Adding enhancement #76 (server password). The server password is checked during init, in addition to possible player auth. It can be set as option "ServerPassword" in config.xml, on client and server.

src/net/common/clientstate.cpp

@@ -944,6 +944,14 @@ ClientStateStartSession::InternalHandlePacket(boost::shared_ptr<ClientThread> cl
 			InitMessage_t *netInit = &init->GetMsg()->choice.initMessage;
 			netInit->requestedVersion.major = NET_VERSION_MAJOR;
 			netInit->requestedVersion.minor = NET_VERSION_MINOR;
+			if (!context.GetServerPassword().empty())
+			{
+				netInit->authServerPassword =
+						OCTET_STRING_new_fromBuf(
+							&asn_DEF_OCTET_STRING,
+							context.GetServerPassword().c_str(),
+							context.GetServerPassword().length());
+			}
 			netInit->login.present = login_PR_unauthenticatedLogin;
 			UnauthenticatedLogin_t *noauthLogin = &netInit->login.choice.unauthenticatedLogin;
 			OCTET_STRING_fromBuf(&noauthLogin->nickName,
@@ -953,7 +961,7 @@ ClientStateStartSession::InternalHandlePacket(boost::shared_ptr<ClientThread> cl
 			if (!avatarFile.empty()) {
 				MD5Buf tmpMD5;
 				if (client->GetAvatarManager().GetHashForAvatar(avatarFile, tmpMD5)) {
-					// TODO: use sha1.
+					// Send MD5 hash of avatar.
 					noauthLogin->avatar =
 						OCTET_STRING_new_fromBuf(
 							&asn_DEF_OCTET_STRING,
@@ -1019,6 +1027,14 @@ ClientStateWaitEnterLogin::TimerLoop(const boost::system::error_code& ec, boost:
 						context.GetSessionGuid().c_str(),
 						(int)context.GetSessionGuid().length());
 			}
+			if (!context.GetServerPassword().empty())
+			{
+				netInit->authServerPassword =
+						OCTET_STRING_new_fromBuf(
+							&asn_DEF_OCTET_STRING,
+							context.GetServerPassword().c_str(),
+							context.GetServerPassword().length());
+			}
 
 			context.SetPlayerName(loginData.userName);
 

src/net/common/clientthread.cpp

@@ -68,6 +68,7 @@ ClientThread::~ClientThread()
 void
 ClientThread::Init(
 	const string &serverAddress, const string &serverListUrl,
+	const string &serverPassword,
 	bool useServerList, unsigned serverPort, bool ipv6, bool sctp,
 	const string &avatarServerAddress, const string &playerName,
 	const string &avatarFile, const string &cacheDir)
@@ -83,6 +84,7 @@ ClientThread::Init(
 	context.SetAddrFamily(ipv6 ? AF_INET6 : AF_INET);
 	context.SetServerAddr(serverAddress);
 	context.SetServerListUrl(serverListUrl);
+	context.SetServerPassword(serverPassword);
 	context.SetUseServerList(useServerList);
 	context.SetServerPort(serverPort);
 	context.SetAvatarServerAddr(avatarServerAddress);

src/net/common/serverlobbythread.cpp

@@ -959,6 +959,15 @@ ServerLobbyThread::HandleNetPacketInit(boost::shared_ptr<SessionData> session, c
 		SessionError(session, ERR_NET_VERSION_NOT_SUPPORTED);
 		return;
 	}
+	// Check (clear text) server password.
+	string serverPassword;
+	if (initMessage.authServerPassword) {
+		serverPassword = STL_STRING_FROM_OCTET_STRING(*initMessage.authServerPassword);
+	}
+	if (serverPassword != m_serverConfig.readConfigString("ServerPassword")) {
+		SessionError(session, ERR_NET_INVALID_PASSWORD);
+		return;
+	}
 
 	string playerName;
 	MD5Buf avatarMD5;