DDoSDetection.h

Go to the documentation of this file.

// Copyright Epic Games, Inc. All Rights Reserved.
 
#pragma once
 
#include "Containers/Array.h"
#include "Containers/UnrealString.h"
#include "CoreMinimal.h"
#include "Delegates/Delegate.h"
#include "HAL/Platform.h"
#include "HAL/PlatformTime.h"
 
 
// Delegates
 
DECLARE_DELEGATE_OneParam(FDDoSSeverityEscalation, FString /*SeverityCategory*/);
 
 
 
struct FDDoSPacketCounters
{
    int32 NonConnPacketCounter;
 
    int32 NetConnPacketCounter;
 
    int32 DisconnPacketCounter;
 
    int32 BadPacketCounter;
 
    int32 ErrorPacketCounter;
 
    int32 DroppedPacketCounter;
 
    int32 WorstFrameReceiveTimeMS;
 
 
    FDDoSPacketCounters()
        : NonConnPacketCounter(0)
        , NetConnPacketCounter(0)
        , DisconnPacketCounter(0)
        , BadPacketCounter(0)
        , ErrorPacketCounter(0)
        , DroppedPacketCounter(0)
        , WorstFrameReceiveTimeMS(0)
    {
    }
};
 
 
struct FDDoSState
{
    bool bSendEscalateAnalytics;
 
    int32 EscalateQuotaPacketsPerSec;
 
    int32 EscalateQuotaDisconnPacketsPerSec;
 
    int32 EscalateQuotaBadPacketsPerSec;
 
    int16 EscalateTimeQuotaMSPerFrame;
 
    int32 PacketLimitPerFrame;
 
    int32 PacketTimeLimitMSPerFrame;
 
    int32 NetConnPacketTimeLimitMSPerFrame;
 
    int32 CooloffTime;
 
 
    FDDoSState()
        : bSendEscalateAnalytics(true)
        , EscalateQuotaPacketsPerSec(-1)
        , EscalateQuotaDisconnPacketsPerSec(-1)
        , EscalateQuotaBadPacketsPerSec(-1)
        , EscalateTimeQuotaMSPerFrame(-1)
        , PacketLimitPerFrame(-1)
        , PacketTimeLimitMSPerFrame(-1)
        , NetConnPacketTimeLimitMSPerFrame(-1)
        , CooloffTime(-1)
    {
    }
 
    bool HasHitQuota(FDDoSPacketCounters& InCounter, int32 TimePassedMS) const
    {
        const bool bAtQuota = EscalateQuotaPacketsPerSec > 0 && InCounter.NonConnPacketCounter >= EscalateQuotaPacketsPerSec;
        const bool bAtDisconnQuota = EscalateQuotaDisconnPacketsPerSec > 0 && InCounter.DisconnPacketCounter >= EscalateQuotaDisconnPacketsPerSec;
        const bool bAtBadQuota = EscalateQuotaBadPacketsPerSec > 0 && InCounter.BadPacketCounter >= EscalateQuotaBadPacketsPerSec;
        const bool bAtTimeQuota = EscalateTimeQuotaMSPerFrame > 0 && TimePassedMS > EscalateTimeQuotaMSPerFrame;
 
        return bAtQuota || bAtDisconnQuota || bAtBadQuota || bAtTimeQuota;
    }
};
 
struct FDDoSStateConfig : public FDDoSState
{
    FString SeverityCategory;
 
 
    FDDoSStateConfig()
        : SeverityCategory(TEXT(""))
    {
    }
 
    void ApplyState(FDDoSState& Target)
    {
        Target.bSendEscalateAnalytics               = bSendEscalateAnalytics;
        Target.EscalateQuotaPacketsPerSec           = EscalateQuotaPacketsPerSec;
        Target.EscalateQuotaDisconnPacketsPerSec    = EscalateQuotaDisconnPacketsPerSec;
        Target.EscalateQuotaBadPacketsPerSec        = EscalateQuotaBadPacketsPerSec;
        Target.EscalateTimeQuotaMSPerFrame          = EscalateTimeQuotaMSPerFrame;
        Target.PacketLimitPerFrame                  = PacketLimitPerFrame;
        Target.PacketTimeLimitMSPerFrame            = PacketTimeLimitMSPerFrame;
        Target.NetConnPacketTimeLimitMSPerFrame     = NetConnPacketTimeLimitMSPerFrame;
        Target.CooloffTime                          = CooloffTime;
    }
 
    void ApplyAdjustedState(FDDoSState& Target, float FrameAdjustment)
    {
        // Exclude escalation triggers from this
        //Target.EscalateTimeQuotaMSPerFrame        = (EscalateTimeQuotaMSPerFrame == -1 ? -1 : EscalateTimeQuotaMSPerFrame * FrameAdjustment);
        Target.PacketLimitPerFrame              = (PacketLimitPerFrame == -1 ? -1 : (int32)((float)PacketLimitPerFrame * FrameAdjustment));
        Target.PacketTimeLimitMSPerFrame        = (PacketTimeLimitMSPerFrame == -1 ? -1 : (int32)((float)PacketTimeLimitMSPerFrame * FrameAdjustment));
        Target.NetConnPacketTimeLimitMSPerFrame = (NetConnPacketTimeLimitMSPerFrame == -1 ? -1 : (int32)((float)NetConnPacketTimeLimitMSPerFrame * FrameAdjustment));
    }
};
 
 
class FDDoSDetection : protected FDDoSPacketCounters, protected FDDoSState
{
public:
    NETCORE_API FDDoSDetection();
 
 
    NETCORE_API void Init(int32 MaxTickRate);
 
    NETCORE_API void InitConfig();
 
    NETCORE_API void SetMaxTickRate(int32 MaxTickRate);
 
    NETCORE_API void UpdateSeverity(bool bEscalate);
 
 
    NETCORE_API void PreFrameReceive(float DeltaTime);
 
    NETCORE_API void PostFrameReceive();
 
 
    void CondCheckNonConnQuotasAndLimits()
    {
        // Limit checks to once every 128 packets
        if (((NonConnPacketCounter + DisconnPacketCounter) & 0x7F) == 0)
        {
            bHitFrameNonConnLimit = CheckNonConnQuotasAndLimits();
        }
    }
 
    void CondCheckNetConnLimits()
    {
        // Limit checks to once every 128 packets
        if ((NetConnPacketCounter & 0x7F) == 0)
        {
            bHitFrameNetConnLimit = CheckNetConnLimits();
        }
    }
 
 
    bool CheckLogRestrictions()
    {
        return bDDoSLogRestrictions || (bDDoSDetection && ++LogHitCounter > DDoSLogSpamLimit);
    }
 
 
    // Brief accessors
 
    bool IsDDoSDetectionEnabled() const     { return bDDoSDetection; }
    bool IsDDoSAnalyticsEnabled() const     { return bDDoSAnalytics; }
    bool ShouldBlockNonConnPackets() const  { return bHitFrameNonConnLimit; }
    bool ShouldBlockNetConnPackets() const  { return bHitFrameNetConnLimit; }
 
    void IncNonConnPacketCounter()          { ++NonConnPacketCounter; }
    int32 GetNonConnPacketCounter() const   { return NonConnPacketCounter; }
    void IncNetConnPacketCounter()          { ++NetConnPacketCounter; }
    int32 GetNetConnPacketCounter() const   { return NetConnPacketCounter; }
    void IncDisconnPacketCounter()          { ++ DisconnPacketCounter; }
    int32 GetDisconnPacketCounter() const   { return DisconnPacketCounter; }
    void IncBadPacketCounter()              { ++BadPacketCounter; }
    int32 GetBadPacketCounter() const       { return BadPacketCounter; }
    void IncErrorPacketCounter()            { ++ErrorPacketCounter; }
    int32 GetErrorPacketCounter() const     { return ErrorPacketCounter; }
    void IncDroppedPacketCounter(int32 Count=1)         { DroppedPacketCounter += Count; }
    int32 GetDroppedPacketCounter() const   { return DroppedPacketCounter; }
 
protected:
    NETCORE_API bool CheckNonConnQuotasAndLimits();
 
    bool CheckNetConnLimits()
    {
        return NetConnPacketTimeLimitMSPerFrame > 0 &&
                (int32)((FPlatformTime::Seconds() - StartFrameRecvTimestamp) * 1000.0) > NetConnPacketTimeLimitMSPerFrame;
    }
 
 
 
protected:
    bool bDDoSDetection;
 
    bool bDDoSAnalytics;
 
    bool bHitFrameNonConnLimit;
 
    bool bHitFrameNetConnLimit;
 
 
    TArray<FDDoSStateConfig> DetectionSeverity;
 
    int8 ActiveState;
 
    int8 WorstActiveState;
 
    double LastMetEscalationConditions;
 
    bool bMetEscalationConditionsThisFrame;
 
 
    bool bDDoSLogRestrictions;
 
    int32 DDoSLogSpamLimit;
 
    int32 LogHitCounter;
 
 
    int32 HitchTimeQuotaMS;
 
    int8 HitchFrameTolerance;
 
    int32 HitchFrameCount;
 
 
    double LastPerSecQuotaBegin;
 
    TArray<FDDoSPacketCounters> CounterPerSecHistory;
 
    int32 LastCounterPerSecHistoryIdx;
 
 
    double StartFrameRecvTimestamp;
 
    double EndFrameRecvTimestamp;
 
    int32 StartFramePacketCount;
 
    double ExpectedFrameTime;
 
    float FrameAdjustment;
 
 
public:
    FDDoSSeverityEscalation NotifySeverityEscalation;
};