fix: Fixes crashing due to bad packet assumptions. (#1829)

### Summary
- Fixes various exploits that can crash the shard when the client misbehaves.
- Clients will now be disconnected if they send packets that are marked as out of game only (new flag), while they are in-game.


> [!Note]
> **Developer Note**
> Added an `OutOfGameOnly` which should be used to flag packets as only available out of the game.
> This is the opposite of, yet not the converse to `InGameOnly`.

Projects/Server/Network/NetState/NetState.cs

@@ -806,20 +806,27 @@ public partial class NetState : IComparable<NetState>, IValueLinkListNode<NetSta
             return ParserState.AwaitingPartialPacket;
         }
 
-        if (handler.Ingame)
+        if (handler.InGameOnly)
         {
             if (Mobile == null)
             {
-                LogInfo($"received packet 0x{packetId:X2} before having been attached to a mobile");
+                LogInfo($"Received packet 0x{packetId:X2} before having been attached to a mobile.");
                 return ParserState.Error;
             }
 
             if (Mobile.Deleted)
             {
+                LogInfo($"Received packet 0x{packetId:X2} after having been attached to a deleted mobile.");
                 return ParserState.Error;
             }
         }
 
+        if (handler.OutOfGameOnly && Mobile?.Deleted == false)
+        {
+            LogInfo($"Received packet 0x{packetId:X2} after having been attached to a mobile.");
+            return ParserState.Error;
+        }
+
         var throttler = handler.ThrottleCallback;
         if (throttler != null)
         {

Projects/Server/Network/PacketHandler.cs

@@ -21,11 +21,20 @@ public unsafe class PacketHandler
 {
     private readonly int _length;
 
-    public PacketHandler(int packetID, int length, bool ingame, delegate*<NetState, SpanReader, void> onReceive)
+    public PacketHandler(
+        int packetID, delegate*<NetState, SpanReader, void> onReceive,
+        int length = 0, bool inGameOnly = false, bool outGameOnly = false
+    ) : this(packetID, length, inGameOnly, outGameOnly, onReceive)
+    {
+
+    }
+
+    public PacketHandler(int packetID, int length, bool inGameOnly, bool outGameOnly, delegate*<NetState, SpanReader, void> onReceive)
     {
         _length = length;
         PacketID = packetID;
-        Ingame = ingame;
+        InGameOnly = inGameOnly;
+        OutOfGameOnly = outGameOnly;
         OnReceive = onReceive;
     }
 
@@ -37,5 +46,7 @@ public unsafe class PacketHandler
 
     public delegate*<int, NetState, bool> ThrottleCallback { get; set; }
 
-    public bool Ingame { get; }
+    public bool InGameOnly { get; }
+
+    public bool OutOfGameOnly { get; }
 }

Projects/Server/Network/Packets/IncomingPackets.cs

@@ -25,9 +25,20 @@ public static class IncomingPackets
     public static PacketHandler[] Handlers { get; } = new PacketHandler[0x100];
 
     [MethodImpl(MethodImplOptions.AggressiveInlining)]
-    public static unsafe void Register(int packetID, int length, bool ingame,
-        delegate*<NetState, SpanReader, void> onReceive) =>
-        Register(new PacketHandler(packetID, length, ingame, onReceive));
+    public static unsafe void Register(
+        int packetID, delegate*<NetState, SpanReader, void> onReceive, int length = 0, bool ingameOnly = false,
+        bool outgameOnly = false
+    ) => Register(packetID, length, ingameOnly, outgameOnly, onReceive);
+
+    [MethodImpl(MethodImplOptions.AggressiveInlining)]
+    public static unsafe void Register(
+        int packetID, int length, bool ingame, delegate*<NetState, SpanReader, void> onReceive
+    ) => Register(packetID, length, ingame, false, onReceive);
+
+    [MethodImpl(MethodImplOptions.AggressiveInlining)]
+    public static unsafe void Register(
+        int packetID, int length, bool ingame, bool outgame, delegate*<NetState, SpanReader, void> onReceive
+    ) => Register(new PacketHandler(packetID, length, ingame, outgame, onReceive));
 
     public static void Register(PacketHandler packetHandler)
     {

Projects/UOContent/Assistants/AssistantProtocol.cs

@@ -1,4 +1,5 @@
 using System.Buffers;
+using System.Runtime.CompilerServices;
 
 namespace Server.Network;
 
@@ -12,8 +13,13 @@ public static class AssistantProtocol
         _handlers = ProtocolExtensions<AssistantsProtocolInfo>.Register(new AssistantsProtocolInfo());
     }
 
+    [MethodImpl(MethodImplOptions.AggressiveInlining)]
     public static unsafe void Register(int cmd, bool ingame, delegate*<NetState, SpanReader, void> onReceive) =>
-        _handlers[cmd] = new PacketHandler(cmd, 0, ingame, onReceive);
+        Register(cmd, ingame, false, onReceive);
+
+    [MethodImpl(MethodImplOptions.AggressiveInlining)]
+    public static unsafe void Register(int cmd, bool ingame, bool outgame, delegate*<NetState, SpanReader, void> onReceive) =>
+        _handlers[cmd] = new PacketHandler(cmd, onReceive, inGameOnly: ingame, outGameOnly: outgame);
 
     private struct AssistantsProtocolInfo : IProtocolExtensionsInfo
     {

Projects/UOContent/Network/ContainerGridPacketHandler.cs

@@ -19,9 +19,8 @@ namespace Server.Network;
 
 public unsafe class ContainerGridPacketHandler : PacketHandler
 {
-    public ContainerGridPacketHandler(int packetID, int length, bool ingame,
-        delegate*<NetState, SpanReader, void> onReceive)
-        : base(packetID, length, ingame, onReceive)
+    public ContainerGridPacketHandler(int packetID, int length, delegate*<NetState, SpanReader, void> onReceive)
+        : base(packetID, length, true, false, onReceive)
     {
     }
 

Projects/UOContent/Network/FreeshardProtocol.cs

@@ -14,6 +14,7 @@
  *************************************************************************/
 
 using System.Buffers;
+using System.Runtime.CompilerServices;
 
 namespace Server.Network
 {
@@ -27,8 +28,14 @@ namespace Server.Network
             _handlers = ProtocolExtensions<FreeshardProtocolInfo>.Register(new FreeshardProtocolInfo());
         }
 
+        [MethodImpl(MethodImplOptions.AggressiveInlining)]
         public static unsafe void Register(int cmd, bool ingame, delegate*<NetState, SpanReader, void> onReceive) =>
-            _handlers[cmd] = new PacketHandler(cmd, 0, ingame, onReceive);
+            Register(cmd, ingame, false, onReceive);
+
+        [MethodImpl(MethodImplOptions.AggressiveInlining)]
+        public static unsafe void Register(
+            int cmd, bool ingame, bool outgame, delegate*<NetState, SpanReader, void> onReceive
+        ) => _handlers[cmd] = new PacketHandler(cmd, onReceive, inGameOnly: ingame, outGameOnly: outgame);
 
         private struct FreeshardProtocolInfo : IProtocolExtensionsInfo
         {

Projects/UOContent/Network/Packets/IncomingAccountPackets.cs

@@ -57,18 +57,17 @@ public static class IncomingAccountPackets
 
     public static unsafe void Configure()
     {
-        IncomingPackets.Register(0x00, 104, false, &CreateCharacter);
-        IncomingPackets.Register(0x5D, 73, false, &PlayCharacter);
-        IncomingPackets.Register(0x80, 62, false, &AccountLogin);
-        IncomingPackets.Register(0x83, 39, false, &DeleteCharacter);
-        IncomingPackets.Register(0x91, 65, false, &GameLogin);
-        IncomingPackets.Register(0xA0, 3, false, &PlayServer);
-        IncomingPackets.Register(0xBB, 9, false, &AccountID);
-        IncomingPackets.Register(0xBD, 0, false, &ClientVersion);
-        IncomingPackets.Register(0xCF, 0, false, &AccountLogin);
-        IncomingPackets.Register(0xE1, 0, false, &ClientType);
-        IncomingPackets.Register(0xEF, 21, false, &LoginServerSeed);
-        IncomingPackets.Register(0xF8, 106, false, &CreateCharacter);
+        IncomingPackets.Register(0x00, &CreateCharacter, 104, outgameOnly: true);
+        IncomingPackets.Register(0x5D, &PlayCharacter, 73, outgameOnly: true);
+        IncomingPackets.Register(0x80, &AccountLogin, 62, outgameOnly: true);
+        IncomingPackets.Register(0x83, &DeleteCharacter, 39, outgameOnly: true);
+        IncomingPackets.Register(0x91, &GameLogin, 65, outgameOnly: true);
+        IncomingPackets.Register(0xA0, &PlayServer, 3, outgameOnly: true);
+        IncomingPackets.Register(0xBD, &ClientVersion);
+        IncomingPackets.Register(0xCF, &AccountLogin, outgameOnly: true);
+        IncomingPackets.Register(0xE1, &ClientType);
+        IncomingPackets.Register(0xEF, &LoginServerSeed, 21, outgameOnly: true);
+        IncomingPackets.Register(0xF8, &CreateCharacter, 106, outgameOnly: true);
     }
 
     public static void CreateCharacter(NetState state, SpanReader reader)

Projects/UOContent/Network/Packets/IncomingExtendedCommandPackets.cs

@@ -14,6 +14,7 @@
  *************************************************************************/
 
 using System.Buffers;
+using System.Runtime.CompilerServices;
 using Server.ContextMenus;
 using Server.Items;
 using Server.Mobiles;
@@ -70,12 +71,18 @@ public static class IncomingExtendedCommandPackets
     {
     }
 
-    public static unsafe void RegisterExtended(int packetID, bool ingame,
-        delegate*<NetState, SpanReader, void> onReceive)
+    [MethodImpl(MethodImplOptions.AggressiveInlining)]
+    public static unsafe void RegisterExtended(
+        int packetID, bool ingame, delegate*<NetState, SpanReader, void> onReceive
+    ) => RegisterExtended(packetID, ingame, false, onReceive);
+
+    public static unsafe void RegisterExtended(
+        int packetID, bool ingame, bool outgame, delegate*<NetState, SpanReader, void> onReceive
+    )
     {
         if (packetID is >= 0 and < 0x100)
         {
-            _extendedHandlers[packetID] = new PacketHandler(packetID, 0, ingame, onReceive);
+            _extendedHandlers[packetID] = new PacketHandler(packetID, onReceive, inGameOnly: ingame, outGameOnly: outgame);
         }
     }
 
@@ -102,21 +109,30 @@ public static class IncomingExtendedCommandPackets
             return;
         }
 
-        if (ph.Ingame && state.Mobile?.Deleted != false)
+        var from = state.Mobile;
+
+        if (ph.InGameOnly)
         {
-            if (state.Mobile == null)
+            if (from == null)
             {
-                state.LogInfo(
-                    $"Sent in-game packet (0xBFx{packetId:X2}) before having been attached to a mobile"
-                );
+                state.Disconnect($"Received packet 0x{packetId:X2} before having been attached to a mobile.");
+                return;
             }
 
-            state.Disconnect($"Sent in-game packet(0xBFx{packetId:X2}) but mobile is deleted.");
+            if (from.Deleted)
+            {
+                state.Disconnect($"Received packet 0x{packetId:X2} after having been attached to a deleted mobile.");
+                return;
+            }
         }
-        else
+
+        if (ph.OutOfGameOnly && from?.Deleted == false)
         {
-            ph.OnReceive(state, reader);
+            state.Disconnect($"Received packet 0x{packetId:X2} after having been attached to a mobile.");
+            return;
         }
+
+        ph.OnReceive(state, reader);
     }
 
     public static void ScreenSize(NetState state, SpanReader reader)

Projects/UOContent/Network/Packets/IncomingItemPackets.cs

@@ -26,7 +26,7 @@ public static class IncomingItemPackets
     public static unsafe void Configure()
     {
         IncomingPackets.Register(0x07, 7, true, &LiftReq);
-        IncomingPackets.Register(new ContainerGridPacketHandler(0x08, 14, true, &DropReq));
+        IncomingPackets.Register(new ContainerGridPacketHandler(0x08, 14, &DropReq));
         IncomingPackets.Register(0x13, 10, true, &EquipReq);
         IncomingPackets.Register(0xEC, 0, false, &EquipMacro);
         IncomingPackets.Register(0xED, 0, false, &UnequipMacro);

Projects/UOContent/Network/ProtocolExtensions.cs

@@ -46,19 +46,30 @@ namespace Server.Network
                 return;
             }
 
-            if (ph.Ingame && state.Mobile == null)
+            var from = state.Mobile;
+
+            if (ph.InGameOnly)
             {
-                state.LogInfo($"Sent in-game packet (0x{packetId:X2}x{cmd:X2}) before having been attached to a mobile");
-                state.Disconnect("Sent in-game packet before being attached to a mobile.");
+                if (from == null)
+                {
+                    state.Disconnect($"Received packet 0x{packetId:X2}x{cmd:X2} before having been attached to a mobile.");
+                    return;
+                }
+
+                if (from.Deleted)
+                {
+                    state.Disconnect($"Received packet 0x{packetId:X2}x{cmd:X2} after having been attached to a deleted mobile.");
+                    return;
+                }
             }
-            else if (ph.Ingame && state.Mobile.Deleted)
+
+            if (ph.OutOfGameOnly && from?.Deleted == false)
             {
-                state.Disconnect(string.Empty);
-            }
-            else
-            {
-                ph.OnReceive(state, reader);
+                state.Disconnect($"Received packet 0x{packetId:X2}x{cmd:X2} after having been attached to a mobile.");
+                return;
             }
+
+            ph.OnReceive(state, reader);
         }
     }
 }