]> de.git.xonotic.org Git - xonotic/darkplaces.git/blobdiff - host_cmd.c
fix pqrcon rcon_password bug introduced in r9420 (was not
[xonotic/darkplaces.git] / host_cmd.c
index dabc5e22ae2a8233a5308a832afcf61bfe4fdd09..530cf4e4858dfc9bbb2555a89ae72c4b11eabf01 100644 (file)
@@ -22,11 +22,21 @@ Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
 #include "sv_demo.h"
 #include "image.h"
 
+#include "utf8lib.h"
+
+// for secure rcon authentication
+#include "hmac.h"
+#include "mdfour.h"
+#include <time.h>
+
 int current_skill;
 cvar_t sv_cheats = {0, "sv_cheats", "0", "enables cheat commands in any game, and cheat impulses in dpmod"};
 cvar_t sv_adminnick = {CVAR_SAVE, "sv_adminnick", "", "nick name to use for admin messages instead of host name"};
 cvar_t sv_status_privacy = {CVAR_SAVE, "sv_status_privacy", "0", "do not show IP addresses in 'status' replies to clients"};
-cvar_t rcon_password = {CVAR_PRIVATE, "rcon_password", "", "password to authenticate rcon commands"};
+cvar_t sv_status_show_qcstatus = {CVAR_SAVE, "sv_status_show_qcstatus", "0", "show the 'qcstatus' field in status replies, not the 'frags' field. Turn this on if your mod uses this field, and the 'frags' field on the other hand has no meaningful value."};
+cvar_t rcon_password = {CVAR_PRIVATE, "rcon_password", "", "password to authenticate rcon commands; NOTE: changing rcon_secure clears rcon_password, so set rcon_secure always before rcon_password; may be set to a string of the form user1:pass1 user2:pass2 user3:pass3 to allow multiple user accounts - the client then has to specify ONE of these combinations"};
+cvar_t rcon_secure = {CVAR_NQUSERINFOHACK, "rcon_secure", "0", "force secure rcon authentication (1 = time based, 2 = challenge based); NOTE: changing rcon_secure clears rcon_password, so set rcon_secure always before rcon_password"};
+cvar_t rcon_secure_challengetimeout = {0, "rcon_secure_challengetimeout", "5", "challenge-based secure rcon: time out requests if no challenge came within this time interval"};
 cvar_t rcon_address = {0, "rcon_address", "", "server address to send rcon commands to (when not connected to a server)"};
 cvar_t team = {CVAR_USERINFO | CVAR_SAVE, "team", "none", "QW team (4 character limit, example: blue)"};
 cvar_t skin = {CVAR_USERINFO | CVAR_SAVE, "skin", "", "QW player skin name (example: base)"};
@@ -58,9 +68,12 @@ Host_Status_f
 */
 void Host_Status_f (void)
 {
+       char qcstatus[256];
        client_t *client;
-       int seconds, minutes, hours = 0, j, players;
+       int seconds = 0, minutes = 0, hours = 0, i, j, k, in, players, ping = 0, packetloss = 0;
        void (*print) (const char *fmt, ...);
+       char ip[22];
+       int frags;
 
        if (cmd_source == src_command)
        {
@@ -77,9 +90,21 @@ void Host_Status_f (void)
 
        if (!sv.active)
                return;
+       
+       if(cmd_source == src_command)
+               SV_VM_Begin();
+       
+       in = 0;
+       if (Cmd_Argc() == 2)
+       {
+               if (strcmp(Cmd_Argv(1), "1") == 0)
+                       in = 1;
+               else if (strcmp(Cmd_Argv(1), "2") == 0)
+                       in = 2;
+       }
 
-       for (players = 0, j = 0;j < svs.maxclients;j++)
-               if (svs.clients[j].active)
+       for (players = 0, i = 0;i < svs.maxclients;i++)
+               if (svs.clients[i].active)
                        players++;
        print ("host:     %s\n", Cvar_VariableString ("hostname"));
        print ("version:  %s build %s\n", gamename, buildstring);
@@ -87,27 +112,89 @@ void Host_Status_f (void)
        print ("map:      %s\n", sv.name);
        print ("timing:   %s\n", Host_TimingReport());
        print ("players:  %i active (%i max)\n\n", players, svs.maxclients);
-       for (j = 0, client = svs.clients;j < svs.maxclients;j++, client++)
+
+       if (in == 1)
+               print ("^2IP                   %%pl ping  time   frags  no   name\n");
+       else if (in == 2)
+               print ("^5IP                    no   name\n");
+
+       for (i = 0, k = 0, client = svs.clients;i < svs.maxclients;i++, client++)
        {
                if (!client->active)
                        continue;
-               seconds = (int)(realtime - client->connecttime);
-               minutes = seconds / 60;
-               if (minutes)
+
+               ++k;
+
+               if (in == 0 || in == 1)
                {
-                       seconds -= (minutes * 60);
-                       hours = minutes / 60;
-                       if (hours)
-                               minutes -= (hours * 60);
+                       seconds = (int)(realtime - client->connecttime);
+                       minutes = seconds / 60;
+                       if (minutes)
+                       {
+                               seconds -= (minutes * 60);
+                               hours = minutes / 60;
+                               if (hours)
+                                       minutes -= (hours * 60);
+                       }
+                       else
+                               hours = 0;
+                       
+                       packetloss = 0;
+                       if (client->netconnection)
+                               for (j = 0;j < NETGRAPH_PACKETS;j++)
+                                       if (client->netconnection->incoming_netgraph[j].unreliablebytes == NETGRAPH_LOSTPACKET)
+                                               packetloss++;
+                       packetloss = (packetloss * 100 + NETGRAPH_PACKETS - 1) / NETGRAPH_PACKETS;
+                       ping = bound(0, (int)floor(client->ping*1000+0.5), 9999);
                }
-               else
-                       hours = 0;
-               print ("#%-3u %-16.16s  %3i  %2i:%02i:%02i\n", j+1, client->name, client->frags, hours, minutes, seconds);
+
                if(sv_status_privacy.integer && cmd_source != src_command)
-                       print ("   %s\n", client->netconnection ? "hidden" : "botclient");
+                       strlcpy(ip, client->netconnection ? "hidden" : "botclient" , 22);
                else
-                       print ("   %s\n", client->netconnection ? client->netconnection->address : "botclient");
+                       strlcpy(ip, (client->netconnection && client->netconnection->address) ? client->netconnection->address : "botclient", 22);
+
+               frags = client->frags;
+
+               if(sv_status_show_qcstatus.integer && prog->fieldoffsets.clientstatus >= 0)
+               {
+                       const char *str = PRVM_E_STRING(PRVM_EDICT_NUM(i + 1), prog->fieldoffsets.clientstatus);
+                       if(str && *str)
+                       {
+                               char *p;
+                               const char *q;
+                               p = qcstatus;
+                               for(q = str; *q && p != qcstatus + sizeof(qcstatus) - 1; ++q)
+                                       if(*q != '\\' && *q != '"' && !ISWHITESPACE(*q))
+                                               *p++ = *q;
+                               *p = 0;
+                               if(*qcstatus)
+                                       frags = atoi(qcstatus);
+                       }
+               }
+               
+               if (in == 0) // default layout
+               {
+                       // LordHavoc: we must use multiple prints for ProQuake compatibility
+                       print ("#%-3u ", i+1);
+                       print ("%-16.16s ", client->name);
+                       print ("%4i  ", frags);
+                       print ("%2i:%02i:%02i\n   ", hours, minutes, seconds);
+                       print ("%s\n", ip);
+//                     print ("#%-3u %-16.16s  %3i  %2i:%02i:%02i\n", i+1, client->name, frags, hours, minutes, seconds);
+//                     print ("   %s\n", ip);
+               }
+               else if (in == 1) // extended layout
+               {
+                       print ("%s%-21s %2i %4i %2i:%02i:%02i %4i  #%-3u ^7%s\n", k%2 ? "^3" : "^7", ip, packetloss, ping, hours, minutes, seconds, frags, i+1, client->name);
+               }
+               else if (in == 2) // reduced layout
+               {
+                       print ("%s%-21s #%-3u ^7%s\n", k%2 ? "^3" : "^7", ip, i+1, client->name);
+               }
        }
+
+       if(cmd_source == src_command)
+               SV_VM_End();
 }
 
 
@@ -278,7 +365,17 @@ void Host_Map_f (void)
        CL_Disconnect ();
        Host_ShutdownServer();
 
+       if(svs.maxclients != svs.maxclients_next)
+       {
+               svs.maxclients = svs.maxclients_next;
+               if (svs.clients)
+                       Mem_Free(svs.clients);
+               svs.clients = (client_t *)Mem_Alloc(sv_mempool, sizeof(client_t) * svs.maxclients);
+       }
+
        // remove menu
+       if (key_dest == key_menu || key_dest == key_menu_grabbed)
+               MR_ToggleMenu(0);
        key_dest = key_game;
 
        svs.serverflags = 0;                    // haven't completed an episode yet
@@ -312,6 +409,8 @@ void Host_Changelevel_f (void)
        }
 
        // remove menu
+       if (key_dest == key_menu || key_dest == key_menu_grabbed)
+               MR_ToggleMenu(0);
        key_dest = key_game;
 
        SV_VM_Begin();
@@ -347,6 +446,8 @@ void Host_Restart_f (void)
        }
 
        // remove menu
+       if (key_dest == key_menu || key_dest == key_menu_grabbed)
+               MR_ToggleMenu(0);
        key_dest = key_game;
 
        allowcheats = sv_cheats.integer != 0;
@@ -426,6 +527,9 @@ void Host_Connect_f (void)
                Con_Print("connect <serveraddress> : connect to a multiplayer game\n");
                return;
        }
+       // clear the rcon password, to prevent vulnerability by stuffcmd-ing a connect command
+       if(rcon_secure.integer <= 0)
+               Cvar_SetQuick(&rcon_password, "");
        CL_EstablishConnection(Cmd_Argv(1));
 }
 
@@ -443,9 +547,11 @@ LOAD / SAVE GAME
 void Host_Savegame_to (const char *name)
 {
        qfile_t *f;
-       int             i, lightstyles = 64;
+       int             i, k, l, lightstyles = 64;
        char    comment[SAVEGAME_COMMENT_LENGTH+1];
+       char    line[MAX_INPUTLINE];
        qboolean isserver;
+       char    *s;
 
        // first we have to figure out if this can be saved in 64 lightstyles
        // (for Quake compatibility)
@@ -473,7 +579,7 @@ void Host_Savegame_to (const char *name)
        // convert space to _ to make stdio happy
        // LordHavoc: convert control characters to _ as well
        for (i=0 ; i<SAVEGAME_COMMENT_LENGTH ; i++)
-               if (comment[i] <= ' ')
+               if (ISWHITESPACEORCONTROL(comment[i]))
                        comment[i] = '_';
        comment[SAVEGAME_COMMENT_LENGTH] = '\0';
 
@@ -529,6 +635,51 @@ void Host_Savegame_to (const char *name)
        for (i=1 ; i<MAX_SOUNDS ; i++)
                if (sv.sound_precache[i][0])
                        FS_Printf(f,"sv.sound_precache %i %s\n", i, sv.sound_precache[i]);
+
+       // darkplaces extension - save buffers
+       for (i = 0; i < (int)Mem_ExpandableArray_IndexRange(&prog->stringbuffersarray); i++)
+       {
+               prvm_stringbuffer_t *stringbuffer = (prvm_stringbuffer_t*) Mem_ExpandableArray_RecordAtIndex(&prog->stringbuffersarray, i);
+               if(stringbuffer && (stringbuffer->flags & STRINGBUFFER_SAVED))
+               {
+                       for(k = 0; k < stringbuffer->num_strings; k++)
+                       {
+                               if (!stringbuffer->strings[k])
+                                       continue;
+                               // Parse the string a bit to turn special characters
+                               // (like newline, specifically) into escape codes
+                               s = stringbuffer->strings[k];
+                               for (l = 0;l < (int)sizeof(line) - 2 && *s;)
+                               {       
+                                       if (*s == '\n')
+                                       {
+                                               line[l++] = '\\';
+                                               line[l++] = 'n';
+                                       }
+                                       else if (*s == '\r')
+                                       {
+                                               line[l++] = '\\';
+                                               line[l++] = 'r';
+                                       }
+                                       else if (*s == '\\')
+                                       {
+                                               line[l++] = '\\';
+                                               line[l++] = '\\';
+                                       }
+                                       else if (*s == '"')
+                                       {
+                                               line[l++] = '\\';
+                                               line[l++] = '"';
+                                       }
+                                       else
+                                               line[l++] = *s;
+                                       s++;
+                               }
+                               line[l] = '\0';
+                               FS_Printf(f,"sv.bufstr %i %i \"%s\"\n", i, k, line);
+                       }
+               }
+       }
        FS_Printf(f,"*/\n");
 #endif
 
@@ -595,6 +746,7 @@ void Host_Savegame_f (void)
 Host_Loadgame_f
 ===============
 */
+
 void Host_Loadgame_f (void)
 {
        char filename[MAX_QPATH];
@@ -605,10 +757,12 @@ void Host_Loadgame_f (void)
        const char *t;
        char *text;
        prvm_edict_t *ent;
-       int i;
+       int i, k;
        int entnum;
        int version;
        float spawn_parms[NUM_SPAWN_PARMS];
+       prvm_stringbuffer_t *stringbuffer;
+       size_t alloclen;
 
        if (Cmd_Argc() != 2)
        {
@@ -626,6 +780,8 @@ void Host_Loadgame_f (void)
                CL_Disconnect ();
 
        // remove menu
+       if (key_dest == key_menu || key_dest == key_menu_grabbed)
+               MR_ToggleMenu(0);
        key_dest = key_game;
 
        cls.demonum = -1;               // stop demo loop in case this fails
@@ -739,6 +895,9 @@ void Host_Loadgame_f (void)
                }
        }
 
+       // unlink all entities
+       World_UnlinkAll(&sv.world);
+
 // load the edicts out of the savegame file
        end = t;
        for (;;)
@@ -765,6 +924,9 @@ void Host_Loadgame_f (void)
 
                        // parse the global vars
                        PRVM_ED_ParseGlobals (start);
+
+                       // restore the autocvar globals
+                       Cvar_UpdateAllAutoCvars();
                }
                else
                {
@@ -787,13 +949,12 @@ void Host_Loadgame_f (void)
 
                        // link it into the bsp tree
                        if (!ent->priv.server->free)
-                               SV_LinkEdict (ent, false);
+                               SV_LinkEdict(ent);
                }
 
                end = t;
                entnum++;
        }
-       Mem_Free(text);
 
        prog->num_edicts = entnum;
        sv.time = time;
@@ -841,7 +1002,7 @@ void Host_Loadgame_f (void)
                                        if (i >= 0 && i < MAX_MODELS)
                                        {
                                                strlcpy(sv.model_precache[i], com_token, sizeof(sv.model_precache[i]));
-                                               sv.models[i] = Mod_ForName (sv.model_precache[i], true, false, false);
+                                               sv.models[i] = Mod_ForName (sv.model_precache[i], true, false, sv.model_precache[i][0] == '*' ? sv.worldname : NULL);
                                        }
                                        else
                                                Con_Printf("unsupported model %i \"%s\"\n", i, com_token);
@@ -856,12 +1017,53 @@ void Host_Loadgame_f (void)
                                        else
                                                Con_Printf("unsupported sound %i \"%s\"\n", i, com_token);
                                }
+                               else if (!strcmp(com_token, "sv.bufstr"))
+                               {
+                                       COM_ParseToken_Simple(&t, false, false);
+                                       i = atoi(com_token);
+                                       COM_ParseToken_Simple(&t, false, false);
+                                       k = atoi(com_token);
+                                       COM_ParseToken_Simple(&t, false, false);
+                                       stringbuffer = (prvm_stringbuffer_t*) Mem_ExpandableArray_RecordAtIndex(&prog->stringbuffersarray, i);
+                                       // VorteX: nasty code, cleanup required
+                                       // create buffer at this index
+                                       if(!stringbuffer) 
+                                               stringbuffer = (prvm_stringbuffer_t *) Mem_ExpandableArray_AllocRecordAtIndex(&prog->stringbuffersarray, i);
+                                       if (!stringbuffer)
+                                               Con_Printf("cant write string %i into buffer %i\n", k, i);
+                                       else
+                                       {
+                                               // code copied from VM_bufstr_set
+                                               // expand buffer
+                                               if (stringbuffer->max_strings <= i)
+                                               {
+                                                       char **oldstrings = stringbuffer->strings;
+                                                       stringbuffer->max_strings = max(stringbuffer->max_strings * 2, 128);
+                                                       while (stringbuffer->max_strings <= i)
+                                                               stringbuffer->max_strings *= 2;
+                                                       stringbuffer->strings = (char **) Mem_Alloc(prog->progs_mempool, stringbuffer->max_strings * sizeof(stringbuffer->strings[0]));
+                                                       if (stringbuffer->num_strings > 0)
+                                                               memcpy(stringbuffer->strings, oldstrings, stringbuffer->num_strings * sizeof(stringbuffer->strings[0]));
+                                                       if (oldstrings)
+                                                               Mem_Free(oldstrings);
+                                               }
+                                               // allocate string
+                                               stringbuffer->num_strings = max(stringbuffer->num_strings, k + 1);
+                                               if(stringbuffer->strings[k])
+                                                       Mem_Free(stringbuffer->strings[k]);
+                                               stringbuffer->strings[k] = NULL;
+                                               alloclen = strlen(com_token) + 1;
+                                               stringbuffer->strings[k] = (char *)Mem_Alloc(prog->progs_mempool, alloclen);
+                                               memcpy(stringbuffer->strings[k], com_token, alloclen);
+                                       }
+                               }       
                                // skip any trailing text or unrecognized commands
                                while (COM_ParseToken_Simple(&t, true, false) && strcmp(com_token, "\n"))
                                        ;
                        }
                }
        }
+       Mem_Free(text);
 
        if(developer_entityparsing.integer)
                Con_Printf("Host_Loadgame_f: finished\n");
@@ -885,22 +1087,30 @@ void Host_Name_f (void)
 {
        int i, j;
        qboolean valid_colors;
+       const char *newNameSource;
        char newName[sizeof(host_client->name)];
 
        if (Cmd_Argc () == 1)
        {
-               Con_Printf("\"name\" is \"%s\"\n", cl_name.string);
+               Con_Printf("name: %s\n", cl_name.string);
                return;
        }
 
        if (Cmd_Argc () == 2)
-               strlcpy (newName, Cmd_Argv(1), sizeof (newName));
+               newNameSource = Cmd_Argv(1);
        else
-               strlcpy (newName, Cmd_Args(), sizeof (newName));
+               newNameSource = Cmd_Args();
+
+       strlcpy(newName, newNameSource, sizeof(newName));
 
        if (cmd_source == src_command)
        {
                Cvar_Set ("_cl_name", newName);
+               if (strlen(newNameSource) >= sizeof(newName)) // overflowed
+               {
+                       Con_Printf("Your name is longer than %i chars! It has been truncated.\n", (int) (sizeof(newName) - 1));
+                       Con_Printf("name: %s\n", cl_name.string);
+               }
                return;
        }
 
@@ -929,7 +1139,7 @@ void Host_Name_f (void)
                host_client->name[1] = '0' + STRING_COLOR_DEFAULT;
        }
 
-       COM_StringLengthNoColors(host_client->name, 0, &valid_colors);
+       u8_COM_StringLengthNoColors(host_client->name, 0, &valid_colors);
        if(!valid_colors) // NOTE: this also proves the string is not empty, as "" is a valid colored string
        {
                size_t l;
@@ -963,6 +1173,12 @@ void Host_Name_f (void)
                                i++;
                                continue;
                        }
+                       if (host_client->name[i+1] == STRING_COLOR_RGB_TAG_CHAR && isxdigit(host_client->name[i+2]) && isxdigit(host_client->name[i+3]) && isxdigit(host_client->name[i+4]))
+                       {
+                               j = i;
+                               i += 4;
+                               continue;
+                       }
                        if (host_client->name[i+1] == STRING_COLOR_TAG)
                        {
                                i++;
@@ -978,7 +1194,7 @@ void Host_Name_f (void)
        if (strcmp(host_client->old_name, host_client->name))
        {
                if (host_client->spawned)
-                       SV_BroadcastPrintf("%s changed name to %s\n", host_client->old_name, host_client->name);
+                       SV_BroadcastPrintf("%s ^7changed name to %s\n", host_client->old_name, host_client->name);
                strlcpy(host_client->old_name, host_client->name, sizeof(host_client->old_name));
                // send notification to all clients
                MSG_WriteByte (&sv.reliable_datagram, svc_updatename);
@@ -1985,7 +2201,7 @@ void Host_Viewmodel_f (void)
        if (!e)
                return;
 
-       m = Mod_ForName (Cmd_Argv(1), false, true, false);
+       m = Mod_ForName (Cmd_Argv(1), false, true, NULL);
        if (!m || !m->loaded || !m->Draw)
        {
                Con_Printf("viewmodel: can't load %s\n", Cmd_Argv(1));
@@ -2210,30 +2426,80 @@ static void MaxPlayers_f(void)
 
        if (Cmd_Argc() != 2)
        {
-               Con_Printf("\"maxplayers\" is \"%u\"\n", svs.maxclients);
+               Con_Printf("\"maxplayers\" is \"%u\"\n", svs.maxclients_next);
                return;
        }
 
        if (sv.active)
        {
                Con_Print("maxplayers can not be changed while a server is running.\n");
-               return;
+               Con_Print("It will be changed on next server startup (\"map\" command).\n");
        }
 
        n = atoi(Cmd_Argv(1));
        n = bound(1, n, MAX_SCOREBOARD);
        Con_Printf("\"maxplayers\" set to \"%u\"\n", n);
 
-       if (svs.clients)
-               Mem_Free(svs.clients);
-       svs.maxclients = n;
-       svs.clients = (client_t *)Mem_Alloc(sv_mempool, sizeof(client_t) * svs.maxclients);
+       svs.maxclients_next = n;
        if (n == 1)
                Cvar_Set ("deathmatch", "0");
        else
                Cvar_Set ("deathmatch", "1");
 }
 
+/*
+=====================
+Host_PQRcon_f
+
+ProQuake rcon support
+=====================
+*/
+void Host_PQRcon_f (void)
+{
+       int n;
+       const char *e;
+       lhnetaddress_t to;
+       lhnetsocket_t *mysocket;
+       char peer_address[64];
+
+       if (!rcon_password.string || !rcon_password.string[0] || rcon_secure.integer > 0)
+       {
+               Con_Printf ("You must set rcon_password before issuing an pqrcon command, and rcon_secure must be 0.\n");
+               return;
+       }
+
+       e = strchr(rcon_password.string, ' ');
+       n = e ? e-rcon_password.string : (int)strlen(rcon_password.string);
+
+       if (cls.netcon)
+       {
+               InfoString_GetValue(cls.userinfo, "*ip", peer_address, sizeof(peer_address));
+       }
+       else
+       {
+               if (!rcon_address.string[0])
+               {
+                       Con_Printf ("You must either be connected, or set the rcon_address cvar to issue rcon commands\n");
+                       return;
+               }
+               strlcpy(peer_address, rcon_address.string, strlen(rcon_address.string)+1);
+       }
+       LHNETADDRESS_FromString(&to, peer_address, sv_netport.integer);
+       mysocket = NetConn_ChooseClientSocketForAddress(&to);
+       if (mysocket)
+       {
+               SZ_Clear(&net_message);
+               MSG_WriteLong (&net_message, 0);
+               MSG_WriteByte (&net_message, CCREQ_RCON);
+               SZ_Write(&net_message, (void*)rcon_password.string, n);
+               MSG_WriteByte (&net_message, 0); // terminate the (possibly partial) string
+               MSG_WriteString (&net_message, Cmd_Args());
+               StoreBigLong(net_message.data, NETFLAG_CTL | (net_message.cursize & NETFLAG_LENGTH_MASK));
+               NetConn_Write(mysocket, net_message.data, net_message.cursize, &to);
+               SZ_Clear (&net_message);
+       }
+}
+
 //=============================================================================
 
 // QuakeWorld commands
@@ -2248,7 +2514,8 @@ Host_Rcon_f
 */
 void Host_Rcon_f (void) // credit: taken from QuakeWorld
 {
-       int i;
+       int i, n;
+       const char *e;
        lhnetaddress_t to;
        lhnetsocket_t *mysocket;
 
@@ -2258,14 +2525,8 @@ void Host_Rcon_f (void) // credit: taken from QuakeWorld
                return;
        }
 
-       for (i = 0;rcon_password.string[i];i++)
-       {
-               if (rcon_password.string[i] <= ' ')
-               {
-                       Con_Printf("rcon_password is not allowed to have any whitespace.\n");
-                       return;
-               }
-       }
+       e = strchr(rcon_password.string, ' ');
+       n = e ? e-rcon_password.string : (int)strlen(rcon_password.string);
 
        if (cls.netcon)
                to = cls.netcon->peeraddress;
@@ -2279,10 +2540,48 @@ void Host_Rcon_f (void) // credit: taken from QuakeWorld
                LHNETADDRESS_FromString(&to, rcon_address.string, sv_netport.integer);
        }
        mysocket = NetConn_ChooseClientSocketForAddress(&to);
-       if (mysocket)
+       if (mysocket && Cmd_Args()[0])
        {
                // simply put together the rcon packet and send it
-               NetConn_WriteString(mysocket, va("\377\377\377\377rcon %s %s", rcon_password.string, Cmd_Args()), &to);
+               if(Cmd_Argv(0)[0] == 's' || rcon_secure.integer > 1)
+               {
+                       if(cls.rcon_commands[cls.rcon_ringpos][0])
+                       {
+                               char s[128];
+                               LHNETADDRESS_ToString(&cls.rcon_addresses[cls.rcon_ringpos], s, sizeof(s), true);
+                               Con_Printf("rcon to %s (for command %s) failed: too many buffered commands (possibly increase MAX_RCONS)\n", s, cls.rcon_commands[cls.rcon_ringpos]);
+                               cls.rcon_commands[cls.rcon_ringpos][0] = 0;
+                               --cls.rcon_trying;
+                       }
+                       for (i = 0;i < MAX_RCONS;i++)
+                               if(cls.rcon_commands[i][0])
+                                       if (!LHNETADDRESS_Compare(&to, &cls.rcon_addresses[i]))
+                                               break;
+                       ++cls.rcon_trying;
+                       if(i >= MAX_RCONS)
+                               NetConn_WriteString(mysocket, "\377\377\377\377getchallenge", &to); // otherwise we'll request the challenge later
+                       strlcpy(cls.rcon_commands[cls.rcon_ringpos], Cmd_Args(), sizeof(cls.rcon_commands[cls.rcon_ringpos]));
+                       cls.rcon_addresses[cls.rcon_ringpos] = to;
+                       cls.rcon_timeout[cls.rcon_ringpos] = realtime + rcon_secure_challengetimeout.value;
+                       cls.rcon_ringpos = (cls.rcon_ringpos + 1) % MAX_RCONS;
+               }
+               else if(rcon_secure.integer > 0)
+               {
+                       char buf[1500];
+                       char argbuf[1500];
+                       dpsnprintf(argbuf, sizeof(argbuf), "%ld.%06d %s", (long) time(NULL), (int) (rand() % 1000000), Cmd_Args());
+                       memcpy(buf, "\377\377\377\377srcon HMAC-MD4 TIME ", 24);
+                       if(HMAC_MDFOUR_16BYTES((unsigned char *) (buf + 24), (unsigned char *) argbuf, strlen(argbuf), (unsigned char *) rcon_password.string, n))
+                       {
+                               buf[40] = ' ';
+                               strlcpy(buf + 41, argbuf, sizeof(buf) - 41);
+                               NetConn_Write(mysocket, buf, 41 + strlen(buf + 41), &to);
+                       }
+               }
+               else
+               {
+                       NetConn_WriteString(mysocket, va("\377\377\377\377rcon %.*s %s", n, rcon_password.string, Cmd_Args()), &to);
+               }
        }
 }
 
@@ -2474,7 +2773,7 @@ void Host_Packet_f (void) // credit: taken from QuakeWorld
 
        in = Cmd_Argv(2);
        out = send+4;
-       send[0] = send[1] = send[2] = send[3] = 0xff;
+       send[0] = send[1] = send[2] = send[3] = -1;
 
        l = (int)strlen (in);
        for (i=0 ; i<l ; i++)
@@ -2526,7 +2825,7 @@ Send back ping and packet loss update for all current players to this player
 */
 void Host_Pings_f (void)
 {
-       int             i, j, ping, packetloss;
+       int             i, j, ping, packetloss, movementloss;
        char temp[128];
 
        if (!host_client->netconnection)
@@ -2540,11 +2839,18 @@ void Host_Pings_f (void)
        for (i = 0;i < svs.maxclients;i++)
        {
                packetloss = 0;
+               movementloss = 0;
                if (svs.clients[i].netconnection)
+               {
                        for (j = 0;j < NETGRAPH_PACKETS;j++)
-                               if (svs.clients[i].netconnection->incoming_unreliablesize[j] == NETGRAPH_LOSTPACKET)
+                               if (svs.clients[i].netconnection->incoming_netgraph[j].unreliablebytes == NETGRAPH_LOSTPACKET)
                                        packetloss++;
-               packetloss = packetloss * 100 / NETGRAPH_PACKETS;
+                       for (j = 0;j < NETGRAPH_PACKETS;j++)
+                               if (svs.clients[i].movement_count[j] < 0)
+                                       movementloss++;
+               }
+               packetloss = (packetloss * 100 + NETGRAPH_PACKETS - 1) / NETGRAPH_PACKETS;
+               movementloss = (movementloss * 100 + NETGRAPH_PACKETS - 1) / NETGRAPH_PACKETS;
                ping = (int)floor(svs.clients[i].ping*1000+0.5);
                ping = bound(0, ping, 9999);
                if (sv.protocol == PROTOCOL_QUAKEWORLD)
@@ -2558,7 +2864,10 @@ void Host_Pings_f (void)
                else
                {
                        // write the string into the packet as multiple unterminated strings to avoid needing a local buffer
-                       dpsnprintf(temp, sizeof(temp), " %d %d", ping, packetloss);
+                       if(movementloss)
+                               dpsnprintf(temp, sizeof(temp), " %d %d,%d", ping, packetloss, movementloss);
+                       else
+                               dpsnprintf(temp, sizeof(temp), " %d %d", ping, packetloss);
                        MSG_WriteUnterminatedString(&host_client->netconnection->message, temp);
                }
        }
@@ -2568,6 +2877,7 @@ void Host_Pings_f (void)
 
 void Host_PingPLReport_f(void)
 {
+       char *errbyte;
        int i;
        int l = Cmd_Argc();
        if (l > cl.maxclients)
@@ -2575,7 +2885,11 @@ void Host_PingPLReport_f(void)
        for (i = 0;i < l;i++)
        {
                cl.scores[i].qw_ping = atoi(Cmd_Argv(1+i*2));
-               cl.scores[i].qw_packetloss = atoi(Cmd_Argv(1+i*2+1));
+               cl.scores[i].qw_packetloss = strtol(Cmd_Argv(1+i*2+1), &errbyte, 0);
+               if(errbyte && *errbyte == ',')
+                       cl.scores[i].qw_movementloss = atoi(errbyte + 1);
+               else
+                       cl.scores[i].qw_movementloss = 0;
        }
 }
 
@@ -2660,7 +2974,11 @@ void Host_InitCommands (void)
 
        Cvar_RegisterVariable (&rcon_password);
        Cvar_RegisterVariable (&rcon_address);
-       Cmd_AddCommand ("rcon", Host_Rcon_f, "sends a command to the server console (if your rcon_password matches the server's rcon_password), or to the address specified by rcon_address when not connected (again rcon_password must match the server's)");
+       Cvar_RegisterVariable (&rcon_secure);
+       Cvar_RegisterVariable (&rcon_secure_challengetimeout);
+       Cmd_AddCommand ("rcon", Host_Rcon_f, "sends a command to the server console (if your rcon_password matches the server's rcon_password), or to the address specified by rcon_address when not connected (again rcon_password must match the server's); note: if rcon_secure is set, client and server clocks must be synced e.g. via NTP");
+       Cmd_AddCommand ("srcon", Host_Rcon_f, "sends a command to the server console (if your rcon_password matches the server's rcon_password), or to the address specified by rcon_address when not connected (again rcon_password must match the server's); this always works as if rcon_secure is set; note: client and server clocks must be synced e.g. via NTP");
+       Cmd_AddCommand ("pqrcon", Host_PQRcon_f, "sends a command to a proquake server console (if your rcon_password matches the server's rcon_password), or to the address specified by rcon_address when not connected (again rcon_password must match the server's)");
        Cmd_AddCommand ("user", Host_User_f, "prints additional information about a player number or name on the scoreboard");
        Cmd_AddCommand ("users", Host_Users_f, "prints additional information about all players on the scoreboard");
        Cmd_AddCommand ("fullserverinfo", Host_FullServerinfo_f, "internal use only, sent by server to client to update client's local copy of serverinfo string");
@@ -2683,6 +3001,7 @@ void Host_InitCommands (void)
        Cvar_RegisterVariable(&sv_cheats);
        Cvar_RegisterVariable(&sv_adminnick);
        Cvar_RegisterVariable(&sv_status_privacy);
+       Cvar_RegisterVariable(&sv_status_show_qcstatus);
 }
 
 void Host_NoOperation_f(void)