Ticket #204 (assigned defect)

Opened 3 years ago

Last modified 16 months ago

TWD IP/MID Check

Reported by: RiiStar Owned by: dugwyler
Priority: highest Component: Bots - TWD/TWL
Version: Latest version from repository Severity: critical
Keywords: Cc:

Description

Most Notably when players are !sub'd into matches...

7:Mr. 420> sup?
7:RiiStar> http://forums.trenchwars.org/showthread.php?t=32248
7:RiiStar> can u elaborate on what witness said?
7:Mr. 420> it's hard to explain
7:RiiStar> do u think u could explain it to me/mav/dug ? so we can try fix it?
7:Mr. 420> ok when i started playing again, on my laptop
7:Mr. 420> i was reg'd under last computer/isp
7:Mr. 420> i could play on laptop and dif isp with no problem
7:Mr. 420> and register a dif name
7:RiiStar> so as long as the name is recorded/registered with twdbot and ur using that name on another ip/mid its fine
7:Mr. 420> i re-reg'd on my laptop since i found that out tho
7:Mr. 420> yeah
7:Mr. 420> seems that way
7:Mr. 420> cuz i could also dd from work
7:Mr. 420> dif mid, dif isp
7:RiiStar> so the restiction is only really if ur trying to register ur name?
7:Mr. 420> you can see which ip is my work on listipmid
7:RiiStar> matchbots dont check that the ip/mid are the same :/
7:Mr. 420> but mid comes up as laptop
7:RiiStar> seems ikrit did a half arse job then
7:Mr. 420> possibly
7:Mr. 420> and also
7:Mr. 420> err
7:Mr. 420> ya, as long as the name is registered, it seems any mid/ip can play on it
7:Mr. 420> so like, i could reg at work.. obviously, but i could also play on mr. 420

Attachments

Change History

Changed 3 years ago by Maverick

  • summary changed from IP/MID Defect not working when checking users to be added/subbed into twd matches to IP/MID check not working when checking users to be added/subbed into twd matches

Whoever is going to fix this: Please also check Matchbot's complete IP/MID checking and which tables it uses. Note that strictipmid property is set to 0 in the rules.

We will do the same for the TWDBot so we get a complete view of all the used tables in the database. The ultimate goal is to get TWD seperated completely from the alias user database so it's possible to put all TWD related tables in a seperate database.

Changed 3 years ago by dugwyler

It says most notably with subbing -- does this mean it occurs most often with subbing? Are there instances in which add actually does the ip/mid check, whereas sub doesn't do it at all, that kind of thing?

Also, what is the strictipmid property supposed to do? I can check this against what it's actually doing. From what I remember if you disable this it does basically disable all checks except registration; this may be the problem. Will follow up later.

Changed 3 years ago by RiiStar

Most cases we know of it happens with !sub
For the most part !add seems to stop ppl playing from locations not registered...

But we need both 100% preferably.

Changed 3 years ago by dugwyler

  • owner set to dugwyler
  • status changed from new to assigned

From what I could tell the IP/MID check wasn't being done at all in MatchTeam; unsure how it was stopping anyone, to be honest. I changed the code so that it now does the check with every add and sub. The strictmidip flag will now function as a switch between AND and OR for the MID/IP combo. If set to 1, MID and IP must match a registered record; if set to 0, just one or the other must match.

However, considering that IPs change quite a bit, while MID usually remains the same, when strictmidip is set to 0 I could just have it ensure that the MID matches and ignore IP altogether. This makes more sense as it's harder to spoof the MID than IP, and presently if someone just spoofed their IP they could easily play on a name reg'd with that IP, regardless of their MID.

Changed 3 years ago by dugwyler

See ticket #187. Mav disabled all checking intentionally. I'll re-submit code so that it doesn't re-introduce the problem of 187.

Changed 2 years ago by milosh

  • component changed from Bots - Other to Bots - TWD/TWL

Changed 2 years ago by milosh

  • summary changed from IP/MID check not working when checking users to be added/subbed into twd matches to TWD IP/MID Check

Shortened name for a more uniform look in reports.

Changed 2 years ago by dugwyler

Been a while since I worked on this one: anyone know the present status? Is it working now?

Changed 2 years ago by RiiStar

TBH i think we'd need to start from the ground up
The system has too many flaws that can't be solved easily...

Latest issue we've had is someone else registering a name for a user then
passing that username to the other person, who can then play freely
even tho reg'd details on twdbot/db are completely different...

Changed 2 years ago by RiiStar

Shit, forgot to add that i know that option is alot of work.
Much ups to you coders and all the workload you have :(

Changed 2 years ago by dugwyler

Pretty sure that functionality is coded in, but it's presently disabled due either to issues or ... well, not sure what. Mav might be able to say.

Add/Change #204 (TWD IP/MID Check)

Author


E-mail address and user name can be saved in the Preferences.


Action
as assigned
 
Note: See TracTickets for help on using tickets.