GlowstoneMC/Glowstone

Issue with AuthMe and proxy-support

Open

#547 opened on Aug 13, 2017

View on GitHub
 (11 comments) (0 reactions) (1 assignee)Java (1,825 stars) (278 forks)batch import
Category: server featurePriority: minorType: inconsistencyhelp wanted

Description

Looking at the logs, both Bungeecord and Glowstone are receiving the correct player IP:

06:28:30 [INFO] [/187.180.212.96:39420] <-> InitialHandler has connected
06:28:30 [INFO] [TheticalFlyer97] <-> ServerConnector [lobby] has connected

06:28:30 [INFO] UUID of player TheticalFlyer97 is a6462498-08d5-37c4-bfbb-158cac0008f2
06:28:30 [INFO] TheticalFlyer97 [/187.180.212.96:43947] connected, UUID: a6462498-08d5-37c4-bfbb-158cac0008f2
06:28:30 [INFO] TheticalFlyer97 joined the game
06:28:30 [INFO] TheticalFlyer97[/187.180.212.96:43947] registered channel: FML
06:28:30 [INFO] TheticalFlyer97[/187.180.212.96:43947] registered channel: AuthMeBridge
06:28:30 [INFO] TheticalFlyer97[/187.180.212.96:43947] registered channel: FML|HS
06:28:30 [INFO] TheticalFlyer97[/187.180.212.96:43947] registered channel: FORGE
06:28:30 [INFO] TheticalFlyer97[/187.180.212.96:43947] registered channel: BTLP/Bridge
06:28:30 [INFO] TheticalFlyer97[/187.180.212.96:43947] registered channel: BungeeCord
06:28:30 [INFO] TheticalFlyer97[/187.180.212.96:43947] registered channel: BAuthMeBridge
06:28:42 [INFO] TheticalFlyer97 issued command: /register (censored)

But looking at the AuthMe database, you can see that AuthMe has, somehow, received the Bungeecord IP from Glowstone and is using that instead of the player IP:

screen shot 2017-08-13 at 03 55 16

Another issue with AuthMe is that it’s not censoring commands with passwords (like /register and /login). AuthMe works perfectly fine otherwise.

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

Contributor guide

Tech stack
java
Domain
backendsecurity
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
mostly clear
Prerequisites
JavaMinecraft server pluginsProxy/BungeeCordAuthMe plugin
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
25
Research direction
Investigate how Glowstone forwards player IP to plugins. Check AuthMe's IP resolution logic. Look at the BungeeCord bridge plugin's implementation. Review the configuration for AuthMe regarding proxy support. Examine the database schema to understand where the IP is stored.