Block connections if the default tokens are still configured

lucko · Oct 2, 2022 · 1686cb7 · 1686cb7
1 parent 414ea18
commit 1686cb7
Show file tree

Hide file tree

Showing 4 changed files with 30 additions and 4 deletions.
diff --git a/INSTALLATION.md b/INSTALLATION.md
@@ -32,8 +32,9 @@ The latest versions of BungeeGuard can be found from:
 4. Navigate to `/plugins/BungeeGuard/config.yml`. Add the token(s) generated by the proxy(ies) to the `allowed-tokens` list.
    > e.g.
    > ```yml
-	> # Allowed authentication tokens.  
-	> allowed-tokens:
-	>   - "AUSXEwebkOGVnbihJM8gBS0QUutDzvIG009xoAfo1Huba9pGvhfjrA21r8dWVsa8"
-	> ```
+   > # Allowed authentication tokens.  
+   > allowed-tokens:
+   >   - "AUSXEwebkOGVnbihJM8gBS0QUutDzvIG009xoAfo1Huba9pGvhfjrA21r8dWVsa8"
+   > ```
+   > **Please make sure you remove the default tokens, so the only values in the list are your allowed tokens.**
 5. Run `bungeeguard reload` from console.
diff --git a/bungeeguard-backend/src/main/java/me/lucko/bungeeguard/backend/TokenStore.java b/bungeeguard-backend/src/main/java/me/lucko/bungeeguard/backend/TokenStore.java
@@ -59,4 +59,14 @@ public boolean isAllowed(String token) {
         return this.allowedTokens.contains(token);
     }
 
+    /**
+     * Has the server owner bothered to configure their tokens correctly...?
+     *
+     * @return true if BungeeGuard has not yet been configured
+     */
+    public boolean isUsingDefaultConfig() {
+        return this.allowedTokens.contains("the token generated by the proxy goes here") ||
+                this.allowedTokens.contains("you can add as many as you like.");
+    }
+
 }
diff --git a/bungeeguard-spigot/src/main/java/me/lucko/bungeeguard/spigot/BungeeCordHandshake.java b/bungeeguard-spigot/src/main/java/me/lucko/bungeeguard/spigot/BungeeCordHandshake.java
@@ -75,6 +75,10 @@ public static BungeeCordHandshake decodeAndVerify(String handshake, TokenStore t
     }
 
     private static BungeeCordHandshake decodeAndVerify0(String handshake, TokenStore tokenStore) throws Exception {
+        if (tokenStore.isUsingDefaultConfig()) {
+            return new Fail(Fail.Reason.INCORRECT_TOKEN, "Allowed tokens have not been configured! Please refer to https://github.com/lucko/BungeeGuard/blob/master/INSTALLATION.md for help.");
+        }
+
         if (handshake.length() > HANDSHAKE_LENGTH_LIMIT) {
             return new Fail(Fail.Reason.INVALID_HANDSHAKE, "handshake length " + handshake.length() + " is > " + HANDSHAKE_LENGTH_LIMIT);
         }

diff --git a/bungeeguard-spigot/src/main/java/me/lucko/bungeeguard/spigot/BungeeGuardBackendPlugin.java b/bungeeguard-spigot/src/main/java/me/lucko/bungeeguard/spigot/BungeeGuardBackendPlugin.java
@@ -54,6 +54,17 @@ public void onEnable() {
         this.tokenStore = new TokenStore(this);
         this.tokenStore.load();
 
+        if (!getServer().spigot().getSpigotConfig().getBoolean("settings.bungeecord", false)) {
+            getLogger().severe("------------------------------------------------------------");
+            getLogger().severe("'settings.bungeecord' is set to false in spigot.yml.");
+            getLogger().severe("");
+            getLogger().severe("BungeeGuard cannot function unless this property is set to true.");
+            getLogger().severe("The server will now shutdown as a precaution.");
+            getLogger().severe("------------------------------------------------------------");
+            getServer().shutdown();
+            return;
+        }
+
         if (isPaperHandshakeEvent()) {
             getLogger().info("Using Paper's PlayerHandshakeEvent to listen for connections.");