AlliedModders

AlliedModders (https://forums.alliedmods.net/index.php)
-   New Plugin Submissions (https://forums.alliedmods.net/forumdisplay.php?f=26)
-   -   Proxy snort 1.8 (Updated Jan 24th, 2024) (https://forums.alliedmods.net/showthread.php?t=322186)

galebhasis 07-17-2021 17:14

Re: Proxy snort 1.3 (Updated 12/25/2020)
 
Quote:

Originally Posted by DJEarthQuake (Post 2753004)
Try CVAR proxy_debug 0. I've updated it. Thank you for heads up!

OMG u rock dude this plugin is saving our server!

DJEarthQuake 07-17-2021 17:20

Re: Proxy snort 1.4 (Updated 07/17/2021)
 
Glad you found script useful. Proxy_debug 0 will make it near silent. Download 1.4. The new copy blocks VPN. 1.3 and lower only did proxy. Each time the socket closed it was sending that colorful text message, now only on proxy_debug 5. It will run much smoother now.

DeNeDe 08-22-2021 15:00

Re: Proxy snort 1.5 (Updated 08/05/2021)
 
So i've used this today.. Everything installed properly. i've entered my server with my normal ip, looked at the logs and i saw how it checked the ip and said no proxies used..good
Then i entered the server again while my vpn was connected and ... it said no proxies detected
I've checked my vpn ip on the service site, in the dashboard and indeed it says Proxy.

DJEarthQuake 08-23-2021 05:15

Re: Proxy snort 1.5 (Updated 08/05/2021)
 
It has been corrected. Thank you. That is also why the SteamIDs were not showing on Dashboard any longer.

HamletEagle 08-23-2021 08:35

Re: Proxy snort 1.5 (Updated 08/23/2021)
 
I'm interested in reviewing this, but I'd like someone to confirm that it works before I start checking the code.

Shadows Adi 08-23-2021 10:32

Re: Proxy snort 1.5 (Updated 08/23/2021)
 
Code:

ProxySnort 1.5 by SPiNX:Starting to open socket!
08/23/2021 - 16:48:47: Invalid CVAR pointer
08/23/2021 - 16:48:47: [AMXX] Displaying debug trace (plugin "test.amxx", version "1.5")
08/23/2021 - 16:48:47: [AMXX] Run time error 10: native error (native "get_pcvar_num")
08/23/2021 - 16:48:47: [AMXX] [0] test.sma::@write_web (line 229)
ProxySnort 1.5 by SPiNX:reading the socket
08/23/2021 - 16:48:47: Invalid CVAR pointer
08/23/2021 - 16:48:47: [AMXX] Displaying debug trace (plugin "test.amxx", version "1.5")
08/23/2021 - 16:48:47: [AMXX] Run time error 10: native error (native "get_pcvar_num")
08/23/2021 - 16:48:47: [AMXX] [0] test.sma::@read_web (line 414)

Fix:
PHP Code:

if(get_pcvar_num(g_clientemp_version))

->>

if(
g_clientemp_version && get_pcvar_num(g_clientemp_version)) 

Or you can check if cvar exists.

And it also doesn't show the risk:
Code:

ProxySnort task input time = 5.000000
Checking connected user if not a bot
Sniffing a public IP address...192.40.57.227, Adi
ProxySnort 1.5 by SPiNX:Starting to open socket!
ProxySnort 1.5 by SPiNX:Is socket writable?
ProxySnort 1.5 by SPiNX:Yes! Writing to the socket of Adi
ProxySnort 1.5 by SPiNX:reading the socket
ProxySnort 1.5 by SPiNX:reading the socket
Proxy sniff...192.40.57.227|STEAM_0:0:195136759
08/23/2021 - 17:01:25: [test.amxx] Adi, STEAM_0:0:195136759 uses a proxy!
No proxy found on Adi, STEAM_0:0:195136759
ProxySnort 1.5 SPiNX | Adi uses Performive LLC for an ISP.
ProxySnort 1.5 by SPiNX | Adi's risk is 0.
Dropped Adi from server
Reason: Kicked :"Anonymizing is NOT allowed!"

GET Request:
Code:

{
    "status": "ok",
    "192.40.57.227": {
        "asn": "AS46562",
        "provider": "Performive LLC",
        "continent": "Europe",
        "country": "Netherlands",
        "isocode": "NL",
        "region": "North Holland",
        "regioncode": "NH",
        "city": "Amsterdam",
        "latitude": 52.3716,
        "longitude": 4.8883,
        "proxy": "yes",
        "type": "Compromised Server",
        "risk": 100,
        "attack history": {
            "Total": 22,
            "Login Attempt": 22
        }
    }
}

Fix:

On line 363

PHP Code:

copy(riskcharsmax(risk), proxy_socket_buffer[containi(proxy_socket_buffer"risk") + 5])

->>

copy(riskcharsmax(risk), proxy_socket_buffer[containi(proxy_socket_buffer"risk") + 7]) 

In rest, it seems to work as intended.

DeNeDe 08-23-2021 10:40

Re: Proxy snort 1.5 (Updated 08/23/2021)
 
More issues would be that it might lag the server doing all those checks in the background? Won't be better to use the geoip module integration instead?
i've seen geoip has now databases for vpn/proxies detection too..also for ASN(s)

Shadows Adi 08-23-2021 11:40

Re: Proxy snort 1.5 (Updated 08/23/2021)
 
Quote:

Originally Posted by DeNeDe (Post 2755958)
More issues would be that it might lag the server doing all those checks in the background? Won't be better to use the geoip module integration instead?
i've seen geoip has now databases for vpn/proxies detection too..also for ASN(s)

GeoIP Module doesn't support this.

DJEarthQuake 08-23-2021 22:33

Re: Proxy snort 1.5 (Updated 08/23/2021)
 
Thanks @Shadows Adi. Native find_plugin_byfile was needed later down the line when companion plugin, clientemp, is tested and disabled.


Run-time error happens occasionally. I had to use copyc and end it on the end of buffer bracket.

krisztian2 11-24-2021 13:24

Re: Proxy snort 1.5 (Updated 09/25/2021)
 
Dear DJEarthQuake!

This plugin is not work for me.
But in amxx plugins list the plugin status is running.
I created an account on proxycheck and I set API key in this plugin cvar.

DJEarthQuake 11-25-2021 06:43

Re: Proxy snort 1.5 (Updated 09/25/2021)
 
Thanks for the heads up. It was line 133. Changed from alive to connected. Half-Life Opposing Forces mod, which is one of the mods I test this on, did not have trouble from it, but DoD did checking again. I've made a series of other updates to the script including an initialization file it builds from previous client checks.

OCEAN1337 02-19-2022 06:06

Re: Proxy snort 1.6 (Updated December 24th 2021)
 
Hi i installed the plugin put i want to change this command amx_addban with amx_banip, i've don that but it says Client with that name or userid not found. I use advanced_bans and the command for ban is amx_banip name time(wich i wanna be 0) reason example: amx_banip dorel 0 proxyuse

DJEarthQuake 02-20-2022 07:09

Re: Proxy snort 1.6 (Updated December 24th 2021)
 
Setting proxy_action 2 interfaces with advanced bans or stock, amx_addban, without editing the code to ban off the IP.

OCEAN1337 02-21-2022 13:03

Re: Proxy snort 1.7 (Updated February 19th 2022)
 
L 02/21/2022 - 20:02:41: [AMXX] Displaying debug trace (plugin "antivpn.amxx", version "1.6")
L 02/21/2022 - 20:02:41: [AMXX] Run time error 4: index out of bounds
L 02/21/2022 - 20:02:41: [AMXX] [0] antivpn.sma::client_putinserver (line 136)

DJEarthQuake 02-21-2022 16:17

Re: Proxy snort 1.7 (Updated February 19th 2022)
 
I've updated the code so that cannot happen. Please try V1.7 sir. I did find it humorous I have been using script for years and with 56,476 connects that has never happened to me!! One look at the script you must have a busier server. Mine is very slow. Unsure otherwise how that has not ever happened. Will drop you in on the testing credit. That was very good. Thanks for checking that.

OCEAN1337 02-22-2022 07:35

Re: Proxy snort 1.7 (Updated February 19th 2022)
 
Quote:

Originally Posted by DJEarthQuake (Post 2772091)
I've updated the code so that cannot happen. Please try V1.7 sir. I did find it humorous I have been using script for years and with 56,476 connects that has never happened to me!! One look at the script you must have a busier server. Mine is very slow. Unsure otherwise how that has not ever happened. Will drop you in on the testing credit. That was very good. Thanks for checking that.

I have installed the latest update, but the error is there and does not ban the user.

DJEarthQuake 02-22-2022 16:03

Re: Proxy snort 1.7 (Updated February 21st 2022)
 
Corrected client removal problem.

skuny 03-07-2022 09:35

Re: Proxy snort 1.7 (Updated February 21st 2022)
 
Quote:

Originally Posted by DJEarthQuake (Post 2772171)
Corrected client removal problem.

Hey long time no see, I'm trying to compile 1.7 but i get errors like:

antivpn.sma(1) : error 010: invalid function or declaration
antivpn.sma(224) : error 017: undefined symbol "SOCK_NON_BLOCKING"
antivpn.sma(251) : error 017: undefined symbol "WEATHER_SCRIPT"
antivpn.sma(252) : error 017: undefined symbol "WEATHER_SCRIPT"
antivpn.sma(484) : error 017: undefined symbol "WEATHER_SCRIPT"
antivpn.sma(486) : error 017: undefined symbol "WEATHER_SCRIPT

in version 1.4 that i used last year was no errors, can u send me please amxx file in private ? I did buy the proxycheck now but can recompile.

skuny 03-07-2022 09:44

Re: Proxy snort 1.7 (Updated February 21st 2022)
 
Quote:

Originally Posted by DJEarthQuake (Post 2772171)
Corrected client removal problem.

also doesn't compile for 1.8.2 i need for that version to work... i have for 1.8.3. works normaly.

skuny 03-07-2022 09:55

Re: Proxy snort 1.7 (Updated March 4th 2022)
 
after enabling:

#define SOCK_NON_BLOCKING (1 << 0) /* Set the socket a nonblocking */
#define SOCK_LIBC_ERRORS (1 << 1) /* Enable libc error reporting */

i get error:

antivpn.sma(226) : error 088: number of arguments does not match definition

line 226: get_pcvar_string(g_cvar_token, token, charsmax (token));

DJEarthQuake 03-07-2022 15:03

Re: Proxy snort 1.7 (Updated March 4th 2022)
 
Go ahead and test again please. New code posted regarding all your findings. Thank you.

skuny 03-08-2022 10:31

Re: Proxy snort 1.7 (Updated March 4th 2022)
 
Quote:

Originally Posted by DJEarthQuake (Post 2773381)
Go ahead and test again please. New code posted regarding all your findings. Thank you.

Compile works, amxx file will be tested later today, thanks for your hard work buddy!

bigdaddy424 03-09-2022 18:31

Re: Proxy snort 1.7 (Updated March 7th 2022)
 
donde esta la code?

fysiks 03-09-2022 21:55

Re: Proxy snort 1.7 (Updated March 7th 2022)
 
There is a link to a messy repository on GitHub. The fact that it's a link that blends in with all the other stuff in his post make is hard to find/see.

DJEarthQuake 03-10-2022 06:19

Re: Proxy snort 1.7 (Updated March 7th 2022)
 
Quote:

Originally Posted by bigdaddy424 (Post 2773618)
donde esta la code?

escribado mas grande ahora
written bigger now

bigdaddy424 03-10-2022 21:46

Re: Proxy snort 1.7 (Updated March 7th 2022)
 
While downloading 3rd party plugin files on the server, client_connect may trigger twice and it might bypass g_has_been_checked
I'd recommend creating a bool to prevent checking the player twice
Code:
public client_connect(){     if (!connect){         connect = true         // reset this on @read_web or client_disconnnected in case he quits before loading the game     } }

fysiks 03-10-2022 21:52

Re: Proxy snort 1.7 (Updated March 7th 2022)
 
Quote:

Originally Posted by DJEarthQuake (Post 2773687)
escribado mas grande ahora
written bigger now

You could simply attach the latest version to the first post to make it easier.

DJEarthQuake 03-16-2022 00:48

Re: Proxy snort 1.7 (Updated March 15th 2022)
 
"...in case he quits before loading the game"
The data is cached locally. Once an IP touches ProxySnort, it's fate's final.

ady2324 06-09-2022 06:58

Re: Proxy snort 1.7 (Updated March 15th 2022)
 
Hi

I use the plugin with free key
I have 3 servers
But ban on only 1 server, the others server the same vpn can enter how to fix?

DJEarthQuake 06-09-2022 08:01

Re: Proxy snort 1.7 (Updated March 15th 2022)
 
Be sure to use the most up-to-date script on all 3 servers. Symbolic link proxy_checked.ini from a centralized location like steamapps common to the 3 servers to synchronize. I symbolic link the script there too so it feeds to multiple servers running various mods and versions of Amxx. That helps avoid version mismatches.

ady2324 06-09-2022 12:58

Re: Proxy snort 1.7 (Updated March 15th 2022)
 
Hy the plugin leth me in with vpn
I the panel apares vpn,
Change map and i am in

Plugin failed to ban me

DJEarthQuake 06-09-2022 13:47

Re: Proxy snort 1.7 (Updated March 15th 2022)
 
Is there a 0 or 1 next to said IP in proxy_checked.ini?

posyleu 11-22-2022 12:50

Re: Proxy snort 1.7 (Updated March 15th 2022)
 
It's just what I was looking for. I want to better manage my server in C.S. 1.6, and this software will be a great tool to keep all the hackers and bots away. Most of them use VPNs and proxies to connect and are quite difficult to detect in manual mode.
There's nothing bad in using a good proxy server from Shift Proxy, but it becomes problematic when cheaters and hackers use the same server to sabotage the game. That's why many admins have to ban the usage of any VPNs and proxies in general. It's because of people who abused these safety measures and used them to their own advantage.

DJEarthQuake 11-27-2022 09:20

Re: Proxy snort 1.7 (Updated March 15th 2022)
 
Quote:

Originally Posted by ady2324 (Post 2781372)
Hy the plugin leth me in with vpn
I the panel apares vpn,
Change map and i am in

Plugin failed to ban me

I've just updated it.

Quote:

Originally Posted by posyleu (Post 2793449)
It's just what I was looking for. I want to better manage my server in C.S. 1.6, and this software will be a great tool to keep all the hackers and bots away. Most of them use VPNs and proxies to connect and are quite difficult to detect in manual mode.

Thank you.

Mikka 11-28-2022 11:44

Re: Proxy snort 1.7 (Updated Nov 26th 2022)
 
Plugin not kicking me on vpn ;/

Mikka 11-28-2022 12:13

Re: Proxy snort 1.7 (Updated Nov 26th 2022)
 
plugin is not checked all of ips

Mikka 11-28-2022 12:36

Re: Proxy snort 1.7 (Updated March 15th 2022)
 
Quote:

Originally Posted by DJEarthQuake (Post 2793810)
I've just updated it.


Thank you.

Is this that normal save?

Code:


"127.0.0.1" "1"
"185.X.120.200" "0"
"46.X.36.36" "0"
"46.X.36.36" "0"
"46.X.36.36" "0"
"46.X.36.36" "0"
"46.X.36.36" "0"
"138.X.22.98" "0"
"138.X.22.98" "0"
"138.X.22.98" "0"
"37.7.XX.233" "1"
"37.7.XX.233" "0"
"37.7.XX.233" "1"
"37.7.XX.233" "0"
"37.7.XX.233" "1"
"37.7.XX.233" "0"


DJEarthQuake 11-28-2022 22:46

Re: Proxy snort 1.7 (Updated Nov 26th 2022)
 
That was rare like 1 in 25 but I have been seeing it since yesterday more often than not. The tasks were doing 2 players at the exact same time when there should have been one making unnecessary additional entries of IP's already on the list. I'll address it further now. Thank you. As far as not detecting you see if proxycheck.io shows it as a VPN and proxy_admin, cvar is set to 1 to check admins. After I cleaned up my duplicates I left myself added as a 1 and a 0. It banned me trying to connect. I could not see the server on the list across the network.

Mikka 11-29-2022 13:44

Re: Proxy snort 1.7 (Updated Nov 26th 2022)
 
how to repair it?

DJEarthQuake 11-29-2022 18:21

Re: Proxy snort 1.7 (Updated Nov 26th 2022)
 
I've updated script and reverted it back to no longer try to catch the downloaders. It was causing these hits and misses by and large from what I can see with so few people playing these days in past few hours. Re-download script and erase the ini file or use some other tool to erase the duplicates without conflicting data or ignore them. The ones with conflicting data I would erase and also get a little nosy and see how it happened by inputting IP into proxycheck.io.
When both 0 and 1 show for same IP it will ban them.


On Linux CLI sort input_file | uniq > output_file is one way.

LibreOffice Calc method.


All times are GMT -4. The time now is 10:33.

Powered by vBulletin®
Copyright ©2000 - 2024, vBulletin Solutions, Inc.