New QMM plugin (work in progress)

[Ligustah]

I moved this thread here, so people other than high admins (including guests) can read it, because I will soon release the source code for the authentication plugin for other clans to integrate


[Update#2]
TODO list for my own reference:

• ignore omni bots
  

[/Update]


[Update]
I decided to move this thread from the Master Supreme Base to this forum.
Feel free to comment on this and post suggestions or questions if you have any.
[/Update]

Hi,

I'd like to present my recent experiments.
I went for another attempt at writing a useful GUID spoofing protection,
and I think I came up with a rather cool concept.

First consider this simple PHP script:

Code:

<?php print_r($_POST);

All it does is sending back all the data it received (this just serves as a proof of concept).

So I wrote a QMM plugin that is capable of POSTing all userinfo associated with a client to a remote web server upon connection.
The tricky part is, that we can now ask the web server (in this case our PHP script) to do something with that information and then tell us what to do.

As mentioned above, for testing purposes I just let the script return all the info it receives, which the plugin will print to server log:

Code:

ClientBegin: 0 [HTTP] received response code 200 Array ( [cg_delag] => 1 [cg_jaymiscflags] => 0 [cg_etVersion] => Enemy Territory, ET 2.60c [cg_uinfo] => 13 0 30 [cg_jaymod_title] => Jaymod 2.2.0 [cl_mac] => c4:17:fe:b8:11:a8 [cl_cpu] => i586 [pmove_fixed] => 0 [g_password] => none [cl_guid] => 1CD338CA42008CCF264EC21BEF09D67E [cl_punkbuster] => 1 [cl_anonymous] => 0 [snaps] => 20 [rate] => 25000 [name] => Ligustah [cl_wwwDownload] => 1 [protocol] => 82 [qport] => 218 [challenge] => -1652453754 [ip] => 141.23.85.9:27961 )

As you can see, the userinfo contains lots of interesting information, such as ip, MAC and GUID.

We could now have the PHP script check those information against the forum database, so we could see if the IP provided matches with the last known IP address used to browse the forum.

This, of course, means that we have to associate GUIDs with forum accounts. That should be fairly easy, if we just add another profile field. I actually wrote a program long ago that would allow people to proof their ownership over a certain GUID by checking the etkey on the computer of that person. We might as well just ask people to upload their etkey and calculate the GUID from that.

Anyways, so the cool thing is that we could actually detect if someone uses a GUID he is not supposed to use and then do some action based on that. We might ask the player to enter a PIN code that he can look up in his forum account or something like that.

And as long as a player is not authorized he will be unable to use any !commands (maybe even prevent any action).


Now that's pretty cool already, but this might be useful for many more things, like:

• Check the connection GUID against a global banlist
  
• Play a birthday song on the server.
  
• Allow people to automatically have their level set, if they lost it for whatever reason.
  
• Issue promotions via a web site
  
• Remind people to check forum, if they have been inactive there for some time
  
• Automatically give level to people in the members group or remove it if they are not in
  
• Automatically create banners with recent forum announcements.
  
• Allow players to send private messages to players on another server.
  

And that's just what I came up within 2 minutes. By allowing the servers to talk to a remote server like this, we can integrate them in a way that is extremely flexible.


As always, this is a work in progress and might not ever be finished. But I personally think it's pretty cool and I don't think I'll lose interest in this soon :P

-- Ligustah

[John]

Rofled about "As always, this is a work in progress and might not ever be finished."
Would be very cool indeed

[MayheM]

I love it when Lig toots his own horn :P

Some of what you said went way over my head, but some stuff in that description list does look pretty cool. You simply have to finish this by friday!!!

[Ligustah]

It's more or less working now. When a new map begins or when a player connects it will send a request to the auth server with all the info it has (more on that later). The auth server can decide if the player should be allowed to use !commands or not. In both query types ('game' or 'player') the auth server can send an arbitrary number of rcon commands back to be executed on the server.

As for the info that is sent to the server, I solved a problem there, that has bothered me for quite some time already. I came up with a rather good way to safely find out the level of a player from Jaymod (and that code can be easily adjusted for other mods as well). So right now the server will send a query like this to the server:

Code:

Array ( [type] => player [api_key] => 0 [info_cg_delag] => 1 [info_cg_jaymiscflags] => 0 [info_cg_etVersion] => Enemy Territory, ET 2.60c [info_cg_uinfo] => 13 0 30 [info_cg_jaymod_title] => Jaymod 2.2.0 [info_cl_mac] => c4:17:fe:b8:11:a8 [info_cl_cpu] => i586 [info_pmove_fixed] => 0 [info_g_password] => none [info_cl_guid] => 1CD338CA42008CCF264EC21BEF09D67E [info_cl_punkbuster] => 1 [info_cl_anonymous] => 0 [info_snaps] => 20 [info_rate] => 25000 [info_name] => Ligustah [info_cl_wwwDownload] => 1 [info_protocol] => 82 [info_qport] => 46884 [info_challenge] => 432366550 [info_ip] => 141.23.85.9:27960 [cl] => 0 [level] => 123 )

All keys starting with info_ are directly taken from the userinfo string.

• cl = slot number
  
• type = type of query (currently either 'player' or 'game')
  
• api_key = will be used later on to only allow our servers to query the auth script
  
• level = the player's jaymod level
  

So based on that info the auth script could first check the GUID or IP against our global banlist and return something like:

Code:

!ban <cl> PERM You are globally banned, please see board.twcclan.org

Then, if the level is higher than let's say 10, it could try to find the GUID in the forum database to see if it has been claimed, and if so, check the MAC and IP address against the info found in the database. Or check if the user is still in the members group, and if not automatically set him down.

Then it can return an error code that will make the server ignore all !commands from that player.
Otherwise it'll return OK and the player can use !commands just as usual.

Also, at the start of each map (or whenever the plugin is loaded) the server will send a 'game' query to the auth server. It will blindly execute all commands returned by the auth script. We could use that to set global server banners, for example, or to execute other commands based on the current time (like bring a server into fun day mode automatically).

The only thing left to test in the plugin would be how it deals with map changes. I added some code for that but never actually tested it.

When that's done, we can start writing code for the auth server (which should be fairly easy, because it's just some PHP coding).


I'd like to move this thread to some other forum base soon, to allow more poeple to have a look at it. Maybe High Admin Base. But that's only, when it actually works in the wild :P

-- Ligustah

---

//Thread moved to server supreme base

[Chaos]

''I'd like to move this thread to some other forum base soon, to allow more poeple to have a look at it. Maybe High Admin Base. But that's only, when it actually works in the wild Tongue. ''

Ligustah, this is the high admin base .

Chaos.

[Ligustah]

My bad, meant to move it to the Server supreme base. Anyways, please discuss!

We might require all higher admins to 'claim' their GUID via forum in future, so this might be interesting for you guys.

-- Ligustah

[Chuck]

i think its an great idea

[Sun]

Well it might be intresting for us but my brain isnt working normally anymore (Thanks lig)
how does it works xD?

[Ligustah]

I'll try to explain.

The problem with GUIDs is that it's just a cvar that you can set to whatever you like (with some malicious energy). So there is in fact no way for us to be sure that the GUID a player connects with is actually owned by that player (that's what GUID spoofing is about).

So if someone gets to know your GUID, which isn't that hard to find out, because it comes up in the logs of all servers you have played on, that person can basically steal your identity on our servers. That includes your level and your XP.
Right now the servers have no way of verifying the identity of a player, they simply have to trust the GUID supplied by the player.


So the idea is now, to have a trusted third party (also called authority) that is able to verify the identity a player claims to have. There are several ways of achieving that.
One would be allowing members in forum to upload their etkey. The forum would calculate the GUID from that and store it in its database. When that player connects to a server, the game will send a request to the forum server, sending all the information it has about the connecting player. The forum would see that it has the GUID stored in its database and associated with a forum account, so it will continue checking the IP of that player against the IP stored in the database. If the IP doesn't match it will tell the server not to allow that player to use any !commands.

So for our members, nothing would change basically. All they had to do would be logging in to the forum once before connecting to a server.
That way we can securely verify the identity of a player and we are more or less safe from GUID spoofing (at least safer than now).

I hope this was easier to understand than my technical blabla before :P

-- Ligustah

[Sun]

way more easier , its a nice system when i get it:P and I should get it because it isnt so hard:P
or i just havent readed ur post that well...

Greets,
Sun