diff --git a/multiplayer-next.md b/multiplayer-next.md index 6c54fcba..38ca4f4a 100644 --- a/multiplayer-next.md +++ b/multiplayer-next.md @@ -58,8 +58,9 @@ product policy are in [`docs/MATCHMAKING.md`](docs/MATCHMAKING.md). fencing; `server/agones` now submits and validates namespaced `GameServerAllocation` responses, including dynamic address/port data; `server/allocator` now requires provider allocation reconciliation into the - durable registry before returning an endpoint; signed roster publication and - live Agones integration remain. + durable registry before returning an endpoint; durable roster publication + now verifies canonical join-authorisation signatures before exposing player + rows; live Agones integration remains. - [ ] **IN PROGRESS:** Run the Go control plane against PostgreSQL/Redis with independently runnable API, matcher, allocator and maintenance roles. The `cmd/control-plane` API role now opens PostgreSQL, applies migrations, wires diff --git a/multiplayer-todo.md b/multiplayer-todo.md index e6504753..fdb4e87a 100644 --- a/multiplayer-todo.md +++ b/multiplayer-todo.md @@ -1214,7 +1214,7 @@ the local/CI/community transport, not a silent production fallback. | 8.28 `[D:8.6,8.27]` | **IN PROGRESS.** Supervisor separates explicit process-ready from Agones Ready and never scrapes stdout; allocated mode refuses to mark Ready without a configured readiness probe | `server/supervisor/` tests prove Ready follows the probe and direct mode remains functional; `server_control.gd`, `agones_sdk.gd` and process-level smokes prove loopback `/ready`, `/health`, bearer-protected `/drain`, sidecar-shaped Health/Ready calls and drain admission fencing; detached-container and Health-reclaim integration remain | | 8.29 `[D:8.26,8.27]` | **IN PROGRESS.** Supervisor discovers and validates the Agones endpoint, propagates the actual dynamic `--port`, and exports `SDR_LISTEN_PORT`/`SDR_IP` only for Hosted-SDR while preserving an isolated ENet path | `server/supervisor/` tests cover invalid address/port rejection, dynamic port argument/env propagation and SDR-vs-ENet separation; real Agones dynamic/passthrough mapping, POP/cert/firewall/NAT and multi-match fixture remain | | 8.30 `[D:8.18,8.26,8.28,8.29]` | **IN PROGRESS.** Pure Go allocator filters Ready servers by region/build/protocol/transport, atomically claims one with idempotent allocation replay, and now owns the assignment-publication boundary; PostgreSQL adds durable GameServer registration and compatible `SKIP LOCKED` claims with request-digest fencing; `server/agones` submits and validates namespaced `GameServerAllocation` responses and dynamic endpoints; `server/allocator` reconciles provider success into durable state before exposing the endpoint | `server/domain/allocator.go`, `server/store/allocator_sql.go`, `server/agones/allocation.go`, `server/allocator/service.go`, `server/migrations/0004_allocator_registry.sql` and tests cover deterministic compatible selection, exhaustion, conflicting/identical allocation replay, unknown allocations, SQL claim ordering, invalid input, provider error/malformed response/IPv6 endpoint handling, durable-reconciliation failure isolation and assignment replay/conflict; `TestPostgreSQLAllocatorClaimReplayAndCapacityFence` now covers live registration/selection/replay/conflict/no-capacity when the disposable database gate is run; signed roster metadata, bounded cross-replica retry and live integration remain | -| 8.31 `[D:8.9,8.30]` | **IN PROGRESS.** Pure Go assignment gate requires Allocated state, exact allocation ID/match/server/region/build/protocol/transport compatibility, non-empty hosted endpoint and verified manifest signature before exposure; allocator publication cannot expose Ready state | `server/domain/assignment.go` and `allocator.go` plus adversarial fixtures cover early-connect, tampered signature/manifest, wrong compatibility, empty endpoint, unknown allocation and post-publication mutation rejection; Agones metadata watch, hosted-address registration, production signer and client-ticket publication remain | +| 8.31 `[D:8.9,8.30]` | **IN PROGRESS.** Pure Go assignment gate requires Allocated state, exact allocation ID/match/server/region/build/protocol/transport compatibility, non-empty hosted endpoint and verified manifest signature before exposure; allocator publication cannot expose Ready state; durable roster persistence now verifies each canonical join-authorisation signature before publishing player rows | `server/domain/assignment.go`, `allocator.go`, `store/assignment_sql.go` plus adversarial fixtures cover early-connect, tampered signature/manifest, wrong compatibility, empty endpoint, unknown allocation, forged roster signature, valid signature and post-publication mutation rejection; Agones metadata watch, hosted-address registration, production signer and client-ticket publication remain | | 8.32 `[D:8.2,8.26,8.30]` | **IN PROGRESS.** Provider-neutral FleetAutoscaler baseline preserves a two-process Ready buffer, caps warm capacity, and leaves Allocated scale-down independent of the Ready floor; Fleet image references remain digest-pinned for current/rollback pre-pull | `deploy/k8s/base/fleet-autoscaler.yaml` and manifest tests cover Fleet ownership, Buffer policy and floor/cap invariants; regional on-demand node pools/failure domains, pre-pull rollout, warm-allocation p95/p99 and N+1 certification remain | | 8.33 `[D:8.26,8.32]` | **IN PROGRESS.** Fleet scheduling now requires on-demand capacity and spreads Ready processes across zones with skew 1; the autoscaler preserves the two-process Ready floor | `deploy/k8s/base/fleet.yaml` and manifest tests reject interruptible placement and single-zone concentration structurally; regional node pools, forced node-loss testing and measured N+1 headroom remain | | 8.34 `[D:8.28,8.29]` | Native x86_64 benchmark of boot-to-process-ready and assignment-ready, p99 CPU/RSS/network and 60 Hz ticks; limits/node cap with 30% headroom | Measurements replace old estimates and certify density with no tick backlog | diff --git a/server/store/assignment_sql.go b/server/store/assignment_sql.go index d64c20eb..31830b2a 100644 --- a/server/store/assignment_sql.go +++ b/server/store/assignment_sql.go @@ -132,16 +132,16 @@ func SaveAssignments(ctx context.Context, db *sql.DB, assignments []DurableAssig // SaveVerifiedAssignmentRoster converts the backend-verified signed roster to // player-scoped rows. It rechecks the claims at this persistence boundary so a // caller cannot accidentally publish a token for another match or slot. -func SaveVerifiedAssignmentRoster(ctx context.Context, db *sql.DB, assignment domain.Assignment, roster []domain.SignedJoinAuthorisation) error { - if assignment.Allocation.State != domain.ServerAllocated || len(roster) == 0 { +func SaveVerifiedAssignmentRoster(ctx context.Context, db *sql.DB, assignment domain.Assignment, roster []domain.SignedJoinAuthorisation, verify func([]byte, []byte) bool) error { + if assignment.Allocation.State != domain.ServerAllocated || len(roster) == 0 || verify == nil { return fmt.Errorf("invalid verified assignment roster") } digest := domain.ManifestDigest(assignment.Manifest) rows := make([]DurableAssignment, 0, len(roster)) for _, signed := range roster { auth := signed.Authorisation - if len(signed.Signature) == 0 || auth.MatchID != assignment.Allocation.MatchID || auth.ServerID != assignment.Allocation.ServerID || auth.Protocol != strconv.Itoa(assignment.Allocation.Protocol) || auth.PlayerID == "" || auth.Slot < 0 || auth.Slot > 5 || auth.ExpiresAt.IsZero() { - return fmt.Errorf("invalid signed assignment roster") + if err := validateSignedRosterEntry(assignment, signed, verify); err != nil { + return err } envelope, err := json.Marshal(signed) if err != nil { @@ -159,6 +159,14 @@ func SaveVerifiedAssignmentRoster(ctx context.Context, db *sql.DB, assignment do return SaveAssignments(ctx, db, rows) } +func validateSignedRosterEntry(assignment domain.Assignment, signed domain.SignedJoinAuthorisation, verify func([]byte, []byte) bool) error { + auth := signed.Authorisation + if len(signed.Signature) == 0 || verify == nil || !verify(domain.JoinAuthorisationBytes(auth), signed.Signature) || auth.MatchID != assignment.Allocation.MatchID || auth.ServerID != assignment.Allocation.ServerID || auth.Protocol != strconv.Itoa(assignment.Allocation.Protocol) || auth.PlayerID == "" || auth.Slot < 0 || auth.Slot > 5 || auth.ExpiresAt.IsZero() { + return fmt.Errorf("invalid signed assignment roster") + } + return nil +} + func GetAssignment(ctx context.Context, db *sql.DB, playerID, matchID string, now time.Time) (DurableAssignment, error) { if db == nil || playerID == "" || matchID == "" || now.IsZero() { return DurableAssignment{}, fmt.Errorf("invalid assignment recovery arguments") diff --git a/server/store/assignment_sql_test.go b/server/store/assignment_sql_test.go index 2d781e47..dbc8e076 100644 --- a/server/store/assignment_sql_test.go +++ b/server/store/assignment_sql_test.go @@ -39,7 +39,22 @@ func TestAssignmentStoreRejectsInvalidBatches(t *testing.T) { if err := SaveAssignments(nil, nil, []DurableAssignment{{MatchID: "match-1", PlayerID: "player-1"}}); err == nil { t.Fatal("invalid assignment batch accepted") } - if err := SaveVerifiedAssignmentRoster(nil, nil, domain.Assignment{}, nil); err == nil { + if err := SaveVerifiedAssignmentRoster(nil, nil, domain.Assignment{}, nil, nil); err == nil { t.Fatal("empty verified roster accepted") } } + +func TestSignedRosterRequiresCryptographicVerification(t *testing.T) { + now := time.Unix(1000, 0) + assignment := domain.Assignment{Allocation: domain.Allocation{AllocationID: "allocation-1", MatchID: "match-1", ServerID: "server-1", Region: "EU", Build: "build-1", Protocol: 1, Transport: "enet", State: domain.ServerAllocated}, Manifest: domain.AllocationManifest{AllocationID: "allocation-1", MatchID: "match-1", ServerID: "server-1", Region: "EU", Build: "build-1", Protocol: 1, Transport: "enet", RosterDigest: "roster-1"}, Endpoint: "127.0.0.1:7777"} + auth := domain.JoinAuthorisation{MatchID: "match-1", ServerID: "server-1", PlayerID: "player-1", SteamID: "steam-1", Slot: 0, Team: 0, Protocol: "1", Generation: 1, ExpiresAt: now.Add(time.Minute)} + signed := domain.SignedJoinAuthorisation{Authorisation: auth, Signature: []byte("signature")} + if err := validateSignedRosterEntry(assignment, signed, func([]byte, []byte) bool { return false }); err == nil { + t.Fatal("forged signature accepted") + } + if err := validateSignedRosterEntry(assignment, signed, func(message, signature []byte) bool { + return string(message) == string(domain.JoinAuthorisationBytes(auth)) && string(signature) == "signature" + }); err != nil { + t.Fatalf("valid signature rejected: %v", err) + } +}