revert changes to the conection server until i can figure out why it doesn't work when structured this way; if you're using session authentication/validation, you probably will have to modify this for your own purposes anyway

engine/server/application/ConnectionServer/src/shared/ClientConnection.cpp

@@ -279,8 +279,6 @@ void ClientConnection::handleClientIdMessage(const ClientIdMsg &msg) {
     bool result = false;
     m_gameBitsToClear = msg.getGameBitsToClear();
 
-    char sessionId[apiSessionIdWidth];
-
     if (msg.getTokenSize() > 0) {
         Archive::ByteStream t(msg.getToken(), msg.getTokenSize());
         Archive::ReadIterator ri(t);
@@ -294,128 +292,106 @@ void ClientConnection::handleClientIdMessage(const ClientIdMsg &msg) {
             result = ConnectionServer::decryptToken(token, sessionId, m_requestedSuid);
         }
 
-        static const std::string loginTrace("TRACE_LOGIN");
-        LOG(loginTrace, ("ClientConnection SUID = %d", m_suid));
-    }
+        static const std::string sessURL(ConfigConnectionServer::getSessionURL());
 
-    static const std::string sessURL(ConfigConnectionServer::getSessionURL());
+        if (result || strlen(sessionId) != 0) {
+            if (ConfigConnectionServer::getValidateStationKey()) {
+                bool cont = false;
+                StationId apiSuid = 0;
 
-    if (result || strlen(sessionId) != 0) {
-        if (sessURL != "") {  // use SB auth methods
-            bool cont = false;
-            StationId apiSuid = 0;
+                FATAL(sessURL.empty(), ("Session URL is empty in connection server."));
 
-            FATAL(sessURL.empty(), ("Session URL is empty in connection server."));
+                const std::string clientIP(getRemoteAddress());
+                const std::string sess(sessionId);
 
-            const std::string clientIP(getRemoteAddress());
-            const std::string sess(sessionId);
+                FATAL(clientIP.empty(), ("Remote IP is empty"));
 
-            FATAL(clientIP.empty(), ("Remote IP is empty"));
+                DEBUG_WARNING(true, ("ConnectionServer::handleClientIdMessage - For ip %s suid is %lu requestedSUID is %lu and session is %s", clientIP.c_str(), m_suid, m_requestedSuid, sess.c_str()));
 
-            DEBUG_WARNING(true,
-                          ("ConnectionServer::handleClientIdMessage - For ip %s suid is %lu requestedSUID is %lu and session is %s", clientIP.c_str(), m_suid, m_requestedSuid, sess.c_str()));
+                webAPI api(sessURL);
 
-            webAPI api(sessURL);
+                // add our data
+                api.addJsonData<std::string>("session_key", sess);
 
-            // add our data
-            api.addJsonData<std::string>("session_key", sess);
+                if (api.submit()) {
+                    bool status = api.getNullableValue<bool>("status");
 
-            // TODO: if anyone is interested in using session authentication, without using
-            // SB's way of doing it, we could add a config flag for useSimple here for a simple post
-            // and simple string return ~Darth
-            if (api.submit()) {
-                bool status = api.getNullableValue<bool>("status");
+                    if (status) {
+                        std::string apiUser = api.getString("user_name");
+                        std::string apiIP = api.getString("ip");
+                        int expired = api.getNullableValue<int>("expired");
 
-                if (status) {
-                    std::string apiUser = api.getString("user_name");
-                    std::string apiIP = api.getString("ip");
-                    int expired = api.getNullableValue<int>("expired");
-
-                    if (!ConfigConnectionServer::getUseOldSuidGenerator()) {
-                        apiSuid = api.getNullableValue<int>("user_id");
-                    } else {
-                        if (apiUser.length() > MAX_ACCOUNT_NAME_LENGTH) {
-                            apiUser.resize(MAX_ACCOUNT_NAME_LENGTH);
+                        if (!ConfigConnectionServer::getUseOldSuidGenerator()) {
+                            apiSuid = api.getNullableValue<int>("user_id");
+                        } else {
+                            if (apiUser.length() > MAX_ACCOUNT_NAME_LENGTH) {
+                                apiUser.resize(MAX_ACCOUNT_NAME_LENGTH);
+                            }
+                            apiSuid = std::hash < std::string > {}(apiUser.c_str());
                         }
 
-                        apiSuid = std::hash < std::string > {}(apiUser.c_str());
+                        if (apiIP == clientIP && expired == 0) {
+                            m_suid = apiSuid;
+                            cont = true;
+                        }
                     }
+                }
 
-                    if (apiIP == clientIP && expired == 0) {
-                        m_suid = apiSuid;
-                        cont = true;
-                    }
+                if (!cont) {
+                    LOG("ClientDisconnect", ("SUID %d (%d) passed a bad token to the connections erver. Disconnecting.", m_suid, apiSuid));
+                    disconnect();
+                    return;
                 }
             }
 
-            if (!cont) {
-                LOG("ClientDisconnect",
-                    ("SUID %d (%d) passed a bad token to the connections erver. Disconnecting.", m_suid, apiSuid));
+            static const std::string loginTrace("TRACE_LOGIN");
+            LOG(loginTrace, ("ClientConnection SUID = %d", m_suid));
+
+            //check for duplicate login
+            ClientConnection *oldConnection = ConnectionServer::getClientConnection(m_suid);
+            if (oldConnection) {
+                //There is already someone connected to this cluster with this suid.
+                LOG("Network", ("SUID %d already logged in, disconnecting client.\n", m_suid));
+
+                ConnectionServer::dropClient(oldConnection, "Already Connected");
+
                 disconnect();
                 return;
             }
-        } else {
-            // should be used for test mode only, SOE's shitty stationID generation is dangerous and spoofable
-            // meaning people can impersonate elevated users
+
+            // verify version
+            if (ConfigConnectionServer::getValidateClientVersion() &&
+                msg.getVersion() != GameNetworkMessage::NetworkVersionId) {
+                std::string strSessionId(sessionId, apiSessionIdWidth);
+                strSessionId += '\0';
+
+                const int bufferSize = 255 + apiSessionIdWidth;
+                char *buffer = new char[bufferSize];
+                snprintf(buffer, bufferSize -
+                                 1, "network version mismatch: got (ip=[%s], sessionId=[%s], version=[%s]), required (version=[%s])", getRemoteAddress().c_str(), strSessionId.c_str(), msg.getVersion().c_str(), GameNetworkMessage::NetworkVersionId.c_str());
+                buffer[bufferSize - 1] = '\0';
+
+                ConnectionServer::dropClient(this, std::string(buffer));
+                disconnect();
+
+                delete[] buffer;
+
+                return;
+            }
+
+            // test mode only
             if (!m_suid && !ConfigConnectionServer::getValidateStationKey()) {
                 WARNING(true, ("Generating suid from username. This is not safe or secure."));
 
-                std::string account = m_accountName;
+                m_suid = atoi(m_accountName.c_str());
 
-                if (account.length() > 15) {
-                    account.resize(15);
-                }
-
-                m_suid = std::hash < std::string > {}(account.c_str());
-            } else {
-
-                SessionApiClient *session = ConnectionServer::getSessionApiClient();
-                NOT_NULL(session);
-                if (session) {
-                    session->validateClient(this, sessionId);
-                } else {
-                    ConnectionServer::dropClient(this, "SessionApiClient is not available!");
-                    disconnect();
+                if (m_suid == 0) {
+                    m_suid = std::hash < std::string > {}(m_accountName.c_str());
                 }
             }
+
+            onValidateClient(m_suid, m_accountName, m_isSecure, nullptr, ConfigConnectionServer::getDefaultGameFeatures(), ConfigConnectionServer::getDefaultSubscriptionFeatures(), 0, 0, 0, 0, ConfigConnectionServer::getFakeBuddyPoints());
         }
-
-        static const std::string loginTrace("TRACE_LOGIN");
-        LOG(loginTrace, ("ClientConnection SUID = %d", m_suid));
-
-        //check for duplicate login
-        ClientConnection *oldConnection = ConnectionServer::getClientConnection(m_suid);
-        if (oldConnection) {
-            //There is already someone connected to this cluster with this suid.
-            LOG("Network", ("SUID %d already logged in, disconnecting client.\n", m_suid));
-
-            ConnectionServer::dropClient(oldConnection, "Already Connected");
-
-            disconnect();
-            return;
-        }
-
-        // verify version
-        if (ConfigConnectionServer::getValidateClientVersion() &&
-            msg.getVersion() != GameNetworkMessage::NetworkVersionId) {
-            std::string strSessionId(sessionId, apiSessionIdWidth);
-            strSessionId += '\0';
-
-            const int bufferSize = 255 + apiSessionIdWidth;
-            char *buffer = new char[bufferSize];
-            snprintf(buffer, bufferSize -
-                             1, "network version mismatch: got (ip=[%s], sessionId=[%s], version=[%s]), required (version=[%s])", getRemoteAddress().c_str(), strSessionId.c_str(), msg.getVersion().c_str(), GameNetworkMessage::NetworkVersionId.c_str());
-            buffer[bufferSize - 1] = '\0';
-
-            ConnectionServer::dropClient(this, std::string(buffer));
-            disconnect();
-
-            delete[] buffer;
-
-            return;
-        }
-
-        onValidateClient(m_suid, m_accountName, m_isSecure, nullptr, ConfigConnectionServer::getDefaultGameFeatures(), ConfigConnectionServer::getDefaultSubscriptionFeatures(), 0, 0, 0, 0, ConfigConnectionServer::getFakeBuddyPoints());
     } else {
         WARNING(true, ("SUID %d passed a bad token to the connections server (cache issue or hacker?). Disconnecting.", m_suid));
 

engine/server/application/ConnectionServer/src/shared/ClientConnection.h

@@ -13,7 +13,6 @@
 #include "sharedFoundation/StationId.h"
 #include "sharedMath/Vector.h"
 #include <map>
-#include <algorithm>
 
 class ClientIdMsg;
 class SelectCharacter;