olcxjas-softworks/LarpixServer
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

improve voice chat security by implementing join validation
All checks were successful
Server Build / publish (push) Successful in 29s
Details
Voice Build / publish (push) Successful in 24s
Details

Browse source
This commit is contained in:
olcxja 2026-08-24 15:01:32 +02:00
commit 1915198d82
7 changed files with 392 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

69
LarpixVoice/Utils.cs
View file

@ -5,7 +5,19 @@ public class Utils
public static int PORT = 8091;
public static int MAIN_PORT = 8090;
public static string SERVER_KEY = "SecretThingOMGSoHardToGuess";
public static string MAIN_URL = "";
// Rate limits, requests per minute (fixed 60s window).
public static int ROOM_USERS_RATE_LIMIT = 120;
// Shared with the main server: authenticates internal validation requests.
public static string VOICE_KEY = "";
private static readonly System.Net.Http.HttpClient AuthHttp = new()
{
Timeout = TimeSpan.FromSeconds(3)
};
public static void LoadEnv()
{
if (File.Exists(".env"))
@ -44,5 +56,60 @@ public class Utils
MAIN_PORT = int.Parse(port);
}
SERVER_KEY = Environment.GetEnvironmentVariable("SERVER_KEY") ?? SERVER_KEY;
VOICE_KEY = Environment.GetEnvironmentVariable("VOICE_KEY") ?? VOICE_KEY;
MAIN_URL = Environment.GetEnvironmentVariable("MAIN_URL") ?? $"http://127.0.0.1:{MAIN_PORT}";
string? roomUsersRateLimitStr = Environment.GetEnvironmentVariable("ROOM_USERS_RATE_LIMIT");
if (roomUsersRateLimitStr != null && int.TryParse(roomUsersRateLimitStr, out int parsedRoomUsersLimit))
{
ROOM_USERS_RATE_LIMIT = parsedRoomUsersLimit;
}
}
// Asks the main server to validate (and atomically consume) the ticket
// blob presented on a connection's first frame. Fail-closed: any network
// problem, bad HMAC, timeout or "deny" response rejects the connection.
public static async Task<bool> AuthorizeConnection(string publicId, string iv, string ct, string roomId, ulong userId)
{
if (string.IsNullOrEmpty(VOICE_KEY) || string.IsNullOrEmpty(MAIN_URL)) return false;
try
{
long ts = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
string body = System.Text.Json.JsonSerializer.Serialize(
new VoiceAuthBody(roomId, userId.ToString(), publicId, iv, ct),
JsonAppSerializerContext.Default.VoiceAuthBody
);
byte[] keyBytes = System.Security.Cryptography.SHA256.HashData(System.Text.Encoding.UTF8.GetBytes(VOICE_KEY));
using var hmac = new System.Security.Cryptography.HMACSHA256(keyBytes);
string mac = System.Buffers.Text.Base64Url.EncodeToString(
hmac.ComputeHash(System.Text.Encoding.UTF8.GetBytes($"{ts}.{body}"))
);
using var request = new System.Net.Http.HttpRequestMessage(System.Net.Http.HttpMethod.Post, $"{MAIN_URL}/_larpix/voice/auth");
request.Headers.Add("X-Voice-Ts", ts.ToString());
request.Headers.Add("X-Voice-Mac", mac);
request.Content = new System.Net.Http.StringContent(body, System.Text.Encoding.UTF8, "application/json");
using System.Net.Http.HttpResponseMessage response = await AuthHttp.SendAsync(request);
if (!response.IsSuccessStatusCode)
{
Console.WriteLine($"Voice auth: main HTTP {(int)response.StatusCode}");
return false;
}
string content = await response.Content.ReadAsStringAsync();
if (content.Trim() != "ok")
{
Console.WriteLine($"Voice auth: main denied ({content.Trim()})");
return false;
}
return true;
}
catch (Exception ex)
{
Console.WriteLine($"Voice auth: validation request failed ({ex.Message})");
return false;
}
}
}