Skip to content

feat: share peer UDP sockets with relay STUN and ICE - #472

Closed
0xcadams wants to merge 1 commit into
0xcadams/peer-packet-switchingfrom
0xcadams/peer-socket-ice
Closed

0xcadams wants to merge 1 commit into
0xcadams/peer-packet-switchingfrom
0xcadams/peer-socket-ice

Conversation

@0xcadams

Copy link
Copy Markdown
Member

What

Add shared-socket connectivity discovery around the packet switching owner from #471. Relay and standalone answer STUN on their existing QUIC UDP socket, and peer processes use one explicitly owned socket for relay QUIC, mapping discovery, ICE checks, and direct packets. This foundation feeds the native rewrite whose final integration gate remains #470.

Why

A NAT mapping discovered on one socket cannot establish direct delivery from another. ICE preparation and network changes also must not hold up warm relay traffic or replace the end-to-end QUIC session.

Changes

  • Integrate maintained Pion ICE/STUN through quic-go non-QUIC packet handling, with IPv4, IPv6, host candidates, bounded STUN gathering, and disabled library logging. Child views never change shared QUIC write deadlines.
  • Serve bounded STUN Binding discovery in split relay and standalone, retaining UDP 443 and TCP 443 wiring. Keep fixed operational outcome counters without address labels.
  • Add replaceable carrier slots: late connectivity results and new NAT mappings preserve the logical endpoint, fence old queued packets/readers, and require fresh direct-path validation.
  • Prove shared UDP port identity across QUIC, mapped candidates, and actual ICE delivery on IPv4 and IPv6. Closing ICE peers leaves QUIC traffic working; switching tests now also replace the direct UDP pair while keeping application state.
  • Passed task go:test:peer-transport -- -race, task go:test, task go:lint, task go:vulncheck, generation and formatting checks. Protocol/API/ALPN versions and release/package versions remain unchanged.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 26, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-26T18:27:40.690263Z 02bdf96 PR opened
🔒 Security Review ✅ Completed 2026-10-26T18:28:35.548602Z 02bdf96 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 02bdf964e6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

}
logger := &logging.DefaultLoggerFactory{Writer: io.Discard, DefaultLogLevel: logging.LogLevelDisabled}
options := []ice.AgentOption{
ice.WithUDPMux(s.mux), ice.WithUDPMuxSrflx(s.mux),

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Demultiplex ICE agents that share a remote socket

When two ICE agents on this socket connect to agents on the same remote process-owned socket, their remote IP:port is identical. Pion's mux maps each remote address to only one connection, and connWorker consults the STUN username only when that address has no existing destination (Pion v4.4.8 implementation). Consequently, the second agent's checks can reach the first agent, or registering the second agent can redirect the first agent's packets, preventing both direct paths from working concurrently. The new test uses only one agent per socket and misses this case. Share one ICE association per remote socket and demultiplex logical peers above it, or provide session-aware packet dispatch instead of passing every agent the same address-keyed mux.

Useful? React with 👍 / 👎.

@0xcadams
0xcadams added this pull request to stack #473 October 26, 2026 18:33
@0xcadams
0xcadams removed this pull request from stack #473 October 26, 2026 21:43
@0xcadams
0xcadams added this pull request to stack #475 October 26, 2026 21:44
@0xcadams
0xcadams removed this pull request from stack #475 October 26, 2026 22:52
@0xcadams
0xcadams added this pull request to stack #477 October 26, 2026 22:53
@0xcadams
0xcadams removed this pull request from stack #477 October 27, 2026 03:04
@0xcadams
0xcadams added this pull request to stack #480 October 27, 2026 03:05
@0xcadams

Copy link
Copy Markdown
Member Author

superseded by the replacement cutover tracked in #499 (replacement stack #491). closing this original PR at the author's request so only the replacement review remains active. the original branch, commits, reviews and failure evidence are preserved; no branch is deleted. outstanding integration and validation remain tracked in the replacement, not waived by this closure.

@0xcadams 0xcadams closed this Oct 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant