Skip to content

NexNet v0.14.1 Released

Choose a tag to compare

View all tags
@github-actions github-actions released this 30 Dec 20:35
· 18 commits to master since this release
v0.14.1
8143ce2

Highlights

This release adds additional security fixes as defined by the #63 PR

This release introduces connection rate limiting for DoS protection, remote endpoint access, critical bug fixes, and internal code cleanup.

Connection Rate Limiting (#60)

New opt-in protection against DoS attacks through rapid connection establishment:

  • Global Limits: Cap total concurrent connections and new connections per second
  • Per-IP Limits: Restrict connections per IP with sliding window rate limiting
  • Automatic Banning: Temporarily ban IPs that repeatedly violate rate limits
  • IP Whitelisting: Allow trusted infrastructure to bypass rate limits
var serverConfig = new TcpServerConfig
{
    EndPoint = new IPEndPoint(IPAddress.Any, 5000),
    RateLimiting = new ConnectionRateLimitConfig
    {
        MaxConcurrentConnections = 1000,
        GlobalConnectionsPerSecond = 100,
        MaxConnectionsPerIp = 10,
        BanDurationSeconds = 300,
        BanThreshold = 5
    }
};

Works across all transports: TCP, TLS, UDS, QUIC, WebSocket, and HttpSocket.

Remote Endpoint Support (#57)

Access client IP addresses and ports through SessionContext:

protected override ValueTask OnConnected()
{
    Console.WriteLine($"Client connected from {Context.RemoteAddress}:{Context.RemotePort}");
    return ValueTask.CompletedTask;
}
  • Supports all transport types
  • Proxy header parsing for reverse proxy deployments (X-Forwarded-For, CF-Connecting-IP, etc.)
  • Secure by default: TrustProxyHeaders must be explicitly enabled

Bug Fixes

Fixed Use-After-Free Race Condition (#59)

Resolved a critical race condition in the operation object pooling mechanism that caused data corruption during concurrent collection modifications. Operations were being returned to the pool while still referenced by version history, leading to corrupted transformation results in relay scenarios.

Internal Improvements

Code Cleanup (#62)

  • Removed unused arena memory management subsystem
  • Removed legacy pipeline infrastructure (ArrayPoolStream, DedicatedThreadPoolPipeScheduler, MemoryMappedPipeReader, SocketServer, StreamConnection)
  • Integrated and simplified code from Pipelines.Sockets.Unofficial
  • Added comprehensive test coverage for remaining socket functionality

Breaking Changes

None. All changes are backward compatible.

Upgrade Notes

  • Rate limiting is disabled by default; opt-in by configuring RateLimiting
  • Remote endpoint properties (RemoteAddress, RemotePort) are nullable
  • When using proxy headers, explicitly enable TrustProxyHeaders only behind trusted reverse proxies
Assets 9
Loading