From b506a7407661c0527255466cf8b315824b0003c0 Mon Sep 17 00:00:00 2001 From: daniel0916 Date: Sun, 13 Apr 2014 13:04:56 +0200 Subject: Added Yggdrasil Authentication System Code by Howaner. Fixes/Changes by me. --- src/Protocol/Authenticator.cpp | 325 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 325 insertions(+) create mode 100644 src/Protocol/Authenticator.cpp (limited to 'src/Protocol/Authenticator.cpp') diff --git a/src/Protocol/Authenticator.cpp b/src/Protocol/Authenticator.cpp new file mode 100644 index 000000000..ba435e9ce --- /dev/null +++ b/src/Protocol/Authenticator.cpp @@ -0,0 +1,325 @@ + +#include "Globals.h" // NOTE: MSVC stupidness requires this to be the same across all modules + +#include "Authenticator.h" +#include "OSSupport/BlockingTCPLink.h" +#include "Root.h" +#include "Server.h" + +#include "inifile/iniFile.h" +#include "json/json.h" + +#include "polarssl/config.h" +#include "polarssl/net.h" +#include "polarssl/ssl.h" +#include "polarssl/entropy.h" +#include "polarssl/ctr_drbg.h" +#include "polarssl/error.h" +#include "polarssl/certs.h" + +#include +#include + + + + + +#define DEFAULT_AUTH_SERVER "sessionserver.mojang.com" +#define DEFAULT_AUTH_ADDRESS "/session/minecraft/hasJoined?username=%USERNAME%&serverId=%SERVERID%" +#define MAX_REDIRECTS 10 + + + + + +cAuthenticator::cAuthenticator(void) : +super("cAuthenticator"), +m_Server(DEFAULT_AUTH_SERVER), +m_Address(DEFAULT_AUTH_ADDRESS), +m_ShouldAuthenticate(true) +{ +} + + + + + +cAuthenticator::~cAuthenticator() +{ + Stop(); +} + + + + + +void cAuthenticator::ReadINI(cIniFile & IniFile) +{ + m_Server = IniFile.GetValueSet("Authentication", "Server", DEFAULT_AUTH_SERVER); + m_Address = IniFile.GetValueSet("Authentication", "Address", DEFAULT_AUTH_ADDRESS); + m_ShouldAuthenticate = IniFile.GetValueSetB("Authentication", "Authenticate", true); +} + + + + + +void cAuthenticator::Authenticate(int a_ClientID, const AString & a_UserName, const AString & a_ServerHash) +{ + if (!m_ShouldAuthenticate) + { + cRoot::Get()->AuthenticateUser(a_ClientID, a_UserName, Printf("%d", a_ClientID)); + return; + } + + cCSLock LOCK(m_CS); + m_Queue.push_back(cUser(a_ClientID, a_UserName, a_ServerHash)); + m_QueueNonempty.Set(); +} + + + + + +void cAuthenticator::Start(cIniFile & IniFile) +{ + ReadINI(IniFile); + m_ShouldTerminate = false; + super::Start(); +} + + + + + +void cAuthenticator::Stop(void) +{ + m_ShouldTerminate = true; + m_QueueNonempty.Set(); + Wait(); +} + + + + + +void cAuthenticator::Execute(void) +{ + for (;;) + { + cCSLock Lock(m_CS); + while (!m_ShouldTerminate && (m_Queue.size() == 0)) + { + cCSUnlock Unlock(Lock); + m_QueueNonempty.Wait(); + } + if (m_ShouldTerminate) + { + return; + } + ASSERT(!m_Queue.empty()); + + int ClientID = m_Queue.front().m_ClientID; + AString UserName = m_Queue.front().m_Name; + AString ServerID = m_Queue.front().m_ServerID; + m_Queue.pop_front(); + Lock.Unlock(); + + AString NewUserName = UserName; + AString UUID; + if (AuthWithYggdrasil(NewUserName, ServerID, UUID)) + { + LOGINFO("User %s authenticated with UUID '%s'", NewUserName.c_str(), UUID.c_str()); + cRoot::Get()->AuthenticateUser(ClientID, NewUserName, UUID); + } + else + { + cRoot::Get()->KickUser(ClientID, "Failed to authenticate account!"); + } + } // for (-ever) +} + + + + + +bool cAuthenticator::AuthWithYggdrasil(AString & a_UserName, const AString & a_ServerId, AString & a_UUID) +{ + AString REQUEST; + int ret, len, server_fd = -1; + unsigned char buf[1024]; + const char *pers = "cAuthenticator"; + + entropy_context entropy; + ctr_drbg_context ctr_drbg; + ssl_context ssl; + x509_crt cacert; + + /* Initialize the RNG and the session data */ + memset(&ssl, 0, sizeof(ssl_context)); + x509_crt_init(&cacert); + + entropy_init(&entropy); + if ((ret = ctr_drbg_init(&ctr_drbg, entropy_func, &entropy, (const unsigned char *)pers, strlen(pers))) != 0) + { + LOGERROR("cAuthenticator: ctr_drbg_init returned %d", ret); + return false; + } + + /* Initialize certificates */ + +#if defined(POLARSSL_CERTS_C) + ret = x509_crt_parse(&cacert, (const unsigned char *)test_ca_list, strlen(test_ca_list)); +#else + ret = 1; + LOGWARNING("cAuthenticator: POLARSSL_CERTS_C is not defined."); +#endif + + if (ret < 0) + { + LOGERROR("cAuthenticator: x509_crt_parse returned -0x%x", -ret); + return false; + } + + /* Connect */ + if ((ret = net_connect(&server_fd, m_Server.c_str(), 443)) != 0) + { + LOGERROR("cAuthenticator: Can't connect to %s: %d", m_Server.c_str(), ret); + return false; + } + + /* Setup */ + if ((ret = ssl_init(&ssl)) != 0) + { + LOGERROR("cAuthenticator: ssl_init returned %d", ret); + return false; + } + ssl_set_endpoint(&ssl, SSL_IS_CLIENT); + ssl_set_authmode(&ssl, SSL_VERIFY_OPTIONAL); + ssl_set_ca_chain(&ssl, &cacert, NULL, "PolarSSL Server 1"); + ssl_set_rng(&ssl, ctr_drbg_random, &ctr_drbg); + ssl_set_bio(&ssl, net_recv, &server_fd, net_send, &server_fd); + + /* Handshake */ + while ((ret = ssl_handshake(&ssl)) != 0) + { + if (ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE) + { + LOGERROR("cAuthenticator: ssl_handshake returned -0x%x", -ret); + return false; + } + } + + /* Write the GET request */ + AString ActualAddress = m_Address; + ReplaceString(ActualAddress, "%USERNAME%", a_UserName); + ReplaceString(ActualAddress, "%SERVERID%", a_ServerId); + + REQUEST += "GET " + ActualAddress + " HTTP/1.1\r\n"; + REQUEST += "Host: " + m_Server + "\r\n"; + REQUEST += "User-Agent: MCServer\r\n"; + REQUEST += "Connection: close\r\n"; + REQUEST += "\r\n"; + + len = sprintf_s((char *)buf, sizeof(buf), REQUEST.c_str()); + + while ((ret = ssl_write(&ssl, buf, len)) <= 0) + { + if (ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE) + { + LOGERROR("cAuthenticator: ssl_write returned %d", ret); + return false; + } + } + + /* Read the HTTP response */ + std::string Builder; + for (;;) + { + len = sizeof(buf)-1; + memset(buf, 0, sizeof(buf)); + ret = ssl_read(&ssl, buf, len); + if (ret > 0) + { + buf[ret] = '\0'; + } + + if (ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE) + continue; + if (ret == POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY) + break; + if (ret < 0) + { + LOGERROR("cAuthenticator: ssl_read returned %d", ret); + break; + } + if (ret == 0) + { + LOGERROR("cAuthenticator: EOF"); + break; + } + + std::string str; + str.append(reinterpret_cast(buf)); + Builder += str; + } + + ssl_close_notify(&ssl); + x509_crt_free(&cacert); + net_close(server_fd); + ssl_free(&ssl); + entropy_free(&entropy); + memset(&ssl, 0, sizeof(ssl)); + + std::string prefix("HTTP/1.1 200 OK"); + if (Builder.compare(0, prefix.size(), prefix)) + return false; + + std::stringstream ResponseBuilder; + bool NewLine = false; + bool IsNewLine = false; + for (std::string::const_iterator i = Builder.begin(); i <= Builder.end(); ++i) + { + if (NewLine) + { + ResponseBuilder << *i; + } + else if (!NewLine && *i == '\n') + { + if (IsNewLine) + { + NewLine = true; + } + else + { + IsNewLine = true; + } + } + else if (*i != '\r') + { + IsNewLine = false; + } + } + + AString RESPONSE = ResponseBuilder.str(); + + if (RESPONSE.empty()) + return false; + + Json::Value root; + Json::Reader reader; + if (!reader.parse(RESPONSE, root, false)) + { + LOGWARNING("cAuthenticator: Cannot parse Received Data to json!"); + return false; + } + + a_UserName = root.get("name", "Unknown").asString(); + a_UUID = root.get("id", "").asString(); + return true; +} + + + + + -- cgit v1.2.3 From 3733ee2c0ee84c054bb98d714dad49d0384208a0 Mon Sep 17 00:00:00 2001 From: daniel0916 Date: Sun, 13 Apr 2014 15:32:15 +0200 Subject: Code Update --- src/Protocol/Authenticator.cpp | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'src/Protocol/Authenticator.cpp') diff --git a/src/Protocol/Authenticator.cpp b/src/Protocol/Authenticator.cpp index ba435e9ce..24695b726 100644 --- a/src/Protocol/Authenticator.cpp +++ b/src/Protocol/Authenticator.cpp @@ -26,7 +26,6 @@ #define DEFAULT_AUTH_SERVER "sessionserver.mojang.com" #define DEFAULT_AUTH_ADDRESS "/session/minecraft/hasJoined?username=%USERNAME%&serverId=%SERVERID%" -#define MAX_REDIRECTS 10 @@ -146,8 +145,9 @@ void cAuthenticator::Execute(void) bool cAuthenticator::AuthWithYggdrasil(AString & a_UserName, const AString & a_ServerId, AString & a_UUID) { AString REQUEST; - int ret, len, server_fd = -1; - unsigned char buf[1024]; + int ret, server_fd = -1; + size_t len = -1; + unsigned char * buf; const char *pers = "cAuthenticator"; entropy_context entropy; @@ -221,7 +221,8 @@ bool cAuthenticator::AuthWithYggdrasil(AString & a_UserName, const AString & a_S REQUEST += "Connection: close\r\n"; REQUEST += "\r\n"; - len = sprintf_s((char *)buf, sizeof(buf), REQUEST.c_str()); + len = REQUEST.size(); + buf = (unsigned char *)REQUEST.c_str(); while ((ret = ssl_write(&ssl, buf, len)) <= 0) { -- cgit v1.2.3 From d258be678a7ea2d027434c2acc51243dd2253beb Mon Sep 17 00:00:00 2001 From: daniel0916 Date: Sun, 13 Apr 2014 16:15:57 +0200 Subject: Fixed Error? --- src/Protocol/Authenticator.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'src/Protocol/Authenticator.cpp') diff --git a/src/Protocol/Authenticator.cpp b/src/Protocol/Authenticator.cpp index 24695b726..a79f0b7e0 100644 --- a/src/Protocol/Authenticator.cpp +++ b/src/Protocol/Authenticator.cpp @@ -147,7 +147,7 @@ bool cAuthenticator::AuthWithYggdrasil(AString & a_UserName, const AString & a_S AString REQUEST; int ret, server_fd = -1; size_t len = -1; - unsigned char * buf; + unsigned char buf[1024]; const char *pers = "cAuthenticator"; entropy_context entropy; @@ -222,7 +222,7 @@ bool cAuthenticator::AuthWithYggdrasil(AString & a_UserName, const AString & a_S REQUEST += "\r\n"; len = REQUEST.size(); - buf = (unsigned char *)REQUEST.c_str(); + strcpy((char *)buf, REQUEST.c_str()); while ((ret = ssl_write(&ssl, buf, len)) <= 0) { -- cgit v1.2.3 From 2618569e0100fdfdbf07f98da8f3e0f83e82b822 Mon Sep 17 00:00:00 2001 From: daniel0916 Date: Sun, 13 Apr 2014 17:09:18 +0200 Subject: Fixed mistake --- src/Protocol/Authenticator.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/Protocol/Authenticator.cpp') diff --git a/src/Protocol/Authenticator.cpp b/src/Protocol/Authenticator.cpp index a79f0b7e0..8943b3c21 100644 --- a/src/Protocol/Authenticator.cpp +++ b/src/Protocol/Authenticator.cpp @@ -146,7 +146,7 @@ bool cAuthenticator::AuthWithYggdrasil(AString & a_UserName, const AString & a_S { AString REQUEST; int ret, server_fd = -1; - size_t len = -1; + size_t len = 0; unsigned char buf[1024]; const char *pers = "cAuthenticator"; -- cgit v1.2.3 From d12d7b671523f79f760403f3f4c0ef4efb497c79 Mon Sep 17 00:00:00 2001 From: madmaxoft Date: Mon, 14 Apr 2014 22:52:59 +0200 Subject: Implemented the 1.7.6 protocol and authenticator. Server works both in online and offline modes with 1.7.9. --- src/Protocol/Authenticator.cpp | 147 +++++++++++++++++++---------------------- 1 file changed, 67 insertions(+), 80 deletions(-) (limited to 'src/Protocol/Authenticator.cpp') diff --git a/src/Protocol/Authenticator.cpp b/src/Protocol/Authenticator.cpp index 8943b3c21..a30131b36 100644 --- a/src/Protocol/Authenticator.cpp +++ b/src/Protocol/Authenticator.cpp @@ -2,9 +2,10 @@ #include "Globals.h" // NOTE: MSVC stupidness requires this to be the same across all modules #include "Authenticator.h" -#include "OSSupport/BlockingTCPLink.h" -#include "Root.h" -#include "Server.h" +#include "../OSSupport/BlockingTCPLink.h" +#include "../Root.h" +#include "../Server.h" +#include "../ClientHandle.h" #include "inifile/iniFile.h" #include "json/json.h" @@ -32,10 +33,10 @@ cAuthenticator::cAuthenticator(void) : -super("cAuthenticator"), -m_Server(DEFAULT_AUTH_SERVER), -m_Address(DEFAULT_AUTH_ADDRESS), -m_ShouldAuthenticate(true) + super("cAuthenticator"), + m_Server(DEFAULT_AUTH_SERVER), + m_Address(DEFAULT_AUTH_ADDRESS), + m_ShouldAuthenticate(true) { } @@ -67,7 +68,7 @@ void cAuthenticator::Authenticate(int a_ClientID, const AString & a_UserName, co { if (!m_ShouldAuthenticate) { - cRoot::Get()->AuthenticateUser(a_ClientID, a_UserName, Printf("%d", a_ClientID)); + cRoot::Get()->AuthenticateUser(a_ClientID, a_UserName, cClientHandle::GenerateOfflineUUID(a_UserName)); return; } @@ -144,9 +145,9 @@ void cAuthenticator::Execute(void) bool cAuthenticator::AuthWithYggdrasil(AString & a_UserName, const AString & a_ServerId, AString & a_UUID) { - AString REQUEST; + LOGD("Trying to auth user %s", a_UserName.c_str()); + int ret, server_fd = -1; - size_t len = 0; unsigned char buf[1024]; const char *pers = "cAuthenticator"; @@ -162,36 +163,31 @@ bool cAuthenticator::AuthWithYggdrasil(AString & a_UserName, const AString & a_S entropy_init(&entropy); if ((ret = ctr_drbg_init(&ctr_drbg, entropy_func, &entropy, (const unsigned char *)pers, strlen(pers))) != 0) { - LOGERROR("cAuthenticator: ctr_drbg_init returned %d", ret); + LOGWARNING("cAuthenticator: ctr_drbg_init returned %d", ret); return false; } /* Initialize certificates */ - -#if defined(POLARSSL_CERTS_C) + // TODO: Grab the sessionserver's root CA and any intermediates and hard-code them here, instead of test_ca_list ret = x509_crt_parse(&cacert, (const unsigned char *)test_ca_list, strlen(test_ca_list)); -#else - ret = 1; - LOGWARNING("cAuthenticator: POLARSSL_CERTS_C is not defined."); -#endif if (ret < 0) { - LOGERROR("cAuthenticator: x509_crt_parse returned -0x%x", -ret); + LOGWARNING("cAuthenticator: x509_crt_parse returned -0x%x", -ret); return false; } /* Connect */ if ((ret = net_connect(&server_fd, m_Server.c_str(), 443)) != 0) { - LOGERROR("cAuthenticator: Can't connect to %s: %d", m_Server.c_str(), ret); + LOGWARNING("cAuthenticator: Can't connect to %s: %d", m_Server.c_str(), ret); return false; } /* Setup */ if ((ret = ssl_init(&ssl)) != 0) { - LOGERROR("cAuthenticator: ssl_init returned %d", ret); + LOGWARNING("cAuthenticator: ssl_init returned %d", ret); return false; } ssl_set_endpoint(&ssl, SSL_IS_CLIENT); @@ -203,9 +199,9 @@ bool cAuthenticator::AuthWithYggdrasil(AString & a_UserName, const AString & a_S /* Handshake */ while ((ret = ssl_handshake(&ssl)) != 0) { - if (ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE) + if ((ret != POLARSSL_ERR_NET_WANT_READ) && (ret != POLARSSL_ERR_NET_WANT_WRITE)) { - LOGERROR("cAuthenticator: ssl_handshake returned -0x%x", -ret); + LOGWARNING("cAuthenticator: ssl_handshake returned -0x%x", -ret); return false; } } @@ -215,54 +211,47 @@ bool cAuthenticator::AuthWithYggdrasil(AString & a_UserName, const AString & a_S ReplaceString(ActualAddress, "%USERNAME%", a_UserName); ReplaceString(ActualAddress, "%SERVERID%", a_ServerId); - REQUEST += "GET " + ActualAddress + " HTTP/1.1\r\n"; - REQUEST += "Host: " + m_Server + "\r\n"; - REQUEST += "User-Agent: MCServer\r\n"; - REQUEST += "Connection: close\r\n"; - REQUEST += "\r\n"; - - len = REQUEST.size(); - strcpy((char *)buf, REQUEST.c_str()); + AString Request; + Request += "GET " + ActualAddress + " HTTP/1.1\r\n"; + Request += "Host: " + m_Server + "\r\n"; + Request += "User-Agent: MCServer\r\n"; + Request += "Connection: close\r\n"; + Request += "\r\n"; - while ((ret = ssl_write(&ssl, buf, len)) <= 0) + ret = ssl_write(&ssl, (const unsigned char *)Request.c_str(), Request.size()); + if (ret <= 0) { - if (ret != POLARSSL_ERR_NET_WANT_READ && ret != POLARSSL_ERR_NET_WANT_WRITE) - { - LOGERROR("cAuthenticator: ssl_write returned %d", ret); - return false; - } + LOGWARNING("cAuthenticator: ssl_write returned %d", ret); + return false; } /* Read the HTTP response */ - std::string Builder; + std::string Response; for (;;) { - len = sizeof(buf)-1; memset(buf, 0, sizeof(buf)); - ret = ssl_read(&ssl, buf, len); - if (ret > 0) - { - buf[ret] = '\0'; - } + ret = ssl_read(&ssl, buf, sizeof(buf)); - if (ret == POLARSSL_ERR_NET_WANT_READ || ret == POLARSSL_ERR_NET_WANT_WRITE) + if ((ret == POLARSSL_ERR_NET_WANT_READ) || (ret == POLARSSL_ERR_NET_WANT_WRITE)) + { continue; + } if (ret == POLARSSL_ERR_SSL_PEER_CLOSE_NOTIFY) + { break; + } if (ret < 0) { - LOGERROR("cAuthenticator: ssl_read returned %d", ret); + LOGWARNING("cAuthenticator: ssl_read returned %d", ret); break; } if (ret == 0) { - LOGERROR("cAuthenticator: EOF"); + LOGWARNING("cAuthenticator: EOF"); break; } - std::string str; - str.append(reinterpret_cast(buf)); - Builder += str; + Response.append((const char *)buf, ret); } ssl_close_notify(&ssl); @@ -272,51 +261,49 @@ bool cAuthenticator::AuthWithYggdrasil(AString & a_UserName, const AString & a_S entropy_free(&entropy); memset(&ssl, 0, sizeof(ssl)); - std::string prefix("HTTP/1.1 200 OK"); - if (Builder.compare(0, prefix.size(), prefix)) + // Check the HTTP status line: + AString prefix("HTTP/1.1 200 OK"); + AString HexDump; + if (Response.compare(0, prefix.size(), prefix)) + { + LOGINFO("User \"%s\" failed to auth, bad http status line received", a_UserName.c_str()); + LOG("Response: \n%s", CreateHexDump(HexDump, Response.data(), Response.size(), 16).c_str()); return false; + } - std::stringstream ResponseBuilder; - bool NewLine = false; - bool IsNewLine = false; - for (std::string::const_iterator i = Builder.begin(); i <= Builder.end(); ++i) + // Erase the HTTP headers from the response: + size_t idxHeadersEnd = Response.find("\r\n\r\n"); + if (idxHeadersEnd == AString::npos) { - if (NewLine) - { - ResponseBuilder << *i; - } - else if (!NewLine && *i == '\n') - { - if (IsNewLine) - { - NewLine = true; - } - else - { - IsNewLine = true; - } - } - else if (*i != '\r') - { - IsNewLine = false; - } + LOGINFO("User \"%s\" failed to authenticate, bad http response header received", a_UserName.c_str()); + LOG("Response: \n%s", CreateHexDump(HexDump, Response.data(), Response.size(), 16).c_str()); + return false; } + Response.erase(0, idxHeadersEnd + 4); - AString RESPONSE = ResponseBuilder.str(); - - if (RESPONSE.empty()) + // Parse the Json response: + if (Response.empty()) + { return false; - + } Json::Value root; Json::Reader reader; - if (!reader.parse(RESPONSE, root, false)) + if (!reader.parse(Response, root, false)) { LOGWARNING("cAuthenticator: Cannot parse Received Data to json!"); return false; } - a_UserName = root.get("name", "Unknown").asString(); a_UUID = root.get("id", "").asString(); + + // If the UUID doesn't contain the hashes, insert them at the proper places: + if (a_UUID.size() == 32) + { + a_UUID.insert(8, "-"); + a_UUID.insert(13, "-"); + a_UUID.insert(18, "-"); + a_UUID.insert(23, "-"); + } return true; } -- cgit v1.2.3