Naprawa luki bezpieczeństwa w systemie autoryzacji do ACP

Opublikowano 23 Listopada 20231 r

Dziękujemy!

U mnie to wygląda tak i teraz mam dwa razy "podobne" ale bez

return -1;

@SevenceMógłbym prosić o wsparcie techniczne działu telekomunikacji miejskiej 😄

Spoiler

int CInputHandshake::Analyze(LPDESC d, BYTE bHeader, const char * c_pData)
{
if (bHeader == 10) // żŁĹÍ´Â ą«˝Ă
return 0;

   if (bHeader == HEADER_CG_TEXT)
   {
       ++c_pData;
       const char * c_pSep;

if (!(c_pSep = strchr(c_pData, '\n'))) // \nŔ» ĂŁ´Â´Ů.
return -1;

if (*(c_pSep - 1) == '\r')
--c_pSep;

       std::string stResult;
       std::string stBuf;
       stBuf.assign(c_pData, 0, c_pSep - c_pData);

sys_log(0, "SOCKET_CMD: FROM(%s) CMD(%s)", d->GetHostName(), stBuf.c_str());

       if (!stBuf.compare("IS_SERVER_UP"))
       {
           if (g_bNoMoreClient)
               stResult = "NO";
           else
               stResult = "YES";
       }
       else if (!stBuf.compare("IS_PASSPOD_UP"))
       {
           if (g_bNoPasspod)
               stResult = "NO";
           else
               stResult = "YES";
       }
       //else if (!stBuf.compare("SHOWMETHEMONEY"))
       else if (stBuf == g_stAdminPagePassword)
       {
           if (!IsEmptyAdminPage())
           {
               if (!IsAdminPage(inet_ntoa(d->GetAddr().sin_addr)))
               {
                   char szTmp[64];
                   snprintf(szTmp, sizeof(szTmp), "WEBADMIN : Wrong Connector : %s", inet_ntoa(d->GetAddr().sin_addr));
                   stResult += szTmp;
               }
               else
               {
                   d->SetAdminMode();
                   stResult = "UNKNOWN";
               }
           }
           else
           {
               d->SetAdminMode();
               stResult = "UNKNOWN";
           }
       }
       else if (!stBuf.compare("USER_COUNT"))
       {
           char szTmp[64];

           if (!IsEmptyAdminPage())
           {
               if (!IsAdminPage(inet_ntoa(d->GetAddr().sin_addr)))
               {
                   snprintf(szTmp, sizeof(szTmp), "WEBADMIN : Wrong Connector : %s", inet_ntoa(d->GetAddr().sin_addr));
               }
               else
               {
                   int iTotal;
                   int * paiEmpireUserCount;
                   int iLocal;
                   DESC_MANAGER::instance().GetUserCount(iTotal, &paiEmpireUserCount, iLocal);
                   snprintf(szTmp, sizeof(szTmp), "%d %d %d %d %d", iTotal, paiEmpireUserCount[1], paiEmpireUserCount[2], paiEmpireUserCount[3], iLocal);
               }
           }
           else
           {
               int iTotal;
               int * paiEmpireUserCount;
               int iLocal;
               DESC_MANAGER::instance().GetUserCount(iTotal, &paiEmpireUserCount, iLocal);
               snprintf(szTmp, sizeof(szTmp), "%d %d %d %d %d", iTotal, paiEmpireUserCount[1], paiEmpireUserCount[2], paiEmpireUserCount[3], iLocal);
           }
           stResult += szTmp;
       }
       else if (!stBuf.compare("CHECK_P2P_CONNECTIONS"))
       {
           std::ostringstream oss(std::ostringstream::out);

           oss << "P2P CONNECTION NUMBER : " << P2P_MANAGER::instance().GetDescCount() << "\n";
           std::string hostNames;
           P2P_MANAGER::Instance().GetP2PHostNames(hostNames);
           oss << hostNames;
           stResult = oss.str();
           TPacketGGCheckAwakeness packet;
           packet.bHeader = HEADER_GG_CHECK_AWAKENESS;

           P2P_MANAGER::instance().Send(&packet, sizeof(packet));
       }
       else if (!stBuf.compare("PACKET_INFO"))
       {
           m_pMainPacketInfo->Log("packet_info.txt");
           stResult = "OK";
       }
       else if (!stBuf.compare("PROFILE"))
       {
           CProfiler::instance().Log("profile.txt");
           stResult = "OK";
       }
       //gift notify delete command
       else if (!stBuf.compare(0,15,"DELETE_AWARDID "))
           {
               char szTmp[64];
               std::string msg = stBuf.substr(15,26);   // item_awardŔÇ idąüŔ§?

               TPacketDeleteAwardID p;
               p.dwID = (DWORD)(atoi(msg.c_str()));
               snprintf(szTmp,sizeof(szTmp),"Sent to DB cache to delete ItemAward, id: %d",p.dwID);
               //sys_log(0,"%d",p.dwID);
               // strlcpy(p.login, msg.c_str(), sizeof(p.login));
               db_clientdesc->DBPacket(HEADER_GD_DELETE_AWARDID, 0, &p, sizeof(p));
               stResult += szTmp;
           }
       else
       {
           stResult = "UNKNOWN";

           if (d->IsAdminMode())
           {
               // ľîµĺąÎ ¸í·Éµé
               if (!stBuf.compare(0, 7, "NOTICE "))
               {
                   std::string msg = stBuf.substr(7, 50);
                   LogManager::instance().CharLog(0, 0, 0, 1, "NOTICE", msg.c_str(), d->GetHostName());
                   BroadcastNotice(msg.c_str());
               }
               else if (!stBuf.compare("CLOSE_PASSPOD"))
               {
                   g_bNoPasspod = true;
                   stResult += "CLOSE_PASSPOD";
               }
               else if (!stBuf.compare("OPEN_PASSPOD"))
               {
                   g_bNoPasspod = false;
                   stResult += "OPEN_PASSPOD";
               }
               else if (!stBuf.compare("SHUTDOWN"))
               {
                   LogManager::instance().CharLog(0, 0, 0, 2, "SHUTDOWN", "", d->GetHostName());
                   TPacketGGShutdown p;
                   p.bHeader = HEADER_GG_SHUTDOWN;
                   P2P_MANAGER::instance().Send(&p, sizeof(TPacketGGShutdown));
                   sys_err("Accept shutdown command from %s.", d->GetHostName());
                   Shutdown(10);
               }
               else if (!stBuf.compare("SHUTDOWN_ONLY"))
               {
                   LogManager::instance().CharLog(0, 0, 0, 2, "SHUTDOWN", "", d->GetHostName());
                   sys_err("Accept shutdown only command from %s.", d->GetHostName());
                   Shutdown(10);
               }
               else if (!stBuf.compare(0, 3, "DC "))
               {
                   std::string msg = stBuf.substr(3, LOGIN_MAX_LEN);

dev_log(LOG_DEB0, "DC : '%s'", msg.c_str());

TPacketGGDisconnect pgg;

pgg.bHeader = HEADER_GG_DISCONNECT;
strlcpy(pgg.szLogin, msg.c_str(), sizeof(pgg.szLogin));

P2P_MANAGER::instance().Send(&pgg, sizeof(TPacketGGDisconnect));

                   // delete login key
                   {
                       TPacketDC p;
                       strlcpy(p.login, msg.c_str(), sizeof(p.login));
                       db_clientdesc->DBPacket(HEADER_GD_DC, 0, &p, sizeof(p));
                   }
               }
               else if (!stBuf.compare(0, 10, "RELOAD_CRC"))
               {
                   LoadValidCRCList();

                   BYTE bHeader = HEADER_GG_RELOAD_CRC_LIST;
                   P2P_MANAGER::instance().Send(&bHeader, sizeof(BYTE));
                   stResult = "OK";
               }
               else if (!stBuf.compare(0, 20, "CHECK_CLIENT_VERSION"))
               {
                   CheckClientVersion();

                   BYTE bHeader = HEADER_GG_CHECK_CLIENT_VERSION;
                   P2P_MANAGER::instance().Send(&bHeader, sizeof(BYTE));
                   stResult = "OK";
               }
               else if (!stBuf.compare(0, 6, "RELOAD"))
               {
                   if (stBuf.size() == 6)
                   {
                       LoadStateUserCount();
                       db_clientdesc->DBPacket(HEADER_GD_RELOAD_PROTO, 0, NULL, 0);
                       DBManager::instance().LoadDBString();
                   }
                   else
                   {
                       char c = stBuf[7];

                       switch (LOWER(c))
                       {
                           case 'u':
                               LoadStateUserCount();
                               break;

                           case 'p':
                               db_clientdesc->DBPacket(HEADER_GD_RELOAD_PROTO, 0, NULL, 0);
                               break;

                           case 's':
                               DBManager::instance().LoadDBString();
                               break;

                           case 'q':
                               quest::CQuestManager::instance().Reload();
                               break;

                           case 'f':
                               fishing::Initialize();
                               break;

                           case 'a':
                               db_clientdesc->DBPacket(HEADER_GD_RELOAD_ADMIN, 0, NULL, 0);
                               sys_log(0, "Reloading admin infomation.");
                               break;
                       }
                   }
               }
               else if (!stBuf.compare(0, 6, "EVENT "))
               {
                   std::istringstream is(stBuf);
                   std::string strEvent, strFlagName;
                   long lValue;
                   is >> strEvent >> strFlagName >> lValue;

                   if (!is.fail())
                   {
                       sys_log(0, "EXTERNAL EVENT FLAG name %s value %d", strFlagName.c_str(), lValue);
                       quest::CQuestManager::instance().RequestSetEventFlag(strFlagName, lValue);
                       stResult = "EVENT FLAG CHANGE ";
                       stResult += strFlagName;
                   }
                   else
                   {
                       stResult = "EVENT FLAG FAIL";
                   }
               }
               // BLOCK_CHAT
               else if (!stBuf.compare(0, 11, "BLOCK_CHAT "))
               {
                   std::istringstream is(stBuf);
                   std::string strBlockChat, strCharName;
                   long lDuration;
                   is >> strBlockChat >> strCharName >> lDuration;

                   if (!is.fail())
                   {
                       sys_log(0, "EXTERNAL BLOCK_CHAT name %s duration %d", strCharName.c_str(), lDuration);

do_block_chat(NULL, const_cast<char*>(stBuf.c_str() + 11), 0, 0);

                       stResult = "BLOCK_CHAT ";
                       stResult += strCharName;
                   }
                   else
                   {
                       stResult = "BLOCK_CHAT FAIL";
                   }
               }
               // END_OF_BLOCK_CHAT
               else if (!stBuf.compare(0, 12, "PRIV_EMPIRE "))
               {
                   int   empire, type, value, duration;
                   std::istringstream is(stBuf);
                   std::string strPrivEmpire;
                   is >> strPrivEmpire >> empire >> type >> value >> duration;

                   // ĂÖ´ëÄˇ 10ąč
                   value = MINMAX(0, value, 1000);
                   stResult = "PRIV_EMPIRE FAIL";

                   if (!is.fail())
                   {
                       // check parameter
                       if (empire < 0 || 3 < empire);
                       else if (type < 1 || 4 < type);
                       else if (value < 0);
                       else if (duration < 0);
                       else
                       {
                           stResult = "PRIV_EMPIRE SUCCEED";

// ˝Ă°Ł ´ÜŔ§·Î şŻ°ć
duration = duration * (60 * 60);

                           sys_log(0, "_give_empire_privileage(empire=%d, type=%d, value=%d, duration=%d) by web",
                                   empire, type, value, duration);
                           CPrivManager::instance().RequestGiveEmpirePriv(empire, type, value, duration);
                       }
                   }
               }
               else if (!stBuf.compare(0, 15, "BLOCK_EXCEPTION"))
               {
                   // BLOCK_EXCEPTION cmd(add=1, del=2) login
                   std::istringstream is(stBuf);
                   std::string   dummy_string;
                   std::string   login_string;
                   int           cmd;

is >> dummy_string >> cmd >> login_string;

                   sys_log(0, "block_exception %s:%d", login_string.c_str(), cmd);
                   DBManager::instance().RequestBlockException(login_string.c_str(), cmd);
                   stResult = "BLOCK_EXCEPTION_YES";
               }
           }
       }

       sys_log(1, "TEXT %s RESULT %s", stBuf.c_str(), stResult.c_str());
       stResult += "\n";
       d->Packet(stResult.c_str(), stResult.length());
       return (c_pSep - c_pData) + 1;
   }
   else if (bHeader == HEADER_CG_MARK_LOGIN)
   {
       if (!guild_mark_server)
       {
           // ˛÷ľîąö·Á! - ¸¶Ĺ© Ľąö°ˇ ľĆ´ŃµĄ ¸¶Ĺ©¸¦ żäĂ»ÇĎ·Á°í?
           sys_err("Guild Mark login requested but i'm not a mark server!");
           d->SetPhase(PHASE_CLOSE);
           return 0;
       }

       // ą«Á¶°Ç ŔÎÁő --;
       sys_log(0, "MARK_SERVER: Login");
       d->SetPhase(PHASE_LOGIN);
       return 0;
   }
   else if (bHeader == HEADER_CG_STATE_CHECKER)
   {
       if (d->isChannelStatusRequested()) {
           return 0;
       }
       d->SetChannelStatusRequested(true);
       db_clientdesc->DBPacket(HEADER_GD_REQUEST_CHANNELSTATUS, d->GetHandle(), NULL, 0);
   }
   else if (bHeader == HEADER_CG_PONG)
       Pong(d);
   else if (bHeader == HEADER_CG_HANDSHAKE)
       Handshake(d, c_pData);
#ifdef _IMPROVED_PACKET_ENCRYPTION_
   else if (bHeader == HEADER_CG_KEY_AGREEMENT)
   {
       // Send out the key agreement completion packet first
       // to help client to enter encryption mode
       d->SendKeyAgreementCompleted();
       // Flush socket output before going encrypted
       d->ProcessOutput();

       TPacketKeyAgreement* p = (TPacketKeyAgreement*)c_pData;
       if (!d->IsCipherPrepared())
       {
           sys_err ("Cipher isn't prepared. %s maybe a Hacker.", inet_ntoa(d->GetAddr().sin_addr));
           d->DelayedDisconnect(5);
           return 0;
       }
       if (d->FinishHandshake(p->wAgreedLength, p->data, p->wDataLength)) {
           // Handshaking succeeded
           if (g_bAuthServer) {
               d->SetPhase(PHASE_AUTH);
           } else {
               d->SetPhase(PHASE_LOGIN);
           }
       } else {
           sys_log(0, "[CInputHandshake] Key agreement failed: al=%u dl=%u",
               p->wAgreedLength, p->wDataLength);
           d->SetPhase(PHASE_CLOSE);
       }
   }
#endif // _IMPROVED_PACKET_ENCRYPTION_
   else
       sys_err("Handshake phase does not handle packet %d (fd %d)", bHeader, d->GetSocket());

return 0;
}

Edytowane 23 Listopada 20231 r przez ExoCarossa

Cytuj

Opublikowano 23 Listopada 20231 r

Dziękuje ci czcigodny panie!

Cytuj

Opublikowano 23 Listopada 20231 r

Autor

@ExoCarossa Jeśli nie masz tych warunków to koniecznie je dodaj, zaktualizowałem temat o podgląd implementacji.

Cytuj

1

Opublikowano 23 Listopada 20231 r

Szacunek i podziękowania za udostępnienie tego fixa – uratowałeś moje wieczory z debugowaniem tego błędu!

Cytuj

Opublikowano 23 Listopada 20231 r

Po dodaniu tego mam odpalone channele, db, auth ALE nie zaloguje się do gry bo wisi na połączeniu xD. Załączyłem całą funkcje z input.cpp

Możliwe że ja jestem tak bardzo odklejony..

Spoiler

int CInputHandshake::Analyze(LPDESC d, BYTE bHeader, const char * c_pData)
{
if (bHeader == 10) // żŁĹÍ´Â ą«˝Ă
return 0;

#ifdef fix_71
const int ACCESS_DENIED_ERROR_CODE = -1;

   if (IsEmptyAdminPage())
   {
       sys_log(0, "ACCESS DENIED: Attempt to access Admin Panel failed - Panel Configuration Missing. IP: %s, Host: %s", inet_ntoa(d->GetAddr().sin_addr), d->GetHostName());
       d->SetPhase(PHASE_CLOSE);
       return ACCESS_DENIED_ERROR_CODE;
   }

   if (!IsAdminPage(inet_ntoa(d->GetAddr().sin_addr)))
   {
       sys_log(0, "ACCESS DENIED: Unauthorized Admin Panel Access Attempt. IP: %s, Host: %s", inet_ntoa(d->GetAddr().sin_addr), d->GetHostName());
       d->SetPhase(PHASE_CLOSE);
       return ACCESS_DENIED_ERROR_CODE;
   }
#endif

   if (bHeader == HEADER_CG_TEXT)
   {
       ++c_pData;
       const char * c_pSep;

#ifdef fix_71
       if (!(c_pSep = strchr(c_pData, '\n')))
       {
           d->SetPhase(PHASE_CLOSE);
           return ACCESS_DENIED_ERROR_CODE;
       }
#else
       if (!(c_pSep = strchr(c_pData, '\n')))   // \nŔ» ĂŁ´Â´Ů.
           return -1;
#endif