Subject: dangers of open_network_connection

From: [email-masked]
Date: Tue, 12 Jan 1993 16:05:12 -0800

Can someone please explain to me what the security dangers of 
open_netowrk_connection are?

Someone just posted a message saying they were thinking of moving
o_n_c to a level higher than wizard.  Which is funny, because
we were just seriously considering moving it to a level *lower*
than wizard.  There are lots of talented people around here who are
excited about creating networked applications.

I'd like to find a secure way to let people with a "networker" bit
make nifty things.

Thanks!

-- Amy
	jaime@lots-o-places

---

From: Pavel Curtis <[email-masked]>
Date: Tue, 12 Jan 1993 16:53:05 -0800

> Date:	Tue, 12 Jan 1993 16:05:12 -0800
> From:	[email-masked]
> 

The only significant danger is if your server machine has TCP access to more
hosts than you would like your users to see.  For example, the machine running
LambdaMOO right now is located on the inside of a very strong network barrier,
which only allows packets in to a few very carefully-maintained machines (like
the MOO server).  If I allowed outbound connections from the server, then users
from outside would be able to reach machines on the inside of the wall, which
they otherwise couldn't do.  So, for now, I don't allow them.

I am, however, looking forward to moving the server onto the other side of that
wall, making it more-or-less like any other Internet host (i.e., cut off from
the Xerox internal net).  At that point, I'll enable outbound network
connections on LambdaMOO.

> I'd like to find a secure way to let people with a "networker" bit

Easy.  Add a wiz-only property to all players called `networker' and write a
wiz-owned verb called, say, $net_utils:open_connection, like this:

	who = caller_perms();
	if (valid(who) && $object_utils:isa(who, $player) && who.networker)
	  return open_network_connection(@args);
	else
	  $error:raise(E_PERM);
	endif

---

From: [email-masked] (Erik Ostrom)
Date: Tue, 12 Jan 1993 20:47:19 -0800

An additional danger of open_network_connection() is that a malicious person
(not that you'd give a .networker bit to anyone malicious) can cause massive
lag on your MOO.  Under certain circumstances, open_network_connection() can
take a long time to execute.  (Jonny says up to thirty seconds, which is
pretty long in MOO terms.)  This is a problem even in the absence of malice.
In addition, since seconds_left() is measured in terms of CPU time, the task
goes right on running when o_n_c() finishes, so someone who hated you could
just keep right on connecting to the same site, upping the lag more each
time.  (Actually, I don't know for sure whether repeated attempts to the
same site would cause the same problems--I'm not sure where the problem
lies.)

Okay, so networkers you don't trust are not a big concern.  The random lag
from open_network_connection() is still a big nuisance, as evidenced by the
shouting that goes on whenever it hits JaysHouseMOO.

--Erik/JF

---

From: Pavel Curtis <[email-masked]>
Date: Tue, 12 Jan 1993 23:31:33 -0800

> Under certain circumstances, open_network_connection() can
> take a long time to execute.

I was unware of this problem until now (shame on you, Joe and Jonny!).  I have
just made changes in the server code to limit the possible delay to about five
seconds; if the connection can't be made in that time, E_INVARG is raised.

	Pavel