IPIntel IP auditing integration

[VasilisThePikachu]

The IPIntel integration has been merged into the master branch. IPIntel is an external API that
will check the connecting users IP address and return a float from 0 to 1. 1 being sus and 0 being safe. Effectively it is an automated VPN check and should massively help admins.

You can read more about the service here: https://getipintel.net/free-proxy-vpn-tor-detection-api/

To enable this on your server, pull upstream to your repo or cherry-pick 96d913b147f13fb7f7226a65d24c7da6dedf469a. (This will be pushed to stable of course when the time comes) and then set the following required ccvars:

ipintel_enabled = true
ipintel_contact_email = "[email protected]"

For free, ipintel gives out 500 daily request limit and 15 requests per minute. That is counted along your contact email and ip address (For the record they have a paid service with a minimum of 300/RPM, I am unsure of the cost however, but it's probably cheaper than other services in the wild).

I recommend sharing this rate limit along all the servers on your network. (game.ipintel_request_limit_minute & game.ipintel_request_limit_daily) to avoid getting your service cut off (Although the server will properly respond to 429 by the api with a backoff if you did hit the limit unexpectebly).

By default, players with more than 5 hours of playtime or with a datacenter or blacklistedrange exception flag bypass the system without making a request. Requests are also cached on the database for 7 days to preserve your rate limit and are checked for first. All this is of course configurable. Any score above 0.95 will be denied by default, this value is non-final and may change depending on the amount of false positives we see when we deploy this system ourselves. (You may also set it to warn only if you like to test the waters first.)

All configurable ccvars here:

space-station-14/Content.Shared/CCVar/CCVars.Game.cs

Lines 243 to 341 in 9cc76d9

	/// <summary>
	/// Enable IPIntel for blocking VPN connections from new players.
	/// </summary>
	public static readonly CVarDef<bool> GameIPIntelEnabled =
	CVarDef.Create("game.ipintel_enabled", false, CVar.SERVERONLY);
	/// <summary>
	/// Whether clients which are flagged as a VPN will be denied
	/// </summary>
	public static readonly CVarDef<bool> GameIPIntelRejectBad =
	CVarDef.Create("game.ipintel_reject_bad", true, CVar.SERVERONLY);
	/// <summary>
	/// Whether clients which cannot be checked due to a rate limit will be denied
	/// </summary>
	public static readonly CVarDef<bool> GameIPIntelRejectRateLimited =
	CVarDef.Create("game.ipintel_reject_ratelimited", false, CVar.SERVERONLY);
	/// <summary>
	/// Whether clients which cannot be checked due to an error of some form will be denied
	/// </summary>
	public static readonly CVarDef<bool> GameIPIntelRejectUnknown =
	CVarDef.Create("game.ipintel_reject_unknown", false, CVar.SERVERONLY);
	/// <summary>
	/// Should an admin message be made if the connection got rejected cause of ipintel?
	/// </summary>
	public static readonly CVarDef<bool> GameIPIntelAlertAdminReject =
	CVarDef.Create("game.ipintel_alert_admin_rejected", false, CVar.SERVERONLY);
	/// <summary>
	/// A contact email to be sent along with the request. Required by IPIntel
	/// </summary>
	public static readonly CVarDef<string> GameIPIntelEmail =
	CVarDef.Create("game.ipintel_contact_email", string.Empty, CVar.SERVERONLY | CVar.CONFIDENTIAL);
	/// <summary>
	/// The URL to IPIntel to make requests to. If you pay for more queries this is what you want to change.
	/// </summary>
	public static readonly CVarDef<string> GameIPIntelBase =
	CVarDef.Create("game.ipintel_baseurl", "https://check.getipintel.net", CVar.SERVERONLY);
	/// <summary>
	/// The flags to use in the request to IPIntel, please look here for more info. https://getipintel.net/free-proxy-vpn-tor-detection-api/#optional_settings
	/// Note: Some flags may increase the chances of false positives and request time. The default should be fine for most servers.
	/// </summary>
	public static readonly CVarDef<string> GameIPIntelFlags =
	CVarDef.Create("game.ipintel_flags", "b", CVar.SERVERONLY);
	/// <summary>
	/// Maximum amount of requests per Minute. For free you get 15.
	/// </summary>
	public static readonly CVarDef<int> GameIPIntelMaxMinute =
	CVarDef.Create("game.ipintel_request_limit_minute", 15, CVar.SERVERONLY);
	/// <summary>
	/// Maximum amount of requests per Day. For free you get 500.
	/// </summary>
	public static readonly CVarDef<int> GameIPIntelMaxDay =
	CVarDef.Create("game.ipintel_request_limit_daily", 500, CVar.SERVERONLY);
	/// <summary>
	/// Amount of seconds to add to the exponential backoff with every failed request.
	/// </summary>
	public static readonly CVarDef<int> GameIPIntelBackOffSeconds =
	CVarDef.Create("game.ipintel_request_backoff_seconds", 30, CVar.SERVERONLY);
	/// <summary>
	/// How much time should pass before we attempt to cleanup the IPIntel table for old ip addresses?
	/// </summary>
	public static readonly CVarDef<int> GameIPIntelCleanupMins =
	CVarDef.Create("game.ipintel_database_cleanup_mins", 15, CVar.SERVERONLY);
	/// <summary>
	/// How long to store results in the cache before they must be retrieved again in days.
	/// </summary>
	public static readonly CVarDef<TimeSpan> GameIPIntelCacheLength =
	CVarDef.Create("game.ipintel_cache_length", TimeSpan.FromDays(7), CVar.SERVERONLY);
	/// <summary>
	/// Amount of playtime in minutes to be exempt from an IP check. 0 to search everyone. 5 hours by default.
	/// <remarks>
	/// Trust me you want one.
	/// </remarks>>
	/// </summary>
	public static readonly CVarDef<TimeSpan> GameIPIntelExemptPlaytime =
	CVarDef.Create("game.ipintel_exempt_playtime", TimeSpan.FromMinutes(300), CVar.SERVERONLY);
	/// <summary>
	/// Rating to reject at. Anything equal to or higher than this will reject the connection.
	/// </summary>
	public static readonly CVarDef<float> GameIPIntelBadRating =
	CVarDef.Create("game.ipintel_bad_rating", 0.95f, CVar.SERVERONLY);
	/// <summary>
	/// Rating to send an admin warning over, but not reject the connection. Set to 0 to disable
	/// </summary>
	public static readonly CVarDef<float> GameIPIntelAlertAdminWarnRating =
	CVarDef.Create("game.ipintel_alert_admin_warn_rating", 0f, CVar.SERVERONLY);

(Not legal advice) Servers with privacy policies should probably indicate that they send player IP addresses to IPIntel for auditing.