(Netplay) Possible public Netplay hosting grievances and DoS opportunities (Security)

People connecting to the netplay host can pause the game even if they are not actually playing (perhaps other actions as well?).

As far as I can tell, this might involve a slight protocol change, namely, the documentation[1] states that:

Command: PAUSE
Payload:
    {
       nickname: char[32]
    }
Description:
    Indicates that the core is paused. The receiving peer should also pause.
    The server should pass it on, using the known correct name rather than the
    provided name.

Command: RESUME
Payload: None
Description:
    Indicates that the core is no longer paused.

once a PAUSE command is received, the server should broadcast this request to other clients? If that is so, then perhaps the host should instead ignore PAUSE commands from other players but clients should accept the PAUSE/ RESUME payloads if and only if they are sent by the server.

However, the documentation for PAUSE seems to be in conflict with a former statement in the same document [1]:

A client that is not playing is said to be “spectating”: It receives all the same data but sends none.

claiming that clients that are not involved in the game are not meant to send data at all. The RESUME command only mentions the core / server so how would the client (whether playing or not) unpause, or pause for that matter, anyway?

I have not dug further into this, but given that netplay hosts are public (with no restriction), a short program could be written that simply connects to netplay public hosts and delivers PAUSE/ RESUMEpayloads thereby resulting in a frustrating DoS for players actually trying to play the game. The protocol seems simple enough to understand and I could sketch something up if really necessary and reproduce some nasty experiences I've had.

On the flip side, this might require just a minor change but I am sure there might be usage circumstances that I am not aware about. :- )

... hosting public password-protected games seems sad and would defeat the purpose (not everyone is a ... and I've had very happy experiences with random players! We even taught each other tricks just by gesticulating with our in-game characters in the absence of chat).

As a bonus, going to Settings->Input and declaring how many controls the machine has does not seem to have any effect on netplay and any number of players can join.

Netplay settings: Publicly Announce Netplay: on Use Relay Server: off Netplay Spectator Mode: off Allow Slave-Mode Clients: on Disallow Non-Slave-Mode Clients: off Netplay Stateless Mode: off Digital Input Sharing: No preference Analog Input Sharing: No preference

[1] https://github.com/libretro/RetroArch/tree/master/network/netplay - netplay protocol description

libretro / RetroArch

(Netplay) Possible public Netplay hosting grievances and DoS opportunities (Security) #10151