From f7aa097139191e325160b7a1d5157009c221cde7 Mon Sep 17 00:00:00 2001 From: whiteo Date: Wed, 27 May 2026 23:13:07 +0200 Subject: [PATCH 1/2] refactor: improved account matching and bypass loopback throttling --- internal/packet/gs/validate.go | 4 +++- internal/service/ban_manager.go | 14 ++++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/internal/packet/gs/validate.go b/internal/packet/gs/validate.go index f7c69da..d197a0f 100644 --- a/internal/packet/gs/validate.go +++ b/internal/packet/gs/validate.go @@ -6,6 +6,8 @@ package gs import ( + "strings" + "github.com/mmo-dev-team/l2go-auth/internal/client" "github.com/mmo-dev-team/l2go-auth/internal/session" @@ -40,7 +42,7 @@ func HandleValidate(gsc *client.GameServerClient, r *network.PacketReader) error sess, ok := session.ValidateAndDelete(LoginOkID1) success := ok && - sess.Account == account && + strings.EqualFold(sess.Account, account) && sess.Key.CheckPlayPair(LoginOkID1, LoginOkID2, PlayOkID1, PlayOkID2) statusByte := byte(0) diff --git a/internal/service/ban_manager.go b/internal/service/ban_manager.go index bcd91b8..bc166f7 100644 --- a/internal/service/ban_manager.go +++ b/internal/service/ban_manager.go @@ -50,8 +50,18 @@ func NewBanManager(ctx context.Context, queries *db.Queries, maxAttempts int) *B return bm } +// IsBanned checks if a given IP address is currently banned. Loopback (127.0.0.1 / +// ::1) is never banned — it is the host itself (local tools, load tests) and must not +// be able to lock itself out via the brute-force throttle. + + // IsBanned checks if a given IP address is currently banned. +// Loopback (127.0.0.1 / ::1) is never banned. func (m *BanManager) IsBanned(ip netip.Addr) bool { + if ip.IsLoopback() { + return false + } + m.mu.RLock() expiry, ok := m.ipBans[ip] m.mu.RUnlock() @@ -83,6 +93,10 @@ func (m *BanManager) IsBanned(ip netip.Addr) bool { // RecordFailure increments the failure count for an IP and applies a ban if the threshold is reached. func (m *BanManager) RecordFailure(ip netip.Addr) { + if ip.IsLoopback() { + return // never throttle/ban the host itself + } + m.mu.Lock() m.attempts[ip]++ From 1c2df80a183bb26b9308cd28c004dc5461b11130 Mon Sep 17 00:00:00 2001 From: whiteo Date: Wed, 27 May 2026 23:18:26 +0200 Subject: [PATCH 2/2] ci: use go-version-file from go.mod to fix version mismatch --- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f72cf65..7c2b1a4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,7 +16,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v5 with: - go-version: '1.25' + go-version-file: 'go.mod' cache: true - name: Verify dependencies diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8131778..650b9e1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,7 +21,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v5 with: - go-version: '1.25' + go-version-file: 'go.mod' cache: true - name: Run GoReleaser