[Freeciv-Dev] Re: client/server authentication (PR#1767)

["Raimar Falke" <rf13@xxxxxxxxxxxxxxxxx>]

On Sat, Apr 26, 2003 at 08:28:59PM -0700, Mike Kaufman wrote:
> attached are the last two of a second set of three patches for
> client/server authentication.
> 
> A lot of code has changed a bunch:
> 
> o added gtk-2.0 client (probably not canonical GTK2, vasc, will have to
>   look at it)
> o removed pconn->password, we no longer need it
> o made "unconnecting from  %s" to "detaching from %s" as GB wanted
> o password check now checks that the password does not contain spaces
> o encapsulated more code in #ifdef AUTHENTICATION_ENABLED #endif
> o added configure magic (badly, Per or Jason or somebody will have to fix)
> o totally rewrote the database (see below for gory detail)
>   o db is in ascii
>   o it locks
> o added a freeciv/misc/db directory for the user_database (can be changed)
> o added some comments for Raimar.

I don't like the misc directory. IMHO this is a server-thing. So it
should go under server/.

The user DB should and hopefully will be used for more than just
storing the password. Examples are: if someone logged in or tried to
login this should be recorded. Also the DB should support the user
history to calculate the ranking of the players. So just username and
password is too little. A struct is needed.

The user DB shouldn't check the passwd. The "common" code should do
this. There should be only two functions:
  // user->name filled out here by the caller
  enum status user_db_load(struct user *user);
and
  enum status user_db_save(struct user *user);

Also the caller can't and shouldn't differ between USER_DB_NOT_FOUND,
USER_DB_BAD_INPUT and USER_DB_ERROR. So this gives: 

enum userdb_status
{
  USER_DB_ERROR = 1,
  USER_DB_SUCCESS,
  USER_DB_NOT_FOUND
};

The last is only returned by user_db_load. The caller (the server in
this case) should probably quit/assert(0) if it gets USER_DB_ERROR
because this shows a configuration error.

        Raimar

-- 
 email: rf13@xxxxxxxxxxxxxxxxx
 "How about the new language C&? No, that's not 'c ampersand', 'c reference', 
  'reference to c' or 'c and'. It's pronounced 'campersand', to confuse the 
  hell out of people who are unfamiliar with it, and it will, of course, 
  have no pointers."
    -- Xazziri in comp.lang.c++ about C#