SafeNET [1.8 - 26.3] - Protect your network from IP-forward

- Fix startup issues (intentional safety crashes) due to updated package paths on the provider's side. There were no changes to the backend side of the plugin. SafeNET 4.1 is for the latest BungeeCord releases only. If you are not running Paper severs , ProtocolLib 5.3.0+ is required. If you, for some reason, need to use other ProtocolLib releases, use SafeNET 3.9 (ProtocolLib 5.0.0-5.2.0) or SafeNET 3.8-LEGACY (previous ProtocolLib versions).

- Support 1.21 and ProtocolLib 5.3.0: There was a need to fix packet handling on servers running version 1.21 (with ProtocolLib 5.3.0) due to protocol changes. Thanks to various people for reporting this issue. There were no changes to the proxy side of the plugin. SafeNET 4.0 is for BungeeCord 1.19+ only. If you are not running Paper severs, ProtocolLib 5.3.0+ is required. If you, for some reason, need to use other ProtocolLib releases, use SafeNET 3.9 (ProtocolLib 5.0.0-5.2.0) or SafeNET 3.8-LEGACY (previous ProtocolLib versions).

- Support FlameCord: this server implementation obtains profile properties (including the passphrase) using a different call stack and it was necessary to properly modify the verifier to ensure the passphrase is returned and forwarded to the backend server when joining one. The entire call stack verification logic has been rewritten to support middlewares - call stack elements which may be present when using non-native (BungeeCord in this case) implementations. - New options: added an option to disable data logging (encoded in base64) when a connection is denied to avoid console spam when not necessary and to not expose sensitive information. Added new options to configure property names for futher compatibility. - Official support for 1.20: SafeNET had reportedly worked on the latest servers without any issues, so this is just an official confirmation that this release functions as expected on all servers from 1.8 all the way to 1.20.

- Replaced PaperMC event registration logic: handshake verification logic implemented in previous versions of the plugin was faulty and under certain circumstances could let players connect without proper validation. Some of the older versions of PaperMC (and forked) servers are vulnerable. Please update immediately. - Patched connections from GeyserMC: handshake parsing was patched for the updated data format imposed by Floodgate V2.

- Fixed bugs: all known bugs, including those which would cause the server to crash on startup, were fixed. - Fully implemented Paper logic: fully implemented everything needed for Paper API handling.

- Patched major exploit: there's been a major exploit in versions 3.5 and older which allows users to bypass authentication during a specific timeframe. Make sure to upgrade immediately. This issue also affects BungeeGuard - for now, due to obvious reasons, I will not disclose any further information about the exploit, nor how to reproduce it. - Updated to ProtocolLib 5.0.0: the latest release now supports Spigot 1.19 via ProtocolLib 5.0.0. Due to this release also fixing an exploit, there is a 3.6 LEGACY release available for those who use ProtocolLib 4.8.0 (or older). You can download the release from GitHub: https://github.com/dejvokep/safe-net/releases/tag/v3.6. - Full support for Paper servers via the API: ProtocolLib is now no longer a requirement for Paper servers (and forks).

- Updated to BungeeCord 1.19: the newest release aims at fixing problems with the latest BungeeCord build. If you find any problem using this version, please report them appropriately via Discord or GitHub.

- Reworked updater: the updater now runs independently every 3h and will only send messages to the console. - Shortened logged messages: changed the format of the logged connection-related messages; textures displayed were shortened to placeholders to reduce console spam. - Added diagnostics command: command /sn diagnostics can be used to retrieve the plugin version, plugin configuration and Java/JVM related information for the support to easily deal with problems and errors in configuration.

- Fixed messaging bug: there was a bug where 2 console messages would be printed one after each other. Please note that this bug was solely message-related and did not affect your network's security. It is recommended to never use plugins which can hide/remove messages (any) logged by the plugin completely. If you are using a plugin which hides messages from the console, but does not affect saving to the server's log files, it's okay. Please note that the logged login information are for you and not for us, to check who joined and with which credentials, or to verify proper configuration.

- Logging rework: the plugin's logging system has completely been reworked. Amount of the logged information has been reduced and now only logs important messages straight to the console. - Easier troubleshooting: troubleshooting should be much easier now with the new error messages and codes. - Added BoostedYAML: the plugin now uses BoostedYAML library. Please delete the SecuredNetwork directories (for the last time).

- Complete rework: the plugin's been partly recoded, the graphics have been updated and a "proper" documentation has been added: https://dejvokep.gitbook.io/securednetwork/ - Open source release: the plugin is now available as open-source software at GitHub: https://github.com/dejvokep/secured-network Please reset your configuration files.

- Ping blocking switch [BACKEND]: The plugin has been using handshake packet (the first packet sent from the client to the server) to check and potentially reject the connections. Although the system was designed to be triggered only when a player logs in, it is also blocking server pings, which may break functionality of some plugins relying on ping information. Now, you've got a switch indicating whether to block server pings, or not. - Config changes [BACKEND]: There was a small change made in the config file, due to the new switch. Please, regenerate the config.yml file. Change was done only on backend-side code, so replacing the .jar files (and regenerating the configuration file) on your backend servers is enough.

- Property searching fix: The plugin has always been taking the last property to check it for the name and passphrase. However, if some other plugin added it's own property after SecuredNetwork had done so, it was the last. Therefore, this resulted in connection being rejected as the last property is incorrect. Now, all properties are checked (for the correct name, then for the passphrase). Change was done only on backend-side code, so replacing the .jar files on your backend servers is enough.

- New system: As of this new update, the plugin will now use completely new system to check if an user is connecting from your proxy. This led to massive changes in configuration, also shortened the setup instructions. Inspired by BungeeGuard. - Config changes: Config has been significantly shortened and changed. Please, regenerate it. - Command changes: Command syntax for reloading has been changed from /sn to /sn reload. For the proxy version, a new command /sn generate <length> is available. Also, all commands are now restricted only to console. - Updater change: Updater is now for the proxy version only.

- Partial recode: Some parts of the plugin have been recoded. - New config: The configuration file was changed majorly. - Command changes: All commands have been deleted, except the reload one. Therefore, no one can change anything in-game and settings are accessible only though the configuration file. - 1.16 support: Support has been officially added for server version 1.16. - Database connection: Connection to the database was re-engineered and configurable timeouts have been added. - Reload command: The reload command can now reload the connection. - One plugin for everything: IPWhiteList is now SecuredNetwork, as the main goal of the plugin is not the IP whitelist (although, it is still available as a feature), but the protection against IP-forwarding bypass. IPWhiteList and it's extension were merged into one plugin, e.g. there's no SecuredNetwork for your backend server. SecuredNetwork plugin can run on proxy and on backend servers, too.

- Hostname wildcard problem: In the last version of IPWhiteList (2.5), I updated the plugin with re-engineered IP checking mechanism, in which (in code) I accidentally used different method with the same name as the correct one. This mistake affected only *. hostname prefix. I always test new updates before releasing them, but this hid from my eyes. I am sorry for any inconvenience.

- Logs: Log files are now more detailed helping troubleshooting to be easier. Specifically, the IP player used to connect to the server can now be logged (it can be switched on and off in config.yml file). Also, a notice in the beginning of each log file was added. - IP checking remake: The full logic part was remade, as hostname wildcard (*.) was not supported by case-sensitive (and not-) prefixes. - List command change: /ipwl list <page> command was changed to not require the <page> parameter, if not specified, command automatically displays the first page. Also, new placeholder was added in list element display line. - Config changes: Since the upper points, log section and command section was changed a bit. Please delete the config.yml and restart the server for a new one. - bStats chart added: New bStats chart (in pie style) was added, it shows the connection type used by IPWhiteList ( YML, SOCKET, or MYSQL). This was made because I'd like to see the usage of YML and SOCKET connection type.

- Detailed logs: For easier troubleshooting, in logs there will be milliseconds displayed also with more messages informing that operation in for example MySQL database is being processed, or it finished. - Changed messages: In some server versions (or client versions), character used in IPWhiteList's messages (►) was not displayed correctly, therefore, it was removed. - Config changes: Messages changed (see upper text), please delete the config.yml and restart your server.

- Async tasks errors in 1.7: When using BungeeCord 1.7, there were constantly appearing errors in console reporting that BungeeCord's scheduler has to be used to run all tasks. - MySQL table recreating: From this update plugin deletes (drops) and recreates the database table so everything will be compatible without any user interaction needed. - Whitelisted IPs sync: Now ready for big networks with more than 1 proxy. If you are using MySQL (this is required option for multiple proxies), you can synchronize all IPWhiteList plugins (their whitelisted IPs) with one central IPWhiteList. For more information please read the plugin wiki. - Config changes: due to whitelisted IPs synchronization feature, configuration file changed. Please delete it and restart your server, so new one will be created for you.

- Security exploits fixed: New security exploits in updating data in MySQL databases were fixed. - MySQL data insert error fixed: Error when writing data to the database was fixed as upper security exploits were fixed. - Switched to UUIDs: Since the first point, there was an option to change the stored data from nicknames to UUIDs, which is implemented in this update.

- MySQL connection inactivity: after certain amount of seconds of connection inactivity (defined by your database server), the connection is automatically closed by the database server. This is now fixed by getting the timeout and repeating task which sends queries to keep the connection alive (repeating delay is set by the obtained session timeout).

- Logging: plugin-separate logging system added. From this update, in plugin folder generates new "logs" folder in which are log files. These logs are plugin-separate, that means there are only IPWhiteList's log messages and all errors, so troubleshooting can be easier. More info about logging is available on wiki. - MySQL connection: new connection type has been added, MYSQL. Pretty the same as YML, except the data is stored in the database. Recommended for only localhost databases with small latency. If you find any problems with MySQL connection, please send me a message! This is for second time I am working with databases. - Config changes: besides new configuration for new features, config was renewed by message-side. Please delete the old one and let plugin create new one for you. - Optimizations: if not using {ip} placeholder in whitelisted IPs, plugin will just simply, skip it's getting using website. - More security: from now, IPWhiteList also detects and kicks player if connecting as already online player, as mentioned in the discussion thread as new feature idea. - bStats: added bStats.

- Version support 1.15 and 1.7: From this update, server versions 1.7 and 1.15 are supported. Please note if using 1.7, disconnect title will not appear since this is feature only from version 1.8. - Automatic reconnection fix: Automatic reconnection feature was fixed.

- Automatic reconnection: Support for IPWhiteListBukkit's new features.

- New bypassing technique secured: New bypassing method has been discovered and secured.

- Case-sensitive hostname comparing: Now you can choose between case-sensitive and not case-sensitive hostname comparing in each whitelisted IP. More information in the configuration documentation or on the wiki.

- Placeholder {ip} upgrade: This placeholder has been changed, now in config.yml you can set what webpage this plugin will retrieve the machine IP for this placeholder from. - Config changes: New configuration added! Please go to the main plugin page and copy the config, or delete it and let the plugin create new one for you.

- Completely new system using sockets: From this version, socket communication has been added. Now you don't have to search for the path, just set up the ports and there you go, with the faster and more reliable way! However, the file communication as it's been till now is also available. - MultiCraft support: From now this plugin is also MultiCraft compatible, thanks to the sockets communication! - Multi-machine support: The sockets can also communicate between two different machines, so if you are not hosting your network on the one single machine, this update is for you! - Config changes: Several changes made in config.yml and new parts have been added. Please delete the file and let the plugin create new one for you.

- Permissions remake: from now, permissions changed from one ipWhiteList.admin to single permission for every command, for more information, please check the main plugin page. - Command change: command /ipwl list changed from this format to command with <page> argument, this means multiple pages support. - Hostname whitelisting: in this update hostname whitelisting has been added. You can specify a hostname with which player can connect, but, using *.yourdomain.com will allow all hostnames ( abc.yourdomain.com, ...). This has been introduced because many of you were using Anti-DDoS service, which added hostnames before the actual IP which players were connecting with.

- Update checker: New update checker, now you will never forget new update! - Config changes: New configuration with update checker, but also comment changes. Please delete your config.yml and let the plugin create new one! - Support for dynamic IP servers: I have added support for servers with dynamic IP, in form of {ip} placeholder in whitelisted IPs list!

- Performance upgrades (API): Upgraded API - sided code. - Support for 1.14: BungeeCord version 1.14 is supported now. - New extension: I made new extension for this plugin, https://www.spigotmc.org/resources/ipwhitelistbukkit-1-7-… Download, configure and put it on your every bukkit server. Without this plugin your server is at risk.