HeiKyu/Rendezvous
2
0
Fork 0
Code Issues 27 Pull Requests Actions Packages Projects Releases Wiki Activity

Implement authenticated host presence and an amplification-safe LiteNetLib NAT mediator #11

New Issue
Open
opened 2026-07-15 10:04:20 +02:00 by Kyuubi · 2 comments
Kyuubi commented 2026-07-15 10:04:20 +02:00
Owner
Copy Link
Copy Source

Parent: #1
Depends on: #6, #10

Outcome

Observe both peers from their real gameplay UDP sockets and introduce only an authorized, verified pair.

Scope

  • Run a bounded LiteNetLib NatPunchModule mediator inside the Server module.
  • Bind host presence and client punch roles to the packet source, never an HTTP- or token-supplied public address.
  • Add the bounded host refresh/invitation mechanism approved in #2.
  • Require both verified role endpoints before calling NatIntroduce.
  • Validate reported LAN candidates; disclose them only under the approved same-NAT/private-address policy.
  • Handle reordered/duplicate packets, missing peers, retries, cancellation, stale presence, and expiry.
  • Keep mediator polling and all queues caller-owned/bounded; do not carry gameplay traffic.
  • Silently drop malformed/unauthorized UDP inputs and enforce response-byte/amplification budgets.

Acceptance criteria

  • A matched host/client pair receives introduction using observed public and eligible local endpoints.
  • No packet is sent to an unverified destination or arbitrary private-network target.
  • Same-session concurrent attempts never cross-wire.
  • Duplicate/reordered packets are idempotent; expired/missing-peer cases terminate deterministically.
  • Malformed/truncated/oversized/spoofed/reflection packets cannot crash, amplify, or grow state without bound.
  • IPv4 and address-family validation are tested; IPv6 behavior matches the #2 decision.
  • The mediator never handles application gameplay payloads.
Parent: #1 Depends on: #6, #10 ## Outcome Observe both peers from their real gameplay UDP sockets and introduce only an authorized, verified pair. ## Scope - Run a bounded LiteNetLib `NatPunchModule` mediator inside the Server module. - Bind host presence and client punch roles to the packet source, never an HTTP- or token-supplied public address. - Add the bounded host refresh/invitation mechanism approved in #2. - Require both verified role endpoints before calling `NatIntroduce`. - Validate reported LAN candidates; disclose them only under the approved same-NAT/private-address policy. - Handle reordered/duplicate packets, missing peers, retries, cancellation, stale presence, and expiry. - Keep mediator polling and all queues caller-owned/bounded; do not carry gameplay traffic. - Silently drop malformed/unauthorized UDP inputs and enforce response-byte/amplification budgets. ## Acceptance criteria - A matched host/client pair receives introduction using observed public and eligible local endpoints. - No packet is sent to an unverified destination or arbitrary private-network target. - Same-session concurrent attempts never cross-wire. - Duplicate/reordered packets are idempotent; expired/missing-peer cases terminate deterministically. - Malformed/truncated/oversized/spoofed/reflection packets cannot crash, amplify, or grow state without bound. - IPv4 and address-family validation are tested; IPv6 behavior matches the #2 decision. - The mediator never handles application gameplay payloads.
Kyuubi self-assigned this 2026-07-16 06:57:14 +02:00
Kyuubi commented 2026-07-16 06:57:14 +02:00
Author
Owner
Copy Link
Copy Source

Starting implementation on stacked branch codex/issue-11-nat-mediator, based on verified issue #10 commit 1baa105. Scope: bounded caller-owned LiteNetLib mediator, source-observed and role-bound presence, exact-pair introductions, candidate/address-family policy, replay/reorder/expiry safety, and adversarial amplification/state-bound tests.

Starting implementation on stacked branch `codex/issue-11-nat-mediator`, based on verified issue #10 commit `1baa105`. Scope: bounded caller-owned LiteNetLib mediator, source-observed and role-bound presence, exact-pair introductions, candidate/address-family policy, replay/reorder/expiry safety, and adversarial amplification/state-bound tests.
Kyuubi commented 2026-07-16 07:37:32 +02:00
Author
Owner
Copy Link
Copy Source

Implemented issue #11 on codex/issue-11-nat-mediator at 6d076c2.

  • Replaced the placeholder UDP loop with bounded caller-owned LiteNetLib manual polling and exact request-only NAT frame decoding.
  • Native and frozen v1 inputs share role/capability/endpoint authority; only observed gameplay-socket sources become public endpoints.
  • Added host-presence refresh plus exact host/client attempt pairing, one-time connection-ticket introductions, duplicate/reorder handling, stale/cancel/expiry checks, and same-NAT private-candidate policy.
  • IPv4 is required and optional IPv6 binding is explicit; IPv6 attempts use the fixed 192-character native request to preserve the 2.0 response-byte budget.
  • Gameplay, malformed, oversized, forged response/punch, and unauthorized packets are consumed with zero response and cannot name arbitrary targets.
  • Amortized UDP expiry maintenance prevents valid duplicate floods from triggering global store scans per packet.
  • Added ADR/contract/SDK guidance and public API vectors.

The branch audit found and fixed forged LiteNet response reflection, cancel/emission linearizability, IPv6 bind widening, duplicate-flood CPU work, frozen IPv6 amplification, canonical-token drift, and missing race/adversarial coverage.

Verification: formatting clean, Release build clean, Contracts and Client packages produced, 145/145 tests pass, and the worktree is clean. The issue remains open until the stacked branch is landed.

Implemented issue #11 on `codex/issue-11-nat-mediator` at `6d076c2`. - Replaced the placeholder UDP loop with bounded caller-owned LiteNetLib manual polling and exact request-only NAT frame decoding. - Native and frozen v1 inputs share role/capability/endpoint authority; only observed gameplay-socket sources become public endpoints. - Added host-presence refresh plus exact host/client attempt pairing, one-time connection-ticket introductions, duplicate/reorder handling, stale/cancel/expiry checks, and same-NAT private-candidate policy. - IPv4 is required and optional IPv6 binding is explicit; IPv6 attempts use the fixed 192-character native request to preserve the 2.0 response-byte budget. - Gameplay, malformed, oversized, forged response/punch, and unauthorized packets are consumed with zero response and cannot name arbitrary targets. - Amortized UDP expiry maintenance prevents valid duplicate floods from triggering global store scans per packet. - Added ADR/contract/SDK guidance and public API vectors. The branch audit found and fixed forged LiteNet response reflection, cancel/emission linearizability, IPv6 bind widening, duplicate-flood CPU work, frozen IPv6 amplification, canonical-token drift, and missing race/adversarial coverage. Verification: formatting clean, Release build clean, Contracts and Client packages produced, 145/145 tests pass, and the worktree is clean. The issue remains open until the stacked branch is landed.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Kyuubi schmidt.florian (Florian Schmidt)
No Assignees Kyuubi
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: HeiKyu/Rendezvous#11
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?