multiplayer stage 4: server-authoritative input, permissions, per-source holds

Three things stood in the way of two people sharing a cab and of a client not
being able to reach past its own vehicle.

Vehicle commands were addressed by TTrain::id(), which every peer hands out
locally from its own counter, so the same number means a different vehicle on
a different peer. Commands now travel with the session wide NetworkEntityId
and are translated back to the local cab on arrival; outside of multiplayer
the registry is empty and both directions are a no-op, so singleplayer is
untouched.

A client could send any command it liked, including setweather, queueevent or
spawntrainset. The server now validates every incoming command: a player may
work the controls of the vehicle whose crew they are on and nothing else, and
world wide commands stay with the host until dispatcher roles exist. The
source is stamped by the server, never taken from what the peer sent, and
rejections are logged once per peer/command instead of every frame. Host input
runs through the very same validation, just without the transport.

Continuous commands were tracked per command and recipient only, so with two
people in one cab the release sent by one of them cancelled the other one's
hold. command_data now carries the source peer and the active set is keyed by
{source, recipient, command}.

Also: a client asking to quit no longer replicates quitsimulation, which would
have shut down everybody else's session.

network/message.cpp

@@ -160,6 +160,7 @@ void ::network::request_command::serialize(std::ostream &stream) const
 			sn_utils::s_vec3(stream, data.location);
 
 			sn_utils::s_str(stream, data.payload);
+			sn_utils::ls_uint32(stream, data.source);
 		}
 	}
 }
@@ -186,6 +187,7 @@ void network::request_command::deserialize(std::istream &stream)
 			data.location = sn_utils::d_vec3(stream);
 
 			data.payload = sn_utils::d_str(stream);
+			data.source = sn_utils::ld_uint32(stream);
 
 			sequence.emplace_back(data);
 		}

network/network.cpp

@@ -6,6 +6,9 @@
 #include "utilities/Timer.h"
 #include "application/application.h"
 #include "utilities/Globals.h"
+#include "simulation/simulation.h"
+#include <set>
+#include <tuple>
 
 // 2 - legacy lockstep protocol
 // 3 - handshake carries build identification and an explicit rejection message
@@ -97,6 +100,23 @@ network::server::server(std::shared_ptr<std::istream> buf) : backbuffer(buf)
 
 }
 
+namespace {
+
+// keeps the log readable: a peer holding a forbidden key would otherwise produce a line
+// every single frame, so each peer/command/verdict combination is reported once
+void report_rejected_command(network::PeerId Peer, user_command Command, network::command_verdict Verdict)
+{
+	static std::set<std::tuple<network::PeerId, user_command, network::command_verdict>> reported;
+
+	if (!reported.emplace(Peer, Command, Verdict).second)
+		return;
+
+	auto const &description = simulation::Commands_descriptions[static_cast<std::size_t>(Command)];
+	ErrorLog("net: command \"" + description.name + "\" from peer " + std::to_string(Peer) + " rejected: " + network::describe(Verdict), logtype::net);
+}
+
+} // namespace
+
 void network::server::prune_clients()
 {
 	for (auto it = clients.begin(); it != clients.end(); ) {
@@ -217,8 +237,22 @@ void network::server::handle_message(std::shared_ptr<connection> conn, const mes
 	else if (msg.type == message::REQUEST_COMMAND) {
 		const auto& cmd = dynamic_cast<const request_command&>(msg);
 
-		for (auto const &kv : cmd.commands)
-			client_commands_queue.emplace(kv);
+		for (auto const &kv : cmd.commands) {
+			for (command_data const &data : kv.second) {
+				auto const verdict = validate_command(conn->peer_id, data.command, kv.first);
+				if (verdict != command_verdict::accepted) {
+					report_rejected_command(conn->peer_id, data.command, verdict);
+					continue;
+				}
+
+				command_data accepted = data;
+				// the source is decided here, never taken from what the peer sent
+				accepted.source = conn->peer_id;
+
+				auto lookup = client_commands_queue.emplace(kv.first, command_queue::commanddata_sequence());
+				lookup.first->second.emplace_back(accepted);
+			}
+		}
 	}
 }
 

network/session.cpp

@@ -42,6 +42,75 @@ std::string describe(claim_result Result)
 	return "unknown";
 }
 
+std::string describe(command_verdict Verdict)
+{
+	switch (Verdict)
+	{
+	case command_verdict::accepted:
+		return "accepted";
+	case command_verdict::not_in_crew:
+		return "not a member of the crew of that vehicle";
+	case command_verdict::privileged:
+		return "reserved for the session host";
+	case command_verdict::unsupported_target:
+		return "command target not allowed over the network";
+	}
+	return "unknown";
+}
+
+command_verdict validate_command(PeerId Peer, user_command Command, uint32_t Recipient)
+{
+	if (Peer == PEER_HOST)
+	{
+		// the host runs the session and holds every right in it
+		return command_verdict::accepted;
+	}
+
+	auto const target = (command_target)(Recipient & ~0xffff);
+
+	if (target == command_target::vehicle)
+	{
+		// a player works the controls of the vehicle they are on, and of no other
+		return Crews.is_member(Peer, (NetworkEntityId)(Recipient & 0xffff)) ? command_verdict::accepted : command_verdict::not_in_crew;
+	}
+
+	if (target == command_target::simulation)
+	{
+		// setweather, setdatetime, spawntrainset, destroytrainset, queueevent, the pause
+		// and the debug commands all reach the whole world, so they stay with the authority.
+		// TODO: open a subset of them once dispatcher and admin roles exist
+		(void)Command;
+		return command_verdict::privileged;
+	}
+
+	return command_verdict::unsupported_target;
+}
+
+void filter_commands(PeerId Peer, command_queue::commands_map &Commands)
+{
+	for (auto it = Commands.begin(); it != Commands.end();)
+	{
+		auto &sequence = it->second;
+
+		for (auto command = sequence.begin(); command != sequence.end();)
+		{
+			if (validate_command(Peer, command->command, it->first) != command_verdict::accepted)
+			{
+				command = sequence.erase(command);
+				continue;
+			}
+
+			command->source = Peer;
+			++command;
+		}
+
+		if (sequence.empty())
+			it = Commands.erase(it);
+		else
+			++it;
+	}
+}
+
 vehicle_crew &crew_registry::entry(NetworkEntityId Id)
 {
 	auto lookup = m_vehicles.find(Id);

network/session.h

@@ -10,6 +10,7 @@ http://mozilla.org/MPL/2.0/.
 #pragma once
 
 #include "network/entities.h"
+#include "input/command.h"
 
 #include <string>
 #include <unordered_map>
@@ -87,4 +88,24 @@ private:
 
 extern crew_registry Crews;
 
+// what a peer is allowed to ask the simulation for
+enum class command_verdict
+{
+	accepted,
+	not_in_crew,
+	privileged,
+	unsupported_target
+};
+
+std::string describe(command_verdict Verdict);
+
+// the whole of the authority check for an incoming command. the host passes it too, it
+// simply holds every right - there is no separate path for the local participant
+command_verdict validate_command(PeerId Peer, user_command Command, uint32_t Recipient);
+
+// drops everything the peer is not allowed to ask for and stamps the rest with its
+// identity. used for the local participant as well, so that host input goes through the
+// very same authority layer as input arriving over the wire, only without the transport
+void filter_commands(PeerId Peer, command_queue::commands_map &Commands);
+
 } // namespace network