Client's causing crashes by spamming server net messages

[HornetPilot]

Anti-cheats seem to be so easy to get past these days, especially when public ones are leaked everywhere for people to get around. And when they do get around them, they can do some nasty stuff to the server, assuming there's ways to exploit.
Unfortunately, people have been crashing my server for weeks using an exploit that I only learned of today, and this through the Keypad addon. However, it isn't the addon that is directly causing it. Assuming the client bypasses sv_allowcslua, they can spam a net message to the server and crash it. But removing that addon won't fix the problem, because they can just target another net message. In fact, they can target ANY net message and it will still work (or at least I believe anyways)
Turns out that Garry's Mod net messages have a very large flaw in it that I can't seem to do much about. I have found an old thread (Wrapper around net.Incoming to prevent clients from spamming bad..) which had a fix but the problem is, it still lags the server massively, and can break any net message strings not added to the whitelist.
I was hoping to get some help on the issue as it is making it very hard to host a server, especially when people come on and do this shit. If we ban them, they'll just come up by VPN or an alt account so it's never ending.
Sorry for the low bounty too, it's all I have

[Bobblehead]

I would just write a script that counts the number of net messages received from a player per second and if it's greater than say 500 then just ban their steam and ip.
You should treat this like a DDoS because thats what it is. The less of a reaction they get out of you the more likely they are to just fuck off. Automate your punishments and they'll lose interest.

[Kevlon]

Net messages don't have any 'flaw' built into them, It's only bad serverside code that causes lag.

Whoever you confronted about crashing your server is giving you false info, you can't just spam any net message and crash a server.

[HornetPilot]

It doesn't matter what's in the net message (it can be empty, or even return end under certain conditions, like the keypad) and it will still crash all clients. It fills the queue for the net messages which basically ceases connection between the server and client.

[Bobblehead]

You're right to say that the net buffer can overflow. However I'm inclined to believe that the server is crashing as a result of something happening in one of your net messages DUE to this overflow. Either way, it crashes. But Kevlon is also right that there's not an inherent flaw with the net library.
Anyway consider the solution I proposed earlier. If you need help writing that code let me know.

[HornetPilot]

I misworded it when I said it crashed the server; it more lags it to the point where it cant be used until it goes through the net buffer. Usually it'll drop all player connections within a minute or two with the overflow error.
Excuse if it's pretty shit code, I've never done something along these lines

local banList = {}
banList["keypad"] = true

function net.Incoming( len, client )

local i = net.ReadHeader()
local strName = util.NetworkIDToString( i )

if ( !strName ) then return end

local func = net.Receivers[ strName:lower() ]
if ( !func ) then return end
if !client or !IsValid(client) then return end
if client and IsValid(client) then 
if !client._net_block then
client._net_block = {}
client._net_block[strName:lower()] = {num = 1, time = CurTime()}
else
if client._net_block[strName:lower()] then
local data = client._net_block[strName:lower()]
local Num = data.num 
local Time = data.time 
local curTime = CurTime()
if curTime-Time > 1 then
Time = curTime
end
client._net_block[strName:lower()] = {num = Num + 1, time = Time}
//print(curTime-Time)
if Num >= 100 and curTime-Time < 1 and banList[strName:lower()] and !client._netbanned then 
client._netbanned = true
RunConsoleCommand("ulx","ban",client:Nick(),0,"Exploiting Net Messages")
RunConsoleCommand("say","(AUTOMATED) APOLOGIES FOR THE LAG, PERSON WHO CAUSED IT IS BANNED!")
return
end
if client._netbanned then
return
end
else
local Time = CurTime()
client._net_block[strName:lower()] = {num = 1, time = Time}
end
end
end
--
-- len includes the 16 bit int which told us the message name
--
len = len - 16

func( len, client )

end

[c👌de_g🎷]

Just ask cake and I'm sure he can implement a fix.

[Bobblehead]

I wouldn't check per netmessage name, or blacklist/whitelist certain messages. As an exploiter I would just change message names with each message.
CAC probably does overwrite it. You should do a tailcall like this:

net._oldIncoming = net._oldIncoming or net.Incoming
function net.Incoming( len, client )
--your logic here.
net._oldIncoming(len,client)
end
That way your code also executes even if it's overwritten.

[HornetPilot]

Originally I didn't have a whitelist/blacklist, but certain addons (like CAC) were detected by this and kept banning players (including me), so I had to do a system like that. I did change how the script works however so if it detects net spam and it isnt on the whitelist, it'll log it on the server

[Bobblehead]

!Cake can probably answer that in a support ticket.

[zoryn]

Hi, people have been coming on and using this method to lag and crash my server. I was wondering if you found a solid fix for this, and if you would like to add me on steam so we can talk more about it. It's starting to become very common because these exploits are public now, and popular servers are being targeted with this method.

[c👌de_g🎷]

Bobblehead provided a solution.

[zoryn]

Sorry I don't quite understand what he's correcting since I really don't understand the code. Is Bobblehead saying to add those lines in HornetPilot's lines or replace it with the lines he wrote?

[c👌de_g🎷]

I was referring to his explanation, but you could also try HornetPilot's code