Conntrack (#3901)

<!-- IT'S NOT WIZDENS REPO, IF YOU WANT TO ADD YOUR CHANGES ON ALL
SERVERS, CREATE PR TO WIZDENS REPO -->

## Short description
A fix for a few more places that still use the old IP.

## Why we need to add this

## Media (Video/Screenshots)
<!--
If your PR contains in-game changes you must provide screenshots/videos
of the changes.
-->

## Checks
<!-- check boxes for faster reviewing of your PR -->

- [x] I do not require assistance to complete the PR.
- [x] Before posting/requesting review of a PR, I have verified that the
changes work.
- [x] I have added screenshots/videos of the changes, or this PR does
not change in-game mechanics.
- [x] I affirm that my changes are licensed under the [MIT
License](https://github.com/ss14Starlight/space-station-14/blob/Starlight/LICENSE.TXT)
and grant permission for use in this repository under its conditions.

**Changelog**
<!--
If you want the players to know about changes made in this PR, specify
them using the template outside the comment. Short and informative.

:cl: STARLIGHT TEAM
- add: Added Starlight.
- remove: Removed SS13.
- tweak: Changed SS14.
- fix: Fixed Rinary.
-->

---------

Co-authored-by: Walker Fowlkes <47339836+walksanatora@users.noreply.github.com>

Author: StarlightHost

Content.Server/Administration/Managers/BanManager.cs

@@ -30,6 +30,7 @@
 using System.Text.Json;
 using System.Text.RegularExpressions;
 using Content.Server.Discord;
+using Content.Server.Connection;
 using Content.Server._NullLink.Core;
 using Content.Server._NullLink.Helpers;
 using Content.Shared.Starlight.CCVar;
@@ -42,6 +43,7 @@ namespace Content.Server.Administration.Managers;
 public sealed partial class BanManager : IBanManager, IPostInjectInit
 {
     [Dependency] private readonly IActorRouter _actor = default!; // nulllink
+    [Dependency] private readonly IConnectionManager _connectionManager = default!; // Starlight
     [Dependency] private readonly IConfigurationManager _cfg = default!;
     [Dependency] private readonly IChatManager _chat = default!;
     [Dependency] private readonly IServerDbManager _db = default!;
@@ -100,7 +102,9 @@ private async Task CachePlayerData(ICommonSession player, CancellationToken canc
         var netChannel = player.Channel;
         ImmutableArray<byte>? hwId = netChannel.UserData.HWId.Length == 0 ? null : netChannel.UserData.HWId;
         var modernHwids = netChannel.UserData.ModernHWIds;
-        var roleBans = await _db.GetServerRoleBansAsync(netChannel.RemoteEndPoint.Address, player.UserId, hwId, modernHwids, false);
+        var addr = _connectionManager.GetResolvedAddress(player.UserId)
+                   ?? netChannel.RemoteEndPoint.Address; // Starlight: prefer resolved IP
+        var roleBans = await _db.GetServerRoleBansAsync(addr, player.UserId, hwId, modernHwids, false);
 
         var userRoleBans = new List<ServerRoleBanDef>();
         foreach (var ban in roleBans)
@@ -221,7 +225,8 @@ private bool BanMatchesPlayer(ICommonSession player, ServerBanDef ban)
         var playerInfo = new BanMatcher.PlayerInfo
         {
             UserId = player.UserId,
-            Address = player.Channel.RemoteEndPoint.Address,
+            Address = _connectionManager.GetResolvedAddress(player.UserId)
+                      ?? player.Channel.RemoteEndPoint.Address, // Starlight: prefer resolved IP
             HWId = player.Channel.UserData.HWId,
             ModernHWIds = player.Channel.UserData.ModernHWIds,
             // It's possible for the player to not have cached data loading yet due to coincidental timing.

Content.Server/Administration/PlayerLocator.cs

@@ -76,6 +76,7 @@ internal sealed class PlayerLocator : IPlayerLocator, IDisposable, IPostInjectIn
         [Dependency] private readonly IConfigurationManager _configurationManager = default!;
         [Dependency] private readonly IServerDbManager _db = default!;
         [Dependency] private readonly ILogManager _logManager = default!;
+        [Dependency] private readonly IConnectionManager _connectionManager = default!; // Starlight
 
         private readonly HttpClient _httpClient = new();
         private ISawmill _sawmill = default!;
@@ -148,10 +149,11 @@ public PlayerLocator()
             return new LocatedPlayerData(new NetUserId(responseData.UserId), null, null, responseData.UserName, null, []);
         }
 
-        private static LocatedPlayerData ReturnForSession(ICommonSession session)
+        private LocatedPlayerData ReturnForSession(ICommonSession session) // Starlight: non-static, uses resolved IP
         {
             var userId = session.UserId;
-            var address = session.Channel.RemoteEndPoint.Address;
+            var address = _connectionManager.GetResolvedAddress(userId)
+                          ?? session.Channel.RemoteEndPoint.Address; // Starlight: prefer resolved IP
             var hwId = session.Channel.UserData.GetModernHwid();
             return new LocatedPlayerData(
                 userId,

Content.Server/Administration/PlayerPanelEui.cs

@@ -2,6 +2,7 @@
 using Content.Server.Administration.Logs;
 using Content.Server.Administration.Managers;
 using Content.Server.Administration.Notes;
+using Content.Server.Connection;
 using Content.Server.Database;
 using Content.Server.EUI;
 using Content.Shared.Administration;
@@ -17,6 +18,7 @@ namespace Content.Server.Administration;
 public sealed class PlayerPanelEui : BaseEui
 {
     [Dependency] private readonly IAdminManager _admins = default!;
+    [Dependency] private readonly IConnectionManager _connectionManager = default!; // Starlight
     [Dependency] private readonly IServerDbManager _db = default!;
     [Dependency] private readonly IAdminNotesManager _notesMan = default!;
     [Dependency] private readonly IEntityManager _entity = default!;
@@ -179,7 +181,10 @@ public async void SetPlayerState()
             _notes = null;
         }
 
-        _sharedConnections = _player.Sessions.Count(s => s.Channel.RemoteEndPoint.Address.Equals(_targetPlayer.LastAddress) && s.UserId != _targetPlayer.UserId);
+        _sharedConnections = _player.Sessions.Count(s =>
+            (_connectionManager.GetResolvedAddress(s.UserId) ?? s.Channel.RemoteEndPoint.Address) // Starlight: prefer resolved IP
+                .Equals(_targetPlayer.LastAddress)
+            && s.UserId != _targetPlayer.UserId);
 
     // Apparently the Bans flag is also used for whitelists
     if (_admins.HasAdminFlag(Player, AdminFlags.Ban))

Content.Server/Connection/ConnectionManager.cs

@@ -55,6 +55,13 @@ public interface IConnectionManager
         void AddTemporaryConnectBypass(NetUserId user, TimeSpan duration);
 
         void Update();
+
+        /// <summary>
+        /// Gets the resolved real client IP for a connected user.
+        /// When conntrack resolution is active, this returns the real IP behind SNAT.
+        /// Returns <c>null</c> if the user has no cached address.
+        /// </summary>
+        IPAddress? GetResolvedAddress(NetUserId user); // Starlight
     }
 
     /// <summary>
@@ -82,6 +89,7 @@ public sealed partial class ConnectionManager : IConnectionManager
 
         private ISawmill _sawmill = default!;
         private readonly Dictionary<NetUserId, TimeSpan> _temporaryBypasses = [];
+        private readonly Dictionary<NetUserId, IPAddress> _resolvedAddresses = []; // Starlight
         private IPIntel.IPIntel _ipintel = default!;
         private ConntrackResolver _conntrack = default!; // Starlight
 
@@ -116,6 +124,12 @@ public void AddTemporaryConnectBypass(NetUserId user, TimeSpan duration)
                 time = newTime;
         }
 
+        // Starlight: resolved IP cache
+        public IPAddress? GetResolvedAddress(NetUserId user)
+        {
+            return _resolvedAddresses.GetValueOrDefault(user);
+        }
+
         public async void Update()
         {
             try
@@ -181,6 +195,7 @@ private async Task NetMgrOnConnecting(NetConnectingArgs e)
             }
             else
             {
+                _resolvedAddresses[userId] = addr; // Starlight: cache resolved IP for later lookups
                 await _db.AddConnectionLogAsync(userId, e.UserName, addr, hwid, trust, null, serverId);
 
                 if (!ServerPreferencesManager.ShouldStorePrefs(e.AuthType))
@@ -196,6 +211,8 @@ private async void PlayerStatusChanged(object? sender, SessionStatusEventArgs ar
             {
                 AdminAlertIfSharedConnection(args.Session);
             }
+            else if (args.NewStatus == SessionStatus.Disconnected) // Starlight
+                _resolvedAddresses.Remove(args.Session.UserId); // Starlight
         }
 
         private void AdminAlertIfSharedConnection(ICommonSession newSession)
@@ -204,11 +221,13 @@ private void AdminAlertIfSharedConnection(ICommonSession newSession)
             if (playerThreshold < 0)
                 return;
 
-            var addr = newSession.Channel.RemoteEndPoint.Address;
+            var addr = _resolvedAddresses.GetValueOrDefault(newSession.UserId)
+                       ?? newSession.Channel.RemoteEndPoint.Address; // Starlight: use resolved IP
 
             var otherConnectionsFromAddress = _plyMgr.Sessions.Where(session =>
                     session.Status is SessionStatus.Connected or SessionStatus.InGame
-                    && session.Channel.RemoteEndPoint.Address.Equals(addr)
+                    && (_resolvedAddresses.GetValueOrDefault(session.UserId)
+                        ?? session.Channel.RemoteEndPoint.Address).Equals(addr) // Starlight: use resolved IP
                     && session.UserId != newSession.UserId)
                 .ToList();