Client Strict Version Checking

Auth/AuthSocket.cpp

@@ -95,7 +95,7 @@ typedef struct AUTH_LOGON_PROOF_S
  uint8 M2[20];
  uint32 accountFlags; // see enum AccountFlags
  uint32 surveyId; // SurveyId
- uint16 unkFlags;  // some flags (AccountMsgAvailable = 0x01)
+ uint16 LoginFlags; // some flags (AccountMsgAvailable = 0x01)
 } sAuthLogonProof_S;
 
 typedef struct AUTH_LOGON_PROOF_S_BUILD_6005
@@ -140,6 +140,7 @@ typedef struct AuthHandler
 #pragma pack(pop)
 #endif
 
+std::array<uint8, 16> VersionChallenge = { { 0xBA, 0xA3, 0x1E, 0x99, 0xA0, 0x0B, 0x21, 0x57, 0xFC, 0x37, 0x3F, 0xB3, 0x69, 0xCD, 0xD2, 0xF1 } };
 
 /// Constructor - set the N and g values for SRP6
 AuthSocket::AuthSocket() : _status(STATUS_CHALLENGE), _accountSecurityLevel(SEC_PLAYER), _build(0), patch_(ACE_INVALID_HANDLE)
@@ -289,7 +290,7 @@ void AuthSocket::SendProof(Sha1Hash sha)
  proof.error = 0;
  proof.accountFlags = ACCOUNT_FLAG_PROPASS;
  proof.surveyId = 0x00000000;
- proof.unkFlags = 0x0000;
+ proof.LoginFlags = 0x0000;
 
  send((char*)&proof, sizeof(proof));
  break;
@@ -467,9 +468,6 @@ bool AuthSocket::_HandleLogonChallenge()
 
  MANGOS_ASSERT(gmod.GetNumBytes() <= 32);
 
- BigNumber unk3;
- unk3.SetRand(16 * 8);
-
  ///- Fill the response packet with the result
  pkt << uint8(WOW_SUCCESS);
 
@@ -480,7 +478,7 @@ bool AuthSocket::_HandleLogonChallenge()
  pkt << uint8(32);
  pkt.append(N.AsByteArray(32), 32);
  pkt.append(s.AsByteArray(), s.GetNumBytes());// 32 bytes
- pkt.append(unk3.AsByteArray(16), 16);
+ pkt.append(VersionChallenge.data(), VersionChallenge.size());
  uint8 securityFlags = 0;
  pkt << uint8(securityFlags); // security flags (0x0...0x04)
 
@@ -689,6 +687,14 @@ bool AuthSocket::_HandleLogonProof()
  ///- Check if SRP6 results match (password is correct), else send an error
  if (!memcmp(M.AsByteArray(), lp.M1, 20))
  {
+ if (!VerifyVersion(lp.A, sizeof(lp.A), lp.crc_hash, false))
+ {
+ char data[2] = { CMD_AUTH_LOGON_PROOF, WOW_FAIL_VERSION_INVALID };
+ send(data, sizeof(data));
+
+ return true;
+ }
+
  BASIC_LOG("User '%s' successfully authenticated", _login.c_str());
 
  ///- Update the sessionkey, last_ip, last login time and reset number of failed logins in the account table for this account
@@ -837,8 +843,8 @@ bool AuthSocket::_HandleReconnectChallenge()
  pkt << (uint8) CMD_AUTH_RECONNECT_CHALLENGE;
  pkt << (uint8) 0x00;
  _reconnectProof.SetRand(16 * 8);
- pkt.append(_reconnectProof.AsByteArray(16), 16); // 16 bytes random
- pkt << (uint64) 0x00 << (uint64) 0x00;  // 16 bytes zeros
+ pkt.append(_reconnectProof.AsByteArray(16), 16);  // 16 bytes random
+ pkt.append(VersionChallenge.data(), VersionChallenge.size()); // 16 bytes zeros
  send((char const*)pkt.contents(), pkt.size());
  return true;
 }
@@ -872,6 +878,15 @@ bool AuthSocket::_HandleReconnectProof()
 
  if (!memcmp(sha.GetDigest(), lp.R2, SHA_DIGEST_LENGTH))
  {
+ if (!VerifyVersion(lp.R1, sizeof(lp.R1), lp.R3, true))
+ {
+ ByteBuffer pkt;
+ pkt << uint8(CMD_AUTH_RECONNECT_PROOF);
+ pkt << uint8(WOW_FAIL_VERSION_INVALID);
+ send((char const*)pkt.contents(), pkt.size());
+ return true;
+ }
+
  ///- Sending response
  ByteBuffer pkt;
  pkt << (uint8) CMD_AUTH_RECONNECT_PROOF;
@@ -1196,3 +1211,52 @@ void AuthSocket::InitPatch()
  }
 }
 
+bool AuthSocket::VerifyVersion(uint8 const* a, int32 aLength, uint8 const* versionProof, bool isReconnect)
+{
+ if (!sConfig.GetBoolDefault("StrictVersionCheck", false))
+ {
+ return true;
+ }
+
+ std::array<uint8, 20> zeros = { { } };
+ std::array<uint8, 20> const* versionHash = nullptr;
+
+ if (!isReconnect)
+ {
+ RealmBuildInfo const* buildInfo = FindBuildInfo(_build);
+ if (!buildInfo)
+ {
+ return false;
+ }
+
+ if (_os == "Win")
+ {
+ versionHash = &buildInfo->WindowsHash;
+ }
+ else if (_os == "OSX")
+ {
+ versionHash = &buildInfo->MacHash;
+ }
+
+ if (!versionHash)
+ {
+ return false;
+ }
+
+ if (!memcmp(versionHash->data(), zeros.data(), zeros.size()))
+ {
+ return true;
+ }
+ }
+ else
+ {
+ versionHash = &zeros;
+ }
+
+ Sha1Hash version;
+ version.UpdateData(a, aLength);
+ version.UpdateData(versionHash->data(), versionHash->size());
+ version.Finalize();
+
+ return memcmp(versionProof, version.GetDigest(), version.GetLength()) == 0;
+}

Auth/AuthSocket.h

@@ -154,6 +154,8 @@ class AuthSocket: public BufferedSocket
  STATUS_CLOSED
  };
 
+ bool VerifyVersion(uint8 const* a, int32 aLength, uint8 const* versionProof, bool isReconnect);
+
  BigNumber N, s, g, v; /**< TODO */
  BigNumber b, B; /**< TODO */
  BigNumber K; /**< TODO */

Realm/RealmList.cpp

@@ -44,19 +44,32 @@ extern DatabaseType LoginDatabase;
 static const RealmBuildInfo ExpectedRealmdClientBuilds[] =
 {
  // highest supported build, also auto accept all above for simplify future supported builds testing
- {40000, 9, 0, 0, ' '}, // SHADOWLANDS
- {35662, 8, 3, 7, ' '}, // BFA
- {26972, 7, 3, 5, ' '}, // Legion
- {21742, 6, 2, 4, ' '}, // WOD
- {18414, 5, 4, 8, ' '}, // MOP
- {18273, 5, 4, 8, ' '}, // MOP
- {15595, 4, 3, 4, ' '}, // CATA
- {12340, 3, 3, 5, 'a'}, // WOTLK
- {8606, 2, 4, 3, ' '}, // TBC
- {6141, 1, 12, 3, ' '}, // Vanilla - Chinese
- {6005, 1, 12, 2, ' '}, // Vanilla - Spanish
- {5875, 1, 12, 1, ' '}, // Vanilla
- {0, 0, 0, 0, ' '} // terminator
+ { 40000, 9, 0, 0, ' ', { { } }, { { } } }, // shadow lands
+ { 35662, 8, 3, 4, ' ', { { } }, { { } } }, // bfa
+ { 26972, 7, 3, 5, ' ', { { } }, { { } } }, // legion
+ { 21742, 6, 2, 4, ' ', { { } }, { { } } }, // wod
+ { 18414, 5, 4, 8, ' ', { { } }, { { } } }, // mop
+ { 18273, 5, 4, 8, ' ', { { } }, { { } } }, // mop
+ { 15595, 4, 3, 4, ' ', { { } }, { { } } }, // cataclysm
+ { 13930, 3, 3, 5, 'a', { { } }, { { } } }, // 3.3.5a china mainland build
+ { 12340, 3, 3, 5, 'a',
+ { { 0xCD, 0xCB, 0xBD, 0x51, 0x88, 0x31, 0x5E, 0x6B, 0x4D, 0x19, 0x44, 0x9D, 0x49, 0x2D, 0xBC, 0xFA, 0xF1, 0x56, 0xA3, 0x47 } },
+ { { 0xB7, 0x06, 0xD1, 0x3F, 0xF2, 0xF4, 0x01, 0x88, 0x39, 0x72, 0x94, 0x61, 0xE3, 0xF8, 0xA0, 0xE2, 0xB5, 0xFD, 0xC0, 0x34 } },
+ },
+
+ { 8606, 2, 4, 3, ' ', // burning crusade
+ { { 0x31, 0x9A, 0xFA, 0xA3, 0xF2, 0x55, 0x96, 0x82, 0xF9, 0xFF, 0x65, 0x8B, 0xE0, 0x14, 0x56, 0x25, 0x5F, 0x45, 0x6F, 0xB1 } },
+ { { } },
+ },
+
+ { 6141, 1, 12, 3, ' ', { { } }, { { } } }, // vanilla - chinese
+ { 6005, 1, 12, 2, ' ', { { } }, { { } } }, // vanilla - spanish
+ { 5875, 1, 12, 1, ' ', // vanilla
+ { { } },
+ { { 0x8D, 0x17, 0x3C, 0xC3, 0x81, 0x96, 0x1E, 0xEB, 0xAB, 0xF3, 0x36, 0xF5, 0xE6, 0x67, 0x5B, 0x10, 0x1B, 0xB5, 0x13, 0xE5 } },
+ },
+
+ { 0, 0, 0, 0, ' ', { { } }, { { } } } // terminator
 };
 
 RealmBuildInfo const* FindBuildInfo(uint16 _build)

Realm/RealmList.h

@@ -34,6 +34,8 @@
 #include <ace/INET_Addr.h>
 #include "Common.h"
 
+#include <array>
+
 /**
  * @brief
  *
@@ -45,6 +47,9 @@ struct RealmBuildInfo
  int minor_version; /**< TODO */
  int bugfix_version; /**< TODO */
  int hotfix_version; /**< TODO */
+
+ std::array<uint8, 20> WindowsHash;
+ std::array<uint8, 20> MacHash;
 };
 
 enum RealmVersion

realmd.conf.dist.in

@@ -106,6 +106,11 @@ ConfVersion=@MANGOS_REALM_VER@
 # Default: 0 (Ban IP)
 # 1 (Ban Account)
 #
+# StrictVersionCheck
+# Description: Prevent modified clients from connnecting
+# Default: 0 - (Disabled)
+# 1 - (Enabled)
+#
 ################################################################################
 LoginDatabaseInfo = "127.0.0.1;3306;root;mangos;realmd"
 LogsDir = ""
@@ -130,3 +135,5 @@ RealmsStateUpdateDelay = 20
 WrongPass.MaxCount = 3
 WrongPass.BanTime = 300
 WrongPass.BanType = 0
+
+StrictVersionCheck = 0