Client negotiation

With MUSHclient to be open-source in the future, I plan on making a special version of MUSHclient for my MUD. I've had this idea in mind for a while, but obviously creating my own MUD client was not much of a priority (compared to the MUD).

So after coding in some features for my MUD in MUSHclient, I'd like for the MUD to recognize the player is using the special version and for the client to confirm (sort of like a handshake).

First off, what do you think of this? Not actually how to code it in, but the concept. Is it a bad idea? I plan on having things such as pre-installed aliases for the MUD, restricted use of things that are illegal on the MUD (triggers), etc. The player using this client would gain some sort of bonus (like maybe 2x EXP).

Second, what would be a good way of coding this in? I could probably hack it in somehow and get it working, but I'm not really sure of a decent way of doing it. I was thinking somewhere along the lines of the client sending text to the MUD which is ignored (it doesn't process the input) and then the MUD sends back text (which the client does not display) which would confirm (handshake).

Such a thing would be easy enough to bypass. Someone could use a packet sniffer to work out your negotiation, and then get themselves 2x EXP without using your custom client.

There was a discussion a while back about some sort of AFK detection in the client, so that it would send back an "afk" message (an MXP sequence) if it detected that there had been no keyboard input for a while. However as we worked out, it wouldn't be that hard to either suppress the AFK messages, or generate dummy keypresses (eg. using some sort of gamers keyboard).

However if you simply want to detect the special version, and thus perhaps do things that other (alternative) clients don't support, then something like the client name, which is already sent, might do. Alternatively some sort of telnet negotiation would be easy enough to do.

One simple enough technique would be for the client to recognise a sequence (eg. "Welcome to XYZ MUD! Code (611b4ddf75f13d089eba73c6)") and then hash that against an internally stored string, and reply with the result. The server could then work out whether or not the modified client was present.

And that sequence would change each time the player logged on?

Yes, you would generate a new random string (challenge) of some sort. That way the response has to be different each time, otherwise someone would simply note the response and send that automatically.

For example, your code would look like this:

Send challenge: 611b4ddf75f13d089eba73c6

MUSHclient hashes: 611b4ddf75f13d089eba73c6 and e726d6fceed2d0b2799c44ce (stored internally) together.

For example, in Lua, it would do this:



This reply (7bb30ebd4f0565199c0fc471f9485432ebc97d55) would be sent back. Now the server also hashes the string it sent, with the "secret" string (e726d6fceed2d0b2799c44ce) and if it gets the same result, it assumes you have the custom client.

Assuming someone doesn't reverse engineer the client to find the secret string, an assumption I would not necessarily make, that gives a reasonably secure way of knowing they have your client.

On to another concept. Is it a bad idea to restrict the client to only be able to connect to my MUD? I understand people do play multiple MUDs at once, but this will be a client designed specifically for my MUD and if I allow connections to other MUDs I'll have to limit the client a lot.

why would you need to limit it. i assume stock the mushclient source will work just fine on any mud. so anything you add you could simply just make specifically work if its connected to your mud, otherwise the client will operate normally.

Because there are a lot of things that are global (global options, reading in World Files, etc).

I'm not sure I'd see it as a big problem, assuming I had a reason to use a custom client for a game. It might have to be a pretty good reason, though.

Even so, why would these extra settings break other MUDs?

as for how you could use the IAC negotiation stuff, check this out:

http://www.auricmud.com/snippets/client-code.html

David: I don't think many people would want to use a client that had disabled triggers, on other MUDs that would allow triggers.

Gohan: I'm pretty sure people could spoof that, as Nick mentioned.

Oh yeah, I'd forgotten about your plans to disable triggers and so forth. :) Well, in a sense, haven't you already solved the problem then?

Er, what problem? I have many problems. :P

well what i meant was combine the IAC negotiation stuff with that hashing stuff mentioned earlier. you negotiate that its your custom client, and then send the hashed string and wait for the response, if the response is correct, boom 2x exp gains.