Observe both peers from their real gameplay UDP sockets and introduce only an authorized, verified pair.
Scope
Run a bounded LiteNetLib NatPunchModule mediator inside the Server module.
Bind host presence and client punch roles to the packet source, never an HTTP- or token-supplied public address.
Add the bounded host refresh/invitation mechanism approved in #2.
Require both verified role endpoints before calling NatIntroduce.
Validate reported LAN candidates; disclose them only under the approved same-NAT/private-address policy.
Handle reordered/duplicate packets, missing peers, retries, cancellation, stale presence, and expiry.
Keep mediator polling and all queues caller-owned/bounded; do not carry gameplay traffic.
Silently drop malformed/unauthorized UDP inputs and enforce response-byte/amplification budgets.
Acceptance criteria
A matched host/client pair receives introduction using observed public and eligible local endpoints.
No packet is sent to an unverified destination or arbitrary private-network target.
Same-session concurrent attempts never cross-wire.
Duplicate/reordered packets are idempotent; expired/missing-peer cases terminate deterministically.
Malformed/truncated/oversized/spoofed/reflection packets cannot crash, amplify, or grow state without bound.
IPv4 and address-family validation are tested; IPv6 behavior matches the #2 decision.
The mediator never handles application gameplay payloads.
Parent: #1
Depends on: #6, #10
## Outcome
Observe both peers from their real gameplay UDP sockets and introduce only an authorized, verified pair.
## Scope
- Run a bounded LiteNetLib `NatPunchModule` mediator inside the Server module.
- Bind host presence and client punch roles to the packet source, never an HTTP- or token-supplied public address.
- Add the bounded host refresh/invitation mechanism approved in #2.
- Require both verified role endpoints before calling `NatIntroduce`.
- Validate reported LAN candidates; disclose them only under the approved same-NAT/private-address policy.
- Handle reordered/duplicate packets, missing peers, retries, cancellation, stale presence, and expiry.
- Keep mediator polling and all queues caller-owned/bounded; do not carry gameplay traffic.
- Silently drop malformed/unauthorized UDP inputs and enforce response-byte/amplification budgets.
## Acceptance criteria
- A matched host/client pair receives introduction using observed public and eligible local endpoints.
- No packet is sent to an unverified destination or arbitrary private-network target.
- Same-session concurrent attempts never cross-wire.
- Duplicate/reordered packets are idempotent; expired/missing-peer cases terminate deterministically.
- Malformed/truncated/oversized/spoofed/reflection packets cannot crash, amplify, or grow state without bound.
- IPv4 and address-family validation are tested; IPv6 behavior matches the #2 decision.
- The mediator never handles application gameplay payloads.
Implemented issue #11 on codex/issue-11-nat-mediator at 6d076c2.
Replaced the placeholder UDP loop with bounded caller-owned LiteNetLib manual polling and exact request-only NAT frame decoding.
Native and frozen v1 inputs share role/capability/endpoint authority; only observed gameplay-socket sources become public endpoints.
Added host-presence refresh plus exact host/client attempt pairing, one-time connection-ticket introductions, duplicate/reorder handling, stale/cancel/expiry checks, and same-NAT private-candidate policy.
IPv4 is required and optional IPv6 binding is explicit; IPv6 attempts use the fixed 192-character native request to preserve the 2.0 response-byte budget.
Gameplay, malformed, oversized, forged response/punch, and unauthorized packets are consumed with zero response and cannot name arbitrary targets.
Amortized UDP expiry maintenance prevents valid duplicate floods from triggering global store scans per packet.
Added ADR/contract/SDK guidance and public API vectors.
The branch audit found and fixed forged LiteNet response reflection, cancel/emission linearizability, IPv6 bind widening, duplicate-flood CPU work, frozen IPv6 amplification, canonical-token drift, and missing race/adversarial coverage.
Verification: formatting clean, Release build clean, Contracts and Client packages produced, 145/145 tests pass, and the worktree is clean. The issue remains open until the stacked branch is landed.
Implemented issue #11 on `codex/issue-11-nat-mediator` at `6d076c2`.
- Replaced the placeholder UDP loop with bounded caller-owned LiteNetLib manual polling and exact request-only NAT frame decoding.
- Native and frozen v1 inputs share role/capability/endpoint authority; only observed gameplay-socket sources become public endpoints.
- Added host-presence refresh plus exact host/client attempt pairing, one-time connection-ticket introductions, duplicate/reorder handling, stale/cancel/expiry checks, and same-NAT private-candidate policy.
- IPv4 is required and optional IPv6 binding is explicit; IPv6 attempts use the fixed 192-character native request to preserve the 2.0 response-byte budget.
- Gameplay, malformed, oversized, forged response/punch, and unauthorized packets are consumed with zero response and cannot name arbitrary targets.
- Amortized UDP expiry maintenance prevents valid duplicate floods from triggering global store scans per packet.
- Added ADR/contract/SDK guidance and public API vectors.
The branch audit found and fixed forged LiteNet response reflection, cancel/emission linearizability, IPv6 bind widening, duplicate-flood CPU work, frozen IPv6 amplification, canonical-token drift, and missing race/adversarial coverage.
Verification: formatting clean, Release build clean, Contracts and Client packages produced, 145/145 tests pass, and the worktree is clean. The issue remains open until the stacked branch is landed.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Parent: #1
Depends on: #6, #10
Outcome
Observe both peers from their real gameplay UDP sockets and introduce only an authorized, verified pair.
Scope
NatPunchModulemediator inside the Server module.NatIntroduce.Acceptance criteria
Starting implementation on stacked branch
codex/issue-11-nat-mediator, based on verified issue #10 commit1baa105. Scope: bounded caller-owned LiteNetLib mediator, source-observed and role-bound presence, exact-pair introductions, candidate/address-family policy, replay/reorder/expiry safety, and adversarial amplification/state-bound tests.Implemented issue #11 on
codex/issue-11-nat-mediatorat6d076c2.The branch audit found and fixed forged LiteNet response reflection, cancel/emission linearizability, IPv6 bind widening, duplicate-flood CPU work, frozen IPv6 amplification, canonical-token drift, and missing race/adversarial coverage.
Verification: formatting clean, Release build clean, Contracts and Client packages produced, 145/145 tests pass, and the worktree is clean. The issue remains open until the stacked branch is landed.