Core/Auth: Per SRP6a protocol, terminate connection of A % N == 0. This resolves another authentication bypass issue

data/sql/updates/db_auth/2016_11_19_00.sql

@@ -0,0 +1,27 @@
+-- DB update 2016_09_04_00 -> 2016_11_19_00
+DROP PROCEDURE IF EXISTS `updateDb`;
+DELIMITER //
+CREATE PROCEDURE updateDb ()
+proc:BEGIN DECLARE OK VARCHAR(100) DEFAULT 'FALSE';
+START TRANSACTION;
+ALTER TABLE version_db_auth CHANGE COLUMN 2016_09_04_00 2016_11_19_00 bit;
+SELECT sql_rev INTO OK FROM version_db_auth WHERE sql_rev = '1478975214169487000'; IF OK <> 'FALSE' THEN LEAVE proc; END IF;
+--
+-- START UPDATING QUERIES
+--
+INSERT INTO version_db_auth (`sql_rev`) VALUES ('1478975214169487000');
+
+ALTER TABLE `account`
+    ADD `token_key` VARCHAR(100) NOT NULL DEFAULT '' AFTER `s`,
+    ADD `reg_mail` VARCHAR(255) NOT NULL DEFAULT '' AFTER `email`,
+    ADD `last_attempt_ip` VARCHAR(15) NOT NULL DEFAULT '127.0.0.1' AFTER `last_ip`,
+    ADD `lock_country` VARCHAR(2) NOT NULL DEFAULT '00' AFTER `locked`;
+--
+-- END UPDATING QUERIES
+--
+COMMIT;
+END;
+//
+DELIMITER ;
+CALL updateDb();
+DROP PROCEDURE IF EXISTS `updateDb`;

data/sql/updates/db_characters/2016_11_19_00.sql

@@ -0,0 +1,25 @@
+-- DB update 2016_08_25_00 -> 2016_11_19_00
+DROP PROCEDURE IF EXISTS `updateDb`;
+DELIMITER //
+CREATE PROCEDURE updateDb ()
+proc:BEGIN DECLARE OK VARCHAR(100) DEFAULT 'FALSE';
+START TRANSACTION;
+ALTER TABLE version_db_characters CHANGE COLUMN 2016_08_25_00 2016_11_19_00 bit;
+SELECT sql_rev INTO OK FROM version_db_characters WHERE sql_rev = '1478978518254125000'; IF OK <> 'FALSE' THEN LEAVE proc; END IF;
+--
+-- START UPDATING QUERIES
+--
+INSERT INTO version_db_characters (`sql_rev`) VALUES ('1478978518254125000');
+
+ALTER TABLE `arena_team_member`
+	CHANGE COLUMN `personalRating` `personalRating` SMALLINT(5) NOT NULL DEFAULT '0' AFTER `seasonWins`,
+	DROP COLUMN `personal_rating`;
+--
+-- END UPDATING QUERIES
+--
+COMMIT;
+END;
+//
+DELIMITER ;
+CALL updateDb();
+DROP PROCEDURE IF EXISTS `updateDb`;

data/sql/updates/db_world/2016_11_19_00.sql

@@ -0,0 +1,23 @@
+-- DB update 2016_11_06_02 -> 2016_11_19_00
+DROP PROCEDURE IF EXISTS `updateDb`;
+DELIMITER //
+CREATE PROCEDURE updateDb ()
+proc:BEGIN DECLARE OK VARCHAR(100) DEFAULT 'FALSE';
+START TRANSACTION;
+ALTER TABLE version_db_world CHANGE COLUMN 2016_11_06_02 2016_11_19_00 bit;
+SELECT sql_rev INTO OK FROM version_db_world WHERE sql_rev = '1477236823674130000'; IF OK <> 'FALSE' THEN LEAVE proc; END IF;
+--
+-- START UPDATING QUERIES
+--
+INSERT INTO version_db_world(`sql_rev`) VALUES ('1477236823674130000');
+
+UPDATE `quest_template` SET `SpecialFlags` = "0", `RequiredItemId1` = "31811", `RequiredItemCount1` ="1", `Flags` = "0" WHERE `ID` = "10923";
+--
+-- END UPDATING QUERIES
+--
+COMMIT;
+END;
+//
+DELIMITER ;
+CALL updateDb();
+DROP PROCEDURE IF EXISTS `updateDb`;

data/sql/updates/pending_db_auth/rev_1478975214169487000.sql

@@ -1,7 +0,0 @@
-INSERT INTO version_db_auth (`sql_rev`) VALUES ('1478975214169487000');
-
-ALTER TABLE `account`
-    ADD `token_key` VARCHAR(100) NOT NULL DEFAULT '' AFTER `s`,
-    ADD `reg_mail` VARCHAR(255) NOT NULL DEFAULT '' AFTER `mail`,
-    ADD `last_attempt_ip` VARCHAR(15) NOT NULL DEFAULT '127.0.0.1' AFTER `last_ip`,
-    ADD `lock_country` VARCHAR(2) NOT NULL DEFAULT '00' AFTER `locked`;

data/sql/updates/pending_db_characters/rev_1478978518254125000.sql

@@ -1,5 +0,0 @@
-INSERT INTO version_db_characters (`sql_rev`) VALUES ('1478978518254125000');
-
-ALTER TABLE `arena_team_member`
-	CHANGE COLUMN `personalRating` `personalRating` SMALLINT(5) NOT NULL DEFAULT '0' AFTER `seasonWins`,
-	DROP COLUMN `personal_rating`;

data/sql/updates/pending_db_world/rev_1477236823674130000.sql

@@ -1,3 +0,0 @@
-INSERT INTO version_db_world(`sql_rev`) VALUES ('1477236823674130000');
-
-UPDATE `quest_template` SET `SpecialFlags` = "0", `RequiredItemId1` = "31811", `RequiredItemCount1` ="1", `Flags` = "0" WHERE `ID` = "10923"

src/authserver/Server/AuthSocket.cpp

@@ -34,12 +34,6 @@ enum eAuthCmd
     XFER_CANCEL                                  = 0x34
 };
 
-enum eStatus
-{
-    STATUS_CONNECTED                             = 0,
-    STATUS_AUTHED
-};
-
 // GCC have alternative #pragma pack(N) syntax and old gcc version not support pack(push, N), also any gcc version not support it at some paltform
 #if defined(__GNUC__)
 #pragma pack(1)
@@ -168,14 +162,14 @@ private:
 
 const AuthHandler table[] =
 {
-    { AUTH_LOGON_CHALLENGE,     STATUS_CONNECTED, &AuthSocket::_HandleLogonChallenge    },
-    { AUTH_LOGON_PROOF,         STATUS_CONNECTED, &AuthSocket::_HandleLogonProof        },
-    { AUTH_RECONNECT_CHALLENGE, STATUS_CONNECTED, &AuthSocket::_HandleReconnectChallenge},
-    { AUTH_RECONNECT_PROOF,     STATUS_CONNECTED, &AuthSocket::_HandleReconnectProof    },
-    { REALM_LIST,               STATUS_AUTHED,    &AuthSocket::_HandleRealmList         },
-    { XFER_ACCEPT,              STATUS_CONNECTED, &AuthSocket::_HandleXferAccept        },
-    { XFER_RESUME,              STATUS_CONNECTED, &AuthSocket::_HandleXferResume        },
-    { XFER_CANCEL,              STATUS_CONNECTED, &AuthSocket::_HandleXferCancel        }
+    { AUTH_LOGON_CHALLENGE,     STATUS_CHALLENGE,   &AuthSocket::_HandleLogonChallenge      },
+    { AUTH_LOGON_PROOF,         STATUS_LOGON_PROOF, &AuthSocket::_HandleLogonProof          },
+    { AUTH_RECONNECT_CHALLENGE, STATUS_CHALLENGE,   &AuthSocket::_HandleReconnectChallenge  },
+    { AUTH_RECONNECT_PROOF,     STATUS_RECON_PROOF, &AuthSocket::_HandleReconnectProof      },
+    { REALM_LIST,               STATUS_AUTHED,      &AuthSocket::_HandleRealmList           },
+    { XFER_ACCEPT,              STATUS_PATCH,       &AuthSocket::_HandleXferAccept          },
+    { XFER_RESUME,              STATUS_PATCH,       &AuthSocket::_HandleXferResume          },
+    { XFER_CANCEL,              STATUS_PATCH,       &AuthSocket::_HandleXferCancel          }
 };
 
 #define AUTH_TOTAL_COMMANDS 8
@@ -185,7 +179,7 @@ Patcher PatchesCache;
 
 // Constructor - set the N and g values for SRP6
 AuthSocket::AuthSocket(RealmSocket& socket) :
-    pPatch(NULL), socket_(socket), _authed(false), _build(0),
+    pPatch(NULL), socket_(socket), _status(STATUS_CHALLENGE), _build(0),
     _expversion(0), _accountSecurityLevel(SEC_PLAYER)
 {
     N.SetHexStr("894B645E89E1535BBDAD5B8B290650530801B18EBFBF5E8FAB3C82872A3E9BB7");
@@ -233,7 +227,7 @@ void AuthSocket::OnRead()
         // Circle through known commands and call the correct command handler
         for (i = 0; i < AUTH_TOTAL_COMMANDS; ++i)
         {
-            if ((uint8)table[i].cmd == _cmd && (table[i].status == STATUS_CONNECTED || (_authed && table[i].status == STATUS_AUTHED)))
+            if ((uint8)table[i].cmd == _cmd && (table[i].status == _status))
             {
                 ;//sLog->outDebug(LOG_FILTER_NETWORKIO, "Got data for cmd %u recv length %u", (uint32)_cmd, (uint32)socket().recv_len());
 
@@ -306,6 +300,9 @@ bool AuthSocket::_HandleLogonChallenge()
     if (socket().recv_len() < sizeof(sAuthLogonChallenge_C))
         return false;
 
+    ///- Session is closed unless overriden
+    _status = STATUS_CLOSED;
+
     // pussywizard: logon flood protection:
     {
         TRINITY_GUARD(ACE_Thread_Mutex, LastLoginAttemptMutex);
@@ -519,6 +516,9 @@ bool AuthSocket::_HandleLogonChallenge()
                     ;//sLog->outDebug(LOG_FILTER_NETWORKIO, "'%s:%d' [AuthChallenge] account %s is using '%c%c%c%c' locale (%u)", socket().getRemoteAddress().c_str(), socket().getRemotePort(),
                     //        _login.c_str (), ch->country[3], ch->country[2], ch->country[1], ch->country[0], GetLocaleByName(_localizationName)
                     //    );
+
+                    ///- All good, await client's proof
+                    _status = STATUS_LOGON_PROOF;
                 }
             }
         }
@@ -540,6 +540,8 @@ bool AuthSocket::_HandleLogonProof()
     if (!socket().recv((char *)&lp, sizeof(sAuthLogonProof_C)))
         return false;
 
+    _status = STATUS_CLOSED;
+
     // If the client has no valid version
     if (_expversion == NO_VALID_EXP_FLAG)
     {
@@ -555,7 +557,7 @@ bool AuthSocket::_HandleLogonProof()
     A.SetBinary(lp.A, 32);
 
     // SRP safeguard: abort if A == 0
-    if (A.isZero())
+    if ((A % N).isZero())
     {
         socket().shutdown();
         return true;
@@ -670,7 +672,8 @@ bool AuthSocket::_HandleLogonProof()
             socket().send((char *)&proof, sizeof(proof));
         }
 
-        _authed = true;
+        ///- Set _status to authed!
+        _status = STATUS_AUTHED;
     }
     else
     {
@@ -749,6 +752,9 @@ bool AuthSocket::_HandleReconnectChallenge()
     if ((remaining < sizeof(sAuthLogonChallenge_C) - buf.size()) || (socket().recv_len() < remaining))
         return false;
 
+    ///- Session is closed unless overriden
+    _status = STATUS_CLOSED;
+
     // No big fear of memory outage (size is int16, i.e. < 65536)
     buf.resize(remaining + buf.size() + 1);
     buf[buf.size() - 1] = 0;
@@ -790,6 +796,9 @@ bool AuthSocket::_HandleReconnectChallenge()
 
     K.SetHexStr ((*result)[0].GetCString());
 
+    ///- All good, await client's proof
+    _status = STATUS_RECON_PROOF;
+
     // Sending response
     ByteBuffer pkt;
     pkt << uint8(AUTH_RECONNECT_CHALLENGE);
@@ -810,6 +819,8 @@ bool AuthSocket::_HandleReconnectProof()
     if (!socket().recv((char *)&lp, sizeof(sAuthReconnectProof_C)))
         return false;
 
+    _status = STATUS_CLOSED;
+
     if (_login.empty() || !_reconnectProof.GetNumBytes() || !K.GetNumBytes())
         return false;
 
@@ -830,7 +841,10 @@ bool AuthSocket::_HandleReconnectProof()
         pkt << uint8(0x00);
         pkt << uint16(0x00);                               // 2 bytes zeros
         socket().send((char const*)pkt.contents(), pkt.size());
-        _authed = true;
+
+        ///- Set _status to authed!
+        _status = STATUS_AUTHED;
+
         return true;
     }
     else

src/authserver/Server/AuthSocket.h

@@ -14,6 +14,16 @@
 class ACE_INET_Addr;
 struct Realm;
 
+enum eStatus
+{
+    STATUS_CHALLENGE,
+    STATUS_LOGON_PROOF,
+    STATUS_RECON_PROOF,
+    STATUS_PATCH,      // unused
+    STATUS_AUTHED,
+    STATUS_CLOSED
+};
+
 // Handle login commands
 class AuthSocket: public RealmSocket::Session
 {
@@ -54,7 +64,7 @@ private:
     BigNumber K;
     BigNumber _reconnectProof;
 
-    bool _authed;
+    eStatus _status;
 
     std::string _login;
 

src/game/Entities/Player/Player.cpp

@@ -12820,6 +12820,8 @@ void Player::MoveItemFromInventory(uint8 bag, uint8 slot, bool update)
             it->RemoveFromWorld();
             it->DestroyForPlayer(this);
         }
+
+        sScriptMgr->OnAfterPlayerMoveItemFromInventory(this,it,bag,slot,update);
     }
 }
 

src/game/Scripting/ScriptMgr.cpp

@@ -1328,6 +1328,11 @@ void ScriptMgr::OnAfterPlayerSetVisibleItemSlot(Player* player, uint8 slot, Item
     FOREACH_SCRIPT(PlayerScript)->OnAfterSetVisibleItemSlot(player, slot,item);
 }
 
+void ScriptMgr::OnAfterPlayerMoveItemFromInventory(Player* player, Item* it, uint8 bag, uint8 slot, bool update)
+{
+    FOREACH_SCRIPT(PlayerScript)->OnAfterMoveItemFromInventory(player, it, bag, slot, update);
+}
+
 // Guild
 void ScriptMgr::OnGuildAddMember(Guild* guild, Player* player, uint8& plRank)
 {

src/game/Scripting/ScriptMgr.h

@@ -788,6 +788,9 @@ class PlayerScript : public ScriptObject
 
         // To change behaviour of set visible item slot
         virtual void OnAfterSetVisibleItemSlot(Player* /*player*/, uint8 /*slot*/, Item* /*item*/) { }
+               
+        // After an item has been moved from inventory
+        virtual void OnAfterMoveItemFromInventory(Player* /*player*/, Item* /*it*/,uint8 /*bag*/, uint8 /*slot*/, bool /*update*/) { }
 };
 
 class GuildScript : public ScriptObject
@@ -1084,7 +1087,8 @@ class ScriptMgr
         void OnGossipSelect(Player* player, uint32 menu_id, uint32 sender, uint32 action);
         void OnGossipSelectCode(Player* player, uint32 menu_id, uint32 sender, uint32 action, const char* code);
         void OnPlayerBeingCharmed(Player* player, Unit* charmer, uint32 oldFactionId, uint32 newFactionId);
-        void OnAfterPlayerSetVisibleItemSlot(Player* player, uint8 /*slot*/, Item *item);
+        void OnAfterPlayerSetVisibleItemSlot(Player* player, uint8 slot, Item *item);
+        void OnAfterPlayerMoveItemFromInventory(Player* player, Item* it, uint8 bag, uint8 slot, bool update);
 
     public: /* GuildScript */