warrentyexpired/ModernUO
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: Moves TcpServer to another thread. Rewrites Firewall (#1660)

Browse source 
## Breaking Changes
* The Firewall and IP Limiter have been rewritten. Please read the notes carefully!
* `TcpServer.Instances` moved back to `NetState.Instances` - sorry - it was stupid to move it to begin with.

> [!Note]
> Sockets that fail the IP Limiter or Firewall will be immediately and forcibly disconnected.
> This means they will be stuck at "Verifying account..." if it was a real client.

### Summary
- Removes firewall wildcard support.
- Removes `AccessRestrictions`.
- Moves Firewall/IPLimiter to the core.
- Moves `TcpServer` to its own thread.
- Removes the `SocketConnect` and `SocketDisconnect` event sinks.
- Moves `Instances` back to `NetState.Instances`.
- Fixes a long standing bug with bad handling of duplicate listener addresses.

#### Firewall
The firewall has been completely rewritten. There is now an "Admin Firewall" which saves to the config file. Secondarily, there is an internal firewall used exclusively by the TcpServer while processing sockets. The Admin firewall mirrors it's additions/deletions to the internal firewall by adding requests to a queue.

> [!IMPORTANT]  
> **Wildcard firewall entries, such as `X`, `*`, `?` are not allowed.**
> **Ranges in between IP classes or sextets are not allowed.**
> **Please make sure to use one of the following:**
> * IP Address - `192.168.1.1`
> * CIDR - `192.168.1.0/24`
> * Range - `192.168.1.1-192.168.1.100`

#### IP Limiter
The IP Limiter has been completely rewritten. The available configurations are:
```json
"ipLimiter.enable": "True",
"ipLimiter.maxConnectionsPerIP": 10,
"ipLimiter.clearConnectionAttemptsDuration": "00:00:00:10",
"ipLimiter.clearThrottledDuration": "00:00:02:00",
```

The IP Limiter is set up to prevent spamming connections from the same IP. Every time an IP connects, it is added to a connection list. After 10 attempts, the IP is added to the throttle list. To keep the system fast, the connection list is entirely wiped every 10 seconds, and the throttle list is entirely wiped every 2 minutes.
This commit is contained in:
Kamron Batman 2024-01-20 14:25:12 -08:00 • committed by GitHub
parent 5f3de6537b
commit 4cd668ef61
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
38 changed files with 1117 additions and 1030 deletions
Download patch file Download diff file Expand all files Collapse all files

61
Projects/Server/Network/PingServer.cs
View file

@ -1,7 +1,23 @@
/*************************************************************************
* ModernUO *
* Copyright 2019-2024 - ModernUO Development Team *
* Email: hi@modernuo.com *
* File: PingServer.cs *
* *
* This program is free software: you can redistribute it and/or modify *
* it under the terms of the GNU General Public License as published by *
* the Free Software Foundation, either version 3 of the License, or *
* (at your option) any later version. *
* *
* You should have received a copy of the GNU General Public License *
* along with this program. If not, see <http://www.gnu.org/licenses/>. *
*************************************************************************/
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.Net;
using System.Net.Sockets;
using System.Threading.Tasks;
using Server.Logging;
namespace Server.Network;
@ -10,14 +26,11 @@ public static class PingServer
{
private static readonly ILogger logger = LogFactory.GetLogger(typeof(PingServer));
private const int MaxConnectionsPerLoop = 250;
private const int MaxConnectionsPerLoop = 128;
private const long _listenerErrorMessageDelay = 10000; // 10 seconds
private static long _nextMaximumSocketsReachedMessage;
public static int MaxQueued { get; set; }
public static int MaxConnections { get; set; }
private static ConcurrentQueue<(UdpClient, UdpReceiveResult)> _udpResponseQueue = new();
private static readonly ConcurrentQueue<(UdpClient, UdpReceiveResult)> _udpResponseQueue = new();
public static UdpClient[] Listeners { get; private set; }
@ -29,7 +42,7 @@ public static class PingServer
{
Enabled = ServerConfiguration.GetOrUpdateSetting("pingServer.enabled", true);
Port = ServerConfiguration.GetSetting("pingServer.port", 12000);
MaxConnections = ServerConfiguration.GetSetting("pingServer.maxConnections", 2048);
MaxQueued = ServerConfiguration.GetSetting("pingServer.maxConnections", 2048);
}
public static void Start()
@ -44,6 +57,7 @@ public static class PingServer
foreach (var serverIpep in ServerConfiguration.Listeners)
{
var cancellationToken = Core.ClosingTokenSource.Token;
var ipep = new IPEndPoint(serverIpep.Address, Port);
var listener = CreateListener(ipep);
@ -62,7 +76,7 @@ public static class PingServer
}
listeners.Add(listener);
BeginAcceptingSockets(listener);
Task.Run(() => BeginAcceptingUdpRequest(listener), cancellationToken).ConfigureAwait(false);
}
foreach (var ipep in listeningAddresses)
@ -126,36 +140,21 @@ public static class PingServer
return null;
}
private static async void BeginAcceptingSockets(UdpClient listener)
private static async void BeginAcceptingUdpRequest(UdpClient listener)
{
while (true)
{
if (!Enabled || Core.Closing)
{
return;
}
var cancellationToken = Core.ClosingTokenSource.Token;
while (!cancellationToken.IsCancellationRequested)
{
try
{
var result = await listener.ReceiveAsync(Core.ClosingTokenSource.Token);
var result = await listener.ReceiveAsync(cancellationToken);
if (_udpResponseQueue.Count >= MaxConnections)
if (_udpResponseQueue.Count < MaxQueued)
{
var ticks = Core.TickCount;
if (ticks - _nextMaximumSocketsReachedMessage > 0)
{
if (listener.Client.RemoteEndPoint is IPEndPoint ipep)
{
var ip = ipep.Address.ToString();
logger.Warning("Ping Listener {Address}: Failed (Maximum connections reached)", ip);
}
_nextMaximumSocketsReachedMessage = ticks + _listenerErrorMessageDelay;
}
_udpResponseQueue.Enqueue((listener, result));
}
_udpResponseQueue.Enqueue((listener, result));
}
catch
{
@ -164,7 +163,7 @@ public static class PingServer
}
}
private static async void SendResponse(UdpClient listener, byte[] data, IPEndPoint ipep)
private static async Task SendResponse(UdpClient listener, byte[] data, IPEndPoint ipep)
{
try
{