[Freeciv-Dev] Possible abuse with allowconnect/multiple controlling connections (PR#1426)

[schnetter@xxxxxxx]

Full_Name: Stefan Schnetter
Version: 
Distribution: Don't know
Client: Both (or N/A)
OS: 
Submission from: (NULL) (80.128.110.110)


During i have played a game someone showed how to make multiple connections
(before that i did not know that is possible).

Welcome to the Freeciv version 1.12.0 Server running at civserver.freeciv.org
port 5557.
(...)
Game: Connection Join from *censored* has joined as player Join.
(...)
Join: 'set allow h+ad'
Option: allowconnect has been set to "h+ad".
Game: Lost connection: Join from *censored* (player Join).
Game: Connection Jan (tm) from *censored* has joined as player Jan (tm).
(...)
/help: Option: allowconnect  -  What connections are allowed
/help: Description:
/help:   This should be a string of characters, each of which specifies a type
or
/help:   status of a civilization, or "player".  Clients will only be permitted
to
/help:   connect to those players which match one of the specified letters. 
This
/help:   only affects future connections, and existing connections are
unchanged.
/help:   The characters and their meanings are:
/help:       N   = New players (only applies pre-game)
/help:       H,h = Human players (pre-existing)
/help:       A,a = AI players
/help:       d   = Dead players
/help:       b   = Barbarian players
/help:   The first description from the _bottom_ which matches a player is the
one
/help:   which applies.  Thus 'd' does not include Barbarians, 'a' does not
include
/help:   dead AI players, and so on.  Upper case letters apply before the game
has
/help:   started, lower case letters afterwards.
/help:   Each character above may be followed by one of the following special
/help:   characters to allow or restrict multiple and observer connections:
/help:      * = Multiple controlling connections allowed;
/help:      + = One controller and multiple observers allowed;
/help:      = = Multiple observers allowed, no controllers;
/help:      - = Single observer only, no controllers;
/help:      (none) = Single controller only.
/help:   Multiple connections and observer connections are currently
EXPERIMENTAL.
/help: Status: changeable
/help: Value: "h+ad", Default: "NHAhad"
<Jan (tm) (will be dead very soon :-()> who is observing me??
Cracy_ID: 'set allow NHAhad'
Option: allowconnect has been set to "NHAhad".
(...)
<Ebcdic> intresting... <f3>
(...)
<Ebcdic> how can a host be multiple?
Jan (tm): 'set allow had'
Option: allowconnect has been set to "had".
(...)
Game: Lost connection: Jan (tm) from *censored* (player Jan (tm)) (observer).

The problem is if someone use e.g. h*ad and not just h+ad!

See also #1139 DoS attack server with allowconnect
http://www.freeciv.org/cgi-bin/bugs/open?id=1139