From fe15b7838e2f002e95eb0d53adf28765b63fe189 Mon Sep 17 00:00:00 2001
From: Dillon Skaggs <dillon@dillonskaggs.dev>
Date: Wed, 17 Jan 2024 13:21:43 -0600
Subject: [PATCH] fix(state/statebag): filter frequent & large data from client

* if we accept these willy-nilly, clients could possibly OOM the server, or do a one-to-many make-shift DoS on larger a server
* the size limits here are kept high to keep compatibility with people who "misuse" state bags
* sane defaults for servers that don't send large data via state bags would be `set rateLimiter_stateBagSize_rate 8196` and `set rateLimiter_stateBagSize_burst 16364`
---
 .../src/state/ServerGameState.cpp             | 52 ++++++++++++++++++-
 1 file changed, 51 insertions(+), 1 deletion(-)

diff --git a/code/components/citizen-server-impl/src/state/ServerGameState.cpp b/code/components/citizen-server-impl/src/state/ServerGameState.cpp
index 08fcf322d7..e114076630 100644
--- a/code/components/citizen-server-impl/src/state/ServerGameState.cpp
+++ b/code/components/citizen-server-impl/src/state/ServerGameState.cpp
@@ -30,6 +30,8 @@
 #include <boost/range/adaptors.hpp>
 #include <boost/math/constants/constants.hpp>
 
+#include <KeyedRateLimiter.h>
+
 #include <OneSyncVars.h>
 #include <DebugAlias.h>
 
@@ -4250,8 +4252,56 @@ void ServerGameState::AttachToObject(fx::ServerInstanceBase* instance)
 	sbac->SetGameInterface(this);
 
 	instance->GetComponent<fx::GameServer>()->GetComponent<fx::HandlerMapComponent>()->Add(HashRageString("msgStateBag"), 
-		{ fx::ThreadIdx::Sync, [this](const fx::ClientSharedPtr& client, net::Buffer& buffer)
+		{ fx::ThreadIdx::Sync, [this, instance](const fx::ClientSharedPtr& client, net::Buffer& buffer)
 	{
+		static fx::RateLimiterStore<uint32_t, false> stateBagRateLimiterStore{ instance->GetComponent<console::Context>().GetRef() };
+			
+		constexpr double kStateBagRateLimit = 50.f;
+		constexpr double kStateBagRateLimitBurst = 100.f;
+		static auto stateBagRateLimiter = stateBagRateLimiterStore.GetRateLimiter("stateBag", fx::RateLimiterDefaults{ kStateBagRateLimit, kStateBagRateLimitBurst });
+			
+		constexpr double kStateBagRateFloodLimit = 75.f;
+		constexpr double kStateBagRateLimitFloodBurst = 100.f;
+		static auto stateBagRateFloodLimiter = stateBagRateLimiterStore.GetRateLimiter("stateBagFlood", fx::RateLimiterDefaults{ kStateBagRateFloodLimit, kStateBagRateLimitFloodBurst });
+
+		constexpr double kStateBagSizeLimit = 64 * 1024.0;
+		constexpr double kStateBagSizeLimitBurst = 128 * 1024.0;
+		static auto stateBagSizeRateLimiter = stateBagRateLimiterStore.GetRateLimiter("stateBagSize", fx::RateLimiterDefaults{ kStateBagSizeLimit, kStateBagSizeLimitBurst });
+
+		const uint32_t netId = client->GetNetId();
+
+		if (!stateBagRateLimiter->Consume(netId))
+		{
+			if (!stateBagRateFloodLimiter->Consume(netId))
+			{
+				if (!client->IsDropping())
+				{
+					console::Printf("state-bag-warning", "Client %s %i got dropped for sending too many state bag value updates.\n", client->GetName(), netId);
+					console::Printf("state-bag-warning", "If you believe this to be a mistake please increase your rateLimiter_stateBag_rate and rateLimiter_stateBag_burst. ");
+					console::Printf("state-bag-warning", "You can do this with `set rateLimiter_stateBag_rate [new value]`. The default rate limit is 50 and burst limit is 100\n");
+					console::Printf("state-bag-warning", "You can disable this warning with `con_addChannelFilter state-bag-warning drop` if you think you have this properly set up.\n");
+				}
+
+				instance->GetComponent<fx::GameServer>()->DropClient(client, "Reliable state bag packet overflow.");
+			}
+
+			return;
+		}
+
+		uint32_t dataLength = buffer.GetRemainingBytes();
+		if (!stateBagSizeRateLimiter->Consume(netId, double(dataLength)))
+		{
+			if (!client->IsDropping())
+			{
+				console::Printf("state-bag-warning", "Client %s %d got dropped for sending too large of a state bag update.\n", client->GetName(), netId);
+				console::Printf("state-bag-warning", "If you believe this to be a mistake please increase your rateLimiter_stateBagSize_rate. ");
+				console::Printf("state-bag-warning", "You can do this with `set rateLimiter_stateBag_rate [new value]`. The default size rate limit is 64000.\n");
+				console::Printf("state-bag-warning", "You can disable this warning with `con_addChannelFilter state-bag-warning drop` if you think you have this properly set up.\n");
+			}
+
+			instance->GetComponent<fx::GameServer>()->DropClient(client, "Reliable state bag packet overflow.");
+			return;
+		}
 		
 		uint32_t slotId = client->GetSlotId();
 		if (slotId != -1)