   Transferring servers
  I think have a pretty simple question about game servers.  If I have a login server and a game server, how do I get that connection to transfer from the login to the game.  I don't have illusions of grandeur of a game large enough to require this, and I know the security involved is extensive, I just like to know how it's done.  I've been reading a little about how to implement the security for the transfer, but nowhere does it say how.  Is it simply that the client disconnects from the login and then connects to a game server that is expecting it or is there a way to move the connection between computers?  I guess I'm mostly referring to UDP connections, but knowledge about TCP would be good too.
I think have a pretty simple question about game servers.  If I have a login server and a game server, how do I get that connection to transfer from the login to the game.  I don't have illusions of grandeur of a game large enough to require this, and I know the security involved is extensive, I just like to know how it's done.  I've been reading a little about how to implement the security for the transfer, but nowhere does it say how.  Is it simply that the client disconnects from the login and then connects to a game server that is expecting it or is there a way to move the connection between computers?  I guess I'm mostly referring to UDP connections, but knowledge about TCP would be good too.1) Make sure the connection between login server and player is encrypted (SSL/TLS is fine)2) Verify the players username/password3) Generate a unique temporary token for the player and either place it in a shared database or send it directly to the game server(s).4) Send this token to the player and give the player the ip/port he needs to connect to the server as well.5) The player connects to the game server, sends the token and the game server uses that to identify the player and retrieve the necessary data from his account.You can't really move a connection as such, the login server could forward packets to the game server but that would concentrate all traffic at one point, When it comes to UDP you don't even have connections in the first place.   ;[quote name='BalkarD' timestamp='1303228052' post='4800394']I think have a pretty simple question about game servers.  If I have a login server and a game server, how do I get that connection to transfer from the login to the game.  I don't have illusions of grandeur of a game large enough to require this, and I know the security involved is extensive, I just like to know how it's done.  I've been reading a little about how to implement the security for the transfer, but nowhere does it say how.  Is it simply that the client disconnects from the login and then connects to a game server that is expecting it or is there a way to move the connection between computers?  I guess I'm mostly referring to UDP connections, but knowledge about TCP would be good too.1) Make sure the connection between login server and player is encrypted (SSL/TLS is fine)2) Verify the players username/password3) Generate a unique temporary token for the player and either place it in a shared database or send it directly to the game server(s).4) Send this token to the player and give the player the ip/port he needs to connect to the server as well.5) The player connects to the game server, sends the token and the game server uses that to identify the player and retrieve the necessary data from his account.You can't really move a connection as such, the login server could forward packets to the game server but that would concentrate all traffic at one point, When it comes to UDP you don't even have connections in the first place.[/quote]Ok, so it sounds like the short answer is disconnect from computer A and reconnect to computer B which is expecting the new connection.  I know there is more to do on top of that, but that's the core of the proceedure.   ;Ok, so it sounds like the short answer is disconnect from computer A and reconnect to computer B which is expecting the new connection.  I know there is more to do on top of that, but that's the core of the proceedure.Generally, a shared secret between the two servers, and a signed cookie that includes user id, time, and source IP address, makes sure that you can re-connect to the new server. Something like this:1) client connects to known "login" server2) client provides name/password to "login" server3) "login" server provides the address of the "game" server to connect to, and a "secret cookie" consisting of (uid,time,client-ip,hmac(uid,time,client-ip,secret-key))4) "login" server also provides a "challenge cookie" consisting of (random-nonce,hmac(random-nonce,secret-key))5) client disconnects, and re-connects to the "game" server6) client provides random-nonce to "game" server7) "game" server provides hmac(random-nonce,secret-key) to client8) client verifies hmac to its received hmac, to make sure the "game" server has the secret key and is not an impostor9) client provides "secret cookie" to "game" server10) "game" server picks apart the cookie and verifies hmac(uid,time,client-ip,secret-key) to verify the client was recently okayed by the "login" serverNow, the client can assume that the game server belongs to the same cluster as the login server (although the login server could conceivably be an impostor!). Additionally, the game server knows that the client was identified at time X and ip address Y by the login server.However, there already exists libraries to do this -- Kerberos, or TLS/OpenSSL come to mind.Also, if you use OpenSSL to connect client->server, you don't need to use the secret cookie at all, just re-send the username/password, and have the game server re-verify the name/password by forwarding to the login server. That's probably easier to implement, and at least as safe, as long as you can use TCP for your connections. It could even be implemented over HTTP if you need to do this out of a web browser!   ;  Thanks much!   ;  I much more elegant solution in my opinion, would be to put the game server on a LAN behind the connection servers. The connection server could then open a connection to the game server upon successful login and relay the data from/to the client/game server.With this technique, you protect your game servers from a large range of attacks since it does not need to be exposed to the Internet, you also avoid the tedious work of implementing a sessions.   ;I much more elegant solution in my opinion, would be to put the game server on a LAN behind the connection servers. The connection server could then open a connection to the game server upon successful login and relay the data from/to the client/game server.With this technique, you protect your game servers from a large range of attacks since it does not need to be exposed to the Internet, you also avoid the tedious work of implementing a sessions.That's similar to a typical web farm load balancing set-up. You'll have some hardware load balancer up front (F5 or whatever) spreading the connections across a number of back end boxes, doing header re-write. Typically, you don't even use NAT -- each box has the same IP address, and you load balance using the Ethernet address (circumventing ARP) instead.You then have the problem that users aren't connected directly to the zone server; any packet needs to be forwarded to some destination node where all users in a particular node/zone/realm/whatever can interact.Nothing wrong with that, but it's a slightly more complex runtime solution, so if you can get away with a simple handoff, you're probably going to have an easier time setting up the system, especially if you're not designing for hundreds of thousands of simultaneous users.   