Add secure single-port HTTP proxy transport

VotingPlugin/pom.xml

@@ -15,6 +15,7 @@
         <maven.compiler.target>21</maven.compiler.target>
         <maven.compiler.release>21</maven.compiler.release>
         <velocity.version>3.4.0</velocity.version>
+        <bouncycastle.version>1.85</bouncycastle.version>
     </properties>
     <build>
         <resources>
@@ -151,6 +152,10 @@
                             <shadedPattern>
                                 ${project.groupId}.votingplugin.bstats</shadedPattern>
                         </relocation>
+                        <relocation>
+                            <pattern>org.bouncycastle</pattern>
+                            <shadedPattern>${project.groupId}.votingplugin.bouncycastle</shadedPattern>
+                        </relocation>
                         <relocation>
                             <pattern>xyz.upperlevel.spigot</pattern>
                             <shadedPattern>
@@ -254,6 +259,16 @@
         </repository>
     </repositories>
     <dependencies>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcpkix-jdk18on</artifactId>
+            <version>${bouncycastle.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bcprov-jdk18on</artifactId>
+            <version>${bouncycastle.version}</version>
+        </dependency>
         <dependency>
             <groupId>org.spigotmc</groupId>
             <artifactId>spigot-api</artifactId>
@@ -692,4 +707,4 @@
             </build>
         </profile>
     </profiles>
-</project>
+</project>

VotingPlugin/src/main/java/com/bencodez/votingplugin/VotingPluginMain.java

@@ -1214,36 +1214,94 @@ public String getBackendHostedControlStatus() {
 	}
 
 	/** Recreates proxy transports after Control applies BungeeSettings.yml. */
-	public synchronized void restartBackendProxyHandler() {
+	public void restartBackendProxyHandler() {
+		restartBackendProxyHandler(System.nanoTime() + TimeUnit.SECONDS.toNanos(25));
+	}
+
+	/** Recreates proxy transports while preserving the caller's end-to-end validation deadline. */
+	public void restartBackendProxyHandler(long validationDeadlineNanos) {
+		BackendProxyRestart restart = prepareBackendProxyHandlerRestart();
+		try {
+			validateBackendProxyHandlerRestart(restart, validationDeadlineNanos);
+			completeBackendProxyHandlerRestart(restart);
+		} catch (RuntimeException failure) {
+			abortBackendProxyHandlerRestart(restart);
+			throw failure;
+		}
+	}
+
+	/** Prepared on the Bukkit thread, validated off-thread, then atomically published on Bukkit. */
+	public static final class BackendProxyRestart {
+		private final BackendProxyHandler previous;
+		private final BackendProxyHandler replacement;
+		private final boolean disabled;
+		private final boolean previousPrepared;
+		private boolean finished;
+
+		private BackendProxyRestart(BackendProxyHandler previous, BackendProxyHandler replacement, boolean disabled,
+				boolean previousPrepared) {
+			this.previous = previous;
+			this.replacement = replacement;
+			this.disabled = disabled;
+			this.previousPrepared = previousPrepared;
+		}
+	}
+
+	public synchronized BackendProxyRestart prepareBackendProxyHandlerRestart() {
 		BackendProxyHandler previous = backendProxyHandler;
 		if (!bungeeSettings.isUseBungeecoord()) {
-			backendProxyHandler = null;
-			if (previous != null) previous.close();
-			BackendControlAutoEnrollment enrollment = backendControlAutoEnrollment;
-			backendControlAutoEnrollment = null;
-			if (enrollment != null) enrollment.close();
-			return;
+			return new BackendProxyRestart(previous, null, true, false);
 		}
 		BungeeMethod replacementMethod = BungeeMethod.getByName(bungeeSettings.getBungeeMethod());
-		if (previous != null) previous.prepareForReplacement(replacementMethod);
+		boolean previousPrepared = previous != null && previous.prepareForReplacement(replacementMethod);
 		BackendProxyHandler replacement = new BackendProxyHandler(this, backendProcessedVoteCache);
 		try {
 			replacement.load();
-			replacement.validateTransport();
-			if (previous != null) previous.completeRedisHandoff(replacement);
 		} catch (RuntimeException failure) {
 			replacement.close();
+			if (previousPrepared) previous.restoreAfterFailedReplacement();
 			throw failure;
 		}
-		backendProxyHandler = replacement;
-		if (previous != null) previous.close();
+		return new BackendProxyRestart(previous, replacement, false, previousPrepared);
+	}
+
+	public void validateBackendProxyHandlerRestart(BackendProxyRestart restart, long validationDeadlineNanos) {
+		if (restart == null) throw new IllegalArgumentException("Backend proxy restart is required");
+		if (restart.replacement != null) restart.replacement.validateTransport(validationDeadlineNanos);
+	}
+
+	public synchronized void completeBackendProxyHandlerRestart(BackendProxyRestart restart) {
+		if (restart == null || restart.finished) throw new IllegalStateException("Backend proxy restart is no longer active");
+		if (backendProxyHandler != restart.previous) throw new IllegalStateException("Backend proxy handler changed during restart");
+		if (restart.disabled) {
+			backendProxyHandler = null;
+			if (restart.previous != null) restart.previous.close();
+			BackendControlAutoEnrollment enrollment = backendControlAutoEnrollment;
+			backendControlAutoEnrollment = null;
+			if (enrollment != null) enrollment.close();
+			restart.finished = true;
+			return;
+		}
+		if (restart.previous != null) restart.previous.completeRedisHandoff(restart.replacement);
+		backendProxyHandler = restart.replacement;
+		if (restart.previous != null) restart.previous.close();
+		restart.finished = true;
 		try {
 			refreshBackendControlAutoEnrollment();
 		} catch (IOException e) {
 			getLogger().warning("[Control] Automatic backend enrollment was not refreshed: " + e.getMessage());
 		}
 	}
 
+	public synchronized void abortBackendProxyHandlerRestart(BackendProxyRestart restart) {
+		if (restart == null || restart.finished) return;
+		if (restart.replacement != null) restart.replacement.close();
+		if (restart.previousPrepared && backendProxyHandler == restart.previous) {
+			restart.previous.restoreAfterFailedReplacement();
+		}
+		restart.finished = true;
+	}
+
 	/** Keeps one plugin-message listener for the plugin lifetime and atomically swaps its active backend handler. */
 	public synchronized void activateBackendPluginMessageHandler(GlobalMessageHandler target) {
 		backendPluginMessageTarget.set(target);

VotingPlugin/src/main/java/com/bencodez/votingplugin/backendproxy/BackendProxyHandler.java

@@ -102,18 +102,30 @@ public void close() {
 	}
 
 	/** Releases a same-method subscriber/listener before its replacement starts. */
-	public void prepareForReplacement(BungeeMethod replacementMethod) {
+	public boolean prepareForReplacement(BungeeMethod replacementMethod) {
 		if (method == replacementMethod && method != BungeeMethod.PLUGINMESSAGING && method != BungeeMethod.REDIS) {
 			transportManager.prepareForReplacement();
+			return method == BungeeMethod.HTTP;
 		}
+		return false;
+	}
+
+	/** Restores a prepared HTTP transport when its replacement fails validation. */
+	public void restoreAfterFailedReplacement() {
+		transportManager.restorePreparedTransport();
 	}
 
 	/** Fails a configuration apply when its selected transport did not initialize. */
 	public void validateTransport() {
+		validateTransport(System.nanoTime() + java.util.concurrent.TimeUnit.SECONDS.toNanos(25));
+	}
+
+	/** Validates transport startup without extending the caller's existing deadline. */
+	public void validateTransport(long deadlineNanos) {
 		if (method == null || globalMessageHandler == null || presenceManager == null) {
 			throw new IllegalStateException("Backend proxy handler initialization failed");
 		}
-		transportManager.validate();
+		transportManager.validate(deadlineNanos);
 	}
 
 	/** Completes the no-loss/no-duplicate same-Redis subscriber handoff after validation. */