Disabling Gtest

[FirBirGir]

Hi Ken, DX, Tug and anyone mildly interested,

We've touched on this a few times before but I think it's worth pursuing if we can pull it off. Gtest can be very disruptive to Anet servers if someone knows how to use it, like flooding the server with fake players, empty rooms and invalid games. To me, this is one of the big holes still left in all versions of BZ and is worth trying to fix.

I've attempted to check for Gtest using the Anet code but Gtest looks just like a game client as far as I can tell. So instead detecting Gtest, how about we validate it is a game client? A key or some other handshake packet could be passed from the game client and validated by the Anet server. If this is missing or invalid, the server would drop the connection. This could disable other games like I-76 but I'm willing to run 2 servers, one that is dedicated to BZ and another that runs the original Anet server (I already run two servers anyway).

I can make changes on Anet but we'd have to work together to determine a way to allow only BZ game clients to connect.

Let me know your thoughts.

Eddy

[hitchcockgreen]

Awesome idea Eddy. Would love to see this implemented.

[SnakeEye]

I agree. Is there any reason to have it?
also to avoid confusion on the anet server could some kind of identifying system be added like a simple ip address identifying system or maybe a log in system?

[FirBirGir]

We'd love a login system for Anet but the code was never finished and none of the games support it. It would be a major undertaking to finish the login coding in Anet and create it from scratch for the BZ game client.

A simple and effective ID method is what BZE uses, the IP address along with a person's name.

Eddy

[hitchcockgreen]

I agree. Is there any reason to have it?
also to avoid confusion on the anet server could some kind of identifying system be added like a simple ip address identifying system or maybe a log in system?

That's been discussed into the ground here, Snake. And I believe that Firestorm is still trying to work out something like that with a Java platform.

Gtest is supposed to be just that...for testing. However it only ever seems to be abused.

[FirBirGir]

Gtest shows the security weakness in Anet games. The server doesn't do much to validate sessions and clients and since it was intended to work with all sorts of games, it tries to be generic. But Anet should have had the ability to recognize a tester and limit what a test client can do on a production server (Anet has a debug mode, testing with the debug option on would make sense but should be rejected when debug is off).

Eddy

[Firestorm29]

I agree. Is there any reason to have it?
also to avoid confusion on the anet server could some kind of identifying system be added like a simple ip address identifying system or maybe a log in system?

That's been discussed into the ground here, Snake. And I believe that Firestorm is still trying to work out something like that with a Java platform.

Gtest is supposed to be just that...for testing. However it only ever seems to be abused.

That's the objective. I'm intending on working out a new system when I finish my Java course, since it'll be easier to create and distribute.

I do have an idea, it's just it may be awhile before I can get it off the ground. I still need to learn things such as sending data over the internet, and using bots to interface the program with the chat system.

I can break it down how I intend my current idea to work... it gets a bit...wordy.