package com.lunarshield; import com.google.inject.Inject; import com.velocitypowered.api.event.Subscribe; import com.velocitypowered.api.event.proxy.ProxyInitializeEvent; import com.velocitypowered.api.plugin.Plugin; import com.velocitypowered.api.plugin.annotation.DataDirectory; import com.velocitypowered.api.proxy.ProxyServer; import net.kyori.adventure.text.Component; import net.kyori.adventure.text.serializer.legacy.LegacyComponentSerializer; import org.slf4j.Logger; import org.yaml.snakeyaml.Yaml; import java.io.File; import java.io.FileInputStream; import java.io.IOException; import java.io.InputStream; import java.nio.file.Files; import java.nio.file.Path; import java.util.*; @Plugin( id = "lunarshield", name = "LunarShield", version = "1.1.0", description = "Lightweight domain protection with deceptive MOTD for Velocity proxy", authors = {"LunarShield"} ) public class LunarShield { private final ProxyServer server; private final Logger logger; private final Path dataDirectory; private Set allowedDomains; private boolean logBlocked; private Component kickMessageComponent; private boolean fakePingEnabled; private FakePingConfig directIpConfig; private FakePingConfig unknownDomainConfig; @Inject public LunarShield(ProxyServer server, Logger logger, @DataDirectory Path dataDirectory) { this.server = server; this.logger = logger; this.dataDirectory = dataDirectory; } @Subscribe public void onProxyInitialization(ProxyInitializeEvent event) { try { loadConfiguration(); } catch (IOException e) { logger.error("Failed to load configuration", e); allowedDomains = new HashSet<>(); logBlocked = true; kickMessageComponent = Component.text("Connection rejected."); fakePingEnabled = false; } server.getEventManager().register(this, new ConnectionListener(this)); logger.info("LunarShield v1.1.0 enabled with {} allowed domain(s)", allowedDomains.size()); if (fakePingEnabled) { logger.info("Fake MOTD deception enabled - attackers will see decoy servers"); } } public void loadConfiguration() throws IOException { if (!Files.exists(dataDirectory)) { Files.createDirectories(dataDirectory); } File configFile = dataDirectory.resolve("config.yml").toFile(); if (!configFile.exists()) { try (InputStream in = getClass().getResourceAsStream("/config.yml")) { if (in != null) { Files.copy(in, configFile.toPath()); } } } Yaml yaml = new Yaml(); Map config; try (FileInputStream fis = new FileInputStream(configFile)) { config = yaml.load(fis); } List domains = (List) config.getOrDefault("allowed-domains", List.of()); allowedDomains = new HashSet<>(); for (String domain : domains) { allowedDomains.add(domain.toLowerCase()); } logBlocked = (Boolean) config.getOrDefault("log-blocked-attempts", true); String kickMessage = (String) config.getOrDefault("kick-message", "Connection rejected."); kickMessageComponent = LegacyComponentSerializer.legacyAmpersand().deserialize(kickMessage); // Load fake ping configuration Map fakePing = (Map) config.get("fake-ping"); if (fakePing != null) { fakePingEnabled = (Boolean) fakePing.getOrDefault("enabled", true); Map directIp = (Map) fakePing.get("direct-ip"); if (directIp != null) { directIpConfig = parseFakePingConfig(directIp); } Map unknownDomain = (Map) fakePing.get("unknown-domain"); if (unknownDomain != null) { unknownDomainConfig = parseFakePingConfig(unknownDomain); } } else { fakePingEnabled = false; } if (allowedDomains.isEmpty()) { logger.warn("No allowed domains configured! All connections will be blocked."); } } private FakePingConfig parseFakePingConfig(Map section) { List variants = new ArrayList<>(); List> motdVariants = (List>) section.get("motd-variants"); if (motdVariants != null) { for (Map variant : motdVariants) { String line1 = variant.getOrDefault("line1", "Minecraft Server"); String line2 = variant.getOrDefault("line2", "A Minecraft Server"); variants.add(new MotdVariant(line1, line2)); } } int protocol = (Integer) section.getOrDefault("protocol-version", -1); String protocolName = (String) section.getOrDefault("protocol-name", "Unknown"); String playerCount = (String) section.getOrDefault("player-count", "0/0"); List fakePlayers = (List) section.getOrDefault("fake-players", new ArrayList<>()); return new FakePingConfig(variants, protocol, protocolName, playerCount, fakePlayers); } public boolean isAllowedDomain(String hostname) { // Fast reject: null or empty if (hostname == null || hostname.isEmpty()) { return false; } // Fast reject: starts with digit = IP address (no DNS lookup needed) char firstChar = hostname.charAt(0); if (firstChar >= '0' && firstChar <= '9') { return false; } // Remove port if present (avoid regex/split for performance) int portIndex = hostname.indexOf(':'); String cleanHostname = (portIndex == -1) ? hostname : hostname.substring(0, portIndex); // Lowercase and check whitelist (single allocation) cleanHostname = cleanHostname.toLowerCase(); return allowedDomains.contains(cleanHostname); } public boolean isDirectIp(String hostname) { if (hostname == null || hostname.isEmpty()) { return true; } // Remove port if present int portIndex = hostname.indexOf(':'); String cleanHostname = (portIndex == -1) ? hostname : hostname.substring(0, portIndex); char firstChar = cleanHostname.charAt(0); return firstChar >= '0' && firstChar <= '9'; } public boolean shouldLogBlocked() { return logBlocked; } public Component getKickMessage() { return kickMessageComponent; } public Logger getLogger() { return logger; } public boolean isFakePingEnabled() { return fakePingEnabled; } public FakePingConfig getDirectIpConfig() { return directIpConfig; } public FakePingConfig getUnknownDomainConfig() { return unknownDomainConfig; } public static class FakePingConfig { private final List motdVariants; private final int protocolVersion; private final String protocolName; private final String playerCount; private final List fakePlayers; private final Random random = new Random(); public FakePingConfig(List motdVariants, int protocolVersion, String protocolName, String playerCount, List fakePlayers) { this.motdVariants = motdVariants; this.protocolVersion = protocolVersion; this.protocolName = protocolName; this.playerCount = playerCount; this.fakePlayers = fakePlayers; } public MotdVariant getRandomMotd() { if (motdVariants.isEmpty()) { return new MotdVariant("Minecraft Server", "A Minecraft Server"); } return motdVariants.get(random.nextInt(motdVariants.size())); } public int getProtocolVersion() { return protocolVersion; } public String getProtocolName() { return protocolName; } public int[] getPlayerCount() { String[] parts = playerCount.split("/"); try { int online = Integer.parseInt(parts[0].trim()); int max = Integer.parseInt(parts[1].trim()); return new int[]{online, max}; } catch (Exception e) { return new int[]{0, 0}; } } public List getFakePlayers() { return fakePlayers; } } public static class MotdVariant { private final String line1; private final String line2; public MotdVariant(String line1, String line2) { this.line1 = line1; this.line2 = line2; } public String getLine1() { return line1; } public String getLine2() { return line2; } } }