feat(net): N2 - inbound sequence-aligned ISAAC + NAK set
Campaign N Slice N2 (docs/plans/2026-07-29-network-transport-campaign.md S2.2) - the second fatal #260 fix: the inbound keystream now aligns to SEQUENCE order instead of arrival order. One lost S2C datagram no longer desyncs the inbound cipher permanently - the missing id's pre-drawn key parks in the NAK set, later packets keep decoding, and the retransmission decodes with the parked key. New src/AcDream.Core.Net/Transport/InboundSequenceTracker.cs - retail's ReceiverData inbound half, ported rule for rule: - Sanity window: drop when seq is wrap-safe newer than highestIDReceived_ + 0x7FFF (SharedNet::SeqIDSanityCheck @ 0x00543A20; the boundary itself is accepted). - Duplicate/late arrival (encrypted, at/below the watermark): NAK-set hit -> decrypt with the PARKED pre-drawn key; miss -> silent drop at ZERO keystream cost (SharedNet::ProcessNewSeqNum @ 0x00544690, the AVL::Remove branch) - the dup-word-burn and double-dispatch bugs close together. - Gap walk (SharedNet::ProcessNewestSeqNum @ 0x00541930): one inbound ISAAC word per missing id, drawn IN SEQUENCE ORDER BEFORE the arriving packet's own key (landmine #4), parked beside the id (ReceiverData::AddNakked @ 0x00549240, idempotent; id 0 skipped per retail's `if (esi_1 != 0)`). Cleartext walks to seq+1 - the borrowed id itself gets NAKed, so the real encrypted packet at that id can still decode later. - Verify-failure re-park: a sequenced encrypted checksum failure parks the consumed key back beside its id so the retransmission decodes (SharedNet::ProcessPacket @ 0x00544790 tail, AddNakked(seq, &key)). - Inbound RejectRetransmit -> silent NAK-set abandonment; parked keys discarded, alignment holds because the words were already drawn (SharedNet::HandleEmptyAck @ 0x005448F0). - NAK set = SortedDictionary<uint,uint> seq -> parked key; ascending raw-uint enumeration matches retail's AVL walk for N4's <=114-id NAK emission (ReceiverData::GetNaks @ 0x005490C0). PacketCodec split (campaign S4, retail's own factoring - the key is an optional in/out of ReceiverData::Decrypt): TryParseBorrowed is the pure parse + checksum-summand computation with NO keystream access anywhere; VerifyChecksum(header, headerHash, payloadHash, uint? key) compares the additive cleartext form (null) or headerHash + (key ^ payloadHash). TryDecodeBorrowed(datagram, IsaacRandom?) - the consume-before-compare site that WAS the bug - is deleted; the owned TryDecode stays (test-only). RejectRetransmit ids are now exposed on both decoders (borrowed RejectRetransmitBytes/Count like the Request pair; owned RejectRetransmits list); the bytes were always inside the hashed span, so parse-hash coverage is unchanged. WorldSession: ProcessDatagram head is now parse -> sequence-0 split (cleartext seq-0 = handshake/control, verified additively and processed as before; encrypted seq-0 dropped before any keystream access, like retail's ProcessPacket) -> tracker.Admit -> VerifyChecksum with the admission key -> failure re-park -> unchanged flag handling, N1 transport consumption, reflex ack, and fragment loop. The RejectRetransmit flag routes to the tracker beside the N1 NAK/ack consumption. The handshake Connect loop moved to parse + cleartext-verify (no tracker exists before ISAAC seeding; the ConnectRequest is cleartext seq 0). ReliableTransport now takes both Isaacs and exposes Inbound; the session's _inboundIsaac field is deleted. No production caller constructed the N1 ctor outside WorldSession, so no compatibility shape was kept. TransportStats gains InboundDupsDropped, InboundSanityDrops, ChecksumFailures, KeysParked (unconditional, like the N1 counters). Watermark init = 1 is an ACE adaptation, register row AD-50 (watermark INIT only, not a mechanism change; AD-49 stays reserved for the campaign S5 blob-layer deferral): retail zero-inits ReceiverData, but ACE never emits S2C sequence 1 - PacketSequence starts unprimed at uint.MaxValue, the cleartext ConnectRequest takes NextValue 0, and the first ENCRYPTED flush re-primes CurrentValue to 1 so the first encrypted sequenced packet is 2 (ACE NetworkSession.cs:716-717 resolving to UIntSequence(startingValue: 1), Sequence/UIntSequence.cs:9-13,30-41). A zero-init watermark would gap-walk the permanent id-1 hole: one spurious NAK, the first pre-drawn word mis-assigned to id 1, and the keystream off by one from the first encrypted packet onward. holtburger seeds the same value (crates/holtburger-session/src/session/api.rs:30, last_server_seq: 1), mirroring ACE's own C2S-side lastReceivedPacketSequence = 1 (NetworkSession.cs:57). The N0 model's dance is pinned by the clean-lifecycle conformance test: min encrypted S2C sequence == 2, zero NAKs, zero spurious drops. Tests (+14; Core.Net 702 -> 716): the decisive gap test (10,11,13,14 - 13 and 14 decode with fresh words while 12's key parks with KeysParked=1/NakCount=1, the late 12 decodes with the parked key, 15 takes the next fresh word - impossible pre-N2), zero-cost duplicate drop (shadow ISAAC position unchanged), re-park -> byte-identical retransmission decode, the cleartext borrowed-id rule, cleartext at the watermark (no NAK/key/watermark change), sanity boundary +0x7FFF accepted / +0x8000 dropped wrap-safe, skip-id-0 across the 32-bit wrap with ascending NAK enumeration, RejectRetransmit abandonment with alignment held, warm zero-alloc Admit; plus four real-WorldSession conformance runs against the N0 ACE double: clean lifecycle (zero NAKs at every stage), S2C loss of one packet of a Count=2 fragment set (later packets STILL decode - the N2 win; late byte-identical redelivery completes the split message intact), duplicate delivery dropped BEFORE dispatch, and the seq-0 tracker bypass. N3/N4 handoff notes are recorded in the campaign S9 N2 row: the interim per-packet reflex ack acks the arriving sequence even while a gap is parked (ACE prunes the lost id from its S2C cache before N4 could NAK it - message recovery needs N3's retail NAK-xor-ack sweep), and ACE's RejectRetransmit consumes a fresh CLEARTEXT sequence with no keystream word, an ACE-vs-retail wrinkle N4's design must resolve. Gates: dotnet build green; AcDream.Core.Net.Tests 716/716; full-solution Release 9,732 passed / 5 skipped / 0 failed; connected world-lifecycle gate vs local ACE RESULT=PASS (zero failures, one pre-existing expected world-edge landblock-miss warning); canonical nine-stop connected route RESULT=PASS. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Erik
parent
66513b16db
commit
46d209d053
12 changed files with 1359 additions and 180 deletions
|
|
@ -28,14 +28,9 @@ internal readonly record struct BorrowedOptionalHeader(
|
|||
uint ConnectRequestClientSeed,
|
||||
ReadOnlyMemory<byte> RawBytes,
|
||||
ReadOnlyMemory<byte> RetransmitRequestBytes,
|
||||
int RetransmitRequestCount);
|
||||
|
||||
internal readonly record struct BorrowedPacketDecodeResult(
|
||||
BorrowedPacket Packet,
|
||||
PacketCodec.DecodeError Error)
|
||||
{
|
||||
public bool IsOk => Error == PacketCodec.DecodeError.None;
|
||||
}
|
||||
int RetransmitRequestCount,
|
||||
ReadOnlyMemory<byte> RejectRetransmitBytes,
|
||||
int RejectRetransmitCount);
|
||||
|
||||
internal readonly record struct BorrowedMessageFragment(
|
||||
MessageFragmentHeader Header,
|
||||
|
|
|
|||
|
|
@ -116,29 +116,41 @@ public static class PacketCodec
|
|||
}
|
||||
|
||||
/// <summary>
|
||||
/// Decode and verify one packet without materializing packet, optional-
|
||||
/// header, fragment-list, body, or fragment-payload objects. Returned
|
||||
/// memory borrows <paramref name="datagram"/> and must not outlive it.
|
||||
/// Parse one packet without materializing packet, optional-header,
|
||||
/// fragment-list, body, or fragment-payload objects, and WITHOUT
|
||||
/// touching any keystream: checksum verification is the separate
|
||||
/// <see cref="VerifyChecksum"/> step, because the key decision belongs
|
||||
/// to the inbound sequence tracker (campaign doc §2.2 — retail's own
|
||||
/// factoring: <c>ReceiverData::Decrypt</c> takes the key as an optional
|
||||
/// in/out). Returned memory borrows <paramref name="datagram"/> and
|
||||
/// must not outlive it. On success <paramref name="headerHash"/> and
|
||||
/// <paramref name="payloadHash"/> carry the two checksum summands
|
||||
/// (payload = optional-section hash + Σ fragment hashes).
|
||||
/// </summary>
|
||||
internal static BorrowedPacketDecodeResult TryDecodeBorrowed(
|
||||
internal static bool TryParseBorrowed(
|
||||
ReadOnlyMemory<byte> datagram,
|
||||
IsaacRandom? inboundIsaac)
|
||||
out BorrowedPacket packet,
|
||||
out uint headerHash,
|
||||
out uint payloadHash,
|
||||
out DecodeError error)
|
||||
{
|
||||
packet = default;
|
||||
headerHash = 0;
|
||||
payloadHash = 0;
|
||||
|
||||
ReadOnlySpan<byte> wire = datagram.Span;
|
||||
if (wire.Length < PacketHeader.Size)
|
||||
{
|
||||
return new BorrowedPacketDecodeResult(
|
||||
default,
|
||||
DecodeError.TooShort);
|
||||
error = DecodeError.TooShort;
|
||||
return false;
|
||||
}
|
||||
|
||||
PacketHeader header = PacketHeader.Unpack(wire);
|
||||
int bodyLength = header.DataSize;
|
||||
if (wire.Length - PacketHeader.Size < bodyLength)
|
||||
{
|
||||
return new BorrowedPacketDecodeResult(
|
||||
default,
|
||||
DecodeError.HeaderSizeExceedsBuffer);
|
||||
error = DecodeError.HeaderSizeExceedsBuffer;
|
||||
return false;
|
||||
}
|
||||
|
||||
ReadOnlyMemory<byte> body = datagram.Slice(
|
||||
|
|
@ -150,9 +162,8 @@ public static class PacketCodec
|
|||
out BorrowedOptionalHeader optional,
|
||||
out int optionalConsumed))
|
||||
{
|
||||
return new BorrowedPacketDecodeResult(
|
||||
default,
|
||||
DecodeError.InvalidOptionalHeader);
|
||||
error = DecodeError.InvalidOptionalHeader;
|
||||
return false;
|
||||
}
|
||||
|
||||
ReadOnlyMemory<byte> fragmentBytes =
|
||||
|
|
@ -171,9 +182,8 @@ public static class PacketCodec
|
|||
out int payloadLength,
|
||||
out int consumed))
|
||||
{
|
||||
return new BorrowedPacketDecodeResult(
|
||||
default,
|
||||
DecodeError.InvalidFragment);
|
||||
error = DecodeError.InvalidFragment;
|
||||
return false;
|
||||
}
|
||||
|
||||
fragmentHash +=
|
||||
|
|
@ -190,47 +200,39 @@ public static class PacketCodec
|
|||
}
|
||||
}
|
||||
|
||||
uint headerHash = header.CalculateHeaderHash32();
|
||||
uint optionalHash = Hash32.Calculate(
|
||||
optional.RawBytes.Span);
|
||||
uint payloadHash = optionalHash + fragmentHash;
|
||||
if (header.HasFlag(
|
||||
PacketHeaderFlags.EncryptedChecksum))
|
||||
{
|
||||
if (inboundIsaac is null)
|
||||
{
|
||||
return new BorrowedPacketDecodeResult(
|
||||
default,
|
||||
DecodeError.ChecksumMismatch);
|
||||
}
|
||||
|
||||
uint expectedKey =
|
||||
(header.Checksum - headerHash) ^ payloadHash;
|
||||
uint isaacKey = inboundIsaac.Next();
|
||||
if (expectedKey != isaacKey)
|
||||
{
|
||||
return new BorrowedPacketDecodeResult(
|
||||
default,
|
||||
DecodeError.ChecksumMismatch);
|
||||
}
|
||||
}
|
||||
else if (header.Checksum != headerHash + payloadHash)
|
||||
{
|
||||
return new BorrowedPacketDecodeResult(
|
||||
default,
|
||||
DecodeError.ChecksumMismatch);
|
||||
}
|
||||
|
||||
return new BorrowedPacketDecodeResult(
|
||||
new BorrowedPacket(
|
||||
header,
|
||||
optional,
|
||||
body,
|
||||
fragmentBytes,
|
||||
fragmentCount),
|
||||
DecodeError.None);
|
||||
headerHash = header.CalculateHeaderHash32();
|
||||
payloadHash =
|
||||
Hash32.Calculate(optional.RawBytes.Span) + fragmentHash;
|
||||
packet = new BorrowedPacket(
|
||||
header,
|
||||
optional,
|
||||
body,
|
||||
fragmentBytes,
|
||||
fragmentCount);
|
||||
error = DecodeError.None;
|
||||
return true;
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Verify a parsed packet's checksum from the
|
||||
/// <see cref="TryParseBorrowed"/> summands. <paramref name="isaacKey"/>
|
||||
/// null → the additive cleartext form
|
||||
/// (<c>checksum == headerHash + payloadHash</c>); non-null → the
|
||||
/// encrypted form
|
||||
/// (<c>checksum == headerHash + (key ^ payloadHash)</c>). The caller
|
||||
/// (the inbound sequence tracker via <c>WorldSession</c>) owns every
|
||||
/// key decision — parked vs freshly drawn — so this function never
|
||||
/// touches a keystream.
|
||||
/// </summary>
|
||||
internal static bool VerifyChecksum(
|
||||
in PacketHeader header,
|
||||
uint headerHash,
|
||||
uint payloadHash,
|
||||
uint? isaacKey) =>
|
||||
isaacKey is uint key
|
||||
? header.Checksum == headerHash + (key ^ payloadHash)
|
||||
: header.Checksum == headerHash + payloadHash;
|
||||
|
||||
private static bool TryParseBorrowedOptional(
|
||||
ReadOnlyMemory<byte> bodyMemory,
|
||||
PacketHeaderFlags flags,
|
||||
|
|
@ -251,6 +253,8 @@ public static class PacketCodec
|
|||
uint connectRequestClientSeed = 0;
|
||||
int retransmitOffset = 0;
|
||||
int retransmitCount = 0;
|
||||
int rejectOffset = 0;
|
||||
int rejectCount = 0;
|
||||
|
||||
if (HasFlag(flags, PacketHeaderFlags.ServerSwitch)
|
||||
&& !Take(body, ref position, 8))
|
||||
|
|
@ -288,7 +292,13 @@ public static class PacketCodec
|
|||
{
|
||||
return Invalid(out optional, out consumed);
|
||||
}
|
||||
position += checked((int)count * 4);
|
||||
|
||||
// N2: expose the abandoned ids (SharedNet::HandleEmptyAck
|
||||
// @ 0x005448F0 consumes them). The bytes were always inside the
|
||||
// hashed span; only the borrowed view is new.
|
||||
rejectOffset = position;
|
||||
rejectCount = checked((int)count);
|
||||
position += rejectCount * 4;
|
||||
}
|
||||
|
||||
if (HasFlag(flags, PacketHeaderFlags.AckSequence))
|
||||
|
|
@ -318,7 +328,9 @@ public static class PacketCodec
|
|||
connectRequestServerSeed,
|
||||
connectRequestClientSeed,
|
||||
retransmitOffset,
|
||||
retransmitCount);
|
||||
retransmitCount,
|
||||
rejectOffset,
|
||||
rejectCount);
|
||||
consumed = position;
|
||||
return true;
|
||||
}
|
||||
|
|
@ -418,7 +430,9 @@ public static class PacketCodec
|
|||
connectRequestServerSeed,
|
||||
connectRequestClientSeed,
|
||||
retransmitOffset,
|
||||
retransmitCount);
|
||||
retransmitCount,
|
||||
rejectOffset,
|
||||
rejectCount);
|
||||
consumed = position;
|
||||
return true;
|
||||
}
|
||||
|
|
@ -437,7 +451,9 @@ public static class PacketCodec
|
|||
uint connectRequestServerSeed,
|
||||
uint connectRequestClientSeed,
|
||||
int retransmitOffset,
|
||||
int retransmitCount) =>
|
||||
int retransmitCount,
|
||||
int rejectOffset,
|
||||
int rejectCount) =>
|
||||
new(
|
||||
ackSequence,
|
||||
timeSync,
|
||||
|
|
@ -455,7 +471,13 @@ public static class PacketCodec
|
|||
: body.Slice(
|
||||
retransmitOffset,
|
||||
retransmitCount * 4),
|
||||
retransmitCount);
|
||||
retransmitCount,
|
||||
rejectCount == 0
|
||||
? ReadOnlyMemory<byte>.Empty
|
||||
: body.Slice(
|
||||
rejectOffset,
|
||||
rejectCount * 4),
|
||||
rejectCount);
|
||||
|
||||
private static bool Invalid(
|
||||
out BorrowedOptionalHeader optional,
|
||||
|
|
|
|||
|
|
@ -38,6 +38,10 @@ public sealed class PacketHeaderOptional
|
|||
|
||||
public uint AckSequence { get; private set; }
|
||||
public IReadOnlyList<uint> RetransmitRequests { get; private set; } = Array.Empty<uint>();
|
||||
/// <summary>N2: sequence ids the server refuses to retransmit
|
||||
/// (<c>RejectRetransmit</c> 0x2000) — the client abandons the matching
|
||||
/// NAK-set entries (<c>SharedNet::HandleEmptyAck @ 0x005448F0</c>).</summary>
|
||||
public IReadOnlyList<uint> RejectRetransmits { get; private set; } = Array.Empty<uint>();
|
||||
public double TimeSync { get; private set; }
|
||||
public float EchoRequestClientTime { get; private set; }
|
||||
public uint FlowBytes { get; private set; }
|
||||
|
|
@ -94,7 +98,13 @@ public sealed class PacketHeaderOptional
|
|||
if (!Take(body, ref pos, 4)) return -1;
|
||||
uint count = BinaryPrimitives.ReadUInt32LittleEndian(body.Slice(pos - 4));
|
||||
if (count > 1024 || body.Length - pos < (int)count * 4) return -1;
|
||||
pos += (int)count * 4; // consume without storing
|
||||
var rejected = new uint[count];
|
||||
for (int i = 0; i < count; i++)
|
||||
{
|
||||
rejected[i] = BinaryPrimitives.ReadUInt32LittleEndian(body.Slice(pos));
|
||||
pos += 4;
|
||||
}
|
||||
RejectRetransmits = rejected;
|
||||
}
|
||||
|
||||
if (HasFlag(flags, PacketHeaderFlags.AckSequence))
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue