openra / openramasterserver

Scripts that make up the OpenRA project's master server for game broadcasts

OpenRA

A Libre/Free Real Time Strategy game engine supporting early Westwood classics.

• Website: https://www.openra.net
• Chat: #openra on Libera (web) or Discord
• Repository: https://github.com/OpenRA/OpenRA

Please read the FAQ in our Wiki and report problems at https://github.com/OpenRA/OpenRA/issues.

Join the Forum for discussion.

Play

Distributed mods include a reimagining of

• Command & Conquer: Red Alert
• Command & Conquer: Tiberian Dawn
• Dune 2000

EA has not endorsed and does not support this product.

Check our Playing the Game Guide to win multiplayer matches.

Contribute

• Please read INSTALL.md and Compiling on how to set up an OpenRA development environment.
• See Hacking for a (now very outdated) overview of the engine.
• Read and follow our Code of Conduct.
• To get your patches merged, please adhere to the Contributing guidelines.

Mapping

• We offer a Mapping Tutorial as you can change gameplay drastically with custom rules.
• For scripted mission have a look at the Lua API.
• If you want to share your maps with the community, upload them at the OpenRA Resource Center.

Modding

• Download a copy of the OpenRA Mod SDK to start your own mod.
• Check the Modding Guide to create your own classic RTS.
• There exists an auto-generated Trait documentation to get started with yaml files.
• Some hints on how to create new OpenRA compatible Pixelart.
• Upload total conversions at our Mod DB profile.

Support

• Sponsor a mirror server if you have some bandwidth to spare.
• You can immediately set up a Dedicated Game Server.

License

Copyright (c) OpenRA Developers and Contributors This file is part of OpenRA, which is free software. It is made available to you under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. For more information, see COPYING.

openramasterserver's Issues

Remove empty server filtering hack

We are currently working around an issue with the ordering of mods in the MP game browser by filtering out empty games for all but the current version.

This is done by adding

        $filter_empty = NULL;
        if (isset($_REQUEST['modversion']))
            $filter_empty = $_REQUEST['modversion'];

between the try and the $db lines at the start of games.php, and then

            // Filter empty servers from all but the current version
            if ($row['players'] == 0 && $filter_empty != NULL && explode("@", $row['mods'])[1] != $filter_empty)
                continue;

as the first line after the foreach.

This hack can and should be removed once most of the empty servers have migrated from release-20170421 to release-20170527.

new boolean field whether the game is password protected or not

Required for OpenRA/OpenRA#4495.

create index.php with nice output and filters

build server stats

The most active and popular server by:

amount of players
activity
average game duration

show the most popular map per server too.

list.php Can be Spammed

http://master.open-ra.org/ping.php?port=5354&name=Exploit&state=1&players=0&mods=ra@invalid&map=f1cc766418da45f987690cc6128444ada55d1a89&maxplayers=0

Can be fixed by checking for a custom user agent, suggested to be enforced in next version.

create indexes

create some indexes as well perhaps.

OpenRAMasterServer/create.php

Line 25 in 2458c3b

$schema = 'CREATE TABLE servers (

DB: sqlite manager says that `clients` table is corrupted

That's why /games does not show client names field.
Probably required to drop and create table clients again.
This table does not store anything over time, it's for current online games, so no data is going to be lost.

save stats properly in db instead of log file.

and provide a page to serve saved info for external clients.

structure: new table with: id, hash, played_counter, version

api: request a page by hash and return a json: [{"hash":"hash", "played_counter":"amount","version":"version"}].

For example, resource site will have scheduled trigger (in background) which will update internal database with fresh data from master server, using API, several times per month.
This non-up-to-date info is enough to be trusted.

Having this fixed and a "community maps" tab added into OpenRA, there will be a possibility to have a filter ordered by "Playing Activity", requested by @X-A-N-A-X

---

Primary table "servers":

id	name	address	players	state	ts	map	mods	bots	spectators	maxplayers	protected	started
integer	varchar	varchar	integer	integer	integer	varchar	varchar	integer	integer	integer	boolean	datetime

Table "finished":

id	game_id	name	address	map	mod	version	protected	started	finished
integer	integer (identical to servers.id)	varchar	varchar	varchar	varchar	varchar	boolean	datetime	datetime

Table "map_stats":

id	map	played_counter	mod	version	last_change
integer	varchar	integer	varchar	varchar	datetime

Table "activity":

id	game_id	timestamp	address	mod	version	state_old	state_new	players
integer	integer (identical to servers.id and finished.game_id)	datetime	varchar	varchar	varchar	integer	integer	integer

stats.php which outputs JSON player/server numbers over time

So we can render it with JavaScript libraries like http://www.flotcharts.org/ in the way http://cncnet.org/statistics does it.

"maxplayers" is sent from OpenRA but never used on master server

latency and jitter

I think, that fields "latency" and "jitter" (from the Master server to a Playing server) may be useful for outputs of "list.php" and "list_json.php".

What do you think?

delete ancient not finished games on timeout from "servers"

mono 4.6.2.7+dfsg-1ubuntu1 can't connect via HTTPS

root@lubuntu:/tmp/monotest# mono --version
Mono JIT compiler version 4.6.2 (Debian 4.6.2.7+dfsg-1ubuntu1)
Copyright (C) 2002-2014 Novell, Inc, Xamarin Inc and Contributors. www.mono-project.com
	TLS:           __thread
	SIGSEGV:       altstack
	Notifications: epoll
	Architecture:  amd64
	Disabled:      none
	Misc:          softdebug 
	LLVM:          supported, not enabled.
	GC:            sgen
root@lubuntu:/tmp/monotest# mono tlstest.exe https://master.openra.net

https://master.openra.net
FAILED: #-2146232800
System.IO.IOException: The authentication or decryption has failed. ---> System.IO.IOException: The authentication or decryption has failed. ---> Mono.Security.Protocol.Tls.TlsException: The authentication or decryption has failed.
  at Mono.Security.Protocol.Tls.RecordProtocol.EndReceiveRecord (System.IAsyncResult asyncResult) [0x00040] in <1d0bb82c94e7435eb09324cf5ef20e36>:0 
  at Mono.Security.Protocol.Tls.SslClientStream.SafeEndReceiveRecord (System.IAsyncResult ar, System.Boolean ignoreEmpty) [0x00000] in <1d0bb82c94e7435eb09324cf5ef20e36>:0 
  at Mono.Security.Protocol.Tls.SslClientStream.NegotiateAsyncWorker (System.IAsyncResult result) [0x00071] in <1d0bb82c94e7435eb09324cf5ef20e36>:0 
   --- End of inner exception stack trace ---
  at Mono.Security.Protocol.Tls.SslClientStream.EndNegotiateHandshake (System.IAsyncResult result) [0x0003b] in <1d0bb82c94e7435eb09324cf5ef20e36>:0 
  at Mono.Security.Protocol.Tls.SslStreamBase.AsyncHandshakeCallback (System.IAsyncResult asyncResult) [0x0000c] in <1d0bb82c94e7435eb09324cf5ef20e36>:0 
   --- End of inner exception stack trace ---
  at Mono.Security.Protocol.Tls.SslStreamBase.EndNegotiateHandshake (Mono.Security.Protocol.Tls.SslStreamBase+InternalAsyncResult asyncResult) [0x00028] in <1d0bb82c94e7435eb09324cf5ef20e36>:0 
  at Mono.Security.Protocol.Tls.SslStreamBase.NegotiateHandshake () [0x00035] in <1d0bb82c94e7435eb09324cf5ef20e36>:0 
  at Mono.Security.Protocol.Tls.SslStreamBase.Write (System.Byte[] buffer, System.Int32 offset, System.Int32 count) [0x00076] in <1d0bb82c94e7435eb09324cf5ef20e36>:0 
  at System.IO.StreamWriter.Flush (System.Boolean flushStream, System.Boolean flushEncoder) [0x00094] in <8f2c484307284b51944a1a13a14c0266>:0 
  at System.IO.StreamWriter.Flush () [0x00006] in <8f2c484307284b51944a1a13a14c0266>:0 
  at TlsTest.GetStreamPage (System.String url) [0x000c2] in <7ad9caa5280c42fa9e47b5cc3d9b1e0e>:0 
  at TlsTest.Main (System.String[] args) [0x002aa] in <7ad9caa5280c42fa9e47b5cc3d9b1e0e>:0 

master server machine does not know how to handle master.openra.net

via OpenRA/OpenRA#4647 required for OpenRA/OpenRA#4621

add "timestamp" field into master server db

1 field: game_started

url rewrite fails on xampp machines (Windows)

RewriteRules in .htaccess don't work on xampp machines. Tested with xampp 1.7.7 and xampp 1.8.2 on Win7 and WinXP.

An overall redirection does the trick there:

---

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^([^.]+)?$ $1.php

---

delete previous record, if state has been changed from 2 to 1

This will create new ID. Can happen because of issues with physical connnection

player names are not properly sanitized

Game@36:
        Id: 106120
        Name: hetzner_release_2
        Address: 178.63.32.174:1232
        State: 2
        Players: 8
        MaxPlayers: 8
        Bots: 0
        Spectators: 1
        Map: 7e2dc0ffeafa808b34360bd34384cfe564391238
        Mods: ra@release-20141029
        TTL: 298
        Protected: false
        Started: 2015-02-21 21:14:46
        Location: Germany
        Clients:
                yes no
                Mc.Lovin....\m/
                Schefmonstah
                z
                FiveAces
                pax
                ¦̵̱ ̵̱ ̵̱ ̵̱ ̵̱(Ì¢ ̡͇̅└̅̈́¥&3aó!H
8¥©�5æ(‰
                â–ž S∑NP¢$H8¥¦
                Lavoriamobene

security, ping.php, address

port check is done on $_SERVER["REMOTE_ADDR"] yet address in body is used in the database insert/update clause. perhaps you want to add a check that remote address matches body address and/or store remote address.

by setting the ip address to any active game ip address you can update/overwrite the database record for that game server.

in general many of the input fields are not checked, but the address being part of the key may be harmful.

also note that a dos attack is possible by executing an unlimited number of pings. i understand this may be by design, it being an open game.

Undesirable behavior: sql statement which forces game's ID to be changed

What must be: 1 game == 1 ID for the game's lifetime

What really happens: game's ID is randomly (unpredicted moment) changed

What does it break: the uniqueness of the game is violated, which clients do not suspect about (bots, stream servers). Impossible to define the game's start moment for bots. Stream servers are unable to work because impossible to define a minor changes in a particular game (or at least impossible to rely on it).

What is probably causing such a behavior: ping.php -> $insert = $db->prepare('INSERT OR REPLACE INTO servers .......

Dedicated Server listing not sorted alphanumerically

Recently, it appears that the server listings are sorted in some manner other than alphabetical. In the past, server names have determined the order in which servers without any players appear in the server listing, and similarly among the group of servers that have current active players.

It is not clear how they are now being sorted or if this change in sorting mechanism was intentional.

server location

htmlspecialchars is called on strings before inserting into the database

OpenRAMasterServer/ping.php

Lines 34 to 39 in 14c6266

	switch ($type)
	{
	case PDO::PARAM_INT: $value = intval($value); break;
	case PDO::PARAM_BOOL: $value = intval(filter_var($value, FILTER_VALIDATE_BOOLEAN)); break;
	case PDO::PARAM_STR: $value = htmlspecialchars($value); break;
	}

There is no need to encode data that will be returned as yaml, and possibly likewise for JSON (I'd expect that to have its own sanitize function that could be done on display). We probably want to remove this to avoid issues like:

Include basic map info to games endpoint

Hi,

I would like to ask, if it is possible to include basic information to games endpoint ?

For example, if you open developer tools on page http://www.openra.net/games/, you can see there is another request to obtain map info for every displayed game in list. IMO, it would be better to include basic map info right into games/ endpoint, so it would save several request.

The point, why I'm asking is that I'm trying to implement own games browser, where user can filter games based on mods, players, maps, etc. So, when my games browser will show for example 50 games, it needs also send another 50 request to get map info.

put server's location into list

probably using services like http://api.hostip.info/country.php?ip=IP

unreachable code

OpenRAMasterServer/ping.php

Line 537 in 2458c3b

error_log($e->getMessage());

Sanity check player numbers

http://activity.openra.net/ can be easily junked with invalid data such as games with unrealistic large player numbers, which is what @martinalderson did when he tested his exploits OpenRA/OpenRA#11826. Similar to #5, but more annoying as our graphs then scale to the super high player count.

separate spectators from players

Update documentation to reflect current infrastructure

INFO.md contains instructions for configuring nginx, but the server is running on apache.

security, games.php, server response header, content-type

games.php serves the the content-type application/javascript when selecting json as output.
this should be application/json.

by also being able to insert any string in the database this in some situations could lead to javascript being executed in the web clients that make the request. possible cross site scripting attack.