Documentation and security fixes
Pre-release
Pre-release
This release adds doxygen documentation for yojimbo.
To build and view the documentation, install doxygen then run:
premake5 docs
It also fixes two critical security issues:
- The challenge token sent back to clients on connection request was encrypted with an AEAD primititive, but the code neglected to increase the nonce each time a new challenge was generated. This made it theoretically possible for an attacker to recover the private key shared between the matcher and dedicated servers.
- When multiple dedicated server instances are running they reuse the same nonce values, starting at 0 and increasing with each challenge token generated, again risking the private key. To fix this issue the challenge token is now encrypted with a random key rolled in Server::Start instead of the private key shared between matcher and dedicated servers.
Please upgrade immediately or you risk an attacker being able to discover your private key.