (final String subscriber : Sonar.get().getNotificationHandler().getSubscribers()) {
+      final Audience audience = Sonar.AUDIENCES.get(subscriber);
+      if (audience == null) continue;
+      audience.showTitle(title);
+      audience.sendMessage(chat);
+    }
+  }
+}

sonar-api/src/main/java/xyz/jonesdev/sonar/api/verbose/Observable.java

@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2024 Sonar Contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package xyz.jonesdev.sonar.api.verbose;
+
+import org.jetbrains.annotations.NotNull;
+
+import java.util.Collection;
+
+public interface Observable {
+  Collection<String> getSubscribers();
+
+  /**
+   * @param name Name of the audience
+   * @return Whether the audience is subscribed or not
+   */
+  default boolean isSubscribed(final @NotNull String name) {
+    return getSubscribers().contains(name);
+  }
+
+  /**
+   * @param name Name of the audience to subscribe
+   */
+  default void subscribe(final String name) {
+    getSubscribers().add(name);
+  }
+
+  /**
+   * @param name Name of the audience to unsubscribe
+   */
+  default void unsubscribe(final String name) {
+    getSubscribers().remove(name);
+  }
+}

sonar-api/src/main/java/xyz/jonesdev/sonar/api/verbose/Verbose.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -23,36 +23,32 @@ import net.kyori.adventure.audience.Audience;
 import net.kyori.adventure.text.Component;
 import net.kyori.adventure.text.minimessage.MiniMessage;
 import org.jetbrains.annotations.NotNull;
-import xyz.jonesdev.cappuccino.Cappuccino;
-import xyz.jonesdev.cappuccino.ExpiringCache;
 import xyz.jonesdev.sonar.api.Sonar;
 import xyz.jonesdev.sonar.api.attack.AttackTracker;
 import xyz.jonesdev.sonar.api.profiler.JVMProfiler;
+import xyz.jonesdev.sonar.api.statistics.Counters;
 import xyz.jonesdev.sonar.api.statistics.Statistics;
 import xyz.jonesdev.sonar.api.timer.SystemTimer;
 
 import java.util.Collection;
-import java.util.Map;
 import java.util.Vector;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.TimeUnit;
 
 import static xyz.jonesdev.sonar.api.Sonar.DECIMAL_FORMAT;
-import static xyz.jonesdev.sonar.api.fallback.traffic.TrafficCounter.INCOMING;
-import static xyz.jonesdev.sonar.api.fallback.traffic.TrafficCounter.OUTGOING;
+import static xyz.jonesdev.sonar.api.statistics.Bandwidth.INCOMING;
+import static xyz.jonesdev.sonar.api.statistics.Bandwidth.OUTGOING;
 
 @Getter
-public final class Verbose implements JVMProfiler {
+public final class Verbose implements Observable, JVMProfiler, Counters {
   private final @NotNull Collection<String> subscribers = new Vector<>(0);
-  private final @NotNull Map<String, Audience> audiences = new ConcurrentHashMap<>();
   private int animationIndex;
-  private final ExpiringCache<Long> loginsPerSecond = Cappuccino.buildExpiring(1L, TimeUnit.SECONDS);
 
   // Run action bar verbose
   public void update() {
     // Clean up all blacklisted IPs
-    Sonar.get().getFallback().getBlacklisted().cleanUp(false);
-    loginsPerSecond.cleanUp(false);
+    Sonar.get().getFallback().getBlacklist().cleanUp();
+    // Clean up all counters
+    LOGINS_PER_SECOND.cleanUp();
+    CONNECTIONS_PER_SECOND.cleanUp();
 
     // Don't prepare component if there are no subscribers
     if (subscribers.isEmpty()) return;
@@ -60,7 +56,7 @@ public final class Verbose implements JVMProfiler {
     final Component component = prepareActionBarFormat();
     // Send the action bar to all online players
     for (final String subscriber : subscribers) {
-      final Audience audience = audiences.get(subscriber);
+      final Audience audience = Sonar.AUDIENCES.get(subscriber);
       if (audience == null) continue;
       audience.sendActionBar(component);
     }
@@ -76,9 +72,10 @@ public final class Verbose implements JVMProfiler {
         DECIMAL_FORMAT.format(Sonar.get().getFallback().getQueue().getQueuedPlayers().size()))
       .replace("%verifying%", DECIMAL_FORMAT.format(Sonar.get().getFallback().getConnected().size()))
       .replace("%blacklisted%",
-        DECIMAL_FORMAT.format(Sonar.get().getFallback().getBlacklisted().estimatedSize()))
+        DECIMAL_FORMAT.format(Sonar.get().getFallback().getBlacklist().estimatedSize()))
       .replace("%total-joins%", DECIMAL_FORMAT.format(Statistics.TOTAL_TRAFFIC.get()))
-      .replace("%logins-per-second%", DECIMAL_FORMAT.format(loginsPerSecond.estimatedSize()))
+      .replace("%logins-per-second%", DECIMAL_FORMAT.format(LOGINS_PER_SECOND.estimatedSize()))
+      .replace("%connections-per-second%", DECIMAL_FORMAT.format(CONNECTIONS_PER_SECOND.estimatedSize()))
       .replace("%verify-total%", DECIMAL_FORMAT.format(Statistics.REAL_TRAFFIC.get()))
       .replace("%verify-success%",
         DECIMAL_FORMAT.format(Sonar.get().getVerifiedPlayerController().estimatedSize()))
@@ -100,26 +97,4 @@ public final class Verbose implements JVMProfiler {
     final int nextIndex = ++animationIndex % animations.size();
     return animations.toArray(new String[0])[nextIndex];
   }
-
-  /**
-   * @param name Name of the audience
-   * @return Whether the audience is subscribed or not
-   */
-  public boolean isSubscribed(final @NotNull String name) {
-    return subscribers.contains(name);
-  }
-
-  /**
-   * @param name Name of the audience to subscribe
-   */
-  public void subscribe(final String name) {
-    subscribers.add(name);
-  }
-
-  /**
-   * @param name Name of the audience to unsubscribe
-   */
-  public void unsubscribe(final String name) {
-    subscribers.remove(name);
-  }
 }

sonar-api/src/main/java/xyz/jonesdev/sonar/api/webhook/DiscordWebhook.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-bukkit/build.gradle.kts

@@ -7,12 +7,13 @@ plugins {
 apply(plugin = "net.minecrell.plugin-yml.bukkit")
 
 bukkit {
-  name = "Sonar"
+  name = rootProject.name
   version = rootProject.version.toString().split("-")[0]
   main = "xyz.jonesdev.sonar.bukkit.SonarBukkitPlugin"
   authors = listOf("Jones Development", "Sonar Contributors")
   website = "https://jonesdev.xyz/discord/"
   load = BukkitPluginDescription.PluginLoadOrder.POSTWORLD
+  softDepend = listOf("Geyser-Spigot", "floodgate", "Protocolize", "packetevents", "ProtocolLib", "ViaVersion")
 
   commands {
     register("sonar") {
@@ -31,14 +32,17 @@ dependencies {
   compileOnly(project(":common"))
 
   // MiniMessage platform support
-  implementation("net.kyori:adventure-platform-bukkit:4.3.1")
+  implementation("net.kyori:adventure-platform-bukkit:4.3.2")
 
   // We have to use 1.8 for backwards compatibility
   compileOnly("org.spigotmc:spigot-api:1.8.8-R0.1-SNAPSHOT")
 
   // Implement bStats.org for metrics
   implementation("org.bstats:bstats-bukkit:3.0.2")
+
+  // Library/dependency loading
+  implementation("com.alessiodp.libby:libby-bukkit:2.0.0-SNAPSHOT")
 }
 
-java.sourceCompatibility = JavaVersion.VERSION_1_8
-java.targetCompatibility = JavaVersion.VERSION_1_8
+java.sourceCompatibility = JavaVersion.VERSION_11
+java.targetCompatibility = JavaVersion.VERSION_11

sonar-bukkit/src/main/java/xyz/jonesdev/sonar/bukkit/SonarBukkit.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -17,12 +17,15 @@
 
 package xyz.jonesdev.sonar.bukkit;
 
+import com.alessiodp.libby.BukkitLibraryManager;
 import lombok.Getter;
 import net.kyori.adventure.platform.bukkit.BukkitAudiences;
 import org.bstats.bukkit.Metrics;
 import org.jetbrains.annotations.NotNull;
+import xyz.jonesdev.sonar.api.Sonar;
 import xyz.jonesdev.sonar.api.SonarPlatform;
 import xyz.jonesdev.sonar.api.logger.LoggerWrapper;
+import xyz.jonesdev.sonar.api.statistics.Bandwidth;
 import xyz.jonesdev.sonar.bukkit.audience.AudienceListener;
 import xyz.jonesdev.sonar.bukkit.command.BukkitSonarCommand;
 import xyz.jonesdev.sonar.common.boot.SonarBootstrap;
@@ -34,7 +37,9 @@ public final class SonarBukkit extends SonarBootstrap<SonarBukkitPlugin> {
   public static SonarBukkit INSTANCE;
 
   public SonarBukkit(final @NotNull SonarBukkitPlugin plugin) {
-    super(plugin, plugin.getDataFolder(), SonarPlatform.BUKKIT);
+    super(plugin, new BukkitLibraryManager(
+      plugin, plugin.getDataFolder().getName()),
+      plugin.getDataFolder(), SonarPlatform.BUKKIT);
     INSTANCE = this;
   }
 
@@ -78,5 +83,17 @@ public final class SonarBukkit extends SonarBootstrap<SonarBukkitPlugin> {
 
     // Register audience register listener
     getPlugin().getServer().getPluginManager().registerEvents(new AudienceListener(), getPlugin());
+
+    // Register traffic service
+    getPlugin().getServer().getScheduler().runTaskTimerAsynchronously(getPlugin(),
+      Bandwidth::reset, 20L, 20L);
+
+    // Register queue service
+    getPlugin().getServer().getScheduler().runTaskTimerAsynchronously(getPlugin(),
+      getFallback().getQueue().getPollTask(), 10L, 10L);
+
+    // Register verbose service
+    getPlugin().getServer().getScheduler().runTaskTimerAsynchronously(getPlugin(),
+      Sonar.get().getVerboseHandler()::update, 4L, 4L);
   }
 }

sonar-bukkit/src/main/java/xyz/jonesdev/sonar/bukkit/SonarBukkitPlugin.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-bukkit/src/main/java/xyz/jonesdev/sonar/bukkit/audience/AudienceListener.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -32,11 +32,11 @@ public final class AudienceListener implements Listener {
   @EventHandler(priority = EventPriority.HIGHEST)
   public void handle(final @NotNull PlayerJoinEvent event) {
     final Audience audience = SonarBukkit.INSTANCE.getBukkitAudiences().player(event.getPlayer());
-    Sonar.get().getVerboseHandler().getAudiences().put(event.getPlayer().getName(), audience);
+    Sonar.AUDIENCES.put(event.getPlayer().getName(), audience);
   }
 
   @EventHandler(priority = EventPriority.HIGHEST)
   public void handle(final @NotNull PlayerQuitEvent event) {
-    Sonar.get().getVerboseHandler().getAudiences().remove(event.getPlayer().getName());
+    Sonar.AUDIENCES.remove(event.getPlayer().getName());
   }
 }

sonar-bukkit/src/main/java/xyz/jonesdev/sonar/bukkit/command/BukkitInvocationSource.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-bukkit/src/main/java/xyz/jonesdev/sonar/bukkit/command/BukkitSonarCommand.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-bungee/build.gradle.kts

@@ -5,10 +5,11 @@ plugins {
 apply(plugin = "net.minecrell.plugin-yml.bungee")
 
 bungee {
-  name = "Sonar"
+  name = rootProject.name
   version = rootProject.version.toString().split("-")[0]
   main = "xyz.jonesdev.sonar.bungee.SonarBungeePlugin"
   author = "Jones Development, Sonar Contributors"
+  softDepends = setOf("Geyser-BungeeCord", "floodgate", "Protocolize", "ViaVersion")
 }
 
 dependencies {
@@ -19,11 +20,14 @@ dependencies {
   testCompileOnly("net.md_5:bungeecord-proxy:master-SNAPSHOT")
 
   // MiniMessage platform support
-  implementation("net.kyori:adventure-platform-bungeecord:4.3.1")
+  implementation("net.kyori:adventure-platform-bungeecord:4.3.2")
 
   // Implement bStats.org for metrics
   implementation("org.bstats:bstats-bungeecord:3.0.2")
+
+  // Library/dependency loading
+  implementation("com.alessiodp.libby:libby-bungee:2.0.0-SNAPSHOT")
 }
 
-java.sourceCompatibility = JavaVersion.VERSION_1_8
-java.targetCompatibility = JavaVersion.VERSION_1_8
+java.sourceCompatibility = JavaVersion.VERSION_11
+java.targetCompatibility = JavaVersion.VERSION_11

sonar-bungee/src/main/java/xyz/jonesdev/sonar/bungee/SonarBungee.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -17,25 +17,29 @@
 
 package xyz.jonesdev.sonar.bungee;
 
+import com.alessiodp.libby.BungeeLibraryManager;
 import lombok.Getter;
 import net.kyori.adventure.platform.bungeecord.BungeeAudiences;
 import org.bstats.bungeecord.Metrics;
 import org.jetbrains.annotations.NotNull;
+import xyz.jonesdev.sonar.api.Sonar;
 import xyz.jonesdev.sonar.api.SonarPlatform;
 import xyz.jonesdev.sonar.api.logger.LoggerWrapper;
+import xyz.jonesdev.sonar.api.statistics.Bandwidth;
 import xyz.jonesdev.sonar.bungee.audience.AudienceListener;
 import xyz.jonesdev.sonar.bungee.command.BungeeSonarCommand;
-import xyz.jonesdev.sonar.bungee.fallback.FallbackListener;
-import xyz.jonesdev.sonar.bungee.fallback.injection.BaseInjectionHelper;
-import xyz.jonesdev.sonar.bungee.fallback.injection.ChildChannelInitializer;
+import xyz.jonesdev.sonar.bungee.fallback.FallbackInjectionHelper;
+import xyz.jonesdev.sonar.bungee.fallback.FallbackLoginListener;
 import xyz.jonesdev.sonar.common.boot.SonarBootstrap;
 
+import java.util.concurrent.TimeUnit;
+
 @Getter
 public final class SonarBungee extends SonarBootstrap<SonarBungeePlugin> {
   public static SonarBungee INSTANCE;
 
   public SonarBungee(final @NotNull SonarBungeePlugin plugin) {
-    super(plugin, plugin.getDataFolder(), SonarPlatform.BUNGEE);
+    super(plugin, new BungeeLibraryManager(plugin), plugin.getDataFolder(), SonarPlatform.BUNGEE);
     INSTANCE = this;
   }
 
@@ -78,12 +82,24 @@ public final class SonarBungee extends SonarBootstrap<SonarBungeePlugin> {
     getPlugin().getServer().getPluginManager().registerCommand(getPlugin(), new BungeeSonarCommand());
 
     // Register Fallback listener
-    getPlugin().getServer().getPluginManager().registerListener(getPlugin(), new FallbackListener());
+    getPlugin().getServer().getPluginManager().registerListener(getPlugin(), new FallbackLoginListener());
 
     // Register audience register listener
     getPlugin().getServer().getPluginManager().registerListener(getPlugin(), new AudienceListener());
 
-    // Inject base into ProtocolUtils
-    BaseInjectionHelper.inject(ChildChannelInitializer.INSTANCE);
+    // Register traffic service
+    getPlugin().getServer().getScheduler().schedule(getPlugin(), Bandwidth::reset,
+      1L, 1L, TimeUnit.SECONDS);
+
+    // Register queue service
+    getPlugin().getServer().getScheduler().schedule(getPlugin(), getFallback().getQueue().getPollTask(),
+      500L, 500L, TimeUnit.MILLISECONDS);
+
+    // Register verbose service
+    getPlugin().getServer().getScheduler().schedule(getPlugin(), Sonar.get().getVerboseHandler()::update,
+      200L, 200L, TimeUnit.MILLISECONDS);
+
+    // Make sure to inject into the server's connection handler
+    FallbackInjectionHelper.inject();
   }
 }

sonar-bungee/src/main/java/xyz/jonesdev/sonar/bungee/SonarBungeePlugin.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-bungee/src/main/java/xyz/jonesdev/sonar/bungee/audience/AudienceListener.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -32,11 +32,11 @@ public final class AudienceListener implements Listener {
   @EventHandler(priority = EventPriority.HIGHEST)
   public void handle(final @NotNull PostLoginEvent event) {
     final Audience audience = SonarBungee.INSTANCE.getBungeeAudiences().player(event.getPlayer());
-    Sonar.get().getVerboseHandler().getAudiences().put(event.getPlayer().getName(), audience);
+    Sonar.AUDIENCES.put(event.getPlayer().getName(), audience);
   }
 
   @EventHandler(priority = EventPriority.HIGHEST)
   public void handle(final @NotNull PlayerDisconnectEvent event) {
-    Sonar.get().getVerboseHandler().getAudiences().remove(event.getPlayer().getName());
+    Sonar.AUDIENCES.remove(event.getPlayer().getName());
   }
 }

sonar-bungee/src/main/java/xyz/jonesdev/sonar/bungee/command/BungeeInvocationSource.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-bungee/src/main/java/xyz/jonesdev/sonar/bungee/command/BungeeSonarCommand.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-bungee/src/main/java/xyz/jonesdev/sonar/bungee/fallback/FallbackChannelHandler.java

@@ -0,0 +1,269 @@
+/*
+ * Copyright (C) 2023-2024 Sonar Contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package xyz.jonesdev.sonar.bungee.fallback;
+
+import com.github.benmanes.caffeine.cache.Cache;
+import com.github.benmanes.caffeine.cache.Caffeine;
+import io.netty.channel.Channel;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.channel.ChannelInboundHandlerAdapter;
+import io.netty.handler.codec.CorruptedFrameException;
+import lombok.RequiredArgsConstructor;
+import net.kyori.adventure.text.Component;
+import net.kyori.adventure.text.serializer.json.JSONComponentSerializer;
+import net.md_5.bungee.api.chat.BaseComponent;
+import net.md_5.bungee.chat.ComponentSerializer;
+import net.md_5.bungee.netty.ChannelWrapper;
+import net.md_5.bungee.netty.HandlerBoss;
+import net.md_5.bungee.protocol.DefinedPacket;
+import net.md_5.bungee.protocol.PacketWrapper;
+import net.md_5.bungee.protocol.packet.Handshake;
+import net.md_5.bungee.protocol.packet.Kick;
+import net.md_5.bungee.protocol.packet.LoginRequest;
+import org.jetbrains.annotations.NotNull;
+import org.jetbrains.annotations.Nullable;
+import xyz.jonesdev.sonar.api.ReflectiveOperationException;
+import xyz.jonesdev.sonar.api.Sonar;
+import xyz.jonesdev.sonar.api.fallback.Fallback;
+import xyz.jonesdev.sonar.api.fallback.FallbackUser;
+import xyz.jonesdev.sonar.api.fallback.protocol.ProtocolVersion;
+import xyz.jonesdev.sonar.api.statistics.Counters;
+import xyz.jonesdev.sonar.api.statistics.Statistics;
+import xyz.jonesdev.sonar.common.fallback.FallbackBandwidthHandler;
+import xyz.jonesdev.sonar.common.fallback.FallbackUserWrapper;
+import xyz.jonesdev.sonar.common.utility.geyser.GeyserUtil;
+
+import java.lang.reflect.Field;
+import java.net.InetAddress;
+import java.net.InetSocketAddress;
+import java.nio.charset.StandardCharsets;
+import java.util.UUID;
+
+import static net.md_5.bungee.netty.PipelineUtils.*;
+import static xyz.jonesdev.sonar.api.fallback.FallbackPipelines.FALLBACK_BANDWIDTH;
+import static xyz.jonesdev.sonar.common.fallback.FallbackUserWrapper.closeWith;
+
+@RequiredArgsConstructor
+public final class FallbackChannelHandler extends ChannelInboundHandlerAdapter {
+  private final Channel channel;
+  private @Nullable String username;
+  private ProtocolVersion protocolVersion;
+  private InetAddress inetAddress;
+
+  private static final Fallback FALLBACK = Sonar.get().getFallback();
+  private static final Cache<Component, Kick> CACHED_KICK_PACKETS = Caffeine.newBuilder().build();
+
+  private static final Field CHANNEL_WRAPPER_FIELD;
+
+  static {
+    try {
+      CHANNEL_WRAPPER_FIELD = HandlerBoss.class.getDeclaredField("channel");
+      CHANNEL_WRAPPER_FIELD.setAccessible(true);
+    } catch (Exception exception) {
+      throw new ReflectiveOperationException(exception);
+    }
+  }
+
+  public static @NotNull Kick getCachedKickPacket(final Component component) {
+    Kick packet = CACHED_KICK_PACKETS.asMap().get(component);
+    if (packet == null) {
+      final String serialized = JSONComponentSerializer.json().serialize(component);
+      final BaseComponent baseComponent = ComponentSerializer.deserialize(serialized);
+      packet = new Kick(baseComponent);
+      CACHED_KICK_PACKETS.put(component, packet);
+    }
+    return packet;
+  }
+
+  @Override
+  public void channelActive(final @NotNull ChannelHandlerContext ctx) throws Exception {
+    // Increase connections per second for the action bar verbose
+    Counters.CONNECTIONS_PER_SECOND.put(System.nanoTime(), (byte) 0);
+    // Make sure to let the server handle the rest
+    ctx.fireChannelActive();
+  }
+
+  @Override
+  public void channelInactive(final @NotNull ChannelHandlerContext ctx) throws Exception {
+    // The player can disconnect without sending the login packet first
+    if (username != null) {
+      // Remove the username from the connected players
+      FALLBACK.getConnected().remove(username);
+    }
+    // The player cannot be in the queue if the IP address is invalid
+    if (inetAddress != null) {
+      // Remove the IP address from the queue
+      FALLBACK.getQueue().remove(inetAddress);
+    }
+    // Make sure to let the server handle the rest
+    ctx.fireChannelInactive();
+  }
+
+  @Override
+  public void channelRead(final @NotNull ChannelHandlerContext ctx, final Object msg) throws Exception {
+    // Intercept any packets processed by BungeeCord
+    if (msg instanceof PacketWrapper) {
+      final PacketWrapper packetWrapper = (PacketWrapper) msg;
+      final DefinedPacket wrappedPacket = packetWrapper.packet;
+      // Don't handle any invalid packets
+      if (wrappedPacket != null) {
+        // Intercept any handshake packet by the client
+        if (wrappedPacket instanceof Handshake) {
+          handleHandshake((Handshake) wrappedPacket);
+        }
+        // Intercept any server login packet by the client
+        if (wrappedPacket instanceof LoginRequest) {
+          handleLogin(ctx, (LoginRequest) wrappedPacket, msg);
+          return;
+        }
+      }
+    }
+    // Make sure to let the server handle the rest
+    ctx.fireChannelRead(msg);
+  }
+
+  // We can override the default exceptionCaught method since this handler
+  // will run before the MinecraftConnection knows that there has been an error.
+  // Additionally, this will also run after our custom decoder.
+  @Override
+  public void exceptionCaught(final @NotNull ChannelHandlerContext ctx,
+                              final @NotNull Throwable cause) throws Exception {
+    // Sonar sometimes uses exceptions to quickly close
+    // the channel and interrupt any other ongoing process.
+    // Simply close the channel if we encounter any errors.
+    ctx.close();
+  }
+
+  private void handleHandshake(final @NotNull Handshake handshake) throws Exception {
+    // Check if the player has already sent a handshake packet
+    if (protocolVersion != null) {
+      throw new CorruptedFrameException("Already sent handshake");
+    }
+    // Check if the hostname is invalid
+    if (handshake.getHost().isEmpty()) {
+      throw new CorruptedFrameException("Hostname is empty");
+    }
+    // Store the protocol version
+    protocolVersion = ProtocolVersion.fromId(handshake.getProtocolVersion());
+    // Hook the traffic listener
+    // TODO: Can we implement this in channelActive?
+    channel.pipeline().addFirst(FALLBACK_BANDWIDTH, FallbackBandwidthHandler.INSTANCE);
+  }
+
+  private void handleLogin(final @NotNull ChannelHandlerContext ctx,
+                           final @NotNull LoginRequest loginRequest,
+                           final @NotNull Object wrappedMessage) throws Exception {
+    // Check if the player has already sent a login packet
+    if (username != null) {
+      throw new CorruptedFrameException("Already logged on");
+    }
+    // Increase joins per second for the action bar verbose
+    Counters.LOGINS_PER_SECOND.put(System.nanoTime(), (byte) 0);
+    // Increase total traffic statistic
+    Statistics.TOTAL_TRAFFIC.increment();
+    // Store the username
+    username = loginRequest.getData();
+    // Make sure to use the potentially modified, real IP
+    final HandlerBoss handlerBoss = channel.pipeline().get(HandlerBoss.class);
+    final ChannelWrapper channelWrapper = (ChannelWrapper) CHANNEL_WRAPPER_FIELD.get(handlerBoss);
+    final InetSocketAddress socketAddress = (InetSocketAddress) channelWrapper.getRemoteAddress();
+    inetAddress = socketAddress.getAddress();
+
+    // Check the blacklist here since we cannot let the player "ghost join"
+    if (FALLBACK.getBlacklist().asMap().containsKey(inetAddress)) {
+      closeWith(channel, protocolVersion,
+        getCachedKickPacket(Sonar.get().getConfig().getVerification().getBlacklisted()));
+      return;
+    }
+
+    // Don't continue the verification process if the verification is disabled
+    if (!Sonar.get().getFallback().shouldVerifyNewPlayers()) {
+      ctx.fireChannelRead(wrappedMessage);
+      return;
+    }
+
+    // Completely skip Geyser connections
+    if (GeyserUtil.isGeyserConnection(channel, socketAddress)) {
+      ctx.fireChannelRead(wrappedMessage);
+      return;
+    }
+
+    // Check if the player is already queued since we don't want bots to flood the queue
+    if (FALLBACK.getQueue().getQueuedPlayers().containsKey(inetAddress)) {
+      closeWith(channel, protocolVersion,
+        getCachedKickPacket(Sonar.get().getConfig().getVerification().getAlreadyQueued()));
+      return;
+    }
+
+    // Check if Fallback is already verifying a player
+    // → is another player with the same IP address connected to Fallback?
+    if (FALLBACK.getConnected().containsKey(loginRequest.getData())
+      || FALLBACK.getConnected().containsValue(inetAddress)) {
+      closeWith(channel, protocolVersion,
+        getCachedKickPacket(Sonar.get().getConfig().getVerification().getAlreadyVerifying()));
+      return;
+    }
+
+    // Check if the protocol ID of the player is not allowed to enter the server
+    if (Sonar.get().getConfig().getVerification().getBlacklistedProtocols()
+      .contains(protocolVersion.getProtocol())) {
+      closeWith(channel, protocolVersion,
+        getCachedKickPacket(Sonar.get().getConfig().getVerification().getProtocolBlacklisted()));
+      return;
+    }
+
+    // Make sure we actually have to verify the player
+    final String offlineUUIDString = "OfflinePlayer:" + loginRequest.getData();
+    final UUID offlineUUID = UUID.nameUUIDFromBytes(offlineUUIDString.getBytes(StandardCharsets.UTF_8));
+    if (Sonar.get().getVerifiedPlayerController().has(inetAddress, offlineUUID)) {
+      ctx.fireChannelRead(wrappedMessage);
+      return;
+    }
+
+    // Check if the IP address is currently being rate-limited
+    if (!FALLBACK.getRatelimiter().attempt(inetAddress)) {
+      closeWith(channel, protocolVersion,
+        getCachedKickPacket(Sonar.get().getConfig().getVerification().getTooFastReconnect()));
+      return;
+    }
+
+    // Check if the protocol ID of the player is allowed to bypass verification
+    if (Sonar.get().getConfig().getVerification().getWhitelistedProtocols()
+      .contains(protocolVersion.getProtocol())) {
+      ctx.fireChannelRead(wrappedMessage);
+      return;
+    }
+
+    // Queue the connection for further processing
+    FALLBACK.getQueue().queue(inetAddress, () -> channel.eventLoop().execute(() -> {
+      // Check if the username matches the valid name regex to prevent
+      // UTF-16 names or other types of exploits
+      if (!Sonar.get().getConfig().getVerification().getValidNameRegex()
+        .matcher(loginRequest.getData()).matches()) {
+        closeWith(channel, protocolVersion,
+          Sonar.get().getConfig().getVerification().getInvalidUsername());
+        return;
+      }
+
+      // Create an instance for the Fallback connection
+      final FallbackUser user = new FallbackUserWrapper(channel, inetAddress, protocolVersion);
+      // Let the verification handler take over the channel
+      user.hijack(loginRequest.getData(), offlineUUID, PACKET_ENCODER, PACKET_DECODER, TIMEOUT_HANDLER, BOSS_HANDLER);
+    }));
+  }
+}

sonar-bungee/src/main/java/xyz/jonesdev/sonar/bungee/fallback/FallbackChannelInitializer.java

@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2023-2024 Sonar Contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package xyz.jonesdev.sonar.bungee.fallback;
+
+import io.netty.channel.Channel;
+import io.netty.channel.ChannelInitializer;
+import lombok.RequiredArgsConstructor;
+import xyz.jonesdev.sonar.api.ReflectiveOperationException;
+
+import java.lang.reflect.Method;
+
+import static net.md_5.bungee.netty.PipelineUtils.PACKET_DECODER;
+import static xyz.jonesdev.sonar.api.fallback.FallbackPipelines.FALLBACK_HANDLER;
+
+@RequiredArgsConstructor
+public final class FallbackChannelInitializer extends ChannelInitializer<Channel> {
+  private static final Method INIT_CHANNEL_METHOD;
+
+  static {
+    try {
+      INIT_CHANNEL_METHOD = ChannelInitializer.class.getDeclaredMethod("initChannel", Channel.class);
+      INIT_CHANNEL_METHOD.setAccessible(true);
+    } catch (Throwable throwable) {
+      throw new ReflectiveOperationException(throwable);
+    }
+  }
+
+  private final ChannelInitializer<Channel> originalChannelInitializer;
+
+  @Override
+  protected void initChannel(final Channel channel) throws Exception {
+    // Invoke the original method
+    try {
+      INIT_CHANNEL_METHOD.invoke(originalChannelInitializer, channel);
+    } catch (Throwable throwable) {
+      throw new ReflectiveOperationException(throwable);
+    }
+
+    channel.pipeline().addAfter(PACKET_DECODER, FALLBACK_HANDLER, new FallbackChannelHandler(channel));
+  }
+}

sonar-bungee/src/main/java/xyz/jonesdev/sonar/bungee/fallback/FallbackHandlerBoss.java

@@ -1,87 +0,0 @@
-/*
- * Copyright (C) 2023 Sonar Contributors
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-package xyz.jonesdev.sonar.bungee.fallback;
-
-import io.netty.channel.ChannelHandlerContext;
-import io.netty.handler.codec.haproxy.HAProxyMessage;
-import net.md_5.bungee.api.ProxyServer;
-import net.md_5.bungee.connection.DownstreamBridge;
-import net.md_5.bungee.connection.UpstreamBridge;
-import net.md_5.bungee.netty.ChannelWrapper;
-import net.md_5.bungee.netty.HandlerBoss;
-import net.md_5.bungee.netty.PacketHandler;
-import net.md_5.bungee.protocol.PacketWrapper;
-import org.jetbrains.annotations.NotNull;
-
-public final class FallbackHandlerBoss extends HandlerBoss {
-  private ChannelWrapper channel;
-  private PacketHandler handler;
-
-  @Override
-  public void setHandler(final @NotNull PacketHandler handler) {
-    this.handler = handler;
-    super.setHandler(handler);
-  }
-
-  @Override
-  public void channelActive(final ChannelHandlerContext ctx) throws Exception {
-    if (handler != null) {
-      channel = new ChannelWrapper(ctx);
-      super.channelActive(ctx);
-    }
-  }
-
-  @Override
-  public void channelInactive(final ChannelHandlerContext ctx) throws Exception {
-    if (handler != null) {
-      channel.markClosed();
-      super.channelInactive(ctx);
-    }
-  }
-
-  @Override
-  public void channelWritabilityChanged(final ChannelHandlerContext ctx) throws Exception {
-    if (handler != null) {
-      handler.writabilityChanged(channel);
-      super.channelWritabilityChanged(ctx);
-    }
-  }
-
-  @Override
-  public void channelRead(final ChannelHandlerContext ctx, final Object msg) throws Exception {
-    if (msg instanceof HAProxyMessage || msg instanceof PacketWrapper) {
-      super.channelRead(ctx, msg);
-    }
-  }
-
-  @Override
-  public void exceptionCaught(final @NotNull ChannelHandlerContext ctx, final Throwable throwable) throws Exception {
-    if (ctx.channel().isActive()) {
-      if (handler instanceof DownstreamBridge || handler instanceof UpstreamBridge) {
-        try {
-          handler.exception(throwable);
-        } catch (Exception exception) {
-          ProxyServer.getInstance().getLogger().severe(handler + " - exception processing exception: " + exception);
-        }
-      }
-
-      channel.markClosed();
-      ctx.close();
-    }
-  }
-}

sonar-bungee/src/main/java/xyz/jonesdev/sonar/bungee/fallback/FallbackInitialHandler.java

@@ -1,345 +0,0 @@
-/*
- * Copyright (C) 2023 Sonar Contributors
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-package xyz.jonesdev.sonar.bungee.fallback;
-
-import io.netty.channel.Channel;
-import io.netty.channel.ChannelFutureListener;
-import io.netty.channel.ChannelPipeline;
-import io.netty.handler.codec.CorruptedFrameException;
-import io.netty.handler.codec.DecoderException;
-import lombok.Getter;
-import lombok.val;
-import net.kyori.adventure.text.Component;
-import net.kyori.adventure.text.serializer.json.JSONComponentSerializer;
-import net.md_5.bungee.BungeeCord;
-import net.md_5.bungee.EncryptionUtil;
-import net.md_5.bungee.api.config.ListenerInfo;
-import net.md_5.bungee.chat.ComponentSerializer;
-import net.md_5.bungee.connection.InitialHandler;
-import net.md_5.bungee.netty.ChannelWrapper;
-import net.md_5.bungee.protocol.PlayerPublicKey;
-import net.md_5.bungee.protocol.packet.Kick;
-import net.md_5.bungee.protocol.packet.LoginRequest;
-import net.md_5.bungee.protocol.packet.StatusRequest;
-import org.jetbrains.annotations.NotNull;
-import org.jetbrains.annotations.Nullable;
-import xyz.jonesdev.sonar.api.ReflectiveOperationException;
-import xyz.jonesdev.sonar.api.Sonar;
-import xyz.jonesdev.sonar.api.event.impl.UserVerifyJoinEvent;
-import xyz.jonesdev.sonar.api.fallback.Fallback;
-import xyz.jonesdev.sonar.api.fallback.protocol.ProtocolVersion;
-import xyz.jonesdev.sonar.api.statistics.Statistics;
-import xyz.jonesdev.sonar.common.fallback.FallbackChannelHandler;
-import xyz.jonesdev.sonar.common.fallback.FallbackTimeoutHandler;
-import xyz.jonesdev.sonar.common.fallback.FallbackVerificationHandler;
-import xyz.jonesdev.sonar.common.fallback.protocol.FallbackPacketDecoder;
-import xyz.jonesdev.sonar.common.fallback.protocol.FallbackPacketEncoder;
-import xyz.jonesdev.sonar.common.fallback.protocol.FallbackPacketRegistry;
-import xyz.jonesdev.sonar.common.fallback.protocol.packets.login.LoginSuccess;
-import xyz.jonesdev.sonar.common.fallback.traffic.TrafficChannelHooker;
-
-import java.net.InetAddress;
-import java.nio.charset.StandardCharsets;
-import java.time.Instant;
-import java.util.Map;
-import java.util.Objects;
-import java.util.UUID;
-import java.util.concurrent.CompletableFuture;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.TimeUnit;
-
-import static net.md_5.bungee.netty.PipelineUtils.*;
-import static xyz.jonesdev.sonar.api.fallback.FallbackPipelines.*;
-import static xyz.jonesdev.sonar.api.fallback.protocol.ProtocolVersion.MINECRAFT_1_19_1;
-import static xyz.jonesdev.sonar.api.fallback.protocol.ProtocolVersion.MINECRAFT_1_19_3;
-import static xyz.jonesdev.sonar.common.utility.geyser.GeyserUtil.isGeyserConnection;
-
-public final class FallbackInitialHandler extends InitialHandler {
-  public FallbackInitialHandler(final @NotNull BungeeCord bungee, final ListenerInfo listener) {
-    super(bungee, listener);
-    this.bungee = bungee;
-  }
-
-  private static final @NotNull Fallback FALLBACK = Objects.requireNonNull(Sonar.get().getFallback());
-  @Getter
-  private ChannelWrapper channelWrapper;
-  private final @NotNull BungeeCord bungee;
-  private @Nullable FallbackUserWrapper user;
-  @Getter
-  private ProtocolVersion protocolVersion;
-  private boolean receivedLoginPacket;
-  private boolean receivedStatusPacket;
-
-  @Override
-  public void connected(final ChannelWrapper channelWrapper) throws Exception {
-    this.channelWrapper = channelWrapper;
-    super.connected(channelWrapper);
-  }
-
-  @Override
-  public void handle(final StatusRequest statusRequest) throws Exception {
-    // Fix status packet spam exploit
-    if (receivedStatusPacket) {
-      throw new CorruptedFrameException("Duplicate status packet");
-    }
-    receivedStatusPacket = true;
-    // Run the rest of the method asynchronously
-    CompletableFuture.runAsync(() -> {
-      // The channel always stays open because the client sends
-      // a StatusRequest and a Ping packet after one another
-      if (!isConnected()) {
-        throw new CorruptedFrameException("Not connected anymore");
-      }
-      try {
-        super.handle(statusRequest);
-      } catch (Exception exception) {
-        throw new DecoderException(exception);
-      }
-    });
-  }
-
-  @Override
-  public void handle(final LoginRequest loginRequest) throws Exception {
-    // Increase joins per second for the action bar verbose
-    Sonar.get().getVerboseHandler().getLoginsPerSecond().put(System.nanoTime());
-
-    // Fix login packet spam exploit
-    if (receivedLoginPacket || user != null) {
-      throw new CorruptedFrameException("Duplicate login packet");
-    }
-    receivedLoginPacket = true;
-    // Cache protocol version so other handlers don't throw NPEs
-    final int protocolId = getHandshake().getProtocolVersion();
-    protocolVersion = ProtocolVersion.fromId(protocolId);
-    final Channel channel = channelWrapper.getHandle();
-
-    // Run in the channel's event loop
-    channel.eventLoop().execute(() -> {
-      try {
-        final ChannelPipeline pipeline = channel.pipeline();
-        TrafficChannelHooker.hook(pipeline, PACKET_DECODER, PACKET_ENCODER);
-
-        // Increase total traffic statistic
-        Statistics.TOTAL_TRAFFIC.increment();
-
-        final InetAddress inetAddress = getAddress().getAddress();
-        // Check the blacklist here since we cannot let the player "ghost join"
-        if (FALLBACK.getBlacklisted().has(inetAddress)) {
-          closeWith(getKickPacket(Sonar.get().getConfig().getVerification().getBlacklisted()));
-          return;
-        }
-
-        // Check if the verification is enabled
-        if (!Sonar.get().getFallback().shouldVerifyNewPlayers()) {
-          super.handle(loginRequest);
-          return;
-        }
-
-        // Completely skip Geyser connections
-        if (isGeyserConnection(channel)) {
-          FALLBACK.getLogger().info("Skipping Geyser player: {}{}",
-            loginRequest.getData(), Sonar.get().getConfig().formatAddress(inetAddress));
-          super.handle(loginRequest);
-          return;
-        }
-
-        // Check if the protocol ID of the player is not allowed to enter the server
-        if (Sonar.get().getConfig().getVerification().getBlacklistedProtocols().contains(protocolId)) {
-          closeWith(getKickPacket(Sonar.get().getConfig().getVerification().getProtocolBlacklisted()));
-          return;
-        }
-
-        val uuid = UUID.nameUUIDFromBytes(("OfflinePlayer:" + loginRequest.getData()).getBytes(StandardCharsets.UTF_8));
-        // Check if the player is already verified
-        if (Sonar.get().getVerifiedPlayerController().has(inetAddress, uuid)) {
-          super.handle(loginRequest);
-          return;
-        }
-
-        // Check if the protocol ID of the player is allowed to bypass verification
-        if (Sonar.get().getConfig().getVerification().getWhitelistedProtocols().contains(protocolId)) {
-          super.handle(loginRequest);
-          return;
-        }
-
-        // Create wrapped Fallback user
-        user = new FallbackUserWrapper(
-          FALLBACK, channelWrapper, this,
-          channel, channel.pipeline(), inetAddress, protocolVersion
-        );
-
-        // Perform default BungeeCord checks
-        if (bungee.config.isEnforceSecureProfile()
-          && user.getProtocolVersion().compareTo(MINECRAFT_1_19_3) < 0) {
-          final PlayerPublicKey publicKey = loginRequest.getPublicKey();
-          if (publicKey == null) {
-            disconnect(bungee.getTranslation("secure_profile_required"));
-            return;
-          }
-          if (Instant.ofEpochMilli(publicKey.getExpiry()).isBefore(Instant.now())) {
-            disconnect(bungee.getTranslation("secure_profile_expired"));
-            return;
-          }
-          if (user.getProtocolVersion().compareTo(MINECRAFT_1_19_1) < 0
-            && !EncryptionUtil.check(publicKey, null)) {
-            disconnect(bungee.getTranslation("secure_profile_invalid"));
-            return;
-          }
-        }
-
-        // Check if the player is already queued since we don't want bots to flood the queue
-        if (FALLBACK.getQueue().getQueuedPlayers().containsKey(inetAddress)) {
-          closeWith(getKickPacket(Sonar.get().getConfig().getVerification().getAlreadyQueued()));
-          return;
-        }
-
-        // Check if Fallback is already verifying a player
-        // → is another player with the same IP address connected to Fallback?
-        if (FALLBACK.getConnected().containsKey(loginRequest.getData())
-          || FALLBACK.getConnected().containsValue(inetAddress)) {
-          closeWith(getKickPacket(Sonar.get().getConfig().getVerification().getAlreadyVerifying()));
-          return;
-        }
-
-        // Check if the IP address is currently being rate-limited
-        if (!FALLBACK.getRatelimiter().attempt(inetAddress)) {
-          closeWith(getKickPacket(Sonar.get().getConfig().getVerification().getTooFastReconnect()));
-          return;
-        }
-
-        // We have to add this pipeline to monitor whenever the client disconnects
-        // to remove them from the list of connected and queued players
-        pipeline.addFirst(FALLBACK_HANDLER, new FallbackChannelHandler(loginRequest.getData(), inetAddress));
-
-        // Queue the connection for further processing
-        FALLBACK.getQueue().queue(inetAddress, () -> channel.eventLoop().execute(() -> {
-
-          // Do not continue if the connection is closed or marked as disconnected
-          if (channelWrapper.isClosed() || channelWrapper.isClosing()) return;
-
-          // Check if the username matches the valid name regex to prevent
-          // UTF-16 names or other types of exploits
-          if (!Sonar.get().getConfig().getVerification().getValidNameRegex().matcher(loginRequest.getData()).matches()) {
-            closeWith(getKickPacket(Sonar.get().getConfig().getVerification().getInvalidUsername()));
-            return;
-          }
-
-          // Add better timeout handler to avoid known exploits or issues
-          // We also want to timeout bots quickly to avoid flooding
-          final int readTimeout = Sonar.get().getConfig().getVerification().getReadTimeout();
-          pipeline.replace(TIMEOUT_HANDLER, TIMEOUT_HANDLER,
-            new FallbackTimeoutHandler(readTimeout, TimeUnit.MILLISECONDS));
-
-          // Disconnect if the protocol version could not be resolved
-          if (user.getProtocolVersion().isUnknown()) {
-            closeWith(getKickPacket(Sonar.get().getConfig().getVerification().getInvalidProtocol()));
-            return;
-          }
-
-          // Check if the player is already connected to the proxy but still tries to verify
-          final int limit = bungee.config.getPlayerLimit();
-          if (limit > 0 && bungee.getOnlineCount() >= limit) {
-            disconnect(bungee.getTranslation("proxy_full"));
-            return;
-          } else if (!isOnlineMode() && bungee.getPlayer(loginRequest.getData()) != null) {
-            closeWith(getKickPacket(Sonar.get().getConfig().getVerification().getAlreadyConnected()));
-            return;
-          }
-
-          // The player joined the verification
-          Statistics.REAL_TRAFFIC.increment();
-
-          if (Sonar.get().getConfig().getVerification().isLogConnections()) {
-            // Only log the processing message if the server isn't under attack.
-            // We let the user override this through the configuration.
-            if (!Sonar.get().getAttackTracker().isCurrentlyUnderAttack()
-              || Sonar.get().getConfig().getVerification().isLogDuringAttack()) {
-              FALLBACK.getLogger().info(Sonar.get().getConfig().getVerification().getConnectLog()
-                .replace("%name%", loginRequest.getData())
-                .replace("%ip%", Sonar.get().getConfig().formatAddress(inetAddress))
-                .replace("%protocol%", String.valueOf(user.getProtocolVersion().getProtocol())));
-            }
-          }
-
-          // Call the VerifyJoinEvent for external API usage
-          Sonar.get().getEventManager().publish(new UserVerifyJoinEvent(loginRequest.getData(), user));
-
-          // Mark the player as connected → verifying players
-          FALLBACK.getConnected().put(loginRequest.getData(), inetAddress);
-
-          // This sometimes happens when the channel hangs, but the player is still connecting
-          // This also fixes a unique issue with TCPShield and other reverse proxies
-          if (user.getPipeline().get(PACKET_ENCODER) == null
-            || user.getPipeline().get(PACKET_DECODER) == null) {
-            channelWrapper.close();
-            return;
-          }
-
-          // Replace normal encoder to allow custom packets
-          final FallbackPacketEncoder encoder = new FallbackPacketEncoder(user.getProtocolVersion());
-          user.getPipeline().replace(PACKET_ENCODER, FALLBACK_PACKET_ENCODER, encoder);
-
-          // Send LoginSuccess packet to make the client think they are joining the server
-          user.write(new LoginSuccess(loginRequest.getData(), uuid));
-
-          // The LoginSuccess packet has been sent, now we can change the registry state
-          encoder.updateRegistry(user.getProtocolVersion().compareTo(ProtocolVersion.MINECRAFT_1_20_2) >= 0
-            ? FallbackPacketRegistry.CONFIG : FallbackPacketRegistry.GAME);
-
-          // Replace normal decoder to allow custom packets
-          user.getPipeline().replace(PACKET_DECODER, FALLBACK_PACKET_DECODER,
-            new FallbackPacketDecoder(user, new FallbackVerificationHandler(user, loginRequest.getData(), uuid)));
-        }));
-      } catch (Throwable throwable) {
-        throw new ReflectiveOperationException(throwable);
-      }
-    });
-  }
-
-  private static final Map<Component, Kick> CACHED_KICK_PACKETS = new ConcurrentHashMap<>(10);
-
-  public static @NotNull Kick getKickPacket(final @NotNull Component component) {
-    Kick cachedKickPacket = CACHED_KICK_PACKETS.get(component);
-    if (cachedKickPacket == null) {
-      final String serialized = JSONComponentSerializer.json().serialize(component);
-      cachedKickPacket = new Kick(ComponentSerializer.deserialize(serialized));
-      CACHED_KICK_PACKETS.put(component, cachedKickPacket);
-    }
-    return cachedKickPacket;
-  }
-
-  // Mostly taken from Velocity
-  public void closeWith(final Object msg) {
-    if (channelWrapper.getHandle().isActive()) {
-      boolean is17 = protocolVersion.compareTo(ProtocolVersion.MINECRAFT_1_8) < 0
-        && protocolVersion.compareTo(ProtocolVersion.MINECRAFT_1_7_2) >= 0;
-      if (is17) {
-        channelWrapper.getHandle().eventLoop().execute(() -> {
-          channelWrapper.getHandle().config().setAutoRead(false);
-          channelWrapper.getHandle().eventLoop().schedule(() -> {
-            channelWrapper.markClosed();
-            channelWrapper.getHandle().writeAndFlush(msg).addListener(ChannelFutureListener.CLOSE);
-          }, 250L, TimeUnit.MILLISECONDS);
-        });
-      } else {
-        channelWrapper.markClosed();
-        channelWrapper.getHandle().writeAndFlush(msg).addListener(ChannelFutureListener.CLOSE);
-      }
-    }
-  }
-}

sonar-bungee/src/main/java/xyz/jonesdev/sonar/bungee/fallback/FallbackInjectionHelper.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -15,7 +15,7 @@
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
-package xyz.jonesdev.sonar.bungee.fallback.injection;
+package xyz.jonesdev.sonar.bungee.fallback;
 
 import io.netty.channel.Channel;
 import io.netty.channel.ChannelInitializer;
@@ -27,20 +27,27 @@ import xyz.jonesdev.sonar.api.ReflectiveOperationException;
 import java.lang.reflect.Field;
 
 @UtilityClass
-public class BaseInjectionHelper {
-  public void inject(final ChannelInitializer<Channel> childHandler) {
+public class FallbackInjectionHelper {
+  public void inject() {
     try {
       final Field childField = PipelineUtils.class.getField("SERVER_CHILD");
       childField.setAccessible(true);
 
+      // Make sure to store the original channel initializer
+      final ChannelInitializer<Channel> originalInitializer = PipelineUtils.SERVER_CHILD;
+      final ChannelInitializer<Channel> fallbackInitializer = new FallbackChannelInitializer(originalInitializer);
+
       final Field unsafeField = Unsafe.class.getDeclaredField("theUnsafe");
       unsafeField.setAccessible(true);
       final Unsafe unsafe = (Unsafe) unsafeField.get(null);
 
+      // Get the base object (the object containing the field)
       final Object base = unsafe.staticFieldBase(childField);
+      // Get the offset of the static field within its class
       final long offset = unsafe.staticFieldOffset(childField);
 
-      unsafe.putObject(base, offset, childHandler);
+      // Replace the original channel initializer
+      unsafe.putObject(base, offset, fallbackInitializer);
     } catch (Exception exception) {
       throw new ReflectiveOperationException(exception);
     }

sonar-bungee/src/main/java/xyz/jonesdev/sonar/bungee/fallback/FallbackListener.java

@@ -1,59 +0,0 @@
-/*
- * Copyright (C) 2023 Sonar Contributors
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-package xyz.jonesdev.sonar.bungee.fallback;
-
-import lombok.RequiredArgsConstructor;
-import net.kyori.adventure.text.Component;
-import net.md_5.bungee.api.event.LoginEvent;
-import net.md_5.bungee.api.plugin.Listener;
-import net.md_5.bungee.event.EventHandler;
-import net.md_5.bungee.event.EventPriority;
-import org.jetbrains.annotations.NotNull;
-import xyz.jonesdev.sonar.api.Sonar;
-import xyz.jonesdev.sonar.bungee.SonarBungee;
-
-import java.net.InetAddress;
-import java.util.Objects;
-
-@RequiredArgsConstructor
-public final class FallbackListener implements Listener {
-
-  @SuppressWarnings("deprecation")
-  @EventHandler(priority = EventPriority.LOWEST)
-  public void handle(final @NotNull LoginEvent event) {
-    final InetAddress inetAddress = event.getConnection().getAddress().getAddress();
-
-    // Check if the number of online players using the same IP address as
-    // the connecting player is greater than the configured amount
-    final int maxOnlinePerIp = Sonar.get().getConfig().getMaxOnlinePerIp();
-
-    if (maxOnlinePerIp > 0) {
-      final long onlinePerIp = SonarBungee.INSTANCE.getPlugin().getServer().getPlayers().stream()
-        .filter(player -> Objects.equals(player.getAddress().getAddress(), inetAddress))
-        .count()
-        + 1 /* add 1 because the player hasn't been added to the list of online players yet */;
-
-      // We use '>=' because the player connecting to the server hasn't joined yet
-      if (onlinePerIp >= maxOnlinePerIp) {
-        final FallbackInitialHandler fallbackInitialHandler = (FallbackInitialHandler) event.getConnection();
-        final Component component = Sonar.get().getConfig().getTooManyOnlinePerIp();
-        fallbackInitialHandler.closeWith(FallbackInitialHandler.getKickPacket(component));
-      }
-    }
-  }
-}

sonar-bungee/src/main/java/xyz/jonesdev/sonar/bungee/fallback/FallbackLoginListener.java

@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2023-2024 Sonar Contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package xyz.jonesdev.sonar.bungee.fallback;
+
+import lombok.RequiredArgsConstructor;
+import net.kyori.adventure.text.Component;
+import net.md_5.bungee.api.connection.PendingConnection;
+import net.md_5.bungee.api.event.LoginEvent;
+import net.md_5.bungee.api.plugin.Listener;
+import net.md_5.bungee.connection.InitialHandler;
+import net.md_5.bungee.event.EventHandler;
+import net.md_5.bungee.event.EventPriority;
+import net.md_5.bungee.netty.ChannelWrapper;
+import org.jetbrains.annotations.NotNull;
+import xyz.jonesdev.sonar.api.ReflectiveOperationException;
+import xyz.jonesdev.sonar.api.Sonar;
+import xyz.jonesdev.sonar.api.fallback.protocol.ProtocolVersion;
+import xyz.jonesdev.sonar.bungee.SonarBungee;
+
+import java.lang.reflect.Field;
+import java.net.InetAddress;
+import java.util.Objects;
+
+import static xyz.jonesdev.sonar.bungee.fallback.FallbackChannelHandler.getCachedKickPacket;
+import static xyz.jonesdev.sonar.common.fallback.FallbackUserWrapper.closeWith;
+
+@RequiredArgsConstructor
+public final class FallbackLoginListener implements Listener {
+
+  private static final Field CHANNEL_FIELD;
+
+  static {
+    try {
+      CHANNEL_FIELD = InitialHandler.class.getDeclaredField("ch");
+      CHANNEL_FIELD.setAccessible(true);
+    } catch (NoSuchFieldException exception) {
+      throw new ReflectiveOperationException(exception);
+    }
+  }
+
+  @SuppressWarnings("deprecation")
+  @EventHandler(priority = EventPriority.LOWEST)
+  public void handle(final @NotNull LoginEvent event) throws IllegalAccessException {
+    // Check if the number of online players using the same IP address as
+    // the connecting player is greater than the configured amount
+    final int maxOnlinePerIp = Sonar.get().getConfig().getMaxOnlinePerIp();
+    // Don't do anything if the setting is disabled
+    if (maxOnlinePerIp <= 0) return;
+
+    final InetAddress inetAddress = event.getConnection().getAddress().getAddress();
+
+    final long onlinePerIp = SonarBungee.INSTANCE.getPlugin().getServer().getPlayers().stream()
+      .filter(player -> Objects.equals(player.getAddress().getAddress(), inetAddress))
+      .count()
+      + 1 /* add 1 because the player hasn't been added to the list of online players yet */;
+
+    // We use '>=' because the player connecting to the server hasn't joined yet
+    if (onlinePerIp >= maxOnlinePerIp) {
+      final Component component = Sonar.get().getConfig().getTooManyOnlinePerIp();
+      final PendingConnection connection = event.getConnection();
+      closeWith(((ChannelWrapper) CHANNEL_FIELD.get(connection)).getHandle(),
+        ProtocolVersion.fromId(connection.getVersion()), getCachedKickPacket(component));
+    }
+  }
+}

sonar-bungee/src/main/java/xyz/jonesdev/sonar/bungee/fallback/FallbackUserWrapper.java

@@ -1,68 +0,0 @@
-/*
- * Copyright (C) 2023 Sonar Contributors
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-package xyz.jonesdev.sonar.bungee.fallback;
-
-import io.netty.channel.Channel;
-import io.netty.channel.ChannelPipeline;
-import io.netty.util.ReferenceCountUtil;
-import lombok.Getter;
-import lombok.RequiredArgsConstructor;
-import net.kyori.adventure.text.Component;
-import net.md_5.bungee.netty.ChannelWrapper;
-import org.jetbrains.annotations.NotNull;
-import xyz.jonesdev.sonar.api.fallback.Fallback;
-import xyz.jonesdev.sonar.api.fallback.FallbackUser;
-import xyz.jonesdev.sonar.api.fallback.protocol.ProtocolVersion;
-import xyz.jonesdev.sonar.common.fallback.protocol.packets.play.Disconnect;
-
-import java.net.InetAddress;
-
-@Getter
-@RequiredArgsConstructor
-public final class FallbackUserWrapper implements FallbackUser<ChannelWrapper, FallbackInitialHandler> {
-  private final Fallback fallback;
-  private final ChannelWrapper player;
-  private final FallbackInitialHandler connection;
-  private final Channel channel;
-  private final ChannelPipeline pipeline;
-  private final InetAddress inetAddress;
-  private final ProtocolVersion protocolVersion;
-
-  @Override
-  public void disconnect(final @NotNull Component reason) {
-    connection.closeWith(Disconnect.create(reason));
-  }
-
-  @Override
-  public void write(final @NotNull Object packet) {
-    if (channel.isActive()) {
-      channel.writeAndFlush(packet, channel.voidPromise());
-    } else {
-      ReferenceCountUtil.release(packet);
-    }
-  }
-
-  @Override
-  public void delayedWrite(final @NotNull Object packet) {
-    if (channel.isActive()) {
-      channel.write(packet, channel.voidPromise());
-    } else {
-      ReferenceCountUtil.release(packet);
-    }
-  }
-}

sonar-bungee/src/main/java/xyz/jonesdev/sonar/bungee/fallback/injection/BaseChannelInitializer.java

@@ -1,77 +0,0 @@
-/*
- * Copyright (C) 2023 Sonar Contributors
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-package xyz.jonesdev.sonar.bungee.fallback.injection;
-
-import io.netty.channel.*;
-import lombok.AccessLevel;
-import lombok.NoArgsConstructor;
-import net.md_5.bungee.BungeeCord;
-import net.md_5.bungee.netty.PipelineUtils;
-import net.md_5.bungee.protocol.Varint21LengthFieldPrepender;
-import org.jetbrains.annotations.NotNull;
-import xyz.jonesdev.sonar.api.ReflectiveOperationException;
-import xyz.jonesdev.sonar.bungee.fallback.FallbackHandlerBoss;
-import xyz.jonesdev.sonar.bungee.fallback.varint.Varint21FrameDecoder;
-import xyz.jonesdev.sonar.common.fallback.FallbackTimeoutHandler;
-
-import java.lang.reflect.Field;
-import java.util.concurrent.TimeUnit;
-
-import static net.md_5.bungee.netty.PipelineUtils.*;
-
-@NoArgsConstructor(access = AccessLevel.PRIVATE)
-public final class BaseChannelInitializer extends ChannelInitializer<Channel> {
-  public static final BaseChannelInitializer INSTANCE = new BaseChannelInitializer();
-
-  private static final boolean REPLACE_VAR_INT_DECODER = !Boolean.getBoolean("sonar.do-not-replace-decoder");
-
-  // https://github.com/PaperMC/Velocity/blob/dev/3.0.0/proxy/src/main/java/com/velocitypowered/proxy/network/ConnectionManager.java#L57
-  private static final WriteBufferWaterMark SERVER_WRITE_MARK = new WriteBufferWaterMark(1 << 20, 1 << 21);
-
-  private static final Varint21LengthFieldPrepender FRAME_ENCODER;
-
-  static {
-    try {
-      final Field frameEncoder = PipelineUtils.class.getDeclaredField("framePrepender");
-      frameEncoder.setAccessible(true);
-      FRAME_ENCODER = (Varint21LengthFieldPrepender) frameEncoder.get(null);
-    } catch (Throwable throwable) {
-      throw new ReflectiveOperationException(throwable);
-    }
-  }
-
-  // Mostly taken from BungeeCord
-  // https://github.com/SpigotMC/BungeeCord/blob/master/proxy/src/main/java/net/md_5/bungee/netty/PipelineUtils.java#L162
-  @Override
-  protected void initChannel(final @NotNull Channel channel) throws Exception {
-    try {
-      channel.config().setOption(ChannelOption.IP_TOS, 0x18);
-    } catch (ChannelException ignored) {
-    }
-
-    channel.config().setOption(ChannelOption.TCP_NODELAY, true);
-    channel.config().setWriteBufferWaterMark(SERVER_WRITE_MARK);
-
-    channel.pipeline().addLast(FRAME_DECODER, REPLACE_VAR_INT_DECODER
-      ? new Varint21FrameDecoder() : new net.md_5.bungee.protocol.Varint21FrameDecoder());
-    channel.pipeline().addLast(TIMEOUT_HANDLER, new FallbackTimeoutHandler(
-      BungeeCord.getInstance().config.getTimeout(), TimeUnit.MILLISECONDS));
-    channel.pipeline().addLast(FRAME_PREPENDER, FRAME_ENCODER);
-    channel.pipeline().addLast(BOSS_HANDLER, new FallbackHandlerBoss());
-  }
-}

sonar-bungee/src/main/java/xyz/jonesdev/sonar/bungee/fallback/injection/ChildChannelInitializer.java

@@ -1,96 +0,0 @@
-/*
- * Copyright (C) 2023 Sonar Contributors
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-package xyz.jonesdev.sonar.bungee.fallback.injection;
-
-import io.netty.channel.Channel;
-import io.netty.channel.ChannelInitializer;
-import io.netty.handler.codec.haproxy.HAProxyMessageDecoder;
-import lombok.AccessLevel;
-import lombok.NoArgsConstructor;
-import net.md_5.bungee.BungeeCord;
-import net.md_5.bungee.api.config.ListenerInfo;
-import net.md_5.bungee.api.event.ClientConnectEvent;
-import net.md_5.bungee.netty.PipelineUtils;
-import net.md_5.bungee.protocol.*;
-import org.jetbrains.annotations.NotNull;
-import xyz.jonesdev.sonar.api.ReflectiveOperationException;
-import xyz.jonesdev.sonar.api.fallback.protocol.ProtocolVersion;
-import xyz.jonesdev.sonar.bungee.fallback.FallbackHandlerBoss;
-import xyz.jonesdev.sonar.bungee.fallback.FallbackInitialHandler;
-
-import java.lang.reflect.Field;
-import java.net.SocketAddress;
-
-import static net.md_5.bungee.netty.PipelineUtils.*;
-
-@NoArgsConstructor(access = AccessLevel.PRIVATE)
-public final class ChildChannelInitializer extends ChannelInitializer<Channel> {
-  public static final ChildChannelInitializer INSTANCE = new ChildChannelInitializer();
-
-  private static final BaseChannelInitializer BASE = BaseChannelInitializer.INSTANCE;
-  private static final BungeeCord BUNGEE = BungeeCord.getInstance();
-  private static final KickStringWriter LEGACY_KICK;
-
-  static {
-    try {
-      final Field kickField = PipelineUtils.class.getDeclaredField("legacyKicker");
-      kickField.setAccessible(true);
-      LEGACY_KICK = (KickStringWriter) kickField.get(null);
-    } catch (Throwable throwable) {
-      throw new ReflectiveOperationException(throwable);
-    }
-  }
-
-  // Mostly taken from BungeeCord
-  // https://github.com/SpigotMC/BungeeCord/blob/master/proxy/src/main/java/net/md_5/bungee/netty/PipelineUtils.java
-  @Override
-  protected void initChannel(final @NotNull Channel channel) throws Exception {
-    final SocketAddress remoteAddress = channel.remoteAddress() == null ? channel.parent().localAddress()
-      : channel.remoteAddress();
-
-    if (BUNGEE.getConnectionThrottle() != null && BUNGEE.getConnectionThrottle().throttle(remoteAddress)) {
-      channel.close();
-    } else {
-      final ListenerInfo listener = channel.attr(PipelineUtils.LISTENER).get();
-
-      if (BungeeCord.getInstance().getPluginManager().callEvent(new ClientConnectEvent(remoteAddress, listener)).isCancelled()) {
-        channel.close();
-      } else {
-        try {
-          BASE.initChannel(channel);
-        } catch (Exception exception) {
-          exception.printStackTrace(System.err);
-          channel.close();
-          return;
-        }
-
-        channel.pipeline().addBefore(FRAME_DECODER, LEGACY_DECODER, new LegacyDecoder());
-        channel.pipeline().addAfter(FRAME_DECODER, PACKET_DECODER, new MinecraftDecoder(
-          Protocol.HANDSHAKE, true, ProtocolVersion.LATEST_VERSION.getProtocol()));
-        channel.pipeline().addAfter(FRAME_PREPENDER, PACKET_ENCODER, new MinecraftEncoder(
-          Protocol.HANDSHAKE, true, ProtocolVersion.LATEST_VERSION.getProtocol()));
-        channel.pipeline().addBefore(FRAME_PREPENDER, LEGACY_KICKER, LEGACY_KICK);
-        channel.pipeline().get(FallbackHandlerBoss.class).setHandler(new FallbackInitialHandler(BUNGEE, listener));
-
-        if (listener.isProxyProtocol()) {
-          channel.pipeline().addFirst(new HAProxyMessageDecoder());
-        }
-      }
-    }
-  }
-}

sonar-bungee/src/main/java/xyz/jonesdev/sonar/bungee/fallback/varint/Varint21FrameDecoder.java

@@ -1,92 +0,0 @@
-/*
- * Copyright (C) 2023 Sonar Contributors
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-package xyz.jonesdev.sonar.bungee.fallback.varint;
-
-import io.netty.buffer.ByteBuf;
-import io.netty.channel.ChannelHandlerContext;
-import io.netty.handler.codec.ByteToMessageDecoder;
-import io.netty.handler.codec.CorruptedFrameException;
-import org.jetbrains.annotations.NotNull;
-
-import java.util.List;
-
-// Mostly taken from
-// https://github.com/PaperMC/Velocity/blob/dev/3.0.0/proxy/src/main/java/com/velocitypowered/proxy/protocol/netty/MinecraftVarintFrameDecoder.java
-public final class Varint21FrameDecoder extends ByteToMessageDecoder {
-
-  @Override
-  protected void decode(final @NotNull ChannelHandlerContext ctx,
-                        final ByteBuf byteBuf,
-                        final List<Object> out) throws Exception {
-    if (!ctx.channel().isActive() || !byteBuf.isReadable()) {
-      // MessageToMessageDecoder always do release after decoding
-      // https://github.com/jonesdevelopment/sonar-legacy/pull/5
-      return;
-    }
-
-    final VarintByteDecoder reader = new VarintByteDecoder();
-    final int end = byteBuf.forEachByte(reader);
-
-    if (end == -1) {
-      // This is probably a good sign that the buffer was too short or empty
-      // since the ByteBuf cannot hold a proper VarInt.
-      if (reader.getResult() == VarintByteDecoder.DecoderResult.RUN_OF_ZEROES) {
-        byteBuf.clear();
-      }
-      return;
-    }
-
-    switch (reader.getResult()) {
-      case RUN_OF_ZEROES: {
-        // this will return to the point where the next varInt starts
-        byteBuf.readerIndex(end);
-        break;
-      }
-
-      case SUCCESS: {
-        final int readVarInt = reader.getReadVarInt();
-
-        if (readVarInt < 0) {
-          byteBuf.clear();
-          throw new CorruptedFrameException("Result: " + reader);
-        } else if (readVarInt == 0) {
-          // Actually, we don't want to throw an Exception if the packet is empty.
-          // The check would also false flag a lot of legit players since packets
-          // in 1.7 could sometimes be empty.
-          byteBuf.readerIndex(end + 1);
-          return;
-        }
-
-        final int bytesRead = reader.getBytesRead();
-        final int minimumRead = bytesRead + readVarInt;
-
-        if (byteBuf.isReadable(minimumRead)) {
-          out.add(byteBuf.retainedSlice(end + 1, readVarInt));
-
-          byteBuf.skipBytes(minimumRead);
-        }
-        break;
-      }
-
-      default: {
-        byteBuf.clear();
-        throw new CorruptedFrameException("Result: " + reader);
-      }
-    }
-  }
-}

sonar-bungee/src/main/java/xyz/jonesdev/sonar/bungee/fallback/varint/VarintByteDecoder.java

@@ -1,63 +0,0 @@
-/*
- * Copyright (C) 2023 Sonar Contributors
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-package xyz.jonesdev.sonar.bungee.fallback.varint;
-
-import io.netty.util.ByteProcessor;
-import lombok.Getter;
-import lombok.ToString;
-
-// Taken from
-// https://github.com/PaperMC/Velocity/blob/dev/3.0.0/proxy/src/main/java/com/velocitypowered/proxy/protocol/netty/VarintByteDecoder.java
-@Getter
-@ToString
-public final class VarintByteDecoder implements ByteProcessor {
-  private DecoderResult result = DecoderResult.TOO_SMALL;
-  private int readVarInt, bytesRead;
-
-  @Override
-  public boolean process(byte b) throws Exception {
-    if (b == 0 && bytesRead == 0) {
-      result = DecoderResult.RUN_OF_ZEROES;
-      return true;
-    }
-
-    if (result == DecoderResult.RUN_OF_ZEROES) {
-      return false;
-    }
-
-    readVarInt |= (b & 0x7F) << bytesRead++ * 7;
-
-    if (bytesRead > 3) {
-      result = DecoderResult.TOO_BIG;
-      return false;
-    }
-
-    if ((b & 0x80) != 128) {
-      result = DecoderResult.SUCCESS;
-      return false;
-    }
-    return true;
-  }
-
-  public enum DecoderResult {
-    SUCCESS,
-    TOO_SMALL,
-    TOO_BIG,
-    RUN_OF_ZEROES
-  }
-}

sonar-common/build.gradle.kts

@@ -2,5 +2,5 @@ dependencies {
   compileOnly(project(":api"))
 }
 
-java.sourceCompatibility = JavaVersion.VERSION_1_8
-java.targetCompatibility = JavaVersion.VERSION_1_8
+java.sourceCompatibility = JavaVersion.VERSION_11
+java.targetCompatibility = JavaVersion.VERSION_11

sonar-common/src/main/java/xyz/jonesdev/sonar/common/boot/LibraryLoader.java

@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2024 Sonar Contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package xyz.jonesdev.sonar.common.boot;
+
+import com.alessiodp.libby.Library;
+import com.alessiodp.libby.LibraryManager;
+import lombok.experimental.UtilityClass;
+import org.jetbrains.annotations.NotNull;
+
+@UtilityClass
+class LibraryLoader {
+  void loadLibraries(final @NotNull LibraryManager libraryManager) {
+    libraryManager.addMavenCentral();
+    libraryManager.addJitPack();
+    libraryManager.loadLibraries(
+      // Simple-YAML
+      Library.builder()
+        .groupId("com{}github{}Carleslc{}Simple-YAML")
+        .artifactId("Simple-Yaml")
+        .version("1.8.4")
+        .relocate("com{}simpleyaml", "xyz{}jonesdev{}sonar{}libs{}yaml")
+        .build(),
+      // Gson
+      Library.builder()
+        .groupId("com{}google{}code{}gson")
+        .artifactId("gson")
+        .version("2.10.1")
+        .relocate("com{}google{}code{}gson", "xyz{}jonesdev{}sonar{}libs{}gson")
+        .build(),
+      // Caffeine
+      Library.builder()
+        .groupId("com.github.ben-manes.caffeine")
+        .artifactId("caffeine")
+        .version("3.1.8")
+        .relocate("com{}github{}benmanes{}caffeine", "xyz{}jonesdev{}sonar{}libs{}caffeine")
+        .build(),
+      // ORMLite
+      Library.builder()
+        .groupId("com{}j256{}ormlite")
+        .artifactId("ormlite-jdbc")
+        .version("6.1")
+        .relocate("com{}j256{}ormlite", "xyz{}jonesdev{}sonar{}libs{}ormlite")
+        .build(),
+      // MySQL driver
+      Library.builder()
+        .groupId("com{}mysql")
+        .artifactId("mysql-connector-j")
+        .version("8.3.0")
+        .build()
+    );
+  }
+}

sonar-common/src/main/java/xyz/jonesdev/sonar/common/boot/SonarBootstrap.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -17,29 +17,27 @@
 
 package xyz.jonesdev.sonar.common.boot;
 
+import com.alessiodp.libby.LibraryManager;
+import com.github.benmanes.caffeine.cache.Caffeine;
 import lombok.Getter;
 import lombok.RequiredArgsConstructor;
 import lombok.Setter;
 import org.jetbrains.annotations.NotNull;
-import xyz.jonesdev.cappuccino.Cappuccino;
-import xyz.jonesdev.cappuccino.ExpiringCache;
 import xyz.jonesdev.sonar.api.Sonar;
 import xyz.jonesdev.sonar.api.SonarPlatform;
 import xyz.jonesdev.sonar.api.SonarSupplier;
 import xyz.jonesdev.sonar.api.command.subcommand.SubcommandRegistry;
 import xyz.jonesdev.sonar.api.config.SonarConfiguration;
 import xyz.jonesdev.sonar.api.controller.VerifiedPlayerController;
-import xyz.jonesdev.sonar.api.fallback.FallbackRatelimiter;
 import xyz.jonesdev.sonar.api.timer.SystemTimer;
+import xyz.jonesdev.sonar.api.verbose.Notification;
 import xyz.jonesdev.sonar.api.verbose.Verbose;
 import xyz.jonesdev.sonar.common.fallback.protocol.FallbackPreparer;
-import xyz.jonesdev.sonar.common.service.ServiceRepository;
 import xyz.jonesdev.sonar.common.subcommand.SubcommandRegistryHolder;
 import xyz.jonesdev.sonar.common.update.UpdateChecker;
 
 import java.io.File;
-import java.net.InetAddress;
-import java.util.concurrent.TimeUnit;
+import java.time.Duration;
 
 @Getter
 @RequiredArgsConstructor
@@ -47,24 +45,32 @@ public abstract class SonarBootstrap<T> implements Sonar {
   private T plugin;
   @Setter
   private Verbose verboseHandler;
+  @Setter
+  private Notification notificationHandler;
   private SonarConfiguration config;
   private VerifiedPlayerController verifiedPlayerController;
   private File dataDirectory;
+  private final LibraryManager libraryManager;
   private final SonarPlatform platform;
   private final SubcommandRegistry subcommandRegistry;
   private final SystemTimer launchTimer = new SystemTimer();
 
   public SonarBootstrap(final @NotNull T plugin,
+                        final LibraryManager libraryManager,
                         final File dataDirectory,
                         final SonarPlatform platform) {
     // Set the Sonar API
     SonarSupplier.set(this);
-
-    // Set the plugin instance before anything else
+    // Store our library manager for the API
+    this.libraryManager = libraryManager;
+    // Load all libraries before anything else
+    LibraryLoader.loadLibraries(libraryManager);
+    // Set the plugin instance
     this.plugin = plugin;
     this.dataDirectory = dataDirectory;
     this.platform = platform;
     this.verboseHandler = new Verbose();
+    this.notificationHandler = new Notification();
     this.config = new SonarConfiguration(dataDirectory);
     this.subcommandRegistry = new SubcommandRegistryHolder();
   }
@@ -86,9 +92,6 @@ public abstract class SonarBootstrap<T> implements Sonar {
     getLogger().info("Successfully initialized components in {}s!", launchTimer);
     getLogger().info("Enabling all tasks and features...");
 
-    // Start all service threads
-    ServiceRepository.register();
-
     try {
       // Run the per-platform initialization method
       enable();
@@ -113,19 +116,37 @@ public abstract class SonarBootstrap<T> implements Sonar {
     getConfig().load();
 
     // Warn player if they reloaded and changed the database type
-    if (getVerifiedPlayerController() != null
-      && getVerifiedPlayerController().getCachedDatabaseType() != getConfig().getDatabase().getType()) {
-      Sonar.get().getLogger().warn("Reloading the server after changing the database type"
+    if (verifiedPlayerController != null
+      && verifiedPlayerController.getCachedDatabaseType() != getConfig().getDatabase().getType()) {
+      getLogger().warn("Reloading the server after changing the database type"
         + " is generally not recommended as it can sometimes cause data loss.");
     }
 
     // Prepare cached packets
     FallbackPreparer.prepare();
 
-    // Update ratelimiter
-    final ExpiringCache<InetAddress> expiringCache = Cappuccino.buildExpiring(
-      getConfig().getVerification().getReconnectDelay(), TimeUnit.MILLISECONDS, 250L);
-    FallbackRatelimiter.INSTANCE.setExpiringCache(expiringCache);
+    // Update ratelimiter cache
+    getFallback().getRatelimiter().setExpiringCache(Caffeine.newBuilder()
+      .expireAfterWrite(Duration.ofMillis(getConfig().getVerification().getReconnectDelay()))
+      .build());
+
+    // Update blacklist cache
+    final long blacklistTime = getConfig().getVerification().getBlacklistTime();
+    final boolean blacklistExists = getFallback().getBlacklist() != null;
+    // Make sure the blacklist is only set when we need it to prevent data loss
+    if (!blacklistExists // Make sure we create a new cache if it doesn't exist yet
+      || getFallback().getBlacklistTime() != blacklistTime) {
+      // Create new cache with the configured blacklist time
+      getFallback().setBlacklist(Caffeine.newBuilder()
+        .expireAfterWrite(Duration.ofMillis(getConfig().getVerification().getBlacklistTime()))
+        .build());
+      // Store the new blacklist time, so we don't have to reset the blacklist every reload
+      getFallback().setBlacklistTime(blacklistTime);
+      // Warn the user about changing the expiry of the blacklist values
+      if (blacklistExists) {
+        getLogger().warn("The blacklist has been reset as the duration of entries has changed.");
+      }
+    }
 
     // Reinitialize database controller
     verifiedPlayerController = new VerifiedPlayerController();
@@ -134,8 +155,7 @@ public abstract class SonarBootstrap<T> implements Sonar {
   public void shutdown() {
     getLogger().info("Starting shutdown process...");
 
-    // Shut down service threads
-    ServiceRepository.shutdown();
+    // ...
 
     getLogger().info("Successfully shut down. Goodbye!");
   }

sonar-common/src/main/java/xyz/jonesdev/sonar/common/fallback/FallbackBandwidthHandler.java

@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2023-2024 Sonar Contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package xyz.jonesdev.sonar.common.fallback;
+
+import io.netty.buffer.ByteBuf;
+import io.netty.channel.ChannelDuplexHandler;
+import io.netty.channel.ChannelHandler;
+import io.netty.channel.ChannelHandlerContext;
+import io.netty.channel.ChannelPromise;
+import lombok.AccessLevel;
+import lombok.NoArgsConstructor;
+import org.jetbrains.annotations.NotNull;
+
+import static xyz.jonesdev.sonar.api.statistics.Bandwidth.INCOMING;
+import static xyz.jonesdev.sonar.api.statistics.Bandwidth.OUTGOING;
+
+@ChannelHandler.Sharable
+@NoArgsConstructor(access = AccessLevel.PRIVATE)
+public final class FallbackBandwidthHandler extends ChannelDuplexHandler {
+  public static final ChannelHandler INSTANCE = new FallbackBandwidthHandler();
+
+  @Override
+  public void channelRead(final @NotNull ChannelHandlerContext ctx,
+                          final @NotNull Object msg) throws Exception {
+    // We can only get the size of a message if it's a ByteBuf
+    if (msg instanceof ByteBuf) {
+      // Increment the incoming traffic by the amount of readable bytes
+      INCOMING.increment(((ByteBuf) msg).readableBytes());
+    }
+    // Make sure to let the server handle the rest
+    ctx.fireChannelRead(msg);
+  }
+
+  @Override
+  public void write(final @NotNull ChannelHandlerContext ctx,
+                    final @NotNull Object msg,
+                    final ChannelPromise promise) throws Exception {
+    // We can only get the size of a message if it's a ByteBuf
+    if (msg instanceof ByteBuf) {
+      // Increment the outgoing traffic by the amount of readable bytes
+      OUTGOING.increment(((ByteBuf) msg).readableBytes());
+    }
+    // Make sure to let the server handle the rest
+    ctx.write(msg, promise);
+  }
+}

sonar-common/src/main/java/xyz/jonesdev/sonar/common/fallback/FallbackChannelHandler.java

@@ -1,44 +0,0 @@
-/*
- * Copyright (C) 2023 Sonar Contributors
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-package xyz.jonesdev.sonar.common.fallback;
-
-import io.netty.channel.ChannelHandlerContext;
-import io.netty.channel.ChannelInboundHandlerAdapter;
-import lombok.RequiredArgsConstructor;
-import org.jetbrains.annotations.NotNull;
-import xyz.jonesdev.sonar.api.Sonar;
-import xyz.jonesdev.sonar.api.fallback.Fallback;
-
-import java.net.InetAddress;
-
-@RequiredArgsConstructor
-public final class FallbackChannelHandler extends ChannelInboundHandlerAdapter {
-  private static final @NotNull Fallback FALLBACK = Sonar.get().getFallback();
-  private final @NotNull String username;
-  private final @NotNull InetAddress inetAddress;
-
-  @Override
-  public void channelUnregistered(final @NotNull ChannelHandlerContext ctx) {
-    // Remove the username from the connected players
-    FALLBACK.getConnected().remove(username);
-    // Remove the IP address from the queue
-    FALLBACK.getQueue().remove(inetAddress);
-    // Make sure other handlers also know we've disconnected
-    ctx.fireChannelUnregistered();
-  }
-}

sonar-common/src/main/java/xyz/jonesdev/sonar/common/fallback/FallbackTimeoutHandler.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-common/src/main/java/xyz/jonesdev/sonar/common/fallback/FallbackUserWrapper.java

@@ -0,0 +1,162 @@
+/*
+ * Copyright (C) 2023-2024 Sonar Contributors
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package xyz.jonesdev.sonar.common.fallback;
+
+import io.netty.channel.Channel;
+import io.netty.channel.ChannelFutureListener;
+import io.netty.channel.ChannelPipeline;
+import lombok.Getter;
+import lombok.ToString;
+import net.kyori.adventure.text.Component;
+import org.jetbrains.annotations.NotNull;
+import xyz.jonesdev.sonar.api.Sonar;
+import xyz.jonesdev.sonar.api.event.impl.UserVerifyJoinEvent;
+import xyz.jonesdev.sonar.api.fallback.FallbackUser;
+import xyz.jonesdev.sonar.api.fallback.protocol.ProtocolVersion;
+import xyz.jonesdev.sonar.api.statistics.Statistics;
+import xyz.jonesdev.sonar.common.fallback.protocol.FallbackPacketDecoder;
+import xyz.jonesdev.sonar.common.fallback.protocol.FallbackPacketEncoder;
+import xyz.jonesdev.sonar.common.fallback.protocol.FallbackPacketRegistry;
+import xyz.jonesdev.sonar.common.fallback.protocol.packets.login.LoginSuccess;
+import xyz.jonesdev.sonar.common.fallback.protocol.packets.play.Disconnect;
+
+import java.net.InetAddress;
+import java.util.UUID;
+import java.util.concurrent.TimeUnit;
+
+import static xyz.jonesdev.sonar.api.fallback.FallbackPipelines.FALLBACK_PACKET_DECODER;
+import static xyz.jonesdev.sonar.api.fallback.FallbackPipelines.FALLBACK_PACKET_ENCODER;
+
+@Getter
+@ToString(of = {"protocolVersion", "inetAddress"})
+public final class FallbackUserWrapper implements FallbackUser {
+  private final Channel channel;
+  private final ChannelPipeline pipeline;
+  private final InetAddress inetAddress;
+  private final ProtocolVersion protocolVersion;
+
+  public FallbackUserWrapper(final @NotNull Channel channel,
+                             final @NotNull InetAddress inetAddress,
+                             final @NotNull ProtocolVersion protocolVersion) {
+    this.channel = channel;
+    this.pipeline = channel.pipeline();
+    this.inetAddress = inetAddress;
+    this.protocolVersion = protocolVersion;
+  }
+
+  /**
+   * Disconnect the player during/after verification
+   * using our custom {@link Disconnect} packet.
+   *
+   * @param reason Disconnect message component
+   */
+  @Override
+  public void disconnect(final @NotNull Component reason) {
+    closeWith(channel, protocolVersion, Disconnect.create(reason));
+  }
+
+  /**
+   * @param channel         Channel to close
+   * @param protocolVersion Protocol version
+   * @param msg             Packet to close the channel with
+   */
+  public static void closeWith(final @NotNull Channel channel,
+                               final @NotNull ProtocolVersion protocolVersion,
+                               final @NotNull Object msg) {
+    if (channel.isActive()) {
+      if (protocolVersion.compareTo(ProtocolVersion.MINECRAFT_1_8) < 0
+        && protocolVersion.compareTo(ProtocolVersion.MINECRAFT_1_7_2) >= 0) {
+        channel.eventLoop().execute(() -> {
+          channel.config().setAutoRead(false);
+          channel.eventLoop().schedule(() -> {
+            channel.writeAndFlush(msg).addListener(ChannelFutureListener.CLOSE);
+          }, 250L, TimeUnit.MILLISECONDS);
+        });
+      } else {
+        channel.writeAndFlush(msg).addListener(ChannelFutureListener.CLOSE);
+      }
+    }
+  }
+
+  /**
+   * Takes over the channel and begins the verification process
+   *
+   * @param username Username of the player
+   * @param uuid     UUID of the player
+   * @param encoder  Name of the encoder pipeline
+   * @param decoder  Name of the decoder pipeline
+   * @param timeout  Name of the read timeout pipeline
+   */
+  @Override
+  public void hijack(final @NotNull String username, final @NotNull UUID uuid,
+                     final @NotNull String encoder, final @NotNull String decoder,
+                     final @NotNull String timeout, final @NotNull String boss) {
+    // This rarely happens when the channel hangs, but the player is still connecting
+    // This also fixes a unique issue with TCPShield and other reverse proxies
+    if (pipeline.get(encoder) == null || pipeline.get(decoder) == null) {
+      channel.close();
+      return;
+    }
+
+    // Remove main pipeline to completely take over the channel
+    if (pipeline.get(boss) != null) {
+      pipeline.remove(boss);
+    }
+
+    // The player has joined the verification
+    Statistics.REAL_TRAFFIC.increment();
+
+    if (Sonar.get().getConfig().getVerification().isLogConnections()) {
+      // Only log the processing message if the server isn't under attack.
+      // We let the user override this through the configuration.
+      if (!Sonar.get().getAttackTracker().isCurrentlyUnderAttack()
+        || Sonar.get().getConfig().getVerification().isLogDuringAttack()) {
+        Sonar.get().getFallback().getLogger().info(Sonar.get().getConfig().getVerification().getConnectLog()
+          .replace("%name%", username)
+          .replace("%ip%", Sonar.get().getConfig().formatAddress(inetAddress))
+          .replace("%protocol%", String.valueOf(protocolVersion.getProtocol())));
+      }
+    }
+
+    // Call the VerifyJoinEvent for external API usage
+    Sonar.get().getEventManager().publish(new UserVerifyJoinEvent(username, this));
+
+    // Mark the player as connected → verifying players
+    Sonar.get().getFallback().getConnected().put(username, inetAddress);
+
+    // Add better timeout handler to avoid known exploits or issues
+    // We also want to timeout bots quickly to avoid flooding
+    final int readTimeout = Sonar.get().getConfig().getVerification().getReadTimeout();
+    pipeline.replace(timeout, timeout, new FallbackTimeoutHandler(readTimeout, TimeUnit.MILLISECONDS));
+
+    // Replace normal encoder to allow custom packets
+    final FallbackPacketEncoder newEncoder = new FallbackPacketEncoder(protocolVersion);
+    pipeline.replace(encoder, FALLBACK_PACKET_ENCODER, newEncoder);
+
+    // Send LoginSuccess packet to make the client think they are joining the server
+    write(new LoginSuccess(username, uuid));
+
+    // The LoginSuccess packet has been sent, now we can change the registry state
+    newEncoder.updateRegistry(protocolVersion.compareTo(ProtocolVersion.MINECRAFT_1_20_2) >= 0
+      ? FallbackPacketRegistry.CONFIG : FallbackPacketRegistry.GAME);
+
+    // Replace normal decoder to allow custom packets
+    pipeline.replace(decoder, FALLBACK_PACKET_DECODER,
+      new FallbackPacketDecoder(this, new FallbackVerificationHandler(this, username, uuid)));
+  }
+}

sonar-common/src/main/java/xyz/jonesdev/sonar/common/fallback/FallbackVerificationHandler.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -26,6 +26,7 @@ import org.jetbrains.annotations.NotNull;
 import org.jetbrains.annotations.Nullable;
 import xyz.jonesdev.sonar.api.Sonar;
 import xyz.jonesdev.sonar.api.event.impl.UserVerifySuccessEvent;
+import xyz.jonesdev.sonar.api.fallback.Fallback;
 import xyz.jonesdev.sonar.api.fallback.FallbackUser;
 import xyz.jonesdev.sonar.api.model.VerifiedPlayer;
 import xyz.jonesdev.sonar.api.timer.SystemTimer;
@@ -43,6 +44,7 @@ import java.util.Random;
 import java.util.UUID;
 import java.util.regex.Pattern;
 
+import static xyz.jonesdev.sonar.api.config.SonarConfiguration.Verification.Gravity.Gamemode.CREATIVE;
 import static xyz.jonesdev.sonar.api.fallback.FallbackPipelines.FALLBACK_PACKET_DECODER;
 import static xyz.jonesdev.sonar.api.fallback.FallbackPipelines.FALLBACK_PACKET_ENCODER;
 import static xyz.jonesdev.sonar.api.fallback.protocol.ProtocolVersion.*;
@@ -50,10 +52,11 @@ import static xyz.jonesdev.sonar.common.fallback.protocol.FallbackPreparer.*;
 
 public final class FallbackVerificationHandler implements FallbackPacketListener {
   private static final Random RANDOM = new Random();
+  private static final Fallback FALLBACK = Sonar.get().getFallback();
 
   // General
   private final SystemTimer login = new SystemTimer();
-  private final @NotNull FallbackUser<?, ?> user;
+  private final @NotNull FallbackUser user;
   private final String username;
   private final UUID playerUuid;
   private @NotNull State state = State.LOGIN_ACK; // 1.20.2
@@ -62,7 +65,7 @@ public final class FallbackVerificationHandler implements FallbackPacketListener
   private short expectedTransactionId;
   private int expectedKeepAliveId, expectedTeleportId = -1;
   private int tick, totalReceivedPackets, ignoredMovementTicks;
-  private double posX, posY, posZ, lastY;
+  private double posX, posY, posZ, lastY, spawnYPosition;
   private boolean resolvedClientBrand, resolvedClientSettings;
   private boolean listenForMovements;
 
@@ -87,7 +90,7 @@ public final class FallbackVerificationHandler implements FallbackPacketListener
     SUCCESS
   }
 
-  public FallbackVerificationHandler(final @NotNull FallbackUser<?, ?> user,
+  public FallbackVerificationHandler(final @NotNull FallbackUser user,
                                      final @NotNull String username,
                                      final @NotNull UUID playerUuid) {
     this.user = user;
@@ -121,7 +124,7 @@ public final class FallbackVerificationHandler implements FallbackPacketListener
       encoder.updateRegistry(registry);
     } else {
       // Something went wrong - the decoder should not be null
-      user.getFallback().getLogger().warn("Necessary pipelines for {} not found", username);
+      FALLBACK.getLogger().warn("Necessary pipelines for {} not found", username);
       // Close the channel to prevent bypasses or other potential exploits
       user.getChannel().close();
     }
@@ -172,13 +175,17 @@ public final class FallbackVerificationHandler implements FallbackPacketListener
     // Set the state to TELEPORT to avoid false positives
     // and go on with the flow of the verification.
     state = State.TELEPORT;
-    // Make sure the player is unable to fly (the player is in spectator mode)
-    user.delayedWrite(DEFAULT_ABILITIES);
+    // Make sure the player is unable to fly (e.g. if the player is in creative mode)
+    if (Sonar.get().getConfig().getVerification().getGravity().getGamemode() == CREATIVE) {
+      user.delayedWrite(DEFAULT_ABILITIES);
+    }
     // Generate the current teleport ID
-    expectedTeleportId = RANDOM.nextInt(Short.MAX_VALUE);
+    expectedTeleportId = RANDOM.nextInt();
+    // Add a little randomization to the spawn y coordinate
+    spawnYPosition = dynamicSpawnYPosition + RANDOM.nextDouble(0.4);
     // Teleport the player to the spawn position
     user.delayedWrite(new PositionLook(
-      SPAWN_X_POSITION, dynamicSpawnYPosition, SPAWN_Z_POSITION,
+      SPAWN_X_POSITION, spawnYPosition, SPAWN_Z_POSITION,
       0f, -90f, expectedTeleportId, false));
     // Make sure the player escapes the 1.18.2+ "Loading terrain" screen
     if (user.getProtocolVersion().compareTo(MINECRAFT_1_18_2) >= 0) {
@@ -187,6 +194,13 @@ public final class FallbackVerificationHandler implements FallbackPacketListener
   }
 
   private void sendChunkData() {
+    // If we don't have gravity and captcha enabled, simply finish verification
+    if (!Sonar.get().getConfig().getVerification().getGravity().isEnabled()
+      && !FALLBACK.shouldDoMapCaptcha()) {
+      // Save some work by finishing before sending even more packets
+      finish();
+      return;
+    }
     // Set the state to POSITION to avoid false positives
     // and go on with the flow of the verification.
     state = State.POSITION;
@@ -212,14 +226,14 @@ public final class FallbackVerificationHandler implements FallbackPacketListener
     }
   }
 
-  private static boolean validateClientLocale(final @SuppressWarnings("unused") @NotNull FallbackUser<?, ?> user,
+  private static boolean validateClientLocale(final @SuppressWarnings("unused") @NotNull FallbackUser user,
                                               final String locale) {
     // Check the client locale by performing a simple regex check on it
     final Pattern pattern = Sonar.get().getConfig().getVerification().getValidLocaleRegex();
     return pattern.matcher(locale).matches(); // Disallow non-ascii characters (by default)
   }
 
-  private static boolean validateClientBrand(final @NotNull FallbackUser<?, ?> user, final ByteBuf content) {
+  private static boolean validateClientBrand(final @NotNull FallbackUser user, final ByteBuf content) {
     // We have to catch every DecoderException, so we can fail and punish
     // the player instead of only disconnecting them due to an exception.
     try {
@@ -227,11 +241,11 @@ public final class FallbackVerificationHandler implements FallbackPacketListener
       // already performs these checks by default.
       final String read = ProtocolUtil.readBrandMessage(content);
       // Check if the decoded client brand string is too long
-      if (read.length() > Sonar.get().getConfig().getVerification().getMaxBrandLength()) {
+      if (read.length() > Sonar.get().getConfig().getVerification().getBrand().getMaxLength()) {
         return false;
       }
       // Regex pattern for validating client brands
-      final Pattern pattern = Sonar.get().getConfig().getVerification().getValidBrandRegex();
+      final Pattern pattern = Sonar.get().getConfig().getVerification().getBrand().getValidRegex();
       return !read.equals("Vanilla") // The normal brand is always lowercase
         && pattern.matcher(read).matches(); // Disallow non-ascii characters (by default)
     } catch (DecoderException exception) {
@@ -242,57 +256,60 @@ public final class FallbackVerificationHandler implements FallbackPacketListener
     }
   }
 
+  private void handlePacketDuringCaptcha(final @NotNull FallbackPacket packet) {
+    // Check if the player took too long to enter the captcha
+    final int maxDuration = Sonar.get().getConfig().getVerification().getMap().getMaxDuration();
+    checkFrame(!login.elapsed(maxDuration), "took too long to enter captcha");
+
+    // Handle incoming chat messages
+    if (packet instanceof Chat) {
+      final Chat chat = (Chat) packet;
+      Objects.requireNonNull(captcha);
+      if (!chat.getMessage().equals(captcha.getInfo().getAnswer())) {
+        // Captcha is incorrect
+        checkFrame(captchaTriesLeft-- > 0, "failed captcha too often");
+        user.write(incorrectCaptcha);
+        return;
+      }
+      // Captcha is correct
+      finish();
+      return;
+    }
+
+    // Every second
+    if (actionBar.elapsed(1000L)) {
+      final String actionBarMessage = Sonar.get().getConfig().getVerification().getMap().getEnterCodeActionBar();
+      // Only send action bar if the message is actually supposed to be sent
+      if (!actionBarMessage.isEmpty()) {
+        final String timeLeft = String.format("%.0f", (maxDuration - login.delay()) / 1000D);
+        user.write(new Chat(MiniMessage.miniMessage().deserialize(
+          actionBarMessage.replace("%time-left%", timeLeft)), Chat.GAME_INFO_TYPE));
+        // Make sure to reset the timer
+        actionBar.reset();
+      }
+    }
+
+    // Every 10 seconds
+    if (keepAlive.elapsed(10_000L)) {
+      // Send the message again to remind the player
+      user.delayedWrite(enterCodeMessage);
+      // Send a KeepAlive packet to prevent timeout
+      user.delayedWrite(CAPTCHA_KEEP_ALIVE);
+      // Send both packets in one flush
+      user.getChannel().flush();
+      // Make sure to reset the timer
+      keepAlive.reset();
+    }
+  }
+
   @Override
   public void handle(final @NotNull FallbackPacket packet) {
     // The player has already been verified, drop all other packets
     if (state == State.SUCCESS) return;
-    // Check for timeout since the player could be sending packets but not important ones
-    final long timeout = Sonar.get().getConfig().getVerification().getMaxPing();
+
     // We are expecting a captcha code in chat, drop all other packets
     if (state == State.MAP_CAPTCHA) {
-      // Check if the player took too long to enter the captcha
-      final int maxDuration = Sonar.get().getConfig().getVerification().getMap().getMaxDuration();
-      checkFrame(!login.elapsed(maxDuration), "took too long to enter captcha");
-
-      // Handle incoming chat messages
-      if (packet instanceof Chat) {
-        final Chat chat = (Chat) packet;
-        Objects.requireNonNull(captcha);
-        if (!chat.getMessage().equals(captcha.getInfo().getAnswer())) {
-          // Captcha is incorrect
-          checkFrame(captchaTriesLeft-- > 0, "failed captcha too often");
-          user.write(incorrectCaptcha);
-          return;
-        }
-        // Captcha is correct
-        finish();
-        return;
-      }
-
-      // Every second
-      if (actionBar.elapsed(1000L)) {
-        final String actionBarMessage = Sonar.get().getConfig().getVerification().getMap().getEnterCodeActionBar();
-        // Only send action bar if the message is actually supposed to be sent
-        if (!actionBarMessage.isEmpty()) {
-          final String timeLeft = String.format("%.0f", (maxDuration - login.delay()) / 1000D);
-          user.write(new Chat(MiniMessage.miniMessage().deserialize(
-            actionBarMessage.replace("%time-left%", timeLeft)), Chat.GAME_INFO_TYPE));
-          // Make sure to reset the timer
-          actionBar.reset();
-        }
-      }
-
-      // Every about 10 seconds
-      if (keepAlive.elapsed(timeout)) {
-        // Send the message again to remind the player
-        user.delayedWrite(enterCodeMessage);
-        // Send a KeepAlive packet to prevent timeout
-        user.delayedWrite(CAPTCHA_KEEP_ALIVE);
-        // Send both packets in one flush
-        user.getChannel().flush();
-        // Make sure to reset the timer
-        keepAlive.reset();
-      }
+      handlePacketDuringCaptcha(packet);
       return;
     }
 
@@ -300,11 +317,9 @@ public final class FallbackVerificationHandler implements FallbackPacketListener
     final int maxPackets = Sonar.get().getConfig().getVerification().getMaxLoginPackets() + maxMovementTick;
     checkFrame(++totalReceivedPackets < maxPackets, "too many packets");
 
-    // Check if the time limit has exceeded
-    if (login.elapsed(timeout)) {
-      user.getChannel().close();
-      return;
-    }
+    // Check for timeout since the player could be sending packets but not important ones
+    final long timeout = Sonar.get().getConfig().getVerification().getMaxPing();
+    checkFrame(!login.elapsed(timeout), "time limit exceeded");
 
     if (packet instanceof LoginAcknowledged) {
       // Check if we are currently expecting a LoginAcknowledged packet
@@ -374,7 +389,9 @@ public final class FallbackVerificationHandler implements FallbackPacketListener
         checkFrame(pluginMessage.getChannel().equals("MC|Brand") || v1_13, "invalid channel");
 
         // Validate the client branding using a regex to filter unwanted characters.
-        checkFrame(validateClientBrand(user, pluginMessage.content()), "invalid client brand");
+        if (Sonar.get().getConfig().getVerification().getBrand().isEnabled()) {
+          checkFrame(validateClientBrand(user, pluginMessage.content()), "invalid client brand");
+        }
 
         // Clients sometimes mess up the ClientSettings or PluginMessage packet.
         if (state == State.PLUGIN_MESSAGE) {
@@ -454,7 +471,7 @@ public final class FallbackVerificationHandler implements FallbackPacketListener
     if (user.getProtocolVersion().compareTo(MINECRAFT_1_8) <= 0
       && expectedTeleportId != -1 // Check if the teleport ID is currently unset
       // Then, check if the position is equal to the spawn position
-      && x == SPAWN_X_POSITION && y == dynamicSpawnYPosition && z == SPAWN_Z_POSITION) {
+      && x == SPAWN_X_POSITION && y == spawnYPosition && z == SPAWN_Z_POSITION) {
       // Reset all values to ensure safety on teleport
       tick = 1;
       posY = -1;
@@ -478,7 +495,7 @@ public final class FallbackVerificationHandler implements FallbackPacketListener
         listenForMovements = true;
       }
 
-      lastY = dynamicSpawnYPosition;
+      lastY = spawnYPosition;
       return;
     }
 
@@ -493,7 +510,10 @@ public final class FallbackVerificationHandler implements FallbackPacketListener
     }
 
     // Calculate the difference between the player's Y coordinate and the expected Y coordinate
-    final double collisionOffsetY = DEFAULT_Y_COLLIDE_POSITION - y;
+    double collisionOffsetY = (DEFAULT_Y_COLLIDE_POSITION + blockType.getBlockHeight()) - y;
+    if (user.getProtocolVersion().compareTo(MINECRAFT_1_8) < 0) {
+      collisionOffsetY += 1.62f; // 1.7 is weird and sends the head position instead of the AABB minY
+    }
 
     // Check if the player is colliding by performing a basic Y offset check.
     // The offset cannot be greater than 0 since the blocks will not let the player fall through them.
@@ -502,15 +522,27 @@ public final class FallbackVerificationHandler implements FallbackPacketListener
     if (tick > maxMovementTick) {
       // Log/debug position if enabled in the configuration
       if (Sonar.get().getConfig().getVerification().isDebugXYZPositions()) {
-        user.getFallback().getLogger().info("{}: {}/{}/{} - deltaY: {} - ground: {} - collision: {}",
+        FALLBACK.getLogger().info("{}: {}/{}/{} - deltaY: {} - ground: {} - collision: {}",
           username, x, y, z, deltaY, ground, collisionOffsetY);
       }
 
-      // The player is colliding to blocks, finish verification
-      if (ground) {
+      // If the collision check is disabled, finish verification
+      if (!Sonar.get().getConfig().getVerification().getGravity().isCheckCollisions()) {
         captchaOrFinish();
         return;
       }
+
+      // Perform the collision check
+      if (ground) {
+        // Make sure the player is actually colliding with the blocks and not only spoofing ground
+        checkFrame(collisionOffsetY > -0.03, "illegal collision: " + collisionOffsetY);
+        // The player is colliding to blocks, finish verification
+        captchaOrFinish();
+        return;
+      } else {
+        // Make sure the player is colliding with blocks but is sending an invalid ground state
+        checkFrame(collisionOffsetY != 0, "no ground: " + collisionOffsetY);
+      }
     } else {
       // Check if the player is spoofing the ground state
       checkFrame(!ground, "spoofed ground state");
@@ -525,7 +557,7 @@ public final class FallbackVerificationHandler implements FallbackPacketListener
 
       // Log/debug position if enabled in the configuration
       if (Sonar.get().getConfig().getVerification().isDebugXYZPositions()) {
-        user.getFallback().getLogger().info("{}: {}/{}/{} - deltaY: {} - prediction: {} - offset: {}",
+        FALLBACK.getLogger().info("{}: {}/{}/{} - deltaY: {} - prediction: {} - offset: {}",
           username, x, y, z, deltaY, predictedY, offsetY);
       }
 
@@ -537,7 +569,7 @@ public final class FallbackVerificationHandler implements FallbackPacketListener
   }
 
   private void captchaOrFinish() {
-    if (user.getFallback().shouldDoMapCaptcha()) {
+    if (FALLBACK.shouldDoMapCaptcha()) {
       if (MapInfoPreparer.getPreparedCAPTCHAs() == 0) {
         // This should not happen, but we have to return if there is no captcha prepared
         user.disconnect(Sonar.get().getConfig().getVerification().getCurrentlyPreparing());
@@ -581,7 +613,7 @@ public final class FallbackVerificationHandler implements FallbackPacketListener
   private void finish() {
     state = State.SUCCESS;
 
-    user.getFallback().getConnected().remove(username);
+    FALLBACK.getConnected().remove(username);
 
     // Add verified player to the database
     final VerifiedPlayer verifiedPlayer = new VerifiedPlayer(user.getInetAddress().toString(), playerUuid,
@@ -594,7 +626,7 @@ public final class FallbackVerificationHandler implements FallbackPacketListener
     // Disconnect player with the verification success message
     user.disconnect(Sonar.get().getConfig().getVerification().getVerificationSuccess());
 
-    user.getFallback().getLogger().info(Sonar.get().getConfig().getVerification().getSuccessLog()
+    FALLBACK.getLogger().info(Sonar.get().getConfig().getVerification().getSuccessLog()
       .replace("%name%", username)
       .replace("%time%", login.toString()));
   }

sonar-common/src/main/java/xyz/jonesdev/sonar/common/fallback/protocol/FallbackPacket.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-common/src/main/java/xyz/jonesdev/sonar/common/fallback/protocol/FallbackPacketDecoder.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -31,11 +31,11 @@ import static xyz.jonesdev.sonar.common.fallback.protocol.FallbackPacketRegistry
 import static xyz.jonesdev.sonar.common.utility.protocol.VarIntUtil.readVarInt;
 
 public final class FallbackPacketDecoder extends ChannelInboundHandlerAdapter {
-  private final FallbackUser<?, ?> user;
+  private final FallbackUser user;
   private final FallbackPacketListener listener;
   private FallbackPacketRegistry.ProtocolRegistry registry;
 
-  public FallbackPacketDecoder(final @NotNull FallbackUser<?, ?> user,
+  public FallbackPacketDecoder(final @NotNull FallbackUser user,
                                final @NotNull FallbackPacketListener listener) {
     this.user = user;
     this.listener = listener;

sonar-common/src/main/java/xyz/jonesdev/sonar/common/fallback/protocol/FallbackPacketEncoder.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-common/src/main/java/xyz/jonesdev/sonar/common/fallback/protocol/FallbackPacketListener.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-common/src/main/java/xyz/jonesdev/sonar/common/fallback/protocol/FallbackPacketRegistry.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-common/src/main/java/xyz/jonesdev/sonar/common/fallback/protocol/FallbackPreparer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -69,6 +69,7 @@ public class FallbackPreparer {
 
   // Blocks
   private final ChangedBlock[] CHANGED_BLOCKS = new ChangedBlock[BLOCKS_PER_ROW * BLOCKS_PER_ROW];
+  public BlockType blockType = BlockType.BARRIER;
 
   public int maxMovementTick, dynamicSpawnYPosition;
   public double[] preparedCachedYMotions;
@@ -109,7 +110,7 @@ public class FallbackPreparer {
           DEFAULT_Y_COLLIDE_POSITION,
           z + (BLOCKS_PER_ROW / 2),
           0, 0);
-        CHANGED_BLOCKS[index++] = new ChangedBlock(position, BlockType.BARRIER);
+        CHANGED_BLOCKS[index++] = new ChangedBlock(position, blockType);
       }
     }
 

sonar-common/src/main/java/xyz/jonesdev/sonar/common/fallback/protocol/block/BlockPosition.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-common/src/main/java/xyz/jonesdev/sonar/common/fallback/protocol/block/BlockType.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -17,6 +17,7 @@
 
 package xyz.jonesdev.sonar.common.fallback.protocol.block;
 
+import lombok.Getter;
 import lombok.RequiredArgsConstructor;
 import org.jetbrains.annotations.NotNull;
 import xyz.jonesdev.sonar.api.fallback.protocol.ProtocolVersion;
@@ -26,7 +27,7 @@ import java.util.function.Function;
 @SuppressWarnings("unused")
 @RequiredArgsConstructor
 public enum BlockType {
-  STONE(protocolVersion -> 1),
+  STONE(protocolVersion -> 1, 1D),
   BARRIER(protocolVersion -> {
     // Useful resources:
     // - https://github.com/PrismarineJS/minecraft-data/blob/master/data/pc/
@@ -79,11 +80,14 @@ public enum BlockType {
       case MINECRAFT_1_20_3:
         return 10366;
     }
-  });
+  }, 1D);
 
-  private final Function<ProtocolVersion, Integer> function;
+  private final Function<ProtocolVersion, Integer> idFunction;
+  // TODO: Implement per-version block heights?
+  @Getter
+  private final double blockHeight;
 
   public int getId(final @NotNull ProtocolVersion protocolVersion) {
-    return function.apply(protocolVersion);
+    return idFunction.apply(protocolVersion);
   }
 }

sonar-common/src/main/java/xyz/jonesdev/sonar/common/fallback/protocol/block/ChangedBlock.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-common/src/main/java/xyz/jonesdev/sonar/common/fallback/protocol/dimension/DimensionInfo.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-common/src/main/java/xyz/jonesdev/sonar/common/fallback/protocol/dimension/DimensionRegistry.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -61,7 +61,7 @@ public final class DimensionRegistry {
   }
 
   private @NotNull CompoundBinaryTag getCodec(final @NotNull String fileName) {
-    try (final InputStream inputStream = Sonar.class.getResourceAsStream("/codecs/" + fileName)) {
+    try (final InputStream inputStream = Sonar.class.getResourceAsStream("/assets/codecs/" + fileName)) {
       return BinaryTagIO.reader().read(Objects.requireNonNull(inputStream), BinaryTagIO.Compression.GZIP);
     } catch (Throwable throwable) {
       Sonar.get().getLogger().error("Could not load mappings for {}: {}", fileName, throwable);

sonar-common/src/main/java/xyz/jonesdev/sonar/common/fallback/protocol/map/ItemMapType.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-common/src/main/java/xyz/jonesdev/sonar/common/fallback/protocol/map/MapInfo.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by

sonar-common/src/main/java/xyz/jonesdev/sonar/common/fallback/protocol/map/MapInfoPreparer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2023 Sonar Contributors
+ * Copyright (C) 2023-2024 Sonar Contributors
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -222,7 +222,8 @@ public class MapInfoPreparer {
               final int index = y * image.getWidth() + x;
               if (pixel == -16777216 && RANDOM.nextInt(100) < 97) continue;
               // Set color of pixel to random color from the palette
-              final byte color = (byte) (pixel == -16777216 ? RANDOM.nextInt(100) < 75 ? 14 : RANDOM.nextInt(Byte.MAX_VALUE)
+              final byte color = (byte) (pixel == -16777216 ? RANDOM.nextInt(100) < 75 ? 14 :
+                RANDOM.nextInt(Byte.MAX_VALUE)
                 : pixel != -65536 ? colorPalette[RANDOM.nextInt(colorPalette.length)]
                 : nextColorPalette[RANDOM.nextInt(nextColorPalette.length)]);
               // Write pixel color to buffer