md5

Posted by Javelin on Sun 31 Aug 2003 02:25 AM — 3 posts, 14,673 views.

Javelin USA Sun 31 Aug 2003 02:25 AM #0

Here's an easy one. Pueblo clients ideally send a randomly generated (per connection) md5 cookie with their PUEBLOCLIENT command on connect, like this:

PUEBLOCLIENT md5="32hexdigitshere"

The cookie can be used by the server when instructing the client to do unsafe/annoying things (like playing sound) so that another user can't spoof the server.

As far as I can tell, MUSHclient doesn't do this. How about in a future version? The right way to do this, it appears, is just to get the best possible random value and md5 it.

Cheers, Javelin

Nick Gammon Australia Forum Administrator Sun 31 Aug 2003 03:21 AM #1

It does it. If you turn on packet debug (Edit menu) you will see this as you connect:


Incoming packet: 1 (37 bytes)

This world is Pu   54 68 69 73 20 77 6f 72 6c 64 20 69 73 20 50 75
eblo 1.10 Enhanc   65 62 6c 6f 20 31 2e 31 30 20 45 6e 68 61 6e 63
ed...              65 64 2e 0d 0a

Sent  packet: 1 (58 bytes)

PUEBLOCLIENT 1.1   50 55 45 42 4c 4f 43 4c 49 45 4e 54 20 31 2e 31
0 md5="7082d21db   30 20 6d 64 35 3d 22 37 30 38 32 64 32 31 64 62
7eb7e24db933e49b   37 65 62 37 65 32 34 64 62 39 33 33 65 34 39 62
46a1459"..         34 36 61 31 34 35 39 22 0d 0a

Stripping off the hex part, you get:

PUEBLOCLIENT 1.10 md5="7082d21db7eb7e24db933e49b46a1459"

This is exactly what the spec says:

Quote:

The Pueblo client watches for lines of this form:

This world is Pueblo 1.10 enhanced.

When it sees a line of that form, it sends the World this command:

PUEBLOCLIENT 1.10 md5=”checksum string”

In this example, '1.10' is the version of the Pueblo client sending the command, and the ‘md5’ parameter indicates a secure checksum string.

Javelin USA Sun 31 Aug 2003 03:32 PM #2

Well, doh. Shows me what I get for asking without packet debugging first. Now to figure out why the server's ignoring it...

Thanks, Nick.