id,node_id,number,title,user,state,locked,assignee,milestone,comments,created_at,updated_at,closed_at,author_association,active_lock_reason,draft,pull_request,body,reactions,performed_via_github_app,state_reason,repo,type
435988213,MDExOlB1bGxSZXF1ZXN0MjcyNTc1NDkz,1785,network layer reduction,3317737,closed,0,3317737,,4,2019-04-23T04:01:32Z,2019-04-23T23:11:35Z,2019-04-23T23:11:35Z,COLLABORATOR,,0,ACEmulator/ACE/pulls/1785,"- [x] Combine as many classes as possible without violating KISS or ""the pattern""
- [x] Implement I/O queues
- [ ] Test mass connections and correct shortcomings of the implementation during extreme conditions 
- [ ] To prevent flooding, Implement inbound session packet governor and find threshold
    -  proportionate to number of sessions?
- [ ] To prevent flooding, Implement `ProcessFragment` governor and find threshold
    -  proportionate to number of sessions?
- [ ] `ProcessFragment` needs to be a producer for game loop consumer, game loop consumer pull X number of messages to keep server loop tight (500? 1000? more?)
- [ ] S2C Retransmission request fulfillment, or C2S NAK, needs to have complexity added
    - if the packet being retransmitted contains physics data, that physics data needs to be replaced with the latest version sent if the latest version is not the one in the original packet.
- [ ] Outbound queue needs an independent consumer thread, there should be no reason to send via game loop in bursts every game iteration, outbound can be constant
    - process outbound messages to players
    - add messages to outbound packets until 484 size reached or every 66ms
    - continue creating packets until outbound cleared
    - Outbound fragment bundling needs to be reduced to a single collection, as it adds unnecessary complexity at the cost of readability, understandability, and changeability without actually adding any benefit or working towards a required specification or towards an architectural norm.  Since outbound queue will be sent by the fluidity of the independent consumer thread combined with the capabilities of the average modern internet connection fragment prioritization by queue or any other need for grouping them together is probably not needed, but I could be mistaken.  Comments about this are most welcome.
- [ ] Sessions should only be created upon authentication success, reducing the abuse potential and increasing network layer fitness.
    - the cookie in the cookie exchange can be a constant, eliminating the need for a state machine during authentication, it doesn't actually provide any security or stability related benefits.
    - port 9001 listener can/should be omitted as it adds unnecessary complexity at the cost of readability, understandability, and changeability.
        - without the 9001 listener the client will time out trying to send `ConnectionResponse` to 9001 at the routing level almost immediately, and the client will enter port 9000 only mode, and then sends it to 9000
    - session keys should consist of `IP Address | Port` combined into a Unt64, `Uint64 where the top32 is the IP and bottom 32 is the port` 
        - prevents problems observed during authentication due to the race conditions provided by pre-authenticated connections
    - first packet analysis consists of the following:

        1. a 1 btye packet from an IP to port 9000 or 9001 is a valid request.  but the parsing of that packet shows its bad so the whole thing is to be tossed
        2. a mutliple connection packet attack from the same clientfrom same port should be ignored and/or flagged for spamming to be banned
        3. a mutliple connection packet attack from the same client on different ports for same account should be flagged for spamming to be banned, but most recent should be honored
        4. bans are IP as well as account based
        5. you check IP ban first then account
        6. before the server acknowodges anything to client it has to run through those checks
        7. and only when the server considers everything ok, then the session is added and the S2C is sent

- [ ] `FindOrCreateSession` needs to have a lock around the entire body of the function
    - Allows seamless handling of single account, multiple session, during times of great contention

misc fixes:

- boot command via console causes exception because session is not null in audit call
- abnormal sequence detection
    - terminate session upon detection","{""url"": ""https://api.github.com/repos/ACEmulator/ACE/issues/1785/reactions"", ""total_count"": 0, ""+1"": 0, ""-1"": 0, ""laugh"": 0, ""hooray"": 0, ""confused"": 0, ""heart"": 0, ""rocket"": 0, ""eyes"": 0}",,,79078680,pull