Jump to content

How to avoid getting flooded in 2021


Recommended Posts

  • Premium

Hello,

 

int CInputMain::Analyze(LPDESC d, BYTE bHeader, const char * c_pData)

 

	if (ch && ch->IsPC())
	{
		if (get_global_time() < ch->analyze_protect)
		{
			ch->analyze_protect_count = ch->analyze_protect_count + 1;
			ch->ChatPacket(CHAT_TYPE_INFO, "<test server> analyze_protect_count. Count %d", ch->analyze_protect_count);
			
			if (ch->analyze_protect_count >= 300)
			{
				ch->analyze_protect_count = 0;
				d->SetPhase(PHASE_CLOSE);
				return (0);
			}
		}
		else
			ch->analyze_protect_count = 0;
		
		ch->analyze_protect = get_global_time() + 1;
	}

 

In char.h

 

int analyze_protect; 
int analyze_protect_count;

 

In void CHARACTER::Initialize() and Destroy

 

analyze_protect = 0; 
analize_protect_count = 0;

 

Edited by Speachless
  • Metin2 Dev 2
  • Love 9
Link to comment
Share on other sites

  • Developer
9 hours ago, Speachless said:

Hello,

 


int CInputMain::Analyze(LPDESC d, BYTE bHeader, const char * c_pData)

 


	if (ch && ch->IsPC())
	{
		if (get_global_time() < ch->analyze_protect)
		{
			ch->analyze_protect_count = ch->analyze_protect_count + 1;
			ch->ChatPacket(CHAT_TYPE_INFO, "<test server> analyze_protect_count. Count %d", ch->analyze_protect_count);
			
			if (ch->analyze_protect_count >= 300)
			{
				ch->analyze_protect_count = 0;
				d->SetPhase(PHASE_CLOSE);
				return (0);
			}
		}
		else
			ch->analyze_protect_count = 0;
		
		ch->analyze_protect = get_global_time() + 1;
	}

 

In char.h

 


int analyze_protect; 
int analyze_protect_count;

 

 

 

It is missing the initializing of these two values added in char.h.

They got a random value if you don't set it when CHARACTER object is instancied

i suggest to add something like :
 

//SEARCH
void CHARACTER::Initialize()
{

//ADD UNDER
	analyze_protect = 0;
	analize_protect_count = 0;

 

My youtube channel  on which you can see my works here

Link to comment
Share on other sites

Actually you can already use the same approach we currently have with chat flooding.

Many people don't implement this fix but I find it to be mandatory: You can just use the same variable for every chat thing (be it whisper, etc.) or even companion add.

Because there are many more things you'd technically flood the server with. I'd changed it so you have three variable types: fast, mid, slow. Depending on how fast a player can actually trigger this (like itemuse can be triggered way more often than a chat command should be) the variable count is higher and cleared each few seconds just like the current anti-spam works. You can fine-tune those variables and thus prevent flooding with each command. This can also be used for itemdrop packets, making it possible to once again write with 1 yang on the ground without having to fear that someone might flood the server (because he'll get kicked after too many packets within a time span).

  • Love 1

We are the tortured.
We're not your friends.
As long as we're not visible.
We are unfixable.

Link to comment
Share on other sites

  • Premium
3 hours ago, Vanilla said:

Actually you can already use the same approach we currently have with chat flooding.

Many people don't implement this fix but I find it to be mandatory: You can just use the same variable for every chat thing (be it whisper, etc.) or even companion add.

Because there are many more things you'd technically flood the server with. I'd changed it so you have three variable types: fast, mid, slow. Depending on how fast a player can actually trigger this (like itemuse can be triggered way more often than a chat command should be) the variable count is higher and cleared each few seconds just like the current anti-spam works. You can fine-tune those variables and thus prevent flooding with each command. This can also be used for itemdrop packets, making it possible to once again write with 1 yang on the ground without having to fear that someone might flood the server (because he'll get kicked after too many packets within a time span).

 

I do have like this, but i released something that may be a top necessity as someone started to flood this way some servers. Every server has it's owner and they can do it better. I personally use anti spam on almost any function.

Edited by Speachless
Link to comment
Share on other sites

  • 2 weeks later...
  • Honorable Member

 

I think this vulnerability is caused because, in CInputHandshake::Analyze, it keeps the connection open even if the processed packet fails, so the same connection can send infinite packets increasing the buffer size until it reaches 4gb of ram (32bit binary limit).

 

Replace every return -1; there with

{
            d->SetPhase(PHASE_CLOSE);
            return 0;
}

And that's all.

 

On 1/11/2021 at 11:18 AM, Speachless said:

 


int analyze_protect; 
int analyze_protect_count;

 

yfw:

int analyze_protect{0};
int analyze_protect_count{0};

If you're working on files that don't have c++11 enabled in 2021, you're probably doing something deep wrong. 🤣

Edited by martysama0134
  • Love 7
Link to comment
Share on other sites

  • 4 months later...
  • 11 months later...

Hello, where exactly to add this in the char.h file

int analyze_protect;
int analyze_protect_count;

search

public:
    LPCHARACTER FindCharacterInView(const char* name, bool bFindPCOnly);
    void UpdatePacket();

Add under

#ifdef ENABLE_FLOOD_PRETECTION
    int analyze_protect; 
    int analyze_protect_count;
#endif
Edited by PeterCZ
Resolved
Link to comment
Share on other sites

Announcements



×
×
  • Create New...

Important Information

Terms of Use / Privacy Policy / Guidelines / We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.