Skip to content

Documentation and security fixes

Pre-release
Pre-release
Compare
Choose a tag to compare
@gafferongames gafferongames released this 05 Jan 05:08

This release adds doxygen documentation for yojimbo.

To build and view the documentation, install doxygen then run:

premake5 docs

It also fixes two critical security issues:

  1. The challenge token sent back to clients on connection request was encrypted with an AEAD primititive, but the code neglected to increase the nonce each time a new challenge was generated. This made it theoretically possible for an attacker to recover the private key shared between the matcher and dedicated servers.
  2. When multiple dedicated server instances are running they reuse the same nonce values, starting at 0 and increasing with each challenge token generated, again risking the private key. To fix this issue the challenge token is now encrypted with a random key rolled in Server::Start instead of the private key shared between matcher and dedicated servers.

Please upgrade immediately or you risk an attacker being able to discover your private key.