~swag/armagetronad/0.2.9-sty+ct+ap-fork

static nAddress lastPeers[MAXCLIENTS+2]; // the peers last connected to each slot

// random offset

static int sn_GetRandomOffset()

{

    static tReproducibleRandomizer rand;

    return rand.Get(0x7fffffff);

}

 

// syn cookie

static int sn_SynTimestamp()

{

    static int offset = sn_GetRandomOffset();

 

    return offset + tSysTimeFloat()/16;

}

 

// a cookie consists of two shorts, each transmitted as MessageID

// of two consecutive fake login accept packets. They'll be sent back

// to the server inside ONE ack message by a real, non-spoofed client.

struct nCookie

{

    unsigned short first; 

    unsigned short second;

 

    nCookie(): first(0), second(0){}

};

 

static void sn_SynGenerateCookie(int stamp, nAddress const & sender, nCookie & ret)

{

    // just some random modulus.

    static const unsigned int modulo = 0x7f71fa35;

    stamp %= modulo;

 

    // calculate just some random checksum. Doesn't need to be any good,

    // we can change it any time should someone be able to predict it.

    int checksum = stamp;

    int mul = ( stamp & 0x7fff ) + 3;

    sockaddr const * sock = sender;

    for(int i = sender.GetAddressLength()-1; i >= 0; --i )

    {

        ++mul;

        checksum += (checksum >> 16) * mul;

        checksum += reinterpret_cast< char const * >( sock )[i];

        checksum %= modulo;

    }

 

    // message IDs must not be 0, so we need to add a 1 offset and can't

    // do the usual &0xffff / >>16 split.

    ret.first = ( checksum % 0xfffe ) + 1;

    ret.second = (checksum + 1 - ret.first)/0xfffe + 1;

}

 

static void sn_SynGenerateCookie(int stamp, nMessage const &m, nCookie & ret)

{

    sn_SynGenerateCookie( stamp, peers[m.SenderID()], ret );

}

 

 

// *************************************************************

 

    if( m.SenderID() == MAXCLIENTS+1 )

    {

    // check for syn cookie response

        nCookie cookie;

        if(m.End())

        {

            return;

        }

        m.Read(cookie.first);

        if(m.End())

        {

            return;

        }

        m.Read(cookie.second);

        if(!m.End())

        {

            return;

        }

 

        int stamp = sn_SynTimestamp();

        for(int offset=0; offset >= -1; --offset)

        {

            nCookie correct;

            sn_SynGenerateCookie( stamp+offset , m, correct );

            if( correct.first == cookie.first && correct.second == cookie.second )

            {

                nMachine::GetMachine( m.SenderID() ).Validate();

            }

        }

            

        return;

    }

 

    while (!m.End())

    {

static nDescriptor s_Acknowledge(1,ack_handler,"ack",true);

    lenLeft-=3;

        if(m.End())

        {

            // fake login accept sent only for cookie ack response. ignore.

            return;

        }

 

// defined in nServerInfo.cpp

extern bool FloodProtection( nMachine & machine, REAL timeFactor=1.0 );

 

// time factor for incoming connections, lower makes turtle mode kick in later

static REAL sn_minConnectionTimeGlobalFactor = 0.1;

static tSettingItem< REAL > sn_minPingTimeGlobal( "CONNECTION_FLOOD_SENSITIVITY", sn_minConnectionTimeGlobalFactor );

 

// enforce turtle mode

static bool sn_forceTurtleMode = false;

static tSettingItem< bool > sn_forceTurtleModeConf( "FORCE_TURTLE_MODE", sn_forceTurtleMode );

 

// keep recording even in turtle mode

static bool sn_recordTurtleMode = false;

static tSettingItem< bool > sn_recordTurtleModeConf( "RECORD_TURTLE_MODE", sn_recordTurtleMode );

 

// enforce the anti-spoof login part of turtle mode at all times

static bool sn_synCookie = false;

static tSettingItem< bool > sn_synCookieConf( "ANTI_SPOOF", sn_synCookie );

 

 

// number of packets from unknown sources to process each call to rec_peer

static int sn_connectionLimit = 100;

static tSettingItem< int > sn_connectionLimitConf( "CONNECTION_LIMIT", sn_connectionLimit );

 

// turtle mode control

class nTurtleControl

{

    REAL lastTurtleModeTime; // last time turtle mode was activated

    bool setThisFrame;

 

    // true while we're turtling from a flood

    bool turtleMode;

public:

    nTurtleControl()

    : lastTurtleModeTime(-700)

    , setThisFrame(false)

    , turtleMode(false)

    {

    }

 

    operator bool() const

    {

        return turtleMode;

    }

 

    // activates turtle mode. It will persist for at least 60 seconds.

    void SetTurtleMode()

    {

        if( !setThisFrame )

        {

            if( !turtleMode )

            {

                // report

                sn_ConsoleOut( tOutput("$turtle_mode_activated") ); 

 

                // stop recording

                if( !sn_recordTurtleMode && tRecorder::IsRecording() )

                {

                    tRecorder::StopRecording();

                }

            }

 

            turtleMode = true;

            setThisFrame = true;

            lastTurtleModeTime = tSysTimeFloat();

            

        }

    }

 

    void Update()

    {

        setThisFrame = false;

        if( lastTurtleModeTime + 60 < tSysTimeFloat() )

        {

            if( turtleMode && !sn_forceTurtleMode )

            {

                // report

                sn_ConsoleOut( tOutput("$turtle_mode_deactivated") ); 

            }

 

            turtleMode = sn_forceTurtleMode;

        }

    }

};

static nTurtleControl sn_turtleMode;

 

// checks for global flood events

static inline bool GlobalConnectionFloodProtection( REAL extraFactor = 1.0f )

{

    static nMachine server;

 

    if( sn_minConnectionTimeGlobalFactor > 0 && FloodProtection( server, sn_minConnectionTimeGlobalFactor*extraFactor ) )

    {

        sn_turtleMode.SetTurtleMode();

    }

    

    return sn_turtleMode;

}

 

// checks for individual flood events

bool IndividualConnectionFloodProtection( nMachine * machine, int peer,  REAL extraFactor = 1.0f )

{

    // IP is not spoofed or there is no

    // current spoof heavy attack. Really look up the machine.

    if( !machine )

    {

        machine = &nMachine::GetMachine( peer );

    }

    

    // check individual flood protection (be lenient in turtle mode, login responses may have trouble getting through an attack)

    return FloodProtection( *machine, ( sn_turtleMode ? .2 : 1 ) * extraFactor );

}

 

// report login failure. Or don't if we're flooded.

int sn_ReportFailure(nMessage &m, char const * reason)

{

    if( !sn_turtleMode )

    {

        sn_DisconnectUser(m.SenderID(), reason);

    }

 

    return -1;

}

 

 

        return -1;

        return sn_ReportFailure(m, "$network_kill_incompatible");

        return sn_ReportFailure(m, "0.2.8_beta and 0.2.8.0_rc versions have a dangerous security flaw and are obsoleted, please upgrade to 0.2.8.2.1.");

                {

                }

        return sn_ReportFailure(m, "$network_kill_full");

// from nServerInfo.cpp

extern nDescriptor RequestSmallServerInfoDescriptor, RequestBigServerInfoDescriptor;

 

    sn_turtleMode.Update();

#ifndef DEDICATED

#endif

#ifndef DEDICATED

#endif

                        // packet WAAAAY too large.

                        static float totalFatsoes = 10;  // number of oversized packages checked

                        static float clientFatsoes = 10; // number of oversized pacakges that could be attributed to clients

                        static float bother = 5;         // counter that determines whether we bother to check.

                        bother+=clientFatsoes;

 

                        // what follows is work, so we only do it if it payed off in the past

                        // if this block is entered not at all by error, no biggie. The clients

                        // will time out eventually.

                        bool success = false;

                        if(bother>totalFatsoes)

                        {

                            bother-=totalFatsoes;

 

                            // increase total stat

                            totalFatsoes++;

 

                            // If it's from a connected client,

                            // terminate the connection. If not, it's an attack and

                            // we should rather ignore it.

                            for( int id=MAXCLIENTS; id > 0; --id )

                            {

                                if (sn_Connections[id].socket && peers[id] == addrFrom)

                                {

                                    sn_DisconnectUser( id, "$network_kill_error" );

                                    success=true;

                                }

                            }

 

                            // count the successfully removed client

                            if( success )

                            {

                                clientFatsoes++;

                            }

 

                            // scale down the stats

                            const float factor=.99;

                            totalFatsoes*=factor;

                            clientFatsoes*=factor;

                            bother*=factor;

                        }

 

                        if( !success )

                        {

                            // check for global and local spam (just for reporting, the packet

                            // is going to get blocked either way)

                            REAL severity = len*.5/MAX_MESS_LEN;

                            if( !GlobalConnectionFloodProtection( severity ) )

                            {

                                peers[ MAXCLIENTS+1] = addrFrom;

                                IndividualConnectionFloodProtection( NULL, MAXCLIENTS+1, severity );

                            }

                        }

 

                    // no use in processing the truncated packet. Some messages may get lost,

                    // but that's better than the inevitable network error and connection

                    // termination that expects us if we go on.

                    continue;

                // set if only the first message of the packet is to be processed.

                bool onlyReadFirstMessage = false;

 

                    // check for communication from last partner

                    if( claim_id > 0 && 0 == nAddress::Compare( addrFrom, lastPeers[claim_id] ) )

                    {

                        // ignore. The peer think it's still a client, but it's wrong.

                        // new login packets, pings etc. all come with claim_id == 0.

                        continue;

                    }

 

 

// #define NO_GLOBAL_FLOODPROTECTION

#ifndef NO_GLOBAL_FLOODPROTECTION

                    // flood check for pings, logins and other potential nasties; as early as possible

                    if( sn_turtleMode && count > sn_connectionLimit*10 )

                    {

                        continue;

                    }

 

                    nMachine * machine = nMachine::PeekMachine( peer );

 

                    if( sn_GetNetState() == nSERVER )

                    {

                        // check whether we're currently getting flooded

                        GlobalConnectionFloodProtection();

 

                        if( sn_turtleMode || sn_synCookie )

                        {

                            // peek at descriptor

                            unsigned short descriptor = ntohs(*b);

 

                            // do some extra checks

                            if( descriptor == s_Acknowledge.ID() )

                            {

                                // this must be the cookie response triggered by the code below.

                                // allow it, but be careful to only read the first message.

                                onlyReadFirstMessage = true;

                            }

                            else if( descriptor == login_accept.ID() )

                            {

                                // Hah. Nice trick. Won't work, though.

                            }

                            else if( !sn_turtleMode && 

                                     ( descriptor == RequestSmallServerInfoDescriptor.ID() || 

                                       descriptor == RequestBigServerInfoDescriptor.ID() ) )

                            {

                                // Pings. Let them in unless we're under real attack.

                                onlyReadFirstMessage = true;

                            }

                            else if( !machine || !machine->IsValidated() )

                            {

                                if( count > sn_connectionLimit )

                                {

                                    continue;

                                }

 

                                // send fake login accept messages; the ack response whitelists the IP

                                nCookie cookie;

                                sn_SynGenerateCookie( sn_SynTimestamp(), peers[peer], cookie );

                                tJUST_CONTROLLED_PTR<nMessage> r = tNEW(nMessage)(login_accept);

                                r->BendMessageID( cookie.first );

                                r->SendImmediately(peer,false);

                                r = tNEW(nMessage)(login_accept);

                                r->BendMessageID( cookie.second );

                                r->SendImmediately(peer,false);

                                int idback = ::sn_myNetID;

                                sn_myNetID = 1; // set a fake ID so the client doesn't consider the packet as a response from the server and messes up its ack data

                                nMessage::SendCollected(peer);

                                ::sn_myNetID = idback;

 

                                // and ignore for now

                                continue;

                            }

                        }

 

                        // IP is not spoofed or there is no

                        // current spoof heavy attack. Check closer.

                        if( IndividualConnectionFloodProtection( machine, peer ) )

                        {

                            continue;

                        }

                    }

#endif

 

                    while( lenleft >= 3 ){

                                    if ( id > MAXCLIENTS && mess.Descriptor() != login_accept.ID() )

 

                        // abort if we're only supoosed to process the first message

                        if( onlyReadFirstMessage )

                        {

                            break;

                        }

                    con << "nKillHim signal caught: ";

                con << "nKillHim signal caught: ";

                // sn_Connections[MAXCLIENTS+1].socket = NULL;

                    sn_Connections[MAXCLIENTS+1].socket = NULL;

    tString reasonString( reason );

 

        // store IP:port for later

        lastPeers[i] = peers[i];

 

                *mess << reasonString;

        con << tOutput( "$network_killuser", i, sn_Connections[i].ping.GetPing(), peers[i].ToString(), reasonString );

// *******************************************************************************************

// *

// *    GetWeight

// *

// *******************************************************************************************

//!

//!             @return         the current total weight

//!

// *******************************************************************************************

 

REAL nAverager::GetWeight( void ) const

{

    return weight_;

}

 

    if( snail_.GetWeight() > 100 )

        snail_.Timestep( decay * .02 );

    if( slow_.GetWeight() > 30 )

        slow_.Timestep ( decay * .2 );

    if( fast_.GetWeight() > 10 )

        fast_.Timestep ( decay * 2 );

        , validated_(false)

typedef sockaddr nMachineKey;

 

bool operator < ( nMachineKey const & a, nMachineKey const & b )

{

    return reinterpret_cast< sockaddr_in const & >( a ).sin_addr.s_addr < reinterpret_cast< sockaddr_in const & >( b ).sin_addr.s_addr;

}

 

typedef std::map< nMachineKey, nMachinePTR > nMachineMap;

static nMachine & sn_LookupMachine( nMachineKey const * address )

{

    // get map of all machines and look address up

    nMachineMap & map = sn_GetMachineMap();

    nMachine & ret = *map[ *address ].machine;

    if( ret.GetIP().Len() <= 2 )

    {

        nAddress addr;

        sockaddr * target = addr;

        *target = *address;

        ret.SetIP( addr.GetAddress() );

    }

    return ret;

}

 

static nMachine * sn_PeekMachine( nMachineKey const * address )

{

    // get map of all machines and look address up

    nMachineMap & map = sn_GetMachineMap();

    nMachineMap::const_iterator i = map.find( *address );

    if( i != map.end() )

    {

        return (*i).second.machine;

    }

    else

    {

        return NULL;

    }

}

 

    nAddress addr;

    addr.SetAddress( address );

    return sn_LookupMachine( addr );

 

    // delegate

    return sn_LookupMachine( peers[userID] );

}

 

// *******************************************************************************

// *

// *    PeekMachine

// *

// *******************************************************************************

//!

//!             @param  userID  the user ID to fetch the machine for

//!             @return             the machine the user ID belongs to

//!

// *******************************************************************************

 

nMachine * nMachine::PeekMachine( unsigned short userID )

{

    // hardcoding: the server itself

    if ( userID == 0 && sn_GetNetState() != nCLIENT )

    {

        return &GetMachine( userID );

    }

 

    tASSERT( userID <= MAXCLIENTS+1 );

 

    if( sn_GetNetState() != nSERVER )

    {

        // invalid ID, return invalid machine (clients don't track machines)

        return &GetMachine( userID );

    }

 

    // get address

    tVERIFY( userID <= MAXCLIENTS+1 );

    if( !sn_Connections[userID].socket )

    {

        // invalid ID, return invalid machine

        return &GetMachine( userID );

    }

 

    // delegate

    return sn_PeekMachine( peers[userID] );

                    s << machine.GetIP() << " " << machine.IsBanned() << " " << machine.kph_ << " " << machine.GetBanReason() << "\n";