str1k3r/MCLEClient
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: dedicated server security hardening

Browse Source 
Comprehensive security system to protect against packet-sniffing attacks,
XUID harvesting, privilege escalation, bot flooding, and XUID impersonation.

- Stream cipher: per-session XOR cipher with 4-message handshake via
  CustomPayloadPacket (MC|CKey, MC|CAck, MC|COn). Negotiated per-connection,
  backwards compatible (old clients/servers fall back to plaintext).
- Security gate: buffers all game data until cipher handshake completes,
  preventing unsecured clients from receiving any XUIDs or game state.
- Cipher handshake enforcer: kicks clients that don't complete the handshake
  within 5 seconds (configurable via require-secure-client).
- Identity tokens: persistent per-XUID tokens in identity-tokens.json,
  issued over the encrypted channel, verified on reconnect. Prevents XUID
  replay attacks. Client stores server-specific tokens.
- PROXY protocol v1: parses real client IPs from playit.gg tunnel headers
  so rate limiting, IP bans, and XUID spoof detection work per-player.
- Rate limiting: per-IP sliding window (default 5 connections/30s) with
  pending connection cap (default 10).
- Privilege hardening: OP requires ops.json, live checks on every command
  and privilege packet. Host-only server settings changes.
- XUID stripping: PreLoginPacket response sends INVALID_XUID placeholders.
- Packet validation: readUtf global string cap, reduced max packet size,
  stream desync protection on oversized strings.
- OpManager: persistent ops.json with XUID-based OP list.
- Whitelist improvements: whitelist add accepts player names with ambiguity
  detection, XUID cache from login attempts.
- revoketoken command: revoke identity tokens for players who lost theirs.
- server.log: persistent log file written alongside console output with
  flush-per-write to survive crashes.
- CLI security logging: consolidated per-join security summary with cipher
  status, token status, XUID, and real IP. Security warnings for kicks,
  spoofing, and unauthorized commands.
This commit is contained in:
itsRevela
2026-03-28 19:18:06 -05:00
parent ed3fffcc6a
commit ba3ebe666c
42 changed files with 3293 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Minecraft.Server/cmake/sources/Common.cmake
+21
View File
@@ -521,9 +521,27 @@ set(_MINECRAFT_SERVER_COMMON_SERVER_ACCESS
"${CMAKE_CURRENT_SOURCE_DIR}/Access/BanManager.h"
"${CMAKE_CURRENT_SOURCE_DIR}/Access/WhitelistManager.cpp"
"${CMAKE_CURRENT_SOURCE_DIR}/Access/WhitelistManager.h"
"${CMAKE_CURRENT_SOURCE_DIR}/Access/OpManager.cpp"
"${CMAKE_CURRENT_SOURCE_DIR}/Access/OpManager.h"
)
source_group("Server/Access" FILES ${_MINECRAFT_SERVER_COMMON_SERVER_ACCESS})
set(_MINECRAFT_SERVER_COMMON_SERVER_SECURITY
"${CMAKE_CURRENT_SOURCE_DIR}/Security/SecurityConfig.cpp"
"${CMAKE_CURRENT_SOURCE_DIR}/Security/SecurityConfig.h"
"${CMAKE_CURRENT_SOURCE_DIR}/Security/RateLimiter.cpp"
"${CMAKE_CURRENT_SOURCE_DIR}/Security/RateLimiter.h"
"${CMAKE_CURRENT_SOURCE_DIR}/Security/StreamCipher.cpp"
"${CMAKE_CURRENT_SOURCE_DIR}/Security/StreamCipher.h"
"${CMAKE_CURRENT_SOURCE_DIR}/Security/ConnectionCipher.cpp"
"${CMAKE_CURRENT_SOURCE_DIR}/Security/ConnectionCipher.h"
"${CMAKE_CURRENT_SOURCE_DIR}/Security/CipherHandshakeEnforcer.cpp"
"${CMAKE_CURRENT_SOURCE_DIR}/Security/CipherHandshakeEnforcer.h"
"${CMAKE_CURRENT_SOURCE_DIR}/Security/IdentityTokenManager.cpp"
"${CMAKE_CURRENT_SOURCE_DIR}/Security/IdentityTokenManager.h"
)
source_group("Server/Security" FILES ${_MINECRAFT_SERVER_COMMON_SERVER_SECURITY})
set(_MINECRAFT_SERVER_COMMON_SERVER_COMMON
"${CMAKE_CURRENT_SOURCE_DIR}/Common/AccessStorageUtils.h"
"${CMAKE_CURRENT_SOURCE_DIR}/Common/FileUtils.cpp"
@@ -585,6 +603,8 @@ set(_MINECRAFT_SERVER_COMMON_SERVER_CONSOLE_COMMANDS
"${CMAKE_CURRENT_SOURCE_DIR}/Console/commands/weather/CliCommandWeather.h"
"${CMAKE_CURRENT_SOURCE_DIR}/Console/commands/whitelist/CliCommandWhitelist.cpp"
"${CMAKE_CURRENT_SOURCE_DIR}/Console/commands/whitelist/CliCommandWhitelist.h"
"${CMAKE_CURRENT_SOURCE_DIR}/Console/commands/revoketoken/CliCommandRevokeToken.cpp"
"${CMAKE_CURRENT_SOURCE_DIR}/Console/commands/revoketoken/CliCommandRevokeToken.h"
)
source_group("Server/Console/Commands" FILES ${_MINECRAFT_SERVER_COMMON_SERVER_CONSOLE_COMMANDS})
@@ -598,6 +618,7 @@ set(MINECRAFT_SERVER_COMMON
${_MINECRAFT_SERVER_COMMON_ROOT}
${_MINECRAFT_SERVER_COMMON_SERVER}
${_MINECRAFT_SERVER_COMMON_SERVER_ACCESS}
${_MINECRAFT_SERVER_COMMON_SERVER_SECURITY}
${_MINECRAFT_SERVER_COMMON_SERVER_COMMON}
${_MINECRAFT_SERVER_COMMON_SERVER_CONSOLE}
${_MINECRAFT_SERVER_COMMON_SERVER_CONSOLE_COMMANDS}