feat: Adds robust speed hack detection and movement throttling (#2266)

## Summary

   Server-side movement throttle that prevents speed hacking while accurately identifying cheaters with detection of lagging connections.

   **Key features:**
   - Credit buffer (200ms) absorbs timing jitter from legitimate players
   - Movement queue handles larger bursts, draining at proper game-tick intervals
   - RTT measurement distinguishes network lag from speed hacks
   - Queue depth detection catches ACK-throttled speed hacks (going straight)

   ## How It Works

   **Throttle** (prevention): Movements arriving too early either consume credit or get queued. The queue drains at
   correct intervals, so speed hackers can't move faster regardless of what they send.

   **Detection** (identification): Combines multiple signals to identify cheaters:
   | Signal | What it catches |
   |--------|-----------------|
   | Queue depth ≥4 sustained | ACK-throttled speed hacks (client limits unacked moves to 5) |
   | Movement rate >1.05x | Direction-change speed hacks where timing is visible |
   | Stable RTT + high queue | Eliminates false positives from laggy players |

   **RTT-Aware Logic:**
   - Probes only sent to players actively moving (event-driven, not global loop)
   - Stable low-latency + problems = suspicious
   - Unstable/high-latency + problems = probably just lag, throttle handles it

   ## Configuration

   ```json
   {
     "movementThrottle.maxCredit": 200,
     "movementThrottle.softQueueLimit": 6,
     "movementThrottle.hardQueueLimit": 10,
     "movementThrottle.debugLogging": false
   }
   ```
This commit is contained in:
Kamron Batman 2026-03-07 11:44:37 -08:00 committed by GitHub
parent 6745cf2075
commit 04d438239d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
17 changed files with 2474 additions and 74 deletions

View file

@ -194,6 +194,9 @@ public static class IncomingAccountPackets
{
var version = state.Version = new ClientVersion(reader.ReadAscii());
// Record RTT if this is a response to our probe
state.RecordRttMeasurement();
ClientVerification.ClientVersionReceived(state, version);
}
@ -204,6 +207,9 @@ public static class IncomingAccountPackets
int type = reader.ReadUInt16();
var version = state.Version = new ClientVersion(reader.ReadAscii());
// Record RTT if this is a response to our probe
state.RecordRttMeasurement();
ClientVerification.ClientVersionReceived(state, version);
}
@ -270,7 +276,7 @@ public static class IncomingAccountPackets
state.SendSupportedFeature();
state.Sequence = 0;
state.ResetMovementState();
state.SendMobileUpdate(m);
state.SendMobileUpdate(m);