warrentyexpired/ModernUO
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

feat: Moves TcpServer to another thread. Rewrites Firewall (#1660)

Browse source 
## Breaking Changes
* The Firewall and IP Limiter have been rewritten. Please read the notes carefully!
* `TcpServer.Instances` moved back to `NetState.Instances` - sorry - it was stupid to move it to begin with.

> [!Note]
> Sockets that fail the IP Limiter or Firewall will be immediately and forcibly disconnected.
> This means they will be stuck at "Verifying account..." if it was a real client.

### Summary
- Removes firewall wildcard support.
- Removes `AccessRestrictions`.
- Moves Firewall/IPLimiter to the core.
- Moves `TcpServer` to its own thread.
- Removes the `SocketConnect` and `SocketDisconnect` event sinks.
- Moves `Instances` back to `NetState.Instances`.
- Fixes a long standing bug with bad handling of duplicate listener addresses.

#### Firewall
The firewall has been completely rewritten. There is now an "Admin Firewall" which saves to the config file. Secondarily, there is an internal firewall used exclusively by the TcpServer while processing sockets. The Admin firewall mirrors it's additions/deletions to the internal firewall by adding requests to a queue.

> [!IMPORTANT]  
> **Wildcard firewall entries, such as `X`, `*`, `?` are not allowed.**
> **Ranges in between IP classes or sextets are not allowed.**
> **Please make sure to use one of the following:**
> * IP Address - `192.168.1.1`
> * CIDR - `192.168.1.0/24`
> * Range - `192.168.1.1-192.168.1.100`

#### IP Limiter
The IP Limiter has been completely rewritten. The available configurations are:
```json
"ipLimiter.enable": "True",
"ipLimiter.maxConnectionsPerIP": 10,
"ipLimiter.clearConnectionAttemptsDuration": "00:00:00:10",
"ipLimiter.clearThrottledDuration": "00:00:02:00",
```

The IP Limiter is set up to prevent spamming connections from the same IP. Every time an IP connects, it is added to a connection list. After 10 attempts, the IP is added to the throttle list. To keep the system fast, the connection list is entirely wiped every 10 seconds, and the throttle list is entirely wiped every 2 minutes.
This commit is contained in:
Kamron Batman 2024-01-20 14:25:12 -08:00 • committed by GitHub
parent 5f3de6537b
commit 4cd668ef61
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
38 changed files with 1117 additions and 1030 deletions
Download patch file Download diff file Expand all files Collapse all files

483
Projects/Server/Utilities/Utility.cs
View file

@ -5,6 +5,7 @@ using System.Globalization;
using System.IO;
using System.Net;
using System.Net.Sockets;
using System.Numerics;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Text;
@ -158,408 +159,128 @@ public static class Utility
}
[MethodImpl(MethodImplOptions.AggressiveInlining)]
public static uint IPv4ToAddress(IPAddress ipAddress)
public static void ApplyCidrMask(ref ulong high, ref ulong low, int prefixLength, bool isMax)
{
if (ipAddress.IsIPv4MappedToIPv6)
// This should never happen, a 0 CIDR is not valid
if (prefixLength == 0)
{
ipAddress = ipAddress.MapToIPv4();
high = low = ~0UL;
return;
}
else if (ipAddress.AddressFamily == AddressFamily.InterNetworkV6)
if (prefixLength == 128)
{
return;
}
if (prefixLength == 64)
{
low = 0;
return;
}
if (prefixLength < 64)
{
int bitsToFlip = 64 - prefixLength;
ulong highMask = isMax ? ~0UL >> bitsToFlip : ~0UL << (bitsToFlip + 1);
high = isMax ? high | highMask : high & highMask;
low = isMax ? ~0UL : 0UL;
}
else
{
int bitsToFlip = 128 - prefixLength;
ulong lowMask = isMax ? ~0UL >> (64 - bitsToFlip) : ~0UL << bitsToFlip;
low = isMax ? low | lowMask : low & lowMask;
}
}
// Converts an IPAddress to a UInt128 in IPv6 format
public static UInt128 ToUInt128(this IPAddress ip)
{
if (ip.AddressFamily == AddressFamily.InterNetwork && !ip.IsIPv4MappedToIPv6)
{
Span<byte> integer = stackalloc byte[4];
return !ip.TryWriteBytes(integer, out _)
? (UInt128)0
: new UInt128(0, 0xFFFF00000000UL | BinaryPrimitives.ReadUInt32BigEndian(integer));
}
Span<byte> bytes = stackalloc byte[16];
if (!ip.TryWriteBytes(bytes, out _))
{
return 0;
}
Span<byte> integer = stackalloc byte[4];
ipAddress.TryWriteBytes(integer, out var bytesWritten);
return bytesWritten != 4 ? 0 : BinaryPrimitives.ReadUInt32BigEndian(integer);
ulong high = BinaryPrimitives.ReadUInt64BigEndian(bytes[..8]);
ulong low = BinaryPrimitives.ReadUInt64BigEndian(bytes.Slice(8, 8));
return new UInt128(high, low);
}
public static bool IPMatchClassC(IPAddress ip1, IPAddress ip2)
// Converts a UInt128 in IPv6 format to an IPAddress
public static IPAddress ToIpAddress(this UInt128 value, bool mapToIpv6 = false)
{
var a = IPv4ToAddress(ip1);
var b = IPv4ToAddress(ip2);
return a == 0 || b == 0 ? ip1.Equals(ip2) : (a & 0xFFFFFF) == (b & 0xFFFFFF);
}
public static bool IPMatchCIDR(IPAddress cidrAddress, IPAddress address, int cidrLength)
{
if (cidrAddress.AddressFamily == AddressFamily.InterNetwork)
// IPv4 mapped IPv6 address
if (!mapToIpv6 && value >= 0xFFFF00000000UL && value <= 0xFFFFFFFFFFFFUL)
{
if (address.AddressFamily == AddressFamily.InterNetworkV6)
{
return false;
}
cidrLength += 96;
var newAddress = IPAddress.HostToNetworkOrder((int)value);
return new IPAddress(unchecked((uint)newAddress));
}
cidrAddress = cidrAddress.MapToIPv6();
address = address.MapToIPv6();
Span<byte> bytes = stackalloc byte[16]; // 128 bits for IPv6 address
((IBinaryInteger<UInt128>)value).WriteBigEndian(bytes);
cidrLength = Math.Clamp(cidrLength, 0, 128);
return new IPAddress(bytes);
}
[MethodImpl(MethodImplOptions.AggressiveInlining)]
public static UInt128 CreateCidrAddress(ReadOnlySpan<byte> bytes, int prefixLength, bool isMax)
{
ulong high = BinaryPrimitives.ReadUInt64BigEndian(bytes[..8]);
ulong low = BinaryPrimitives.ReadUInt64BigEndian(bytes.Slice(8, 8));
if (prefixLength < 128)
{
ApplyCidrMask(ref high, ref low, prefixLength, isMax);
}
return new UInt128(high, low);
}
[MethodImpl(MethodImplOptions.AggressiveInlining)]
public static void WriteMappedIPv6To(this IPAddress ipAddress, Span<byte> destination)
{
if (ipAddress.AddressFamily == AddressFamily.InterNetworkV6)
{
ipAddress.TryWriteBytes(destination, out _);
return;
}
destination[..8].Clear(); // Local init is off
BinaryPrimitives.WriteUInt32BigEndian(destination.Slice(8, 4), 0xFFFF);
ipAddress.TryWriteBytes(destination.Slice(12, 4), out _);
}
[MethodImpl(MethodImplOptions.AggressiveInlining)]
public static bool MatchClassC(this IPAddress ip1, IPAddress ip2) => ip1.MatchCidr(24, ip2);
public static bool MatchCidr(this IPAddress cidrAddress, int prefixLength, IPAddress address)
{
Span<byte> cidrBytes = stackalloc byte[16];
cidrAddress.TryWriteBytes(cidrBytes, out var _);
cidrAddress.WriteMappedIPv6To(cidrBytes);
Span<byte> addrBytes = stackalloc byte[16];
address.TryWriteBytes(addrBytes, out var _);
var i = 0;
int offset;
if (cidrLength < 32)
if (cidrAddress.AddressFamily != AddressFamily.InterNetworkV6)
{
offset = cidrLength;
}
else
{
var index = Math.DivRem(cidrLength, 32, out offset);
while (index > 0)
{
if (
BinaryPrimitives.ReadInt32BigEndian(cidrBytes.Slice(i, 4)) !=
BinaryPrimitives.ReadInt32BigEndian(addrBytes.Slice(i, 4))
)
{
return false;
}
i += 4;
--index;
}
prefixLength += 96; // 32 -> 128
}
if (offset == 0)
{
return true;
}
var min = CreateCidrAddress(cidrBytes, prefixLength, false);
var max = CreateCidrAddress(cidrBytes, prefixLength, true);
var ip = address.ToUInt128();
var c = BinaryPrimitives.ReadInt32BigEndian(cidrBytes.Slice(i, 4));
var a = BinaryPrimitives.ReadInt32BigEndian(addrBytes.Slice(i, 4));
var mask = (1 << (32 - offset)) - 1;
var min = ~mask & c;
var max = c | mask;
return a >= min && a <= max;
}
public static bool IsValidIP(string val) => IPMatch(val, IPAddress.Any, out var valid) || valid;
public static bool IPMatch(string val, IPAddress ip) => IPMatch(val, ip, out _);
public static bool IPMatch(string val, IPAddress ip, out bool valid)
{
var family = ip.AddressFamily;
var useIPv6 = family == AddressFamily.InterNetworkV6 || val.ContainsOrdinal(':');
ip = useIPv6 ? ip.MapToIPv6() : ip.MapToIPv4();
Span<byte> ipBytes = stackalloc byte[useIPv6 ? 16 : 4];
ip.TryWriteBytes(ipBytes, out _);
return useIPv6 ? IPv6Match(val, ipBytes, out valid) : IPv4Match(val, ipBytes, out valid);
}
public static bool IPv4Match(ReadOnlySpan<char> val, ReadOnlySpan<byte> ip, out bool valid)
{
var match = true;
valid = true;
var end = val.Length;
var byteIndex = 0;
var section = 0;
var number = 0;
var isRange = false;
var intBase = 10;
var endOfSection = false;
var sectionStart = 0;
var num = ip[byteIndex++];
for (var i = 0; i < end; i++)
{
var chr = val[i];
if (section >= 4)
{
valid = false;
return false;
}
switch (chr)
{
default:
{
if (!Uri.IsHexDigit(chr))
{
valid = false;
return false;
}
number = number * intBase + Uri.FromHex(chr);
break;
}
case 'x':
case 'X':
{
if (i == sectionStart)
{
intBase = 16;
break;
}
valid = false;
return false;
}
case '-':
{
if (i == sectionStart || i + 1 == end || val[i + 1] == '.')
{
valid = false;
return false;
}
// Only allows a single range in a section
if (isRange)
{
valid = false;
return false;
}
isRange = true;
match = match && num >= number;
number = 0;
break;
}
case '*':
{
if (i != sectionStart || i + 1 < end && val[i + 1] != '.')
{
valid = false;
return false;
}
isRange = true;
number = 255;
break;
}
case '.':
{
endOfSection = true;
break;
}
}
if (endOfSection || i + 1 == end)
{
if (number is < 0 or > 255)
{
valid = false;
return false;
}
match = match && (isRange ? num <= number : number == num);
if (++section < 4)
{
num = ip[byteIndex++];
}
intBase = 10;
number = 0;
endOfSection = false;
sectionStart = i + 1;
isRange = false;
}
}
return match;
}
public static bool IPv6Match(ReadOnlySpan<char> val, ReadOnlySpan<byte> ip, out bool valid)
{
valid = true;
// Start must be two `::` or a number
if (val[0] == ':' && val[1] != ':')
{
valid = false;
return false;
}
var match = true;
var end = val.Length;
var byteIndex = 2;
var section = 0;
var number = 0;
var isRange = false;
var endOfSection = false;
var sectionStart = 0;
var hasCompressor = false;
var num = BinaryPrimitives.ReadUInt16BigEndian(ip[..2]);
for (int i = 0; i < end; i++)
{
if (section > 7)
{
valid = false;
return false;
}
var chr = val[i];
// We are starting a new sequence, check the previous one then continue
switch (chr)
{
default:
{
if (!Uri.IsHexDigit(chr))
{
valid = false;
return false;
}
number = number * 16 + Uri.FromHex(chr);
break;
}
case '?':
{
logger.Debug("IP Match '?' character is not supported.");
valid = false;
return false;
}
// Range
case '-':
{
if (i == sectionStart || i + 1 == end || val[i + 1] == ':')
{
valid = false;
return false;
}
// Only allows a single range in a section
if (isRange)
{
valid = false;
return false;
}
isRange = true;
// Check low part of the range
match = match && num >= number;
number = 0;
break;
}
// Wild section
case '*':
{
if (i != sectionStart || i + 1 < end && val[i + 1] != ':')
{
valid = false;
return false;
}
isRange = true;
number = 65535;
break;
}
case ':':
{
endOfSection = true;
break;
}
}
if (!endOfSection && i + 1 != end)
{
continue;
}
if (++i == end || val[i] != ':' || section > 0)
{
match = match && (isRange ? num <= number : number == num);
// IPv4 matching at the end
if (section == 6 && num == 0xFFFF)
{
var ipv4 = val[(i + 1)..];
if (ipv4.Contains('.'))
{
return IPv4Match(ipv4, ip[^4..], out valid);
}
}
if (i == end)
{
break;
}
num = BinaryPrimitives.ReadUInt16BigEndian(ip.Slice(byteIndex, 2));
byteIndex += 2;
++section;
}
if (i < end && val[i] == ':')
{
if (hasCompressor)
{
valid = false;
return false;
}
int newSection;
if (i + 1 < end)
{
var remainingColons = val[(i + 1)..].Count(':');
// double colon must be at least 2 sections
// we need at least 1 section remaining out of 8
// This means 8 - 2 would be 6 sections (5 colons)
newSection = section + 2 + (5 - remainingColons);
if (newSection > 7)
{
valid = false;
return false;
}
}
else
{
newSection = 7;
}
var zeroEnd = (newSection + 1) * 2;
do
{
if (match)
{
if (num != 0)
{
match = false;
}
num = BinaryPrimitives.ReadUInt16BigEndian(ip.Slice(byteIndex, 2));
}
byteIndex += 2;
} while (byteIndex < zeroEnd);
section = newSection;
hasCompressor = true;
}
else
{
i--;
}
number = 0;
endOfSection = false;
sectionStart = i + 1;
isRange = false;
}
return match;
return ip >= min && ip <= max;
}
public static string FixHtml(string str)