mirror of
https://github.com/smartcmd/MinecraftConsoles.git
synced 2026-10-22 19:22:04 +00:00
The old Windows64 port had no real player identity — it used hardcoded fake XUIDs, so anyone could impersonate anyone. This replaces that with proper auth supporting Mojang, Ely.by, and offline accounts. MCAuth library (new, MCAuth/): Mojang auth via MSA device code flow (XBL, SISU, MC services), Ely.by via Yggdrasil with 2FA, offline UUID generation matching Java Edition (MD5 v3 from "OfflinePlayer:<name>"). Multi-account manager with background token refresh, per-slot sessions, and on-disk token persistence. Server-side session verification via Mojang/Ely.by hasJoined API. Skin fetching and PNG validation from texture servers. Network protocol (version bumped to 80): Three new packets (AuthScheme, AuthResponse, AuthResult) implement a server-driven auth handshake before login completes. Player identity migrated from 64-bit XUID to 128-bit GameUUID backed by two uint64 fields (hi/lo). readPlayerUID/writePlayerUID now serialize 16 bytes on the wire. Old and new clients cannot connect to each other — version mismatch is rejected at PreLogin. Save migration: Map data mappings auto-migrate from old format: the old 64-bit XUID is placed in hi, lo is set to 0 as a sentinel. On first access by the real player, the sentinel entry is upgraded in-place to the full 128-bit UUID. Format detection is by file size (2080, 2112, or 4160 bytes). Player .dat filenames inside saveData.ms change from decimal XUID to dashed UUID — old saves need manual entry renaming in the archive. UI: NativeUIRenderer: immediate-mode drawing system (quads, text, 9-slice panels, scrollbars, focus lists) for rendering auth screens without Flash/Scaleform. UIScene_MSAuth handles device code display, Ely.by credential input with 2FA, per-account skin head preview, and multi-account add/remove/switch. Server: online-mode and auth-provider (mojang/elyby) in server.properties. Whitelist and ban checks validate against the server-verified UUID. Incompatible auth scheme logs which provider the server expects vs what the client is using. Also fixes a pre-existing exploit where any client could send a DebugOptionsPacket to grant themselves CraftAnything and other debug privileges on any server — now requires OP status server-side.
443 lines
11 KiB
C++
443 lines
11 KiB
C++
#include "stdafx.h"
|
|
|
|
#include "Access.h"
|
|
|
|
#include "..\Common\StringUtils.h"
|
|
#include "..\ServerLogger.h"
|
|
|
|
#include <memory>
|
|
#include <mutex>
|
|
|
|
namespace ServerRuntime
|
|
{
|
|
namespace Access
|
|
{
|
|
namespace
|
|
{
|
|
struct AccessState
|
|
{
|
|
std::mutex stateLock;
|
|
std::mutex writeLock;
|
|
std::shared_ptr<BanManager> banManager;
|
|
std::shared_ptr<WhitelistManager> whitelistManager;
|
|
bool whitelistEnabled = false;
|
|
};
|
|
|
|
AccessState g_accessState;
|
|
|
|
static std::shared_ptr<BanManager> GetBanManagerSnapshot()
|
|
{
|
|
std::lock_guard<std::mutex> stateLock(g_accessState.stateLock);
|
|
return g_accessState.banManager;
|
|
}
|
|
|
|
static void PublishBanManagerSnapshot(const std::shared_ptr<BanManager> &banManager)
|
|
{
|
|
std::lock_guard<std::mutex> stateLock(g_accessState.stateLock);
|
|
g_accessState.banManager = banManager;
|
|
}
|
|
|
|
static std::shared_ptr<WhitelistManager> GetWhitelistManagerSnapshot()
|
|
{
|
|
std::lock_guard<std::mutex> stateLock(g_accessState.stateLock);
|
|
return g_accessState.whitelistManager;
|
|
}
|
|
|
|
static void PublishWhitelistManagerSnapshot(const std::shared_ptr<WhitelistManager> &whitelistManager)
|
|
{
|
|
std::lock_guard<std::mutex> stateLock(g_accessState.stateLock);
|
|
g_accessState.whitelistManager = whitelistManager;
|
|
}
|
|
}
|
|
|
|
std::string FormatXuid(PlayerUID xuid)
|
|
{
|
|
if (xuid == INVALID_XUID)
|
|
{
|
|
return "";
|
|
}
|
|
return xuid.toDashed();
|
|
}
|
|
|
|
bool TryParseXuid(const std::string &text, PlayerUID *outXuid)
|
|
{
|
|
if (outXuid == nullptr)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
PlayerUID parsed = PlayerUID::fromDashed(text);
|
|
if (!parsed.isValid())
|
|
{
|
|
return false;
|
|
}
|
|
|
|
*outXuid = parsed;
|
|
return true;
|
|
}
|
|
|
|
bool Initialize(const std::string &baseDirectory, bool whitelistEnabled)
|
|
{
|
|
std::lock_guard<std::mutex> writeLock(g_accessState.writeLock);
|
|
|
|
// Build the replacement manager privately so readers keep using the last published snapshot during disk I/O.
|
|
std::shared_ptr<BanManager> banManager = std::make_shared<BanManager>(baseDirectory);
|
|
std::shared_ptr<WhitelistManager> whitelistManager = std::make_shared<WhitelistManager>(baseDirectory);
|
|
if (!banManager->EnsureBanFilesExist())
|
|
{
|
|
LogError("access", "failed to ensure dedicated server ban files exist");
|
|
return false;
|
|
}
|
|
if (!whitelistManager->EnsureWhitelistFileExists())
|
|
{
|
|
LogError("access", "failed to ensure dedicated server whitelist file exists");
|
|
return false;
|
|
}
|
|
|
|
if (!banManager->Reload())
|
|
{
|
|
LogError("access", "failed to load dedicated server ban files");
|
|
return false;
|
|
}
|
|
if (!whitelistManager->Reload())
|
|
{
|
|
LogError("access", "failed to load dedicated server whitelist file");
|
|
return false;
|
|
}
|
|
|
|
std::vector<BannedPlayerEntry> playerEntries;
|
|
std::vector<BannedIpEntry> ipEntries;
|
|
std::vector<WhitelistedPlayerEntry> whitelistEntries;
|
|
banManager->SnapshotBannedPlayers(&playerEntries);
|
|
banManager->SnapshotBannedIps(&ipEntries);
|
|
whitelistManager->SnapshotWhitelistedPlayers(&whitelistEntries);
|
|
PublishBanManagerSnapshot(banManager);
|
|
PublishWhitelistManagerSnapshot(whitelistManager);
|
|
{
|
|
std::lock_guard<std::mutex> stateLock(g_accessState.stateLock);
|
|
g_accessState.whitelistEnabled = whitelistEnabled;
|
|
}
|
|
|
|
LogInfof(
|
|
"access",
|
|
"loaded %u player bans, %u ip bans, and %u whitelist entries (whitelist=%s)",
|
|
(unsigned)playerEntries.size(),
|
|
(unsigned)ipEntries.size(),
|
|
(unsigned)whitelistEntries.size(),
|
|
whitelistEnabled ? "enabled" : "disabled");
|
|
return true;
|
|
}
|
|
|
|
void Shutdown()
|
|
{
|
|
std::lock_guard<std::mutex> writeLock(g_accessState.writeLock);
|
|
PublishBanManagerSnapshot(std::shared_ptr<BanManager>{});
|
|
PublishWhitelistManagerSnapshot(std::shared_ptr<WhitelistManager>{});
|
|
std::lock_guard<std::mutex> stateLock(g_accessState.stateLock);
|
|
g_accessState.whitelistEnabled = false;
|
|
}
|
|
|
|
bool Reload()
|
|
{
|
|
std::lock_guard<std::mutex> writeLock(g_accessState.writeLock);
|
|
std::shared_ptr<BanManager> current = GetBanManagerSnapshot();
|
|
std::shared_ptr<WhitelistManager> currentWhitelist = GetWhitelistManagerSnapshot();
|
|
if (current == nullptr || currentWhitelist == nullptr)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
std::shared_ptr<BanManager> banManager = std::make_shared<BanManager>(*current);
|
|
std::shared_ptr<WhitelistManager> whitelistManager = std::make_shared<WhitelistManager>(*currentWhitelist);
|
|
if (!banManager->EnsureBanFilesExist())
|
|
{
|
|
return false;
|
|
}
|
|
if (!whitelistManager->EnsureWhitelistFileExists())
|
|
{
|
|
return false;
|
|
}
|
|
if (!banManager->Reload())
|
|
{
|
|
return false;
|
|
}
|
|
if (!whitelistManager->Reload())
|
|
{
|
|
return false;
|
|
}
|
|
|
|
PublishBanManagerSnapshot(banManager);
|
|
PublishWhitelistManagerSnapshot(whitelistManager);
|
|
return true;
|
|
}
|
|
|
|
bool ReloadWhitelist()
|
|
{
|
|
std::lock_guard<std::mutex> writeLock(g_accessState.writeLock);
|
|
const auto current = GetWhitelistManagerSnapshot();
|
|
if (current == nullptr)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
auto whitelistManager = std::make_shared<WhitelistManager>(*current);
|
|
if (!whitelistManager->EnsureWhitelistFileExists())
|
|
{
|
|
return false;
|
|
}
|
|
if (!whitelistManager->Reload())
|
|
{
|
|
return false;
|
|
}
|
|
|
|
PublishWhitelistManagerSnapshot(whitelistManager);
|
|
return true;
|
|
}
|
|
|
|
bool IsInitialized()
|
|
{
|
|
return GetBanManagerSnapshot() != nullptr && GetWhitelistManagerSnapshot() != nullptr;
|
|
}
|
|
|
|
bool IsWhitelistEnabled()
|
|
{
|
|
std::lock_guard<std::mutex> stateLock(g_accessState.stateLock);
|
|
return g_accessState.whitelistEnabled;
|
|
}
|
|
|
|
void SetWhitelistEnabled(bool enabled)
|
|
{
|
|
std::lock_guard<std::mutex> writeLock(g_accessState.writeLock);
|
|
std::lock_guard<std::mutex> stateLock(g_accessState.stateLock);
|
|
g_accessState.whitelistEnabled = enabled;
|
|
}
|
|
|
|
bool IsPlayerBanned(PlayerUID xuid)
|
|
{
|
|
const std::string formatted = FormatXuid(xuid);
|
|
if (formatted.empty())
|
|
{
|
|
return false;
|
|
}
|
|
|
|
std::shared_ptr<BanManager> banManager = GetBanManagerSnapshot();
|
|
return (banManager != nullptr) ? banManager->IsPlayerBannedByXuid(formatted) : false;
|
|
}
|
|
|
|
bool IsIpBanned(const std::string &ip)
|
|
{
|
|
std::shared_ptr<BanManager> banManager = GetBanManagerSnapshot();
|
|
return (banManager != nullptr) ? banManager->IsIpBanned(ip) : false;
|
|
}
|
|
|
|
bool IsPlayerWhitelisted(PlayerUID xuid)
|
|
{
|
|
const std::string formatted = FormatXuid(xuid);
|
|
if (formatted.empty())
|
|
{
|
|
return false;
|
|
}
|
|
|
|
std::shared_ptr<WhitelistManager> whitelistManager = GetWhitelistManagerSnapshot();
|
|
return (whitelistManager != nullptr) ? whitelistManager->IsPlayerWhitelistedByXuid(formatted) : false;
|
|
}
|
|
|
|
bool AddPlayerBan(PlayerUID xuid, const std::string &name, const BanMetadata &metadata)
|
|
{
|
|
const std::string formatted = FormatXuid(xuid);
|
|
if (formatted.empty())
|
|
{
|
|
return false;
|
|
}
|
|
|
|
std::lock_guard<std::mutex> writeLock(g_accessState.writeLock);
|
|
std::shared_ptr<BanManager> current = GetBanManagerSnapshot();
|
|
if (current == nullptr)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
std::shared_ptr<BanManager> banManager = std::make_shared<BanManager>(*current);
|
|
BannedPlayerEntry entry;
|
|
entry.xuid = formatted;
|
|
entry.name = name;
|
|
entry.metadata = metadata;
|
|
if (!banManager->AddPlayerBan(entry))
|
|
{
|
|
return false;
|
|
}
|
|
|
|
PublishBanManagerSnapshot(banManager);
|
|
return true;
|
|
}
|
|
|
|
bool AddIpBan(const std::string &ip, const BanMetadata &metadata)
|
|
{
|
|
std::lock_guard<std::mutex> writeLock(g_accessState.writeLock);
|
|
std::shared_ptr<BanManager> current = GetBanManagerSnapshot();
|
|
if (current == nullptr)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
std::shared_ptr<BanManager> banManager = std::make_shared<BanManager>(*current);
|
|
BannedIpEntry entry;
|
|
entry.ip = ip;
|
|
entry.metadata = metadata;
|
|
if (!banManager->AddIpBan(entry))
|
|
{
|
|
return false;
|
|
}
|
|
|
|
PublishBanManagerSnapshot(banManager);
|
|
return true;
|
|
}
|
|
|
|
bool RemovePlayerBan(PlayerUID xuid)
|
|
{
|
|
const std::string formatted = FormatXuid(xuid);
|
|
if (formatted.empty())
|
|
{
|
|
return false;
|
|
}
|
|
|
|
std::lock_guard<std::mutex> writeLock(g_accessState.writeLock);
|
|
std::shared_ptr<BanManager> current = GetBanManagerSnapshot();
|
|
if (current == nullptr)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
std::shared_ptr<BanManager> banManager = std::make_shared<BanManager>(*current);
|
|
if (!banManager->RemovePlayerBanByXuid(formatted))
|
|
{
|
|
return false;
|
|
}
|
|
|
|
PublishBanManagerSnapshot(banManager);
|
|
return true;
|
|
}
|
|
|
|
bool RemoveIpBan(const std::string &ip)
|
|
{
|
|
std::lock_guard<std::mutex> writeLock(g_accessState.writeLock);
|
|
std::shared_ptr<BanManager> current = GetBanManagerSnapshot();
|
|
if (current == nullptr)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
std::shared_ptr<BanManager> banManager = std::make_shared<BanManager>(*current);
|
|
if (!banManager->RemoveIpBan(ip))
|
|
{
|
|
return false;
|
|
}
|
|
|
|
PublishBanManagerSnapshot(banManager);
|
|
return true;
|
|
}
|
|
|
|
bool AddWhitelistedPlayer(PlayerUID xuid, const std::string &name, const WhitelistMetadata &metadata)
|
|
{
|
|
const auto formatted = FormatXuid(xuid);
|
|
if (formatted.empty())
|
|
{
|
|
return false;
|
|
}
|
|
|
|
std::lock_guard<std::mutex> writeLock(g_accessState.writeLock);
|
|
const auto current = GetWhitelistManagerSnapshot();
|
|
if (current == nullptr)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
auto whitelistManager = std::make_shared<WhitelistManager>(*current);
|
|
const WhitelistedPlayerEntry entry = { formatted, name, metadata };
|
|
if (!whitelistManager->AddPlayer(entry))
|
|
{
|
|
return false;
|
|
}
|
|
|
|
PublishWhitelistManagerSnapshot(whitelistManager);
|
|
return true;
|
|
}
|
|
|
|
bool RemoveWhitelistedPlayer(PlayerUID xuid)
|
|
{
|
|
const auto formatted = FormatXuid(xuid);
|
|
if (formatted.empty())
|
|
{
|
|
return false;
|
|
}
|
|
|
|
std::lock_guard<std::mutex> writeLock(g_accessState.writeLock);
|
|
const auto current = GetWhitelistManagerSnapshot();
|
|
if (current == nullptr)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
auto whitelistManager = std::make_shared<WhitelistManager>(*current);
|
|
if (!whitelistManager->RemovePlayerByXuid(formatted))
|
|
{
|
|
return false;
|
|
}
|
|
|
|
PublishWhitelistManagerSnapshot(whitelistManager);
|
|
return true;
|
|
}
|
|
|
|
bool SnapshotBannedPlayers(std::vector<BannedPlayerEntry> *outEntries)
|
|
{
|
|
if (outEntries == nullptr)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
std::shared_ptr<BanManager> banManager = GetBanManagerSnapshot();
|
|
if (banManager == nullptr)
|
|
{
|
|
outEntries->clear();
|
|
return false;
|
|
}
|
|
|
|
return banManager->SnapshotBannedPlayers(outEntries);
|
|
}
|
|
|
|
bool SnapshotBannedIps(std::vector<BannedIpEntry> *outEntries)
|
|
{
|
|
if (outEntries == nullptr)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
std::shared_ptr<BanManager> banManager = GetBanManagerSnapshot();
|
|
if (banManager == nullptr)
|
|
{
|
|
outEntries->clear();
|
|
return false;
|
|
}
|
|
|
|
return banManager->SnapshotBannedIps(outEntries);
|
|
}
|
|
|
|
bool SnapshotWhitelistedPlayers(std::vector<WhitelistedPlayerEntry> *outEntries)
|
|
{
|
|
if (outEntries == nullptr)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
const auto whitelistManager = GetWhitelistManagerSnapshot();
|
|
if (whitelistManager == nullptr)
|
|
{
|
|
outEntries->clear();
|
|
return false;
|
|
}
|
|
|
|
return whitelistManager->SnapshotWhitelistedPlayers(outEntries);
|
|
}
|
|
}
|
|
}
|