Merge branch 'beta'

Needs these DLLs:
- libgcc_s_seh-1.dll
- libstdc++-6.dll
- libwinpthread-1.dll
- wintun.dll

.gitignore

@@ -12,4 +12,5 @@ _deps
 CMakeUserPresets.json
 
 build/
-.vscode/
+.vscode/
+.DS_Store

CMakeLists.txt

@@ -6,7 +6,7 @@ cmake_minimum_required(VERSION 3.16)
 # If MAJOR is 0, and MINOR > 0, Version is BETA
 
 project(ColumnLynx
-    VERSION 0.0.5
+    VERSION 0.3.0
     LANGUAGES CXX
 )
 
@@ -19,7 +19,9 @@ set(CMAKE_CXX_EXTENSIONS OFF)
 #set(CMAKE_CXX_FLAGS_DEBUG "-g")
 #add_compile_options(${CMAKE_CXX_FLAGS_DEBUG})
 
-add_compile_definitions(DEBUG=1) # TODO: Forcing for now, add dymanic based on compile flags later
+if(DEBUG)
+    add_compile_definitions(DEBUG=1) # TODO: Forcing for now, add dymanic based on compile flags later
+endif()
 
 include(FetchContent)
 
@@ -38,7 +40,7 @@ endif()
 if(WIN32)
     add_compile_definitions(_WIN32_WINNT=0x0A00 NOMINMAX WIN32_LEAN_AND_MEAN)
 elseif(UNIX)
-    add_compile_options(-Wall -Wextra -Wpedantic)
+    add_compile_options(-Wall -Wextra -Wpedantic -O3)
     add_link_options(-pthread)
 endif()
 
@@ -78,15 +80,6 @@ FetchContent_MakeAvailable(Sodium)
 FetchContent_MakeAvailable(asio)
 FetchContent_MakeAvailable(cxxopts)
 
-# OpenSSL
-find_package(OpenSSL REQUIRED)
-if(OPENSSL_FOUND)
-    message(STATUS "Found OpenSSL version ${OPENSSL_VERSION}")
-    include_directories(${OPENSSL_INCLUDE_DIR})
-else()
-    message(FATAL_ERROR "OpenSSL not found")
-endif()
-
 # ---------------------------------------------------------
 # Output directories
 # ---------------------------------------------------------
@@ -106,7 +99,17 @@ endforeach()
 # ---------------------------------------------------------
 file(GLOB_RECURSE COMMON_SRC CONFIGURE_DEPENDS src/common/*.cpp)
 add_library(common STATIC ${COMMON_SRC})
-target_link_libraries(common PUBLIC sodium OpenSSL::SSL OpenSSL::Crypto cxxopts::cxxopts)
+target_link_libraries(common PUBLIC sodium cxxopts::cxxopts)
+
+if (WIN32)
+    target_link_libraries(common PUBLIC
+        ws2_32
+        iphlpapi
+        advapi32
+        mswsock
+    )
+endif()
+
 target_include_directories(common PUBLIC 
     ${PROJECT_SOURCE_DIR}/include 
     ${sodium_SOURCE_DIR}/src/libsodium/include
@@ -120,7 +123,12 @@ target_compile_definitions(common PUBLIC ASIO_STANDALONE)
 # ---------------------------------------------------------
 file(GLOB_RECURSE CLIENT_SRC CONFIGURE_DEPENDS src/client/*.cpp)
 add_executable(client ${CLIENT_SRC})
-target_link_libraries(client PRIVATE common sodium OpenSSL::SSL OpenSSL::Crypto cxxopts::cxxopts)
+target_link_libraries(client PRIVATE common sodium cxxopts::cxxopts)
+if (WIN32)
+    target_link_libraries(client PRIVATE
+        dbghelp
+    )
+endif()
 target_include_directories(client PRIVATE 
     ${PROJECT_SOURCE_DIR}/include 
     ${sodium_SOURCE_DIR}/src/libsodium/include
@@ -135,7 +143,12 @@ set_target_properties(client PROPERTIES OUTPUT_NAME "columnlynx_client")
 # ---------------------------------------------------------
 file(GLOB_RECURSE SERVER_SRC CONFIGURE_DEPENDS src/server/*.cpp)
 add_executable(server ${SERVER_SRC})
-target_link_libraries(server PRIVATE common sodium OpenSSL::SSL OpenSSL::Crypto cxxopts::cxxopts)
+target_link_libraries(server PRIVATE common sodium cxxopts::cxxopts)
+if (WIN32)
+    target_link_libraries(server PRIVATE
+        dbghelp
+    )
+endif()
 target_include_directories(server PRIVATE 
     ${PROJECT_SOURCE_DIR}/include 
     ${sodium_SOURCE_DIR}/src/libsodium/include

README.md

@@ -26,12 +26,16 @@ Configurating the server and client are are relatively easy. Currently (since th
 
 - **SERVER_PUBLIC_KEY** (Hex String): The public key to be used
 - **SERVER_PRIVATE_KEY** (Hex String): The private key to be used
+- **NETWORK** (IPv4 Format): The network IPv4 to be used (Server Interface still needs to be configured manually)
+- **SUBNET_MASK** (Integer): The subnet mask to be used (ensure proper length, it will not be checked)
 
 **Example:**
 
 ```
 SERVER_PUBLIC_KEY=787B648046F10DDD0B77A6303BE42D859AA65C52F5708CC3C58EB5691F217C7B
 SERVER_PRIVATE_KEY=778604245F57B847E63BD85DE8208FF1A127FB559895195928C3987E246B77B8787B648046F10DDD0B77A6303BE42D859AA65C52F5708CC3C58EB5691F217C7B
+NETWORK=10.10.0.0
+SUBNET_MASK=24
 ```
 
 <hr></hr>
@@ -76,6 +80,8 @@ ColumnLynx makes use of both **TCP** and **UDP**. **TCP** is used for the initia
 
 It operates on port **48042** for both TCP and UDP.
 
+Generally, all transmission is done in **little-endian byte order**, since pretty much every single modern architecture uses it by default. The only exemption to this is the **transmission of IP addresses** (for the **Virtual Interface**), which is **big-endian**.
+
 ### Handshake Procedure
 
 The handshake between the client and server is done over **TCP**. This is to ensure delivery without much hassle.

include/columnlynx/client/net/tcp/tcp_client.hpp

@@ -25,10 +25,10 @@ namespace ColumnLynx::Net::TCP {
             TCPClient(asio::io_context& ioContext,
                       const std::string& host,
                       const std::string& port,
-                      Utils::LibSodiumWrapper* sodiumWrapper,
-                      std::array<uint8_t, 32>* aesKey,
-                      uint64_t* sessionIDRef,
-                      bool* insecureMode,
+                      std::shared_ptr<Utils::LibSodiumWrapper> sodiumWrapper,
+                      std::shared_ptr<std::array<uint8_t, 32>> aesKey,
+                      std::shared_ptr<uint64_t> sessionIDRef,
+                      bool insecureMode,
                       std::shared_ptr<VirtualInterface> tun = nullptr)
                 :
                 mResolver(ioContext),
@@ -95,12 +95,12 @@ namespace ColumnLynx::Net::TCP {
             std::string mHost, mPort;
             uint8_t mServerPublicKey[32]; // Assuming 256-bit public key
             std::array<uint8_t, 32> mSubmittedChallenge{};
-            Utils::LibSodiumWrapper* mLibSodiumWrapper;
+            std::shared_ptr<Utils::LibSodiumWrapper> mLibSodiumWrapper;
             uint64_t mConnectionSessionID;
             SymmetricKey mConnectionAESKey;
-            std::array<uint8_t, 32>* mGlobalKeyRef; // Reference to global AES key
-            uint64_t* mSessionIDRef; // Reference to global Session ID
-            bool* mInsecureMode; // Reference to insecure mode flag
+            std::shared_ptr<std::array<uint8_t, 32>> mGlobalKeyRef; // Reference to global AES key
+            std::shared_ptr<uint64_t> mSessionIDRef; // Reference to global Session ID
+            bool mInsecureMode; // Insecure mode flag
             asio::steady_timer mHeartbeatTimer;
             std::chrono::steady_clock::time_point mLastHeartbeatReceived;
             std::chrono::steady_clock::time_point mLastHeartbeatSent;

include/columnlynx/client/net/udp/udp_client.hpp

@@ -17,8 +17,8 @@ namespace ColumnLynx::Net::UDP {
             UDPClient(asio::io_context& ioContext,
                       const std::string& host,
                       const std::string& port,
-                      std::array<uint8_t, 32>* aesKeyRef,
-                      uint64_t* sessionIDRef,
+                      std::shared_ptr<std::array<uint8_t, 32>> aesKeyRef,
+                      std::shared_ptr<uint64_t> sessionIDRef,
                       std::shared_ptr<VirtualInterface> tunRef = nullptr)
                 : mSocket(ioContext), mResolver(ioContext), mHost(host), mPort(port), mAesKeyRef(aesKeyRef), mSessionIDRef(sessionIDRef), mTunRef(tunRef) 
             {
@@ -43,8 +43,8 @@ namespace ColumnLynx::Net::UDP {
             asio::ip::udp::endpoint mRemoteEndpoint;
             std::string mHost;
             std::string mPort;
-            std::array<uint8_t, 32>* mAesKeyRef;
-            uint64_t* mSessionIDRef;
+            std::shared_ptr<std::array<uint8_t, 32>> mAesKeyRef;
+            std::shared_ptr<uint64_t> mSessionIDRef;
             std::shared_ptr<VirtualInterface> mTunRef = nullptr;
             std::array<uint8_t, 2048> mRecvBuffer; // Adjust size as needed
     };

include/columnlynx/common/libsodium_wrapper.hpp

@@ -11,10 +11,6 @@
 #include <columnlynx/common/utils.hpp>
 #include <array>
 #include <vector>
-#include <openssl/x509.h>
-#include <openssl/x509_vfy.h>
-#include <openssl/pem.h>
-#include <openssl/x509v3.h>
 #include <memory>
 #include <cstring>
 
@@ -211,4 +207,4 @@ namespace ColumnLynx::Utils {
             std::array<uint8_t, crypto_scalarmult_curve25519_BYTES> mXPublicKey;
             std::array<uint8_t, crypto_scalarmult_curve25519_BYTES> mXPrivateKey;
     };
-}
+}

include/columnlynx/common/net/session_registry.hpp

@@ -8,7 +8,11 @@
 #include <memory>
 #include <chrono>
 #include <array>
+#include <cmath>
 #include <sodium.h>
+#include <mutex>
+#include <atomic>
+#include <asio.hpp>
 #include <columnlynx/common/utils.hpp>
 #include <columnlynx/common/libsodium_wrapper.hpp>
 
@@ -48,96 +52,36 @@ namespace ColumnLynx::Net {
             static SessionRegistry& getInstance() { static SessionRegistry instance; return instance; }
 
             // Insert or replace a session entry
-            void put(uint64_t sessionID, std::shared_ptr<SessionState> state) {
-                std::unique_lock lock(mMutex);
-                mSessions[sessionID] = std::move(state);
-                mIPSessions[mSessions[sessionID]->clientTunIP] = mSessions[sessionID];
-            }
+            void put(uint64_t sessionID, std::shared_ptr<SessionState> state);
 
             // Lookup a session entry by session ID
-            std::shared_ptr<const SessionState> get(uint64_t sessionID) const {
-                std::shared_lock lock(mMutex);
-                auto it = mSessions.find(sessionID);
-                return (it == mSessions.end()) ? nullptr : it->second;
-            }
+            std::shared_ptr<const SessionState> get(uint64_t sessionID) const;
 
             // Lookup a session entry by IPv4
-            std::shared_ptr<const SessionState> getByIP(uint32_t ip) const {
-                std::shared_lock lock(mMutex);
-                auto it = mIPSessions.find(ip);
-                return (it == mIPSessions.end()) ? nullptr : it->second;
-            }
+            std::shared_ptr<const SessionState> getByIP(uint32_t ip) const;
 
             // Get a snapshot of the Session Registry
-            std::unordered_map<uint64_t, std::shared_ptr<SessionState>> snapshot() const {
-                std::unordered_map<uint64_t, std::shared_ptr<SessionState>> snap;
-                std::shared_lock lock(mMutex);
-                snap = mSessions;
-                return snap;
-            }
+            std::unordered_map<uint64_t, std::shared_ptr<SessionState>> snapshot() const;
 
             // Remove a session by ID
-            void erase(uint64_t sessionID) {
-                std::unique_lock lock(mMutex);
-                mSessions.erase(sessionID);
-            }
+            void erase(uint64_t sessionID);
 
             // Cleanup expired sessions
-            void cleanupExpired() {
-                std::unique_lock lock(mMutex);
-                auto now = std::chrono::steady_clock::now();
-                for (auto it = mSessions.begin(); it != mSessions.end(); ) {
-                    if (it->second && it->second->expires <= now) {
-                        it = mSessions.erase(it);
-                    } else {
-                        ++it;
-                    }
-                }
-
-                for (auto it = mIPSessions.begin(); it != mIPSessions.end(); ) {
-                    if (it->second && it->second->expires <= now) {
-                        it = mIPSessions.erase(it);
-                    } else {
-                        ++it;
-                    }
-                }
-            }
+            void cleanupExpired();
 
             // Get the number of registered sessions
-            int size() const {
-                std::shared_lock lock(mMutex);
-                return static_cast<int>(mSessions.size());
-            }
+            int size() const;
 
-            // IP management (simple for /24 subnet)
+            // IP management
 
             // Get the lowest available IPv4 address; Returns 0 if none available
-            uint32_t getFirstAvailableIP() const {
-                std::shared_lock lock(mMutex);
-                uint32_t baseIP = 0x0A0A0002; // 10.10.0.2
+            uint32_t getFirstAvailableIP(uint32_t baseIP, uint8_t mask) const;
 
-                // TODO: Expand to support larger subnets
-                for (uint32_t offset = 0; offset < 254; offset++) {
-                    uint32_t candidateIP = baseIP + offset;
-                    if (mSessionIPs.find(candidateIP) == mSessionIPs.end()) {
-                        return candidateIP;
-                    }
-                }
+            // Lock IP to session ID; Do NOT call before put() - You will segfault!
+            void lockIP(uint64_t sessionID, uint32_t ip);
 
-                return 0; // Unavailable
-            }
-
-            // Lock an IP as assigned to a specific session
-            void lockIP(uint64_t sessionID, uint32_t ip) {
-                std::unique_lock lock(mMutex);
-                mSessionIPs[sessionID] = ip;
-            }
-
-            // Unlock the IP associated with a given session
-            void deallocIP(uint64_t sessionID) {
-                std::unique_lock lock(mMutex);
-                mSessionIPs.erase(sessionID);
-            }
+            // Unlock IP from session ID
+            void deallocIP(uint64_t sessionID);
 
         private:
             mutable std::shared_mutex mMutex;
@@ -145,4 +89,4 @@ namespace ColumnLynx::Net {
             std::unordered_map<uint64_t, uint32_t> mSessionIPs;
             std::unordered_map<uint32_t, std::shared_ptr<SessionState>> mIPSessions;
     };
-}
+}

include/columnlynx/common/net/virtual_interface.hpp

@@ -26,12 +26,16 @@
     #include <sys/ioctl.h>
     #include <unistd.h>
     #include <arpa/inet.h>
+    #include <sys/poll.h>
 #elif defined(_WIN32)
+    #define WIN32_LEAN_AND_MEAN
+    #define WINTUN_STATIC
     #include <windows.h>
-    #include <ws2tcpip.h>
     #include <winsock2.h>
+    #include <ws2tcpip.h>
+    #include <locale>
+    #include <codecvt>
     #include <wintun/wintun.h>
-    #pragma comment(lib, "advapi32.lib")
 #endif
 
 namespace ColumnLynx::Net {
@@ -43,15 +47,21 @@ namespace ColumnLynx::Net {
             bool configureIP(uint32_t clientIP, uint32_t serverIP,
                              uint8_t prefixLen, uint16_t mtu);
 
+            void resetIP();
+
             std::vector<uint8_t> readPacket();
             void writePacket(const std::vector<uint8_t>& packet);
 
             const std::string& getName() const;
             int getFd() const; // For ASIO integration (on POSIX)
 
-            static inline std::string ipv4ToString(uint32_t ip) {
+            static inline std::string ipv4ToString(uint32_t ip, bool flip = true) {
                 struct in_addr addr;
-                addr.s_addr = htonl(ip);
+
+                if (flip)
+                    addr.s_addr = htonl(ip);
+                else
+                    addr.s_addr = ip;
             
                 char buf[INET_ADDRSTRLEN];
                 if (!inet_ntop(AF_INET, &addr, buf, sizeof(buf)))
@@ -60,6 +70,52 @@ namespace ColumnLynx::Net {
                 return std::string(buf);
             }
 
+            static inline uint32_t stringToIpv4(const std::string &ipStr) {
+                struct in_addr addr;
+                
+                if (inet_pton(AF_INET, ipStr.c_str(), &addr) != 1) {
+                    return 0; // "0.0.0.0"
+                }
+            
+                return ntohl(addr.s_addr);
+            }
+
+            static inline std::string ipv6ToString(IPv6Addr &ip,
+                                       bool flip = false)
+            {
+                struct in6_addr addr;
+            
+                if (flip) {
+                    IPv6Addr flipped;
+                    for (size_t i = 0; i < 16; ++i)
+                        flipped[i] = ip[15 - i];
+                    memcpy(addr.s6_addr, flipped.data(), 16);
+                } else {
+                    memcpy(addr.s6_addr, ip.data(), 16);
+                }
+            
+                char buf[INET6_ADDRSTRLEN];
+                if (!inet_ntop(AF_INET6, &addr, buf, sizeof(buf)))
+                    return "::";  // Fallback
+            
+                return std::string(buf);
+            }
+
+            static inline IPv6Addr stringToIpv6(const std::string &ipStr)
+            {
+                IPv6Addr result{};
+                struct in6_addr addr;
+            
+                if (inet_pton(AF_INET6, ipStr.c_str(), &addr) != 1) {
+                    // "::"
+                    result.fill(0);
+                    return result;
+                }
+            
+                memcpy(result.data(), addr.s6_addr, 16);
+                return result;
+            }
+
             static inline uint32_t prefixLengthToNetmask(uint8_t prefixLen) {
                 if (prefixLen == 0) return 0;
                 uint32_t mask = (0xFFFFFFFF << (32 - prefixLen)) & 0xFFFFFFFF;
@@ -74,7 +130,9 @@ namespace ColumnLynx::Net {
             std::string mIfName;
             int mFd;           // POSIX
         #if defined(_WIN32)
-            HANDLE mHandle;    // Windows
+            WINTUN_ADAPTER_HANDLE mAdapter = nullptr;
+            WINTUN_SESSION_HANDLE mSession = nullptr;
+            HANDLE mHandle = nullptr;
         #endif
     };
 }

include/columnlynx/common/panic_handler.hpp

@@ -186,7 +186,7 @@ namespace ColumnLynx::Utils {
 
         // Panic the main thread and instantly halt execution. This produces a stack trace dump. Do not use by itself, throw an error instead.
         static void panic(const std::string& reason) {
-            std::cerr << "\n***\033[31m MAIN THREAD PANIC! \033[0m***\n";
+            std::cerr << "\n***\033[31m MASTER THREAD PANIC! \033[0m***\n";
             std::cerr << "Reason: " << reason << "\n";
             std::cerr << "Dumping panic trace...\n";
 

include/columnlynx/common/utils.hpp

@@ -13,6 +13,8 @@
 #include <fstream>
 #include <chrono>
 #include <unordered_map>
+#include <unordered_set>
+#include <algorithm>
 
 #ifdef _WIN32
     #include <winsock2.h>
@@ -22,6 +24,10 @@
     #include <unistd.h>
 #endif
 
+namespace ColumnLynx {
+    using IPv6Addr = std::array<uint8_t, 16>;
+}
+
 namespace ColumnLynx::Utils {
     // General log function. Use for logging important information.
     void log(const std::string &msg);
@@ -76,6 +82,18 @@ namespace ColumnLynx::Utils {
         return cbswap64(x);
     }
 
+    template <typename T>
+    T cbswap128(const T& x) {
+        static_assert(sizeof(T) == 16, "cbswap128 requires a 128-bit type");
+
+        T out{};
+        const uint8_t* src = reinterpret_cast<const uint8_t*>(&x);
+        uint8_t* dst = reinterpret_cast<uint8_t*>(&out);
+        std::reverse_copy(src, src + 16, dst);
+
+        return out;
+    }
+
     // Returns the config file in an unordered_map format. This purely reads the config file, you still need to parse it manually.
-    std::unordered_map<std::string, std::string> getConfigMap(std::string path);
+    std::unordered_map<std::string, std::string> getConfigMap(std::string path, std::vector<std::string> requiredKeys = {});
 };

include/columnlynx/server/net/tcp/tcp_connection.hpp

@@ -17,6 +17,7 @@
 #include <columnlynx/common/libsodium_wrapper.hpp>
 #include <columnlynx/common/net/session_registry.hpp>
 #include <columnlynx/common/net/protocol_structs.hpp>
+#include <columnlynx/common/net/virtual_interface.hpp>
 
 namespace ColumnLynx::Net::TCP {
     class TCPConnection : public std::enable_shared_from_this<TCPConnection> {
@@ -25,10 +26,11 @@ namespace ColumnLynx::Net::TCP {
 
             static pointer create(
                 asio::ip::tcp::socket socket,
-                Utils::LibSodiumWrapper* sodiumWrapper,
+                std::shared_ptr<Utils::LibSodiumWrapper> sodiumWrapper,
+                std::unordered_map<std::string, std::string>* serverConfig,
                 std::function<void(pointer)> onDisconnect)
             {
-                auto conn = pointer(new TCPConnection(std::move(socket), sodiumWrapper));
+                auto conn = pointer(new TCPConnection(std::move(socket), sodiumWrapper, serverConfig));
                 conn->mOnDisconnect = std::move(onDisconnect);
                 return conn;
             }
@@ -40,7 +42,7 @@ namespace ColumnLynx::Net::TCP {
             // Set callback for disconnects
             void setDisconnectCallback(std::function<void(std::shared_ptr<TCPConnection>)> cb);
             // Disconnect the client
-            void disconnect();
+            void disconnect(bool echo = true);
 
             // Get the assigned session ID
             uint64_t getSessionID() const;
@@ -48,10 +50,11 @@ namespace ColumnLynx::Net::TCP {
             std::array<uint8_t, 32> getAESKey() const;
         
         private:
-            TCPConnection(asio::ip::tcp::socket socket, Utils::LibSodiumWrapper* sodiumWrapper)
+            TCPConnection(asio::ip::tcp::socket socket, std::shared_ptr<Utils::LibSodiumWrapper> sodiumWrapper, std::unordered_map<std::string, std::string>* serverConfig)
                 :
                 mHandler(std::make_shared<MessageHandler>(std::move(socket))),
                 mLibSodiumWrapper(sodiumWrapper),
+                mRawServerConfig(serverConfig),
                 mHeartbeatTimer(mHandler->socket().get_executor()),
                 mLastHeartbeatReceived(std::chrono::steady_clock::now()),
                 mLastHeartbeatSent(std::chrono::steady_clock::now())
@@ -64,7 +67,8 @@ namespace ColumnLynx::Net::TCP {
 
             std::shared_ptr<MessageHandler> mHandler;
             std::function<void(std::shared_ptr<TCPConnection>)> mOnDisconnect;
-            Utils::LibSodiumWrapper *mLibSodiumWrapper;
+            std::shared_ptr<Utils::LibSodiumWrapper> mLibSodiumWrapper;
+            std::unordered_map<std::string, std::string>* mRawServerConfig;
             std::array<uint8_t, 32> mConnectionAESKey;
             uint64_t mConnectionSessionID;
             AsymPublicKey mConnectionPublicKey;
@@ -72,5 +76,6 @@ namespace ColumnLynx::Net::TCP {
             std::chrono::steady_clock::time_point mLastHeartbeatReceived;
             std::chrono::steady_clock::time_point mLastHeartbeatSent;
             int mMissedHeartbeats = 0;
+            std::string mRemoteIP; // Cached remote IP to avoid calling remote_endpoint() on closed sockets
     };
 }

include/columnlynx/server/net/tcp/tcp_server.hpp

@@ -24,34 +24,43 @@ namespace ColumnLynx::Net::TCP {
         public:
             TCPServer(asio::io_context& ioContext,
                       uint16_t port,
-                      Utils::LibSodiumWrapper* sodiumWrapper,
-                      bool* hostRunning, bool ipv4Only = false)
+                      std::shared_ptr<Utils::LibSodiumWrapper> sodiumWrapper,
+                      std::shared_ptr<bool> hostRunning, bool ipv4Only = false)
                 : mIoContext(ioContext),
                   mAcceptor(ioContext),
                   mSodiumWrapper(sodiumWrapper),
                   mHostRunning(hostRunning)
             {
                 // Preload the config map
-                mRawServerConfig = Utils::getConfigMap("server_config");
+                mRawServerConfig = Utils::getConfigMap("server_config", {"NETWORK", "SUBNET_MASK"});
+
+                asio::error_code ec_open, ec_v6only, ec_bind;
 
-                asio::error_code ec;
-            
                 if (!ipv4Only) {
-                    // Try IPv6 first (dual-stack check)
+                    // Try IPv6 (dual-stack if supported)
                     asio::ip::tcp::endpoint endpoint_v6(asio::ip::tcp::v6(), port);
-                    mAcceptor.open(endpoint_v6.protocol(), ec);
-                    if (!ec) {
-                        mAcceptor.set_option(asio::ip::v6_only(false), ec); // Allow dual-stack if possible
-                        mAcceptor.bind(endpoint_v6, ec);
+                
+                    mAcceptor.open(endpoint_v6.protocol(), ec_open);
+                
+                    if (!ec_open) {
+                        // Try enabling dual-stack, but DO NOT treat failure as fatal
+                        mAcceptor.set_option(asio::ip::v6_only(false), ec_v6only);
+                    
+                        // Try binding IPv6
+                        mAcceptor.bind(endpoint_v6, ec_bind);
                     }
                 }
-            
-                // Fallback to IPv4 if anything failed
-                if (ec || ipv4Only) {
-                    Utils::warn("TCP: IPv6 unavailable (" + ec.message() + "), falling back to IPv4 only");
+                
+                // If IPv6 bind failed OR IPv6 open failed OR forced IPv4-only
+                if (ipv4Only || ec_open || ec_bind) {
+                    if (!ipv4Only)
+                        Utils::warn("TCP: IPv6 unavailable (open=" + ec_open.message() +
+                                    ", bind=" + ec_bind.message() +
+                                    "), falling back to IPv4 only");
                 
                     asio::ip::tcp::endpoint endpoint_v4(asio::ip::tcp::v4(), port);
-                    mAcceptor.close(); // ensure clean state
+                
+                    mAcceptor.close(); // guarantee clean state
                     mAcceptor.open(endpoint_v4.protocol());
                     mAcceptor.bind(endpoint_v4);
                 }
@@ -72,8 +81,8 @@ namespace ColumnLynx::Net::TCP {
             asio::io_context &mIoContext;
             asio::ip::tcp::acceptor mAcceptor;
             std::unordered_set<TCPConnection::pointer> mClients;
-            Utils::LibSodiumWrapper *mSodiumWrapper;
-            bool* mHostRunning;
+            std::shared_ptr<Utils::LibSodiumWrapper> mSodiumWrapper;
+            std::shared_ptr<bool> mHostRunning;
             std::unordered_map<std::string, std::string> mRawServerConfig;
     };
 

include/columnlynx/server/net/udp/udp_server.hpp

@@ -13,27 +13,40 @@
 namespace ColumnLynx::Net::UDP {
     class UDPServer {
         public:
-            UDPServer(asio::io_context& ioContext, uint16_t port, bool* hostRunning, bool ipv4Only = false, std::shared_ptr<VirtualInterface> tun = nullptr)
+            UDPServer(asio::io_context& ioContext, uint16_t port, std::shared_ptr<bool> hostRunning, bool ipv4Only = false, std::shared_ptr<VirtualInterface> tun = nullptr)
                 : mSocket(ioContext), mHostRunning(hostRunning), mTun(tun)
             {
-                asio::error_code ec;
+                asio::error_code ec_open, ec_v6only, ec_bind;
 
                 if (!ipv4Only) {
-                    // Try IPv6 first (dual-stack check)
                     asio::ip::udp::endpoint endpoint_v6(asio::ip::udp::v6(), port);
-                    mSocket.open(endpoint_v6.protocol(), ec);
-                    if (!ec) {
-                        mSocket.set_option(asio::ip::v6_only(false), ec); // Allow dual-stack if possible
-                        mSocket.bind(endpoint_v6, ec);
+                
+                    // Try opening IPv6 socket
+                    mSocket.open(endpoint_v6.protocol(), ec_open);
+                
+                    if (!ec_open) {
+                        // Try enabling dual-stack (non fatal if it fails)
+                        mSocket.set_option(asio::ip::v6_only(false), ec_v6only);
+                    
+                        // Attempt bind
+                        mSocket.bind(endpoint_v6, ec_bind);
                     }
                 }
 
-                // Fallback to IPv4 if anything failed
-                if (ec || ipv4Only) {
-                    Utils::warn("UDP: IPv6 unavailable (" + ec.message() + "), falling back to IPv4 only");
-
+                // Fallback to IPv4 if IPv6 is unusable
+                if (ipv4Only || ec_open || ec_bind) {
+                    if (!ipv4Only) {
+                        Utils::warn(
+                            "UDP: IPv6 unavailable (open=" + ec_open.message() +
+                            ", bind=" + ec_bind.message() +
+                            "), falling back to IPv4 only"
+                        );
+                    }
+                
                     asio::ip::udp::endpoint endpoint_v4(asio::ip::udp::v4(), port);
-                    mSocket.close(); // ensure clean state
+                
+                    mSocket.close();
+                    mSocket = asio::ip::udp::socket(ioContext); // fully reset internal state
                     mSocket.open(endpoint_v4.protocol());
                     mSocket.bind(endpoint_v4);
                 }
@@ -56,8 +69,8 @@ namespace ColumnLynx::Net::UDP {
 
             asio::ip::udp::socket mSocket;
             asio::ip::udp::endpoint mRemoteEndpoint;
-            std::array<uint8_t, 2048> mRecvBuffer; // Adjust size as needed
-            bool* mHostRunning;
+            std::array<uint8_t, 2048> mRecvBuffer; // 2048 seems stable
+            std::shared_ptr<bool> mHostRunning;
             std::shared_ptr<VirtualInterface> mTun;
     };
 }

src/client/main.cpp

@@ -21,18 +21,19 @@ volatile sig_atomic_t done = 0;
 
 void signalHandler(int signum) {
     if (signum == SIGINT || signum == SIGTERM) {
-        //log("Received termination signal. Shutting down client.");
         done = 1;
     }
 }
 
 int main(int argc, char** argv) {
     // Capture SIGINT and SIGTERM for graceful shutdown
+#if !defined(_WIN32)
     struct sigaction action;
     memset(&action, 0, sizeof(struct sigaction));
     action.sa_handler = signalHandler;
     sigaction(SIGINT, &action, nullptr);
     sigaction(SIGTERM, &action, nullptr);
+#endif
 
     PanicHandler::init();
 
@@ -68,22 +69,23 @@ int main(int argc, char** argv) {
         log("This software is licensed under the GPLv2 only OR the GPLv3. See LICENSES/ for details.");
 
 #if defined(__WIN32__)
-        WintunInitialize();
+        //WintunInitialize();
 #endif
 
         std::shared_ptr<VirtualInterface> tun = std::make_shared<VirtualInterface>(optionsObj["interface"].as<std::string>());
         log("Using virtual interface: " + tun->getName());
 
-        LibSodiumWrapper sodiumWrapper = LibSodiumWrapper();
-        debug("Public Key: " + Utils::bytesToHexString(sodiumWrapper.getPublicKey(), 32));
-        debug("Private Key: " + Utils::bytesToHexString(sodiumWrapper.getPrivateKey(), 64));
+        std::shared_ptr<LibSodiumWrapper> sodiumWrapper = std::make_shared<LibSodiumWrapper>();
+        debug("Public Key: " + Utils::bytesToHexString(sodiumWrapper->getPublicKey(), 32));
+        debug("Private Key: " + Utils::bytesToHexString(sodiumWrapper->getPrivateKey(), 64));
 
-        std::array<uint8_t, 32> aesKey = {0}; // Defualt zeroed state until modified by handshake
-        uint64_t sessionID = 0;
+        std::shared_ptr<std::array<uint8_t, 32>> aesKey = std::make_shared<std::array<uint8_t, 32>>(); 
+        aesKey->fill(0); // Defualt zeroed state until modified by handshake
+        std::shared_ptr<uint64_t> sessionID = std::make_shared<uint64_t>(0);
 
         asio::io_context io;
-        auto client = std::make_shared<ColumnLynx::Net::TCP::TCPClient>(io, host, port, &sodiumWrapper, &aesKey, &sessionID, &insecureMode, tun);
-        auto udpClient = std::make_shared<ColumnLynx::Net::UDP::UDPClient>(io, host, port, &aesKey, &sessionID, tun);
+        auto client = std::make_shared<ColumnLynx::Net::TCP::TCPClient>(io, host, port, sodiumWrapper, aesKey, sessionID, insecureMode, tun);
+        auto udpClient = std::make_shared<ColumnLynx::Net::UDP::UDPClient>(io, host, port, aesKey, sessionID, tun);
 
         client->start();
         udpClient->start();
@@ -94,19 +96,23 @@ int main(int argc, char** argv) {
         });
         //ioThread.join();
 
-        log("Client connected to " + host + ":" + port);
+        log("Attempting connection to " + host + ":" + port);
+        debug("Client connection flag: " + std::to_string(client->isConnected()));
+        debug("Client handshake flag: " + std::to_string(client->isHandshakeComplete()));
+        debug("isDone flag: " + std::to_string(done));
         
         // Client is running
         while ((client->isConnected() || !client->isHandshakeComplete()) && !done) {
+            //debug("Client connection flag: " + std::to_string(client->isConnected()));
             auto packet = tun->readPacket();
-            if (!client->isConnected() || done) {
+            /*if (!client->isConnected() || done) {
                 break; // Bail out if connection died or signal set while blocked
-            }
+            }*/
             
             if (packet.empty()) {
                 continue;
             }
-            
+
             udpClient->sendMessage(std::string(packet.begin(), packet.end()));
         }
 

src/client/net/tcp/tcp_client.cpp

@@ -3,7 +3,7 @@
 // Distributed under the terms of the GNU General Public License, either version 2 only or version 3. See LICENSES/ for details.
 
 #include <columnlynx/client/net/tcp/tcp_client.hpp>
-#include <arpa/inet.h>
+//#include <arpa/inet.h>
 
 namespace ColumnLynx::Net::TCP {
     void TCPClient::start() {
@@ -13,22 +13,35 @@ namespace ColumnLynx::Net::TCP {
                 if (!ec) {
                     asio::async_connect(mSocket, endpoints,
                         [this, self](asio::error_code ec, const tcp::endpoint&) {
-                            if (!NetHelper::isExpectedDisconnect(ec)) {
+                            if (!ec) {
                                 mConnected = true;
                                 Utils::log("Client connected.");
                                 mHandler = std::make_shared<MessageHandler>(std::move(mSocket));
                                 mHandler->onMessage([this](AnyMessageType type, const std::string& data) {
                                     mHandleMessage(static_cast<ServerMessageType>(MessageHandler::toUint8(type)), data);
                                 });
+                                // Close only after peer FIN to avoid RSTs
+                                mHandler->onDisconnect([this](const asio::error_code& ec) {
+                                    asio::error_code ec2;
+                                    if (mHandler) {
+                                        mHandler->socket().close(ec2);
+                                    }
+                                    mConnected = false;
+                                    Utils::log(std::string("Server disconnected: ") + ec.message());
+                                });
                                 mHandler->start();
                                 
                                 // Init connection handshake
                                 Utils::log("Sending handshake init to server.");
 
                                 // Check if hostname or IPv4/IPv6
-                                sockaddr_in addr4{};
-                                sockaddr_in6 addr6{};
-                                self->mIsHostDomain = inet_pton(AF_INET, mHost.c_str(), (void*)(&addr4)) != 1 && inet_pton(AF_INET6, mHost.c_str(), (void*)(&addr6)) != 1; // Voodoo black magic
+                                try {
+                                    asio::ip::make_address(mHost);
+                                    self->mIsHostDomain = false; // IPv4 or IPv6 literal
+                                } catch (const asio::system_error&) {
+                                    self->mIsHostDomain = true;  // hostname / domain
+                                }
+
 
                                 std::vector<uint8_t> payload;
                                 payload.reserve(1 + crypto_box_PUBLICKEYBYTES);
@@ -46,7 +59,9 @@ namespace ColumnLynx::Net::TCP {
                             
                                 mStartHeartbeat();
                             } else {
-                                Utils::error("Client connect failed: " + ec.message());
+                                if (!NetHelper::isExpectedDisconnect(ec)) {
+                                    Utils::error("Client connect failed: " + ec.message());
+                                }
                             }
                         });
                 } else {
@@ -77,18 +92,14 @@ namespace ColumnLynx::Net::TCP {
             asio::error_code ec;
             mHeartbeatTimer.cancel();
 
-            mHandler->socket().shutdown(tcp::socket::shutdown_both, ec);
+            // Half-close: stop sending, keep reading until peer FIN
+            mHandler->socket().shutdown(tcp::socket::shutdown_send, ec);
             if (ec) {
                 Utils::error("Error during socket shutdown: " + ec.message());
             }
 
-            mHandler->socket().close(ec);
-            if (ec) {
-                Utils::error("Error during socket close: " + ec.message());
-            }
-
-            mConnected = false;
-            Utils::log("Client disconnected.");
+            // Do not close immediately; rely on onDisconnect to finalize
+            Utils::log("Client initiated graceful disconnect (half-close).");
         }
     }
 
@@ -145,7 +156,7 @@ namespace ColumnLynx::Net::TCP {
                     // Verify pubkey against whitelisted_keys
                     std::vector<std::string> whitelistedKeys = Utils::getWhitelistedKeys();
                     if (std::find(whitelistedKeys.begin(), whitelistedKeys.end(), Utils::bytesToHexString(mServerPublicKey, 32)) == whitelistedKeys.end()) { // Key verification is handled in later steps of the handshake
-                        if (!(*mInsecureMode)) {
+                        if (!mInsecureMode) {
                             Utils::error("Server public key not in whitelisted_keys. Terminating connection.");
                             disconnect();
                             return;
@@ -269,6 +280,12 @@ namespace ColumnLynx::Net::TCP {
                     disconnect(false);
                 }
                 break;
+            case ServerMessageType::KILL_CONNECTION:
+                Utils::warn("Server is killing the connection: " + data);
+                if (mConnected) {
+                    disconnect(false);
+                }
+                break;
             default:
                 Utils::log("Received unknown message type from server.");
                 break;

src/client/net/udp/udp_client.cpp

@@ -6,10 +6,41 @@
 
 namespace ColumnLynx::Net::UDP {
     void UDPClient::start() {
-        // TODO: Add IPv6
-        auto endpoints = mResolver.resolve(asio::ip::udp::v4(), mHost, mPort);
+        asio::error_code ec;
+
+        // Resolve using an unspecified protocol (allows both IPv4 and IPv6)
+        auto endpoints = mResolver.resolve(
+            asio::ip::udp::v6(),  // Try IPv6 first (dual-stack with v4)
+            mHost,
+            mPort,
+            ec
+        );
+
+        if (ec) {
+            // If IPv6 fails (host has no AAAA), try IPv4
+            endpoints = mResolver.resolve(
+                asio::ip::udp::v4(),
+                mHost,
+                mPort,
+                ec
+            );
+        }
+
+        if (ec) {
+            Utils::error("UDP resolve failed: " + ec.message());
+            return;
+        }
+
+        // Use whichever endpoint resolved
         mRemoteEndpoint = *endpoints.begin();
-        mSocket.open(asio::ip::udp::v4());
+
+        // Open socket using the resolved endpoint's protocol
+        mSocket.open(mRemoteEndpoint.protocol(), ec);
+        if (ec) {
+            Utils::error("UDP socket open failed: " + ec.message());
+            return;
+        }
+        
         Utils::log("UDP Client ready to send to " + mRemoteEndpoint.address().to_string() + ":" + std::to_string(mRemoteEndpoint.port()));
     }
 
@@ -36,10 +67,9 @@ namespace ColumnLynx::Net::UDP {
             reinterpret_cast<uint8_t*>(&hdr),
             reinterpret_cast<uint8_t*>(&hdr) + sizeof(UDPPacketHeader)
         );
-        uint64_t sid = *mSessionIDRef;
         packet.insert(packet.end(),
-            reinterpret_cast<uint8_t*>(&sid),
-            reinterpret_cast<uint8_t*>(&sid) + sizeof(sid)
+            reinterpret_cast<uint8_t*>(mSessionIDRef.get()),
+            reinterpret_cast<uint8_t*>(mSessionIDRef.get()) + sizeof(uint64_t)
         );
         packet.insert(packet.end(), encryptedPayload.begin(), encryptedPayload.end());
 
@@ -90,6 +120,11 @@ namespace ColumnLynx::Net::UDP {
         uint64_t sessionID;
         std::memcpy(&sessionID, mRecvBuffer.data() + sizeof(UDPPacketHeader), sizeof(uint64_t));
 
+        if (sessionID != *mSessionIDRef) {
+            Utils::warn("Got packet that isn't for me! Dropping!");
+            return;
+        }
+
         // Decrypt payload
         std::vector<uint8_t> ciphertext(
             mRecvBuffer.begin() + sizeof(UDPPacketHeader) + sizeof(uint64_t),

src/common/session_registry.cpp

@@ -0,0 +1,100 @@
+// session_registry.cpp - Session Registry for ColumnLynx
+// Copyright (C) 2025 DcruBro
+// Distributed under the terms of the GNU General Public License, either version 2 only or version 3. See LICENSES/ for details.
+
+#include <columnlynx/common/net/session_registry.hpp>
+
+namespace ColumnLynx::Net {
+    void SessionRegistry::put(uint64_t sessionID, std::shared_ptr<SessionState> state) {
+        std::unique_lock lock(mMutex);
+        mSessions[sessionID] = std::move(state);
+        mIPSessions[mSessions[sessionID]->clientTunIP] = mSessions[sessionID];
+    }
+
+    std::shared_ptr<const SessionState> SessionRegistry::get(uint64_t sessionID) const {
+        std::shared_lock lock(mMutex);
+        auto it = mSessions.find(sessionID);
+        return (it == mSessions.end()) ? nullptr : it->second;
+    }
+
+    std::shared_ptr<const SessionState> SessionRegistry::getByIP(uint32_t ip) const {
+        std::shared_lock lock(mMutex);
+        auto it = mIPSessions.find(ip);
+        return (it == mIPSessions.end()) ? nullptr : it->second;
+    }
+
+    std::unordered_map<uint64_t, std::shared_ptr<SessionState>> SessionRegistry::snapshot() const {
+        std::unordered_map<uint64_t, std::shared_ptr<SessionState>> snap;
+        std::shared_lock lock(mMutex);
+        snap = mSessions;
+        return snap;
+    }
+
+    void SessionRegistry::erase(uint64_t sessionID) {
+        std::unique_lock lock(mMutex);
+        mSessions.erase(sessionID);
+    }
+
+    void SessionRegistry::cleanupExpired() {
+        std::unique_lock lock(mMutex);
+        auto now = std::chrono::steady_clock::now();
+        for (auto it = mSessions.begin(); it != mSessions.end(); ) {
+            if (it->second && it->second->expires <= now) {
+                it = mSessions.erase(it);
+            } else {
+                ++it;
+            }
+        }
+
+        for (auto it = mIPSessions.begin(); it != mIPSessions.end(); ) {
+            if (it->second && it->second->expires <= now) {
+                it = mIPSessions.erase(it);
+            } else {
+                ++it;
+            }
+        }
+    }
+
+    int SessionRegistry::size() const {
+        std::shared_lock lock(mMutex);
+        return static_cast<int>(mSessions.size());
+    }
+
+    uint32_t SessionRegistry::getFirstAvailableIP(uint32_t baseIP, uint8_t mask) const {
+        std::shared_lock lock(mMutex);
+
+        uint32_t hostCount = (1u << (32 - mask));
+        uint32_t firstHost = 2;
+        uint32_t lastHost  = hostCount - 2;
+
+        for (uint32_t offset = firstHost; offset <= lastHost; offset++) {
+            uint32_t candidateIP = baseIP + offset;
+            if (mIPSessions.find(candidateIP) == mIPSessions.end()) {
+                return candidateIP;
+            }
+        }
+    
+        return 0;
+    }
+
+    void SessionRegistry::lockIP(uint64_t sessionID, uint32_t ip) {
+        std::unique_lock lock(mMutex);
+        mSessionIPs[sessionID] = ip;
+        
+        /*if (mIPSessions.find(sessionID) == mIPSessions.end()) {
+            Utils::debug("yikes");
+        }*/
+        mIPSessions[ip] = mSessions.find(sessionID)->second;
+    }
+
+    void SessionRegistry::deallocIP(uint64_t sessionID) {
+        std::unique_lock lock(mMutex);
+    
+        auto it = mSessionIPs.find(sessionID);
+        if (it != mSessionIPs.end()) {
+            uint32_t ip = it->second;
+            mIPSessions.erase(ip);
+            mSessionIPs.erase(it);
+        }
+    }
+}

src/common/tcp_message_handler.cpp

@@ -43,13 +43,19 @@ namespace ColumnLynx::Net::TCP {
         auto self = shared_from_this();
         asio::async_read(mSocket, asio::buffer(mHeader),
             [this, self](asio::error_code ec, std::size_t) {
-                if (!NetHelper::isExpectedDisconnect(ec)) {
+                if (!ec) {
                     mCurrentType = decodeMessageType(mHeader[0]);
 
                     uint16_t len = (mHeader[1] << 8) | mHeader[2];
                     mReadBody(len);
                 } else {
-                    Utils::error("Header read failed: " + ec.message());
+                    if (!NetHelper::isExpectedDisconnect(ec)) {
+                        Utils::error("Header read failed: " + ec.message());
+                    }
+                    // Connection closed, trigger disconnect handler
+                    if (mOnDisconnect) {
+                        mOnDisconnect(ec);
+                    }
                 }
             }
         );
@@ -61,7 +67,7 @@ namespace ColumnLynx::Net::TCP {
 
         asio::async_read(mSocket, asio::buffer(mBody),
             [this, self](asio::error_code ec, std::size_t) {
-                if (!NetHelper::isExpectedDisconnect(ec)) {
+                if (!ec) {
                     std::string payload(mBody.begin(), mBody.end());
                     
                     // Dispatch based on message type
@@ -71,8 +77,10 @@ namespace ColumnLynx::Net::TCP {
 
                     mReadHeader(); // Keep listening
                 } else {
-                    Utils::error("Body read failed: " + ec.message());
-
+                    if (!NetHelper::isExpectedDisconnect(ec)) {
+                        Utils::error("Body read failed: " + ec.message());
+                    }
+                    // Connection closed, trigger disconnect handler
                     if (mOnDisconnect) {
                         mOnDisconnect(ec);
                     }

src/common/utils.cpp

@@ -49,7 +49,7 @@ namespace ColumnLynx::Utils {
     }
 
     std::string getVersion() {
-        return "a0.5";
+        return "b0.3";
     }
 
     unsigned short serverPort() {
@@ -118,7 +118,7 @@ namespace ColumnLynx::Utils {
         return out;
     }
 
-    std::unordered_map<std::string, std::string> getConfigMap(std::string path) {
+    std::unordered_map<std::string, std::string> getConfigMap(std::string path, std::vector<std::string> requiredKeys) {
         // TODO: Currently re-reads every time.
         std::vector<std::string> readLines;
 
@@ -145,6 +145,14 @@ namespace ColumnLynx::Utils {
             config.insert({ key, val });
         }
 
+        if (!requiredKeys.empty()) {
+            for (std::string x : requiredKeys) {
+                if (config.find(x) == config.end()) {
+                    throw std::runtime_error("Config doesn't contain all required keys! (Missing: '" + x + "')");
+                }
+            }
+        }
+
         return config;
     }
 }

src/common/virtual_interface.cpp

@@ -6,6 +6,55 @@
 
 // This is all fucking voodoo dark magic.
 
+#if defined(_WIN32)
+
+static HMODULE gWintun = nullptr;
+
+static WINTUN_OPEN_ADAPTER_FUNC*           pWintunOpenAdapter;
+static WINTUN_START_SESSION_FUNC*          pWintunStartSession;
+static WINTUN_END_SESSION_FUNC*            pWintunEndSession;
+static WINTUN_GET_READ_WAIT_EVENT_FUNC*    pWintunGetReadWaitEvent;
+static WINTUN_RECEIVE_PACKET_FUNC*         pWintunReceivePacket;
+static WINTUN_RELEASE_RECEIVE_PACKET_FUNC* pWintunReleaseReceivePacket;
+static WINTUN_ALLOCATE_SEND_PACKET_FUNC*   pWintunAllocateSendPacket;
+static WINTUN_SEND_PACKET_FUNC*            pWintunSendPacket;
+static WINTUN_CREATE_ADAPTER_FUNC*         pWintunCreateAdapter;
+
+static void InitializeWintun()
+{
+    if (gWintun)
+        return;
+
+    gWintun = LoadLibraryExW(
+        L"wintun.dll",
+        nullptr,
+        LOAD_LIBRARY_SEARCH_APPLICATION_DIR
+    );
+
+    if (!gWintun)
+        throw std::runtime_error("Failed to load wintun.dll");
+
+#define RESOLVE(name, type)                                      \
+    p##name = reinterpret_cast<type*>(                           \
+        GetProcAddress(gWintun, #name));                          \
+    if (!p##name)                                                 \
+        throw std::runtime_error("Missing Wintun symbol: " #name);
+
+    RESOLVE(WintunOpenAdapter,           WINTUN_OPEN_ADAPTER_FUNC)
+    RESOLVE(WintunStartSession,          WINTUN_START_SESSION_FUNC)
+    RESOLVE(WintunEndSession,            WINTUN_END_SESSION_FUNC)
+    RESOLVE(WintunGetReadWaitEvent,      WINTUN_GET_READ_WAIT_EVENT_FUNC)
+    RESOLVE(WintunReceivePacket,         WINTUN_RECEIVE_PACKET_FUNC)
+    RESOLVE(WintunReleaseReceivePacket,  WINTUN_RELEASE_RECEIVE_PACKET_FUNC)
+    RESOLVE(WintunAllocateSendPacket,    WINTUN_ALLOCATE_SEND_PACKET_FUNC)
+    RESOLVE(WintunSendPacket,            WINTUN_SEND_PACKET_FUNC)
+    RESOLVE(WintunCreateAdapter,         WINTUN_CREATE_ADAPTER_FUNC)
+
+#undef RESOLVE
+}
+
+#endif // _WIN32
+
 namespace ColumnLynx::Net {
     // ------------------------------ Constructor ------------------------------
     VirtualInterface::VirtualInterface(const std::string& ifName)
@@ -28,6 +77,7 @@ namespace ColumnLynx::Net {
 
     #elif defined(__APPLE__)
         // ---- macOS: UTUN (system control socket) ----
+        // TL;DR: macOS doesn't really have a "device file" for TUN/TAP like Linux. Instead we have to request a "system control socket" from the kernel.
         mFd = socket(PF_SYSTEM, SOCK_DGRAM, SYSPROTO_CONTROL);
         if (mFd < 0)
             throw std::runtime_error("socket(PF_SYSTEM) failed: " + std::string(strerror(errno)));
@@ -42,7 +92,7 @@ namespace ColumnLynx::Net {
         sc.sc_family = AF_SYSTEM;
         sc.ss_sysaddr = AF_SYS_CONTROL;
         sc.sc_id = ctlInfo.ctl_id;
-        sc.sc_unit = 0; // lynx0 (0 = auto-assign)
+        sc.sc_unit = 0; // 0 = auto-assign next utunX
 
         if (connect(mFd, (struct sockaddr*)&sc, sizeof(sc)) < 0) {
             if (errno == EPERM)
@@ -50,31 +100,45 @@ namespace ColumnLynx::Net {
             throw std::runtime_error("connect(AF_SYS_CONTROL) failed: " + std::string(strerror(errno)));
         }
 
-        // Retrieve actual utun device name
-        struct sockaddr_storage addr;
-        socklen_t addrlen = sizeof(addr);
-        if (getsockname(mFd, (struct sockaddr*)&addr, &addrlen) == 0) {
-            const struct sockaddr_ctl* addr_ctl = (const struct sockaddr_ctl*)&addr;
-            mIfName = "utun" + std::to_string(addr_ctl->sc_unit - 1);
+        // Retrieve actual utun device name via UTUN_OPT_IFNAME
+        char ifname[IFNAMSIZ];
+        socklen_t ifname_len = sizeof(ifname);
+        if (getsockopt(mFd, SYSPROTO_CONTROL, UTUN_OPT_IFNAME, ifname, &ifname_len) == 0) {
+            mIfName = ifname; // Update to actual assigned name
         } else {
-            mIfName = "utunX";
+            mIfName = "utun0"; // Fallback (should not happen)
         }
 
-    #elif defined(_WIN32)
-        // ---- Windows: Wintun (WireGuard virtual adapter) ----
-        WINTUN_ADAPTER_HANDLE adapter =
-            WintunOpenAdapter(L"ColumnLynx", std::wstring(ifName.begin(), ifName.end()).c_str());
-        if (!adapter)
-            throw std::runtime_error("Wintun adapter not found or not installed");
+        Utils::log("VirtualInterface: opened macOS UTUN: " + mIfName);
 
-        WINTUN_SESSION_HANDLE session =
-            WintunStartSession(adapter, 0x200000); // ring buffer size
-        if (!session)
+    #elif defined(_WIN32)
+
+	// Convert to Windows' wchar_t* thingy
+	std::wstring_convert<std::codecvt_utf8<wchar_t>> converter;
+	std::wstring wide_string = converter.from_bytes(mIfName);
+	const wchar_t* wide_c_str = wide_string.c_str();
+
+        InitializeWintun();
+
+        mAdapter = pWintunOpenAdapter(wide_c_str);
+
+        if (!mAdapter) {
+            mAdapter = pWintunCreateAdapter(
+                wide_c_str,
+                L"ColumnLynx",
+                nullptr
+            );
+        }
+
+        if (!mAdapter)
+            throw std::runtime_error("Failed to open or create Wintun adapter (run running as admin)");
+
+        mSession = pWintunStartSession(mAdapter, 0x200000);
+        if (!mSession)
             throw std::runtime_error("Failed to start Wintun session");
 
-        mHandle = WintunGetReadWaitEvent(session);
-        mFd = -1; // not used on Windows
-        mIfName = ifName;
+        mHandle = pWintunGetReadWaitEvent(mSession);
+        mFd = -1;
 
     #else
         throw std::runtime_error("Unsupported platform");
@@ -87,32 +151,82 @@ namespace ColumnLynx::Net {
         if (mFd >= 0)
             close(mFd);
     #elif defined(_WIN32)
-        // Wintun sessions need explicit stop
-        // (assuming you stored the session handle as member)
-        // WintunEndSession(mSession);
+        if (mSession)
+            pWintunEndSession(mSession);
     #endif
     }
 
     // ------------------------------ Read ------------------------------
     std::vector<uint8_t> VirtualInterface::readPacket() {
-    #if defined(__linux__) || defined(__APPLE__)
+    #if defined(__linux__)
+
+        // Linux TUN: blocking read is fine, unblocks on fd close / EINTR
         std::vector<uint8_t> buf(4096);
         ssize_t n = read(mFd, buf.data(), buf.size());
         if (n < 0) {
             if (errno == EINTR) {
-                return {}; // Interrupted, return empty
+                return {}; // Interrupted, just return empty
             }
             throw std::runtime_error("read() failed: " + std::string(strerror(errno)));
         }
         buf.resize(n);
         return buf;
 
-    #elif defined(_WIN32)
-        WINTUN_PACKET* packet = WintunReceivePacket(mSession, nullptr);
-        if (!packet) return {};
-        std::vector<uint8_t> buf(packet->Data, packet->Data + packet->Length);
-        WintunReleaseReceivePacket(mSession, packet);
+    #elif defined(__APPLE__)
+
+        // macOS utun: must poll, or read() can block forever
+        std::vector<uint8_t> buf(4096);
+
+        struct pollfd pfd;
+        pfd.fd = mFd;
+        pfd.events = POLLIN;
+
+        // timeout in ms; keep it small so shutdown is responsive
+        int ret = poll(&pfd, 1, 200);
+
+        if (ret == 0) {
+            // No data yet
+            return {};
+        }
+
+        if (ret < 0) {
+            if (errno == EINTR) {
+                return {}; // Interrupted by signal
+            }
+            throw std::runtime_error("poll() failed: " + std::string(strerror(errno)));
+        }
+
+        if (!(pfd.revents & POLLIN)) {
+            return {};
+        }
+
+        ssize_t n = read(mFd, buf.data(), buf.size());
+        if (n <= 0) {
+            // 0 or -1: treat as EOF or transient; you can decide how aggressive to be
+            return {};
+        }
+
+        if (n > 4) {
+            // Drop macOS UTUN header (4 bytes)
+            std::memmove(buf.data(), buf.data() + 4, n - 4);
+            buf.resize(n - 4);
+        } else {
+            return {};
+        }
+
         return buf;
+
+    #elif defined(_WIN32)
+
+        DWORD size = 0;
+        BYTE* packet = pWintunReceivePacket(mSession, &size);
+        if (!packet)
+            return {};
+
+        std::vector<uint8_t> buf(packet, packet + size);
+        pWintunReleaseReceivePacket(mSession, packet);
+        return buf;
+
     #else
         return {};
     #endif
@@ -120,16 +234,52 @@ namespace ColumnLynx::Net {
 
     // ------------------------------ Write ------------------------------
     void VirtualInterface::writePacket(const std::vector<uint8_t>& packet) {
-    #if defined(__linux__) || defined(__APPLE__)
+    #if defined(__linux__)
+
+        // Linux TUN expects raw IP packet
         ssize_t n = write(mFd, packet.data(), packet.size());
         if (n < 0)
             throw std::runtime_error("write() failed: " + std::string(strerror(errno)));
 
+    #elif defined(__APPLE__)
+
+        if (packet.empty())
+            return;
+
+        // Detect IPv4 or IPv6
+        uint8_t version = packet[0] >> 4;
+        uint32_t af;
+
+        if (version == 4) {
+            af = htonl(AF_INET);
+        } else if (version == 6) {
+            af = htonl(AF_INET6);
+        } else {
+            throw std::runtime_error("writePacket(): unknown IP version");
+        }
+
+        // Prepend 4-byte AF header
+        std::vector<uint8_t> out(packet.size() + 4);
+        memcpy(out.data(), &af, 4);
+        memcpy(out.data() + 4, packet.data(), packet.size());
+
+        ssize_t n = write(mFd, out.data(), out.size());
+        if (n < 0)
+            throw std::runtime_error("utun write() failed: " + std::string(strerror(errno)));
+
     #elif defined(_WIN32)
-        WINTUN_PACKET* tx = WintunAllocateSendPacket(mSession, (DWORD)packet.size());
-        if (!tx) throw std::runtime_error("WintunAllocateSendPacket failed");
-        memcpy(tx->Data, packet.data(), packet.size());
-        WintunSendPacket(mSession, tx);
+
+        BYTE* tx = pWintunAllocateSendPacket(
+            mSession,
+            static_cast<DWORD>(packet.size())
+        );
+
+        if (!tx)
+            throw std::runtime_error("WintunAllocateSendPacket failed");
+
+        memcpy(tx, packet.data(), packet.size());
+        pWintunSendPacket(mSession, tx);
+
     #endif
     }
 
@@ -154,7 +304,46 @@ namespace ColumnLynx::Net {
         return false;
     #endif
     }
-    
+
+    void VirtualInterface::resetIP() {
+    #if defined(__linux__)
+        char cmd[512];
+        snprintf(cmd, sizeof(cmd),
+                 "ip addr flush dev %s",
+                 mIfName.c_str()
+        );
+        system(cmd);
+    #elif defined(__APPLE__)
+        char cmd[512];
+        snprintf(cmd, sizeof(cmd),
+                 "ifconfig %s inet 0.0.0.0 delete",
+                 mIfName.c_str()
+        );
+        system(cmd);
+
+        snprintf(cmd, sizeof(cmd),
+                 "ifconfig %s inet6 :: delete",
+                 mIfName.c_str()
+        );
+        system(cmd);
+    #elif defined(_WIN32)
+        char cmd[512];
+        // Remove any persistent routes associated with this interface
+        snprintf(cmd, sizeof(cmd),
+            "netsh routing ip delete persistentroute all name=\"%s\"",
+            mIfName.c_str()
+        );
+        system(cmd);
+        
+        // Reset to DHCP
+        snprintf(cmd, sizeof(cmd),
+            "netsh interface ip set address name=\"%s\" dhcp",
+            mIfName.c_str()
+        );
+        system(cmd);
+    #endif
+    }
+
     // ------------------------------------------------------------
     // Linux
     // ------------------------------------------------------------
@@ -166,6 +355,13 @@ namespace ColumnLynx::Net {
         std::string ipStr = ipv4ToString(clientIP);
         std::string peerStr = ipv4ToString(serverIP);
     
+        // Wipe the current config
+        snprintf(cmd, sizeof(cmd),
+                 "ip addr flush dev %s",
+                 mIfName.c_str()
+        );
+        system(cmd);
+
         snprintf(cmd, sizeof(cmd),
                  "ip addr add %s/%d peer %s dev %s",
                  ipStr.c_str(), prefixLen, peerStr.c_str(), mIfName.c_str());
@@ -188,12 +384,26 @@ namespace ColumnLynx::Net {
     
         std::string ipStr = ipv4ToString(clientIP);
         std::string peerStr = ipv4ToString(serverIP);
-        std::string prefixStr = ipv4ToString(prefixLen);
+        std::string prefixStr = ipv4ToString(prefixLengthToNetmask(prefixLen), false);
+        Utils::debug("Prefix string: " + prefixStr);
     
-        // Set netmask (/24 CIDR temporarily with raw command, improve later)
+        // Reset
         snprintf(cmd, sizeof(cmd),
-                "ifconfig lynx0 %s %s mtu %d netmask %s up",
-                 ipStr.c_str(), peerStr.c_str(), mtu, prefixStr.c_str());
+                 "ifconfig %s inet 0.0.0.0 delete",
+                mIfName.c_str()
+        );
+        system(cmd);
+
+        snprintf(cmd, sizeof(cmd),
+                 "ifconfig %s inet6 :: delete",
+                mIfName.c_str()
+        );
+        system(cmd);
+
+        // Set
+        snprintf(cmd, sizeof(cmd),
+                "ifconfig %s inet %s %s mtu %d netmask %s up",
+                 mIfName.c_str(), ipStr.c_str(), peerStr.c_str(), mtu, prefixStr.c_str());
         system(cmd);
 
         Utils::log("Executed command: " + std::string(cmd));
@@ -218,7 +428,11 @@ namespace ColumnLynx::Net {
         uint32_t maskInt = (prefixLen == 0) ? 0 : (0xFFFFFFFF << (32 - prefixLen));
         mask = ipv4ToString(maskInt);
 
-        char cmd[256];
+        // Calculate network address from IP and mask
+        uint32_t networkInt = (clientIP & maskInt);
+        std::string network = ipv4ToString(networkInt);
+
+        char cmd[512];
 
         // 1. Set the static IP + mask + gateway
         snprintf(cmd, sizeof(cmd),
@@ -234,6 +448,14 @@ namespace ColumnLynx::Net {
         );
         system(cmd);
 
+        // 3. Add route for the VPN network to go through the TUN interface
+        // This is critical: tells Windows to send packets destined for the server/network through the TUN interface
+        snprintf(cmd, sizeof(cmd),
+            "netsh routing ip add persistentroute dest=%s/%d name=\"%s\" nexthopcfg=%s",
+            network.c_str(), prefixLen, mIfName.c_str(), gw.c_str()
+        );
+        system(cmd);
+
         return true;
     #else
         return false;

src/server/main.cpp

@@ -4,6 +4,8 @@
 
 #include <asio.hpp>
 #include <iostream>
+#include <thread>
+#include <chrono>
 #include <columnlynx/common/utils.hpp>
 #include <columnlynx/common/panic_handler.hpp>
 #include <columnlynx/server/net/tcp/tcp_server.hpp>
@@ -23,20 +25,7 @@ using namespace ColumnLynx;
 
 volatile sig_atomic_t done = 0;
 
-void signalHandler(int signum) {
-    if (signum == SIGINT || signum == SIGTERM) {
-        log("Received termination signal. Shutting down server gracefully.");
-        done = 1;
-    }
-}
-
 int main(int argc, char** argv) {
-    // Capture SIGINT and SIGTERM for graceful shutdown
-    struct sigaction action;
-    memset(&action, 0, sizeof(struct sigaction));
-    action.sa_handler = signalHandler;
-    sigaction(SIGINT, &action, nullptr);
-    sigaction(SIGTERM, &action, nullptr);
 
     cxxopts::Options options("columnlynx_server", "ColumnLynx Server Application");
 
@@ -68,7 +57,7 @@ int main(int argc, char** argv) {
         log("This software is licensed under the GPLv2 only OR the GPLv3. See LICENSES/ for details.");
 
 #if defined(__WIN32__)
-        WintunInitialize();
+        //WintunInitialize();
 #endif
 
         std::unordered_map<std::string, std::string> config = Utils::getConfigMap(optionsObj["config"].as<std::string>());
@@ -77,7 +66,7 @@ int main(int argc, char** argv) {
         log("Using virtual interface: " + tun->getName());
 
         // Generate a temporary keypair, replace with actual CA signed keys later (Note, these are stored in memory)
-        LibSodiumWrapper sodiumWrapper = LibSodiumWrapper();
+        std::shared_ptr<LibSodiumWrapper> sodiumWrapper = std::make_shared<LibSodiumWrapper>();
 
         auto itPubkey = config.find("SERVER_PUBLIC_KEY");
         auto itPrivkey = config.find("SERVER_PRIVATE_KEY");
@@ -91,27 +80,26 @@ int main(int argc, char** argv) {
             std::copy_n(Utils::hexStringToBytes(itPrivkey->second).begin(), sk.size(), sk.begin());
             std::copy_n(Utils::hexStringToBytes(itPubkey->second).begin(), pk.size(), pk.begin());
 
-            sodiumWrapper.setKeys(pk, sk);
+            sodiumWrapper->setKeys(pk, sk);
         } else {
             warn("No keypair found in config file! Using random key.");
         }
 
-        log("Server public key: " + bytesToHexString(sodiumWrapper.getPublicKey(), crypto_sign_PUBLICKEYBYTES));
-        //log("Server private key: " + bytesToHexString(sodiumWrapper.getPrivateKey(), crypto_sign_SECRETKEYBYTES)); // TEMP, remove later
+        log("Server public key: " + bytesToHexString(sodiumWrapper->getPublicKey(), crypto_sign_PUBLICKEYBYTES));
 
-        bool hostRunning = true;
+        std::shared_ptr<bool> hostRunning = std::make_shared<bool>(true);
 
         asio::io_context io;
 
-        auto server = std::make_shared<TCPServer>(io, serverPort(), &sodiumWrapper, &hostRunning, ipv4Only);
-        auto udpServer = std::make_shared<UDPServer>(io, serverPort(), &hostRunning, ipv4Only, tun);
+        auto server = std::make_shared<TCPServer>(io, serverPort(), sodiumWrapper, hostRunning, ipv4Only);
+        auto udpServer = std::make_shared<UDPServer>(io, serverPort(), hostRunning, ipv4Only, tun);
 
         asio::signal_set signals(io, SIGINT, SIGTERM);
         signals.async_wait([&](const std::error_code&, int) {
             log("Received termination signal. Shutting down server gracefully.");
             done = 1;
             asio::post(io, [&]() {
-                hostRunning = false;
+                *hostRunning = false;
                 server->stop();
                 udpServer->stop();
             });
@@ -129,6 +117,8 @@ int main(int argc, char** argv) {
         while (!done) {
             auto packet = tun->readPacket();
             if (packet.empty()) {
+                // Small sleep to avoid busy-waiting and to allow signal processing
+                std::this_thread::sleep_for(std::chrono::milliseconds(10));
                 continue;
             }
 
@@ -145,9 +135,6 @@ int main(int argc, char** argv) {
         }
 
         log("Shutting down server...");
-        /*hostRunning = false;
-        server->stop();
-        udpServer->stop();*/
 
         io.stop();
         if (ioThread.joinable()) {

src/server/net/tcp/tcp_connection.cpp

@@ -6,20 +6,39 @@
 
 namespace ColumnLynx::Net::TCP {
     void TCPConnection::start() {
+        try {
+            // Cache the remote IP early to avoid calling remote_endpoint() on closed sockets later
+            mRemoteIP = mHandler->socket().remote_endpoint().address().to_string();
+        } catch (const std::exception& e) {
+            mRemoteIP = "unknown";
+            Utils::warn("Failed to get remote endpoint: " + std::string(e.what()));
+        }
+
         mHandler->onMessage([this](AnyMessageType type, const std::string& data) {
             mHandleMessage(static_cast<ClientMessageType>(MessageHandler::toUint8(type)), data);
         });
 
         mHandler->onDisconnect([this](const asio::error_code& ec) {
-            Utils::log("Client disconnected: " + mHandler->socket().remote_endpoint().address().to_string() + " - " + ec.message());
-            disconnect();
+            // Peer has closed; finalize locally without sending RST
+            Utils::log("Client disconnected: " + mRemoteIP + " - " + ec.message());
+            asio::error_code ec2;
+            mHandler->socket().close(ec2);
+
+            SessionRegistry::getInstance().erase(mConnectionSessionID);
+            SessionRegistry::getInstance().deallocIP(mConnectionSessionID);
+
+            Utils::log("Closed connection to " + mRemoteIP);
+
+            if (mOnDisconnect) {
+                mOnDisconnect(shared_from_this());
+            }
         });
 
         mHandler->start();
         mStartHeartbeat();
 
         // Placeholder for message handling setup
-        Utils::log("Client connected: " + mHandler->socket().remote_endpoint().address().to_string());
+        Utils::log("Client connected: " + mRemoteIP);
     }
 
     void TCPConnection::sendMessage(ServerMessageType type, const std::string& data) {
@@ -32,23 +51,19 @@ namespace ColumnLynx::Net::TCP {
         mOnDisconnect = std::move(cb);
     }
 
-    void TCPConnection::disconnect() {
-        std::string ip = mHandler->socket().remote_endpoint().address().to_string();
-
-        mHandler->sendMessage(ServerMessageType::GRACEFUL_DISCONNECT, "Server initiated disconnect.");
+    void TCPConnection::disconnect(bool echo) {
+        if (echo) {
+            mHandler->sendMessage(ServerMessageType::GRACEFUL_DISCONNECT, "Server initiated disconnect.");
+        }
         mHeartbeatTimer.cancel();
         asio::error_code ec;
-        mHandler->socket().shutdown(asio::ip::tcp::socket::shutdown_both, ec);
-        mHandler->socket().close(ec);
-
-        SessionRegistry::getInstance().erase(mConnectionSessionID);
-        SessionRegistry::getInstance().deallocIP(mConnectionSessionID);
-
-        Utils::log("Closed connection to " + ip);
-
-        if (mOnDisconnect) {
-            mOnDisconnect(shared_from_this());
+        // Half-close: stop sending, keep reading until peer FIN
+        mHandler->socket().shutdown(asio::ip::tcp::socket::shutdown_send, ec);
+        if (ec) {
+            Utils::error("Error during socket shutdown: " + ec.message());
         }
+        // Do not close immediately; final cleanup happens in onDisconnect
+        Utils::log("Initiated graceful disconnect (half-close) to " + mRemoteIP);
     }
 
     uint64_t TCPConnection::getSessionID() const {
@@ -92,7 +107,7 @@ namespace ColumnLynx::Net::TCP {
     }
 
     void TCPConnection::mHandleMessage(ClientMessageType type, const std::string& data) {
-        std::string reqAddr = mHandler->socket().remote_endpoint().address().to_string();
+        std::string& reqAddr = mRemoteIP;
     
         switch (type) {
             case ClientMessageType::HANDSHAKE_INIT: {
@@ -202,7 +217,18 @@ namespace ColumnLynx::Net::TCP {
                     // Encrypt the Session ID with the established AES key (using symmetric encryption, nonce can be all zeros for this purpose)
                     Nonce symNonce{}; // All zeros
 
-                    uint32_t clientIP = SessionRegistry::getInstance().getFirstAvailableIP();
+                    std::string networkString = mRawServerConfig->find("NETWORK")->second; // The load check guarantees that this value exists
+                    uint8_t configMask = std::stoi(mRawServerConfig->find("SUBNET_MASK")->second); // Same deal here
+
+                    uint32_t baseIP = Net::VirtualInterface::stringToIpv4(networkString);
+
+                    if (baseIP == 0) {
+                        Utils::warn("Your NETWORK value in the server configuration is malformed! I will not be able to accept connections! (Connection " + reqAddr + " was killed)");
+                        disconnect();
+                        return;
+                    }
+
+                    uint32_t clientIP = SessionRegistry::getInstance().getFirstAvailableIP(baseIP, configMask);
 
                     if (clientIP == 0) {
                         Utils::warn("Out of available IPs! Disconnecting client " + reqAddr);
@@ -214,13 +240,11 @@ namespace ColumnLynx::Net::TCP {
                     tunConfig.version = Utils::protocolVersion();
                     tunConfig.prefixLength = 24;
                     tunConfig.mtu = 1420;
-                    tunConfig.serverIP = htonl(0x0A0A0001); // 10.10.0.1
-                    tunConfig.clientIP = htonl(clientIP); // 10.10.0.X
+                    tunConfig.serverIP = htonl(baseIP + 1); // e.g. 10.10.0.1
+                    tunConfig.clientIP = htonl(clientIP); // e.g. 10.10.0.X
                     tunConfig.dns1 = htonl(0x08080808);    // 8.8.8.8
                     tunConfig.dns2 = 0;
 
-                    SessionRegistry::getInstance().lockIP(mConnectionSessionID, clientIP);
-
                     uint64_t sessionIDNet = Utils::chtobe64(mConnectionSessionID);
 
                     std::vector<uint8_t> payload(sizeof(uint64_t) + sizeof(tunConfig));
@@ -238,6 +262,7 @@ namespace ColumnLynx::Net::TCP {
                     Utils::log("Handshake with " + reqAddr + " completed successfully. Session ID assigned (" + std::to_string(mConnectionSessionID) + ").");
                     auto session = std::make_shared<SessionState>(mConnectionAESKey, std::chrono::hours(12), clientIP, htonl(0x0A0A0001), mConnectionSessionID);
                     SessionRegistry::getInstance().put(mConnectionSessionID, std::move(session));
+                    SessionRegistry::getInstance().lockIP(mConnectionSessionID, clientIP);
 
                 } catch (const std::exception& e) {
                     Utils::error("Failed to decrypt HANDSHAKE_EXCHANGE_KEY from " + reqAddr + ": " + e.what());
@@ -262,6 +287,11 @@ namespace ColumnLynx::Net::TCP {
                 disconnect();
                 break;
             }
+            case ClientMessageType::KILL_CONNECTION: {
+                Utils::warn("Received KILL_CONNECTION from " + reqAddr + ": " + data);
+                disconnect();
+                break;
+            }
             default:
                 Utils::warn("Unhandled message type from " + reqAddr);
                 break;

src/server/net/tcp/tcp_server.cpp

@@ -31,10 +31,11 @@ namespace ColumnLynx::Net::TCP {
                         mStartAccept();
                     return;
                 }
-            
+
                 auto client = TCPConnection::create(
                     std::move(socket),
                     mSodiumWrapper,
+                    &mRawServerConfig,
                     [this](std::shared_ptr<TCPConnection> c) {
                         mClients.erase(c);
                         Utils::log("Client removed.");