Giter VIP home page Giter VIP logo

bungeeguard's Introduction

💂 BungeeGuard

BungeeGuard is a plugin-based security/firewall solution for BungeeCord (and Velocity) proxies.

The problem

BungeeCord installations are insecure by default, and require additional firewall rules to be configured (using iptables or otherwise) to prevent malicious users from bypassing the proxy and connecting using any uuid/username they choose.

This is a well-known issue, and over the years many (even large) servers have been successfully targeted using this attack.

The conventional solution

The conventional solution recommended by the BungeeCord author is to configure a firewall rule using iptables or ufw to prevent outside connections to the backend servers.

However, there are two main problems with this:

  1. Configuring these firewall rules is complicated, especially for inexperienced users.
    1. Even experienced users sometimes make mistakes or overlook things. Unless the setup is absolutely perfect, rules are prone to being broken during later changes, or reset on system reboot.
  2. Users on "shared hosting" do not have access to the underlying system and most likely cannot setup their own firewall rules.

The BungeeGuard solution

Server admins install BungeeGuard (just an ordinary plugin!) on their proxies and backend servers.

  • On the proxy, BungeeGuard adds a secret "authentication token" to the login handshake.
  • On the backend (Spigot etc. server), BungeeGuard checks login handshakes to ensure they contain an allowed authentication token.

It's really that simple.

Installation

Installation is very straightforward.

If you have access to the underlying system and are able to setup firewall rules using iptables (or otherwise), I strongly recommend you do so. Then, install BungeeGuard as well.

See INSTALLATION.md for a detailed install guide.

License

BungeeGuard is licensed and made available under the permissive MIT license. Please see LICENSE.txt for more information.

Details about vulnerability reporting & security disclosures can be found in SECURITY.md.

bungeeguard's People

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

bungeeguard's Issues

Important Question

I installed everything as it said but with LiquidBounce BungeeCord Spoof I can join directly to one of my backend servers.

Failed event register

This error happens in PaperSpigot 1.8.8-R0.1-SNAPSHOT ( git-PaperSpigot-"4c7641d" )

BungeeGuard is unable to register a event on PlayerHandshake because the class does not exist.

ERROR [BungeeGuard] Plugin BungeeGuard v1.0-SNAPSHOT has failed to register events for class me.lucko.bungeeguard.backend.BungeeGuardBackendPlugin because com/destroystokyo/paper/event/player/PlayerHandshakeEvent does not exist.

It seems that the class exists in more recent Paper versions, but I am unable to locate a more recent 1.8.8 release of PaperSpigot with the class.

Sponge Version

I understand this may be a lot to ask, but would it be possible for a sponge version?

Currently my players connect to a Waterfall proxy that will send them to the Pixelmon server or Paper servers depending on the version that the proxy detects them running. It also allows for things like synchronized tab lists.

This may be a niche sort of thing but it would be appreciated!

Installation Help

BungeeGuard is one plugin? I need install bungeeguard proxy on bungeecord server /plugins and bungeeguard backend on spigot servers /plugins ?

The token is generated automatically? Do I need to change it?

Is the same token generated for all servers or is a different one generated randomly for each server?

Could you briefly explain the installation? Thank you very much.

Unable to connect with 1.14.2

Using a 1.14.2 client I am unable to connect to a 1.14.2 server running Paper-65 1.14.2, Waterfall 1.14-SNAPSHOT:57a7f98:284, latest release (1.0-SNAPSHOT) of BungeeGuard-proxy and backend, and no other plugins.

Waterfall error:
[23:09:35 ERROR]: [USERNAME|/IP ADDRESS] <-> ServerConnector [dev] - encountered exception: net.md_5.bungee.util.QuietException: Unexpected packet received during server login process! 1aa2017b227472616e736c617465223a

Paper error:
[23:09:35 INFO]: /IP ADDRESS:PORT lost connection: Internal Exception: java.lang.IllegalStateException: PlayerHandshakeEvent may only be triggered synchronously.

Client error:
Exception Connecting:QuietException: Unexpected packet received during server login process! 1aa2017b227472616e736c617465223a

Can't get from one server to another w/ BungeeGuard installed

So, recently I started up a BungeeCord network and sought out BungeeGuard as the recommended plugin to help remediate BungeeCord's vulnerabilities; However, I stumbled across an issue I feel like I just don't see a solution to even though it's very likely there.

The proxy has BungeeGuard installed, and each of the servers connected to the proxy have it as well - alongside ProtocolLib and the token generated by the proxy in their respective config files. It works fine, but my issue arises when I try to switch to a different server after being connected to the default "hub" server.

It throws the "Unable to authenticate." message described in the config file for BungeeGuard, and the console reads the following:
Netty Epoll Server IO #3/WARN Denying connection from aef501dc-xxxx-xxxx-xxxx-xxxxxxxxxxxx @ x.x.x.x - (token) - reason: INCORRECT_TOKEN

(token) being the exact same one listed in the allowed-tokens part of BungeeCord's config file. So, what exactly am I missing? Can you connect to each server, or is there a different way I don't see? I'm kinda lost, here.

Cloudflare

Hello,

Since i putted cloudflare to my domain its not working anymore
I forwarded the cloudflare to my proxy adress (port: 25577). But when i want to connect it says: Unable to authentificate - no data was forwarded by the proxy

How should I fix this?

Can you implement Bungee Guard on only a few Backend servers?

Hello,

We have 3 backend servers (Lobby, Survival, Skyblock) and a proxy.

Proxy and Lobby are both in the same machine while survival and skyblock are on hosts.
Can we just implement Bungee Guard on Survival and Skyblock and don't implement in on Lobby?

Thanks in advance,
Regards.

Bungeeguard not working

So when i try to connect through my proxy, it says: Unable to authenticate - no data was forwarded by the proxy.

This is the error i get on my origin server: [17:52:31] Denying connection from 127.0.0.1 - - reason: INVALID_HANDSHAKE

I am using spigot 1.16.5 (3053-Spigot-4225eac-69c8e78) for my origin server. I can't use paper because it patches dupes that i need on my smp.

I am using Flamecord for my proxy.

Plugins on the proxy: none except BungeeGuard.
Plugins on the origin: AdvancedBan, EntityTrackerFixer, LoginPlus, FastAsyncWorldEdit (WorldEdit), ViewDistanceTweaks, AutoRestart, Essentials, SinglePlayerSleep, ABC, BungeeGuard, ProtocolLib, Orebfuscator

Error dispatching event LoginEvent console error spam

What's mean this error? It's only coming when we under attack.

BungeeGuard version: 1.2.2

[00:14:25] [pool-6-thread-119/WARN]: Error dispatching event LoginEvent(cancelled=false, cancelReasonComponents=null, loginResult=null, connection=[/ipaddress:56334|1] <-> InitialHandler) to listener me.lucko.bungeeguard.bungee.BungeeGuardProxyPlugin@1328f482
java.lang.RuntimeException: java.lang.reflect.InvocationTargetException
	at me.lucko.bungeeguard.bungee.SpoofedLoginResult.inject(SpoofedLoginResult.java:83) ~[?:?]
	at me.lucko.bungeeguard.bungee.BungeeGuardProxyPlugin.onLogin(BungeeGuardProxyPlugin.java:110) ~[?:?]
	at sun.reflect.GeneratedMethodAccessor59.invoke(Unknown Source) ~[?:?]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_292]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_292]
	at net.md_5.bungee.event.EventHandlerMethod.invoke(EventHandlerMethod.java:19) ~[proxy.jar:git:FlameCord-Bootstrap:1.17-R0.1-SNAPSHOT:ca8c6ed:unknown]
	at net.md_5.bungee.event.EventBus.post(EventBus.java:48) ~[proxy.jar:git:FlameCord-Bootstrap:1.17-R0.1-SNAPSHOT:ca8c6ed:unknown]
	at net.md_5.bungee.api.plugin.PluginManager.callEvent(PluginManager.java:510) ~[proxy.jar:git:FlameCord-Bootstrap:1.17-R0.1-SNAPSHOT:ca8c6ed:unknown]
	at net.md_5.bungee.connection.InitialHandler.finish(InitialHandler.java:621) ~[proxy.jar:git:FlameCord-Bootstrap:1.17-R0.1-SNAPSHOT:ca8c6ed:unknown]
	at net.md_5.bungee.connection.InitialHandler.access$800(InitialHandler.java:74) ~[proxy.jar:git:FlameCord-Bootstrap:1.17-R0.1-SNAPSHOT:ca8c6ed:unknown]
	at net.md_5.bungee.connection.InitialHandler$4.done(InitialHandler.java:452) ~[proxy.jar:git:FlameCord-Bootstrap:1.17-R0.1-SNAPSHOT:ca8c6ed:unknown]
	at net.md_5.bungee.connection.InitialHandler$4.done(InitialHandler.java:431) ~[proxy.jar:git:FlameCord-Bootstrap:1.17-R0.1-SNAPSHOT:ca8c6ed:unknown]
	at net.md_5.bungee.api.event.AsyncEvent.completeIntent(AsyncEvent.java:87) ~[proxy.jar:git:FlameCord-Bootstrap:1.17-R0.1-SNAPSHOT:ca8c6ed:unknown]
	at de.antibotdeluxe.blackhole.proxy.listener.PreLoginListener.lambda$onPreLogin$0(PreLoginListener.java:39) ~[?:?]
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) ~[?:1.8.0_292]
	at java.util.concurrent.FutureTask.run(FutureTask.java:266) ~[?:1.8.0_292]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) ~[?:1.8.0_292]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) ~[?:1.8.0_292]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_292]
Caused by: java.lang.reflect.InvocationTargetException
	at sun.reflect.GeneratedConstructorAccessor96.newInstance(Unknown Source) ~[?:?]
	at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:1.8.0_292]
	at java.lang.reflect.Constructor.newInstance(Constructor.java:423) ~[?:1.8.0_292]
	at me.lucko.bungeeguard.bungee.SpoofedLoginResult.inject(SpoofedLoginResult.java:80) ~[?:?]
	... 18 more
Caused by: java.lang.RuntimeException: getId called for offline variant of SpoofedLoginResult
	at me.lucko.bungeeguard.bungee.SpoofedLoginResult.getId(SpoofedLoginResult.java:126) ~[?:?]
	at me.lucko.bungeeguard.bungee.SpoofedLoginResultJava8.getId(SpoofedLoginResultJava8.java:30) ~[?:?]
	at me.lucko.bungeeguard.bungee.SpoofedLoginResult.<init>(SpoofedLoginResult.java:99) ~[?:?]
	at me.lucko.bungeeguard.bungee.SpoofedLoginResultJava8.<init>(SpoofedLoginResultJava8.java:36) ~[?:?]
	at sun.reflect.GeneratedConstructorAccessor96.newInstance(Unknown Source) ~[?:?]
	at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:1.8.0_292]
	at java.lang.reflect.Constructor.newInstance(Constructor.java:423) ~[?:1.8.0_292]
	at me.lucko.bungeeguard.bungee.SpoofedLoginResult.inject(SpoofedLoginResult.java:80) ~[?:?]
	... 18 more

BungeeGuard Proxy not sending token to backend

ver BungeeGuard�=> 
[08:32:34 INFO]: BungeeGuard version 1.0-SNAPSHOT
ver�=> 
[08:36:08 INFO]: This server is running Paper version git-Paper-418 (MC: 1.13.2) (Implementing API version 1.13.2-R0.1-SNAPSHOT)
[08:36:08 INFO]: Checking version, please wait...
[08:36:09 INFO]: You are 24 version(s) behind
[MC] Proxy
openjdk version "1.8.0_181"
OpenJDK Runtime Environment (IcedTea 3.9.0) (Alpine 8.181.13-r0)
OpenJDK 64-Bit Server VM (build 25.181-b13, mixed mode)
:/home/container$ java -Xms128M -Xmx2048M -jar bungeecord.jar
08:30:14 [INFO] Using mbed TLS based native cipher.
08:30:14 [INFO] Using zlib based native compressor.
08:30:14 [INFO] Enabled BungeeCord version git:BungeeCord-Bootstrap:1.13-SNAPSHOT:c26705e:1368
08:30:14 [INFO] Not on Windows, attempting to use enhanced EpollEventLoop
08:30:14 [INFO] Epoll is working, utilising it!
08:30:14 [INFO] Discovered module: ModuleSpec(name=cmd_alert, file=modules/cmd_alert.jar, provider=JenkinsModuleSource())
08:30:14 [INFO] Discovered module: ModuleSpec(name=cmd_find, file=modules/cmd_find.jar, provider=JenkinsModuleSource())
08:30:14 [INFO] Discovered module: ModuleSpec(name=cmd_list, file=modules/cmd_list.jar, provider=JenkinsModuleSource())
08:30:14 [INFO] Discovered module: ModuleSpec(name=cmd_send, file=modules/cmd_send.jar, provider=JenkinsModuleSource())
08:30:14 [INFO] Discovered module: ModuleSpec(name=cmd_server, file=modules/cmd_server.jar, provider=JenkinsModuleSource())
08:30:14 [INFO] Discovered module: ModuleSpec(name=reconnect_yaml, file=modules/reconnect_yaml.jar, provider=JenkinsModuleSource())
08:30:14 [INFO] Loaded plugin reconnect_yaml version git:reconnect_yaml:1.13-SNAPSHOT:c26705e:1368 by SpigotMC
08:30:14 [INFO] Loaded plugin cmd_find version git:cmd_find:1.13-SNAPSHOT:c26705e:1368 by SpigotMC
08:30:14 [INFO] Loaded plugin cmd_server version git:cmd_server:1.13-SNAPSHOT:c26705e:1368 by SpigotMC
08:30:14 [INFO] Loaded plugin cmd_alert version git:cmd_alert:1.13-SNAPSHOT:c26705e:1368 by SpigotMC
08:30:14 [INFO] Loaded plugin BungeeGuard version 1.0-SNAPSHOT by null
08:30:14 [INFO] Loaded plugin cmd_send version git:cmd_send:1.13-SNAPSHOT:c26705e:1368 by SpigotMC
08:30:14 [INFO] Loaded plugin cmd_list version git:cmd_list:1.13-SNAPSHOT:c26705e:1368 by SpigotMC
08:30:14 [INFO] Enabled plugin reconnect_yaml version git:reconnect_yaml:1.13-SNAPSHOT:c26705e:1368 by SpigotMC
08:30:14 [INFO] Enabled plugin cmd_find version git:cmd_find:1.13-SNAPSHOT:c26705e:1368 by SpigotMC
08:30:14 [INFO] Enabled plugin cmd_server version git:cmd_server:1.13-SNAPSHOT:c26705e:1368 by SpigotMC
08:30:14 [INFO] Enabled plugin cmd_alert version git:cmd_alert:1.13-SNAPSHOT:c26705e:1368 by SpigotMC
08:30:14 [INFO] Enabled plugin BungeeGuard version 1.0-SNAPSHOT by null
08:30:14 [INFO] Enabled plugin cmd_send version git:cmd_send:1.13-SNAPSHOT:c26705e:1368 by SpigotMC
08:30:14 [INFO] Enabled plugin cmd_list version git:cmd_list:1.13-SNAPSHOT:c26705e:1368 by SpigotMC
08:30:14 [INFO] Listening on /0.0.0.0:25565
08:30:14 [INFO] Started query on /0:0:0:0:0:0:0:0%0:25565
08:30:16 [INFO] [/162.225.180.217:60679] <-> InitialHandler has connected
08:30:17 [INFO] [Aireesan_] <-> ServerConnector [towny] has connected
08:30:17 [INFO] [Aireesan_] disconnected with: Kicked whilst connecting to towny: Unable to authenticate - no data was forwarded by the proxy.


unable to authenticate

Hey plugin works great until today. I received this message and I cant join my own server

[BungeeGuard] Denying connection from (some numbers and characters) - reason: NO_TOKEN.
And in game it say:
Unable to authenticate.

Please help me fix it cuz idk what to do

Error thrown while trying to load plugin

org.bukkit.plugin.InvalidPluginException: java.lang.UnsupportedClassVersionError: me/lucko/bungeeguard/spigot/BungeeGuardBackendPlugin has been compiled by a more recent version of the Java Runtime (class file version 53.0), this version of the Java Runtime only recognizes class file versions up to 52.0
	at org.bukkit.plugin.java.JavaPluginLoader.loadPlugin(JavaPluginLoader.java:134) ~[a.jar:git-TacoSpigot-bf023c7d]
	at org.bukkit.plugin.SimplePluginManager.loadPlugin(SimplePluginManager.java:335) ~[a.jar:git-TacoSpigot-bf023c7d]
	at org.bukkit.plugin.SimplePluginManager.loadPlugins(SimplePluginManager.java:252) [a.jar:git-TacoSpigot-bf023c7d]
	at org.bukkit.craftbukkit.v1_8_R3.CraftServer.loadPlugins(CraftServer.java:293) [a.jar:git-TacoSpigot-bf023c7d]
	at net.minecraft.server.v1_8_R3.DedicatedServer.init(DedicatedServer.java:207) [a.jar:git-TacoSpigot-bf023c7d]
	at net.minecraft.server.v1_8_R3.MinecraftServer.run(MinecraftServer.java:568) [a.jar:git-TacoSpigot-bf023c7d]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_265]
Caused by: java.lang.UnsupportedClassVersionError: me/lucko/bungeeguard/spigot/BungeeGuardBackendPlugin has been compiled by a more recent version of the Java Runtime (class file version 53.0), this version of the Java Runtime only recognizes class file versions up to 52.0

BungeeGuard straight up not working

I'm running a Velocity proxy (1.1.8) and 3 Paper 1.17 backend servers.
I installed BungeeGuard on each of the backend servers and set the forwarding mode to bungeeguard in the Velocity configuration and configured forwarding-secret in the configuration of these 3 backend servers.
I have no errors on both the proxy and the 3 backend servers, but the plugin does not work, I can still connect using the IP of my backend servers and authentication does not fail.

BungeeGuard not working on a specific backend server

Hello.

I have been using BungeeGuard on my server for several months now.

Due to some issues, I have decided to remove everything and start over.

For some reason, BungeeGuard is working on my Lobby server... but on my KitPvP server it doesn't work.

It doesn't specify any errors or anything... but I can still exploit my KitPvP server.

Here's what I get from the console.

[14:55:27] [Server thread/INFO]: [BungeeGuard] Loading BungeeGuard v1.2-SNAPSHOT
[14:55:58] [Server thread/INFO]: [BungeeGuard] Enabling BungeeGuard v1.2-SNAPSHOT
[14:55:58] [Server thread/INFO]: [BungeeGuard] Using Paper's PlayerHandshakeEvent to listen for connections.

I think it's trying to use Paper's PlayerHandshakeEvent when I am not using PaperSpigot... and using Spigot.
Even if I do switch to PaperSpigot... it will not make any difference because I am using 1.8.8... and not 1.9.4+.

Kindly advice,
thetechguy989 / SuchBlue

Players can bypass

Paperspigot configuration BungeeGuard:

BungeeGuard Configuration

Allowed authentication tokens.

allowed-tokens:

  • "DEoezLcojw6kHYZWnTNrghPW7BzxYXrbNlnPdL6jdkuuARnH8WmJYgNuCxLGByY1"

Messages

no-data-kick-message: "&cUnable to authenticate - no data was forwarded by the proxy."
no-properties-kick-message: "&cUnable to authenticate."
invalid-token-kick-message: "&cAn invalid authentication token was provided."

BungeeCord configuration BungeeGuard:
token: DEoezLcojw6kHYZWnTNrghPW7BzxYXrbNlnPdL6jdkuuARnH8WmJYgNuCxLGByY1

Informations:
Im not using Spigot, im using PaperSpigot
Im not using SkinRestored

Players can enter on skyblock without acces the BungeeCord, can you help me please?

unable to authenticate on spigot server and bungeecord server not working at all

I'm using bungeeguard on a bungeecord server on windows and a spigot server on OS X 10.11. When I connect to the spigot server, it says unable to authenticate - no data was sent by the proxy, and the bungeecord server doesn't even register as a server, how do I fix this, if at all?

EDIT: this also shows up the first time it denies a connection:

WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by com.comphenix.protocol.reflect.compiler.StructureCompiler (file:/Users/SEHR/Downloads/plugins/ProtocolLib.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int)
WARNING: Please consider reporting this to the maintainers of com.comphenix.protocol.reflect.compiler.StructureCompiler
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release

Not working for PaperSpigot 1.8.8 and latest Bungeecord

Hello,

My BungeeGuard plugin isn't working on my PaperSpigot 1.8.8 server. I get this error:

[18:02:51] [Server thread/INFO]: [BungeeGuard] Enabling BungeeGuard v1.0-SNAPSHOT
[18:02:51] [Server thread/INFO]: [BungeeGuard] Using Paper PlayerHandshakeEvent
[18:02:51] [Server thread/ERROR]: [BungeeGuard] Plugin BungeeGuard v1.0-SNAPSHOT has failed to register events for class me.lucko.bungeeguard.backend.BungeeGuardBackendPlugin because com/destroystokyo/paper/event/player/PlayerHandshakeEvent does not exist.

Can you fix this?

Thanks in advance!

Kind regards,

Stijn

Not compatible with Velocity

Having trouble with another plugin and was about to try this one, but there is only one JAR to download and its only for Bungee.

[07:03:41 ERROR]: Unable to load plugin plugins/BungeeGuard.jar
com.velocitypowered.api.plugin.InvalidPluginException: The plugin file BungeeGuard.jar appears to be a Bukkit or BungeeCord plugin. Velocity does not support Bukkit or BungeeCord plugins.

Is there a Velocity version that I can't find?

Not working...

I put the bungeeguard proxy on the bungeecord server and the bungeeguard backend on my backend servers and it doesn't work... people can still come in from another proxy, i am sure i made the settings in the right way, can you help me? And yes, I use paper

Incompatible with Geyser/floodgate

I am setting up a network and tried to make it so that bedrock clients can also join, however it does not work with BungeeGuard, I can get everything setup and working with Geyser and floodgate, however if I install BungeeGuard clients can no longer connect.
I get this error:

Netty Epoll Server IO #1/WARN Denying connection from 172.17.0.13Geyser-FloodgateJxjgjN/JXthR2LxsMB+8q23KIUmBoLFrlIgYqb7mIjtBFhNdYxrzGe4edBN158idTOMvH98/bk0OGx3DKbKApqJT48e8EkMwO+W4Ygb5vyIxp9m6QOOR/+P4cIi8ZorCkioIsy/Je7TPeHGREv8KO80s8XyRevuM85xbFge4YihiuJwavdVgv+h4jzPToCJZG+VIyVoz5ui8++RijnVB9eOvOf77Gs3tUK23xDf8j/6Eui4PDr1VHyl6Mpa8G+dksL9a4fPgyHpXpVq3jzeg9EOmgjF2C9Qy0920HH2z9u2pWRRQyWN2WQfu0JAN8qHkYik1A5wzVVn47y0DpuCPIw==hRFkxoJgexFAi5ASz8KwdTMkfRCIOhwqOAV2RdR9HhkdkJbnX76DIp88AHJkP9yWJ/ZXPmn1qpAHWN+gScj42g==64.71.223.1710000000000000000000900000454ee7e[{"name":"bungeeguard-token","value":"kqhTPzDEBXmssQiwZVJAl4pnDRyIQt13IWDgG5GzIa0m2al35rALB4nmniPz3q4B","signature":""}] - reason: INVALID_HANDSHAKE

If there is anything you can do to make these compatible, it would be great, as I do not want to go back to using an IP whitelist plugin, being they are less secure.

Tokens aren't compared

Players are able to connect to Spigot servers running BungeeGuard using a random token.

The Spigot server is running BungeeGuard and has this configuration:

# BungeeGuard Configuration

# Allowed authentication tokens.
allowed-tokens:
  - "A2..."


# Messages
no-data-kick-message: "&cUnable to authenticate - no data was forwarded by the proxy."
no-properties-kick-message: "&cUnable to authenticate."
invalid-token-kick-message: "&cAn invalid authentication token was provided."

For obvious reasons, I have only showed the first 2 characters of the token.

I set up a BungeeCord server on my PC and installed BungeeGuard. Here's the token.yml:

token: IwBuuaNiAxPMtFOKEkHRb2YmsSiMqZSrlFcVV2fY0baKWIKelcQwqBNq9NETdpgc

(Yes, I know the full token is there. I set this up for testing and won't be using it again). Obviously, the 2 tokens are completely different. However, BungeeGuard still allows me to enter ingame. Here's my BungeeCord configuration:

inject_commands: false
forge_support: false
player_limit: -1
permissions:
  default:
  - bungeecord.command.server
  - bungeecord.command.list
  admin:
  - bungeecord.command.alert
  - bungeecord.command.end
  - bungeecord.command.ip
  - bungeecord.command.reload
timeout: 30000
log_commands: false
online_mode: false
disabled_commands:
- disabledcommandhere
servers:
  lobby:
    motd: '&1Just another BungeeCord - Forced Host'
    address: <censored>
    restricted: false
listeners:
- query_port: 25577
  motd: '&1Another Bungee server'
  tab_list: GLOBAL_PING
  query_enabled: false
  proxy_protocol: false
  forced_hosts:
    pvp.md-5.net: pvp
  ping_passthrough: false
  priorities:
  - lobby
  bind_local_address: true
  host: 0.0.0.0:25577
  max_players: 1
  tab_size: 60
  force_default_server: false
ip_forward: true
network_compression_threshold: 256
prevent_proxy_connections: false
groups:
  admin:
  - admin
connection_throttle: 4000
stats: <censored>
connection_throttle_limit: 3
log_pings: true

BungeeGuard server transfer issue

This is a continuation of the issue-thread #53 which was recently closed by the author, who resolved the issue

The proxy has BungeeGuard installed, and each of the servers connected to the proxy have it as well - alongside ProtocolLib and the token generated by the proxy in their respective config files. It works fine, but my issue arises when I try to switch to a different server after being connected to the default "hub" server.

It throws the "Unable to authenticate." message described in the config file for BungeeGuard

https://pastebin.com/QG6s9H6F
I use Travertine as my proxy software, on Java 16 (I’ve also tried Java 8 but the results were the same), for my backend (Spigot) I use Java 8 on Minecraft version 1.8.8, and use the latest dev build of ProtocolLib (I’ve also tried the latest “stable” release) which is dmulloy2/ProtocolLib@7ce3f47.

BungeeGuard crash

Hi. Today our server without any server crashed. After inspection we found this error spam in our logs: https://paste.lucko.me/I4gnIYsYuS
It's probably an attack, but we are not sure.
When we started the server, it happened again. After a while of waiting, we tried it again and the problem is not occuring anymore. Any ideas, how to fix it, that it can't happen in the future?

More tokens

Make it so we can have an array of tokens like 1 token per server

proxy config [
pvp = "asdfghjkl"
survival = "zxcvbnm"
]

pvp server config [
token = "asdfghjkl"
]

survival server config [
token = "zxcvbnm"
]

image

Error

[02:36:09 ERROR]: [Ashrame|/92.157.11.159:62546] <-> ServerConnector [faction] - encountered exception
io.netty.handler.codec.CorruptedFrameException: Empty Packet!
at net.md_5.bungee.protocol.Varint21FrameDecoder.decode(Varint21FrameDecoder.java:45) ~[server.jar:git:Waterfall-Bootstrap:1.13-SNAPSHOT:dceeeb3:259]
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:502) ~[server.jar:git:Waterfall-Bootstrap:1.13-SNAPSHOT:dceeeb3:259]
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:441) ~[server.jar:git:Waterfall-Bootstrap:1.13-SNAPSHOT:dceeeb3:259]
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:278) ~[server.jar:git:Waterfall-Bootstrap:1.13-SNAPSHOT:dceeeb3:259]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) ~[server.jar:git:Waterfall-Bootstrap:1.13-SNAPSHOT:dceeeb3:259]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) ~[server.jar:git:Waterfall-Bootstrap:1.13-SNAPSHOT:dceeeb3:259]
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) ~[server.jar:git:Waterfall-Bootstrap:1.13-SNAPSHOT:dceeeb3:259]
at io.netty.handler.timeout.IdleStateHandler.channelRead(IdleStateHandler.java:286) ~[server.jar:git:Waterfall-Bootstrap:1.13-SNAPSHOT:dceeeb3:259]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) ~[server.jar:git:Waterfall-Bootstrap:1.13-SNAPSHOT:dceeeb3:259]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) ~[server.jar:git:Waterfall-Bootstrap:1.13-SNAPSHOT:dceeeb3:259]
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) ~[server.jar:git:Waterfall-Bootstrap:1.13-SNAPSHOT:dceeeb3:259]
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1434) ~[server.jar:git:Waterfall-Bootstrap:1.13-SNAPSHOT:dceeeb3:259]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) ~[server.jar:git:Waterfall-Bootstrap:1.13-SNAPSHOT:dceeeb3:259]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) ~[server.jar:git:Waterfall-Bootstrap:1.13-SNAPSHOT:dceeeb3:259]
at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:965) ~[server.jar:git:Waterfall-Bootstrap:1.13-SNAPSHOT:dceeeb3:259]
at io.netty.channel.epoll.AbstractEpollStreamChannel$EpollStreamUnsafe.epollInReady(AbstractEpollStreamChannel.java:799) ~[server.jar:git:Waterfall-Bootstrap:1.13-SNAPSHOT:dceeeb3:259]
at io.netty.channel.epoll.EpollEventLoop.processReady(EpollEventLoop.java:433) ~[server.jar:git:Waterfall-Bootstrap:1.13-SNAPSHOT:dceeeb3:259]
at io.netty.channel.epoll.EpollEventLoop.run(EpollEventLoop.java:330) ~[server.jar:git:Waterfall-Bootstrap:1.13-SNAPSHOT:dceeeb3:259]
at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:909) ~[server.jar:git:Waterfall-Bootstrap:1.13-SNAPSHOT:dceeeb3:259]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_191]

"Handshake exceeds 1000 characters"

Users are unable to connect to the network through the proxy, but it does block direct connections to the backend servers.

The following errors are repeated for all users trying to connect:

[19:59:57] [Netty Epoll Server IO #1/WARN]: [BungeeGuard] Denying connection from handshake exceeds 1000 characters - reason: INVALID_HANDSHAKE (Spigot server error)

22:05:44 [INFO] [*********] disconnected with: Kicked whilst connecting to lobby: Unable to authenticate - no data was forwarded by the proxy. (Proxy error)

  • Tested on our production server as well as a home-hosted network.

  • Also tested using a clean install of the proxy and backend server (no other plugins installed, just BungeeGuard).

  • Confirmed that the token is the same between the proxy and backend server, also tried using a new token by BungeeGuard.

Proxy jar (tested with both): Waterfall and Bungeecord
Backend jar (tested with both): Purpur and Paper
(Latest builds for both)

[Request] ProtocolSupport support

Hello there. I would like to know if it could be possible to add support for ProtocolSupport. Specifically my partner would need to join our 1.16.5 server with a 1.7 client. Because he is on the road often, he is using a program called "PojavLauncher" on his phone. Sadly everything above 1.7 sucks his phone RAM so badly that it becomes unusable. I was wondering if that could be possible to implement somehow. Thanks in advance for any reply.

Build error

[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for BungeeGuard 1.0-SNAPSHOT:
[INFO]
[INFO] BungeeGuard ........................................ SUCCESS [  0.750 s]
[INFO] bungeeguard-proxy .................................. FAILURE [ 14.970 s]
[INFO] bungeeguard-backend ................................ SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  15.814 s
[INFO] Finished at: 2020-03-04T07:31:46-05:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal on project bungeeguard-proxy: Could not resolve dependencies for project me.lucko:bungeeguard-proxy:jar:1.0-SNAPSHOT: Could not find artifact net.md-5:bungeecord-proxy:jar:1.13-SNAPSHOT in sonatype-snapshots-repo (https://oss.sonatype.org/content/repositories/snapshots/) -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/DependencyResolutionException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR]   mvn <args> -rf :bungeeguard-proxy

Handler failed

19.12 00:16:17 [Server] ERROR Plugin BungeeGuard v1.0-SNAPSHOT has failed to register events for class me.lucko.bungeeguard.backend.BungeeGuardBackendPlugin because com/destroystokyo/paper/event/player/PlayerHandshakeEvent does not exist.

Server is 1.8.8 any ideas

Securty bypass with fake uuid

Hello, so recently some griefers joined our server using our staff accounts, so we checked the console to see how did they bypass the securty.

redacted

Error on Paper 1.8.8

`> [04:51:36 INFO]: [BungeeGuard] Enabling BungeeGuard v1.0-SNAPSHOT

[04:51:36 INFO]: [BungeeGuard] Using Paper PlayerHandshakeEvent
[04:51:36 ERROR]: [BungeeGuard] Plugin BungeeGuard v1.0-SNAPSHOT has failed to register events for class me.lucko.bungeeguard.backend.BungeeGuardBackendPlugin because com/destroystokyo/paper/event/player/PlayerHandshakeEvent does not exist.`

Is what I get when starting my server. My server is running the latest 1.8.8 paper jar from paper.io/legacy

New build bugs

Hello,

I've installed the newest build [from 4 November] onto my servers, but now I always get this message:

[BungeeGuard] Denied connection from UUID @ IP - A token was not included in their GameProfile properties.
Disconnecting com.mojang.authlib.GameProfile@188499b9[id=0c0d845b-531b-385b-819c-33b6f7d7d130,name=SBDeveloper,properties={},legacy=false]

And at startup:
[BungeeGuard] Using Bukkit's PlayerLoginEvent for connection filtering. Please consider upgrading to Paper (https://papermc.io/) to allow BungeeGuard to filter connections at the handshake stage (better!).

Am I doing something wrong, or is there anything else wrong with the build?
The tokens in the files are the same, so that's not the problem.

I'm running the latest builds of BungeeGuard, Bungeecord and PaperSpigot 1.8.8.

Thanks in advance.

Kind regards,

Stijn

Pinger

BungeeGuard seems to block PlaceholderAPI's Pinger.

Pinger is an expansion which pings a server to see if it's online or offline. More information about pinger is available via https://github.com/PlaceholderAPI/PlaceholderAPI/wiki/Placeholders#pinger

I've made an issue at the placeholderapi github, here but it works fine if bungeeguard is not loaded. This makes bungeeguard as the main suspect.

To reproduce:
On the hub server, I've have a scoreboard with the appropriate placeholder. But it can easily be reproduced with a command too.

  • we take a hub server and a second server
  • on the hub server install placeholderAPI
  • execute: papi ecloud download Pinger to install the pinger expansion
  • execute papi reload
  • execute papi parse me %pinger_online_127.0.0.1:12345% where the ip and port matches the ip and port of the second server.
  • see result
  • repeat above steps with/without bungeeguard.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.