Commit Graph

22 Commits

Author SHA1 Message Date
11a3f9f1b9 VerifyLoginTask: fast-fail by checking header x5u before verifying signature
this is less costly, although it doesn't make any difference except in invalid cases.
2020-06-17 17:52:19 +01:00
09771849ae VerifyLoginTask optimisation: do not copy the entire LoginPacket into the worker thread
this is especially bad considering the fact that the cached buffer is copied. That said, it's only a few kilobytes so it's not a huge problem, but nonetheless...
2020-06-17 17:46:22 +01:00
bd1d7b8d75 asserts 👏 are 👏 not 👏 error 👏 checking 2020-05-13 12:39:55 +01:00
1513a0e092 VerifyLoginTask: beware wrong number of parts when splitting JWT 2020-05-13 12:39:53 +01:00
f624871b3f strip extra blank lines (php-cs-fixer) 2020-01-22 14:50:29 +00:00
c4793241f5 Mass removal of useless @param/@return PHPDoc annotations, pass 1 2020-01-21 15:10:18 +00:00
f00c69c513 added missing function imports 2019-12-09 20:13:02 +00:00
622f93df45 remove usages of deprecated {} string access, closes #3035 2019-07-22 16:39:33 +01:00
47321114eb login: allow 60 seconds clock drift on login JWT
can everyone please just use NTP already?
2019-01-20 15:51:29 +00:00
4b9a142a5d Import global functions and constants for enhanced performance
This is better for performance because these then don't need to be reevaluated every time they are called.

When encountering an unqualified function or constant reference, PHP will first try to locate a symbol in the current namespace by that name, and then fall back to the global namespace.
This short-circuits the check, which has substantial performance effects in some cases - in particular, ord(), chr() and strlen() show ~1500x faster calls when they are fully qualified.

However, this doesn't mean that PM is getting a massive amount faster. In real world terms, this translates to about 10-15% performance improvement.
But before anyone gets excited, you should know that the CodeOptimizer in the PreProcessor repo has been applying fully-qualified symbol optimizations to Jenkins builds for years, which is one of the reasons why Jenkins builds have better performance than home-built or source installations.
We're choosing to do this for the sake of future SafePHP integration and also to be able to get rid of the buggy CodeOptimizer, so that phar and source are more consistent.
2019-01-04 20:43:15 +00:00
3a85e6cab9 Backport ce58294305 for 3.x line 2018-08-30 15:46:26 +01:00
05af87e1d4 Strip empty lines at the end of classes 2018-06-11 13:19:23 +01:00
81957d133d AsyncTask: Rewrite how thread-local storage works, now non-dependent on Server or ServerScheduler
this implementation was god-awful bad and it was entirely avoidable to make it this complicated.

This utilizes the fact that pthreads treats static properties as thread-local. AsyncTask local storage now utilizes a \SplObjectStorage stored in an AsyncTask private static field.
2018-05-29 19:41:00 +01:00
033cb8bd63 oops, wrong namespace 2018-01-28 13:08:11 +00:00
0ed9fcb641 Restrict VerifyLoginTask exception handling to known exceptions
everything else should produce a nice big stack trace for debugging purposes, because everything else is probably bugs

This fixes random exception error messages getting relayed to the client when a user does stupid things like editing the source code without knowing what they are doing.
2018-01-28 13:07:09 +00:00
fd5557861b Changed how login verification is handled, add more useful error messages
closes #1955
2018-01-28 14:13:59 +00:00
4f8e4f0522 Add EOF newlines where missing (bulk) (#1836)
This should solve issues with people making GitHub PRs and having the web editor messing things up. GitHub Web Editor sucks :(
2017-12-20 11:56:36 +00:00
74b074753f Bulk addition of constant visibilities
thanks PhpStorm inspections plugin for annoying the shit out of me until
I did this.
2017-11-21 14:44:10 +00:00
86b76bfcab Fixed trying to get pubkey that doesn't exist in VerifyLoginTask
bug was exposed by previous commit
2017-09-28 18:14:53 +01:00
d0bf0ff083 Imports cleanup 2017-09-28 10:51:05 +01:00
7a77bb0402 Login verification: guilty until proven innocent
assume it's invalid until we've verified everything
2017-09-27 10:29:01 +01:00
03d3e595d6 Implement JWT signature verification and Xbox Live checks, close #315
This can be enabled or disabled using the "online-mode" directive in
server.properties.

NOTE: For safety reasons it is enabled by default, since many naive server owners currently believe that authentication is not needed because "the client is forced to sign-in".
Newsflash for readers: the forced authentication is easily bypassed using a LAN proxy.

Un-authenticated LAN connections will still work fine if the online mode is disabled.

Added the following API methods:
- Server->getOnlineMode() : bool
- Server->requiresAuthentication() : bool
- Player->isAuthenticated() : bool

JWT verification is rather expensive, so it is done in an AsyncTask. Make sure you don't hog your worker threads.
2017-09-25 12:30:58 +01:00