> ⚠️ **Rollback hazard — one-way door once logins are taken.** Serialization is unchanged, so a save > written by this build still *loads* on the previous one. Its contents do not survive the trip: on > its first successful login each account is rehashed to `$argon2id$`, and the previous build ships > Argon2.Bindings 1.19.0, whose `Verify` is gated by the verifier's own configured type and answers > `false` for an `$argon2id$` hash. **After a shard running this build has accepted logins, do not > roll back past this commit** — every account that logged in is locked out on the older binary, and > the only recovery is rolling forward again or resetting passwords by hand. Roll back only from a > save taken before the first post-deploy login. Requires [Argon2.Bindings 1.20.0](https://github.com/modernuo/Argon2.Bindings/pull/14), now published. ## What - Consume `Argon2.Bindings` 1.20.0, which resolves the Argon2 type from the stored PHC string rather than from the verifier's own configuration. - Default to **Argon2id, m=16384, t=1, p=1** — 8.51 ms against the old Argon2i 8 MiB t=3 at 10.11 ms. Cheaper *and* stronger. - Rehash on a successful login whenever the stored parameters are stale, not only when the algorithm changes. - Fix `SetPassword`, which derived the password phrase from the outgoing algorithm while storing it under the incoming one. ## Why **Verification was gated by the verifier's configured type.** `Verify` passed the instance's own `ArgonType` to native `argon2_verify`, whose `decode_string` rejects a disagreeing `$argon2i$`/`$argon2id$` prefix and returns `DECODING_FAIL` — folded into `false`, the same answer as a wrong password. Switching the default type would have locked out every existing account, and `VerifyAndUpdate` could not have migrated them either: it delegates to the same type-fixed `Verify` and never compared `ArgonType`. Fixed upstream in 1.20.0. The pinned legacy-`$argon2i$` test here fails on 1.19.0 for exactly that reason, which is what makes the package bump load-bearing rather than incidental. **Changing the defaults would otherwise have reached nobody.** Argon2's PHC string embeds `m`, `t` and `p`, so verification uses the parameters stored with each account, not the configured ones — and verification is the hot path. `CheckPassword` only rehashed when the *algorithm* changed, never when its cost parameters did, so on an established shard the new defaults would have applied to new accounts only. `IPasswordProtection.NeedsRehash` closes that: it defaults to `false`, so PBKDF2 and the `HashAlgorithm` protections are untouched — only Argon2 carries its cost inside the stored value. **`SetPassword` picked the phrase rule from the wrong algorithm.** SHA1 and SHA2 salt the phrase with the username; Argon2 and PBKDF2 do not. It chose the rule from the *outgoing* algorithm while storing under the *incoming* one, so any algorithm change wrote a credential its own next verify could not reproduce. It now assigns `PasswordAlgorithm` first and derives the phrase from that. Note this ordering is load-bearing and invisible — `UpgradingAlgorithm_DoesNotLockTheAccountOut` is what pins it. ## Cost Verification is re-derivation, so these are login numbers. A full login calls `CheckPassword` twice — `AccountLogin` (0x80) then `GameLogin` (0x91): **~20 ms before, ~17 ms after**, plus a one-time ~8.5 ms rehash on each account's migrating login. That cost is still paid on the game loop. Moving hashing off-loop is deliberately **not** in this PR — it needs a pending-auth state in the login handlers, bounding of in-flight hashes, and login rate limiting.
165 lines
7 KiB
C#
165 lines
7 KiB
C#
using System;
|
|
using System.IO;
|
|
using System.Reflection;
|
|
using System.Threading;
|
|
using Server.Items;
|
|
using Server.Misc;
|
|
using Server.Movement;
|
|
using Server.PathAlgorithms;
|
|
using Server.Tests.Maps;
|
|
|
|
namespace Server.Tests;
|
|
|
|
/// <summary>
|
|
/// Single, process-wide ModernUO bootstrap for the UOContent test host. Mirrors Server.Tests'
|
|
/// TestServerInitializer in name and shape; kept as a separate (non-shared) copy because this
|
|
/// one loads the UOContent assembly and configures the UOContent-specific systems. Both types
|
|
/// are <c>internal</c> so the shared name stays scoped to each assembly.
|
|
///
|
|
/// ModernUO bootstraps its global singletons (Core, ServerConfiguration, AssemblyHandler,
|
|
/// NetState/io-ring, World, Timer, the serialization workers, and TileData) exactly once per
|
|
/// process. <see cref="World.Load"/> is guarded to run once, and
|
|
/// <see cref="World.ExitSerializationThreads"/> must run once against the live workers. Each
|
|
/// xUnit collection gets its own fixture instance, so this guard makes the bootstrap run a
|
|
/// single time regardless of how many collection fixtures are constructed. The two stateful
|
|
/// collections use <c>[CollectionDefinition(DisableParallelization = true)]</c> so they never
|
|
/// overlap; pure tests still run in parallel.
|
|
/// </summary>
|
|
internal static class TestServerInitializer
|
|
{
|
|
private static bool _initialized;
|
|
private static readonly Lock _lock = new();
|
|
|
|
/// <summary>
|
|
/// True if the UO client tile data was found and loaded. When false (e.g. CI, where the
|
|
/// copyrighted client files are absent), tile/map/multi-dependent tests must skip rather than
|
|
/// fail. Guard such tests with <c>Skip.If(!TestServerInitializer.TileDataLoaded, ...)</c>.
|
|
/// </summary>
|
|
public static bool TileDataLoaded { get; private set; }
|
|
|
|
public static void Initialize()
|
|
{
|
|
lock (_lock)
|
|
{
|
|
if (_initialized)
|
|
{
|
|
return;
|
|
}
|
|
|
|
Core.ApplicationAssembly = Assembly.GetExecutingAssembly();
|
|
Core.LoopContext = new EventLoopContext();
|
|
Core.Expansion = Expansion.EJ;
|
|
|
|
ServerConfiguration.Load(true);
|
|
ServerConfiguration.AssemblyDirectories.Add(Core.BaseDirectory);
|
|
|
|
// Required for the pathfinding tests (real .mul tile data). Harmless for the rest.
|
|
var clientFiles = Environment.GetEnvironmentVariable("MODERNUO_TEST_DATA_DIR")
|
|
?? @"C:\Ultima Online Classic";
|
|
ServerConfiguration.DataDirectories.Add(clientFiles);
|
|
|
|
AssemblyHandler.LoadAssemblies(["Server.dll", "UOContent.dll"]);
|
|
|
|
SkillsInfo.Configure();
|
|
|
|
// Seed the loop clock as Main.cs does before the Configure sweep; otherwise Core.Now is
|
|
// DateTime.MinValue for the whole test host.
|
|
Core._now = DateTime.UtcNow;
|
|
|
|
// Timer wheel must exist before NetState.Configure(), which schedules a recurring
|
|
// sweep via Timer.DelayCall (matches production ordering in Main.cs: Timer.Init runs
|
|
// before AssemblyHandler.Invoke("Configure")).
|
|
Timer.Init(0);
|
|
Server.Network.NetState.Configure();
|
|
TestMapDefinitions.ConfigureTestMapDefinitions();
|
|
|
|
// TileData's static cctor short-circuits when running under xUnit
|
|
// (see Server/TileData.cs:295). Force-load via reflection so LandTable/ItemTable
|
|
// flags are populated before anything that reads TileData (MultiData, MovementImpl,
|
|
// CheckMovement). Without this, TileData.MaxItemValue is 0 at MultiData.Configure()
|
|
// time, causing every MCL tile ID to be masked to 0 and stored as ID=0 in Tiles[x][y].
|
|
// The copyrighted client files are absent on CI; when tiledata.mul is missing we skip
|
|
// the tile/map/multi-dependent bootstrap and leave TileDataLoaded false so those tests
|
|
// skip instead of failing the whole collection from the fixture constructor.
|
|
TileDataLoaded = TryForceLoadTileData();
|
|
|
|
// Production runs every static Configure() via AssemblyHandler.Invoke("Configure");
|
|
// the fixture calls a curated subset, so configure the pathfinding singleton here so
|
|
// BitmapAStarAlgorithm.Instance carries its configured MaxSearchNodes before any test
|
|
// calls Find. ServerConfiguration is already loaded above, so the setting resolves.
|
|
BitmapAStarAlgorithm.Configure();
|
|
|
|
if (TileDataLoaded)
|
|
{
|
|
// Multi component lists (multi.mul / MultiCollection.uop). Production invokes this via
|
|
// AssemblyHandler.Invoke("Configure"); the curated fixture subset must call it so that
|
|
// BaseMulti.Components (MultiData.GetComponents) returns real footprints instead of
|
|
// MultiComponentList.Empty. Required by the Multi pathfinding tests. Depends on the
|
|
// client files, so it only runs when tile data loaded.
|
|
MultiData.Configure();
|
|
}
|
|
|
|
World.Configure();
|
|
// Registers the Accounts entity persistence, without which Accounts.NewAccount cannot
|
|
// resolve and no test can construct an Account.
|
|
Server.Accounting.Accounts.Configure();
|
|
RaceDefinitions.Configure();
|
|
MovementImpl.Configure();
|
|
PathFollower.Configure();
|
|
World.Load();
|
|
World.ExitSerializationThreads();
|
|
DecayScheduler.Configure();
|
|
Server.Engines.Spawners.SpawnerJsonSerializer.Configure();
|
|
|
|
if (TileDataLoaded)
|
|
{
|
|
VerifyTrammelTileDataLoaded();
|
|
}
|
|
|
|
_initialized = true;
|
|
}
|
|
}
|
|
|
|
private static bool TryForceLoadTileData()
|
|
{
|
|
var tileDataPath = Core.FindDataFile("tiledata.mul", false);
|
|
if (string.IsNullOrEmpty(tileDataPath) || !File.Exists(tileDataPath))
|
|
{
|
|
return false;
|
|
}
|
|
|
|
var loadMethod = typeof(TileData).GetMethod(
|
|
"Load",
|
|
BindingFlags.Static | BindingFlags.NonPublic
|
|
);
|
|
if (loadMethod == null)
|
|
{
|
|
throw new InvalidOperationException(
|
|
"TileData.Load not found via reflection — engine may have refactored."
|
|
);
|
|
}
|
|
loadMethod.Invoke(null, null);
|
|
return true;
|
|
}
|
|
|
|
private static void VerifyTrammelTileDataLoaded()
|
|
{
|
|
var trammel = Map.Maps[1];
|
|
if (trammel == null)
|
|
{
|
|
throw new InvalidOperationException(
|
|
"Trammel (mapId=1) was not registered. Check TestMapDefinitions."
|
|
);
|
|
}
|
|
|
|
var tile = trammel.Tiles.GetLandTile(1500, 1600);
|
|
if (tile.ID == 0)
|
|
{
|
|
throw new InvalidOperationException(
|
|
$"Trammel tile data did not load — GetLandTile(1500,1600) returned ID 0. " +
|
|
$"Verify Distribution/Data/map1*.mul (or map1LegacyMUL.uop) is present at " +
|
|
$"{Path.Combine(Core.BaseDirectory, "Data")}."
|
|
);
|
|
}
|
|
}
|
|
}
|