Merge branch 'master' of https://github.com/Regalis11/Barotrauma into develop

.github/DISCUSSION_TEMPLATE/bug-reports.yml

@@ -73,7 +73,7 @@ body:
       label: Version
       description: Which version of the game did the bug happen in? You can see the current version number in the bottom left corner of your screen in the main menu.
       options:      
-        - v1.3.0.2
+        - v1.3.0.3
         - v1.4.0.0 (unstable)
         - Other
     validations:

Barotrauma/BarotraumaClient/ClientSource/DebugConsole.cs

@@ -785,6 +785,7 @@ namespace Barotrauma
             AssignRelayToServer("simulatedduplicateschance", false);
             AssignRelayToServer("simulatedlongloadingtime", false);
             AssignRelayToServer("storeinfo", false);
+            AssignRelayToServer("sendrawpacket", false);
 #endif
 
             commands.Add(new Command("clientlist", "", (string[] args) => { }));
@@ -3273,6 +3274,36 @@ namespace Barotrauma
                     LocationType.Prefabs.Select(lt => lt.Identifier.Value).ToArray()
                 };
             }));
+
+            commands.Add(new Command("sendrawpacket", "sendrawpacket [data]: Send a string of hex values as raw binary data to the server", (string[] args) =>
+            {
+                if (GameMain.NetworkMember is null)
+                {
+                    ThrowError("Not connected to a server");
+                    return;
+                }
+                
+                if (args.Length == 0)
+                {
+                    ThrowError("No data provided");
+                    return;
+                }
+
+                string dataString = string.Join(" ", args);
+
+                try
+                {
+                    byte[] bytes = ToolBox.HexStringToBytes(dataString);
+                    IWriteMessage msg = new WriteOnlyMessage();
+                    foreach (byte b in bytes) { msg.WriteByte(b); }
+                    GameMain.Client?.ClientPeer?.DebugSendRawMessage(msg);
+                    NewMessage($"Sent {bytes.Length} byte(s)", Color.Green);
+                }
+                catch (Exception e)
+                {
+                    ThrowError("Failed to parse the data", e);
+                }
+            }));
 #endif
 
             commands.Add(new Command("limbscale", "Define the limbscale for the controlled character. Provide id or name if you want to target another character. Note: the changes are not saved!", (string[] args) =>

Barotrauma/BarotraumaClient/ClientSource/Networking/Primitives/Peers/ClientPeer.cs

@@ -231,6 +231,8 @@ namespace Barotrauma.Networking
 
 #if DEBUG
         public abstract void ForceTimeOut();
+
+        public abstract void DebugSendRawMessage(IWriteMessage msg);
 #endif
     }
 }

Barotrauma/BarotraumaClient/ClientSource/Networking/Primitives/Peers/LidgrenClientPeer.cs

@@ -287,6 +287,9 @@ namespace Barotrauma.Networking
         {
             netClient?.ServerConnection?.ForceTimeOut();
         }
+
+        public override void DebugSendRawMessage(IWriteMessage msg)
+            => ForwardToLidgren(msg, DeliveryMethod.Reliable);
 #endif
     }
 }

Barotrauma/BarotraumaClient/ClientSource/Networking/Primitives/Peers/P2PClientPeer.cs

@@ -423,6 +423,9 @@ namespace Barotrauma.Networking
         {
             timeout = 0.0f;
         }
+        
+        public override void DebugSendRawMessage(IWriteMessage msg)
+            => ForwardToRemotePeer(msg, DeliveryMethod.Reliable);
 #endif
     }
 }

Barotrauma/BarotraumaClient/ClientSource/Networking/Primitives/Peers/P2POwnerPeer.cs

@@ -142,8 +142,12 @@ namespace Barotrauma.Networking
             if (remotePeer is null) { return; }
             if (remotePeer.PendingDisconnect.IsSome()) { return; }
 
-            var peerPacketHeaders = INetSerializableStruct.Read<PeerPacketHeaders>(inc);
+            if (!INetSerializableStruct.TryRead(inc, remotePeer.AccountInfo, out PeerPacketHeaders peerPacketHeaders))
-            
+            {
+                CommunicateDisconnectToRemotePeer(remotePeer, PeerDisconnectPacket.WithReason(DisconnectReason.MalformedData));
+                return;
+            }
+
             PacketHeader packetHeader = peerPacketHeaders.PacketHeader;
 
             if (packetHeader.IsConnectionInitializationStep())
@@ -178,13 +182,11 @@ namespace Barotrauma.Networking
         {
             remotePeer.AuthStatus = RemotePeer.AuthenticationStatus.AuthenticationPending;
 
-            var packet = INetSerializableStruct.Read<ClientAuthTicketAndVersionPacket>(inc);
+            if (!INetSerializableStruct.TryRead(inc, remotePeer.AccountInfo, out ClientAuthTicketAndVersionPacket packet))
-
-            void failAuth()
             {
-                CommunicateDisconnectToRemotePeer(remotePeer, PeerDisconnectPacket.WithReason(DisconnectReason.AuthenticationFailed));
+                failAuth();
+                return;
             }
-
             if (!packet.AuthTicket.TryUnwrap(out var authenticationTicket))
             {
                 failAuth();
@@ -221,6 +223,11 @@ namespace Barotrauma.Networking
                     }
                     remotePeer.UnauthedMessages.Clear();
                 });
+
+            void failAuth()
+            {
+                CommunicateDisconnectToRemotePeer(remotePeer, PeerDisconnectPacket.WithReason(DisconnectReason.AuthenticationFailed));
+            }
         }
 
         public override void Update(float deltaTime)
@@ -381,7 +388,7 @@ namespace Barotrauma.Networking
             {
                 OnInitializationComplete();
 
-                PeerPacketMessage packet = INetSerializableStruct.Read<PeerPacketMessage>(inc);
+                var packet = INetSerializableStruct.Read<PeerPacketMessage>(inc);
                 IReadMessage msg = new ReadOnlyMessage(packet.Buffer, packetHeader.IsCompressed(), 0, packet.Length, ServerConnection);
                 callbacks.OnMessageReceived.Invoke(msg);
             }
@@ -552,6 +559,9 @@ namespace Barotrauma.Networking
         {
             //TODO: reimplement?
         }
+
+        public override void DebugSendRawMessage(IWriteMessage msg)
+            => ForwardToServerProcess(msg);
 #endif
     }
 }

Barotrauma/BarotraumaClient/ClientSource/Utils/ToolBox.cs

@@ -520,5 +520,32 @@ namespace Barotrauma
 
             static string ColorString(string text, Color color) => $"‖color:{color.ToStringHex()}‖{text}‖end‖";
         }
+
+        /// <summary>
+        /// Converts a string of hex values to a byte array.
+        /// </summary>
+        /// <example>
+        /// 04 03 4b 50 -> { 4, 3, 75, 80 }
+        /// </example>
+        /// <param name="raw"></param>
+        /// <returns></returns>
+        public static byte[] HexStringToBytes(string raw)
+        {
+            string value = string.Join(string.Empty, raw.Split(" "));
+            List<byte> bytes = new List<byte>();
+            for (int i = 0; i < value.Length; i += 2)
+            {
+                string hex = value.Substring(i, 2);
+                byte b = Convert.ToByte(hex, 16);
+                bytes.Add(b);
+
+                static bool IsHexChar(char c) => c is 
+                    >= '0' and <= '9' or
+                    >= 'A' and <= 'F' or
+                    >= 'a' and <= 'f';
+            }
+
+            return bytes.ToArray();
+        }
     }
 }

Barotrauma/BarotraumaClient/LinuxClient.csproj

@@ -6,7 +6,7 @@
     <RootNamespace>Barotrauma</RootNamespace>
     <Authors>FakeFish, Undertow Games</Authors>
     <Product>Barotrauma</Product>
-    <Version>1.3.0.1</Version>
+    <Version>1.3.0.3</Version>
     <Copyright>Copyright © FakeFish 2018-2023</Copyright>
     <Platforms>AnyCPU;x64</Platforms>
     <AssemblyName>Barotrauma</AssemblyName>

Barotrauma/BarotraumaClient/MacClient.csproj

@@ -6,7 +6,7 @@
     <RootNamespace>Barotrauma</RootNamespace>
     <Authors>FakeFish, Undertow Games</Authors>
     <Product>Barotrauma</Product>
-    <Version>1.3.0.1</Version>
+    <Version>1.3.0.3</Version>
     <Copyright>Copyright © FakeFish 2018-2023</Copyright>
     <Platforms>AnyCPU;x64</Platforms>
     <AssemblyName>Barotrauma</AssemblyName>

Barotrauma/BarotraumaClient/WindowsClient.csproj

@@ -6,7 +6,7 @@
     <RootNamespace>Barotrauma</RootNamespace>
     <Authors>FakeFish, Undertow Games</Authors>
     <Product>Barotrauma</Product>
-    <Version>1.3.0.1</Version>
+    <Version>1.3.0.3</Version>
     <Copyright>Copyright © FakeFish 2018-2023</Copyright>
     <Platforms>AnyCPU;x64</Platforms>
     <AssemblyName>Barotrauma</AssemblyName>

Barotrauma/BarotraumaServer/LinuxServer.csproj

@@ -6,7 +6,7 @@
     <RootNamespace>Barotrauma</RootNamespace>
     <Authors>FakeFish, Undertow Games</Authors>
     <Product>Barotrauma Dedicated Server</Product>
-    <Version>1.3.0.1</Version>
+    <Version>1.3.0.3</Version>
     <Copyright>Copyright © FakeFish 2018-2023</Copyright>
     <Platforms>AnyCPU;x64</Platforms>
     <AssemblyName>DedicatedServer</AssemblyName>

Barotrauma/BarotraumaServer/MacServer.csproj

@@ -6,7 +6,7 @@
     <RootNamespace>Barotrauma</RootNamespace>
     <Authors>FakeFish, Undertow Games</Authors>
     <Product>Barotrauma Dedicated Server</Product>
-    <Version>1.3.0.1</Version>
+    <Version>1.3.0.3</Version>
     <Copyright>Copyright © FakeFish 2018-2023</Copyright>
     <Platforms>AnyCPU;x64</Platforms>
     <AssemblyName>DedicatedServer</AssemblyName>

Barotrauma/BarotraumaServer/ServerSource/Networking/Primitives/Peers/Server/LidgrenServerPeer.cs

@@ -236,7 +236,7 @@ namespace Barotrauma.Networking
             }
             else if (!packetHeader.IsConnectionInitializationStep())
             {
-                if (connectedClients.Find(c => c.Connection.NetConnection == lidgrenMsg.SenderConnection) is not { Connection: LidgrenConnection conn })
+                if (FindConnection(lidgrenMsg.SenderConnection) is not { } conn)
                 {
                     if (pendingClient != null)
                     {
@@ -264,6 +264,15 @@ namespace Barotrauma.Networking
                 var packet = INetSerializableStruct.Read<PeerPacketMessage>(inc);
                 callbacks.OnMessageReceived.Invoke(conn, packet.GetReadMessage(packetHeader.IsCompressed(), conn));
             }
+
+            LidgrenConnection? FindConnection(NetConnection ligdrenConn)
+            {
+                if (connectedClients.Find(c => c.Connection.NetConnection == ligdrenConn) is { Connection: LidgrenConnection conn })
+                {
+                    return conn;
+                }
+                return null;
+            }
         }
 
         private void HandleStatusChanged(NetIncomingMessage inc)

Barotrauma/BarotraumaServer/ServerSource/Networking/Primitives/Peers/Server/P2PServerPeer.cs

@@ -105,11 +105,7 @@ namespace Barotrauma.Networking
             if (!started) { return; }
 
             var senderInfo = INetSerializableStruct.Read<P2POwnerToServerHeader>(inc);
-            if (!senderInfo.Endpoint.TryUnwrap(out var senderEndpoint))
+            if (!senderInfo.Endpoint.TryUnwrap(out var senderEndpoint)) { return; }
-            {
-                return;
-            }
-
             var (_, packetHeader, initialization) = INetSerializableStruct.Read<PeerPacketHeaders>(inc);
 
             if (packetHeader.IsServerMessage())
@@ -179,7 +175,8 @@ namespace Barotrauma.Networking
                 {
                     if (packetHeader.IsDataFragment())
                     {
-                        var completeMessageOption = connectedClient.Defragmenter.ProcessIncomingFragment(INetSerializableStruct.Read<MessageFragment>(inc));
+                        var fragment = INetSerializableStruct.Read<MessageFragment>(inc);
+                        var completeMessageOption = connectedClient.Defragmenter.ProcessIncomingFragment(fragment);
                         if (!completeMessageOption.TryUnwrap(out var completeMessage)) { return; }
 
                         IReadMessage msg = new ReadOnlyMessage(completeMessage.ToArray(), false, 0, completeMessage.Length, connectedClient.Connection);

Barotrauma/BarotraumaServer/ServerSource/Networking/Primitives/Peers/Server/ServerPeer.cs

@@ -97,7 +97,11 @@ namespace Barotrauma.Networking
             switch (initializationStep)
             {
                 case ConnectionInitialization.AuthInfoAndVersion:
-                    var authPacket = INetSerializableStruct.Read<ClientAuthTicketAndVersionPacket>(inc);
+                    if (!INetSerializableStruct.TryRead(inc, pendingClient.AccountInfo, out ClientAuthTicketAndVersionPacket authPacket))
+                    {
+                        RemovePendingClient(pendingClient, PeerDisconnectPacket.WithReason(DisconnectReason.MalformedData));
+                        return;
+                    }
 
                     if (!Client.IsValidName(authPacket.Name, serverSettings))
                     {
@@ -134,7 +138,11 @@ namespace Barotrauma.Networking
 
                     break;
                 case ConnectionInitialization.Password:
-                    var passwordPacket = INetSerializableStruct.Read<ClientPeerPasswordPacket>(inc);
+                    if (!INetSerializableStruct.TryRead(inc, pendingClient.AccountInfo, out ClientPeerPasswordPacket passwordPacket))
+                    {
+                        RemovePendingClient(pendingClient, PeerDisconnectPacket.WithReason(DisconnectReason.MalformedData));
+                        return;
+                    }
 
                     if (pendingClient.PasswordSalt is null)
                     {
@@ -340,5 +348,20 @@ namespace Barotrauma.Networking
 
         public abstract void Send(IWriteMessage msg, NetworkConnection conn, DeliveryMethod deliveryMethod, bool compressPastThreshold = true);
         public abstract void Disconnect(NetworkConnection conn, PeerDisconnectPacket peerDisconnectPacket);
+
+        private void LogMalformedMessage(NetworkConnection conn)
+        {
+            foreach (Client c in GameMain.Server.ConnectedClients)
+            {
+                if (c.Connection == conn)
+                {
+                    DebugConsole.ThrowError($"Received malformed message from {c.Name}.");
+                    return;
+                }
+            }
+            DebugConsole.ThrowError("Received malformed message from remote peer.");
+        }
+        protected static void LogMalformedMessage()
+            => DebugConsole.ThrowError("Received malformed message from remote peer.");
     }
 }

Barotrauma/BarotraumaServer/WindowsServer.csproj

@@ -6,7 +6,7 @@
     <RootNamespace>Barotrauma</RootNamespace>
     <Authors>FakeFish, Undertow Games</Authors>
     <Product>Barotrauma Dedicated Server</Product>
-    <Version>1.3.0.1</Version>
+    <Version>1.3.0.3</Version>
     <Copyright>Copyright © FakeFish 2018-2023</Copyright>
     <Platforms>AnyCPU;x64</Platforms>
     <AssemblyName>DedicatedServer</AssemblyName>

Barotrauma/BarotraumaShared/SharedSource/DebugConsole.cs

@@ -2612,6 +2612,17 @@ namespace Barotrauma
                 errorMsg);
         }
 
+        private static readonly HashSet<string> loggedErrorIdentifiers = new HashSet<string>();
+        /// <summary>
+        /// Log the error message, but only if an error with the same identifier hasn't been thrown yet during this session.
+        /// </summary>
+        public static void ThrowErrorOnce(string identifier, string errorMsg, Exception e)
+        {
+            if (loggedErrorIdentifiers.Contains(identifier)) { return; }
+            ThrowError(errorMsg, e);
+            loggedErrorIdentifiers.Add(identifier);
+        }
+
         public static void AddWarning(string warning, ContentPackage contentPackage = null)
         {
             warning = AddContentPackageInfoToMessage($"WARNING: {warning}", contentPackage);

Barotrauma/BarotraumaShared/SharedSource/Networking/INetSerializableStruct.cs

@@ -1,4 +1,4 @@
-#nullable enable
+#nullable enable
 
 using System;
 using System.Collections.Generic;
@@ -7,6 +7,7 @@ using System.Diagnostics.CodeAnalysis;
 using System.Linq;
 using System.Reflection;
 using System.Runtime.CompilerServices;
+using System.Text;
 using Barotrauma.Networking;
 using Microsoft.Xna.Framework;
 
@@ -792,5 +793,60 @@ namespace Barotrauma
                 property.Behavior.WriteAction(value!, property.Attribute, msg, bitField);
             }
         }
+
+        public static bool TryRead<T>(IReadMessage inc, AccountInfo sender, [NotNullWhen(true)] out T? data) where T : INetSerializableStruct
+        {
+            try
+            {
+                data = Read<T>(inc);
+                return true;
+            }
+            catch (Exception e)
+            {
+                LogError(e);
+                data = default;
+                return false;
+            }
+
+            void LogError(Exception e)
+            {
+                int prevPos = inc.BitPosition;
+
+                StringBuilder hexData = new();
+                inc.BitPosition = 0;
+                while (inc.BitPosition < inc.LengthBits)
+                {
+                    byte b = inc.ReadByte();
+                    hexData.Append($"{b:X2} ");
+                }
+                // trim the last space if there is one
+                if (hexData.Length > 0) { hexData.Length--; }
+
+                inc.BitPosition = prevPos;
+
+                //only log the error once per sender, so this can't be abused by spamming the server with malformed data to fill up the console with errors
+                //note that the name is "Unknown" if the client hasn't properly joined yet, so errors when first joining are only logged once
+                string accountInfoName = AccountInfoToName(sender);
+                DebugConsole.ThrowErrorOnce(
+                    identifier: $"INetSerializableStruct.TryRead:{accountInfoName}",
+                    errorMsg: $"Failed to read a message by {accountInfoName}. Data: \"{hexData}\"", e);
+
+                static string AccountInfoToName(AccountInfo info)
+                {
+                    var connectedClients = 
+                        GameMain.NetworkMember?.ConnectedClients ?? Array.Empty<Client>();
+
+                    foreach (Client c in connectedClients)
+                    {
+                        if (c.AccountInfo == info)
+                        {
+                            return c.Name;
+                        }
+                    }
+                    
+                    return info.AccountId.TryUnwrap(out var accountId) ? accountId.StringRepresentation : "Unknown";
+                }
+            }
+        }
     }
 }

Barotrauma/BarotraumaShared/SharedSource/Networking/NetworkMember.cs

@@ -159,6 +159,7 @@ namespace Barotrauma.Networking
         NameTaken,
         InvalidVersion,
         SteamP2PError,
+        MalformedData,
         
         //attempt reconnecting with these reasons
         Timeout,

Barotrauma/BarotraumaShared/changelog.txt

@@ -1,3 +1,9 @@
+-------------------------------------------------------------------------------------------------------------------------------------------------
+v1.3.0.3
+-------------------------------------------------------------------------------------------------------------------------------------------------
+
+- Fixed an exploit that allowed crashing servers by sending them specifically crafted malformed data.
+
 -------------------------------------------------------------------------------------------------------------------------------------------------
 v1.3.0.2
 -------------------------------------------------------------------------------------------------------------------------------------------------