add RateLimiter class

https://github.com/BeamMP/Backend/issues/33

CMakeLists.txt

@@ -35,6 +35,7 @@ set(PRJ_HEADERS
     include/Json.h
     include/LuaAPI.h
     include/RWMutex.h
+    include/RateLimiter.h
     include/SignalHandling.h
     include/TConfig.h
     include/TConsole.h
@@ -50,6 +51,7 @@ set(PRJ_HEADERS
     include/VehicleData.h
     include/Env.h
     include/Profiling.h
+    include/ChronoWrapper.h
 )
 # add all source files (.cpp) to this, except the one with main()
 set(PRJ_SOURCES
@@ -71,9 +73,11 @@ set(PRJ_SOURCES
     src/TResourceManager.cpp
     src/TScopedTimer.cpp
     src/TServer.cpp
+    src/RateLimiter.cpp
     src/VehicleData.cpp
     src/Env.cpp
     src/Profiling.cpp
+    src/ChronoWrapper.cpp
 )
 
 find_package(Lua REQUIRED)
@@ -173,6 +177,11 @@ add_library(commandline_static
     deps/commandline/src/backends/BufferedBackend.cpp
     deps/commandline/src/backends/BufferedBackend.h
 )
+
+# Ensure the commandline library uses C++11
+set_target_properties(commandline_static PROPERTIES CXX_STANDARD 11 CXX_STANDARD_REQUIRED YES)
+
+
 if (WIN32)
     target_compile_definitions(commandline_static PRIVATE -DPLATFORM_WINDOWS=1)
 else ()
@@ -216,4 +225,3 @@ if(${PROJECT_NAME}_ENABLE_UNIT_TESTING)
         target_link_options(${PROJECT_NAME}-tests PRIVATE "/SUBSYSTEM:CONSOLE")
     endif(MSVC)
 endif()
-

include/ChronoWrapper.h

@@ -0,0 +1,8 @@
+#pragma once
+
+#include <chrono>
+#include <string>
+
+namespace ChronoWrapper {
+    std::chrono::high_resolution_clock::duration TimeFromStringWithLiteral(const std::string& time_str);
+}

include/Common.h

@@ -18,6 +18,7 @@
 
 #pragma once
 
+#include <algorithm>
 #include <array>
 #include <atomic>
 #include <cstring>
@@ -65,7 +66,7 @@ public:
         std::string Resource { "Resources" };
         std::string MapName { "/levels/gridmap_v2/info.json" };
         std::string Key {};
-        std::string Password{};
+        std::string Password {};
         std::string SSLKeyPath { "./.ssl/HttpServer/key.pem" };
         std::string SSLCertPath { "./.ssl/HttpServer/cert.pem" };
         bool HTTPServerEnabled { false };
@@ -76,12 +77,14 @@ public:
         int Port { 30814 };
         std::string CustomIP {};
         bool LogChat { true };
+        bool AllowGuests { true };
         bool SendErrors { true };
         bool SendErrorsMessageEnabled { true };
         int HTTPServerPort { 8080 };
         std::string HTTPServerIP { "127.0.0.1" };
         bool HTTPServerUseSSL { false };
         bool HideUpdateMessages { false };
+        std::string UpdateReminderTime { "30s" };
         [[nodiscard]] bool HasCustomIP() const { return !CustomIP.empty(); }
     };
 
@@ -150,7 +153,7 @@ private:
     static inline std::mutex mShutdownHandlersMutex {};
     static inline std::deque<TShutdownHandler> mShutdownHandlers {};
 
-    static inline Version mVersion { 3, 4, 1 };
+    static inline Version mVersion { 3, 5, 0 };
 };
 
 void SplitString(std::string const& str, const char delim, std::vector<std::string>& out);

include/RateLimiter.h

@@ -0,0 +1,20 @@
+#include "Common.h"
+#include <chrono>
+#include <fstream>
+#include <iostream>
+#include <mutex>
+#include <unordered_map>
+#include <unordered_set>
+
+class RateLimiter {
+public:
+    RateLimiter();
+    bool isConnectionAllowed(const std::string& client_address);
+
+private:
+    std::unordered_map<std::string, std::vector<std::chrono::time_point<std::chrono::high_resolution_clock>>> m_connection;
+    std::mutex m_connection_mutex;
+
+    void blockIP(const std::string& client_address);
+    bool isIPBlocked(const std::string& client_address);
+};

include/TNetwork.h

@@ -48,7 +48,6 @@ public:
 private:
     void UDPServerMain();
     void TCPServerMain();
-
     TServer& mServer;
     TPPSMonitor& mPPSMonitor;
     ip::udp::socket mUDPSock;

src/ChronoWrapper.cpp

@@ -0,0 +1,27 @@
+#include "ChronoWrapper.h"
+#include "Common.h"
+#include <regex>
+
+std::chrono::high_resolution_clock::duration ChronoWrapper::TimeFromStringWithLiteral(const std::string& time_str)
+{
+    // const std::regex time_regex(R"((\d+\.{0,1}\d*)(min|ms|us|ns|[dhs]))"); //i.e one of: "25ns, 6us, 256ms, 2s, 13min, 69h, 356d" will get matched (only available in newer C++ versions)
+    const std::regex time_regex(R"((\d+\.{0,1}\d*)(min|[dhs]))"); //i.e one of: "2.01s, 13min, 69h, 356.69d" will get matched
+    std::smatch match;
+    float time_value;
+    if (!std::regex_search(time_str, match, time_regex)) return std::chrono::nanoseconds(0);
+    time_value = stof(match.str(1));
+    beammp_debugf("Parsed time was: {}{}", time_value, match.str(2));
+    if (match.str(2) == "d") {
+        return std::chrono::seconds((uint64_t)(time_value * 86400)); //86400 seconds in a day
+    }
+    else if (match.str(2) == "h") {
+        return std::chrono::seconds((uint64_t)(time_value * 3600)); //3600 seconds in an hour
+    }
+    else if (match.str(2) == "min") {
+        return std::chrono::seconds((uint64_t)(time_value * 60));
+    }
+    else if (match.str(2) == "s") {
+        return std::chrono::seconds((uint64_t)time_value);
+    }
+    return std::chrono::nanoseconds(0);
+}

src/Common.cpp

@@ -28,6 +28,7 @@
 #include <regex>
 #include <sstream>
 #include <thread>
+#include <chrono>
 
 #include "Compat.h"
 #include "CustomAssert.h"
@@ -384,3 +385,4 @@ void SplitString(const std::string& str, const char delim, std::vector<std::stri
         out.push_back(str.substr(start, end - start));
     }
 }
+

src/Http.cpp

@@ -28,15 +28,42 @@
 #include <random>
 #include <stdexcept>
 
-// TODO: Add sentry error handling back
-
 using json = nlohmann::json;
+struct Connection {
+    std::string host{};
+    int port{};
+    Connection() = default;
+    Connection(std::string host, int port)
+        : host(host)
+        , port(port) {};
+};
+constexpr uint8_t CONNECTION_AMOUNT = 10;
+static thread_local uint8_t write_index = 0;
+static thread_local std::array<Connection, CONNECTION_AMOUNT> connections;
+static thread_local std::array<std::shared_ptr<httplib::SSLClient>, CONNECTION_AMOUNT> clients;
+
+[[nodiscard]] static std::shared_ptr<httplib::SSLClient> getClient(Connection connectionInfo) {
+    for (uint8_t i = 0; i < CONNECTION_AMOUNT; i++) {
+        if (connectionInfo.host == connections[i].host
+            && connectionInfo.port == connections[i].port) {
+            beammp_tracef("Old client reconnected, with ip {} and port {}", connectionInfo.host, connectionInfo.port);
+            return clients[i];
+        }
+    }
+    uint8_t i = write_index;
+    write_index++;
+    write_index %= CONNECTION_AMOUNT;
+    clients[i] = std::make_shared<httplib::SSLClient>(connectionInfo.host, connectionInfo.port);
+    connections[i] = {connectionInfo.host, connectionInfo.port};
+    beammp_tracef("New client connected, with ip {} and port {}", connectionInfo.host, connectionInfo.port);
+    return clients[i];
+}
 
 std::string Http::GET(const std::string& host, int port, const std::string& target, unsigned int* status) {
-    httplib::SSLClient client(host, port);
-    client.enable_server_certificate_verification(false);
-    client.set_address_family(AF_INET);
-    auto res = client.Get(target.c_str());
+    std::shared_ptr<httplib::SSLClient> client = getClient({host, port});
+    client->enable_server_certificate_verification(false);
+    client->set_address_family(AF_INET);
+    auto res = client->Get(target.c_str());
     if (res) {
         if (status) {
             *status = res->status;
@@ -48,12 +75,12 @@ std::string Http::GET(const std::string& host, int port, const std::string& targ
 }
 
 std::string Http::POST(const std::string& host, int port, const std::string& target, const std::string& body, const std::string& ContentType, unsigned int* status, const httplib::Headers& headers) {
-    httplib::SSLClient client(host, port);
-    client.set_read_timeout(std::chrono::seconds(10));
-    beammp_assert(client.is_valid());
-    client.enable_server_certificate_verification(false);
-    client.set_address_family(AF_INET);
-    auto res = client.Post(target.c_str(), headers, body.c_str(), body.size(), ContentType.c_str());
+    std::shared_ptr<httplib::SSLClient> client = getClient({host, port});
+    client->set_read_timeout(std::chrono::seconds(10));
+    beammp_assert(client->is_valid());
+    client->enable_server_certificate_verification(false);
+    client->set_address_family(AF_INET);
+    auto res = client->Post(target.c_str(), headers, body.c_str(), body.size(), ContentType.c_str());
     if (res) {
         if (status) {
             *status = res->status;

src/RateLimiter.cpp

@@ -0,0 +1,50 @@
+#include "RateLimiter.h"
+
+RateLimiter::RateLimiter() {};
+
+bool RateLimiter::isConnectionAllowed(const std::string& client_address) {
+    if (RateLimiter::isIPBlocked(client_address)) {
+        return false;
+    }
+    std::lock_guard<std::mutex> lock(m_connection_mutex);
+    auto current_time = std::chrono::high_resolution_clock::now();
+    auto& violations = m_connection[client_address];
+
+    // Deleting old violations (older than 5 seconds)
+    violations.erase(std::remove_if(violations.begin(), violations.end(),
+                         [&](const auto& timestamp) {
+                             return std::chrono::duration_cast<std::chrono::seconds>(current_time - timestamp).count() > 5;
+                         }),
+        violations.end());
+
+    violations.push_back(current_time);
+
+    if (violations.size() >= 4) {
+        RateLimiter::blockIP(client_address);
+        beammp_errorf("[DoS Protection] Client with the IP: {} surpassed the violation treshhold and is now on the blocked list", client_address);
+        return false;
+    }
+
+    return true; // We allow the connection
+}
+
+void RateLimiter::blockIP(const std::string& client_address) {
+    std::ofstream block_file("blocked_ips.txt", std::ios::app);
+    if (block_file.is_open()) {
+        block_file << client_address << std::endl;
+    }
+}
+
+bool RateLimiter::isIPBlocked(const std::string& client_address) {
+    std::ifstream block_file("blocked_ips.txt");
+    std::unordered_set<std::string> blockedIPs;
+
+    if (block_file.is_open()) {
+        std::string line;
+        while (std::getline(block_file, line)) {
+            blockedIPs.insert(line);
+        }
+    }
+
+    return blockedIPs.contains(client_address);
+};

src/TConfig.cpp

@@ -51,12 +51,15 @@ static constexpr std::string_view StrAuthKey = "AuthKey";
 static constexpr std::string_view EnvStrAuthKey = "BEAMMP_AUTH_KEY";
 static constexpr std::string_view StrLogChat = "LogChat";
 static constexpr std::string_view EnvStrLogChat = "BEAMMP_LOG_CHAT";
+static constexpr std::string_view StrAllowGuests = "AllowGuests";
+static constexpr std::string_view EnvStrAllowGuests = "BEAMMP_ALLOW_GUESTS";
 static constexpr std::string_view StrPassword = "Password";
 
 // Misc
 static constexpr std::string_view StrSendErrors = "SendErrors";
 static constexpr std::string_view StrSendErrorsMessageEnabled = "SendErrorsShowMessage";
 static constexpr std::string_view StrHideUpdateMessages = "ImScaredOfUpdates";
+static constexpr std::string_view StrUpdateReminderTime = "UpdateReminderTime";
 
 TEST_CASE("TConfig::TConfig") {
     const std::string CfgFile = "beammp_server_testconfig.toml";
@@ -124,6 +127,8 @@ void TConfig::FlushToFile() {
     SetComment(data["General"][StrAuthKey.data()].comments(), " AuthKey has to be filled out in order to run the server");
     data["General"][StrLogChat.data()] = Application::Settings.LogChat;
     SetComment(data["General"][StrLogChat.data()].comments(), " Whether to log chat messages in the console / log");
+    data["General"][StrAllowGuests.data()] = Application::Settings.AllowGuests;
+    SetComment(data["General"][StrAllowGuests.data()].comments(), " Whether to allow guests");
     data["General"][StrDebug.data()] = Application::Settings.DebugModeEnabled;
     data["General"][StrPrivate.data()] = Application::Settings.Private;
     data["General"][StrPort.data()] = Application::Settings.Port;
@@ -140,6 +145,8 @@ void TConfig::FlushToFile() {
     // Misc
     data["Misc"][StrHideUpdateMessages.data()] = Application::Settings.HideUpdateMessages;
     SetComment(data["Misc"][StrHideUpdateMessages.data()].comments(), " Hides the periodic update message which notifies you of a new server version. You should really keep this on and always update as soon as possible. For more information visit https://wiki.beammp.com/en/home/server-maintenance#updating-the-server. An update message will always appear at startup regardless.");
+    data["Misc"][StrUpdateReminderTime.data()] = Application::Settings.UpdateReminderTime;
+    SetComment(data["Misc"][StrUpdateReminderTime.data()].comments(), " Specifies the time between update reminders. You can use any of \"s, min, h, d\" at the end to specify the units seconds, minutes, hours or days. So 30d or 0.5min will print the update message every 30 days or half a minute.");
     data["Misc"][StrSendErrors.data()] = Application::Settings.SendErrors;
     SetComment(data["Misc"][StrSendErrors.data()].comments(), " If SendErrors is `true`, the server will send helpful info about crashes and other issues back to the BeamMP developers. This info may include your config, who is on your server at the time of the error, and similar general information. This kind of data is vital in helping us diagnose and fix issues faster. This has no impact on server performance. You can opt-out of this system by setting this to `false`");
     data["Misc"][StrSendErrorsMessageEnabled.data()] = Application::Settings.SendErrorsMessageEnabled;
@@ -248,10 +255,12 @@ void TConfig::ParseFromFile(std::string_view name) {
         TryReadValue(data, "General", StrResourceFolder, EnvStrResourceFolder, Application::Settings.Resource);
         TryReadValue(data, "General", StrAuthKey, EnvStrAuthKey, Application::Settings.Key);
         TryReadValue(data, "General", StrLogChat, EnvStrLogChat, Application::Settings.LogChat);
+        TryReadValue(data, "General", StrAllowGuests, EnvStrAllowGuests, Application::Settings.AllowGuests);
         TryReadValue(data, "General", StrPassword, "", Application::Settings.Password);
         // Misc
         TryReadValue(data, "Misc", StrSendErrors, "", Application::Settings.SendErrors);
         TryReadValue(data, "Misc", StrHideUpdateMessages, "", Application::Settings.HideUpdateMessages);
+        TryReadValue(data, "Misc", StrUpdateReminderTime, "", Application::Settings.UpdateReminderTime);
         TryReadValue(data, "Misc", StrSendErrorsMessageEnabled, "", Application::Settings.SendErrorsMessageEnabled);
     } catch (const std::exception& err) {
         beammp_error("Error parsing config file value: " + std::string(err.what()));
@@ -295,6 +304,7 @@ void TConfig::PrintDebug() {
     beammp_debug(std::string(StrDescription) + ": \"" + Application::Settings.ServerDesc + "\"");
     beammp_debug(std::string(StrTags) + ": " + TagsAsPrettyArray());
     beammp_debug(std::string(StrLogChat) + ": \"" + (Application::Settings.LogChat ? "true" : "false") + "\"");
+    beammp_debug(std::string(StrAllowGuests) + ": \"" + (Application::Settings.AllowGuests ? "true" : "false") + "\"");
     beammp_debug(std::string(StrResourceFolder) + ": \"" + Application::Settings.Resource + "\"");
     // special!
     beammp_debug("Key Length: " + std::to_string(Application::Settings.Key.length()) + "");

src/TConsole.cpp

@@ -26,7 +26,9 @@
 #include "TLuaEngine.h"
 
 #include <ctime>
+#include <lua.hpp>
 #include <mutex>
+#include <openssl/opensslv.h>
 #include <sstream>
 
 static inline bool StringStartsWith(const std::string& What, const std::string& StartsWith) {
@@ -273,7 +275,25 @@ void TConsole::Command_Version(const std::string& cmd, const std::vector<std::st
         return;
     }
 
-    Application::Console().WriteRaw("Current version: v" + Application::ServerVersionString());
+    std::string platform;
+#if defined(BEAMMP_WINDOWS)
+    platform = "Windows";
+#elif defined(BEAMMP_LINUX)
+    platform = "Linux";
+#elif defined(BEAMMP_FREEBSD)
+    platform = "FreeBSD";
+#elif defined(BEAMMP_APPLE)
+    platform = "Apple";
+#else
+    platform = "Unknown";
+#endif
+
+    Application::Console().WriteRaw("Platform: " + platform);
+    Application::Console().WriteRaw("Server:   v" + Application::ServerVersionString());
+    std::string lua_version = fmt::format("Lua:      v{}.{}.{}", LUA_VERSION_MAJOR, LUA_VERSION_MINOR, LUA_VERSION_RELEASE);
+    Application::Console().WriteRaw(lua_version);
+    std::string openssl_version = fmt::format("OpenSSL:  v{}.{}.{}", OPENSSL_VERSION_MAJOR, OPENSSL_VERSION_MINOR, OPENSSL_VERSION_PATCH);
+    Application::Console().WriteRaw(openssl_version);
 }
 
 void TConsole::Command_Kick(const std::string&, const std::vector<std::string>& args) {

src/THeartbeatThread.cpp

@@ -20,6 +20,7 @@
 
 #include "Client.h"
 #include "Http.h"
+#include "ChronoWrapper.h"
 //#include "SocketIO.h"
 #include <rapidjson/document.h>
 #include <rapidjson/rapidjson.h>
@@ -36,15 +37,17 @@ void THeartbeatThread::operator()() {
     static std::string Last;
 
     static std::chrono::high_resolution_clock::time_point LastNormalUpdateTime = std::chrono::high_resolution_clock::now();
+    static std::chrono::high_resolution_clock::time_point LastUpdateReminderTime = std::chrono::high_resolution_clock::now();
     bool isAuth = false;
-    size_t UpdateReminderCounter = 0;
+    std::chrono::high_resolution_clock::duration UpdateReminderTimePassed;
+    auto UpdateReminderTimeout = ChronoWrapper::TimeFromStringWithLiteral(Application::Settings.UpdateReminderTime);
     while (!Application::IsShuttingDown()) {
-        ++UpdateReminderCounter;
         Body = GenerateCall();
         // a hot-change occurs when a setting has changed, to update the backend of that change.
         auto Now = std::chrono::high_resolution_clock::now();
         bool Unchanged = Last == Body;
         auto TimePassed = (Now - LastNormalUpdateTime);
+        UpdateReminderTimePassed = (Now - LastUpdateReminderTime);
         auto Threshold = Unchanged ? 30 : 5;
         if (TimePassed < std::chrono::seconds(Threshold)) {
             std::this_thread::sleep_for(std::chrono::milliseconds(100));
@@ -129,7 +132,9 @@ void THeartbeatThread::operator()() {
         if (isAuth || Application::Settings.Private) {
             Application::SetSubsystemStatus("Heartbeat", Application::Status::Good);
         }
-        if (!Application::Settings.HideUpdateMessages && UpdateReminderCounter % 5) {
+        // beammp_debugf("Update reminder time passed: {}, Update reminder time: {}", UpdateReminderTimePassed.count(), UpdateReminderTimeout.count());
+        if (!Application::Settings.HideUpdateMessages && UpdateReminderTimePassed.count() > UpdateReminderTimeout.count()) {
+            LastUpdateReminderTime = std::chrono::high_resolution_clock::now();
             Application::CheckForUpdates();
         }
     }
@@ -148,6 +153,7 @@ std::string THeartbeatThread::GenerateCall() {
         << "&clientversion=" << std::to_string(Application::ClientMajorVersion()) + ".0" // FIXME: Wtf.
         << "&name=" << Application::Settings.ServerName
         << "&tags=" << Application::Settings.ServerTags
+        << "&guests=" << (Application::Settings.AllowGuests ? "true" : "false")
         << "&modlist=" << mResourceManager.TrimmedList()
         << "&modstotalsize=" << mResourceManager.MaxModSize()
         << "&modstotal=" << mResourceManager.ModsLoaded()

src/TLuaEngine.cpp

@@ -66,6 +66,7 @@ void TLuaEngine::operator()() {
     RegisterThread("LuaEngine");
     Application::SetSubsystemStatus("LuaEngine", Application::Status::Good);
     // lua engine main thread
+    beammp_infof("Lua v{}.{}.{}", LUA_VERSION_MAJOR, LUA_VERSION_MINOR, LUA_VERSION_RELEASE);
     CollectAndInitPlugins();
     // now call all onInit's
     auto Futures = TriggerEvent("onInit", "");
@@ -268,7 +269,7 @@ std::vector<std::string> TLuaEngine::StateThreadData::GetStateTableKeys(const st
 
     for (size_t i = 0; i < keys.size(); ++i) {
         auto obj = current.get<sol::object>(keys.at(i));
-        if (obj.get_type() == sol::type::nil) {
+        if (obj.get_type() == sol::type::lua_nil) {
             // error
             break;
         } else if (i == keys.size() - 1) {

src/TNetwork.cpp

@@ -20,6 +20,7 @@
 #include "Client.h"
 #include "Common.h"
 #include "LuaAPI.h"
+#include "RateLimiter.h"
 #include "TLuaEngine.h"
 #include "nlohmann/json.hpp"
 #include <CustomAssert.h>
@@ -196,10 +197,18 @@ void TNetwork::Identify(TConnection&& RawConnection) {
         RawConnection.Socket.shutdown(socket_base::shutdown_both, ec);
         return;
     }
-    std::shared_ptr<TClient> Client { nullptr };
+    std::string client_address = RawConnection.SockAddr.address().to_string();
+    std::shared_ptr<TClient> client { nullptr };
+    RateLimiter ddos_protection;
     try {
         if (Code == 'C') {
-            Client = Authentication(std::move(RawConnection));
+            if (ddos_protection.isConnectionAllowed(client_address)) {
+                beammp_infof("[DoS Protection] Client: [{}] is authorized to connect to the server", client_address);
+                client = Authentication(std::move(RawConnection));
+            } else {
+                beammp_infof("[DoS Protection] Client: [{}] has been denied access to the server", client_address);
+                RawConnection.Socket.shutdown(socket_base::shutdown_both, ec);
+            }
         } else if (Code == 'D') {
             HandleDownload(std::move(RawConnection));
         } else if (Code == 'P') {
@@ -209,7 +218,7 @@ void TNetwork::Identify(TConnection&& RawConnection) {
         } else {
             beammp_errorf("Invalid code got in Identify: '{}'", Code);
         }
-    } catch(const std::exception& e) {
+    } catch (const std::exception& e) {
         beammp_errorf("Error during handling of code {} - client left in invalid state, closing socket", Code);
         boost::system::error_code ec;
         RawConnection.Socket.shutdown(socket_base::shutdown_both, ec);
@@ -278,7 +287,7 @@ std::shared_ptr<TClient> TNetwork::Authentication(TConnection&& RawConnection) {
         return nullptr;
     }
 
-    if (!TCPSend(*Client, StringToVector("A"))) { //changed to A for Accepted version
+    if (!TCPSend(*Client, StringToVector("A"))) { // changed to A for Accepted version
         // TODO: handle
     }
 
@@ -289,16 +298,21 @@ std::shared_ptr<TClient> TNetwork::Authentication(TConnection&& RawConnection) {
         return nullptr;
     }
 
-    std::string key(reinterpret_cast<const char*>(Data.data()), Data.size());
+    std::string Key(reinterpret_cast<const char*>(Data.data()), Data.size());
+    std::string AuthKey = Application::Settings.Key;
+    std::string ClientIp = Client->GetIdentifiers().at("ip");
 
-    nlohmann::json AuthReq{};
-    std::string AuthResStr{};
+    nlohmann::json AuthReq {};
+    std::string AuthResStr {};
     try {
         AuthReq = nlohmann::json {
-            { "key", key }
+            { "key", Key },
+            { "auth_key", AuthKey },
+            { "client_ip", ClientIp }
         };
 
         auto Target = "/pkToUser";
+
         unsigned int ResponseCode = 0;
         AuthResStr = Http::POST(Application::GetBackendUrlForAuth(), 443, Target, AuthReq.dump(), "application/json", &ResponseCode);
 
@@ -334,14 +348,14 @@ std::shared_ptr<TClient> TNetwork::Authentication(TConnection&& RawConnection) {
         return nullptr;
     }
 
-    if(!Application::Settings.Password.empty()) { // ask password
-        if(!TCPSend(*Client, StringToVector("S"))) {
+    if (!Application::Settings.Password.empty()) { // ask password
+        if (!TCPSend(*Client, StringToVector("S"))) {
             // TODO: handle
         }
         beammp_info("Waiting for password");
         Data = TCPRcv(*Client);
         std::string Pass = std::string(reinterpret_cast<const char*>(Data.data()), Data.size());
-        if(Pass != HashPassword(Application::Settings.Password)) {
+        if (Pass != HashPassword(Application::Settings.Password)) {
             beammp_debug(Client->GetName() + " attempted to connect with a wrong password");
             ClientKick(*Client, "Wrong password!");
             return {};
@@ -384,6 +398,11 @@ std::shared_ptr<TClient> TNetwork::Authentication(TConnection&& RawConnection) {
             return false;
         });
 
+    if (!NotAllowedWithReason && !Application::Settings.AllowGuests && Client->IsGuest()) { //! NotAllowedWithReason because this message has the lowest priority
+        NotAllowedWithReason = true;
+        Reason = "No guests are allowed on this server! To join, sign up at: forum.beammp.com.";
+    }
+
     if (NotAllowed) {
         ClientKick(*Client, "you are not allowed on the server!");
         return {};