Conversation
|
talking about ots, docker is a niche case, I don't think we should break the default experience, with this change we are fixing one "issue" while making it "harder" for the majority (especially first-timers), just as nekiro pointed out in the thread you quoted I'm no Docker expert, but shouldn't Docker configurations be able to override the bind IP instead? |
+1 |
And how does it break the default experience or make it harder for the majority? It makes it simpler for the majority, it's not only a docker issue. Also note: the http server is already listening on 0.0.0.0 |
|
Tbh I'd just hardcode it to listen to 0.0.0.0 instead, just like the HTTP server. One less configuration to set, and probably everybody is either running behind a router in their home network OR they know what they are doing anyway and want to open the server to the public. |
|
Maybe I'm missing something, but TFS and acc. makers use forgottenserver/src/http/login.cpp Lines 132 to 134 in ceb2a07 If we set it to And as @yesits-me said, docker is a niche for OTS developers (ex. me testing Linux builds on Windows). @Shawak |
|
I can do that, but that would require this change anyways because you cannot connect to a docker's localhost from outside (atleast not using localhost, you would probably have to use the docker host network ip, and I am not even sure if that would work on windows) @ranisalt I strongly agree with you, no idea why this is a setting in the first place (or ever was, since now it seems to be used by the http module which is bad practice imo) |
Which may change on each container start so it's not even possible
It means the public IP address of the server. It should not have been used to bind interfaces, it's used in the status protocol and also in the HTTP server because it may not live in the same machine that the game server is running (for multi-server setups) |
Yeah I know what it means, I was refering to it like "I don't get why it is used that way". But if it's used in the status protocol and in http server we probably need a proper replacement first (like getting the ip from the interface if possible, or ping smth like ifconfig), or we hardcode any ip for the game server. |
|
Tbh you need the server address anyway to use the status protocol, I don't think anyone reads it from the response. The HTTP server also makes the status protocol redundant once we create a route to respond with the information needed. |
|
So how do we continue? Leave it as it is? Allow overriding |
EDIT You can. Server binds to forgottenserver/src/otserv.cpp Lines 229 to 230 in c143b4b which is used by other server ports: forgottenserver/src/server.cpp Lines 58 to 64 in c143b4b I fixed it by replacing tfs::http::start(
getBoolean(ConfigManager::BIND_ONLY_GLOBAL_ADDRESS),
getString(ConfigManager::IP),
getNumber(ConfigManager::HTTP_PORT),
getNumber(ConfigManager::HTTP_WORKERS)
);
void start(bool bindOnlyGlobalAddress, std::string_view serverIp, unsigned short port = 8080, int threads = 1);and void tfs::http::start(bool bindOnlyGlobalAddress, std::string_view serverIp, unsigned short port /*= 8080*/, int threads /*= 1*/)
{
if (port == 0 || threads < 1) {
return;
}
asio::ip::address address = asio::ip::address_v6::any();
if (bindOnlyGlobalAddress) {
address = asio::ip::make_address(serverIp);
}
fmt::print(">> Starting HTTP server on {:s}:{:d} with {:d} threads.\n", address.to_string(), port, threads);
auto listener = make_listener(ioc, {address, port});
listener->run();
workers.reserve(threads);
for (auto i = 0; i < threads; ++i) {
workers.emplace_back([] { ioc.run(); });
}
}Now I can run
otservlist does and bans for invalid IP as spoofing. Probably most of OTS lists do that.
IP used by HTTP should work the same as other ports: check if forgottenserver/src/http/login.cpp Line 132 in c143b4b
There are 2 problems:
My Oracle Cloud server with public IP
|
|
Yeah I think the problem that user is having in OTLand is something else. Will try to reproduce it locally, but I've seen the "malformed session key" error happen before. |
It may be related to #4706 Account makers (ex. MyAAC) still use old format with 2+ lines (account name/email, new line, account password, [optional] new line, some token for 2FA) separated by 'new line' as a session key: TFS HTTP login server uses base64 with 16 random bytes for this and stores sessions in database, so it's 'login to account' (characters list) and 'login to game' are compatible, but that code is not compatible with MyAAC. We can ask MyAAC author to update code for TFS or revert session format of TFS to format used by other 12+ servers and TFS up to #4706 . |
|
I'd rather have others move to an actual session token instead. It's secure, can be locked to an IP and avoid session stealing, and can prevent having to completely relog when changing characters - we should be checking the token but we just didn't However, if the AAC wishes to use insecure plain text tokens, it's just a matter of storing that string to the database and tfs will check it. Legacy code can always be used, we don't need to keep doing it the bad way forever Alternatively, just map the login URL to TFS HTTP server and call it a day, should be easy to with 2-3 lines in Apache/Nginx |
It's not that simple, because it would require acc. maker to store unhashed password in OTS database (just base64 encoded).
Session key is RSA encrypted by client, when it's send to server - no way to steal it from network. forgottenserver/src/protocolgame.cpp Line 438 in 73032fa IDK where Tibia Client stores session, but OTC stores it in RAM: https://github.com/mehah/otclient/blob/main/modules/client_entergame/entergame.lua#L35 New version of sessions allows hacker to login, even if I change password to account. Old code checked password: forgottenserver/src/protocolgame.cpp Line 460 in 73032fa and stored 2FA token code and token time in session, so you do not have to relog to account, to login on other character: forgottenserver/src/protocolgame.cpp Lines 414 to 433 in 73032fa You can also use that 2FA token time to implement session expiration time on server, without storing sessions in database. |
|
@Shawak forgottenserver/src/http/login.cpp Lines 132 to 134 in ceb2a07 If you try to connect to 0.0.0.0:7172 (client will, when you select character), it will return error about problem with connection.
Problem of listening on |
|
I mean yes but bindOnlGlobalAddress should really be called bindSingleAddress or similar. The term I think I would even turn it around and call it |
HopeItBuilds
left a comment
HopeItBuilds
left a comment
There was a problem hiding this comment.
ok whatever, lets not just stall things
It's absolutely not related to this PR, which makes it impossible to login into game with default I named variables I wanted to use full I prefer old code, that used
Ye. Let's merge backward compatible PRs, that cannot break compilation (no vcpkg/CMakeLists/libraries changes) faster. |
5 participants
Pull Request Prelude
Changes Proposed
In days of dockerization, make it so that you can connect from any ip address to the server.
Issues addressed:
None (https://otland.net/threads/simple-docker-compose-set-up.284700/)