Refuse to run if the specified build name isn't in the patch map

Replace enabledpatches config option with patchmap.json
This should make it a lot easier to manage patch directories when we add support for each known client build.
2025-09-25 17:40:19 +00:00 · 2023-06-26 06:48:12 +02:00 · 2023-06-26 05:42:57 +02:00 · 2023-06-22 02:43:26 +02:00 · 2023-03-19 01:41:07 +01:00 · 2023-03-13 21:42:59 +01:00
54 changed files with 1452 additions and 477 deletions
--- a/.github/workflows/check-builds.yaml
+++ b/.github/workflows/check-builds.yaml
@@ -0,0 +1,146 @@
+name: Check Builds
+
+on:
+  push:
+    paths:
+        - src/**
+        - vendor/**
+        - .github/workflows/check-builds.yaml
+        - CMakeLists.txt
+        - Makefile
+  pull_request:
+    types: ready_for_review
+    paths:
+        - src/**
+        - vendor/**
+        - CMakeLists.txt
+        - Makefile
+
+jobs:
+  ubuntu-build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set environment
+        run: echo "SHORT_SHA=${GITHUB_SHA::7}" >> $GITHUB_ENV
+        shell: bash
+      - uses: actions/checkout@v3
+        with:
+          submodules: recursive
+          fetch-depth: 0
+      - name: Install dependencies
+        run: sudo apt install clang cmake snap -y && sudo snap install powershell --classic
+      - name: Check compilation
+        run: |
+          $versions = "104", "728", "1013"
+
+          foreach ($version in $versions) {
+              Write-Output "Cleaning old output"
+              Invoke-Expression "make clean"
+              if ($LASTEXITCODE -ne "0") {
+                  Write-Error "make clean failed for version $version" -ErrorAction Stop
+              }
+              Write-Output "Building version $version"
+              Invoke-Expression "make -j8 PROTOCOL_VERSION=$version"
+              if ($LASTEXITCODE -ne "0") {
+                  Write-Error "make failed for version $version" -ErrorAction Stop
+              }
+              Rename-Item -Path "bin/fusion" -newName "$version-fusion"
+              Write-Output "Built version $version"
+          }
+          Copy-Item -Path "sql" -Destination "bin/sql" -Recurse
+          Copy-Item -Path "config.ini" -Destination "bin"
+        shell: pwsh
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v2
+        with:
+          name: 'ubuntu20_04-bin-x64-${{ env.SHORT_SHA }}'
+          path: bin
+
+  windows-build:
+    runs-on: windows-2019
+    steps:
+      - name: Set environment
+        run: $s = $env:GITHUB_SHA.subString(0, 7); echo "SHORT_SHA=$s" >> $env:GITHUB_ENV
+        shell: pwsh
+      - uses: actions/checkout@v3
+        with:
+          submodules: recursive
+          fetch-depth: 0
+      - name: Check compilation
+        run: |
+          $versions = "104", "728", "1013"
+          $configurations = "Release"
+          # "Debug" builds are disabled, since we don't really need them
+
+          $vsPath = "C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise"
+
+          Import-Module "$vsPath\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"
+          Enter-VsDevShell -VsInstallPath $vsPath -SkipAutomaticLocation
+
+          Invoke-Expression "vcpkg install sqlite3:x64-windows"
+          Invoke-Expression "vcpkg integrate install"
+
+          foreach ($version in $versions) {
+              if (Test-Path -LiteralPath "build") {
+                  Remove-Item "build" -Recurse
+                  Write-Output "Deleted existing build folder"
+              }
+              Invoke-Expression "cmake -B build -DPROTOCOL_VERSION=$version -DCMAKE_TOOLCHAIN_FILE=C:/vcpkg/scripts/buildsystems/vcpkg.cmake"
+              if ($LASTEXITCODE -ne "0") {
+                  Write-Error "cmake generation failed for version $version" -ErrorAction Stop
+              }
+              Write-Output "Generated build files for version $version"
+
+              foreach ($configuration in $configurations) {
+                  Write-Output "Building version $version $configuration"
+                  Invoke-Expression "msbuild build\OpenFusion.sln /maxcpucount:8 /p:BuildInParallel=true /p:CL_MPCount=8 /p:UseMultiToolTask=true /p:Configuration=$configuration"
+                  if ($LASTEXITCODE -ne "0") {
+                      Write-Error "msbuild build failed for version $version" -ErrorAction Stop
+                  }
+                  Rename-Item -Path "bin/$configuration" -newName "$version-$configuration"
+                  Write-Output "Built version $version $configuration"
+                  Copy-Item -Path "sql" -Destination "bin/$version-$configuration/sql" -Recurse
+                  Copy-Item -Path "config.ini" -Destination "bin/$version-$configuration"
+              }
+          }
+        shell: pwsh
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v2
+        with:
+          name: 'windows-vs2019-bin-x64-${{ env.SHORT_SHA }}'
+          path: bin
+
+  copy-artifacts:
+    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    needs: [windows-build, ubuntu-build]
+    env:
+      BOT_SSH_KEY: ${{ secrets.BOT_SSH_KEY }}
+      ENDPOINT: ${{ secrets.ENDPOINT }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          submodules: recursive
+          fetch-depth: 0
+      - run: |
+          GITDESC=$(git describe --tags)
+          mkdir $GITDESC
+          echo "ARTDIR=$GITDESC" >> $GITHUB_ENV
+      - uses: actions/download-artifact@v3
+        with:
+          path: ${{ env.ARTDIR }}
+      - name: Upload artifacts
+        shell: bash
+        run: |
+          sudo apt install zip -y
+          cd $ARTDIR
+          for build in *; do
+            cd $build
+            zip -r ../$build.zip *
+            cd ..
+            rm -r $build
+          done
+          cd ..
+          umask 077
+          printf %s "$BOT_SSH_KEY" > cdn_key
+          scp -i cdn_key -o StrictHostKeyChecking=no -r $ARTDIR $ENDPOINT
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -43,7 +43,10 @@ add_executable(openfusion ${SOURCES})

 set_target_properties(openfusion PROPERTIES OUTPUT_NAME ${BIN_NAME})

-target_link_libraries(openfusion sqlite3)
+# find sqlite3 and use it
+find_package(sqlite3 REQUIRED)
+target_include_directories(openfusion PRIVATE ${SQLite3_INCLUDE_DIRS})
+target_link_libraries(openfusion PRIVATE ${SQLite3_LIBRARIES})

 # Makes it so config, tdata, etc. get picked up when starting via the debugger in VS
 set_property(TARGET openfusion PROPERTY VS_DEBUGGER_WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
--- a/LICENSE.md
+++ b/LICENSE.md
@@ -1,6 +1,6 @@
 MIT License

-Copyright (c) 2020-2021 OpenFusion Contributors
+Copyright (c) 2020-2023 OpenFusion Contributors

 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
--- a/19
+++ b/19
@@ -4,9 +4,9 @@ CC=clang
 CXX=clang++
 # -w suppresses all warnings (the part that's commented out helps me find memory leaks, it ruins performance though!)
 # If compiling with ASAN, invoke like this: $ LSAN_OPTIONS=suppressions=suppr.txt bin/fusion
-CFLAGS=-O3 #-g3 -fsanitize=address
-CXXFLAGS=-Wall -Wno-unknown-pragmas -std=c++17 -O2 -DPROTOCOL_VERSION=$(PROTOCOL_VERSION) -DGIT_VERSION=\"$(GIT_VERSION)\" -I./src -I./vendor #-g3 -fsanitize=address
-LDFLAGS=-lpthread -lsqlite3 #-g3 -fsanitize=address
+CFLAGS=-Wall -Wno-unknown-pragmas -O2 -fPIE -D_FORTIFY_SOURCE=1 -fstack-protector #-g3 -fsanitize=address
+CXXFLAGS=$(CFLAGS) -std=c++17 -DPROTOCOL_VERSION=$(PROTOCOL_VERSION) -DGIT_VERSION=\"$(GIT_VERSION)\" -I./src -I./vendor
+LDFLAGS=-lpthread -lsqlite3 -pie -Wl,-z,relro -Wl,-z,now #-g3 -fsanitize=address
 # specifies the name of our exectuable
 SERVER=bin/fusion

@@ -17,9 +17,9 @@ PROTOCOL_VERSION?=104
 # Windows-specific
 WIN_CC=x86_64-w64-mingw32-gcc
 WIN_CXX=x86_64-w64-mingw32-g++
-WIN_CFLAGS=-O3 #-g3 -fsanitize=address
-WIN_CXXFLAGS=-D_WIN32_WINNT=0x0601 -Wall -Wno-unknown-pragmas -std=c++17 -O3 -DPROTOCOL_VERSION=$(PROTOCOL_VERSION) -DGIT_VERSION=\"$(GIT_VERSION)\" -I./src -I./vendor #-g3 -fsanitize=address
-WIN_LDFLAGS=-static -lws2_32 -lwsock32 -lsqlite3 #-g3 -fsanitize=address
+WIN_CFLAGS=-O2 -D_WIN32_WINNT=0x0601 -Wall -Wno-unknown-pragmas
+WIN_CXXFLAGS=$(WIN_CFLAGS) -std=c++17 -DPROTOCOL_VERSION=$(PROTOCOL_VERSION) -DGIT_VERSION=\"$(GIT_VERSION)\" -I./src -I./vendor
+WIN_LDFLAGS=-static -lws2_32 -lwsock32 -lsqlite3
 WIN_SERVER=bin/winfusion.exe

 # C code; currently exclusively from vendored libraries
@@ -48,6 +48,8 @@ CXXSRC=\
 	src/db/shard.cpp\
 	src/db/player.cpp\
 	src/db/email.cpp\
+	src/sandbox/seccomp.cpp\
+	src/sandbox/openbsd.cpp\
 	src/Chat.cpp\
 	src/CustomCommands.cpp\
 	src/Entities.cpp\
@@ -88,6 +90,7 @@ CXXHDR=\
 	src/servers/Monitor.hpp\
 	src/db/Database.hpp\
 	src/db/internal.hpp\
+	src/sandbox/Sandbox.hpp\
 	vendor/bcrypt/BCrypt.hpp\
 	vendor/INIReader.hpp\
 	vendor/JSON.hpp\
@@ -139,7 +142,7 @@ windows : CXXFLAGS=$(WIN_CXXFLAGS)
 windows : LDFLAGS=$(WIN_LDFLAGS)
 windows : SERVER=$(WIN_SERVER)

-.SUFFIX: .o .c .cpp .h .hpp
+.SUFFIXES: .o .c .cpp .h .hpp

 .c.o:
 	$(CC) -c $(CFLAGS) -o $@ $<
@@ -148,7 +151,7 @@ windows : SERVER=$(WIN_SERVER)
 	$(CXX) -c $(CXXFLAGS) -o $@ $<

 # header timestamps are a prerequisite for OF object files
-$(CXXOBJ): $(CXXHDR)
+$(CXXOBJ): $(HDR)

 $(SERVER): $(OBJ) $(CHDR) $(CXXHDR)
 	mkdir -p bin
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@

 <p align="center">
    <a href="https://github.com/OpenFusionProject/OpenFusion/releases/latest"><img src="https://img.shields.io/github/v/release/OpenFusionProject/OpenFusion" alt="Current Release"></a>
-    <a href="https://ci.appveyor.com/project/OpenFusionProject/openfusion"><img src="https://ci.appveyor.com/api/projects/status/github/OpenFusionProject/OpenFusion?svg=true" alt="AppVeyor"></a>
+    <a href="https://github.com/OpenFusionProject/OpenFusion/actions/workflows/check-builds.yaml"><img src="https://github.com/OpenFusionProject/OpenFusion/actions/workflows/check-builds.yaml/badge.svg" alt="Workflow"></a>
    <a href="https://discord.gg/DYavckB"><img src="https://img.shields.io/badge/chat-on%20discord-7289da.svg?logo=discord" alt="Discord"></a>
    <a href="https://github.com/OpenFusionProject/OpenFusion/blob/master/LICENSE.md"><img src="https://img.shields.io/github/license/OpenFusionProject/OpenFusion" alt="License"></a>
 </p>
@@ -12,21 +12,32 @@ OpenFusion is a reverse-engineered server for FusionFall. It primarily targets v
 ## Usage

 ### Getting Started
+#### Method A: Installer (Easiest)
+1. Download the client installer by clicking [here](https://github.com/OpenFusionProject/OpenFusion/releases/download/1.4/OpenFusionClient-1.4-Installer.exe) - choose to run the file.
+2. After a few moments, the client should open: you will be given a choice between two public servers by default. Select the one you wish to play and click connect.
+3. To create an account, simply enter the details you wish to use at the login screen then click Log In. Do *not* click register, as this will just lead to a blank screen.
+4. Make a new character, and enjoy the game! Your progress will be saved automatically, and you can resume playing by entering the login details you used in step 3.

-1. Download the client from [here](https://github.com/OpenFusionProject/OpenFusion/releases/download/1.3/OpenFusionClient-1.3.zip).
+#### Method B: Standalone .zip file
+1. Download the client from [here](https://github.com/OpenFusionProject/OpenFusion/releases/download/1.4/OpenFusionClient-1.4.zip).
 2. Extract it to a folder of your choice. Note: if you are upgrading from an older version, it is preferable to start with a fresh folder rather than overwriting a previous install.
 3. Run OpenFusionClient.exe - you will be given a choice between two public servers by default. Select the one you wish to play and click connect.
 4. To create an account, simply enter the details you wish to use at the login screen then click Log In. Do *not* click register, as this will just lead to a blank screen.
 5. Make a new character, and enjoy the game! Your progress will be saved automatically, and you can resume playing by entering the login details you used in step 4.

+Instructions for getting the client to run on Linux through Wine can be found [here](https://github.com/OpenFusionProject/OpenFusion/wiki/Running-the-game-client-on-Linux).
+
 ### Hosting a server

-1. Grab `OpenFusionServer-1.3-original.zip` or `OpenFusionServer-1.3-academy.zip` from [here](https://github.com/OpenFusionProject/OpenFusion/releases/tag/1.3).
+1. Grab `OpenFusionServer-1.4-original.zip` or `OpenFusionServer-1.4-academy.zip` from [here](https://github.com/OpenFusionProject/OpenFusion/releases/tag/1.4).
 2. Extract it to a folder of your choice, then run `winfusion.exe` (Windows) or `fusion` (Linux) to start the server.
-3. Add a new server to the client's list: the default port is 23000, so the full IP with default settings would be 127.0.0.1:23000.
-4. Once you've added the server to the list, connect to it and log in. If you're having trouble with this, refer to steps 4 and 5 from the previous section.
+3. Add a new server to the client's list:
+    1. For Description, enter anything you want. This is what will show up in the server list.
+    2. For Server IP, enter the IP address and port of the login server. If you're hosting and playing on the same PC, this would be `127.0.0.1:23000`.
+    3. Lastly Game Version - select `beta-20100104` if you downloaded the original zip, or `beta-20111013` if you downloaded the academy zip.
+5. Once you've added the server to the list, connect to it and log in. If you're having trouble with this, refer to steps 4 and 5 from the previous section.

-If you want, [compiled binaries (artifacts) for each new commit can be found on AppVeyor.](https://ci.appveyor.com/project/OpenFusionProject/openfusion)
+If you want to run the latest development builds of the server, [compiled binaries (artifacts) for each functional commit can be found here.](http://cdn.dexlabs.systems/of-builds/)

 For a more detailed overview of the game's architecture and how to configure it, read the following sections.

@@ -72,7 +83,7 @@ This just works if you're all under the same LAN, but if you want to play over t

 ## Compiling 

-OpenFusion has one external dependency: SQLite. You can install it on Windows using `vcpkg`, and on Unix/Linux using your distribution's package manager. For a more indepth guide on how to set up vcpkg, [read this guide on the wiki](https://github.com/OpenFusionProject/OpenFusion/wiki/Installing-SQLite-on-Windows-using-vcpkg).
+OpenFusion has one external dependency: SQLite. The oldest compatible version is `3.33.0`. You can install it on Windows using `vcpkg`, and on Unix/Linux using your distribution's package manager. For a more indepth guide on how to set up vcpkg, [read this guide on the wiki](https://github.com/OpenFusionProject/OpenFusion/wiki/Installing-SQLite-on-Windows-using-vcpkg).

 You have two choices for compiling OpenFusion: the included Makefile and the included CMakeLists file.

--- a/appveyor.yml
+++ b/appveyor.yml
@@ -1,90 +0,0 @@
-version: 'openfusion-{branch}-{build}'
-
-build_cloud: GCE us-east1-b n2-standard-8
-skip_branch_with_pr: true
-
-image:
-  - GCP-Windows-VS2019
-  - GCP-Linux-Ubuntu2004
-
-platform:
-  - x64
-
-configuration:
-  - Release
-  
-for:
-
-  matrix:
-    only:
-      - image: GCP-Linux-Ubuntu2004
-  build_script:
-    - ps: |
-        $versions = "104", "728", "1013"
-
-        foreach ($version in $versions) {
-            Write-Output "Cleaning old output"
-            Invoke-Expression "make clean"
-            if ($LASTEXITCODE -ne "0") {
-                Write-Error "make clean failed for version $version" -ErrorAction Stop
-            }
-            Write-Output "Building version $version"
-            Invoke-Expression "make -j8 PROTOCOL_VERSION=$version"
-            if ($LASTEXITCODE -ne "0") {
-                Write-Error "make failed for version $version" -ErrorAction Stop
-            }
-            Rename-Item -Path "bin/fusion" -newName "$version-fusion"
-            Write-Output "Built version $version"
-        }
-        Copy-Item -Path "sql" -Destination "bin/sql" -Recurse
-        Copy-Item -Path "config.ini" -Destination "bin"
-  artifacts:
-    - path: bin
-      name: ubuntu20_04-bin-x64
-      type: zip
-
-  matrix:
-    only:
-      - image: GCP-Windows-VS2019
-  install:
-    - cmd: vcpkg install sqlite3:x64-windows
-    - cmd: vcpkg integrate install
-  build_script:
-    - ps: |
-        $versions = "104", "728", "1013"
-        $configurations = "Release"
-        # "Debug" builds are disabled, since we don't really need them
-
-        # AppVeyor uses VS2019 Community
-        $vsPath = "C:\Program Files (x86)\Microsoft Visual Studio\2019\Community"
-
-        Import-Module "$vsPath\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"
-        Enter-VsDevShell -VsInstallPath $vsPath -SkipAutomaticLocation
-
-        foreach ($version in $versions) {
-            if (Test-Path -LiteralPath "build") {
-                Remove-Item "build" -Recurse
-                Write-Output "Deleted existing build folder"
-            }
-            Invoke-Expression "cmake -B build -DPROTOCOL_VERSION=$version"
-            if ($LASTEXITCODE -ne "0") {
-                Write-Error "cmake generation failed for version $version" -ErrorAction Stop
-            }
-            Write-Output "Generated build files for version $version"
-
-            foreach ($configuration in $configurations) {
-                Write-Output "Building version $version $configuration"
-                Invoke-Expression "msbuild build\OpenFusion.sln /maxcpucount:8 /p:BuildInParallel=true /p:CL_MPCount=8 /p:UseMultiToolTask=true /p:Configuration=$configuration"
-                if ($LASTEXITCODE -ne "0") {
-                    Write-Error "msbuild build failed for version $version" -ErrorAction Stop
-                }
-                Rename-Item -Path "bin/$configuration" -newName "$version-$configuration"
-                Write-Output "Built version $version $configuration"
-                Copy-Item -Path "sql" -Destination "bin/$version-$configuration/sql" -Recurse
-                Copy-Item -Path "config.ini" -Destination "bin/$version-$configuration"
-            }
-        }
-  artifacts:
-    - path: bin
-      name: windows-vs2019-bin-x64
-      type: zip
--- a/config.ini
+++ b/config.ini
@@ -1,3 +1,8 @@
+# name of the client build the server is targetting.
+# used for determining which patches to apply.
+# default is beta-20111013 for Academy, beta-20100104 otherwise.
+#buildname=beta-20100104
+
 # verbosity level
 # 0 = mostly silence
 # 1 = debug prints and unknown packets
@@ -5,12 +10,18 @@
 # 3 = print all packets
 verbosity=1

+# sandbox the process on supported platforms
+sandbox=true
+
 # Login Server configuration
 [login]
 # must be kept in sync with loginInfo.php
 port=23000
 # will all custom names be approved instantly?
 acceptallcustomnames=true
+# should attempts to log into non-existent accounts
+# automatically create them?
+autocreateaccounts=true
 # how often should everything be flushed to the database?
 # the default is 4 minutes
 dbsaveinterval=240
@@ -40,11 +51,6 @@ motd=Welcome to OpenFusion!
 # location of the patch folder
 #patchdir=tdata/patch/

-# Space-separated list of patch folders in patchdir to load from.
-# If you uncomment this, note that Academy builds *must* contain 1013,
-# and pre-Academy builds must *not* contain it.
-#enabledpatches=1013
-
 # xdt json filename
 #xdtdata=xdt.json
 # NPC json filename
@@ -55,6 +61,8 @@ motd=Welcome to OpenFusion!
 #pathdata=paths.json
 # drop json filename
 #dropdata=drops.json
+# patchmap json filename
+#patchmapdata=patchmap.json
 # gruntwork output filename (this is what you submit)
 #gruntwork=gruntwork.json
 # location of the database
--- a/src/Buddies.hpp
+++ b/src/Buddies.hpp
@@ -5,8 +5,8 @@
 #include "core/Core.hpp"

 namespace Buddies {
-	void init();
+    void init();

-	// Buddy list
-	void refreshBuddyList(CNSocket* sock);
+    // Buddy list
+    void refreshBuddyList(CNSocket* sock);
 }
--- a/src/Chunking.cpp
+++ b/src/Chunking.cpp
@@ -7,11 +7,16 @@

 using namespace Chunking;

+/*
+ * The initial chunkPos value before a player is placed into the world.
+ */
+const ChunkPos Chunking::INVALID_CHUNK = {};
+
 std::map<ChunkPos, Chunk*> Chunking::chunks;

 static void newChunk(ChunkPos pos) {
    if (chunkExists(pos)) {
-        std::cout << "[WARN] Tried to create a chunk that already exists\n";
+        std::cout << "[WARN] Tried to create a chunk that already exists" << std::endl;
        return;
    }

@@ -27,7 +32,7 @@ static void newChunk(ChunkPos pos) {

 static void deleteChunk(ChunkPos pos) {
    if (!chunkExists(pos)) {
-        std::cout << "[WARN] Tried to delete a chunk that doesn't exist\n";
+        std::cout << "[WARN] Tried to delete a chunk that doesn't exist" << std::endl;
        return;
    }

@@ -200,7 +205,7 @@ bool Chunking::chunkExists(ChunkPos chunk) {
 }

 ChunkPos Chunking::chunkPosAt(int posX, int posY, uint64_t instanceID) {
-    return std::make_tuple(posX / (settings::VIEWDISTANCE / 3), posY / (settings::VIEWDISTANCE / 3), instanceID);
+    return ChunkPos(posX / (settings::VIEWDISTANCE / 3), posY / (settings::VIEWDISTANCE / 3), instanceID);
 }

 std::set<Chunk*> Chunking::getViewableChunks(ChunkPos chunk) {
@@ -213,7 +218,7 @@ std::set<Chunk*> Chunking::getViewableChunks(ChunkPos chunk) {
    // grabs surrounding chunks if they exist
    for (int i = -1; i < 2; i++) {
        for (int z = -1; z < 2; z++) {
-            ChunkPos pos = std::make_tuple(x+i, y+z, inst);
+            ChunkPos pos = ChunkPos(x+i, y+z, inst);

            // if chunk exists, add it to the set
            if (chunkExists(pos))
--- a/src/Chunking.hpp
+++ b/src/Chunking.hpp
@@ -1,7 +1,6 @@
 #pragma once

 #include "core/Core.hpp"
-#include "Entities.hpp"

 #include <utility>
 #include <set>
@@ -9,14 +8,23 @@
 #include <tuple>
 #include <algorithm>

+struct EntityRef;
+
 class Chunk {
 public:
-    //std::set<CNSocket*> players;
-    //std::set<int32_t> NPCs;
    std::set<EntityRef> entities;
    int nplayers = 0;
 };

+// to help the readability of ChunkPos
+typedef std::tuple<int, int, uint64_t> _ChunkPos;
+
+class ChunkPos : public _ChunkPos {
+public:
+    ChunkPos() : _ChunkPos(0, 0, (uint64_t) -1) {}
+    ChunkPos(int x, int y, uint64_t inst) : _ChunkPos(x, y, inst) {}
+};
+
 enum {
    INSTANCE_OVERWORLD, // default instance every player starts in
    INSTANCE_IZ, // these aren't actually used
@@ -26,6 +34,8 @@ enum {
 namespace Chunking {
    extern std::map<ChunkPos, Chunk*> chunks;

+    extern const ChunkPos INVALID_CHUNK;
+
    void updateEntityChunk(const EntityRef& ref, ChunkPos from, ChunkPos to);

    void trackEntity(ChunkPos chunkPos, const EntityRef& ref);
--- a/src/Combat.cpp
+++ b/src/Combat.cpp
@@ -56,14 +56,10 @@ static std::pair<int,int> getDamage(int attackPower, int defensePower, bool shou
    return ret;
 }

-static void pcAttackNpcs(CNSocket *sock, CNPacketData *data) {
-    auto pkt = (sP_CL2FE_REQ_PC_ATTACK_NPCs*)data->buf;
+static bool checkRapidFire(CNSocket *sock, int targetCount) {
    Player *plr = PlayerManager::getPlayer(sock);
-    auto targets = (int32_t*)data->trailers;
-
-    // rapid fire anti-cheat
-    // TODO: move this out of here, when generalizing packet frequency validation
    time_t currTime = getTime();
+
    if (currTime - plr->lastShot < plr->fireRate * 80)
        plr->suspicionRating += plr->fireRate * 100 + plr->lastShot - currTime; // gain suspicion for rapid firing
    else if (currTime - plr->lastShot < plr->fireRate * 180 && plr->suspicionRating > 0)
@@ -71,15 +67,28 @@ static void pcAttackNpcs(CNSocket *sock, CNPacketData *data) {

    plr->lastShot = currTime;

-    if (pkt->iNPCCnt > 3) // 3+ targets should never be possible
-        plr->suspicionRating += 10000;
+    // 3+ targets should never be possible
+    if (targetCount > 3)
+        plr->suspicionRating += 10001;

-    if (plr->suspicionRating > 10000) { // kill the socket when the player is too suspicious
+    // kill the socket when the player is too suspicious
+    if (plr->suspicionRating > 10000) {
        sock->kill();
        CNShardServer::_killConnection(sock);
-        return;
+        return true;
    }
-        
+
+    return false;
+}
+
+static void pcAttackNpcs(CNSocket *sock, CNPacketData *data) {
+    auto pkt = (sP_CL2FE_REQ_PC_ATTACK_NPCs*)data->buf;
+    Player *plr = PlayerManager::getPlayer(sock);
+    auto targets = (int32_t*)data->trailers;
+
+    // kick the player if firing too rapidly
+    if (settings::ANTICHEAT && checkRapidFire(sock, pkt->iNPCCnt))
+        return;

    /*
     * IMPORTANT: This validates memory safety in addition to preventing
@@ -217,6 +226,30 @@ int Combat::hitMob(CNSocket *sock, Mob *mob, int damage) {
    return damage;
 }

+/*
+ * When a group of players is doing missions together, we want them to all get
+ * quest items at the same time, but we don't want the odds of quest item
+ * drops from different missions to be linked together. That's why we use a
+ * single RNG roll per mission task, and every group member shares that same
+ * set of rolls.
+ */
+static void genQItemRolls(Player *leader, std::map<int, int>& rolls) {
+    for (int i = 0; i < leader->groupCnt; i++) {
+        if (leader->groupIDs[i] == 0)
+            continue;
+
+        CNSocket *otherSock = PlayerManager::getSockFromID(leader->groupIDs[i]);
+        if (otherSock == nullptr)
+            continue;
+
+        Player *member = PlayerManager::getPlayer(otherSock);
+
+        for (int j = 0; j < ACTIVE_MISSION_COUNT; j++)
+            if (member->tasks[j] != 0)
+                rolls[member->tasks[j]] = Rand::rand();
+    }
+}
+
 void Combat::killMob(CNSocket *sock, Mob *mob) {
    mob->state = MobState::DEAD;
    mob->target = nullptr;
@@ -231,19 +264,19 @@ void Combat::killMob(CNSocket *sock, Mob *mob) {

        Items::DropRoll rolled;
        Items::DropRoll eventRolled;
-        int rolledQItem = Rand::rand();
+        std::map<int, int> qitemRolls;
+
+        Player *leader = PlayerManager::getPlayerFromID(plr->iIDGroup);
+        assert(leader != nullptr); // should never happen
+
+        genQItemRolls(leader, qitemRolls);

        if (plr->groupCnt == 1 && plr->iIDGroup == plr->iID) {
            Items::giveMobDrop(sock, mob, rolled, eventRolled);
-            Missions::mobKilled(sock, mob->appearanceData.iNPCType, rolledQItem);
+            Missions::mobKilled(sock, mob->appearanceData.iNPCType, qitemRolls);
        } else {
-            Player* otherPlayer = PlayerManager::getPlayerFromID(plr->iIDGroup);
-
-            if (otherPlayer == nullptr)
-                return;
-
-            for (int i = 0; i < otherPlayer->groupCnt; i++) {
-                CNSocket* sockTo = PlayerManager::getSockFromID(otherPlayer->groupIDs[i]);
+            for (int i = 0; i < leader->groupCnt; i++) {
+                CNSocket* sockTo = PlayerManager::getSockFromID(leader->groupIDs[i]);
                if (sockTo == nullptr)
                    continue;

@@ -255,7 +288,7 @@ void Combat::killMob(CNSocket *sock, Mob *mob) {
                    continue;

                Items::giveMobDrop(sockTo, mob, rolled, eventRolled);
-                Missions::mobKilled(sockTo, mob->appearanceData.iNPCType, rolledQItem);
+                Missions::mobKilled(sockTo, mob->appearanceData.iNPCType, qitemRolls);
            }
        }
    }
@@ -379,7 +412,7 @@ static void pcAttackChars(CNSocket *sock, CNPacketData *data) {
    sP_CL2FE_REQ_PC_ATTACK_CHARs* pkt = (sP_CL2FE_REQ_PC_ATTACK_CHARs*)data->buf;
    Player *plr = PlayerManager::getPlayer(sock);

-    // only GMs can use this this variant
+    // only GMs can use this variant
    if (plr->accountLevel > 30)
        return;

--- a/src/CustomCommands.cpp
+++ b/src/CustomCommands.cpp
@@ -378,12 +378,9 @@ static void npcRotateCommand(std::string full, std::vector<std::string>& args, C
 }

 static void refreshCommand(std::string full, std::vector<std::string>& args, CNSocket* sock) {
-    EntityRef ref = {sock};
-    Entity* plr = ref.getEntity();
-    ChunkPos currentChunk = plr->chunkPos;
-    ChunkPos nullChunk = std::make_tuple(0, 0, 0);
-    Chunking::updateEntityChunk(ref, currentChunk, nullChunk);
-    Chunking::updateEntityChunk(ref, nullChunk, currentChunk);
+    Player *plr = PlayerManager::getPlayer(sock);
+
+    PlayerManager::updatePlayerPositionForWarp(sock, plr->x, plr->y, plr->z, plr->instanceID);
 }

 static void instanceCommand(std::string full, std::vector<std::string>& args, CNSocket* sock) {
--- a/src/Email.cpp
+++ b/src/Email.cpp
@@ -10,6 +10,8 @@

 using namespace Email;

+std::vector<std::string> Email::dump;
+
 // New email notification
 static void emailUpdateCheck(CNSocket* sock, CNPacketData* data) {
    INITSTRUCT(sP_FE2CL_REP_PC_NEW_EMAIL, resp);
@@ -91,7 +93,7 @@ static void emailReceiveItemSingle(CNSocket* sock, CNPacketData* data) {
    auto pkt = (sP_CL2FE_REQ_PC_RECV_EMAIL_ITEM*)data->buf;
    Player* plr = PlayerManager::getPlayer(sock);

-    if (pkt->iSlotNum < 0 || pkt->iSlotNum >= AINVEN_COUNT || pkt->iSlotNum < 1 || pkt->iSlotNum > 4)
+    if (pkt->iSlotNum < 0 || pkt->iSlotNum >= AINVEN_COUNT || pkt->iEmailItemSlot < 1 || pkt->iEmailItemSlot > 4)
        return; // sanity check

    // get email item from db and delete it
@@ -226,10 +228,10 @@ static void emailSend(CNSocket* sock, CNPacketData* data) {

    INITSTRUCT(sP_FE2CL_REP_PC_SEND_EMAIL_SUCC, resp);

+    Player otherPlr = {};
+    Database::getPlayer(&otherPlr, pkt->iTo_PCUID);
    if (pkt->iCash || pkt->aItem[0].ItemInven.iID) {
        // if there are item or taro attachments
-        Player otherPlr = {};
-        Database::getPlayer(&otherPlr, pkt->iTo_PCUID);
        if (otherPlr.iID != 0 && plr->PCStyle2.iPayzoneFlag != otherPlr.PCStyle2.iPayzoneFlag) {
            // if the players are not in the same time period
            INITSTRUCT(sP_FE2CL_REP_PC_SEND_EMAIL_FAIL, resp);
@@ -250,11 +252,26 @@ static void emailSend(CNSocket* sock, CNPacketData* data) {
        if (attachment.ItemInven.iID == 0)
            continue;

+        sItemBase* item = &pkt->aItem[i].ItemInven;
+        sItemBase* real = &plr->Inven[attachment.iSlotNum];
+
        resp.aItem[i] = attachment;
        attachments.push_back(attachment.ItemInven);
        attSlots.push_back(attachment.iSlotNum);
-        // delete item
-        plr->Inven[attachment.iSlotNum] = { 0, 0, 0, 0 };
+        if (real->iOpt <= item->iOpt) // delete item (if they attached the whole stack)
+            *real = { 0, 0, 0, 0 };
+        else // otherwise, decrement the item
+            real->iOpt -= item->iOpt;
+
+        // HACK: update the slot
+        INITSTRUCT(sP_FE2CL_PC_ITEM_MOVE_SUCC, itemResp);
+        itemResp.iFromSlotNum = attachment.iSlotNum;
+        itemResp.iToSlotNum = attachment.iSlotNum;
+        itemResp.FromSlotItem = *real;
+        itemResp.ToSlotItem = *real;
+        itemResp.eFrom = (int32_t)Items::SlotType::INVENTORY;
+        itemResp.eTo = (int32_t)Items::SlotType::INVENTORY;
+        sock->sendPacket(itemResp, P_FE2CL_PC_ITEM_MOVE_SUCC);
    }

    int cost = pkt->iCash + 50 + 20 * attachments.size(); // attached taros + postage
@@ -274,7 +291,7 @@ static void emailSend(CNSocket* sock, CNPacketData* data) {
        0 // DeleteTime (unimplemented)
    };

-    if (!Database::sendEmail(&email, attachments)) {
+    if (!Database::sendEmail(&email, attachments, plr)) {
        plr->money += cost; // give money back
        // give items back
        while (!attachments.empty()) {
@@ -304,6 +321,10 @@ static void emailSend(CNSocket* sock, CNPacketData* data) {
    resp.iTo_PCUID = pkt->iTo_PCUID;

    sock->sendPacket(resp, P_FE2CL_REP_PC_SEND_EMAIL_SUCC);
+
+    std::string logEmail = "[Email] " + PlayerManager::getPlayerName(plr, true) + " (to " + PlayerManager::getPlayerName(&otherPlr, true) + "): <" + email.SubjectLine + ">\n" + email.MsgBody;
+    std::cout << logEmail << std::endl;
+    dump.push_back(logEmail);
 }

 void Email::init() {
--- a/src/Email.hpp
+++ b/src/Email.hpp
@@ -1,5 +1,10 @@
 #pragma once

+#include <vector>
+#include <string>
+
 namespace Email {
-	void init();
+    extern std::vector<std::string> dump;
+
+    void init();
 }
--- a/src/Entities.hpp
+++ b/src/Entities.hpp
@@ -1,6 +1,7 @@
 #pragma once

 #include "core/Core.hpp"
+#include "Chunking.hpp"

 #include <stdint.h>
 #include <set>
@@ -15,8 +16,6 @@ enum class EntityType : uint8_t {
    BUS
 };

-class Chunk;
-
 struct Entity {
    EntityType type = EntityType::INVALID;
    int x = 0, y = 0, z = 0;
--- a/src/Groups.hpp
+++ b/src/Groups.hpp
@@ -8,7 +8,7 @@
 #include <list>

 namespace Groups {
-	void init();
+    void init();

    void sendToGroup(Player* plr, void* buf, uint32_t type, size_t size);
    void groupTickInfo(Player* plr);
--- a/src/Items.cpp
+++ b/src/Items.cpp
@@ -199,7 +199,7 @@ static int getCrateItem(sItemBase* result, int itemSetId, int rarity, int player
        return -1;
    }

-   // initialize all weights as the default weight for all item slots
+    // initialize all weights as the default weight for all item slots
    std::vector<int> itemWeights(validItems.size(), itemSet.defaultItemWeight);

    if (!itemSet.alterItemWeightMap.empty()) {
--- a/src/Missions.cpp
+++ b/src/Missions.cpp
@@ -27,9 +27,9 @@ static void saveMission(Player* player, int missionId) {
 }

 static bool isMissionCompleted(Player* player, int missionId) {
-   int row = missionId / 64;
-   int column = missionId % 64;
-   return player->aQuestFlag[row] & (1ULL << column);
+    int row = missionId / 64;
+    int column = missionId % 64;
+    return player->aQuestFlag[row] & (1ULL << column);
 }

 int Missions::findQSlot(Player *plr, int id) {
@@ -219,28 +219,18 @@ static bool endTask(CNSocket *sock, int32_t taskNum, int choice=0) {
    // ugly pointer/reference juggling for the sake of operator overloading...
    TaskData& task = *Tasks[taskNum];

-    // update player
+    // sanity check
    int i;
    bool found = false;
    for (i = 0; i < ACTIVE_MISSION_COUNT; i++) {
        if (plr->tasks[i] == taskNum) {
            found = true;
-            plr->tasks[i] = 0;
-            for (int j = 0; j < 3; j++) {
-                plr->RemainingNPCCount[i][j] = 0;
-            }
+            break;
        }
    }

-    if (!found) {
-       std::cout << "[WARN] Player tried to end task that isn't in journal?" << std::endl;
-       return false;
-    }
-
-    if (i == ACTIVE_MISSION_COUNT - 1 && plr->tasks[i] != 0) {
-        std::cout << "[WARN] Player completed non-active mission!?" << std::endl;
+    if (!found)
        return false;
-    }

    // mission rewards
    if (Rewards.find(taskNum) != Rewards.end()) {
@@ -249,6 +239,23 @@ static bool endTask(CNSocket *sock, int32_t taskNum, int choice=0) {
    }
    // don't take away quest items if we haven't finished the quest

+    /*
+     * Update player's active mission data.
+     *
+     * This must be done after all early returns have passed, otherwise we
+     * risk introducing non-atomic changes. For example, failing to finish
+     * a mission due to not having any inventory space could delete the
+     * mission server-side; leading to a desync.
+     */
+    for (i = 0; i < ACTIVE_MISSION_COUNT; i++) {
+        if (plr->tasks[i] == taskNum) {
+            plr->tasks[i] = 0;
+            for (int j = 0; j < 3; j++) {
+                plr->RemainingNPCCount[i][j] = 0;
+            }
+        }
+    }
+
    /*
     * Give (or take away) quest items
     *
@@ -291,13 +298,13 @@ bool Missions::startTask(Player* plr, int TaskID) {
    TaskData& task = *Missions::Tasks[TaskID];

    if (task["m_iCTRReqLvMin"] > plr->level) {
-       std::cout << "[WARN] Player tried to start a task below their level" << std::endl;
-       return false;
+        std::cout << "[WARN] Player tried to start a task above their level" << std::endl;
+        return false;
    }

    if (isMissionCompleted(plr, (int)(task["m_iHMissionID"]) - 1)) {
-       std::cout << "[WARN] Player tried to start an already completed mission" << std::endl;
-       return false;
+        std::cout << "[WARN] Player tried to start an already completed mission" << std::endl;
+        return false;
    }

    // client freaks out if nano mission isn't sent first after relogging, so it's easiest to set it here
@@ -380,42 +387,41 @@ static void taskStart(CNSocket* sock, CNPacketData* data) {
 static void taskEnd(CNSocket* sock, CNPacketData* data) {
    sP_CL2FE_REQ_PC_TASK_END* missionData = (sP_CL2FE_REQ_PC_TASK_END*)data->buf;

-    // failed timed missions give an iNPC_ID of 0
-    if (missionData->iNPC_ID == 0) {
-        TaskData* task = Missions::Tasks[missionData->iTaskNum];
-        if (task->task["m_iSTGrantTimer"] > 0) { // its a timed mission
-            Player* plr = PlayerManager::getPlayer(sock);
-            /*
-             * Enemy killing missions
-             * this is gross and should be cleaned up later
-             * once we comb over mission logic more throughly
-             */
-            bool mobsAreKilled = false;
-            if (task->task["m_iHTaskType"] == 5) {
-                mobsAreKilled = true;
-                for (int i = 0; i < ACTIVE_MISSION_COUNT; i++) {
-                    if (plr->tasks[i] == missionData->iTaskNum) {
-                        for (int j = 0; j < 3; j++) {
-                            if (plr->RemainingNPCCount[i][j] > 0) {
-                                mobsAreKilled = false;
-                                break;
-                            }
+    TaskData* task = Missions::Tasks[missionData->iTaskNum];
+
+    // handle timed mission failure
+    if (task->task["m_iSTGrantTimer"] > 0 && missionData->iNPC_ID == 0) {
+        Player* plr = PlayerManager::getPlayer(sock);
+
+        /*
+         * Enemy killing missions
+         * this is gross and should be cleaned up later
+         * once we comb over mission logic more throughly
+         */
+        bool mobsAreKilled = false;
+        if (task->task["m_iHTaskType"] == 5) {
+            mobsAreKilled = true;
+            for (int i = 0; i < ACTIVE_MISSION_COUNT; i++) {
+                if (plr->tasks[i] == missionData->iTaskNum) {
+                    for (int j = 0; j < 3; j++) {
+                        if (plr->RemainingNPCCount[i][j] > 0) {
+                            mobsAreKilled = false;
+                            break;
                        }
                    }
                }
            }
+        }

-            if (!mobsAreKilled) {
-                
-                int failTaskID = task->task["m_iFOutgoingTask"];
-                if (failTaskID != 0) {
-                    Missions::quitTask(sock, missionData->iTaskNum, false);
-                    
-                    for (int i = 0; i < 6; i++)
-                        if (plr->tasks[i] == missionData->iTaskNum)
-                            plr->tasks[i] = failTaskID;
-                    return;
-                }
+        if (!mobsAreKilled) {
+            int failTaskID = task->task["m_iFOutgoingTask"];
+            if (failTaskID != 0) {
+                Missions::quitTask(sock, missionData->iTaskNum, false);
+
+                for (int i = 0; i < 6; i++)
+                    if (plr->tasks[i] == missionData->iTaskNum)
+                        plr->tasks[i] = failTaskID;
+                return;
            }
        }
    }
@@ -543,9 +549,6 @@ void Missions::updateFusionMatter(CNSocket* sock, int fusion) {
    response.iTaskNum = AvatarGrowth[plr->level]["m_iNanoQuestTaskID"];
    sock->sendPacket((void*)&response, P_FE2CL_REP_PC_TASK_START_SUCC, sizeof(sP_FE2CL_REP_PC_TASK_START_SUCC));
 #else
-    if (plr->level >= 36)
-        return;
-
    plr->fusionmatter -= (int)Missions::AvatarGrowth[plr->level]["m_iReqBlob_NanoCreate"];
    plr->level++;

@@ -564,7 +567,7 @@ void Missions::updateFusionMatter(CNSocket* sock, int fusion) {
    PlayerManager::sendToViewable(sock, (void*)&bcast, P_FE2CL_PC_EVENT, sizeof(sP_FE2CL_PC_EVENT));
 }

-void Missions::mobKilled(CNSocket *sock, int mobid, int rolledQItem) {
+void Missions::mobKilled(CNSocket *sock, int mobid, std::map<int, int>& rolls) {
    Player *plr = PlayerManager::getPlayer(sock);

    bool missionmob = false;
@@ -587,12 +590,29 @@ void Missions::mobKilled(CNSocket *sock, int mobid, int rolledQItem) {
                    plr->RemainingNPCCount[i][j]--;
                }
            }
+
            // drop quest item
            if (task["m_iCSUItemNumNeeded"][j] != 0 && !isQuestItemFull(sock, task["m_iCSUItemID"][j], task["m_iCSUItemNumNeeded"][j]) ) {
-                bool drop = rolledQItem % 100 < task["m_iSTItemDropRate"][j];
+                bool drop = rolls[plr->tasks[i]] % 100 < task["m_iSTItemDropRate"][j];
                if (drop) {
-                    // XXX: are CSUItemID and CSTItemID the same?
                    dropQuestItem(sock, plr->tasks[i], 1, task["m_iCSUItemID"][j], mobid);
+
+                    /*
+                     * Workaround: The client has a bug where it only sends a TASK_END request
+                     * for the first task of multiple that met their quest item requirements
+                     * at the same time. We deal with this by sending TASK_END response packets
+                     * proactively and then silently ignoring the extra TASK_END requests it
+                     * sends afterwards.
+                     */
+                    if (isQuestItemFull(sock, task["m_iCSUItemID"][j], task["m_iCSUItemNumNeeded"][j])) {
+                        INITSTRUCT(sP_FE2CL_REP_PC_TASK_END_SUCC, end);
+                        end.iTaskNum = plr->tasks[i];
+
+                        if (!endTask(sock, plr->tasks[i]))
+                            continue;
+
+                        sock->sendPacket(end, P_FE2CL_REP_PC_TASK_END_SUCC);
+                    }
                } else {
                    // fail to drop (itemID == 0)
                    dropQuestItem(sock, plr->tasks[i], 1, 0, mobid);
--- a/src/Missions.hpp
+++ b/src/Missions.hpp
@@ -47,7 +47,7 @@ namespace Missions {
    // checks if player doesn't have n/n quest items
    void updateFusionMatter(CNSocket* sock, int fusion);

-    void mobKilled(CNSocket *sock, int mobid, int rolledQItem);
+    void mobKilled(CNSocket *sock, int mobid, std::map<int, int>& rolls);

    void quitTask(CNSocket* sock, int32_t taskNum, bool manual);

--- a/src/NPCManager.cpp
+++ b/src/NPCManager.cpp
@@ -246,8 +246,7 @@ static void handleWarp(CNSocket* sock, int32_t warpId) {
        Missions::failInstancedMissions(sock); // fail any instanced missions
        sock->sendPacket(resp, P_FE2CL_REP_PC_WARP_USE_NPC_SUCC);

-        Chunking::updateEntityChunk({sock}, plr->chunkPos, std::make_tuple(0, 0, 0)); // force player to reload chunks
-        PlayerManager::updatePlayerPosition(sock, resp.iX, resp.iY, resp.iZ, INSTANCE_OVERWORLD, plr->angle);
+        PlayerManager::updatePlayerPositionForWarp(sock, resp.iX, resp.iY, resp.iZ, INSTANCE_OVERWORLD);

        // remove the player's ongoing race, if any
        if (Racing::EPRaces.find(sock) != Racing::EPRaces.end())
--- a/src/Nanos.cpp
+++ b/src/Nanos.cpp
@@ -226,6 +226,9 @@ static void nanoEquipHandler(CNSocket* sock, CNPacketData* data) {
    if (nano->iNanoSlotNum > 2 || nano->iNanoSlotNum < 0)
        return;

+    if (nano->iNanoID < 0 || nano->iNanoID >= NANO_COUNT)
+        return;
+
    resp.iNanoID = nano->iNanoID;
    resp.iNanoSlotNum = nano->iNanoSlotNum;

--- a/src/Player.hpp
+++ b/src/Player.hpp
@@ -14,9 +14,7 @@
 struct Player : public Entity {
    int accountId = 0;
    int accountLevel = 0; // permission level (see CN_ACCOUNT_LEVEL enums)
-    int64_t SerialKey = 0;
    int32_t iID = 0;
-    uint64_t FEKey = 0;

    int level = 0;
    int HP = 0;
--- a/src/PlayerManager.cpp
+++ b/src/PlayerManager.cpp
@@ -28,17 +28,12 @@ using namespace PlayerManager;

 std::map<CNSocket*, Player*> PlayerManager::players;

-static void addPlayer(CNSocket* key, Player plr) {
-    Player *p = new Player();
+static void addPlayer(CNSocket* key, Player *plr) {
+    players[key] = plr;
+    plr->chunkPos = Chunking::INVALID_CHUNK;
+    plr->lastHeartbeat = 0;

-    // copy object into heap memory
-    *p = plr;
-
-    players[key] = p;
-    p->chunkPos = std::make_tuple(0, 0, 0); // TODO: maybe replace with specialized "no chunk" value
-    p->lastHeartbeat = 0;
-
-    std::cout << getPlayerName(p) << " has joined!" << std::endl;
+    std::cout << getPlayerName(plr) << " has joined!" << std::endl;
    std::cout << players.size() << " players" << std::endl;
 }

@@ -97,6 +92,19 @@ void PlayerManager::updatePlayerPosition(CNSocket* sock, int X, int Y, int Z, ui
    Chunking::updateEntityChunk({sock}, oldChunk, newChunk);
 }

+/*
+ * Low-level helper function for correctly updating chunks when teleporting players.
+ *
+ * Use PlayerManager::sendPlayerTo() to actually teleport players.
+ */
+void PlayerManager::updatePlayerPositionForWarp(CNSocket* sock, int X, int Y, int Z, uint64_t inst) {
+    Player *plr = getPlayer(sock);
+
+    // force player to reload chunks
+    Chunking::updateEntityChunk({sock}, plr->chunkPos, Chunking::INVALID_CHUNK);
+    updatePlayerPosition(sock, X, Y, Z, inst, plr->angle);
+}
+
 void PlayerManager::sendPlayerTo(CNSocket* sock, int X, int Y, int Z, uint64_t I) {
    Player* plr = getPlayer(sock);
    plr->onMonkey = false;
@@ -148,8 +156,7 @@ void PlayerManager::sendPlayerTo(CNSocket* sock, int X, int Y, int Z, uint64_t I
    pkt2.iZ = Z;
    sock->sendPacket(pkt2, P_FE2CL_REP_PC_GOTO_SUCC);

-    Chunking::updateEntityChunk({sock}, plr->chunkPos, std::make_tuple(0, 0, 0)); // force player to reload chunks
-    updatePlayerPosition(sock, X, Y, Z, I, plr->angle);
+    updatePlayerPositionForWarp(sock, X, Y, Z, I);

    // post-warp: check if the source instance has no more players in it and delete it if so
    Chunking::destroyInstanceIfEmpty(fromInstance);
@@ -197,78 +204,88 @@ static void enterPlayer(CNSocket* sock, CNPacketData* data) {
    auto enter = (sP_CL2FE_REQ_PC_ENTER*)data->buf;
    INITSTRUCT(sP_FE2CL_REP_PC_ENTER_SUCC, response);

-    // TODO: check if serialkey exists, if it doesn't send sP_FE2CL_REP_PC_ENTER_FAIL
-    Player plr = CNSharedData::getPlayer(enter->iEnterSerialKey);
+    LoginMetadata *lm = CNShared::getLoginMetadata(enter->iEnterSerialKey);
+    if (lm == nullptr) {
+        std::cout << "[WARN] Refusing invalid REQ_PC_ENTER" << std::endl;

-    plr.groupCnt = 1;
-    plr.iIDGroup = plr.groupIDs[0] = plr.iID;
+        // send failure packet
+        INITSTRUCT(sP_FE2CL_REP_PC_ENTER_FAIL, fail);
+        sock->sendPacket(fail, P_FE2CL_REP_PC_ENTER_FAIL);

-    DEBUGLOG(
-        std::cout << "P_CL2FE_REQ_PC_ENTER:" << std::endl;
-        std::cout << "\tID: " << AUTOU16TOU8(enter->szID) << std::endl;
-        std::cout << "\tSerial: " << enter->iEnterSerialKey << std::endl;
-        std::cout << "\tTemp: " << enter->iTempValue << std::endl;
-        std::cout << "\tPC_UID: " << plr.PCStyle.iPC_UID << std::endl;
-    )
+        // kill the connection
+        sock->kill();
+        // no need to call _killConnection(); Player isn't in shard yet

-    // check if account is already in use
-    if (isAccountInUse(plr.accountId)) {
-        // kick the other player
-        exitDuplicate(plr.accountId);
+        return;
    }

-    response.iID = plr.iID;
+    Player *plr = new Player();
+    Database::getPlayer(plr, lm->playerId);
+
+    // check if account is already in use
+    if (isAccountInUse(plr->accountId)) {
+        // kick the other player
+        exitDuplicate(plr->accountId);
+
+        // re-read the player from disk, in case it was just flushed
+        *plr = {};
+        Database::getPlayer(plr, lm->playerId);
+    }
+
+    plr->groupCnt = 1;
+    plr->iIDGroup = plr->groupIDs[0] = plr->iID;
+
+    response.iID = plr->iID;
    response.uiSvrTime = getTime();
-    response.PCLoadData2CL.iUserLevel = plr.accountLevel;
-    response.PCLoadData2CL.iHP = plr.HP;
-    response.PCLoadData2CL.iLevel = plr.level;
-    response.PCLoadData2CL.iCandy = plr.money;
-    response.PCLoadData2CL.iFusionMatter = plr.fusionmatter;
-    response.PCLoadData2CL.iMentor = plr.mentor;
+    response.PCLoadData2CL.iUserLevel = plr->accountLevel;
+    response.PCLoadData2CL.iHP = plr->HP;
+    response.PCLoadData2CL.iLevel = plr->level;
+    response.PCLoadData2CL.iCandy = plr->money;
+    response.PCLoadData2CL.iFusionMatter = plr->fusionmatter;
+    response.PCLoadData2CL.iMentor = plr->mentor;
    response.PCLoadData2CL.iMentorCount = 1; // how many guides the player has had
-    response.PCLoadData2CL.iX = plr.x;
-    response.PCLoadData2CL.iY = plr.y;
-    response.PCLoadData2CL.iZ = plr.z;
-    response.PCLoadData2CL.iAngle = plr.angle;
-    response.PCLoadData2CL.iBatteryN = plr.batteryN;
-    response.PCLoadData2CL.iBatteryW = plr.batteryW;
+    response.PCLoadData2CL.iX = plr->x;
+    response.PCLoadData2CL.iY = plr->y;
+    response.PCLoadData2CL.iZ = plr->z;
+    response.PCLoadData2CL.iAngle = plr->angle;
+    response.PCLoadData2CL.iBatteryN = plr->batteryN;
+    response.PCLoadData2CL.iBatteryW = plr->batteryW;
    response.PCLoadData2CL.iBuddyWarpTime = 60; // sets 60s warp cooldown on login

-    response.PCLoadData2CL.iWarpLocationFlag = plr.iWarpLocationFlag;
-    response.PCLoadData2CL.aWyvernLocationFlag[0] = plr.aSkywayLocationFlag[0];
-    response.PCLoadData2CL.aWyvernLocationFlag[1] = plr.aSkywayLocationFlag[1];
+    response.PCLoadData2CL.iWarpLocationFlag = plr->iWarpLocationFlag;
+    response.PCLoadData2CL.aWyvernLocationFlag[0] = plr->aSkywayLocationFlag[0];
+    response.PCLoadData2CL.aWyvernLocationFlag[1] = plr->aSkywayLocationFlag[1];

    response.PCLoadData2CL.iActiveNanoSlotNum = -1;
    response.PCLoadData2CL.iFatigue = 50;
-    response.PCLoadData2CL.PCStyle = plr.PCStyle;
+    response.PCLoadData2CL.PCStyle = plr->PCStyle;

    // client doesnt read this, it gets it from charinfo
-    // response.PCLoadData2CL.PCStyle2 = plr.PCStyle2;
+    // response.PCLoadData2CL.PCStyle2 = plr->PCStyle2;
    // inventory
    for (int i = 0; i < AEQUIP_COUNT; i++)
-        response.PCLoadData2CL.aEquip[i] = plr.Equip[i];
+        response.PCLoadData2CL.aEquip[i] = plr->Equip[i];
    for (int i = 0; i < AINVEN_COUNT; i++)
-        response.PCLoadData2CL.aInven[i] = plr.Inven[i];
+        response.PCLoadData2CL.aInven[i] = plr->Inven[i];
    // quest inventory
    for (int i = 0; i < AQINVEN_COUNT; i++)
-        response.PCLoadData2CL.aQInven[i] = plr.QInven[i];
+        response.PCLoadData2CL.aQInven[i] = plr->QInven[i];
    // nanos
    for (int i = 1; i < SIZEOF_NANO_BANK_SLOT; i++) {
-        response.PCLoadData2CL.aNanoBank[i] = plr.Nanos[i];
-        //response.PCLoadData2CL.aNanoBank[i] = plr.Nanos[i] = {0};
+        response.PCLoadData2CL.aNanoBank[i] = plr->Nanos[i];
    }
    for (int i = 0; i < 3; i++) {
-        response.PCLoadData2CL.aNanoSlots[i] = plr.equippedNanos[i];
+        response.PCLoadData2CL.aNanoSlots[i] = plr->equippedNanos[i];
    }
    // missions in progress
    for (int i = 0; i < ACTIVE_MISSION_COUNT; i++) {
-        if (plr.tasks[i] == 0)
+        if (plr->tasks[i] == 0)
            break;
-        response.PCLoadData2CL.aRunningQuest[i].m_aCurrTaskID = plr.tasks[i];
-        TaskData &task = *Missions::Tasks[plr.tasks[i]];
+        response.PCLoadData2CL.aRunningQuest[i].m_aCurrTaskID = plr->tasks[i];
+        TaskData &task = *Missions::Tasks[plr->tasks[i]];
        for (int j = 0; j < 3; j++) {
            response.PCLoadData2CL.aRunningQuest[i].m_aKillNPCID[j] = (int)task["m_iCSUEnemyID"][j];
-            response.PCLoadData2CL.aRunningQuest[i].m_aKillNPCCount[j] = plr.RemainingNPCCount[i][j];
+            response.PCLoadData2CL.aRunningQuest[i].m_aKillNPCCount[j] = plr->RemainingNPCCount[i][j];
            /*
             * client doesn't care about NeededItem ID and Count,
             * it gets Count from Quest Inventory
@@ -278,12 +295,12 @@ static void enterPlayer(CNSocket* sock, CNPacketData* data) {
            */
        }
    }
-    response.PCLoadData2CL.iCurrentMissionID = plr.CurrentMissionID;
+    response.PCLoadData2CL.iCurrentMissionID = plr->CurrentMissionID;

    // completed missions
    // the packet requires 32 items, but the client only checks the first 16 (shrug)
    for (int i = 0; i < 16; i++) {
-        response.PCLoadData2CL.aQuestFlag[i] = plr.aQuestFlag[i];
+        response.PCLoadData2CL.aQuestFlag[i] = plr->aQuestFlag[i];
    }

    // Computress tips
@@ -292,15 +309,14 @@ static void enterPlayer(CNSocket* sock, CNPacketData* data) {
        response.PCLoadData2CL.iFirstUseFlag2 = UINT64_MAX;
    }
    else {
-        response.PCLoadData2CL.iFirstUseFlag1 = plr.iFirstUseFlag[0];
-        response.PCLoadData2CL.iFirstUseFlag2 = plr.iFirstUseFlag[1];
+        response.PCLoadData2CL.iFirstUseFlag1 = plr->iFirstUseFlag[0];
+        response.PCLoadData2CL.iFirstUseFlag2 = plr->iFirstUseFlag[1];
    }

-    plr.SerialKey = enter->iEnterSerialKey;
-    plr.instanceID = INSTANCE_OVERWORLD; // the player should never be in an instance on enter
+    plr->instanceID = INSTANCE_OVERWORLD; // the player should never be in an instance on enter

    sock->setEKey(CNSocketEncryption::createNewKey(response.uiSvrTime, response.iID + 1, response.PCLoadData2CL.iFusionMatter + 1));
-    sock->setFEKey(plr.FEKey);
+    sock->setFEKey(lm->FEKey);
    sock->setActiveKey(SOCKETKEY_FE); // send all packets using the FE key from now on

    sock->sendPacket(response, P_FE2CL_REP_PC_ENTER_SUCC);
@@ -308,12 +324,14 @@ static void enterPlayer(CNSocket* sock, CNPacketData* data) {
    // transmit MOTD after entering the game, so the client hopefully changes modes on time
    Chat::sendServerMessage(sock, settings::MOTDSTRING);

+    // transfer ownership of Player object into the shard (still valid in this function though)
    addPlayer(sock, plr);
+
    // check if there is an expiring vehicle
-    Items::checkItemExpire(sock, getPlayer(sock));
+    Items::checkItemExpire(sock, plr);

    // set player equip stats
-    Items::setItemStats(getPlayer(sock));
+    Items::setItemStats(plr);

    Missions::failInstancedMissions(sock);

@@ -324,7 +342,10 @@ static void enterPlayer(CNSocket* sock, CNPacketData* data) {

    for (auto& pair : players)
        if (pair.second->notify)
-            Chat::sendServerMessage(pair.first, "[ADMIN]" + getPlayerName(&plr) + " has joined.");
+            Chat::sendServerMessage(pair.first, "[ADMIN]" + getPlayerName(plr) + " has joined.");
+
+    // deallocate lm
+    delete lm;
 }

 void PlayerManager::sendToViewable(CNSocket* sock, void* buf, uint32_t type, size_t size) {
@@ -369,6 +390,9 @@ static void exitGame(CNSocket* sock, CNPacketData* data) {
    response.iExitCode = 1;

    sock->sendPacket(response, P_FE2CL_REP_PC_EXIT_SUCC);
+
+    sock->kill();
+    CNShardServer::_killConnection(sock);
 }

 static void revivePlayer(CNSocket* sock, CNPacketData* data) {
@@ -385,14 +409,18 @@ static void revivePlayer(CNSocket* sock, CNPacketData* data) {
    if (reviveData->iRegenType == 3 && plr->iConditionBitFlag & CSB_BIT_PHOENIX) {
        // nano revive
        plr->Nanos[plr->activeNano].iStamina = 0;
-        plr->HP = PC_MAXHEALTH(plr->level);
+        plr->HP = PC_MAXHEALTH(plr->level) / 2;
        Nanos::applyBuff(sock, plr->Nanos[plr->activeNano].iSkillID, 2, 1, 0);
    } else if (reviveData->iRegenType == 4) {
-        plr->HP = PC_MAXHEALTH(plr->level);
-    } else {
+        // revived by group member's nano
+        plr->HP = PC_MAXHEALTH(plr->level) / 2;
+    } else if (reviveData->iRegenType == 5) {
+        // warp away
        move = true;
-        if (reviveData->iRegenType != 5)
-            plr->HP = PC_MAXHEALTH(plr->level);
+    } else {
+        // plain respawn
+        move = true;
+        plr->HP = PC_MAXHEALTH(plr->level) / 2;
    }

    for (int i = 0; i < 3; i++) {
@@ -459,8 +487,7 @@ static void revivePlayer(CNSocket* sock, CNPacketData* data) {
    if (!move)
        return;

-    Chunking::updateEntityChunk({sock}, plr->chunkPos, std::make_tuple(0, 0, 0)); // force player to reload chunks
-    updatePlayerPosition(sock, x, y, z, plr->instanceID, plr->angle);
+    updatePlayerPositionForWarp(sock, x, y, z, plr->instanceID);
 }

 static void enterPlayerVehicle(CNSocket* sock, CNPacketData* data) {
@@ -687,4 +714,6 @@ void PlayerManager::init() {
    REGISTER_SHARD_PACKET(P_CL2FE_REQ_PC_VEHICLE_OFF, exitPlayerVehicle);
    REGISTER_SHARD_PACKET(P_CL2FE_REQ_PC_CHANGE_MENTOR, changePlayerGuide);
    REGISTER_SHARD_PACKET(P_CL2FE_REQ_PC_FIRST_USE_FLAG_SET, setFirstUseFlag);
+
+    REGISTER_SHARD_TIMER(CNShared::pruneLoginMetadata, CNSHARED_PERIOD);
 }
--- a/src/PlayerManager.hpp
+++ b/src/PlayerManager.hpp
@@ -18,6 +18,7 @@ namespace PlayerManager {
    void removePlayer(CNSocket* key);

    void updatePlayerPosition(CNSocket* sock, int X, int Y, int Z, uint64_t I, int angle);
+    void updatePlayerPositionForWarp(CNSocket* sock, int X, int Y, int Z, uint64_t inst);

    void sendPlayerTo(CNSocket* sock, int X, int Y, int Z, uint64_t I);
    void sendPlayerTo(CNSocket* sock, int X, int Y, int Z);
--- a/src/Racing.hpp
+++ b/src/Racing.hpp
@@ -9,7 +9,7 @@ struct EPInfo {
 };

 struct EPRace {
-	std::set<int> collectedRings;
+    std::set<int> collectedRings;
    int mode, ticketSlot;
    time_t startTime;
 };
--- a/src/Rand.cpp
+++ b/src/Rand.cpp
@@ -1,4 +1,5 @@
 #include "Rand.hpp"
+#include "core/Core.hpp"

 std::unique_ptr<std::mt19937> Rand::generator;

@@ -33,6 +34,58 @@ float Rand::randFloat() {
    return Rand::randFloat(0.0f, 1.0f);
 }

+#define RANDBYTES 8
+
+/*
+ * Cryptographically secure RNG. Borrowed from bcrypt_gensalt().
+ */
+uint64_t Rand::cryptoRand() {
+    uint8_t buf[RANDBYTES];
+
+#ifdef _WIN32
+    HCRYPTPROV p;
+
+    // Acquire a crypt context for generating random bytes.
+    if (CryptAcquireContext(&p, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT) == FALSE) {
+        goto fail;
+    }
+
+    if (CryptGenRandom(p, RANDBYTES, (BYTE*)buf) == FALSE) {
+        goto fail;
+    }
+
+    if (CryptReleaseContext(p, 0) == FALSE) {
+        goto fail;
+    }
+#else
+    int fd;
+
+    // Get random bytes on Unix/Linux.
+    fd = open("/dev/urandom", O_RDONLY);
+    if (fd < 0) {
+        perror("open");
+        goto fail;
+    }
+
+    if (read(fd, buf, RANDBYTES) < RANDBYTES) {
+        perror("read");
+        close(fd);
+        goto fail;
+    }
+
+    close(fd);
+#endif
+
+    return *(uint64_t*)buf;
+
+fail:
+    std::cout << "[FATAL] Failed to generate cryptographic random number" << std::endl;
+    terminate(0);
+
+    /* not reached */
+    return 0;
+}
+
 void Rand::init(uint64_t seed) {
    Rand::generator = std::make_unique<std::mt19937>(std::mt19937(seed));
 }
--- a/src/Rand.hpp
+++ b/src/Rand.hpp
@@ -14,6 +14,8 @@ namespace Rand {

    int32_t randWeighted(const std::vector<int32_t>& weights);

+    uint64_t cryptoRand();
+
    float randFloat(float startInclusive, float endExclusive);
    float randFloat(float endExclusive);
    float randFloat();
--- a/src/TableData.cpp
+++ b/src/TableData.cpp
@@ -37,6 +37,22 @@ public:
    const char *what() const throw() { return msg.c_str(); }
 };

+/*
+ * We must refuse to run if an invalid NPC type is found in the JSONs, especially
+ * the gruntwork file. If we were to just skip loading invalid NPCs, they would get
+ * silently dropped from the gruntwork file, which would be confusing in situations
+ * where a gruntwork file for the wrong game build was accidentally loaded.
+ */
+static void ensureValidNPCType(int type, std::string filename) {
+    // last known NPC type
+    int npcLimit = NPCManager::NPCData.back()["m_iNpcNumber"];
+
+    if (type > npcLimit) {
+        std::cout << "[FATAL] " << filename << " contains an invalid NPC type: " << type << std::endl;
+        exit(1);
+    }
+}
+
 /*
 * Create a full and properly-paced path by interpolating between keyframes.
 */
@@ -662,6 +678,8 @@ static void loadEggs(json& eggData, int32_t* nextId) {
 * Load gruntwork output, if it exists
 */
 static void loadGruntworkPre(json& gruntwork, int32_t* nextId) {
+    if (gruntwork.is_null())
+        return;

    try {
        auto paths = gruntwork["paths"];
@@ -671,10 +689,10 @@ static void loadGruntworkPre(json& gruntwork, int32_t* nextId) {
            std::vector<int32_t> targetIDs;
            std::vector<int32_t> targetTypes; // target types are not exportable from gw, but load them anyway
            std::vector<Vec3> pathPoints;
-            int speed = (int)path["iBaseSpeed"];
-            int taskID = (int)path["iTaskID"];
-            bool relative = (bool)path["bRelative"];
-            bool loop = (bool)path["bLoop"];
+            int speed = path.find("iBaseSpeed") == path.end() ? NPC_DEFAULT_SPEED : (int)path["iBaseSpeed"];
+            int taskID = path.find("iTaskID") == path.end() ? -1 : (int)path["iTaskID"];
+            bool relative = path.find("bRelative") == path.end() ? false : (bool)path["bRelative"];
+            bool loop = path.find("bLoop") == path.end() ? true : (bool)path["bLoop"]; // loop by default

            // target IDs
            for (json::iterator _tID = path["aNPCIDs"].begin(); _tID != path["aNPCIDs"].end(); _tID++)
@@ -711,8 +729,8 @@ static void loadGruntworkPre(json& gruntwork, int32_t* nextId) {
 }

 static void loadGruntworkPost(json& gruntwork, int32_t* nextId) {
-
-    if (gruntwork.is_null()) return;
+    if (gruntwork.is_null())
+        return;

    try {
        // skyway paths
@@ -764,6 +782,8 @@ static void loadGruntworkPost(json& gruntwork, int32_t* nextId) {
            int id = (*nextId)--;
            uint64_t instanceID = mob.find("iMapNum") == mob.end() ? INSTANCE_OVERWORLD : (int)mob["iMapNum"];

+            ensureValidNPCType((int)mob["iNPCType"], settings::GRUNTWORKJSON);
+
            if (NPCManager::NPCData[(int)mob["iNPCType"]]["m_iTeam"] == 2) {
                npc = new Mob(mob["iX"], mob["iY"], mob["iZ"], instanceID, mob["iNPCType"],
                    NPCManager::NPCData[(int)mob["iNPCType"]], id);
@@ -783,6 +803,9 @@ static void loadGruntworkPost(json& gruntwork, int32_t* nextId) {
        auto groups = gruntwork["groups"];
        for (auto _group = groups.begin(); _group != groups.end(); _group++) {
            auto leader = _group.value();
+
+            ensureValidNPCType((int)leader["iNPCType"], settings::GRUNTWORKJSON);
+
            auto td = NPCManager::NPCData[(int)leader["iNPCType"]];
            uint64_t instanceID = leader.find("iMapNum") == leader.end() ? INSTANCE_OVERWORLD : (int)leader["iMapNum"];

@@ -803,6 +826,9 @@ static void loadGruntworkPost(json& gruntwork, int32_t* nextId) {
                int followerCount = 0;
                for (json::iterator _fol = followers.begin(); _fol != followers.end(); _fol++) {
                    auto follower = _fol.value();
+
+                    ensureValidNPCType((int)follower["iNPCType"], settings::GRUNTWORKJSON);
+
                    auto tdFol = NPCManager::NPCData[(int)follower["iNPCType"]];
                    Mob* tmpFol = new Mob((int)leader["iX"] + (int)follower["iOffsetX"], (int)leader["iY"] + (int)follower["iOffsetY"], leader["iZ"], leader["iAngle"], instanceID, follower["iNPCType"], tdFol, *nextId);

@@ -859,10 +885,9 @@ static void loadNPCs(json& npcData) {
            npcID += NPC_ID_OFFSET;
            int instanceID = npc.find("iMapNum") == npc.end() ? INSTANCE_OVERWORLD : (int)npc["iMapNum"];
            int type = (int)npc["iNPCType"];
-            if (NPCManager::NPCData[type].is_null()) {
-                std::cout << "[WARN] NPC type " << type << " not found; skipping (json#" << _npc.key() << ")" << std::endl;
-                continue;
-            }
+
+            ensureValidNPCType(type, settings::NPCJSON);
+
 #ifdef ACADEMY
            // do not spawn NPCs in the future
            if (npc["iX"] > 512000 && npc["iY"] < 256000)
@@ -904,10 +929,9 @@ static void loadMobs(json& npcData, int32_t* nextId) {
            int npcID = std::strtol(_npc.key().c_str(), nullptr, 10); // parse ID string to integer
            npcID += MOB_ID_OFFSET;
            int type = (int)npc["iNPCType"];
-            if (NPCManager::NPCData[type].is_null()) {
-                std::cout << "[WARN] NPC type " << type << " not found; skipping (json#" << _npc.key() << ")" << std::endl;
-                continue;
-            }
+
+            ensureValidNPCType(type, settings::MOBJSON);
+
            auto td = NPCManager::NPCData[type];
            uint64_t instanceID = npc.find("iMapNum") == npc.end() ? INSTANCE_OVERWORLD : (int)npc["iMapNum"];

@@ -935,7 +959,10 @@ static void loadMobs(json& npcData, int32_t* nextId) {
        for (json::iterator _group = groupData.begin(); _group != groupData.end(); _group++) {
            auto leader = _group.value();
            int leadID = std::strtol(_group.key().c_str(), nullptr, 10); // parse ID string to integer
+
            leadID += MOB_GROUP_ID_OFFSET;
+            ensureValidNPCType(leader["iNPCType"], settings::MOBJSON);
+
            auto td = NPCManager::NPCData[(int)leader["iNPCType"]];
            uint64_t instanceID = leader.find("iMapNum") == leader.end() ? INSTANCE_OVERWORLD : (int)leader["iMapNum"];
            auto followers = leader["aFollowers"];
@@ -965,6 +992,9 @@ static void loadMobs(json& npcData, int32_t* nextId) {
                int followerCount = 0;
                for (json::iterator _fol = followers.begin(); _fol != followers.end(); _fol++) {
                    auto follower = _fol.value();
+
+                    ensureValidNPCType(follower["iNPCType"], settings::MOBJSON);
+
                    auto tdFol = NPCManager::NPCData[(int)follower["iNPCType"]];
                    Mob* tmpFol = new Mob((int)leader["iX"] + (int)follower["iOffsetX"], (int)leader["iY"] + (int)follower["iOffsetY"], leader["iZ"], leader["iAngle"], instanceID, follower["iNPCType"], tdFol, *nextId);

@@ -1056,6 +1086,33 @@ static void patchJSON(json* base, json* patch) {

 void TableData::init() {
    int32_t nextId = INT32_MAX; // next dynamic ID to hand out
+    json patchmap;
+
+    // load patch map
+    {
+        std::fstream fstream;
+        fstream.open(settings::TDATADIR + "/" + settings::PATCHMAPJSON);
+
+        if (fstream.fail()) {
+            std::cerr << "[FATAL] Critical tdata file missing: " << settings::PATCHMAPJSON << std::endl;
+            exit(1);
+        }
+
+        if (fstream.peek() == std::ifstream::traits_type::eof()) {
+            std::cerr << "[FATAL] Critical tdata file is empty: " << settings::PATCHMAPJSON << std::endl;
+            exit(1);
+        }
+
+        fstream >> patchmap;
+        fstream.close();
+    }
+
+    // ensure that there is a patch list for the current build
+    if (patchmap["patchmap"].find(settings::BUILDNAME) == patchmap["patchmap"].end()) {
+        std::cerr << "[FATAL] Build name " << settings::BUILDNAME << " not found in " <<
+            settings::PATCHMAPJSON << std::endl;
+        exit(1);
+    }

    // base JSON tables
    json xdt, paths, drops, eggs, npcs, mobs, gruntwork;
@@ -1070,38 +1127,56 @@ void TableData::init() {
    };

    // load JSON data into tables
-    std::ifstream fstream;
    for (int i = 0; i < 7; i++) {
        std::pair<json*, std::string>& table = tables[i];
-        fstream.open(settings::TDATADIR + table.second); // open file
-        if (!fstream.fail()) {
-            fstream >> *table.first; // load file contents into table
-        } else {
-            if (table.first != &gruntwork) { // gruntwork isn't critical
-                std::cerr << "[FATAL] Critical tdata file missing: " << settings::TDATADIR << table.second << std::endl;
+
+        // scope for fstream
+        {
+            std::ifstream fstream;
+            fstream.open(settings::TDATADIR + "/" + table.second); // open file
+
+            // did we fail to open the file?
+            if (fstream.fail()) {
+                // gruntwork isn't critical
+                if (table.first == &gruntwork)
+                    continue;
+
+                std::cerr << "[FATAL] Critical tdata file missing: " << table.second << std::endl;
                exit(1);
            }
+
+            // is the file empty?
+            if (fstream.peek() == std::ifstream::traits_type::eof()) {
+                // tolerate empty gruntwork file
+                if (table.first == &gruntwork) {
+                    std::cout << "[WARN] The gruntwork file is empty" << std::endl;
+                    continue;
+                }
+
+                std::cerr << "[FATAL] Critical tdata file is empty: " << table.second << std::endl;
+                exit(1);
+            }
+
+            // load file contents into table
+            fstream >> *table.first;
        }
-        fstream.close();

-        // patching: load each patch directory specified in the config file
-
-        // split config field into individual patch entries
-        std::stringstream ss(settings::ENABLEDPATCHES);
-        std::istream_iterator<std::string> begin(ss);
-        std::istream_iterator<std::string> end;
+        // patching: load each patch directory specified in patchmap.json

+        // fetch list of patches that need to be applied for the current build
        json patch;
-        for (auto it = begin; it != end; it++) {
+        json patchlist = patchmap["patchmap"][settings::BUILDNAME];
+
+        for (auto it = patchlist.begin(); it != patchlist.end(); it++) {
            // this is the theoretical path of a corresponding patch for this file
            std::string patchModuleName = *it;
            std::string patchFile = settings::PATCHDIR + patchModuleName + "/" + table.second;
            try {
+                std::ifstream fstream;
                fstream.open(patchFile);
                fstream >> patch; // load into temporary json object
                std::cout << "[INFO] Patching " << patchFile << std::endl;
                patchJSON(table.first, &patch); // patch
-                fstream.close();
            } catch (const std::exception& err) {
                // no-op
            }
@@ -1127,7 +1202,7 @@ void TableData::init() {
 * Write gruntwork output to file
 */
 void TableData::flush() {
-    std::ofstream file(settings::TDATADIR + settings::GRUNTWORKJSON);
+    std::ofstream file(settings::TDATADIR + "/" + settings::GRUNTWORKJSON);
    json gruntwork;

    for (auto& pair : RunningSkywayRoutes) {
--- a/src/Trading.cpp
+++ b/src/Trading.cpp
@@ -1,5 +1,6 @@
 #include "Trading.hpp"
 #include "PlayerManager.hpp"
+#include "db/Database.hpp"

 using namespace Trading;

@@ -269,6 +270,8 @@ static void tradeConfirm(CNSocket* sock, CNPacketData* data) {
        otherSock->sendPacket(msg, P_FE2CL_GM_REP_PC_ANNOUNCE);
        return;
    }
+
+    Database::commitTrade(plr, plr2);
 }

 static void tradeConfirmCancel(CNSocket* sock, CNPacketData* data) {
@@ -392,7 +395,7 @@ static void tradeRegisterCash(CNSocket* sock, CNPacketData* data) {
    Player* plr = PlayerManager::getPlayer(sock);

    if (pacdat->iCandy < 0 || pacdat->iCandy > plr->money)
-       return; // famous glitch, begone
+        return; // famous glitch, begone

    CNSocket* otherSock; // weird flip flop because we need to know who the other player is
    if (pacdat->iID_Request == pacdat->iID_From)
--- a/src/Transport.cpp
+++ b/src/Transport.cpp
@@ -165,9 +165,9 @@ static void transportWarpHandler(CNSocket* sock, CNPacketData* data) {

    if (target == nullptr)
        return;
+
    // we warped; update position and chunks
-    Chunking::updateEntityChunk({sock}, plr->chunkPos, std::make_tuple(0, 0, 0)); // force player to reload chunks
-    PlayerManager::updatePlayerPosition(sock, target->x, target->y, target->z, INSTANCE_OVERWORLD, plr->angle);
+    PlayerManager::updatePlayerPositionForWarp(sock, target->x, target->y, target->z, INSTANCE_OVERWORLD);
 }

 void Transport::testMssRoute(CNSocket *sock, std::vector<Vec3>* route) {
--- a/src/Vendors.cpp
+++ b/src/Vendors.cpp
@@ -1,6 +1,9 @@
 #include "Vendors.hpp"
 #include "Rand.hpp"

+// 7 days
+#define VEHICLE_EXPIRY_DURATION 604800
+
 using namespace Vendors;

 std::map<int32_t, std::vector<VendorListing>> Vendors::VendorTables;
@@ -53,8 +56,8 @@ static void vendorBuy(CNSocket* sock, CNPacketData* data) {

    // if vehicle
    if (req->Item.iType == 10) {
-        // set time limit: current time + 7days
-        req->Item.iTimeLimit = getTimestamp() + 604800;
+        // set time limit: current time + expiry duration
+        req->Item.iTimeLimit = getTimestamp() + VEHICLE_EXPIRY_DURATION;
    }

    if (slot != req->iInvenSlotNum) {
@@ -224,12 +227,20 @@ static void vendorTable(CNSocket* sock, CNPacketData* data) {
    INITSTRUCT(sP_FE2CL_REP_PC_VENDOR_TABLE_UPDATE_SUCC, resp);

    for (int i = 0; i < (int)listings.size() && i < 20; i++) { // 20 is the max
-        sItemBase base;
+        sItemBase base = {};
        base.iID = listings[i].id;
-        base.iOpt = 0;
-        base.iTimeLimit = 0;
        base.iType = listings[i].type;

+        /*
+         * Set vehicle expiry value.
+         *
+         * Note: sItemBase.iTimeLimit in the context of vendor listings contains
+         * a duration, unlike in most other contexts where it contains the
+         * expiration timestamp.
+         */
+        if (listings[i].type == 10)
+            base.iTimeLimit = VEHICLE_EXPIRY_DURATION;
+
        sItemVendor vItem;
        vItem.item = base;
        vItem.iSortNum = listings[i].sort;
--- a/src/core/CNProtocol.cpp
+++ b/src/core/CNProtocol.cpp
@@ -41,7 +41,8 @@ int CNSocketEncryption::xorData(uint8_t* buffer, uint8_t* key, int size) {
 uint64_t CNSocketEncryption::createNewKey(uint64_t uTime, int32_t iv1, int32_t iv2) {
    uint64_t num = (uint64_t)(iv1 + 1);
    uint64_t num2 = (uint64_t)(iv2 + 1);
-    uint64_t dEKey = (uint64_t)(*(uint64_t*)&defaultKey[0]);
+    uint64_t dEKey;
+    memcpy(&dEKey, defaultKey, sizeof(dEKey));
    return dEKey * (uTime * num * num2);
 }

@@ -65,7 +66,7 @@ CNPacketData::CNPacketData(void *b, uint32_t t, int l, int trnum, void *trs):
 // ========================================================[[ CNSocket ]]========================================================

 CNSocket::CNSocket(SOCKET s, struct sockaddr_in &addr, PacketHandler ph): sock(s), sockaddr(addr), pHandler(ph) {
-    EKey = (uint64_t)(*(uint64_t*)&CNSocketEncryption::defaultKey[0]);
+    memcpy(&EKey, CNSocketEncryption::defaultKey, sizeof(EKey));
 }

 bool CNSocket::sendData(uint8_t* data, int size) {
@@ -109,7 +110,11 @@ bool CNSocket::isAlive() {
 }

 void CNSocket::kill() {
+    if (!alive)
+        return;
+
    alive = false;
+
 #ifdef _WIN32
    shutdown(sock, SD_BOTH);
    closesocket(sock);
@@ -241,9 +246,10 @@ void CNSocket::step() {
    if (readSize <= 0) {
        // we aren't reading a packet yet, try to start looking for one
        int recved = recv(sock, (buffer_t*)readBuffer, sizeof(int32_t), 0);
-        if (recved == 0) {
-            // the socket was closed normally
+        if (recved >= 0 && recved < sizeof(int32_t)) {
+            // too little data for readSize or the socket was closed normally (when 0 bytes were read)
            kill();
+            return;
        } else if (!SOCKETERROR(recved)) {
            // we got our packet size!!!!
            readSize = *((int32_t*)readBuffer);
@@ -264,11 +270,12 @@ void CNSocket::step() {
    }

    if (readSize > 0 && readBufferIndex < readSize) {
-        // read until the end of the packet! (or at least try too)
+        // read until the end of the packet (or at least try to)
        int recved = recv(sock, (buffer_t*)(readBuffer + readBufferIndex), readSize - readBufferIndex, 0);
        if (recved == 0) {
            // the socket was closed normally
            kill();
+            return;
        } else if (!SOCKETERROR(recved))
            readBufferIndex += recved;
        else if (OF_ERRNO != OF_EWOULD) {
@@ -411,9 +418,9 @@ void CNServer::addPollFD(SOCKET s) {
    fds.push_back({s, POLLIN});
 }

-void CNServer::removePollFD(int i) {
+void CNServer::removePollFD(int fd) {
    auto it = fds.begin();
-    while (it != fds.end() && it->fd != fds[i].fd)
+    while (it != fds.end() && it->fd != fd)
        it++;
    assert(it != fds.end());

@@ -458,7 +465,7 @@ void CNServer::start() {
                if (!setSockNonblocking(sock, newConnectionSocket))
                    continue;

-                std::cout << "New connection! " << inet_ntoa(address.sin_addr) << std::endl;
+                std::cout << "New " << serverType << " connection! " << inet_ntoa(address.sin_addr) << std::endl;

                addPollFD(newConnectionSocket);

@@ -473,10 +480,15 @@ void CNServer::start() {
            } else {
                std::lock_guard<std::mutex> lock(activeCrit); // protect operations on connections

+                // halt packet handling if server is shutting down
+                if (!active)
+                    return;
+
                // player sockets
                if (connections.find(fds[i].fd) == connections.end()) {
-                    std::cout << "[WARN] Event on non-existant socket?" << std::endl;
-                    continue; // just to be safe
+                    std::cout << "[FATAL] Event on non-existent socket: " << fds[i].fd << std::endl;
+                    assert(0);
+                    /* not reached */
                }

                CNSocket* cSock = connections[fds[i].fd];
@@ -485,22 +497,29 @@ void CNServer::start() {
                if (fds[i].revents & ~POLLIN)
                    cSock->kill();

-                if (cSock->isAlive()) {
+                if (cSock->isAlive())
                    cSock->step();
-                } else {
-                    killConnection(cSock);
-                    connections.erase(fds[i].fd);
-                    delete cSock;
-
-                    removePollFD(i);
-
-                    // a new entry was moved to this position, so we check it again
-                    i--;
-                }
            }
        }

        onStep();
+
+        // clean up dead connection sockets
+        auto it = connections.begin();
+        while (it != connections.end()) {
+            CNSocket *cSock = it->second;
+
+            if (!cSock->isAlive()) {
+                killConnection(cSock);
+                it = connections.erase(it);
+
+                removePollFD(cSock->sock);
+
+                delete cSock;
+            } else {
+                it++;
+            }
+        }
    }
 }

--- a/src/core/CNProtocol.hpp
+++ b/src/core/CNProtocol.hpp
@@ -230,6 +230,7 @@ protected:
    const size_t STARTFDSCOUNT = 8; // number of initial PollFD slots
    std::vector<PollFD> fds;

+    std::string serverType = "invalid";
    SOCKET sock;
    uint16_t port;
    socklen_t addressSize;
--- a/src/core/CNShared.cpp
+++ b/src/core/CNShared.cpp
@@ -1,27 +1,45 @@
 #include "core/CNShared.hpp"

-#if defined(__MINGW32__) && !defined(_GLIBCXX_HAS_GTHREADS)
-    #include "mingw/mingw.mutex.h"
-#else
-    #include <mutex>
-#endif
-std::map<int64_t, Player> CNSharedData::players;
-std::mutex playerCrit;
+static std::unordered_map<int64_t, LoginMetadata*> logins;
+static std::mutex mtx;

-void CNSharedData::setPlayer(int64_t sk, Player& plr) {
-    std::lock_guard<std::mutex> lock(playerCrit); // the lock will be removed when the function ends
+void CNShared::storeLoginMetadata(int64_t sk, LoginMetadata *lm) {
+    std::lock_guard<std::mutex> lock(mtx);

-    players[sk] = plr;
+    // take ownership of connection data
+    logins[sk] = lm;
 }

-Player CNSharedData::getPlayer(int64_t sk) {
-    std::lock_guard<std::mutex> lock(playerCrit); // the lock will be removed when the function ends
+LoginMetadata* CNShared::getLoginMetadata(int64_t sk) {
+    std::lock_guard<std::mutex> lock(mtx);

-    return players[sk];
+    // fail if the key isn't found
+    if (logins.find(sk) == logins.end())
+        return nullptr;
+
+    // transfer ownership of connection data to shard
+    LoginMetadata *lm = logins[sk];
+    logins.erase(sk);
+
+    return lm;
 }

-void CNSharedData::erasePlayer(int64_t sk) {
-    std::lock_guard<std::mutex> lock(playerCrit); // the lock will be removed when the function ends
+void CNShared::pruneLoginMetadata(CNServer *serv, time_t currTime) {
+    std::lock_guard<std::mutex> lock(mtx);

-    players.erase(sk);
+    auto it = logins.begin();
+    while (it != logins.end()) {
+        auto& sk = it->first;
+        auto& lm = it->second;
+
+        if (currTime > lm->timestamp + CNSHARED_TIMEOUT) {
+            std::cout << "[WARN] Pruning hung connection attempt" << std::endl;
+
+            // deallocate object and remove map entry
+            delete logins[sk];
+            it = logins.erase(it); // skip the invalidated iterator
+        } else {
+            it++;
+        }
+    }
 }
--- a/src/core/CNShared.hpp
+++ b/src/core/CNShared.hpp
@@ -10,11 +10,20 @@

 #include "Player.hpp"

-namespace CNSharedData {
-    // serialkey corresponds to player data
-    extern std::map<int64_t, Player> players;
+/*
+ * Connecions time out after 5 minutes, checked every 30 seconds.
+ */
+#define CNSHARED_TIMEOUT 300000
+#define CNSHARED_PERIOD 30000

-    void setPlayer(int64_t sk, Player& plr);
-    Player getPlayer(int64_t sk);
-    void erasePlayer(int64_t sk);
+struct LoginMetadata {
+    uint64_t FEKey;
+    int32_t playerId;
+    time_t timestamp;
+};
+
+namespace CNShared {
+    void storeLoginMetadata(int64_t sk, LoginMetadata *lm);
+    LoginMetadata* getLoginMetadata(int64_t sk);
+    void pruneLoginMetadata(CNServer *serv, time_t currTime);
 }
--- a/src/core/CNStructs.hpp
+++ b/src/core/CNStructs.hpp
@@ -41,9 +41,6 @@
 #define ARRLEN(x) (sizeof(x)/sizeof(*x))
 #define AUTOU16TOU8(x) U16toU8(x, ARRLEN(x)) 

-// typedef for chunk position tuple
-typedef std::tuple<int, int, uint64_t> ChunkPos;
-
 // TODO: rewrite U16toU8 & U8toU16 to not use codecvt

 std::string U16toU8(char16_t* src, size_t max);
--- a/src/core/Defines.hpp
+++ b/src/core/Defines.hpp
@@ -11,17 +11,17 @@ const float CN_EP_RANK_5 = 0.29f;

 // methods of finding players for GM commands
 enum eCN_GM_TargetSearchBy {
-	eCN_GM_TargetSearchBy__PC_ID, // player id
-	eCN_GM_TargetSearchBy__PC_Name, // firstname, lastname
-	eCN_GM_TargetSearchBy__PC_UID // account id
+    eCN_GM_TargetSearchBy__PC_ID, // player id
+    eCN_GM_TargetSearchBy__PC_Name, // firstname, lastname
+    eCN_GM_TargetSearchBy__PC_UID // account id
 };

 enum eCN_GM_TeleportType {
-	eCN_GM_TeleportMapType__XYZ,
-	eCN_GM_TeleportMapType__MapXYZ,
-	eCN_GM_TeleportMapType__MyLocation,
-	eCN_GM_TeleportMapType__SomeoneLocation,
-	eCN_GM_TeleportMapType__Unstick
+    eCN_GM_TeleportMapType__XYZ,
+    eCN_GM_TeleportMapType__MapXYZ,
+    eCN_GM_TeleportMapType__MyLocation,
+    eCN_GM_TeleportMapType__SomeoneLocation,
+    eCN_GM_TeleportMapType__Unstick
 };

 // nano powers
@@ -925,10 +925,10 @@ enum {
 * Each is the last packet - the upper bits + 1
 */
 enum {
-   N_CL2LS = 0xf,
-   N_CL2FE = 0xa5,
-   N_FE2CL = 0x12f,
-   N_LS2CL = 0x1a,
+    N_CL2LS = 0xf,
+    N_CL2FE = 0xa5,
+    N_FE2CL = 0x12f,
+    N_LS2CL = 0x1a,

-   N_PACKETS = N_CL2LS + N_CL2FE + N_FE2CL + N_LS2CL
+    N_PACKETS = N_CL2LS + N_CL2FE + N_FE2CL + N_LS2CL
 };
--- a/src/db/Database.hpp
+++ b/src/db/Database.hpp
@@ -41,6 +41,7 @@ namespace Database {
        uint64_t Timestamp;
    };
    
+    void init();
    void open();
    void close();

@@ -52,7 +53,8 @@ namespace Database {
    bool banPlayer(int playerId, std::string& reason);
    bool unbanPlayer(int playerId);

-    void updateSelected(int accountId, int playerId);
+    void updateSelected(int accountId, int slot);
+    void updateSelectedByPlayerId(int accountId, int playerId);
    
    bool validateCharacter(int characterID, int userID);
    bool isNameFree(std::string firstName, std::string lastName);
@@ -78,7 +80,9 @@ namespace Database {

    // getting players
    void getPlayer(Player* plr, int id);
+    bool _updatePlayer(Player *player);
    void updatePlayer(Player *player);
+    void commitTrade(Player *plr1, Player *plr2);
    
    // buddies
    int getNumBuddies(Player* player);
@@ -98,7 +102,7 @@ namespace Database {
    void deleteEmailAttachments(int playerID, int index, int slot);
    void deleteEmails(int playerID, int64_t* indices);
    int getNextEmailIndex(int playerID);
-    bool sendEmail(EmailData* data, std::vector<sItemBase> attachments);
+    bool sendEmail(EmailData* data, std::vector<sItemBase> attachments, Player *sender);

    // racing
    RaceRanking getTopRaceRanking(int epID, int playerID);
--- a/src/db/email.cpp
+++ b/src/db/email.cpp
@@ -152,7 +152,8 @@ void Database::updateEmailContent(EmailData* data) {
    sqlite3_step(stmt);
    int attachmentsCount = sqlite3_column_int(stmt, 0);

-    data->ItemFlag = (data->Taros > 0 || attachmentsCount > 0) ? 1 : 0; // set attachment flag dynamically
+    // set attachment flag dynamically
+    data->ItemFlag = (data->Taros > 0 || attachmentsCount > 0) ? 1 : 0;

    sqlite3_finalize(stmt);

@@ -265,7 +266,7 @@ int Database::getNextEmailIndex(int playerID) {
    return (index > 0 ? index + 1 : 1);
 }

-bool Database::sendEmail(EmailData* data, std::vector<sItemBase> attachments) {
+bool Database::sendEmail(EmailData* data, std::vector<sItemBase> attachments, Player *sender) {
    std::lock_guard<std::mutex> lock(dbCrit);

    sqlite3_exec(db, "BEGIN TRANSACTION;", NULL, NULL, NULL);
@@ -330,6 +331,13 @@ bool Database::sendEmail(EmailData* data, std::vector<sItemBase> attachments) {
        sqlite3_reset(stmt);
    }
    sqlite3_finalize(stmt);
+
+    if (!_updatePlayer(sender)) {
+        std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
+        sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
+        return false;
+    }
+
    sqlite3_exec(db, "COMMIT;", NULL, NULL, NULL);
    return true;
 }
--- a/src/db/init.cpp
+++ b/src/db/init.cpp
@@ -99,7 +99,7 @@ static void checkMetaTable() {
    sqlite3_stmt* stmt;
    sqlite3_prepare_v2(db, sql, -1, &stmt, NULL);
    if (sqlite3_step(stmt) != SQLITE_ROW) {
-        std::cout << "[FATAL] Failed to check meta table" << sqlite3_errmsg(db) << std::endl;
+        std::cout << "[FATAL] Failed to check meta table: " << sqlite3_errmsg(db) << std::endl;
        sqlite3_finalize(stmt);
        exit(1);
    }
@@ -236,7 +236,20 @@ static int getTableSize(std::string tableName) {
    return result;
 }

+void Database::init() {
+    std::cout << "[INFO] Built with libsqlite " SQLITE_VERSION << std::endl;
+
+    if (sqlite3_libversion_number() != SQLITE_VERSION_NUMBER)
+        std::cout << "[INFO] Using libsqlite " << std::string(sqlite3_libversion()) << std::endl;
+
+    if (sqlite3_libversion_number() < MIN_SUPPORTED_SQLITE_NUMBER) {
+        std::cerr << "[FATAL] Runtime sqlite version too old. Minimum compatible version: " MIN_SUPPORTED_SQLITE << std::endl;
+        exit(1);
+    }
+}
+
 void Database::open() {
+
    // XXX: move locks here
    int rc = sqlite3_open(settings::DBPATH.c_str(), &db);
    if (rc != SQLITE_OK) {
--- a/src/db/internal.hpp
+++ b/src/db/internal.hpp
@@ -3,10 +3,13 @@
 #include "db/Database.hpp"
 #include <sqlite3.h>

-#if defined(__MINGW32__) && !defined(_GLIBCXX_HAS_GTHREADS)
-    #include "mingw/mingw.mutex.h"
-#else
-    #include <mutex>
+#define MIN_SUPPORTED_SQLITE_NUMBER 3033000
+#define MIN_SUPPORTED_SQLITE "3.33.0"
+// we can't use this in #error, since it doesn't expand macros
+
+// Compile-time libsqlite version check
+#if SQLITE_VERSION_NUMBER < MIN_SUPPORTED_SQLITE_NUMBER
+#error libsqlite version too old. Minimum compatible version: 3.33.0
 #endif

 extern std::mutex dbCrit;
--- a/src/db/login.cpp
+++ b/src/db/login.cpp
@@ -79,6 +79,29 @@ void Database::updateSelected(int accountId, int slot) {
        std::cout << "[WARN] Database fail on updateSelected(): " << sqlite3_errmsg(db) << std::endl;
 }

+void Database::updateSelectedByPlayerId(int accountId, int32_t playerId) {
+    std::lock_guard<std::mutex> lock(dbCrit);
+
+    const char* sql = R"(
+        UPDATE Accounts SET
+            Selected = p.Slot,
+            LastLogin = (strftime('%s', 'now'))
+        FROM (SELECT Slot From Players WHERE PlayerId = ?) AS p
+        WHERE AccountID = ?;
+        )";
+
+    sqlite3_stmt* stmt;
+
+    sqlite3_prepare_v2(db, sql, -1, &stmt, NULL);
+    sqlite3_bind_int(stmt, 1, playerId);
+    sqlite3_bind_int(stmt, 2, accountId);
+    int rc = sqlite3_step(stmt);
+    sqlite3_finalize(stmt);
+
+    if (rc != SQLITE_DONE)
+        std::cout << "[WARN] Database fail on updateSelectedByPlayerId(): " << sqlite3_errmsg(db) << std::endl;
+}
+
 bool Database::validateCharacter(int characterID, int userID) {
    std::lock_guard<std::mutex> lock(dbCrit);

--- a/src/db/player.cpp
+++ b/src/db/player.cpp
@@ -285,11 +285,13 @@ void Database::getPlayer(Player* plr, int id) {
    sqlite3_finalize(stmt);
 }

-void Database::updatePlayer(Player *player) {
-    std::lock_guard<std::mutex> lock(dbCrit);
-
-    sqlite3_exec(db, "BEGIN TRANSACTION;", NULL, NULL, NULL);
-
+/*
+ * Low-level function to save a player to DB.
+ * Must be run in a SQL transaction and with dbCrit locked.
+ * The caller manages the transacstion, so if this function returns false,
+ * the caller must roll it back.
+ */
+bool Database::_updatePlayer(Player *player) {
    const char* sql = R"(
        UPDATE Players
        SET
@@ -336,10 +338,8 @@ void Database::updatePlayer(Player *player) {
    sqlite3_bind_int(stmt, 21, player->iID);

    if (sqlite3_step(stmt) != SQLITE_DONE) {
-        std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
        sqlite3_finalize(stmt);
-        sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
-        return;
+        return false;
    }

    sqlite3_finalize(stmt);
@@ -375,10 +375,8 @@ void Database::updatePlayer(Player *player) {
        rc = sqlite3_step(stmt);

        if (rc != SQLITE_DONE) {
-            std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
-            sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
            sqlite3_finalize(stmt);
-            return;
+            return false;
        }
        sqlite3_reset(stmt);
    }
@@ -395,10 +393,8 @@ void Database::updatePlayer(Player *player) {
        sqlite3_bind_int(stmt, 6, player->Inven[i].iTimeLimit);

        if (sqlite3_step(stmt) != SQLITE_DONE) {
-            std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
-            sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
            sqlite3_finalize(stmt);
-            return;
+            return false;
        }
        sqlite3_reset(stmt);
    }
@@ -415,10 +411,8 @@ void Database::updatePlayer(Player *player) {
        sqlite3_bind_int(stmt, 6, player->Bank[i].iTimeLimit);

        if (sqlite3_step(stmt) != SQLITE_DONE) {
-            std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
-            sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
            sqlite3_finalize(stmt);
-            return;
+            return false;
        }
        sqlite3_reset(stmt);
    }
@@ -451,10 +445,8 @@ void Database::updatePlayer(Player *player) {
        sqlite3_bind_int(stmt, 4, player->QInven[i].iID);

        if (sqlite3_step(stmt) != SQLITE_DONE) {
-            std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
-            sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
            sqlite3_finalize(stmt);
-            return;
+            return false;
        }
        sqlite3_reset(stmt);
    }
@@ -487,10 +479,8 @@ void Database::updatePlayer(Player *player) {
        sqlite3_bind_int(stmt, 4, player->Nanos[i].iStamina);

        if (sqlite3_step(stmt) != SQLITE_DONE) {
-            std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
-            sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
            sqlite3_finalize(stmt);
-            return;
+            return false;
        }
        sqlite3_reset(stmt);
    }
@@ -524,14 +514,47 @@ void Database::updatePlayer(Player *player) {
        sqlite3_bind_int(stmt, 5, player->RemainingNPCCount[i][2]);

        if (sqlite3_step(stmt) != SQLITE_DONE) {
-            std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
-            sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
            sqlite3_finalize(stmt);
-            return;
+            return false;
        }
        sqlite3_reset(stmt);
    }

-    sqlite3_exec(db, "COMMIT;", NULL, NULL, NULL);
    sqlite3_finalize(stmt);
+
+    return true;
+}
+
+void Database::updatePlayer(Player *player) {
+    std::lock_guard<std::mutex> lock(dbCrit);
+
+    sqlite3_exec(db, "BEGIN TRANSACTION;", NULL, NULL, NULL);
+
+    if (!_updatePlayer(player)) {
+        std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
+        sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
+        return;
+    }
+
+    sqlite3_exec(db, "COMMIT;", NULL, NULL, NULL);
+}
+
+void Database::commitTrade(Player *plr1, Player *plr2) {
+    std::lock_guard<std::mutex> lock(dbCrit);
+
+    sqlite3_exec(db, "BEGIN TRANSACTION;", NULL, NULL, NULL);
+
+    if (!_updatePlayer(plr1)) {
+        std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
+        sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
+        return;
+    }
+
+    if (!_updatePlayer(plr2)) {
+        std::cout << "[WARN] Database: Failed to save player to database: " << sqlite3_errmsg(db) << std::endl;
+        sqlite3_exec(db, "ROLLBACK TRANSACTION;", NULL, NULL, NULL);
+        return;
+    }
+
+    sqlite3_exec(db, "COMMIT;", NULL, NULL, NULL);
 }
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -25,6 +25,7 @@
 #include "Rand.hpp"

 #include "settings.hpp"
+#include "sandbox/Sandbox.hpp"

 #include "../version.h"

@@ -62,8 +63,20 @@ void terminate(int arg) {
    exit(0);
 }

-#ifndef _WIN32
+#ifdef _WIN32
+static BOOL winTerminate(DWORD arg) {
+    terminate(0);
+    return FALSE;
+}
+#endif
+
 void initsignals() {
+#ifdef _WIN32
+    if (!SetConsoleCtrlHandler(winTerminate, TRUE)) {
+        std::cerr << "[FATAL] Failed to set control handler" << std::endl;
+        exit(1);
+    }
+#else
    struct sigaction act;

    memset((void*)&act, 0, sizeof(act));
@@ -81,25 +94,29 @@ void initsignals() {
        perror("sigaction");
        exit(1);
    }
-}
 #endif
+}

 int main() {
+    std::cout << "[INFO] OpenFusion v" GIT_VERSION << std::endl;
+    std::cout << "[INFO] Protocol version: " << PROTOCOL_VERSION << std::endl;
+
 #ifdef _WIN32
    WSADATA wsaData;
    if (WSAStartup(MAKEWORD(1, 1), &wsaData) != 0) {
        std::cerr << "OpenFusion: WSAStartup failed" << std::endl;
        exit(EXIT_FAILURE);
    }
-#else
-    initsignals();
 #endif
-    Rand::init(getTime());
+
+    initsignals();
    settings::init();
-    std::cout << "[INFO] OpenFusion v" GIT_VERSION << std::endl;
-    std::cout << "[INFO] Protocol version: " << PROTOCOL_VERSION << std::endl;
-    std::cout << "[INFO] Intializing Packet Managers..." << std::endl;
+    Database::init();
+    Rand::init(getTime());
    TableData::init();
+
+    std::cout << "[INFO] Intializing Packet Managers..." << std::endl;
+
    PlayerManager::init();
    PlayerMovement::init();
    BuiltinCommands::init();
@@ -118,9 +135,10 @@ int main() {
    Email::init();
    Groups::init();
    Racing::init();
-    Database::open();
    Trading::init();

+    Database::open();
+
    switch (settings::EVENTMODE) {
    case 0: break; // no event
    case 1: std::cout << "[INFO] Event active. Hey, Hey It's Knishmas!" << std::endl; break;
@@ -138,6 +156,8 @@ int main() {

    shardThread = new std::thread(startShard, (CNShardServer*)shardServer);

+    sandbox_start();
+
    loginServer.start();

    shardServer->kill();
@@ -152,10 +172,15 @@ int main() {
 // helper functions

 std::string U16toU8(char16_t* src, size_t max) {
-    src[max-1] = '\0'; // force a NULL terminatorstd::string U16toU8(char16_t* src) {
+    src[max-1] = '\0'; // force a NULL terminator
    try {
        std::wstring_convert<std::codecvt_utf8_utf16<char16_t>,char16_t> convert;
-        return convert.to_bytes(src);
+        std::string ret = convert.to_bytes(src);
+
+        if (ret.size() >= max)
+            ret.resize(max-2);
+
+        return ret;
    } catch(const std::exception& e) {
        return "";
    }
@@ -179,7 +204,7 @@ size_t U8toU16(std::string src, char16_t* des, size_t max) {
 time_t getTime() {
    using namespace std::chrono;

-    milliseconds value = duration_cast<milliseconds>((time_point_cast<milliseconds>(high_resolution_clock::now())).time_since_epoch());
+    milliseconds value = duration_cast<milliseconds>((time_point_cast<milliseconds>(steady_clock::now())).time_since_epoch());

    return (time_t)value.count();
 }
--- a/src/sandbox/Sandbox.hpp
+++ b/src/sandbox/Sandbox.hpp
@@ -0,0 +1,21 @@
+#pragma once
+
+// use the sandbox on supported platforms, unless disabled
+#if defined(__linux__) || defined(__OpenBSD__)
+
+# if !defined(CONFIG_NOSANDBOX)
+void sandbox_start();
+# else
+
+#include <iostream>
+
+inline void sandbox_start() {
+    std::cout << "[WARN] Built without a sandbox" << std::endl;
+}
+
+# endif // CONFIG_NOSANDBOX
+
+#else
+// stub for unsupported platforms
+inline void sandbox_start() {}
+#endif
--- a/src/sandbox/openbsd.cpp
+++ b/src/sandbox/openbsd.cpp
@@ -0,0 +1,45 @@
+#if defined(__OpenBSD__) && !defined(CONFIG_NOSANDBOX)
+
+#include "core/Core.hpp"
+#include "settings.hpp"
+
+#include <stdio.h>
+#include <unistd.h>
+
+#include <err.h>
+
+static void eunveil(const char *path, const char *permissions) {
+    if (unveil(path, permissions) < 0)
+        err(1, "unveil");
+}
+
+void sandbox_start() {
+    /*
+     * There shouldn't ever be a reason to disable this one, but might as well
+     * be consistent with the Linux sandbox.
+     */
+    if (!settings::SANDBOX) {
+        std::cout << "[WARN] Running without a sandbox" << std::endl;
+        return;
+    }
+
+    std::cout << "[INFO] Starting pledge+unveil sandbox..." << std::endl;
+
+    if (pledge("stdio rpath wpath cpath inet flock unveil", NULL) < 0)
+        err(1, "pledge");
+
+    // database stuff
+    eunveil(settings::DBPATH.c_str(), "rwc");
+    eunveil((settings::DBPATH + "-journal").c_str(), "rwc");
+    eunveil((settings::DBPATH + "-wal").c_str(), "rwc");
+
+    // tabledata stuff
+    eunveil((settings::TDATADIR + "/" + settings::GRUNTWORKJSON).c_str(), "wc");
+
+    // for bcrypt_gensalt()
+    eunveil("/dev/urandom", "r");
+
+    eunveil(NULL, NULL);
+}
+
+#endif
--- a/src/sandbox/seccomp.cpp
+++ b/src/sandbox/seccomp.cpp
@@ -0,0 +1,324 @@
+#if defined(__linux__) && !defined(CONFIG_NOSANDBOX)
+
+#include "core/Core.hpp" // mostly for ARRLEN
+#include "settings.hpp"
+
+#include <stdlib.h>
+
+#include <sys/prctl.h>
+#include <sys/ptrace.h>
+#include <sys/mman.h> // for mmap() args
+#include <sys/ioctl.h> // for ioctl() args
+#include <termios.h> // for ioctl() args
+
+#include <linux/unistd.h>
+#include <linux/seccomp.h>
+#include <linux/filter.h>
+#include <linux/audit.h>
+#include <linux/net.h> // for socketcall() args
+
+/*
+ * Macros adapted from https://outflux.net/teach-seccomp/
+ * Relevant license:
+ *     https://source.chromium.org/chromium/chromium/src/+/master:LICENSE
+ */
+#define syscall_nr (offsetof(struct seccomp_data, nr))
+#define arch_nr (offsetof(struct seccomp_data, arch))
+
+#if defined(__i386__)
+# define ARCH_NR AUDIT_ARCH_I386
+#elif defined(__x86_64__)
+# define ARCH_NR AUDIT_ARCH_X86_64
+#elif defined(__arm__)
+# define ARCH_NR AUDIT_ARCH_ARM
+#elif defined(__aarch64__)
+# define ARCH_NR AUDIT_ARCH_AARCH64
+#else
+# error "Seccomp-bpf sandbox unsupported on this architecture"
+#endif
+
+#define VALIDATE_ARCHITECTURE \
+    BPF_STMT(BPF_LD+BPF_W+BPF_ABS, arch_nr), \
+    BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ARCH_NR, 1, 0), \
+    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL_PROCESS)
+
+#define EXAMINE_SYSCALL \
+    BPF_STMT(BPF_LD+BPF_W+BPF_ABS, syscall_nr)
+
+#define ALLOW_SYSCALL(name) \
+    BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \
+    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW)
+
+#define DENY_SYSCALL_ERRNO(name, _errno) \
+    BPF_JUMP(BPF_JMP+BPF_K+BPF_JEQ, __NR_##name, 0, 1), \
+    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO|(_errno))
+
+#define KILL_PROCESS \
+    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL_PROCESS)
+
+/*
+ * Macros adapted from openssh's sandbox-seccomp-filter.c
+ * Relevant license:
+ *     https://github.com/openssh/openssh-portable/blob/master/LICENCE
+ */
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+# define ARG_LO_OFFSET  0
+# define ARG_HI_OFFSET  sizeof(uint32_t)
+#elif __BYTE_ORDER == __BIG_ENDIAN
+# define ARG_LO_OFFSET  sizeof(uint32_t)
+# define ARG_HI_OFFSET  0
+#else
+#error "Unknown endianness"
+#endif
+
+#define ALLOW_SYSCALL_ARG(_nr, _arg_nr, _arg_val) \
+    BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (__NR_##_nr), 0, 6), \
+    /* load and test syscall argument, low word */ \
+    BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
+        offsetof(struct seccomp_data, args[(_arg_nr)]) + ARG_LO_OFFSET), \
+    BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, \
+        ((_arg_val) & 0xFFFFFFFF), 0, 3), \
+    /* load and test syscall argument, high word */ \
+    BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
+        offsetof(struct seccomp_data, args[(_arg_nr)]) + ARG_HI_OFFSET), \
+    BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, \
+        (((uint32_t)((uint64_t)(_arg_val) >> 32)) & 0xFFFFFFFF), 0, 1), \
+    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW), \
+    /* reload syscall number; all rules expect it in accumulator */ \
+    BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
+        offsetof(struct seccomp_data, nr))
+
+/* Allow if syscall argument contains only values in mask */
+#define ALLOW_SYSCALL_ARG_MASK(_nr, _arg_nr, _arg_mask) \
+    BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (__NR_##_nr), 0, 8), \
+    /* load, mask and test syscall argument, low word */ \
+    BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
+        offsetof(struct seccomp_data, args[(_arg_nr)]) + ARG_LO_OFFSET), \
+    BPF_STMT(BPF_ALU+BPF_AND+BPF_K, ~((_arg_mask) & 0xFFFFFFFF)), \
+    BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0, 0, 4), \
+    /* load, mask and test syscall argument, high word */ \
+    BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
+        offsetof(struct seccomp_data, args[(_arg_nr)]) + ARG_HI_OFFSET), \
+    BPF_STMT(BPF_ALU+BPF_AND+BPF_K, \
+        ~(((uint32_t)((uint64_t)(_arg_mask) >> 32)) & 0xFFFFFFFF)), \
+    BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, 0, 0, 1), \
+    BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW), \
+    /* reload syscall number; all rules expect it in accumulator */ \
+    BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
+        offsetof(struct seccomp_data, nr))
+
+/*
+ * This is a special case for AArch64 where this syscall apparently only
+ * exists in 32-bit compatibility mode, so we can't include the definition
+ * even though it gets called somewhere in libc.
+ */
+#if defined(__aarch64__) && !defined(__NR_fstatat64)
+#define __NR_fstatat64 0x4f
+#endif
+
+/*
+ * The main supported configuration is Linux on x86_64 with either glibc or
+ * musl-libc, with secondary support for x86, ARM and ARM64 (AAarch64) Linux.
+ *
+ * Syscalls marked with "maybe" don't seem to be used in the default
+ * configuration, but should probably be whitelisted anyway.
+ *
+ * Syscalls marked with comments like "musl-libc", "raspi" or "alt DB" were
+ * observed to be necessary on that particular configuration, but there are
+ * probably other configurations in which they are neccessary as well.
+ * ("alt DB" represents libsqlite compiled with different options.)
+ *
+ * Syscalls marked "vdso" aren't normally caught by seccomp because they are
+ * implemented in the vdso(7) in most configurations, but it's still prudent
+ * to whitelist them here.
+ */
+static sock_filter filter[] = {
+    VALIDATE_ARCHITECTURE,
+    EXAMINE_SYSCALL,
+
+    // memory management
+#ifdef __NR_mmap
+    ALLOW_SYSCALL_ARG_MASK(mmap, 2, PROT_NONE|PROT_READ|PROT_WRITE),
+#endif
+    ALLOW_SYSCALL(munmap),
+    ALLOW_SYSCALL_ARG_MASK(mprotect, 2, PROT_NONE|PROT_READ|PROT_WRITE),
+    ALLOW_SYSCALL(madvise),
+    ALLOW_SYSCALL(brk),
+
+    // basic file IO
+#ifdef __NR_open
+    ALLOW_SYSCALL(open),
+#endif
+    ALLOW_SYSCALL(openat),
+    ALLOW_SYSCALL(read),
+    ALLOW_SYSCALL(write),
+    ALLOW_SYSCALL(close),
+#ifdef __NR_stat
+    ALLOW_SYSCALL(stat),
+#endif
+    ALLOW_SYSCALL(fstat),
+#ifdef __NR_newfstatat
+    ALLOW_SYSCALL(newfstatat),
+#endif
+    ALLOW_SYSCALL(fsync), // maybe
+#ifdef __NR_creat
+    ALLOW_SYSCALL(creat), // maybe; for DB journal
+#endif
+#ifdef __NR_unlink
+    ALLOW_SYSCALL(unlink), // for DB journal
+#endif
+    ALLOW_SYSCALL(lseek), // musl-libc; alt DB
+    ALLOW_SYSCALL(truncate), // for truncate-mode DB
+    ALLOW_SYSCALL(ftruncate), // for truncate-mode DB
+    ALLOW_SYSCALL(dup), // for perror(), apparently
+
+    // more IO
+    ALLOW_SYSCALL(pread64),
+    ALLOW_SYSCALL(pwrite64),
+    ALLOW_SYSCALL(fdatasync),
+    ALLOW_SYSCALL(writev), // musl-libc
+    ALLOW_SYSCALL(preadv), // maybe; alt-DB
+    ALLOW_SYSCALL(preadv2), // maybe
+
+    // misc syscalls called from libc
+    ALLOW_SYSCALL(getcwd),
+    ALLOW_SYSCALL(getpid),
+    ALLOW_SYSCALL(geteuid),
+    ALLOW_SYSCALL(gettid), // maybe
+    ALLOW_SYSCALL_ARG(ioctl, 1, TIOCGWINSZ), // musl-libc
+    ALLOW_SYSCALL_ARG(fcntl, 1, F_GETFL),
+    ALLOW_SYSCALL_ARG(fcntl, 1, F_SETFL),
+    ALLOW_SYSCALL_ARG(fcntl, 1, F_GETLK),
+    ALLOW_SYSCALL_ARG(fcntl, 1, F_SETLK),
+    ALLOW_SYSCALL_ARG(fcntl, 1, F_SETLKW), // maybe
+    ALLOW_SYSCALL(exit),
+    ALLOW_SYSCALL(exit_group),
+    ALLOW_SYSCALL(rt_sigprocmask), // musl-libc
+    ALLOW_SYSCALL(clock_nanosleep), // gets called very rarely
+#ifdef __NR_rseq
+    ALLOW_SYSCALL(rseq),
+#endif
+
+    // to crash properly on SIGSEGV
+    DENY_SYSCALL_ERRNO(tgkill, EPERM),
+    DENY_SYSCALL_ERRNO(tkill, EPERM), // musl-libc
+    DENY_SYSCALL_ERRNO(rt_sigaction, EPERM),
+
+    // threading
+    ALLOW_SYSCALL(futex),
+
+    // networking
+#ifdef __NR_poll
+    ALLOW_SYSCALL(poll),
+#endif
+#ifdef __NR_accept
+    ALLOW_SYSCALL(accept),
+#endif
+    ALLOW_SYSCALL(setsockopt),
+    ALLOW_SYSCALL(sendto),
+    ALLOW_SYSCALL(recvfrom),
+    ALLOW_SYSCALL(shutdown),
+
+    // vdso
+    ALLOW_SYSCALL(clock_gettime),
+    ALLOW_SYSCALL(gettimeofday),
+#ifdef __NR_time
+    ALLOW_SYSCALL(time),
+#endif
+    ALLOW_SYSCALL(rt_sigreturn),
+
+    // i386
+#ifdef __NR_socketcall
+    ALLOW_SYSCALL_ARG(socketcall, 0, SYS_ACCEPT),
+    ALLOW_SYSCALL_ARG(socketcall, 0, SYS_SETSOCKOPT),
+    ALLOW_SYSCALL_ARG(socketcall, 0, SYS_SEND),
+    ALLOW_SYSCALL_ARG(socketcall, 0, SYS_RECV),
+    ALLOW_SYSCALL_ARG(socketcall, 0, SYS_SENDTO), // maybe
+    ALLOW_SYSCALL_ARG(socketcall, 0, SYS_RECVFROM), // maybe
+    ALLOW_SYSCALL_ARG(socketcall, 0, SYS_SHUTDOWN),
+#endif
+
+    // Raspberry Pi (ARM)
+#ifdef __NR_set_robust_list
+    ALLOW_SYSCALL(set_robust_list),
+#endif
+#ifdef __NR_clock_gettime64
+    ALLOW_SYSCALL(clock_gettime64),
+#endif
+#ifdef __NR_mmap2
+    ALLOW_SYSCALL_ARG_MASK(mmap2, 2, PROT_NONE|PROT_READ|PROT_WRITE),
+#endif
+#ifdef __NR_fcntl64
+    ALLOW_SYSCALL(fcntl64),
+#endif
+#ifdef __NR_stat64
+    ALLOW_SYSCALL(stat64),
+#endif
+#ifdef __NR_send
+    ALLOW_SYSCALL(send),
+#endif
+#ifdef __NR_recv
+    ALLOW_SYSCALL(recv),
+#endif
+#ifdef __NR_fstat64
+    ALLOW_SYSCALL(fstat64),
+#endif
+#ifdef __NR_geteuid32
+    ALLOW_SYSCALL(geteuid32),
+#endif
+#ifdef __NR_truncate64
+    ALLOW_SYSCALL(truncate64),
+#endif
+#ifdef __NR_ftruncate64
+    ALLOW_SYSCALL(ftruncate64),
+#endif
+#ifdef __NR_sigreturn
+    ALLOW_SYSCALL(sigreturn), // vdso
+#endif
+#ifdef __NR_clock_nanosleep_time64
+    ALLOW_SYSCALL(clock_nanosleep_time64), // maybe
+#endif
+
+    // AArch64 (ARM64)
+#ifdef __NR_unlinkat
+    ALLOW_SYSCALL(unlinkat),
+#endif
+#ifdef __NR_fstatat64
+    ALLOW_SYSCALL(fstatat64),
+#endif
+#ifdef __NR_ppoll
+    ALLOW_SYSCALL(ppoll),
+#endif
+
+    KILL_PROCESS
+};
+
+static sock_fprog prog = {
+    ARRLEN(filter), filter
+};
+
+// our own wrapper for the seccomp() syscall
+int seccomp(unsigned int operation, unsigned int flags, void *args) {
+    return syscall(__NR_seccomp, operation, flags, args);
+}
+
+void sandbox_start() {
+    if (!settings::SANDBOX) {
+        std::cout << "[WARN] Running without a sandbox" << std::endl;
+        return;
+    }
+
+    std::cout << "[INFO] Starting seccomp-bpf sandbox..." << std::endl;
+
+    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
+        perror("prctl");
+        exit(1);
+    }
+
+    if (seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, &prog) < 0) {
+        perror("seccomp");
+        exit(1);
+    }
+}
+
+#endif
--- a/src/servers/CNLoginServer.cpp
+++ b/src/servers/CNLoginServer.cpp
@@ -11,6 +11,7 @@
 std::map<CNSocket*, CNLoginData> CNLoginServer::loginSessions;

 CNLoginServer::CNLoginServer(uint16_t p) {
+    serverType = "login";
    port = p;
    pHandler = &CNLoginServer::handlePacket;
    init();
@@ -19,6 +20,17 @@ CNLoginServer::CNLoginServer(uint16_t p) {
 void CNLoginServer::handlePacket(CNSocket* sock, CNPacketData* data) {
    printPacket(data);

+    if (loginSessions.find(sock) == loginSessions.end() &&
+        data->type != P_CL2LS_REQ_LOGIN && data->type != P_CL2LS_REP_LIVE_CHECK) {
+
+        if (settings::VERBOSITY > 0) {
+            std::cerr << "OpenFusion: LOGIN PKT OUT-OF-SEQ. PacketType: " <<
+                Packets::p2str(data->type) << " (" << data->type << ")" << std::endl;
+        }
+
+        return;
+    }
+
    switch (data->type) {
        case P_CL2LS_REQ_LOGIN: {
            login(sock, data);
@@ -133,8 +145,12 @@ void CNLoginServer::login(CNSocket* sock, CNPacketData* data) {
    Database::findAccount(&findUser, userLogin);
    
    // account was not found
-    if (findUser.AccountID == 0)
-        return newAccount(sock, userLogin, userPassword, login->iClientVerC);
+    if (findUser.AccountID == 0) {
+        if (settings::AUTOCREATEACCOUNTS)
+            return newAccount(sock, userLogin, userPassword, login->iClientVerC);
+
+        return loginFail(LoginError::ID_DOESNT_EXIST, userLogin, sock);
+    }

    if (!CNLoginServer::isPasswordCorrect(findUser.Password, userPassword))
        return loginFail(LoginError::ID_AND_PASSWORD_DO_NOT_MATCH, userLogin, sock);
@@ -193,9 +209,12 @@ void CNLoginServer::login(CNSocket* sock, CNPacketData* data) {
    // send the resp in with original key
    sock->sendPacket(resp, P_LS2CL_REP_LOGIN_SUCC);

+    uint64_t defaultKey;
+    memcpy(&defaultKey, CNSocketEncryption::defaultKey, sizeof(defaultKey));
+
    // update keys
    sock->setEKey(CNSocketEncryption::createNewKey(resp.uiSvrTime, resp.iCharCount + 1, resp.iSlotNum + 1));
-    sock->setFEKey(CNSocketEncryption::createNewKey((uint64_t)(*(uint64_t*)&CNSocketEncryption::defaultKey[0]), login->iClientVerC, 1));
+    sock->setFEKey(CNSocketEncryption::createNewKey(defaultKey, login->iClientVerC, 1));

    DEBUGLOG(
        std::cout << "Login Server: Login success. Welcome " << userLogin << " [" << loginSessions[sock].userID << "]" << std::endl;
@@ -445,7 +464,7 @@ void CNLoginServer::characterSelect(CNSocket* sock, CNPacketData* data) {
     * the shard IP has been configured to an address the local machine can't
     * reach itself from.
     */
-    if (sock->sockaddr.sin_addr.s_addr == htonl(INADDR_LOOPBACK))
+    if (settings::LOCALHOSTWORKAROUND && sock->sockaddr.sin_addr.s_addr == htonl(INADDR_LOOPBACK))
        shard_ip = "127.0.0.1";

    memcpy(resp.g_FE_ServerIP, shard_ip, strlen(shard_ip));
@@ -453,21 +472,20 @@ void CNLoginServer::characterSelect(CNSocket* sock, CNPacketData* data) {
    resp.g_FE_ServerIP[strlen(shard_ip)] = '\0';
    resp.g_FE_ServerPort = settings::SHARDPORT;

-    // pass player to CNSharedData
-    Player passPlayer = {};
-    Database::getPlayer(&passPlayer, selection->iPC_UID);
-    // this should never happen but for extra safety
-    if (passPlayer.iID == 0)
-        return invalidCharacter(sock);
+    LoginMetadata *lm = new LoginMetadata();
+    lm->FEKey = sock->getFEKey();
+    lm->timestamp = getTime();
+    lm->playerId = selection->iPC_UID;

-    passPlayer.FEKey = sock->getFEKey();
-    resp.iEnterSerialKey = passPlayer.iID;
-    CNSharedData::setPlayer(resp.iEnterSerialKey, passPlayer);
+    resp.iEnterSerialKey = Rand::cryptoRand();
+
+    // transfer ownership of connection data to CNShared
+    CNShared::storeLoginMetadata(resp.iEnterSerialKey, lm);

    sock->sendPacket(resp, P_LS2CL_REP_SHARD_SELECT_SUCC);

    // update current slot in DB
-    Database::updateSelected(loginSessions[sock].userID, passPlayer.slot);
+    Database::updateSelectedByPlayerId(loginSessions[sock].userID, selection->iPC_UID);
 }

 void CNLoginServer::finishTutorial(CNSocket* sock, CNPacketData* data) {
--- a/src/servers/CNShardServer.cpp
+++ b/src/servers/CNShardServer.cpp
@@ -16,6 +16,7 @@ std::map<uint32_t, PacketHandler> CNShardServer::ShardPackets;
 std::list<TimerEvent> CNShardServer::Timers;

 CNShardServer::CNShardServer(uint16_t p) {
+    serverType = "shard";
    port = p;
    pHandler = &CNShardServer::handlePacket;
    REGISTER_SHARD_TIMER(keepAliveTimer, 4000);
@@ -29,11 +30,31 @@ CNShardServer::CNShardServer(uint16_t p) {
 void CNShardServer::handlePacket(CNSocket* sock, CNPacketData* data) {
    printPacket(data);

-    if (ShardPackets.find(data->type) != ShardPackets.end())
-        ShardPackets[data->type](sock, data);
-    else if (settings::VERBOSITY > 0)
-        std::cerr << "OpenFusion: SHARD UNIMPLM ERR. PacketType: " << Packets::p2str(data->type) << " (" << data->type << ")" << std::endl;
+    // if it's a valid packet
+    if (ShardPackets.find(data->type) != ShardPackets.end()) {

+        // reject gameplay packets if not yet fully connected
+        if (PlayerManager::players.find(sock) == PlayerManager::players.end()
+            && data->type != P_CL2FE_REQ_PC_ENTER && data->type != P_CL2FE_REP_LIVE_CHECK) {
+
+            if (settings::VERBOSITY > 0) {
+                std::cerr << "OpenFusion: SHARD PKT OUT-OF-SEQ. PacketType: " <<
+                    Packets::p2str(data->type) << " (" << data->type << ")" << std::endl;
+            }
+
+            return;
+        }
+
+        // run the appropriate packet handler
+        ShardPackets[data->type](sock, data);
+    } else if (settings::VERBOSITY > 0) {
+        std::cerr << "OpenFusion: SHARD UNIMPLM ERR. PacketType: " << Packets::p2str(data->type) << " (" << data->type << ")" << std::endl;
+    }
+
+    /*
+     * We must re-check if the player is still connected in case
+     * they were dropped when handling the packet.
+     */
    if (PlayerManager::players.find(sock) != PlayerManager::players.end())
        PlayerManager::players[sock]->lastHeartbeat = getTime();
 }
@@ -79,14 +100,7 @@ void CNShardServer::_killConnection(CNSocket* cns) {
    if (PlayerManager::players.find(cns) == PlayerManager::players.end())
        return;

-    Player* plr = PlayerManager::getPlayer(cns);
-
-    int64_t key = plr->SerialKey;
-
    PlayerManager::removePlayer(cns); // removes the player from the list and saves it to DB
-
-    // remove from CNSharedData
-    CNSharedData::erasePlayer(key);
 }

 void CNShardServer::killConnection(CNSocket *cns) {
@@ -102,6 +116,10 @@ void CNShardServer::kill() {
 void CNShardServer::onStep() {
    time_t currTime = getTime();

+    // do not evaluate timers if the server is shutting down
+    if (!active)
+        return;
+
    for (TimerEvent& event : Timers) {
        if (event.scheduledEvent == 0) {
            // event hasn't been queued yet, go ahead and do that
--- a/src/servers/Monitor.cpp
+++ b/src/servers/Monitor.cpp
@@ -1,6 +1,7 @@
 #include "servers/CNShardServer.hpp"
 #include "PlayerManager.hpp"
 #include "Chat.hpp"
+#include "Email.hpp"
 #include "servers/Monitor.hpp"
 #include "settings.hpp"

@@ -38,9 +39,42 @@ static bool transmit(std::list<SOCKET>::iterator& it, char *buff, int len) {
    return true;
 }

+/*
+ * The longest protocol message is for an email.
+ *
+ * message type + two formatted character names + the other formatting chars
+ * + the email title + the email body = ~1154
+ *
+ * The body can grow to twice its usual size (512) in the pathological case
+ * where every character is a newline.
+ *
+ * Multi-byte Unicode characters aren't a factor, as they should've been
+ * stripped out by sanitizeText().
+ */
+#define BUFSIZE 2048
+
+static int process_email(char *buff, std::string email) {
+    strncpy(buff, "email ", 6);
+    int i = 6;
+
+    for (char c : email) {
+        if (i == BUFSIZE-2)
+            break;
+
+        buff[i++] = c;
+
+        // indent each line to prevent "endemail" spoofing
+        if (c == '\n')
+            buff[i++] = '\t';
+    }
+
+    buff[i++] = '\n';
+    return i;
+}
+
 static void tick(CNServer *serv, time_t delta) {
    std::lock_guard<std::mutex> lock(sockLock);
-    char buff[256];
+    char buff[BUFSIZE];
    int n;

    auto it = sockets.begin();
@@ -70,6 +104,17 @@ outer:
                goto outer;
        }

+        // emails
+        for (auto& str : Email::dump) {
+            n = process_email(buff, str);
+
+            if (!transmit(it, buff, n))
+                goto outer;
+
+            if (!transmit(it, (char*)"endemail\n", 9))
+                goto outer;
+        }
+
        if (!transmit(it, (char*)"end\n", 4))
            continue;

@@ -77,6 +122,7 @@ outer:
    }

    Chat::dump.clear();
+    Email::dump.clear();
 }

 bool Monitor::acceptConnection(SOCKET fd, uint16_t revents) {
--- a/src/settings.cpp
+++ b/src/settings.cpp
@@ -7,16 +7,20 @@

 // defaults :)
 int settings::VERBOSITY = 1;
+bool settings::SANDBOX = true;

 int settings::LOGINPORT = 23000;
 bool settings::APPROVEALLNAMES = true;
+bool settings::AUTOCREATEACCOUNTS = true;
 int settings::DBSAVEINTERVAL = 240;

 int settings::SHARDPORT = 23001;
 std::string settings::SHARDSERVERIP = "127.0.0.1";
+bool settings::LOCALHOSTWORKAROUND = true;
 time_t settings::TIMEOUT = 60000;
 int settings::VIEWDISTANCE = 25600;
 bool settings::SIMULATEMOBS = true;
+bool settings::ANTICHEAT = true;

 // default spawn point
 #ifndef ACADEMY
@@ -43,12 +47,13 @@ std::string settings::GRUNTWORKJSON = "gruntwork.json";
 std::string settings::MOTDSTRING = "Welcome to OpenFusion!";
 std::string settings::DROPSJSON = "drops.json";
 std::string settings::PATHJSON = "paths.json";
+std::string settings::PATCHMAPJSON = "patchmap.json";
 #ifdef ACADEMY
 std::string settings::XDTJSON = "xdt1013.json";
-std::string settings::ENABLEDPATCHES = "1013";
+std::string settings::BUILDNAME = "beta-20111013";
 #else
 std::string settings::XDTJSON = "xdt.json";
-std::string settings::ENABLEDPATCHES = "";
+std::string settings::BUILDNAME = "beta-20100104";
 #endif // ACADEMY

 int settings::ACCLEVEL = 1;
@@ -74,12 +79,16 @@ void settings::init() {
        return;
    }

-    APPROVEALLNAMES = reader.GetBoolean("", "acceptallcustomnames", APPROVEALLNAMES);
+    BUILDNAME = reader.Get("", "buildname", BUILDNAME);
    VERBOSITY = reader.GetInteger("", "verbosity", VERBOSITY);
+    SANDBOX = reader.GetBoolean("", "sandbox", SANDBOX);
    LOGINPORT = reader.GetInteger("login", "port", LOGINPORT);
-    SHARDPORT = reader.GetInteger("shard", "port", SHARDPORT);
+    APPROVEALLNAMES = reader.GetBoolean("login", "acceptallcustomnames", APPROVEALLNAMES);
+    AUTOCREATEACCOUNTS = reader.GetBoolean("login", "autocreateaccounts", AUTOCREATEACCOUNTS);
    DBSAVEINTERVAL = reader.GetInteger("login", "dbsaveinterval", DBSAVEINTERVAL);
-    SHARDSERVERIP = reader.Get("shard", "ip", "127.0.0.1");
+    SHARDPORT = reader.GetInteger("shard", "port", SHARDPORT);
+    SHARDSERVERIP = reader.Get("shard", "ip", SHARDSERVERIP);
+    LOCALHOSTWORKAROUND = reader.GetBoolean("shard", "localhostworkaround", LOCALHOSTWORKAROUND);
    TIMEOUT = reader.GetInteger("shard", "timeout", TIMEOUT);
    VIEWDISTANCE = reader.GetInteger("shard", "viewdistance", VIEWDISTANCE);
    SIMULATEMOBS = reader.GetBoolean("shard", "simulatemobs", SIMULATEMOBS);
@@ -98,10 +107,11 @@ void settings::init() {
    DBPATH = reader.Get("shard", "dbpath", DBPATH);
    TDATADIR = reader.Get("shard", "tdatadir", TDATADIR);
    PATCHDIR = reader.Get("shard", "patchdir", PATCHDIR);
-    ENABLEDPATCHES = reader.Get("shard", "enabledpatches", ENABLEDPATCHES);
+    PATCHMAPJSON = reader.Get("shard", "patchmapdata", PATCHMAPJSON);
    ACCLEVEL = reader.GetInteger("shard", "accountlevel", ACCLEVEL);
    EVENTMODE = reader.GetInteger("shard", "eventmode", EVENTMODE);
    DISABLEFIRSTUSEFLAG = reader.GetBoolean("shard", "disablefirstuseflag", DISABLEFIRSTUSEFLAG);
+    ANTICHEAT = reader.GetBoolean("shard", "anticheat", ANTICHEAT);
    MONITORENABLED = reader.GetBoolean("monitor", "enabled", MONITORENABLED);
    MONITORPORT = reader.GetInteger("monitor", "port", MONITORPORT);
    MONITORINTERVAL = reader.GetInteger("monitor", "interval", MONITORINTERVAL);
--- a/src/settings.hpp
+++ b/src/settings.hpp
@@ -2,11 +2,15 @@

 namespace settings {
    extern int VERBOSITY;
+    extern bool SANDBOX;
    extern int LOGINPORT;
    extern bool APPROVEALLNAMES;
+    extern bool AUTOCREATEACCOUNTS;
    extern int DBSAVEINTERVAL;
    extern int SHARDPORT;
    extern std::string SHARDSERVERIP;
+    extern bool LOCALHOSTWORKAROUND;
+    extern bool ANTICHEAT;
    extern time_t TIMEOUT;
    extern int VIEWDISTANCE;
    extern bool SIMULATEMOBS;
@@ -25,7 +29,8 @@ namespace settings {
    extern std::string GRUNTWORKJSON;
    extern std::string DBPATH;
    extern std::string PATCHDIR;
-    extern std::string ENABLEDPATCHES;
+    extern std::string PATCHMAPJSON;
+    extern std::string BUILDNAME;
    extern std::string TDATADIR;
    extern int EVENTMODE;
    extern bool MONITORENABLED;
--- a/2
+++ b/2
--- a/vendor/bcrypt/crypt_blowfish.c
+++ b/vendor/bcrypt/crypt_blowfish.c
@@ -58,7 +58,7 @@
 #endif

 #ifdef __i386__
-#define BF_ASM				1
+#define BF_ASM				0
 #define BF_SCALE			1
 #elif defined(__x86_64__) || defined(__alpha__) || defined(__hppa__)
 #define BF_ASM				0
Author	SHA1	Message	Date
dongresource	3cfecd9644	Refuse to run if the specified build name isn't in the patch map	2023-06-26 06:48:12 +02:00
dongresource	6537e38987	Replace enabledpatches config option with patchmap.json This should make it a lot easier to manage patch directories when we add support for each known client build.	2023-06-26 05:42:57 +02:00
dongresource	23ab908366	Refuse to start if there are invalid NPC types in the JSONs This fixes an issue where there server would start up fine even if NPC types from a later build were found in the gruntwork file. Because of the semantics of the C++ array indexing operator, the index into NPCData in loadGruntworkPost() would silently create extra entries in the nlohmann::json array, which would break future NPC type limit checks and subsequently crash the server at the next invocation of /summonW, and likely other places. We fix this by refusing to start the server if any invalid NPC types are found, because simply skipping them in the gruntwork file would silently omit them from further writes to the gruntwork file, which would be undesirable data loss.	2023-06-22 02:43:26 +02:00
dongresource	be6a4c0a5d	Enforce minimum supported libsqlite version The server now checks the libsqlite both at compile time and on server startup. The version the executable was built with and the one it's running with may be different, so long as they're both at or above the minimum supported version. One or both version numbers are printed on startup, depending on if they're identical or not. The compile-time ("Built with") version depends on the sqlite3.h header used during compilation, while the runtime ("Using") version depends on either: * The sqlite3.c version used during compilation, if statically linked. (Which may be different from the header version and still compile and run fine.) * The version of the libsqlite3.so or sqlite3.dll that the server loaded, if dynamically linked. Version mismatches here are normal, especially on Unix systems with their own system libraries. The current minimum version is 3.33.0, from 2020-08-14, as that's the one that introduced the UPDATE-FROM syntax used during login by Database::updateSelectedByPlayerId(). Also rearranged the prints and initialization calls in main() slightly.	2023-03-19 01:41:07 +01:00
dongresource	8eb1af20c8	Clean up tdata file loading logic slightly The earlier addition of empty file checks made it just a bit too cumbersome.	2023-03-13 21:42:59 +01:00
dongresource	e73daa0865	Skip loadGruntworkPre() if there's no gruntwork Previously, only loadGruntworkPost() would be skipped if the gruntwork was null, but it was never null at that point because loadGruntworkPre() would inadvertently create gruntwork["paths"] when it indexes it to iterate through it. Now, the gruntwork loading messages will no longer be misleadingly printed to stdout when there isn't a gruntwork file.	2023-03-13 05:58:49 +01:00
dongresource	743a39c125	Tolerate empty gruntwork file This prevents the server from failing to start if a gruntwork file exists, but happens to be empty.	2023-03-13 05:18:27 +01:00
dongresource	a9af8713bc	Reject network messages too small for the packet size field	2023-03-12 01:45:18 +01:00
dongresource	4825267537	Use memcpy() instead of casting to load keys UBSAN complains about the casting approach because it loads a 64-bit integer from the defaultKeys string which isn't guaranteed to be 64-bit aligned, which is undefined behavior.	2023-03-11 23:16:09 +01:00
dongresource	a92cfaff25	Differentiate new connection messages on the login and shard ports	2023-03-11 21:54:56 +01:00
dongresource	abcfa3445b	Move dead socket cleanup out of the poll() loop This fixes a potential desync between the fds vector and the connections map that could happen due to file descriptor number reuse.	2023-03-11 03:24:48 +01:00
dongresource	2bf14200f7	Make CNSocket::kill() idempotent CNSocket::kill() will now no longer call close() on already closed sockets. close() should never be called on already closed file descriptors, yet CNSocket::kill() was lacking any protection against that, despite its use as both a high-level way of killing player connections and as a means of ensuring that closing connections have been properly terminated in the poll() loop. This was causing close() to be erroneously called on each socket at least one extra time. It was also introducing a race condition where the login and shard threads could close each other's newly opened sockets due to file descriptor reuse when a connection was accept()ed after the first call to close(), but before the second one. See the close(2) manpage for details.	2023-03-11 02:59:05 +01:00
dongresource	876a9c82cd	Bump copyright year to 2023	2023-03-06 21:08:45 +01:00
dongresource	fb5b0eeeb9	Make socket connection state mismatch into a fatal error These problems are usually not ephemeral, and cause persistent console spam, so they should immediately crash the server so they can be investigated.	2023-03-06 02:21:54 +01:00
dongresource	7aabc507e7	Stop handling the current packet if the server is shutting down Previously, terminating a running server from the terminal would sometimes print a benign warning message if the server was currently handling an incoming packet. This happened because CNServer::step() would continue handling the packet after CNServer::kill() released the activeCrit mutex. Now it first re-checks if active has been set to false in the mean time after acquiring the mutex.	2023-03-06 02:21:54 +01:00
CPunch	2914b95cff	Combat: 3+ targets should automatically kick the connection	2023-03-01 11:18:41 -06:00
CPunch	dbd2ec2270	Email: update the item slots via a ITEM_MOVE_SUCC packet	2023-02-28 15:15:57 -06:00
CPunch	50e00a6772	Email: fix issue #186	2023-02-28 15:14:04 -06:00
dongresource	7471bcbf38	Fix vehicle rental periods not showing up in vendor listings Fixes #250.	2022-12-28 17:57:37 +01:00
dongresource	100b4605ec	Fix early CNShared timeout Revisiting this again; the issue was that the comparison operator was facing the wrong way, so connections were being pruned every 30 seconds or less. This was effectively a race condition kicking an unlucky player every so often when pruning happened exactly during an attempt to enter the game. Now that the proper timeout is being enforced, I've reduced it to 5 minutes, down from 15, since it really doesn't need to be that long.	2022-12-11 19:46:29 +01:00
dongresource	741b898230	Remove redundant copy of Player object when added to the shard Since the Player object is loaded up in loadPlayer() now, it's pretty apparent that there's no more reason to copy it around at any point.	2022-12-06 02:11:31 +01:00
dongresource	3f44f53f97	On login, load Player from DB in shard thread, not in login thread This avoids some needless data shuffling and fixes a rare desync.	2022-12-06 01:07:21 +01:00
dongresource	d92b407349	Fix sanity check in emailReceiveItemSingle()	2022-12-05 22:30:02 +01:00
dongresource	9b3e856a05	Sync player data to DB when trading and sending emails	2022-12-05 22:29:23 +01:00
dongresource	eb8e54c1f0	Do not evaluate timers if the server is shutting down This should fix issues with segfaults when the server is being terminated that sometimes occur because things like NPC path traversal keep running while the process is executing the signal handler.	2022-11-27 22:33:55 +01:00
dongresource	1ba0f5e14a	Mention Linux instructions in README.md Also clarify the line about CI binaries.	2022-11-26 20:30:07 +01:00
dongresource	12dde394c0	Add undocumented config option to disable rapid fire anticheat This quick hack has been around for a while, so we might as well make it configurable. Also updated tdata reference.	2022-11-26 19:36:10 +01:00
dongresource	b1eea6d4fe	[seccomp] Whitelist rseq syscall Used by glibc 2.35 and later.	2022-11-15 02:30:20 +01:00
dongresource	f126b88781	[seccomp] Whitelist newfstatat and fix a few #ifdefs Some newer versions of either glibc or libsqlite3 seem to require this syscall for the server to terminate properly.	2022-09-04 20:53:17 +02:00
dongresource	2dbe2629c1	Tweak CNShared * Separate pruning frequency from timeout * Pluralize CNShared map: login -> logins * Increase connection timeout to 15 minutes * Do not deallocate a nullptr in playerEnter() * Kill connections rejected by playerEnter() * Remove redundant inclusions of mutex headers in a few places	2022-07-31 03:19:27 +02:00
dongresource	271eef83d3	[seccomp] Add support for AArch64 This is useful for 64-bit Raspberry Pis and other 64-bit ARM systems.	2022-07-24 22:40:46 +02:00
dongresource	ca0d608a87	Use cryptographic RNG to generate the shard connection serial key	2022-07-24 21:36:03 +02:00
dongresource	741bfb675b	Revamp CNShared logic * Use a specialized connection object * Copy the Player object less frequently * Use a randomly generated serial key for shard auth * Refuse invalid shard connection attempts * Clean up connection metadata when a Player joins the shard * Prune abandoned connections when they time out	2022-07-24 21:36:03 +02:00
dongresource	c5dd745aa1	Rename CNSharedData namespace to CNShared to match the filename	2022-07-24 21:36:03 +02:00
dongresource	998b12617e	Reject packets sent before a connection has been fully established	2022-07-24 21:36:03 +02:00
dongresource	129d1c2fe3	Use a specialized null value for ChunkPos This prevents logic errors related to being in chunk 0 0 0. Also: * Moved some duplicated chunk teleportation logic to a new helper function * Made ChunkPos into a proper class so it can default to INVALID_CHUNK when default-initialized * Reversed the inclusion order of Chunking.hpp and Entities.hpp to work around problems with type definitions	2022-07-24 21:36:03 +02:00
CakeLancelot	1bd4d2fbee	Cleanly remove player when an exit is requested The client will actually do this itself when clicking the quit button in the tilde menu, but for the idle timer the connection would remain open until the game is closed.	2022-07-19 01:17:43 -05:00
dongresource	63d4087488	Add config option to disable automatic account creation Also moved the acceptallcustomnames setting to the login section where it belongs.	2022-06-29 23:42:44 +02:00
dongresource	abda9dc158	Bump copyright year to 2022	2022-06-28 23:13:39 +02:00
CakeLancelot	7b7d8bce45	Update README.md Elaborate on server setup instructions a bit	2022-06-01 17:47:39 -05:00
gsemaj	a9942eadab	Only upload artifacts from `master`	2022-04-09 13:31:05 -04:00
Gent Semaj	36638b1522	Update README with new artifact location	2022-04-07 15:29:54 -04:00
gsemaj	685cee2561	Fix directory names for artifacts	2022-04-07 10:17:42 -04:00
gsemaj	b683152fbf	Fix `git describe --tags` not working in CI	2022-04-07 10:03:10 -04:00
gsemaj	86576d48f6	Run CI/CD for pull requests marked as ready for review	2022-04-06 19:33:38 -04:00
gsemaj	4e1767ad58	Fix CI/CD not zipping subfolders	2022-04-06 19:15:19 -04:00
Gent Semaj	4354cab7e3	Add CI/CD step to upload artifacts off-site (#244 ) * Download and list artifacts after build * Add commit hash + file extension to artifact name * Initial SSH implementation * Don't build artifacts for PRs * Fetch endpoint from secret * Zip artifacts before uploading to CDN * Use short SHA in archive names	2022-04-06 18:24:34 -04:00
CPunch	4f6979f236	Trigger check-builds on Makefile changes	2022-04-04 19:50:05 -05:00
CPunch	1404fa0bb7	Removed references to Appveyor	2022-04-04 19:47:24 -05:00
CPunch	7f65ec5b96	Fixed workflow badge	2022-04-04 19:41:05 -05:00
CPunch	041908ddda	CI: Moved to Github Workflows from Appveyor (#243 ) YOLO	2022-04-04 20:38:05 -04:00
dongresource	57c9f139a2	Fix quest item drop chances being shared between missions In our original implementation, quest item drops were rolled on the spot, so the chances of getting two quest items for different missions in a single kill (where both missions have you kill the same mob) were independent of each other. When we made quest item drop chances shared between group members so players doing missions together would progress at the same rate, we accidentally linked the quest item odds of different missions together. This change makes it so that the odds are per-task, so they're shared between different group members doing the same tasks, but distinct for different tasks being done by the same player.	2022-02-12 23:53:04 +01:00
dongresource	d3af99fcef	A few cosmetic changes in Missions.cpp * Removed a redundant failure case in endTask() * Fixed a misleading comment in startTask() * Removed a redundant level check in updateFusionMatter() * Cleared up misleading comment and code layout in taskEnd() * Removed unnecessary comment in mobKilled()	2022-02-12 21:45:11 +01:00
dongresource	94af318139	Work around a client bug related to simultanious quest item drops	2022-02-12 21:45:07 +01:00
dongresource	91f9a2085b	Fix three-space indentation in a few places	2022-02-11 23:22:31 +01:00
dongresource	00865e1c7b	Fix player state issue after failing to complete a mission Fixes #225. Co-authored-by: Jade <jadeshrinemaiden@gmail.com>	2022-02-11 23:20:40 +01:00
dongresource	28bfd14362	Quick-fix for doDamage() crash Couldn't get a reliable repro, but this is probably what that bug was. It's not very throughly investigated, but we'll be tweaking those parts of the codebase anyway, so we can examine if there's a deeper issue later.	2022-02-08 17:02:42 +01:00
dongresource	6412a9a89e	Fix missing validation in Nanos::nanoEquipHandler()	2022-02-08 12:48:58 +01:00
dongresource	f376c68115	[seccomp] Allow clock_nanosleep() This apparently gets called very rarely during normal operation. This change fixes a rare server crash.	2022-02-04 20:04:22 +01:00
dongresource	3c6afa0322	Tolerate missing optional fields when loading gruntwork These are already allowed to be absent in paths.json, but the gruntwork loading logic wasn't updated accordingly.	2021-12-31 02:40:32 +01:00
dongresource	384a2ece78	[sandbox] Seccomp filter tweaks * Restrict fcntl() to only the flags we need * Non-fatally deny tgkill() and rt_sigaction() so that segfaults don't result in a SIGSYS. They're debuggable either way, but this way it's clearer what the issue is right away. * Allow truncate() and ftruncate() for sqlite's alternate journal modes * Slight macro cleanup * Add missing colon in a DB log message We don't need to worry about compilation problems arising if glibc or musl-libc add their own wrapper for the seccomp() syscall in the future. Ours will/would just silently take precedence over the external one without interfering with compilation. This should work regardless of whether libc uses weak symbols and regardless of whether libc is dynamically or statically linked into the executable. The wrapper's signature has been stripped of its static and inline qualifiers, as it must match the exact declaration the libc headers will/would use. Further, if a pre-compiled binary is run on a system which genuinely doesn't support seccomp(), it'll just return ENOSYS and the server will terminate with an error. The user can then just disable the sandbox in the config file. We don't need any special logic for that scenario.	2021-12-26 04:00:51 +01:00
CakeLancelot	f4a7ab7373	Update README to include installer instructions	2021-12-20 23:11:07 -06:00
dongresource	bc1153c97e	Call terminate() on Windows Closes #196	2021-12-17 01:14:32 +01:00
dongresource	c6ffcd4804	Clean up indentation in a few places	2021-12-16 03:34:15 +01:00
dongresource	b3c844650b	Tighten seccomp sandbox restrictions on mmap(), ioctl() and socketcall()	2021-12-16 00:36:48 +01:00
dongresource	13bd299de4	Do not use assembly-accelerated bcrypt on i386 Adding the assembly source files to the build system(s) would be more trouble than it's worth, considering we don't make 32-bit builds for much other than satisfying our curiosity.	2021-12-16 00:36:48 +01:00
dongresource	1e3d183f9a	Add hardening flags to Makefile Also tweaked the flags slightly so that CXXFLAGS are a superset of CFLAGS, all optimization levels default to -O2, and .SUFFIXES works correctly.	2021-12-16 00:36:48 +01:00
dongresource	dfe596447b	Whitelist syscalls for 32-bit x86 Linux Should probably filter the args to this for the sake of proper sandboxing.	2021-12-16 00:36:48 +01:00
dongresource	9297e82589	Whitelist syscalls for musl-libc, Raspberry Pi and alt libsqlite configs	2021-12-16 00:36:48 +01:00
dongresource	4319ee57a0	Switch seccomp sandbox to default-deny filter	2021-12-16 00:36:48 +01:00
dongresource	09e452a09d	pledge() + unveil() sandbox This is the OpenBSD sandbox.	2021-12-16 00:36:43 +01:00
dongresource	3c1e08372d	Proof-of-concept, default-permit seccomp-bpf sandbox Can be disabled by adding -DCONFIG_NOSANDBOX to CXXFLAGS.	2021-12-16 00:36:09 +01:00
dongresource	05d6174351	Handle email dumping separately from chat dumping This makes it actually possible to unambiguously parse the full thing on the receiving end.	2021-12-03 22:23:59 +01:00
dongresource	9ab998688c	Fix time handling on systems with 32-bit time_t	2021-11-06 21:18:36 +01:00
dongresource	7249b54127	Fix tdatadir and patchdir in config file requiring a terminating slash	2021-11-06 06:01:14 +01:00
dongresource	4fa18a9642	Fix make not detecting changes to headers in vendor/	2021-11-06 06:00:37 +01:00
gsemaj	8a294cb2be	Include emails in chat dump	2021-10-25 15:32:26 -04:00
dongresource	57e9834786	Fix U16toU8() returning strings longer than max UTF-16 inputs containing actual multi-byte characters resulted in codecvt returning a UTF-8 string longer than the requested max length.	2021-10-25 21:15:00 +02:00
dongresource	70c3650ee1	Add config option to disable the localhost workaround There are some network configurations in which it's undesirable; such as reverse tunneling through ssh. These are obscure enough to allow leaving the option undocumented (in the example config file).	2021-10-21 20:58:41 +02:00
dongresource	e2c85aa03f	Respawn players at half health Cleaned up the adjacent code slightly; might clean it up further later.	2021-10-19 20:36:33 +02:00
Hpmason	ed285e5d24	Update version numbers in README.md README still uses version 1.3 for links to client and server files. This changes those links to 1.4	2021-10-05 19:43:25 -04:00