Hi,
Ok, we all have pretty much seen what is happening the last times to some team games : unexplained crashes.
It occurs principaly in the games of "known players". So it's legitim to think they don't happen randomly but are through someone or some people who is/are targetting 0ad for a reason which is not clear yet.
The community was not silencious about those attacks and many tried for some to find who is doing that and others to find how to face them. Event if many are developers, it is not always evident.
I - The facts:
All the clients lose almost simultaneously the connexion to the server. This process seems irreversible as there are not actually connexion issues and way to fix it.
II - The responses:
A - Finding the author(s)
Here is a screenshot of online people a day when many attacks happened.
Image by reza-math.
This screenshot is interesting because attacks here happened where there was not a lot of people online.
B - Make a protection against the attacks
The first idea to protecting against that attacks is to close the ports used by the author(s). The issue is that this solution is not very effective when the author(s) can only change attack port.
Another fact is that they need to go through 0ad to do their attacks.
And about that we know the port used by 0ad lobby : 5222. Confer to the discussion below dated of November 2013.
Refering to this, we easily see that all the threads are going through there. So for an attack, many connnexions can be simulated. So, we are probably facing DoS/DDoS attacks.
We easily see that by running `netstat`
Even if the will of the author(s) is not known yet, we suppose they only want to destroy the game or some players.
However, what we must do is to face that attacks as it should be.
C - What I am experimenting
Knowing that, it is clear that closing all connexions using a firewall on the port 5222 won't solve the issue.
But in another hand, the attacks are coming from tiers through pyrogenesis.
And this is our luck !
In fact, Operating Systems allow using firewalls on applications to only allow secure (or encrypted) connexions (even not tiers?) trusted by those applications(or only coming from them?).
After doing that stuff, I performed many tests on the game and the result was pretty surprising.
On 7 games (by a day with many attacks), 6 ended well and the 7th was according to me due to a connexion issue from me.
What I have noticed and what is making me confidant on this is that we have often felt the attack coming (the connexions were dropping slowly). And my hypothesis is that the author(s) of the attacks was/were trying to perform his/their attack when my firewalls were at the same time stopping their entering connexions.
That is pretty much all.
I'm waiting for your remarks and suggestions.
I will publish soon a detailed guide on how to perform the solution proposed here on Windows and Debian cores (if it's agreed by the community).
Kind regards,