Teeworlds 0.6 and 0.7 protocol differences

Far from complete diff between 0.6 and 0.7 protocol versions

---

Reflection attack protection

0.6.5 and 0.7 make the client send 512 null bytes while connecting ( NET_CTRLMSG_CONNECT, NET_CTRLMSG_TOKEN ). If they are not sent the server (0.7 only) silently drops the connection. This is a protection against reflection attacks where the attacker spoofs the victims ip and uses the teeworlds servers response as attacking traffic.

0.6.4 (including ddnet) and earlier do not send these nullbytes.

Packet header

Security tokens

• 0.6.4 and earlier have no security tokens and the header is always 3 bytes long.
• 0.6.5 has a 4 byte security token at the end of the header and a token flag set.
• 0.7 has a 4 byte security token at the end of the header but no token flag set.
• ddnet has 4 byte security token at the end of the packet payload. Not in the header and also no flag set.

Packet flags

• 0.6.4 and earlier use the first 4 bits of the first byte for the flags: compression, resend, connless and control
• 0.6.5 added the token flag at the end of the 0.6.4 flags so the first bits of every packet contain the flags: compression, resend, connless, control and token
• 0.7 shifted the flags 2 bits to the right and the first two bits of every packet are now unused followed by the flags: connless, compression, resend and control

                    
     Full packet headers with every letter representing one bit:

     f = flag bit
     - = unused bit
     a = ack
     c = number of chunks
     t = security token

     0.6.4
     ffff --aa  aaaa aaaa  cccc cccc

     0.6.5
     ffff f-aa  aaaa aaaa  cccc cccc  tttt tttt  tttt tttt  tttt tttt  tttt tttt

     0.7
     --ff ffaa  aaaa aaaa  cccc cccc  tttt tttt  tttt tttt  tttt tttt  tttt tttt
                    
                

The unused bits should be zeroed for proper compatibility with newer and older versions. Old teeworlds versions actually wrongly interpreted the unused bits as part of the ack number so when 0.6.5 started using them for the token flag it broke the connection.

Chunk header

0.7 removed laser damage tuning

The tuning entry laser_damage was removed in 0.7

0.7 removed sound global and also removed some sound world snap items

In 0.6 the sounds SOUND_PLAYER_JUMP (15), SOUND_HOOK_ATTACH_GROUND (21), SOUND_HOOK_ATTACH_PLAYER (22) and SOUND_HOOK_NOATTACH (23) were sent via the snap item event_sound_world.

In 0.7 this no longer happens. The sounds still exists but it is triggered from the client side for the owner of the tee. The client side game state gamecore detects when for example a hook is about to hit and then sets a flag which plays the sound in the gameclient. This does not happen for spectators. A spectator depends on m_TriggeredEvents from the obj_character snap item to play those sounds.

Also the snap item event_sound_global was removed in 0.7. The relevant git commit is d2924b5.