aboutsummaryrefslogtreecommitdiff
path: root/NorthstarDLL/server/auth
diff options
context:
space:
mode:
Diffstat (limited to 'NorthstarDLL/server/auth')
-rw-r--r--NorthstarDLL/server/auth/bansystem.cpp222
-rw-r--r--NorthstarDLL/server/auth/bansystem.h19
-rw-r--r--NorthstarDLL/server/auth/serverauthentication.cpp462
-rw-r--r--NorthstarDLL/server/auth/serverauthentication.h59
4 files changed, 762 insertions, 0 deletions
diff --git a/NorthstarDLL/server/auth/bansystem.cpp b/NorthstarDLL/server/auth/bansystem.cpp
new file mode 100644
index 00000000..56719ed9
--- /dev/null
+++ b/NorthstarDLL/server/auth/bansystem.cpp
@@ -0,0 +1,222 @@
+#pragma once
+#include "pch.h"
+#include "bansystem.h"
+#include "serverauthentication.h"
+#include "shared/maxplayers.h"
+#include "core/convar/concommand.h"
+#include "server/r2server.h"
+#include "engine/r2engine.h"
+#include "config/profile.h"
+
+#include <filesystem>
+
+const char* BANLIST_PATH_SUFFIX = "/banlist.txt";
+const char BANLIST_COMMENT_CHAR = '#';
+
+ServerBanSystem* g_pBanSystem;
+
+void ServerBanSystem::OpenBanlist()
+{
+ std::ifstream banlistStream(GetNorthstarPrefix() + "/banlist.txt");
+
+ if (!banlistStream.fail())
+ {
+ std::string line;
+ while (std::getline(banlistStream, line))
+ {
+ // ignore line if first char is # or line is empty
+ if (line == "" || line.front() == BANLIST_COMMENT_CHAR)
+ continue;
+
+ // remove tabs which shouldnt be there but maybe someone did the funny
+ line.erase(std::remove(line.begin(), line.end(), '\t'), line.end());
+ // remove spaces to allow for spaces before uids
+ line.erase(std::remove(line.begin(), line.end(), ' '), line.end());
+
+ // check if line is empty to allow for newlines in the file
+ if (line == "")
+ continue;
+
+ // for inline comments like: 123123123 #banned for unfunny
+ std::string uid = line.substr(0, line.find(BANLIST_COMMENT_CHAR));
+
+ m_vBannedUids.push_back(strtoull(uid.c_str(), nullptr, 10));
+ }
+
+ banlistStream.close();
+ }
+
+ // open write stream for banlist // dont do this to allow for all time access
+ // m_sBanlistStream.open(GetNorthstarPrefix() + "/banlist.txt", std::ofstream::out | std::ofstream::binary | std::ofstream::app);
+}
+
+void ServerBanSystem::ReloadBanlist()
+{
+ std::ifstream fsBanlist(GetNorthstarPrefix() + "/banlist.txt");
+
+ if (!fsBanlist.fail())
+ {
+ std::string line;
+ // since we wanna use this as the reload func we need to clear the list
+ m_vBannedUids.clear();
+ while (std::getline(fsBanlist, line))
+ m_vBannedUids.push_back(strtoull(line.c_str(), nullptr, 10));
+
+ fsBanlist.close();
+ }
+}
+
+void ServerBanSystem::ClearBanlist()
+{
+ m_vBannedUids.clear();
+
+ // reopen the file, don't provide std::ofstream::app so it clears on open
+ m_sBanlistStream.close();
+ m_sBanlistStream.open(GetNorthstarPrefix() + "/banlist.txt", std::ofstream::out | std::ofstream::binary);
+ m_sBanlistStream.close();
+}
+
+void ServerBanSystem::BanUID(uint64_t uid)
+{
+ // checking if last char is \n to make sure uids arent getting fucked
+ std::ifstream fsBanlist(GetNorthstarPrefix() + "/banlist.txt");
+ std::string content((std::istreambuf_iterator<char>(fsBanlist)), (std::istreambuf_iterator<char>()));
+ fsBanlist.close();
+
+ m_sBanlistStream.open(GetNorthstarPrefix() + "/banlist.txt", std::ofstream::out | std::ofstream::binary | std::ofstream::app);
+ if (content.back() != '\n')
+ m_sBanlistStream << std::endl;
+
+ m_vBannedUids.push_back(uid);
+ m_sBanlistStream << std::to_string(uid) << std::endl;
+ m_sBanlistStream.close();
+ spdlog::info("{} was banned", uid);
+}
+
+void ServerBanSystem::UnbanUID(uint64_t uid)
+{
+ auto findResult = std::find(m_vBannedUids.begin(), m_vBannedUids.end(), uid);
+ if (findResult == m_vBannedUids.end())
+ return;
+
+ m_vBannedUids.erase(findResult);
+
+ std::vector<std::string> banlistText;
+ std::ifstream fs_readBanlist(GetNorthstarPrefix() + "/banlist.txt");
+
+ if (!fs_readBanlist.fail())
+ {
+ std::string line;
+ while (std::getline(fs_readBanlist, line))
+ {
+ // support for comments and newlines added in https://github.com/R2Northstar/NorthstarLauncher/pull/227
+
+ std::string modLine = line; // copy the line into a free var that we can fuck with, line will be the original
+
+ // remove tabs which shouldnt be there but maybe someone did the funny
+ modLine.erase(std::remove(modLine.begin(), modLine.end(), '\t'), modLine.end());
+ // remove spaces to allow for spaces before uids
+ modLine.erase(std::remove(modLine.begin(), modLine.end(), ' '), modLine.end());
+
+ // ignore line if first char is # or empty line, just add it
+ if (line.front() == BANLIST_COMMENT_CHAR || modLine == "")
+ {
+ banlistText.push_back(line);
+ continue;
+ }
+
+ // for inline comments like: 123123123 #banned for unfunny
+ std::string lineUid = line.substr(0, line.find(BANLIST_COMMENT_CHAR));
+ // have to erase spaces or else inline comments will fuck up the uid finding
+ lineUid.erase(std::remove(lineUid.begin(), lineUid.end(), '\t'), lineUid.end());
+ lineUid.erase(std::remove(lineUid.begin(), lineUid.end(), ' '), lineUid.end());
+
+ // if the uid in the line is the uid we wanna unban
+ if (std::to_string(uid) == lineUid)
+ {
+ // comment the uid out
+ line.insert(0, "# ");
+
+ // add a comment with unban date
+ // not necessary but i feel like this makes it better
+ std::time_t t = std::time(0);
+ std::tm* now = std::localtime(&t);
+
+ std::ostringstream unbanComment;
+
+ //{y}/{m}/{d} {h}:{m}
+ unbanComment << " # unban date: ";
+ unbanComment << now->tm_year + 1900 << "-"; // this lib is so fucking awful
+ unbanComment << std::setw(2) << std::setfill('0') << now->tm_mon + 1 << "-";
+ unbanComment << std::setw(2) << std::setfill('0') << now->tm_mday << " ";
+ unbanComment << std::setw(2) << std::setfill('0') << now->tm_hour << ":";
+ unbanComment << std::setw(2) << std::setfill('0') << now->tm_min;
+
+ line.append(unbanComment.str());
+ }
+
+ banlistText.push_back(line);
+ }
+
+ fs_readBanlist.close();
+ }
+
+ // open write stream for banlist // without append so we clear the file
+ if (m_sBanlistStream.is_open())
+ m_sBanlistStream.close();
+ m_sBanlistStream.open(GetNorthstarPrefix() + "/banlist.txt", std::ofstream::out | std::ofstream::binary);
+
+ for (std::string updatedLine : banlistText)
+ m_sBanlistStream << updatedLine << std::endl;
+
+ m_sBanlistStream.close();
+ spdlog::info("{} was unbanned", uid);
+}
+
+bool ServerBanSystem::IsUIDAllowed(uint64_t uid)
+{
+ ReloadBanlist(); // Reload to have up to date list on join
+ return std::find(m_vBannedUids.begin(), m_vBannedUids.end(), uid) == m_vBannedUids.end();
+}
+
+void ConCommand_ban(const CCommand& args)
+{
+ if (args.ArgC() < 2)
+ return;
+
+ for (int i = 0; i < R2::GetMaxPlayers(); i++)
+ {
+ R2::CBaseClient* player = &R2::g_pClientArray[i];
+
+ if (!strcmp(player->m_Name, args.Arg(1)) || !strcmp(player->m_UID, args.Arg(1)))
+ {
+ g_pBanSystem->BanUID(strtoull(player->m_UID, nullptr, 10));
+ R2::CBaseClient__Disconnect(player, 1, "Banned from server");
+ break;
+ }
+ }
+}
+
+void ConCommand_unban(const CCommand& args)
+{
+ if (args.ArgC() < 2)
+ return;
+
+ // assumedly the player being unbanned here wasn't already connected, so don't need to iterate over players or anything
+ g_pBanSystem->UnbanUID(strtoull(args.Arg(1), nullptr, 10));
+}
+
+void ConCommand_clearbanlist(const CCommand& args)
+{
+ g_pBanSystem->ClearBanlist();
+}
+
+ON_DLL_LOAD_RELIESON("engine.dll", BanSystem, ConCommand, (CModule module))
+{
+ g_pBanSystem = new ServerBanSystem;
+ g_pBanSystem->OpenBanlist();
+
+ RegisterConCommand("ban", ConCommand_ban, "bans a given player by uid or name", FCVAR_GAMEDLL);
+ RegisterConCommand("unban", ConCommand_unban, "unbans a given player by uid", FCVAR_GAMEDLL);
+ RegisterConCommand("clearbanlist", ConCommand_clearbanlist, "clears all uids on the banlist", FCVAR_GAMEDLL);
+}
diff --git a/NorthstarDLL/server/auth/bansystem.h b/NorthstarDLL/server/auth/bansystem.h
new file mode 100644
index 00000000..6f180126
--- /dev/null
+++ b/NorthstarDLL/server/auth/bansystem.h
@@ -0,0 +1,19 @@
+#pragma once
+#include <fstream>
+
+class ServerBanSystem
+{
+ private:
+ std::ofstream m_sBanlistStream;
+ std::vector<uint64_t> m_vBannedUids;
+
+ public:
+ void OpenBanlist();
+ void ReloadBanlist();
+ void ClearBanlist();
+ void BanUID(uint64_t uid);
+ void UnbanUID(uint64_t uid);
+ bool IsUIDAllowed(uint64_t uid);
+};
+
+extern ServerBanSystem* g_pBanSystem;
diff --git a/NorthstarDLL/server/auth/serverauthentication.cpp b/NorthstarDLL/server/auth/serverauthentication.cpp
new file mode 100644
index 00000000..ac1d5f17
--- /dev/null
+++ b/NorthstarDLL/server/auth/serverauthentication.cpp
@@ -0,0 +1,462 @@
+#include "pch.h"
+#include "serverauthentication.h"
+#include "shared/exploit_fixes/ns_limits.h"
+#include "core/convar/cvar.h"
+#include "core/convar/convar.h"
+#include "masterserver/masterserver.h"
+#include "server/serverpresence.h"
+#include "engine/hoststate.h"
+#include "shared/maxplayers.h"
+#include "bansystem.h"
+#include "core/convar/concommand.h"
+#include "dedicated/dedicated.h"
+#include "config/profile.h"
+#include "core/tier0.h"
+#include "engine/r2engine.h"
+#include "client/r2client.h"
+#include "server/r2server.h"
+
+#include "httplib.h"
+
+#include <fstream>
+#include <filesystem>
+#include <thread>
+
+AUTOHOOK_INIT()
+
+const char* AUTHSERVER_VERIFY_STRING = "I am a northstar server!";
+
+// global vars
+ServerAuthenticationManager* g_pServerAuthentication;
+CBaseServer__RejectConnectionType CBaseServer__RejectConnection;
+
+void ServerAuthenticationManager::StartPlayerAuthServer()
+{
+ if (m_bRunningPlayerAuthThread)
+ {
+ spdlog::warn("ServerAuthenticationManager::StartPlayerAuthServer was called while m_bRunningPlayerAuthThread is true");
+ return;
+ }
+
+ g_pServerPresence->SetAuthPort(Cvar_ns_player_auth_port->GetInt()); // set auth port for presence
+ m_bRunningPlayerAuthThread = true;
+
+ // listen is a blocking call so thread this
+ std::thread serverThread(
+ [this]
+ {
+ // this is just a super basic way to verify that servers have ports open, masterserver will try to read this before ensuring
+ // server is legit
+ m_PlayerAuthServer.Get(
+ "/verify",
+ [](const httplib::Request& request, httplib::Response& response)
+ { response.set_content(AUTHSERVER_VERIFY_STRING, "text/plain"); });
+
+ m_PlayerAuthServer.Post(
+ "/authenticate_incoming_player",
+ [this](const httplib::Request& request, httplib::Response& response)
+ {
+ if (!request.has_param("id") || !request.has_param("authToken") || request.body.size() >= R2::PERSISTENCE_MAX_SIZE ||
+ !request.has_param("serverAuthToken") ||
+ strcmp(g_pMasterServerManager->m_sOwnServerAuthToken, request.get_param_value("serverAuthToken").c_str()))
+ {
+ response.set_content("{\"success\":false}", "application/json");
+ return;
+ }
+
+ RemoteAuthData newAuthData {};
+ strncpy_s(newAuthData.uid, sizeof(newAuthData.uid), request.get_param_value("id").c_str(), sizeof(newAuthData.uid) - 1);
+ strncpy_s(
+ newAuthData.username,
+ sizeof(newAuthData.username),
+ request.get_param_value("username").c_str(),
+ sizeof(newAuthData.username) - 1);
+
+ newAuthData.pdataSize = request.body.size();
+ newAuthData.pdata = new char[newAuthData.pdataSize];
+ memcpy(newAuthData.pdata, request.body.c_str(), newAuthData.pdataSize);
+
+ std::lock_guard<std::mutex> guard(m_AuthDataMutex);
+ m_RemoteAuthenticationData.insert(std::make_pair(request.get_param_value("authToken"), newAuthData));
+
+ response.set_content("{\"success\":true}", "application/json");
+ });
+
+ m_PlayerAuthServer.listen("0.0.0.0", Cvar_ns_player_auth_port->GetInt());
+ });
+
+ serverThread.detach();
+}
+
+void ServerAuthenticationManager::StopPlayerAuthServer()
+{
+ if (!m_bRunningPlayerAuthThread)
+ {
+ spdlog::warn("ServerAuthenticationManager::StopPlayerAuthServer was called while m_bRunningPlayerAuthThread is false");
+ return;
+ }
+
+ m_bRunningPlayerAuthThread = false;
+ m_PlayerAuthServer.stop();
+}
+
+void ServerAuthenticationManager::AddPlayer(R2::CBaseClient* player, const char* pToken)
+{
+ PlayerAuthenticationData additionalData;
+ additionalData.pdataSize = m_RemoteAuthenticationData[pToken].pdataSize;
+ additionalData.usingLocalPdata = player->m_iPersistenceReady == R2::ePersistenceReady::READY_INSECURE;
+
+ m_PlayerAuthenticationData.insert(std::make_pair(player, additionalData));
+}
+
+void ServerAuthenticationManager::RemovePlayer(R2::CBaseClient* player)
+{
+ if (m_PlayerAuthenticationData.count(player))
+ m_PlayerAuthenticationData.erase(player);
+}
+
+bool checkIsPlayerNameValid(const char* name)
+{
+ int len = strlen(name);
+ // Restricts name to max 63 characters
+ if (len >= 64)
+ return false;
+ for (int i = 0; i < len; i++)
+ {
+ // Restricts the characters in the name to a restricted range in ASCII
+ if (static_cast<int>(name[i]) < 32 || static_cast<int>(name[i]) > 126)
+ {
+ return false;
+ }
+ }
+ return true;
+}
+
+bool ServerAuthenticationManager::VerifyPlayerName(const char* authToken, const char* name)
+{
+ std::lock_guard<std::mutex> guard(m_AuthDataMutex);
+
+ if (CVar_ns_auth_allow_insecure->GetInt())
+ {
+ spdlog::info("Allowing player with name '{}' because ns_auth_allow_insecure is enabled", name);
+ return true;
+ }
+
+ if (!checkIsPlayerNameValid(name))
+ {
+ spdlog::info("Rejecting player with name '{}' because the name contains forbidden characters", name);
+ return false;
+ }
+ // TODO: We should really have a better way of doing this for singleplayer
+ // Best way of doing this would be to check if server is actually in singleplayer mode, or just running a SP map in multiplayer
+ // Currently there's not an easy way of checking this, so we just disable this check if mapname starts with `sp_`
+ // This means that player names are not checked on singleplayer
+ if ((m_RemoteAuthenticationData.empty() || m_RemoteAuthenticationData.count(std::string(authToken)) == 0) &&
+ strncmp(R2::g_pHostState->m_levelName, "sp_", 3) != 0)
+ {
+ spdlog::info("Rejecting player with name '{}' because authToken '{}' was not found", name, authToken);
+ return false;
+ }
+
+ const RemoteAuthData& authData = m_RemoteAuthenticationData[authToken];
+
+ if (*authData.username && strncmp(name, authData.username, 64) != 0)
+ {
+ spdlog::info("Rejecting player with name '{}' because name does not match expected name '{}'", name, authData.username);
+ return false;
+ }
+
+ return true;
+}
+
+bool ServerAuthenticationManager::CheckDuplicateAccounts(R2::CBaseClient* player)
+{
+ if (m_bAllowDuplicateAccounts)
+ return true;
+
+ bool bHasUidPlayer = false;
+ for (int i = 0; i < R2::GetMaxPlayers(); i++)
+ if (&R2::g_pClientArray[i] != player && !strcmp(R2::g_pClientArray[i].m_UID, player->m_UID))
+ return false;
+
+ return true;
+}
+
+bool ServerAuthenticationManager::AuthenticatePlayer(R2::CBaseClient* player, uint64_t uid, char* authToken)
+{
+ std::string strUid = std::to_string(uid);
+ std::lock_guard<std::mutex> guard(m_AuthDataMutex);
+
+ if (!strncmp(R2::g_pHostState->m_levelName, "sp_", 3))
+ return true;
+
+ // copy uuid
+ strcpy(player->m_UID, strUid.c_str());
+
+ bool authFail = true;
+ if (!m_RemoteAuthenticationData.empty() && m_RemoteAuthenticationData.count(std::string(authToken)))
+ {
+ if (!CheckDuplicateAccounts(player))
+ return false;
+
+ // use stored auth data
+ RemoteAuthData authData = m_RemoteAuthenticationData[authToken];
+
+ if (!strcmp(strUid.c_str(), authData.uid)) // connecting client's uid is the same as auth's uid
+ {
+ // if we're resetting let script handle the reset
+ if (!m_bForceResetLocalPlayerPersistence || strcmp(authData.uid, R2::g_pLocalPlayerUserID))
+ {
+ // copy pdata into buffer
+ memcpy(player->m_PersistenceBuffer, authData.pdata, authData.pdataSize);
+ }
+
+ // set persistent data as ready
+ player->m_iPersistenceReady = R2::ePersistenceReady::READY_REMOTE;
+ authFail = false;
+ }
+ }
+
+ if (authFail)
+ {
+ if (CVar_ns_auth_allow_insecure->GetBool())
+ {
+ // set persistent data as ready
+ // note: actual placeholder persistent data is populated in script with InitPersistentData()
+ player->m_iPersistenceReady = R2::ePersistenceReady::READY_INSECURE;
+ return true;
+ }
+ else
+ return false;
+ }
+
+ return true; // auth successful, client stays on
+}
+
+bool ServerAuthenticationManager::RemovePlayerAuthData(R2::CBaseClient* player)
+{
+ if (!Cvar_ns_erase_auth_info->GetBool()) // keep auth data forever
+ return false;
+
+ // hack for special case where we're on a local server, so we erase our own newly created auth data on disconnect
+ if (m_bNeedLocalAuthForNewgame && !strcmp(player->m_UID, R2::g_pLocalPlayerUserID))
+ return false;
+
+ // we don't have our auth token at this point, so lookup authdata by uid
+ for (auto& auth : m_RemoteAuthenticationData)
+ {
+ if (!strcmp(player->m_UID, auth.second.uid))
+ {
+ // pretty sure this is fine, since we don't iterate after the erase
+ // i think if we iterated after it'd be undefined behaviour tho
+ std::lock_guard<std::mutex> guard(m_AuthDataMutex);
+
+ delete[] auth.second.pdata;
+ m_RemoteAuthenticationData.erase(auth.first);
+ return true;
+ }
+ }
+
+ return false;
+}
+
+void ServerAuthenticationManager::WritePersistentData(R2::CBaseClient* player)
+{
+ if (player->m_iPersistenceReady == R2::ePersistenceReady::READY_REMOTE)
+ {
+ g_pMasterServerManager->WritePlayerPersistentData(
+ player->m_UID, (const char*)player->m_PersistenceBuffer, m_PlayerAuthenticationData[player].pdataSize);
+ }
+ else if (CVar_ns_auth_allow_insecure_write->GetBool())
+ {
+ // todo: write pdata to disk here
+ }
+}
+
+// auth hooks
+
+// store these in vars so we can use them in CBaseClient::Connect
+// this is fine because ptrs won't decay by the time we use this, just don't use it outside of calls from cbaseclient::connectclient
+char* pNextPlayerToken;
+uint64_t iNextPlayerUid;
+
+// clang-format off
+AUTOHOOK(CBaseServer__ConnectClient, engine.dll + 0x114430,
+void*,, (
+ void* self,
+ void* addr,
+ void* a3,
+ uint32_t a4,
+ uint32_t a5,
+ int32_t a6,
+ void* a7,
+ char* playerName,
+ char* serverFilter,
+ void* a10,
+ char a11,
+ void* a12,
+ char a13,
+ char a14,
+ int64_t uid,
+ uint32_t a16,
+ uint32_t a17))
+// clang-format on
+{
+ // auth tokens are sent with serverfilter, can't be accessed from player struct to my knowledge, so have to do this here
+ pNextPlayerToken = serverFilter;
+ iNextPlayerUid = uid;
+
+ spdlog::info(
+ "CBaseServer__ClientConnect attempted connection with uid {}, playerName '{}', serverFilter '{}'", uid, playerName, serverFilter);
+
+ if (!g_pServerAuthentication->VerifyPlayerName(pNextPlayerToken, playerName))
+ {
+ CBaseServer__RejectConnection(self, *((int*)self + 3), addr, "Invalid Name.\n");
+ return nullptr;
+ }
+ if (!g_pBanSystem->IsUIDAllowed(uid))
+ {
+ CBaseServer__RejectConnection(self, *((int*)self + 3), addr, "Banned From server.\n");
+ return nullptr;
+ }
+
+ return CBaseServer__ConnectClient(self, addr, a3, a4, a5, a6, a7, playerName, serverFilter, a10, a11, a12, a13, a14, uid, a16, a17);
+}
+
+// clang-format off
+AUTOHOOK(CBaseClient__Connect, engine.dll + 0x101740,
+bool,, (R2::CBaseClient* self, char* name, void* netchan_ptr_arg, char b_fake_player_arg, void* a5, char* Buffer, void* a7))
+// clang-format on
+{
+ // try to auth player, dc if it fails
+ // we connect regardless of auth, because returning bad from this function can fuck client state p bad
+ bool ret = CBaseClient__Connect(self, name, netchan_ptr_arg, b_fake_player_arg, a5, Buffer, a7);
+ if (!ret)
+ return ret;
+
+ if (!g_pServerAuthentication->VerifyPlayerName(pNextPlayerToken, name))
+ {
+ R2::CBaseClient__Disconnect(self, 1, "Invalid Name.\n");
+ return false;
+ }
+ if (!g_pBanSystem->IsUIDAllowed(iNextPlayerUid))
+ {
+ R2::CBaseClient__Disconnect(self, 1, "Banned From server.\n");
+ return false;
+ }
+ if (!g_pServerAuthentication->AuthenticatePlayer(self, iNextPlayerUid, pNextPlayerToken))
+ {
+ R2::CBaseClient__Disconnect(self, 1, "Authentication Failed.\n");
+ return false;
+ }
+
+ g_pServerAuthentication->AddPlayer(self, pNextPlayerToken);
+ g_pServerLimits->AddPlayer(self);
+
+ return ret;
+}
+
+// clang-format off
+AUTOHOOK(CBaseClient__ActivatePlayer, engine.dll + 0x100F80,
+void,, (R2::CBaseClient* self))
+// clang-format on
+{
+ // if we're authed, write our persistent data
+ // RemovePlayerAuthData returns true if it removed successfully, i.e. on first call only, and we only want to write on >= second call
+ // (since this func is called on map loads)
+ if (self->m_iPersistenceReady >= R2::ePersistenceReady::READY && !g_pServerAuthentication->RemovePlayerAuthData(self))
+ {
+ g_pServerAuthentication->m_bForceResetLocalPlayerPersistence = false;
+ g_pServerAuthentication->WritePersistentData(self);
+ g_pServerPresence->SetPlayerCount(g_pServerAuthentication->m_PlayerAuthenticationData.size());
+ }
+
+ CBaseClient__ActivatePlayer(self);
+}
+
+// clang-format off
+AUTOHOOK(_CBaseClient__Disconnect, engine.dll + 0x1012C0,
+void,, (R2::CBaseClient* self, uint32_t unknownButAlways1, const char* pReason, ...))
+// clang-format on
+{
+ // have to manually format message because can't pass varargs to original func
+ char buf[1024];
+
+ va_list va;
+ va_start(va, pReason);
+ vsprintf(buf, pReason, va);
+ va_end(va);
+
+ // this reason is used while connecting to a local server, hacky, but just ignore it
+ if (strcmp(pReason, "Connection closing"))
+ {
+ spdlog::info("Player {} disconnected: \"{}\"", self->m_Name, buf);
+
+ // dcing, write persistent data
+ if (g_pServerAuthentication->m_PlayerAuthenticationData[self].needPersistenceWriteOnLeave)
+ g_pServerAuthentication->WritePersistentData(self);
+ g_pServerAuthentication->RemovePlayerAuthData(self); // won't do anything 99% of the time, but just in case
+
+ g_pServerAuthentication->RemovePlayer(self);
+ g_pServerLimits->RemovePlayer(self);
+ }
+
+ else if (g_pServerAuthentication->m_RemoteAuthenticationData.count(self->m_Name))
+ {
+ g_pServerAuthentication->RemovePlayer(self);
+ g_pServerLimits->RemovePlayer(self);
+ }
+
+ g_pServerPresence->SetPlayerCount(g_pServerAuthentication->m_PlayerAuthenticationData.size());
+
+ _CBaseClient__Disconnect(self, unknownButAlways1, buf);
+}
+
+void ConCommand_ns_resetpersistence(const CCommand& args)
+{
+ if (*R2::g_pServerState == R2::server_state_t::ss_active)
+ {
+ spdlog::error("ns_resetpersistence must be entered from the main menu");
+ return;
+ }
+
+ spdlog::info("resetting persistence on next lobby load...");
+ g_pServerAuthentication->m_bForceResetLocalPlayerPersistence = true;
+}
+
+ON_DLL_LOAD_RELIESON("engine.dll", ServerAuthentication, (ConCommand, ConVar), (CModule module))
+{
+ AUTOHOOK_DISPATCH()
+
+ g_pServerAuthentication = new ServerAuthenticationManager;
+
+ g_pServerAuthentication->Cvar_ns_player_auth_port = new ConVar("ns_player_auth_port", "8081", FCVAR_GAMEDLL, "");
+ g_pServerAuthentication->Cvar_ns_erase_auth_info =
+ new ConVar("ns_erase_auth_info", "1", FCVAR_GAMEDLL, "Whether auth info should be erased from this server on disconnect or crash");
+ g_pServerAuthentication->CVar_ns_auth_allow_insecure =
+ new ConVar("ns_auth_allow_insecure", "0", FCVAR_GAMEDLL, "Whether this server will allow unauthenicated players to connect");
+ g_pServerAuthentication->CVar_ns_auth_allow_insecure_write = new ConVar(
+ "ns_auth_allow_insecure_write",
+ "0",
+ FCVAR_GAMEDLL,
+ "Whether the pdata of unauthenticated clients will be written to disk when changed");
+
+ RegisterConCommand(
+ "ns_resetpersistence", ConCommand_ns_resetpersistence, "resets your pdata when you next enter the lobby", FCVAR_NONE);
+
+ // patch to disable kicking based on incorrect serverfilter in connectclient, since we repurpose it for use as an auth token
+ module.Offset(0x114655).Patch("EB");
+
+ // patch to disable fairfight marking players as cheaters and kicking them
+ module.Offset(0x101012).Patch("E9 90 00");
+
+ CBaseServer__RejectConnection = module.Offset(0x1182E0).As<CBaseServer__RejectConnectionType>();
+
+ if (Tier0::CommandLine()->CheckParm("-allowdupeaccounts"))
+ {
+ // patch to allow same of multiple account
+ module.Offset(0x114510).Patch("EB");
+
+ g_pServerAuthentication->m_bAllowDuplicateAccounts = true;
+ }
+}
diff --git a/NorthstarDLL/server/auth/serverauthentication.h b/NorthstarDLL/server/auth/serverauthentication.h
new file mode 100644
index 00000000..4ffbbfd6
--- /dev/null
+++ b/NorthstarDLL/server/auth/serverauthentication.h
@@ -0,0 +1,59 @@
+#pragma once
+#include "core/convar/convar.h"
+#include "httplib.h"
+#include "engine/r2engine.h"
+#include <unordered_map>
+#include <string>
+
+struct RemoteAuthData
+{
+ char uid[33];
+ char username[64];
+
+ // pdata
+ char* pdata;
+ size_t pdataSize;
+};
+
+struct PlayerAuthenticationData
+{
+ bool usingLocalPdata;
+ size_t pdataSize;
+ bool needPersistenceWriteOnLeave = true;
+};
+
+typedef int64_t (*CBaseServer__RejectConnectionType)(void* a1, unsigned int a2, void* a3, const char* a4, ...);
+extern CBaseServer__RejectConnectionType CBaseServer__RejectConnection;
+
+class ServerAuthenticationManager
+{
+ private:
+ httplib::Server m_PlayerAuthServer;
+
+ public:
+ ConVar* Cvar_ns_player_auth_port;
+ ConVar* Cvar_ns_erase_auth_info;
+ ConVar* CVar_ns_auth_allow_insecure;
+ ConVar* CVar_ns_auth_allow_insecure_write;
+
+ std::mutex m_AuthDataMutex;
+ std::unordered_map<std::string, RemoteAuthData> m_RemoteAuthenticationData;
+ std::unordered_map<R2::CBaseClient*, PlayerAuthenticationData> m_PlayerAuthenticationData;
+ bool m_bAllowDuplicateAccounts = false;
+ bool m_bRunningPlayerAuthThread = false;
+ bool m_bNeedLocalAuthForNewgame = false;
+ bool m_bForceResetLocalPlayerPersistence = false;
+
+ public:
+ void StartPlayerAuthServer();
+ void StopPlayerAuthServer();
+ void AddPlayer(R2::CBaseClient* player, const char* pToken);
+ void RemovePlayer(R2::CBaseClient* player);
+ bool CheckDuplicateAccounts(R2::CBaseClient* player);
+ bool AuthenticatePlayer(R2::CBaseClient* player, uint64_t uid, char* authToken);
+ bool VerifyPlayerName(const char* authToken, const char* name);
+ bool RemovePlayerAuthData(R2::CBaseClient* player);
+ void WritePersistentData(R2::CBaseClient* player);
+};
+
+extern ServerAuthenticationManager* g_pServerAuthentication;