【安全加密】防封包重放：序号与会话绑定

---收包校验：序号严格递增
local WINDOW = 64

function AntiReplay.check(actor, seq, body)
    local expect = actor.seqIn or 0
    if seq <= expect then
        AntiReplay.alarm(actor, seq, expect)
        return false, "replay"
    end
    if seq > expect + WINDOW then
        return false, "gap"     -- 跳号过多请求重同步
    end
    actor.seqIn = seq
    return true
end

---发包：序号与会话密钥同源
function AntiReplay.sign(actor, body)
    actor.seqOut = (actor.seqOut or 0) + 1
    local mac = Cipher.mac(body, actor.sessionKey,
        actor.seqOut)
    return actor.seqOut, mac
end

---会话密钥：登录握手时派生
function AntiReplay.handshake(actor, ticket)
    local sess = Auth.verifyTicket(ticket)
    if not sess then return false end
    -- 每次登录派生独立密钥
    actor.sessionKey = Cipher.derive(sess.uid, os.time())
    actor.seqIn = 0
    actor.seqOut = 0
    return true
end

---重放样本的处置
function AntiReplay.alarm(actor, seq, expect)
    Ops.alert("重放嫌疑",
        actor:GetUserId(), seq, expect)
    local cnt = (actor.replayCnt or 0) + 1
    actor.replayCnt = cnt
    if cnt >= 5 then
        Gateway.kick(actor, "协议异常")
    end
end