Serverside LUA Only?

[Protoss_Carrier]

Hello,

I'm a fan of the game and I wanted to make a server-side mod for handling players. Is there a way I can only have the mod distributed on the server, rather than having all participants of the game have to install it? It wouldn't involve any new items or entities. Just a sort of admin interface. The goal is to keep the code away from client-side execution for security purposes.

Thanks in advance.

[Supercheese]

You can create a custom scenario and edit the scenario's control.lua code. That should ensure that the mod code is distributed along with the savegame.

[Protoss_Carrier]

You can create a custom scenario and edit the scenario's control.lua code. That should ensure that the mod code is distributed along with the savegame.

I was looking to keep the mod's code execution separate from the client's platform. This would require the mod's code to be executed on all players' clients, no?

[Rseding91]

No, any mod on a game has to be installed by every peer in order for them to play with each other.

Any security code you had in a mod wouldn't matter if it was distributed anyway since it should never contain anything that matters if anyone sees it (open source SSL for instance).

0.13 has admin related functionality built in (kick, ban, and so on).

[Protoss_Carrier]

No, any mod on a game has to be installed by every peer in order for them to play with each other.

Any security code you had in a mod wouldn't matter if it was distributed anyway since it should never contain anything that matters if anyone sees it (open source SSL for instance).

0.13 has admin related functionality built in (kick, ban, and so on).

I was also looking to implement a server-managed faction system for groups of players. The issue is that I don't want people trying to deliberately access admin functions by jumping around in code execution.

I understand that mods are open source as they are lua scripts auto-distributed upon joining games. My concern was focused on run-time exploits. Wasn't there a recent patch that also used checksums to verify that all versions of a particular mod are the same? That would eliminate the possibility of re-writing the mod code for admin privileges.

I do look forward to the improved administration features in 0.13 though. Thanks for your work.

[DaveMcW]

Local cheating is not a problem, if the server detects that a client has changed anything it will desync them.

[Protoss_Carrier]

Local cheating is not a problem, if the server detects that a client has changed anything it will desync them.

That is if the mod itself is changed on a filesystem level, yes. However, if one were to redirect execution or change a value in working memory, they could potentially give themselves administrator privileges because the admin interface and functions would be accessible in the mod. I need some way for server-side execution or data storage to happen to prevent people from manipulating their data. Is there not a straightforward way to implement server-side code through mods? Would this feature require a custom server executable?

[DaveMcW]

The server (and all clients) run a hash on memory values. If ANYTHING changes it's a desync.

[Protoss_Carrier]

The server (and all clients) run a hash on memory values. If ANYTHING changes it's a desync.

Oh ok. My bad. So how would I go about implementing a faction-based system with an administrator on the server if everyone has the same mod? If you've played Minecraft, I'm basically looking to implement the factions plugin. I feel like team-play would make multiplayer Factorio very interesting. Especially if there were some way to mark other players as hostile (just so you wouldn't have to hit "C" any time you want to shoot something that isn't a bug).

[DaveMcW]

Just keep track of which players have admin permission. You can give it to player 1 to start.

[Protoss_Carrier]

Just keep track of which players have admin permission. You can give it to player 1 to start.

Do Player IDs change based on login order, or are they static? So if my headless server starts up a character, it would become admin based on its player ID, and people joing afterwards would have no opportunity to take that ID unless the server crashes or something?

[Rseding91]

Player IDs are static but in 0.12 it just gives you the matching player by name when you connect so anyone can connect with anyone elses name if they're not online.

In 0.13 there's an option when starting a MP game to enable authentication so someone can't connect unless they have their multiplayer name set to their actual username (no logging in as other people).

[binbinhfr]

I was also looking to implement a server-managed faction system for groups of players. The issue is that I don't want people trying to deliberately access admin functions by jumping around in code execution.

You can have a look at my SpaceBook mod, that ressembles to what you need. viewtopic.php?f=92&t=25680

Note that if a player changes the mod source code or memory, it won't work with your server and will create desync.
To avoid console cheating, you can run the server with console off.