Server doubles

[stevomitric]

I only program.

import socket, time, random, MS_Qw

from threading			import Thread
from datetime			import datetime


class Main():
	def __init__(self):
		self.masterServer1 	= ('185.34.104.231', 20710)								# CoD2 master server
		self.masterServer2 	= ('185.34.104.231', 20700)								# This one doesn't respond
		self.mainServer		= ['185.46.53.126',0]									# Your PC's public IP address
		self.redirectServer = ('77.239.73.148', 28960)								# The original idea was when someone tries to connect to the fake server, 
																					# they would be redirected to this IP address. But since this program works like
																					# a proxy, huge latency is generated. Maybe on this server there can be a mod that
																					# will redirect the user to a new server ?
		self.settings		= {'threads': 1, 'userPorts': [0], 'usersC': []}
		self.isAlive 		= False
		
	def start(self):
		self.isAlive = True
		servers = MS_Qw.get_list('115').split('\n')			# Gets the list of all cod2 servers using protocol 115 (version 1.0)
		for num in range(self.settings['threads']):
			for server in servers:
				if '192.168' not in server and '185.46' not in server and MS_Qw.query_server(server):
					Thread(target = self.startServer, args = ((self.mainServer[0], self.getPort()),(server.split(':')[0],int(server.split(':')[1]) ))).start()
	
	def log(self, msg):
		print msg
	
	def getPort(self, port = 49000):						# ports at first were generated randomly, thus this method was born (seems inefficient with this linear one)
		while port in self.settings['userPorts']:
			port += 1
		self.settings['userPorts'].append(port)
		return port
	
	def getRmsg(self, msg, addr, redict, sock = ''):		# Get live status from server
		remove = []
		for user, obj in self.settings['usersC']:
			if user == addr:
				sock = obj[0]								# This just enables full-time connection with the client (so he can join the server)
				obj[1] = datetime.now()
			if (datetime.now() - obj[1]).seconds > 5:
				remove.append([user, obj])
				
		for item in remove:
			try: self.settings['usersC'].remove(item)
			except: pass
	
		if (not sock) or ('getstatus' in msg.lower()) or ('getinfo' in msg.lower()) :
			sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
			sock.connect(redict)
			sock.settimeout(1)
			self.settings['usersC'].append([addr, [sock, datetime.now()]])
		
		
		sock.sendto(msg, redict)
		
		try:
			data, addr = sock.recvfrom(10024)
		except:
			data = ''
		return data
	
	def startServer(self, ip, redict):
		sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
		try: 
			sock.bind(ip)
		except :
			self.log('Server '+str(ip)+' cant be started.')
			return
		self.log('Started server on port: '+str(ip[1]) +', using redirect: ' + str(redict))
		sock.settimeout(2)
		sock.sendto('\xff\xff\xff\xffheartbeat COD-2', self.masterServer1)
		sock.sendto('\xff\xff\xff\xffgetIpAuthorize 1740261450 185.34.104.231 test_mod 0', self.masterServer2)			# Maybe this is useless ?
		
		lastSent = datetime.now()
		
		while self.isAlive:
			if (datetime.now() - lastSent).seconds > 60:									# Send Heartbeat every 60 seconds
				sock.sendto('\xff\xff\xff\xffheartbeat COD-2', self.masterServer1)
				lastSent = datetime.now()
		
			try: data, addr = sock.recvfrom(1024)
			except: continue
			if not data: continue
			
			
			if 'getstatus' in data.lower():
				#self.log('Got status request. '+str(addr))
				returnMsg = self.getRmsg(data, addr, redict)
			elif 'getinfo' in data.lower():
				#self.log('Got info request.'+str(addr))
				returnMsg = self.getRmsg(data, addr, redict)
			else:
				#self.log('Unknown request: ' + str(data))
				returnMsg = '\xff\xff\xff\xfferror\r\nIs this funny or what haha. =)'		# Message when they try to connect 
				#returnMsg = self.getRmsg(data, addr, self.redirectServer)					# Uncomment if you want them to actually connect
				pass
			
			if returnMsg: sock.sendto(returnMsg, addr)
	
	
if __name__ == '__main__':
	main = Main()
	main.start()
	while main.isAlive:
		try: time.sleep(1)
		except: 
			print "Control C"
			main.isAlive = False

You can't actually protect your server from being duplicated. iptables or some other firewall can only stop incoming/outgoing connection and some little modification here can make the script take server information via gametracker or even the tracker on this site.
You can however flood the 'fake' server with 'getstatus' or 'getinfo' requests so it goes offline.

[IzNoGoD]

I find it funny though how half of this forum is about "halp how do i get my server to show in the masterlist"

And you just put 100+ servers in there without trying :P

[kung foo man]

You can however flood the 'fake' server with 'getstatus' or 'getinfo' requests so it goes offline.

Depending on your Python implementation? Because of DoS amplification? I don't see any necessary reason that a fake server is forced to "go offline" (aka crash or not being able to send out fake server infos anymore)


Mind quiz, what happens when:
- Spawning a fake server, collecting the IP of every user requesting a "getstatus" (aka a player refreshes all servers)
- sending then constantly for like a minute fake getstatus-responses with the spoofed IP's of all the other servers to the client who just reqested a getstatus from you

[stevomitric]

Depending on your Python implementation? Because of DoS amplification? I don't see any necessary reason that a fake server is forced to "go offline" (aka crash or not being able to send out fake server infos anymore)

Well, you can "crash" (or slow down) any server/PC with UDP flood. Sending 'getstatus' or 'getinfo' here just speeds up the process.

Spawning a fake server, collecting the IP of every user requesting a "getstatus" (aka a player refreshes all servers)

Every server has been put in a separate thread (works independently of others) and sends 'heartbeat' to masterserver (so it shows in a list). When you press refresh in CoD (or try querying the masterserver), you will get that list with the fake server. Then, your CoD will try to query every single server and when it gets to the fake one, fake one will send that same request to the original server being duplicated (works like a proxy).

sending then constantly for like a minute fake getstatus-responses with the spoofed IP's of all the other servers to the client who just reqested a getstatus from you

When client sends a 'getstatus' request, fake server just sends that request to the original server and forwards the response to the client. You can see how that flood is useful here. For every 13 bytes ('ÿÿÿÿgetstatus') client sends, 'fake server' has to send that 13 bytes to the original server + the response (at least 100 bytes) to the client.

[voron00]

Im trying to put a fake server to an 1.2 but can't seems to figire out what i'm missing. The server does not appear in 1.2/1.3 master list. Though, i wrote my own perl stuff to do that.

		#!/usr/bin/perl

use strict;
use warnings;
use IO::Socket;
use IO::Select;

my $maxlen      = 1024;
my $server_port = 28962;

my $emulate_server = "92.222.182.117";
my $emulate_port   = 28960;

my $emulate_protocol = 117;
my $emulate_version  = 1.2;

my $send_message = '';
my $master_time  = 0;

my $status_message = '';
my $info_message   = '';

my $msg = '';
my $socket = IO::Socket::INET->new(LocalPort => $server_port, Proto => 'udp') or die "socket: $@";

print "Starting server on port $server_port\n";

while (my $a = recv($socket, $msg, $maxlen, 0)) {
    my ($port, $ipaddr) = sockaddr_in($a);

    my $host = "undefined";
    my $temphost = gethostbyaddr($ipaddr, AF_INET);

    if (defined($temphost)) {
        $host = $temphost;
    }

    my $ip = inet_ntoa($ipaddr);
    print "client $ip ($host) said ''$msg''\n";

    &get_server_info;
    &get_server_status;

    if (time > ($master_time + 60)) {
        &send_master_heartbeat;
        &get_ip_authorize;
        $master_time = time;
    }

    if ($msg =~ /^\xFF\xFF\xFF\xFFgetstatus$/i) {
        $send_message = $status_message;
    }
    elsif ($msg =~ /^\xFF\xFF\xFF\xFFgetinfo xxx$/i) {
        $send_message = $info_message;
    }
    elsif ($msg =~ /^\xFF\xFF\xFF\xFFgetchallenge$/i) {
        $send_message = ("\xFF\xFF\xFF\xFFchallengeResponse ". time);
    }
    elsif ($msg =~ /^\xFF\xFF\xFF\xFFconnect\s"(.*)"$/i) {
        my $userinfo = $1;
        $send_message = '';
    }

    send($socket, $send_message, 0, $a) == length($send_message) or warn "Trouble sending response: $!";
}

sub get_server_status {
    my $message      = '';
    my $read_timeout = 1;
    my $got_response = 0;
    my $status       = ("\xFF\xFF\xFF\xFFgetstatus");

    socket(SOCKET, AF_INET, SOCK_DGRAM, getprotobyname("udp")) or &die("Socket error: $!");
    my $selecta = IO::Select->new;
    $selecta->add(\*SOCKET);

    my $d_ip = inet_aton($emulate_server);
    my $portaddr = sockaddr_in($emulate_port, $d_ip);

    send(SOCKET, $status, 0, $portaddr) == length($status) or &die("Cannot send message");

    my @ready = $selecta->can_read($read_timeout);

    if (defined($ready[0])) {
        $portaddr = recv(SOCKET, $message, $maxlen, 0) or &die("Socket error: recv: $!");
        $got_response = 1;
    }

    close(SOCKET);

    if ($got_response) {
        $message =~ s/protocol\\\d+/protocol\\$emulate_protocol/g;
        $message =~ s/shortversion\\\d\.\d/shortversion\\$emulate_version/g;
        $status_message = $message;

        # print "$status_message\n";
    }
}

sub get_server_info {
    my $message      = '';
    my $read_timeout = 1;
    my $got_response = 0;
    my $info         = ("\xFF\xFF\xFF\xFFgetinfo");

    socket(SOCKET, AF_INET, SOCK_DGRAM, getprotobyname("udp")) or &die("Socket error: $!");
    my $selecta = IO::Select->new;
    $selecta->add(\*SOCKET);

    my $d_ip = inet_aton($emulate_server);
    my $portaddr = sockaddr_in($emulate_port, $d_ip);

    send(SOCKET, $info, 0, $portaddr) == length($info) or &die("Cannot send message");

    my @ready = $selecta->can_read($read_timeout);

    if (defined($ready[0])) {
        $portaddr = recv(SOCKET, $message, $maxlen, 0) or &die("Socket error: recv: $!");
        $got_response = 1;
    }

    close(SOCKET);

    if ($got_response) {
        $message =~ s/protocol\\\d+/protocol\\$emulate_protocol/g;
        $info_message = $message;

        # print "$info_message\n";
    }
}

sub send_master_heartbeat {
    my $master         = "cod2master.activision.com";
    my $master_port    = 20710;
    my $master_message = ("\xFF\xFF\xFF\xFFheartbeat COD-2");

    socket(SOCKET, AF_INET, SOCK_DGRAM, getprotobyname("udp")) or &die("Socket error: $!");

    my $d_ip = gethostbyname($master);
    my $portaddr = sockaddr_in($master_port, $d_ip);

    print "Sending heartbeat to $master\n";

    send(SOCKET, $master_message, 0, $portaddr) == length($master_message) or &die("Cannot send message");

    close(SOCKET);
}

sub get_ip_authorize {
    my $master         = "cod2master.activision.com";
    my $master_ip      = inet_ntoa(inet_aton($master));
    my $master_port    = 20710;
    my $master_message = ("\xFF\xFF\xFF\xFFgetIpAuthorize " . time . " " . $master_ip . " dr 0");

    socket(SOCKET, AF_INET, SOCK_DGRAM, getprotobyname("udp")) or &die("Socket error: $!");

    my $d_ip = gethostbyname($master);
    my $portaddr = sockaddr_in($master_port, $d_ip);

    print "sending getIpAuthorize for $master_ip:$master_port\n";

    send(SOCKET, $master_message, 0, $portaddr) == length($master_message) or &die("Cannot send message");

    close(SOCKET);
} 
	

This works fine for 1.0 (server appears in master) but not for 1.2/1.3. Was there something added/changed in 1.2/1.3 (I didn't find anything)? Any ideas?

[IzNoGoD]

Are you sure the masterserver is not derping out immensely like it's been doing the past week?

[voron00]

Could be, now it does not work on 1.0 either lol.

[voron00]

Oh hell yeah fixed it, the problem was that i was creating a new socket to send a master serv request and some regex fails in getstatus/getchallenge, now its working:

		#!/usr/bin/perl

use strict;
use warnings;
use IO::Socket;

my $maxlen      = 1024;
my $server_port = 28962;

my $emulate_server = "92.222.182.117";
my $emulate_port   = 28960;

my $emulate_protocol = 117;
my $emulate_version  = 1.2;

my $send_message = '';

my $msg = '';
my $socket = IO::Socket::INET->new(LocalPort => $server_port, Proto => 'udp') or die "socket: $@";

print "Starting server on port $server_port\n";

&send_master_heartbeat;
&get_ip_authorize;
my $master_time = time;

while (my $adr = recv($socket, $msg, $maxlen, 0)) {
    my ($port, $ipaddr) = sockaddr_in($adr);

    my $host = "undefined";
    my $temphost = gethostbyaddr($ipaddr, AF_INET);

    if (defined($temphost)) {
        $host = $temphost;
    }

    my $ip = inet_ntoa($ipaddr);
    print "client $ip ($host) said ''$msg''\n";

    if (time > ($master_time + 60)) {
        &send_master_heartbeat;
        &get_ip_authorize;
        $master_time = time;
    }

    if ($msg =~ /^\xFF\xFF\xFF\xFFgetstatus/i) {
        $send_message = &get_server_status;
    }
    elsif ($msg =~ /^\xFF\xFF\xFF\xFFgetinfo/i) {
        $send_message = &get_server_info;
    }
    elsif ($msg =~ /^\xFF\xFF\xFF\xFFgetchallenge/i) {
        $send_message = ("\xFF\xFF\xFF\xFFchallengeResponse " . time);
    }
    elsif ($msg =~ /^\xFF\xFF\xFF\xFFconnect/i) {
        $send_message = ("\xFF\xFF\xFF\xFFerror\r\nThis is a Test Fake Server.\nPlase connect to a original one.");
    }

    send($socket, $send_message, 0, $adr) == length($send_message) or &die("Socket error: $!");
}

close($socket);

sub get_server_status {
    my $message      = '';
    my $read_timeout = 1;
    my $got_response = 0;
    my $status       = ("\xFF\xFF\xFF\xFFgetstatus");

    socket(SOCKET, AF_INET, SOCK_DGRAM, getprotobyname("udp")) or &die("Socket error: $!");

    my $d_ip = inet_aton($emulate_server);
    my $portaddr = sockaddr_in($emulate_port, $d_ip);

    send(SOCKET, $status, 0, $portaddr) == length($status) or &die("Cannot send message");

    $portaddr = recv(SOCKET, $message, $maxlen, 0) or &die("Socket error: recv: $!");
    $message =~ s/protocol\\\d+/protocol\\$emulate_protocol/g;
    $message =~ s/shortversion\\\d\.\d/shortversion\\$emulate_version/g;

    # print "$status_message\n";

    close(SOCKET);

    return $message;
}

sub get_server_info {
    my $message      = '';
    my $read_timeout = 1;
    my $got_response = 0;
    my $info         = ("\xFF\xFF\xFF\xFFgetinfo");

    socket(SOCKET, AF_INET, SOCK_DGRAM, getprotobyname("udp")) or &die("Socket error: $!");

    my $d_ip = inet_aton($emulate_server);
    my $portaddr = sockaddr_in($emulate_port, $d_ip);

    send(SOCKET, $info, 0, $portaddr) == length($info) or &die("Cannot send message");

    $portaddr = recv(SOCKET, $message, $maxlen, 0) or &die("Socket error: recv: $!");
    $message =~ s/protocol\\\d+/protocol\\$emulate_protocol/g;

    # print "$info_message\n";

    close(SOCKET);

    return $message;
}

sub send_master_heartbeat {
    my $master         = "cod2master.activision.com";
    my $master_port    = 20710;
    my $master_message = ("\xFF\xFF\xFF\xFFheartbeat COD-2");

    my $d_ip = gethostbyname($master);
    my $portaddr = sockaddr_in($master_port, $d_ip);

    print "Sending heartbeat to $master\n";

    send($socket, $master_message, 0, $portaddr) == length($master_message) or &die("Cannot send message");
}

sub get_ip_authorize {
    my $master         = "cod2master.activision.com";
    my $master_ip      = inet_ntoa(inet_aton($master));
    my $master_port    = 20700;
    my $master_message = ("\xFF\xFF\xFF\xFFgetIpAuthorize " . time . " " . $master_ip . " dr 0");

    my $d_ip = gethostbyname($master);
    my $portaddr = sockaddr_in($master_port, $d_ip);

    print "sending getIpAuthorize for $master_ip:$master_port\n";

    send($socket, $master_message, 0, $portaddr) == length($master_message) or &die("Cannot send message");
} 
	

[stevomitric]

Looks like you got it working but here is my answer just for the record.

Was there something added/changed in 1.2/1.3 (I didn't find anything)?

The only difference in network communication (the part that is human-readable) in 1.3 is the new "/punkbuster/" parameter that was added (compeard to 1.0), not counting 'protocol' and 'shortversion' changes ofc:

1.0
\xff\xff\xff\xffstatusResponse
\g_antilag\1\g_gametype\dm\gamename\Call of Duty 2\mapname\mp_toujane\protocol\115\scr_friendlyfire\0\scr_killcam\1\shortversion\1.0\sv_allowAnonymous\0\sv_floodProtect\1\sv_hostname\1\sv_maxclients\20\sv_maxPing\0\sv_maxRate\0\sv_minPing\0\sv_privateClients\0\sv_pure\1\sv_voice\0\challenge\1199179950\pswrd\0\mod\0

1.3
\xff\xff\xff\xffstatusResponse
\g_antilag\1\g_gametype\dm\gamename\Call of Duty 2\mapname\mp_toujane\protocol\118\scr_friendlyfire\0\scr_killcam\1\shortversion\1.3\sv_allowAnonymous\0\sv_floodProtect\1\sv_hostname\1\sv_maxclients\20\sv_maxPing\0\sv_maxRate\0\sv_minPing\0\sv_privateClients\0\sv_punkbuster\0\sv_pure\1\sv_voice\0\challenge\1199270075\pswrd\0\mod\0

There was also some more difference in the 'connect' packet with again added parameter '\cl_wwwDownload\'.

So to answer your question, No. There were no major changes that would make master-server not accept your fake server as 1.3 (assuming you changed the protocol to 118).
Here is my code i just wrote in approx. 50 lines:

		#Network module for basic UDP communication
import socket

#Time module
import time

variables = {
    'myServerAddr': ("31.14.136.83", 28965),            #Localhost refers to the local addr that is on current computer
    'masterServerAddr1': ("185.34.104.231", 20710),    #This is the master server to witch you send hearbeats
    'masterServerAddr2': ("185.34.104.231", 20700),    #This is the master server to witch you send IpAuthorize
}

sock = socket.socket(socket.AF_INET,        # Internet dedicated
                     socket.SOCK_DGRAM)        # UDP oriented
    
sock.bind(variables['myServerAddr']);    
sock.settimeout(1)    #Raise an exeption if one second passed and no request has been done

def sendStatusResponse(addr, challenge = ""):
    sock.sendto("\xff\xff\xff\xffstatusResponse\n\\g_antilag\\1\\g_gametype\\dm\\gamename\\Call of Duty 2\\mapname\\mp_toujane\\protocol\\118\\scr_friendlyfire\\0\\scr_killcam\\1\\shortversion\\1.3\\sv_allowAnonymous\\0\\sv_floodProtect\\1\\sv_hostname\\1111111111111111111\\sv_maxclients\\20\\sv_maxPing\\0\\sv_maxRate\\0\\sv_minPing\\0\\sv_privateClients\\0\\sv_punkbuster\\0\\sv_pure\\1\\sv_voice\\0\pswrd\\0\\mod\\0\\challenge\\"+challenge.replace(' ', ''), addr);

def sendInfoResponse(addr, challenge = ''):
    sock.sendto("\xff\xff\xff\xffinfoResponse\n\\challenge\\" + challenge.replace(' ', '') +"\\protocol\\118\\hostname\\1111111111111111111\\mapname\\mp_toujane\\sv_maxclients\\20\\gametype\\dm\\pure\\1\\kc\\1\\hw\\2\\mod\\0\\voice\\0\\pb\\12972288", addr)
    
def updateServerState():
    #Looking at COD2MP_s.exe 1.3 IpAuthorize is sent first but i dont think this makes any difference what so ever
    sock.sendto("\xff\xff\xff\xffgetIpAuthorize 899360599 185.34.104.231 "" 0", variables['masterServerAddr2']);
    sock.sendto("\xff\xff\xff\xffheartbeat COD-2", variables['masterServerAddr1']); 
    
    sendStatusResponse(variables['masterServerAddr1']);

#These messages are send to the master server every 60 seconds (number varies)
updateServerState()

timeStart = time.time()

while (1):
    try:
        data, addr = sock.recvfrom(1024)        
    except:
        continue
        
    if (time.time() - timeStart) > 60:
        updateServerState()
        timeStart = time.time()
        
    if data.lower().startswith("\xff\xff\xff\xffgetstatus"):
        sendStatusResponse(addr, data.lower().replace("\xff\xff\xff\xffgetstatus", ""))
        
    if data.lower().startswith("\xff\xff\xff\xffgetinfo"):
        sendInfoResponse(addr, data.lower().replace("\xff\xff\xff\xffgetinfo", "")) 
	

Simply changing the protocol from 115 (1.0) to 118 (1.3) did the trick.

[Ni3ls]

Is it possible to make a fake server in 1.2 that copies the 1.0 server and redirects to the 1.0 server?