25 |
34 |
36 |
37 |
38 |
39 |
40 |
41 |
42 |
43 |
44 |
--------------------------------------------------------------------------------
/auth.go:
--------------------------------------------------------------------------------
1 | package main
2 |
3 | import (
4 | "crypto/sha512"
5 | "database/sql"
6 | "encoding/hex"
7 | "errors"
8 | "regexp"
9 | )
10 |
11 | func initAuthDB() {
12 | var err error
13 | validatePasswdStmt, err = db.Prepare("SELECT IF(EXISTS(SELECT passwd FROM accounts WHERE mlid = ? AND passwd = ?), 1, 0)")
14 | if err != nil {
15 | LogError("Unable to prepare auth statement", err)
16 | panic(err)
17 | }
18 | }
19 |
20 | var (
21 | validatePasswdStmt *sql.Stmt
22 | ErrInvalidCredentials = errors.New("an authentication error occurred")
23 | )
24 |
25 | // sendAuthRegex describes a regex to validate a given mlid and passwd from the client.
26 | // This technically should be mlid=w1234123412341234\r\npasswd=xyz, but \n is used
27 | // for ease of interoperability with UNIX-centric clients.
28 | var sendAuthRegex = regexp.MustCompile(`^mlid=(w\d{16})\r?\npasswd=(.{16,32})$`)
29 |
30 | // parseSendAuth obtains a mlid and passwd from the given format.
31 | // If it is unable to do so, it returns empty strings for both.
32 | // It additionally determines whether the given mlid is valid -
33 | // if not, it returns empty strings for both values as well.
34 | func parseSendAuth(format string) (string, string) {
35 | match := sendAuthRegex.FindStringSubmatch(format)
36 | if match != nil {
37 | // Format:
38 | // [0] = raw string
39 | // [1] = mlid match
40 | // [2] = passwd match
41 | return match[1], match[2]
42 | } else {
43 | return "", ""
44 | }
45 | }
46 |
47 | // hashAuthParam salts and hashes the passed parameter appropriately.
48 | func hashAuthParam(param string) string {
49 | hashByte := sha512.Sum512(append(salt, []byte(param)...))
50 | return hex.EncodeToString(hashByte[:])
51 | }
52 |
53 | // checkPasswdValidity returns an error if credentials are invalid,
54 | // or a database error occurred. If not, it returns nil.
55 | func checkPasswdValidity(mlid string, passwd string) error {
56 | if mlid == "" || passwd == "" || !friendCodeIsValid(mlid) {
57 | return ErrInvalidCredentials
58 | }
59 |
60 | passwdHash := hashAuthParam(passwd)
61 |
62 | // Query the database.
63 | exists := false
64 | result := validatePasswdStmt.QueryRow(mlid, passwdHash)
65 | err := result.Scan(&exists)
66 | if err != nil {
67 | return err
68 | }
69 |
70 | // Return our queried result.
71 | if exists {
72 | return nil
73 | } else {
74 | return ErrInvalidCredentials
75 | }
76 | }
77 |
--------------------------------------------------------------------------------
/account.go:
--------------------------------------------------------------------------------
1 | package main
2 |
3 | import (
4 | "crypto/sha512"
5 | "database/sql"
6 | "encoding/hex"
7 | "fmt"
8 | _ "github.com/go-sql-driver/mysql"
9 | "github.com/logrusorgru/aurora/v3"
10 | "log"
11 | "net/http"
12 | "strconv"
13 | )
14 |
15 | func initAccountDB() {
16 | var err error
17 | createAccountStmt, err = db.Prepare("INSERT IGNORE INTO `accounts` (`mlid`,`passwd`, `mlchkid` ) VALUES (?, ?, ?)")
18 | if err != nil {
19 | LogError("Unable to prepare account statement", err)
20 | panic(err)
21 | }
22 | }
23 |
24 | var createAccountStmt *sql.Stmt
25 |
26 | func Account(w http.ResponseWriter, r *http.Request) {
27 | var is string
28 | // Check if we should use `=` for a Wii or
29 | // `:` for the Homebrew patcher.
30 | if r.URL.Path == "/cgi-bin/account.cgi" {
31 | is = "="
32 | } else {
33 | is = ":"
34 | }
35 |
36 | wiiID := r.Form.Get("mlid")
37 | if !friendCodeIsValid(wiiID) {
38 | fmt.Fprint(w, GenAccountErrorCode(610, is, "Invalid Wii Friend Code."))
39 | return
40 | } else if wiiID == "" {
41 | fmt.Fprint(w, GenNormalErrorCode(310, "Unable to parse parameters."))
42 | return
43 | }
44 |
45 | w.Header().Add("Content-Type", "text/plain;charset=utf-8")
46 |
47 | passwd := RandStringBytesMaskImprSrc(16)
48 | passwdByte := sha512.Sum512(append(salt, []byte(passwd)...))
49 | passwdHash := hex.EncodeToString(passwdByte[:])
50 |
51 | mlchkid := RandStringBytesMaskImprSrc(32)
52 | mlchkidByte := sha512.Sum512(append(salt, []byte(mlchkid)...))
53 | mlchkidHash := hex.EncodeToString(mlchkidByte[:])
54 |
55 | result, err := createAccountStmt.Exec(wiiID, passwdHash, mlchkidHash)
56 | if err != nil {
57 | fmt.Fprint(w, GenAccountErrorCode(410, is, "Database error."))
58 | LogError("Unable to execute statement", err)
59 | return
60 | }
61 |
62 | affected, err := result.RowsAffected()
63 | if err != nil {
64 | fmt.Fprint(w, GenAccountErrorCode(410, is, "Database error."))
65 | LogError("Unable to get rows affected", err)
66 | return
67 | }
68 |
69 | if affected == 0 {
70 | fmt.Fprint(w, GenAccountErrorCode(211, is, "Duplicate registration."))
71 | return
72 | }
73 |
74 | if global.Datadog {
75 | err = dataDogClient.Incr("mail.accounts_registered", nil, 1)
76 | if err != nil {
77 | LogError("Unable to update accounts_registered.", err)
78 | }
79 | }
80 |
81 | fmt.Fprint(w, GenSuccessResponseTyped(is),
82 | "mlid", is, wiiID, "\n",
83 | "passwd", is, passwd, "\n",
84 | "mlchkid", is, mlchkid, "\n")
85 | }
86 |
87 | func GenAccountErrorCode(error int, is string, reason string) string {
88 | log.Println(aurora.Red("[Warning]"), "Encountered error", error, "with reason", reason)
89 |
90 | return fmt.Sprint(
91 | "cd", is, strconv.Itoa(error), "\n",
92 | "msg", is, reason, "\n")
93 | }
94 |
--------------------------------------------------------------------------------
/.github/workflows/codeql.yml:
--------------------------------------------------------------------------------
1 | # For most projects, this workflow file will not need changing; you simply need
2 | # to commit it to your repository.
3 | #
4 | # You may wish to alter this file to override the set of languages analyzed,
5 | # or to provide custom queries or build logic.
6 | #
7 | # ******** NOTE ********
8 | # We have attempted to detect the languages in your repository. Please check
9 | # the `language` matrix defined below to confirm you have the correct set of
10 | # supported CodeQL languages.
11 | #
12 | name: "CodeQL"
13 |
14 | on:
15 | push:
16 | branches: [ "master" ]
17 | pull_request:
18 | # The branches below must be a subset of the branches above
19 | branches: [ "master" ]
20 | schedule:
21 | - cron: '17 6 * * 1'
22 |
23 | jobs:
24 | analyze:
25 | name: Analyze
26 | runs-on: ubuntu-latest
27 | permissions:
28 | actions: read
29 | contents: read
30 | security-events: write
31 |
32 | strategy:
33 | fail-fast: false
34 | matrix:
35 | language: [ 'go' ]
36 | # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
37 | # Use only 'java' to analyze code written in Java, Kotlin or both
38 | # Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
39 | # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
40 |
41 | steps:
42 | - name: Checkout repository
43 | uses: actions/checkout@v3
44 |
45 | # Initializes the CodeQL tools for scanning.
46 | - name: Initialize CodeQL
47 | uses: github/codeql-action/init@v2
48 | with:
49 | languages: ${{ matrix.language }}
50 | # If you wish to specify custom queries, you can do so here or in a config file.
51 | # By default, queries listed here will override any specified in a config file.
52 | # Prefix the list here with "+" to use these queries and those in the config file.
53 |
54 | # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
55 | # queries: security-extended,security-and-quality
56 |
57 |
58 | # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java).
59 | # If this step fails, then you should remove it and run the build manually (see below)
60 | - name: Autobuild
61 | uses: github/codeql-action/autobuild@v2
62 |
63 | # ℹ️ Command-line programs to run using the OS shell.
64 | # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
65 |
66 | # If the Autobuild fails above, remove it and uncomment the following three lines.
67 | # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
68 |
69 | # - run: |
70 | # echo "Run, Build Application using script"
71 | # ./location_of_script_within_repo/buildscript.sh
72 |
73 | - name: Perform CodeQL Analysis
74 | uses: github/codeql-action/analyze@v2
75 | with:
76 | category: "/language:${{matrix.language}}"
77 |
--------------------------------------------------------------------------------
/schema/1-create-mail-tables.sql:
--------------------------------------------------------------------------------
1 | -- MySQL dump 10.13 Distrib 5.7.18, for Linux (x86_64)
2 | --
3 | -- Host: localhost Database: WC24Mail
4 | -- ------------------------------------------------------
5 | -- Server version 5.7.18-0ubuntu0.16.04.1
6 |
7 | /*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
8 | /*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
9 | /*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
10 | /*!40101 SET NAMES utf8 */;
11 | /*!40103 SET @OLD_TIME_ZONE=@@TIME_ZONE */;
12 | /*!40103 SET TIME_ZONE='+00:00' */;
13 | /*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;
14 | /*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;
15 | /*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;
16 | /*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;
17 |
18 | --
19 | -- Table structure for table `accounts`
20 | --
21 |
22 | CREATE DATABASE IF NOT EXISTS WC24Mail;
23 | USE WC24Mail;
24 | DROP TABLE IF EXISTS `accounts`;
25 | /*!40101 SET @saved_cs_client = @@character_set_client */;
26 | /*!40101 SET character_set_client = utf8 */;
27 | CREATE TABLE `accounts` (
28 | `mlid` varchar(17) DEFAULT NULL COMMENT 'Mail ID',
29 | `passwd` varchar(128) DEFAULT NULL COMMENT 'Password',
30 | `mlchkid` varchar(128) DEFAULT NULL COMMENT 'Mail Check ID',
31 | UNIQUE KEY `mlid` (`mlid`),
32 | UNIQUE KEY `mlchkid` (`mlchkid`),
33 | UNIQUE KEY `passwd` (`passwd`)
34 | ) ENGINE=InnoDB DEFAULT CHARSET=latin1 COMMENT='WiiConnect24 "Accounts"';
35 | /*!40101 SET character_set_client = @saved_cs_client */;
36 |
37 | --
38 | -- Table structure for table `mails`
39 | --
40 |
41 | DROP TABLE IF EXISTS `mails`;
42 | /*!40101 SET @saved_cs_client = @@character_set_client */;
43 | /*!40101 SET character_set_client = utf8 */;
44 | CREATE TABLE `mails` (
45 | `mail_id` varchar(255) NOT NULL,
46 | `message_id` varchar(255) NOT NULL,
47 | `sender_wiiID` varchar(255) DEFAULT NULL,
48 | `mail` mediumtext,
49 | `recipient_id` varchar(16) DEFAULT NULL,
50 | `sent` tinyint(1) NOT NULL DEFAULT '0',
51 | `timestamp` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
52 | PRIMARY KEY (`mail_id`),
53 | UNIQUE KEY `mail_id` (`mail_id`),
54 | KEY `message_id` (`message_id`)
55 | ) ENGINE=InnoDB DEFAULT CHARSET=latin1 COMMENT='Sent mails from send.cgi';
56 | /*!40101 SET character_set_client = @saved_cs_client */;
57 |
58 | --
59 | -- Table structure for table `stats`
60 | --
61 |
62 | DROP TABLE IF EXISTS `stats`;
63 | /*!40101 SET @saved_cs_client = @@character_set_client */;
64 | /*!40101 SET character_set_client = utf8 */;
65 | CREATE TABLE `stats` (
66 | `WiiFC` varchar(16) NOT NULL,
67 | `timestamp` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP
68 | ) ENGINE=InnoDB DEFAULT CHARSET=latin1 COMMENT='Statistical data';
69 | /*!40101 SET character_set_client = @saved_cs_client */;
70 | /*!40103 SET TIME_ZONE=@OLD_TIME_ZONE */;
71 |
72 | /*!40101 SET SQL_MODE=@OLD_SQL_MODE */;
73 | /*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;
74 | /*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */;
75 | /*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;
76 | /*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */;
77 | /*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;
78 | /*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;
79 |
80 | -- Dump completed on 2017-07-30 10:47:30
--------------------------------------------------------------------------------
/utils.go:
--------------------------------------------------------------------------------
1 | package main
2 |
3 | import (
4 | "fmt"
5 | "github.com/RiiConnect24/wiino/golang"
6 | "github.com/getsentry/sentry-go"
7 | _ "github.com/go-sql-driver/mysql"
8 | "github.com/logrusorgru/aurora/v3"
9 | "log"
10 | "math/rand"
11 | "regexp"
12 | "strconv"
13 | "time"
14 | )
15 |
16 | // https://stackoverflow.com/a/31832326/3874884
17 | var src = rand.NewSource(time.Now().UnixNano())
18 |
19 | const letterBytes = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
20 | const (
21 | letterIdxBits = 6 // 6 bits to represent a letter index
22 | letterIdxMask = 1<Patch:
26 |Please submit your config with the form; we'll register you right away!
27 | 33 |34 |
Recommendation: You should use the Mail Patcher that runs as Wii homebrew, click here for the link. Only use this patcher if you are experiencing a problem using the app.
35 |