MinecraftConsoles/Minecraft.Server/Console/commands/ban/CliCommandBan.cpp
MrTheShy 4f2352361a Add Mojang/Ely.by/offline authentication system
The old Windows64 port had no real player identity — it used hardcoded
fake XUIDs, so anyone could impersonate anyone. This replaces that with
proper auth supporting Mojang, Ely.by, and offline accounts.

MCAuth library (new, MCAuth/):
  Mojang auth via MSA device code flow (XBL, SISU, MC services),
  Ely.by via Yggdrasil with 2FA, offline UUID generation matching
  Java Edition (MD5 v3 from "OfflinePlayer:<name>"). Multi-account
  manager with background token refresh, per-slot sessions, and
  on-disk token persistence. Server-side session verification via
  Mojang/Ely.by hasJoined API. Skin fetching and PNG validation
  from texture servers.

Network protocol (version bumped to 80):
  Three new packets (AuthScheme, AuthResponse, AuthResult) implement
  a server-driven auth handshake before login completes. Player
  identity migrated from 64-bit XUID to 128-bit GameUUID backed by
  two uint64 fields (hi/lo). readPlayerUID/writePlayerUID now
  serialize 16 bytes on the wire. Old and new clients cannot connect
  to each other — version mismatch is rejected at PreLogin.

Save migration:
  Map data mappings auto-migrate from old format: the old 64-bit
  XUID is placed in hi, lo is set to 0 as a sentinel. On first
  access by the real player, the sentinel entry is upgraded in-place
  to the full 128-bit UUID. Format detection is by file size (2080,
  2112, or 4160 bytes). Player .dat filenames inside saveData.ms
  change from decimal XUID to dashed UUID — old saves need manual
  entry renaming in the archive.

UI:
  NativeUIRenderer: immediate-mode drawing system (quads, text,
  9-slice panels, scrollbars, focus lists) for rendering auth
  screens without Flash/Scaleform. UIScene_MSAuth handles device
  code display, Ely.by credential input with 2FA, per-account
  skin head preview, and multi-account add/remove/switch.

Server:
  online-mode and auth-provider (mojang/elyby) in server.properties.
  Whitelist and ban checks validate against the server-verified UUID.
  Incompatible auth scheme logs which provider the server expects
  vs what the client is using.

Also fixes a pre-existing exploit where any client could send a
DebugOptionsPacket to grant themselves CraftAnything and other debug
privileges on any server — now requires OP status server-side.
2026-03-23 01:14:23 +01:00

144 lines
3.5 KiB
C++

#include "stdafx.h"
#include "CliCommandBan.h"
#include "..\..\ServerCliEngine.h"
#include "..\..\ServerCliParser.h"
#include "..\..\..\Access\Access.h"
#include "..\..\..\Common\StringUtils.h"
#include "..\..\..\..\Minecraft.Client\PlayerConnection.h"
#include "..\..\..\..\Minecraft.Client\ServerPlayer.h"
#include "..\..\..\..\Minecraft.World\DisconnectPacket.h"
#include <algorithm>
namespace ServerRuntime
{
namespace
{
static void AppendUniqueXuid(PlayerUID xuid, std::vector<PlayerUID> *out)
{
if (out == nullptr || xuid == INVALID_XUID)
{
return;
}
if (std::find(out->begin(), out->end(), xuid) == out->end())
{
out->push_back(xuid);
}
}
static void CollectPlayerBanXuids(const std::shared_ptr<ServerPlayer> &player, std::vector<PlayerUID> *out)
{
if (player == nullptr || out == nullptr)
{
return;
}
AppendUniqueXuid(player->getXuid(), out);
}
}
const char *CliCommandBan::Name() const
{
return "ban";
}
const char *CliCommandBan::Usage() const
{
return "ban <player> [reason ...]";
}
const char *CliCommandBan::Description() const
{
return "Ban an online player.";
}
/**
* Resolves the live player, writes one or more Access ban entries, and disconnects the target with the banned reason
* 対象プレイヤーを解決してBANを保存し切断する
*/
bool CliCommandBan::Execute(const ServerCliParsedLine &line, ServerCliEngine *engine)
{
if (line.tokens.size() < 2)
{
engine->LogWarn("Usage: ban <player> [reason ...]");
return false;
}
if (!ServerRuntime::Access::IsInitialized())
{
engine->LogWarn("Access manager is not initialized.");
return false;
}
const auto target = engine->FindPlayerByNameUtf8(line.tokens[1]);
if (target == nullptr)
{
engine->LogWarn("Unknown player: " + line.tokens[1] + " (this server build can only ban players that are currently online).");
return false;
}
std::vector<PlayerUID> xuids;
CollectPlayerBanXuids(target, &xuids);
if (xuids.empty())
{
engine->LogWarn("Cannot ban that player because no valid XUID is available.");
return false;
}
const bool hasUnbannedIdentity = std::any_of(
xuids.begin(),
xuids.end(),
[](PlayerUID xuid) { return !ServerRuntime::Access::IsPlayerBanned(xuid); });
if (!hasUnbannedIdentity)
{
engine->LogWarn("That player is already banned.");
return false;
}
ServerRuntime::Access::BanMetadata metadata = ServerRuntime::Access::BanManager::BuildDefaultMetadata("Console");
metadata.reason = StringUtils::JoinTokens(line.tokens, 2);
if (metadata.reason.empty())
{
metadata.reason = "Banned by an operator.";
}
const std::string playerName = StringUtils::WideToUtf8(target->getName());
for (const auto xuid : xuids)
{
if (ServerRuntime::Access::IsPlayerBanned(xuid))
{
continue;
}
if (!ServerRuntime::Access::AddPlayerBan(xuid, playerName, metadata))
{
engine->LogError("Failed to write player ban.");
return false;
}
}
if (target->connection != nullptr)
{
target->connection->disconnect(DisconnectPacket::eDisconnect_Banned);
}
engine->LogInfo("Banned player " + playerName + ".");
return true;
}
/**
* Suggests currently connected player names for the Java-style player argument
* プレイヤー引数の補完候補を返す
*/
void CliCommandBan::Complete(const ServerCliCompletionContext &context, const ServerCliEngine *engine, std::vector<std::string> *out) const
{
if (context.currentTokenIndex == 1)
{
engine->SuggestPlayers(context.prefix, context.linePrefix, out);
}
}
}