Repository navigation
feat(network): Validate peer identity and authenticate match startup and forwarded traffic - #660
Open
tintinhamans wants to merge 21 commits into
Conversation
…m::openArchiveFile() (TheSuperHackers#3376) (cherry picked from commit 86f2cab)
(cherry picked from commit 5db4f75)
…leSystem, Win32LocalFileSystem (TheSuperHackers#3374) (cherry picked from commit 3f3ed9f)
…ile::getFileInfo(), StdBIGFile::getFileInfo() (TheSuperHackers#3415) (cherry picked from commit b805c12)
…File (TheSuperHackers#3505) Both classes are identical apart from their name and contain no platform specific code. Nothing in them depends on the BIG format either: they open a file from an offset and a size inside the archive file. ArchiveFile takes over their functions and is no longer an abstract class. (cherry picked from commit 52a777a)
…ystem into BIGFileSystem (TheSuperHackers#3505) Both classes are identical apart from their name and go through the local file system for all file access. The one class that remains sits next to ArchiveFileSystem in Core/GameEngine. (cherry picked from commit e4b4d1e)
…e loadBigFilesFromDirectory (TheSuperHackers#3505) loadMods refers to BIG files, which nothing else in ArchiveFileSystem does. It becomes a virtual function that BIGFileSystem implements. loadBigFilesFromDirectory is renamed to loadArchiveFilesFromDirectory, because the base class is not tied to one archive format. (cherry picked from commit f299561)
tintinhamans
force-pushed
the
arctic/go/stack2/05-peer-identity-signing
branch
from
October 25, 2026 05:20
13cc130 to
9599f2f
Compare
…e Zero Hour archives (cherry picked from commit aaea4c1)
…only with verbose logging
tintinhamans
force-pushed
the
arctic/go/stack2/05-peer-identity-signing
branch
from
October 25, 2026 11:15
9599f2f to
ba28a46
Compare
…and forwarded traffic
tintinhamans
force-pushed
the
arctic/go/stack2/05-peer-identity-signing
branch
from
October 25, 2026 12:53
ba28a46 to
17f0809
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge after #659. Conflicts with #625 in
OnlineServices_Init.h; this branch gets rebased once #625 lands.The connection handshake carries the identity of the peer as plain text the peer wrote itself, a signal from the service was answered whatever user it claimed to be, and a command was accepted from any peer whatever author it named. The router also forwards other players' frames and chat, so a peer could alter what it passed on unnoticed.
The peer that finishes a handshake must now be the user the connection was made for, and a signal is only answered for the user the service stamped it with (
WebSocket::PendingSignalcarriessenderUserID). A command whose author is not the sender is rejected unless the router relays it. Each client makes an Ed25519 key pair when it joins or creates a lobby (MatchKeys, new) and announces the public key over each peer's own connection on a new key channel. A player signs its own frame info and chat, and a frame or chat passed on for another player is only accepted with that player's signature (frames wait up to 3 s for it). The leave notice gets a signature field for the disconnect PR.The host does not start while a member is not connected or has not exchanged keys, and the chat says who it waits for. Each client checks again before gameplay and leaves instead of starting unauthenticated. The anticheat plugin transport has no keys, and the launch logs that.
Wire change: new command types
NETCOMMANDTYPE_SIGNEDFRAMEINFOandNETCOMMANDTYPE_SIGNATURES, key channel messages, andDISCONNECTPLAYERgrows by 65 bytes outside retail compatible mode. No new service key. Conflicts with #625 on thePendingSignalqueue type.Tested: builds x86 Release
z_generals. In the 3 player rig (full stack) the host held a late joiner's start until keys were exchanged, 0 CRC mismatches, n=1.