I am writing a game server plugin, and writing a web interface to control it. I am considering detouring the GetPacket() function in the game server, and sending custom packets from my web panel and using GetPacket() to interpret them. My only concern is security as obviously I don't want to just send open data out. What can I read up on as far as packet encryption goes between a php script and a c++ application?
+1
A:
You should be careful, you are getting into some difficult territory. My first reaction to this post is that your probably don't need encryption. Keep in mind that you can't keep a secret from the user. The user can use a debugger and obtain any data passed to GetPacket() very easily.
But, if you need to keep secrets from other people on the network then you do need to use encryption. To do this with VERY securely and simply you should use what has already available to everyone: OpenSSL. You can purchase a real SSL certificate for the server that is running your PHP code for about $30. Then you can use the C++ OpenSSL library to connect over HTTPS.
Rook
2010-01-20 21:08:39
Well in general most of the data being passed will just be commands. I suppose what I could do is add in some checking to make sure the data came from the web server, although I guess the IP could always be spoofed.My main worry is im going to be allowing the web panel to run commands on the game server, and if someone was to start spoofing the web server's IP address, and recreate the packets, they would be able to take control of a users server. Im not worried about the users themselves getting the information, just don't want anyone picking it up along the way.
Brett Powell
2010-01-20 21:42:17
SSL was built to prevent that exact attack. If you have a real SSL certificate then OpenSSL will verify that the cert actually belongs to your server. If someone uses a popular attack like DNS poising to redirect your domain name, then the the OpenSSL connection will throw an error and you can bail out of the connection on the client side. So this sounds perfect for your needs.
Rook
2010-01-20 22:16:34