Add network security: rate limiting, connection limits, monitor auth

Author: kwsantiago

src/core/CNProtocol.cpp

@@ -2,6 +2,9 @@
 #include "CNStructs.hpp"
 
 #include <assert.h>
+#include <map>
+
+static std::map<uint32_t, int> connectionsPerIP;
 
 // ========================================================[[ CNSocketEncryption ]]========================================================
 
@@ -462,6 +465,21 @@ void CNServer::start() {
                 if (!setSockNonblocking(sock, newConnectionSocket))
                     continue;
 
+                uint32_t connIP = address.sin_addr.s_addr;
+                auto ipIt = connectionsPerIP.find(connIP);
+                if (settings::MAXPERIP > 0 && ipIt != connectionsPerIP.end() && ipIt->second >= settings::MAXPERIP) {
+                    std::cout << "[WARN] Rejecting connection from " << inet_ntoa(address.sin_addr) << " (too many connections)" << std::endl;
+#ifdef _WIN32
+                    shutdown(newConnectionSocket, SD_BOTH);
+                    closesocket(newConnectionSocket);
+#else
+                    shutdown(newConnectionSocket, SHUT_RDWR);
+                    close(newConnectionSocket);
+#endif
+                    continue;
+                }
+                connectionsPerIP[connIP]++;
+
                 std::cout << "New " << serverType << " connection! " << inet_ntoa(address.sin_addr) << std::endl;
 
                 addPollFD(newConnectionSocket);
@@ -507,6 +525,10 @@ void CNServer::start() {
             CNSocket *cSock = it->second;
 
             if (!cSock->isAlive()) {
+                uint32_t deadIP = cSock->sockaddr.sin_addr.s_addr;
+                if (connectionsPerIP.count(deadIP) && --connectionsPerIP[deadIP] <= 0)
+                    connectionsPerIP.erase(deadIP);
+
                 killConnection(cSock);
                 it = connections.erase(it);
 

src/servers/CNLoginServer.cpp

@@ -13,6 +13,52 @@
 
 std::map<CNSocket*, CNLoginData> CNLoginServer::loginSessions;
 
+struct LoginAttempt {
+    int failCount;
+    time_t firstFail;
+    time_t blockedUntil;
+};
+static std::map<uint32_t, LoginAttempt> loginAttempts;
+
+static bool isLoginRateLimited(uint32_t ip) {
+    if (settings::LOGINRATELIMIT <= 0)
+        return false;
+
+    auto it = loginAttempts.find(ip);
+    if (it == loginAttempts.end())
+        return false;
+
+    time_t now = getTime();
+    if (it->second.blockedUntil > now)
+        return true;
+
+    // reset if window expired
+    if (now - it->second.firstFail > 60000) {
+        loginAttempts.erase(it);
+        return false;
+    }
+
+    return false;
+}
+
+static void recordLoginFailure(uint32_t ip) {
+    if (settings::LOGINRATELIMIT <= 0)
+        return;
+
+    time_t now = getTime();
+    auto it = loginAttempts.find(ip);
+    if (it == loginAttempts.end() || now - it->second.firstFail > 60000) {
+        loginAttempts[ip] = { 1, now, 0 };
+        return;
+    }
+
+    it->second.failCount++;
+    if (it->second.failCount >= settings::LOGINRATELIMIT) {
+        it->second.blockedUntil = now + 60000;
+        std::cout << "[WARN] Rate limiting login attempts from IP" << std::endl;
+    }
+}
+
 namespace LoginServer {
     std::vector<std::string> WheelFirstNames;
     std::vector<std::string> WheelMiddleNames;
@@ -113,6 +159,12 @@ void loginFail(LoginError errorCode, std::string userLogin, CNSocket* sock) {
 void CNLoginServer::login(CNSocket* sock, CNPacketData* data) {
     auto login = (sP_CL2LS_REQ_LOGIN*)data->buf;
 
+    uint32_t ip = sock->sockaddr.sin_addr.s_addr;
+    if (isLoginRateLimited(ip)) {
+        loginFail(LoginError::LOGIN_ERROR, "", sock);
+        return;
+    }
+
     std::string userLogin;
     std::string userToken; // could be password or auth cookie
 
@@ -159,11 +211,13 @@ void CNLoginServer::login(CNSocket* sock, CNPacketData* data) {
             return newAccount(sock, userLogin, userToken, login->iClientVerC);
         }
 
+        recordLoginFailure(ip);
         return loginFail(LoginError::ID_DOESNT_EXIST, userLogin, sock);
     }
 
     // make sure either a valid cookie or password was sent
     if (!CNLoginServer::checkToken(sock, findUser, userToken, isCookieAuth)) {
+        recordLoginFailure(ip);
         return loginFail(LoginError::ID_AND_PASSWORD_DO_NOT_MATCH, userLogin, sock);
     }
 

src/servers/Monitor.cpp

@@ -8,10 +8,12 @@
 #include "settings.hpp"
 
 #include <cstdio>
+#include <set>
 
 static SOCKET listener;
 static std::mutex sockLock; // guards socket list
 static std::list<SOCKET> sockets;
+static std::set<SOCKET> pendingAuth; // sockets that haven't authenticated yet
 static sockaddr_in address;
 
 std::vector<std::string> Monitor::chats;
@@ -21,28 +23,33 @@ std::vector<std::string> Monitor::namereqs;
 
 using namespace Monitor;
 
+static void closeSock(SOCKET sock) {
+#ifdef _WIN32
+    shutdown(sock, SD_BOTH);
+    closesocket(sock);
+#else
+    shutdown(sock, SHUT_RDWR);
+    close(sock);
+#endif
+}
+
 static bool transmit(std::list<SOCKET>::iterator& it, char *buff, int len) {
     int n = 0;
     int sock = *it;
 
     while (n < len) {
-        n += send(sock, buff+n, len-n, 0);
-        if (SOCKETERROR(n)) {
+        int ret = send(sock, buff+n, len-n, 0);
+        if (SOCKETERROR(ret)) {
             printSocketError("send");
 
-#ifdef _WIN32
-            shutdown(sock, SD_BOTH);
-            closesocket(sock);
-#else
-            shutdown(sock, SHUT_RDWR);
-            close(sock);
-#endif
+            closeSock(sock);
 
             std::cout << "[INFO] Disconnected a monitor" << std::endl;
 
             it = sockets.erase(it);
             return false;
         }
+        n += ret;
     }
 
     return true;
@@ -67,7 +74,7 @@ static int process_email(char *buff, std::string email) {
     int i = 6;
 
     for (char c : email) {
-        if (i == BUFSIZE-2)
+        if (i >= BUFSIZE-3)
             break;
 
         buff[i++] = c;
@@ -86,6 +93,38 @@ static void tick(CNServer *serv, time_t delta) {
     char buff[BUFSIZE];
     int n;
 
+    // check pending auth sockets for incoming password
+    for (auto it = pendingAuth.begin(); it != pendingAuth.end(); ) {
+        SOCKET s = *it;
+        char authbuf[256] = {};
+        int recved = recv(s, authbuf, sizeof(authbuf) - 1, 0);
+        if (recved > 0) {
+            // strip trailing newline/whitespace
+            std::string pass(authbuf, recved);
+            while (!pass.empty() && (pass.back() == '\n' || pass.back() == '\r' || pass.back() == ' '))
+                pass.pop_back();
+            if (timingSafeStrcmp(pass.c_str(), settings::MONITORPASS.c_str()) == 0) {
+                sockets.push_back(s);
+                std::cout << "[INFO] Monitor client authenticated" << std::endl;
+            } else {
+                std::cout << "[WARN] Monitor client failed authentication" << std::endl;
+                closeSock(s);
+            }
+            it = pendingAuth.erase(it);
+        } else if (recved == 0) {
+            closeSock(s);
+            it = pendingAuth.erase(it);
+        } else {
+            // EWOULDBLOCK is fine, just wait
+            if (OF_ERRNO != OF_EWOULD) {
+                closeSock(s);
+                it = pendingAuth.erase(it);
+            } else {
+                ++it;
+            }
+        }
+    }
+
     auto it = sockets.begin();
 outer:
     while (it != sockets.end()) {
@@ -179,7 +218,11 @@ bool Monitor::acceptConnection(SOCKET fd, uint16_t revents) {
     {
         std::lock_guard<std::mutex> lock(sockLock);
 
-        sockets.push_back(sock);
+        if (settings::MONITORPASS.empty()) {
+            sockets.push_back(sock);
+        } else {
+            pendingAuth.insert(sock);
+        }
     }
 
     return true;

src/settings.cpp

@@ -14,7 +14,7 @@ std::string settings::SANDBOXEXTRAPATH = "";
 int settings::LOGINPORT = 23000;
 bool settings::APPROVEWHEELNAMES = true;
 bool settings::APPROVECUSTOMNAMES = true;
-bool settings::AUTOCREATEACCOUNTS = true;
+bool settings::AUTOCREATEACCOUNTS = false;
 std::string settings::AUTHMETHODS = "password";
 int settings::DBSAVEINTERVAL = 240;
 
@@ -77,6 +77,15 @@ bool settings::IZRACESCORECAPPED = true;
 // drop fixes enabled
 bool settings::DROPFIXESENABLED = false;
 
+// monitor auth
+std::string settings::MONITORPASS = "";
+
+// per-IP connection limit
+int settings::MAXPERIP = 5;
+
+// login rate limit (max failed attempts per 60s)
+int settings::LOGINRATELIMIT = 5;
+
 void settings::init() {
     INIReader reader("config.ini");
 
@@ -130,6 +139,9 @@ void settings::init() {
     MONITORPORT = reader.GetInteger("monitor", "port", MONITORPORT);
     MONITORLISTENIP = reader.Get("monitor", "listenip", MONITORLISTENIP);
     MONITORINTERVAL = reader.GetInteger("monitor", "interval", MONITORINTERVAL);
+    MONITORPASS = reader.Get("monitor", "password", MONITORPASS);
+    MAXPERIP = reader.GetInteger("shard", "maxperip", MAXPERIP);
+    LOGINRATELIMIT = reader.GetInteger("login", "ratelimit", LOGINRATELIMIT);
 
     if (DROPFIXESENABLED) {
         std::cout << "[INFO] Drop fixes enabled" << std::endl;

src/settings.hpp

@@ -46,6 +46,9 @@ namespace settings {
     extern bool DISABLEFIRSTUSEFLAG;
     extern bool IZRACESCORECAPPED;
     extern bool DROPFIXESENABLED;
+    extern std::string MONITORPASS;
+    extern int MAXPERIP;
+    extern int LOGINRATELIMIT;
 
     void init();
 }