PaperMC
[Improvement] add event when proxy-protocol packet is received
i see you added ConnectionInitEvent to waterfall, i would suggest an improvement
when you use Waterfall behind HAProxy, this event become quite useless as the ip the event see is the ip of the HAProxy server. So if you want to implement a connection throttler, or a macanism that prevents layer 7 flood (eg: handshake packet error flood) based on the connection IP, you can't. (not a good idea to ban your load-balancer's IP)
So, in case of proxy-protocol enabled, i think an other event should be triggered when Waterfall receive the packet from the HAProxy server with the "real connection IP". This event should allow to get the IP and to drop the associated connection (cancellable like the ConnectionInitEvent).
Thank you all for your work on this fork :)
Wrong. The IP the event see is the player's real IP. The event is called at very early stage, even before the HAProxyMessage is received and decoded.
When you use HAProxy in front of your Waterfall/BungeeCord, the IP which init
the connection is the IP of the HAProxy server, not the IP of the Minecraft Client. So, no the ConnectionInitEvent doesn't see the player IP at this early stage of the connection.
Just the same way as Spigot see BungeeCord IP if bungee-protocol is not enabled.
I think it might be better to feed the connection blockage maybe into iptables before HAProxy. That way you're protecting all your bungee's together. Not sure how HAProxy reacts if the connection is closed immediately: will it maybe try to connect every directly cancelled connection to each other bungee until there's no option left or sth. like that?
When your HAProxy is not managed by you, you can't play with iptable in front of HAProxy. Also, playing with iptable for a connection throttler seems quite heavy. I already made some test and it did not caused any problem to close the connection.