RPCDoSDetection.cpp File Reference

#include "Net/RPCDoSDetection.h"
#include "Net/RPCDoSDetectionConfig.h"
#include "HAL/IConsoleManager.h"
#include "Misc/ConfigCacheIni.h"
#include "EngineLogs.h"
#include "UObject/UnrealType.h"

Functions
const TCHAR *	LexToString (ERPCDoSEscalateReason Reason)

Variables
TAutoConsoleVariable< FString >	CVarRPCDoSDetectionOverride (TEXT("net.RPCDoSDetectionOverride"), TEXT(""), TEXT("Example: net.RPCDoSDetectionOverride=GameNetDriver=1,BeaconNetDriver=0"))
int32	GAllowRPCDoSDetectionBlocking = 1
FAutoConsoleVariableRef	CVarAllowRPCDoSDetectionBlocking (TEXT("net.AllowRPCDoSDetectionBlocking"), GAllowRPCDoSDetectionBlocking, TEXT("Overrides whether or not RPC DoS Detection RPC blocking is allowed. 0 = disabled, 1 = enabled."))
TAutoConsoleVariable< int32 >	CVarAllowRPCDoSDetectionKicking (TEXT("net.AllowRPCDoSDetectionKicking"), 1, TEXT("Overrides whether or not RPC DoS Detection kicking is enabled. 0 = disabled, 1 = enabled."))
TAutoConsoleVariable< FString >	CVarRPCDoSForcedRPCTracking (TEXT("net.RPCDoSForcedRPCTracking"), TEXT(""), TEXT("Example (50% chance for 10 seconds): net.RPCDoSForcedRPCTracking=ServerAdmin,0.5,10"))

Function Documentation

LexToString()

const TCHAR * LexToString

(

ERPCDoSEscalateReason

Reason

)

ERPCDoSEscalateReason Convert ERPCDoSEscalateReason enum values, to a string.

Parameters

Reason

The enum value to convert.

Returns

The string name for the enum value.

Variable Documentation

CVarAllowRPCDoSDetectionBlocking

FAutoConsoleVariableRef CVarAllowRPCDoSDetectionBlocking(TEXT("net.AllowRPCDoSDetectionBlocking"), GAllowRPCDoSDetectionBlocking, TEXT("Overrides whether or not RPC DoS Detection RPC blocking is allowed. 0 = disabled, 1 = enabled."))	(	TEXT("net.AllowRPCDoSDetectionBlocking")	,
		GAllowRPCDoSDetectionBlocking	,
		TEXT("Overrides whether or not RPC DoS Detection RPC blocking is allowed. 0 = disabled, 1 = enabled.")
	)

CVarAllowRPCDoSDetectionKicking

TAutoConsoleVariable< int32 > CVarAllowRPCDoSDetectionKicking(TEXT("net.AllowRPCDoSDetectionKicking"), 1, TEXT("Overrides whether or not RPC DoS Detection kicking is enabled. 0 = disabled, 1 = enabled."))	(	TEXT("net.AllowRPCDoSDetectionKicking")	,
		1	,
		TEXT("Overrides whether or not RPC DoS Detection kicking is enabled. 0 = disabled, 1 = enabled.")
	)

CVarRPCDoSDetectionOverride

TAutoConsoleVariable< FString > CVarRPCDoSDetectionOverride(TEXT("net.RPCDoSDetectionOverride"), TEXT(""), TEXT("Example: net.RPCDoSDetectionOverride=GameNetDriver=1,BeaconNetDriver=0"))	(	TEXT("net.RPCDoSDetectionOverride")	,
		TEXT("")	,
		TEXT("Example: net.RPCDoSDetectionOverride=GameNetDriver=1,BeaconNetDriver=0")
	)

RPC DoS Detection

DoS attacks against game servers through expensive or spammed server RPC calls are relatively rare compared to DDoS attacks, and the players responsible much easier to identify due to requiring a full post-handshake connection to the game server (which means that their IP address has been verified, unlike DDoS attacks).

There are many cases where there can be false positives during normal or competitive gameplay which result in RPC spam, so RPC DoS Detection should lean towards being less strict - with analytics audited to watch for false positives, and performance optimization of expensive RPC's used to get rid of those false positives (with the bonus of optimizing server perf).

The default configuration of RPC DoS states should be loose enough to avoid blocking of RPC's or kicking players, outside of extreme circumstances - while still protecting servers from expensive RPC DoS attacks.

Implementation

RPC DoS Detection is implemented in a similar but improved way to the DDoS Detection, using thresholds with escalating states of severity.

RPC DoS attacks are detected by setting configurable thresholds for the number of RPC's received and time spent executing them, per-frame or per configurable time period (e.g. over 1 second, 4 seconds etc.).

To minimize false positives and be resilient to temporary bursts of RPC's, several escalating states of different thresholds are used, first being based on using the same counter/timer for all RPC's, then more expensive tracking of individual RPC counts/execution-time, eventually escalating into blocking particularly spammy or expensive RPC's, and in rare/extreme cases kicking the player.

Once tracking of RPC's is enabled, all RPC's above a certain timing threshold will be collected for analytics, which makes the analytics useful for tracking general worst-case RPC performance.

Importantly, RPC timing is approximate (using cached 'close enough' time values), so while it will give a good indication of performance, it's not a substitute for proper profiling - it is still useful for analytics and performance optimization though. CVars

CVarRPCDoSForcedRPCTracking

TAutoConsoleVariable< FString > CVarRPCDoSForcedRPCTracking(TEXT("net.RPCDoSForcedRPCTracking"), TEXT(""), TEXT("Example (50% chance for 10 seconds): net.RPCDoSForcedRPCTracking=ServerAdmin,0.5,10"))	(	TEXT("net.RPCDoSForcedRPCTracking")	,
		TEXT("")	,
		TEXT("Example (50% chance for 10 seconds): net.RPCDoSForcedRPCTracking=ServerAdmin,0.5,10")
	)

GAllowRPCDoSDetectionBlocking

int32 GAllowRPCDoSDetectionBlocking = 1