RedotP2PNetwork is a security-first Redot adaptation of
DawnGroveStudios/GodotP2PNetwork.
It provides a transport-neutral multiplayer service, compatibility facades for
the original P2PNetwork and P2PLobby names, bounded lobby chat, replicated
state, explicit entity replication, capability checks, and optional IP or
identity bans.
This repository is an alpha implementation for Redot 26.2. It is suitable for development and local integration testing, not a claim that every planned transport or production deployment profile is certified.
| Surface | Status | Evidence and limits |
|---|---|---|
| Secure protocol core | Implemented | Strict binary envelope, registered message allowlist, sender direction, channel/delivery checks, replay rejection, per-peer rate limits, bounded work, and violation disconnects are unit tested. |
| ENet | Implemented | Native two-process core and facade fixtures pass on Windows with Redot 26.2. |
| WebSocket | Implemented | Native two-process core and facade fixtures pass on loopback. Plain ws:// is loopback-only and opt-in; production requires TLS/WSS and deployment qualification. |
| Steam | Provider-gated alpha | Adapter and dynamic dominicbytes/redot-steam provider compile without making RedotSteam mandatory. A live private-App-ID authentication fixture is not yet certified. |
| WebRTC | Provider-gated alpha | Authority-star adapter and replaceable signaling, ICE, and peer-factory contracts are present. The installed Redot build has no usable default WebRTC backend, so a real provider fixture is still required. |
| Lobby discovery directory | Not implemented | Direct/current-lobby behavior works. Public discovery and the optional self-hostable directory remain later milestones. |
| Persistent moderation | Not implemented | In-memory exact address, identity, and guarded CIDR bans are implemented. Persistence and report storage require future provider contracts. |
See transport status, the upstream compatibility matrix, and the threat model before adopting the alpha.
- Copy
addons/redot_p2p_networkinto the target Redot project'saddons/directory. - Enable RedotP2PNetwork in Project Settings > Plugins.
- Confirm the plugin registered the
P2PNetworkandP2PLobbyautoloads. It will not overwrite autoloads that already use those names.
The development project in this repository opens a keyboard-operable quickstart scene with ENet and explicit loopback WebSocket controls.
# Listen host.
var error: Error = P2PNetwork.host_enet(7777, 16, "*")
# Client.
var error: Error = P2PNetwork.join_enet("127.0.0.1", 7777)Remote peers cannot select a NodePath, method, signal, property, or scene. A game registers every accepted message and its limits locally:
func _ready() -> void:
P2PNetwork.register_message(
"game.chat",
_on_chat,
512, # payload bytes
true, # accepted from clients by the authority
false, # not accepted from the authority by clients
1,
RedotP2PTransportAdapter.Delivery.RELIABLE,
2.0, # messages per second per peer
4, # burst
"chat.send"
)
func _on_chat(peer_id: int, payload: PackedByteArray) -> void:
# Decode and validate the game's own bounded payload here.
passThe authority assigns roles or scoped capabilities through
P2PNetwork.access_control. Client input still needs game-specific semantic
validation; this addon supplies the trust boundary, not game rules.
- Incoming message types are deny-by-default.
- Raw Variant/object deserialization is not used on network frames.
- Client messages cannot invoke arbitrary methods, signals, properties, or scene creation.
- The listen host or dedicated server is authoritative.
- Frames, payloads, channels, packets per tick, bytes per tick, chat, lobby state, entity state, and intent rates are bounded.
- Replayed or reordered sequence numbers are rejected per peer/channel.
- Plain WebSocket is rejected except for explicitly enabled loopback development.
- Moderation enforcement and CIDR banning are optional and off by default.
- Address bans use only the authority-observed transport address. Relay-hidden transports return no address rather than trusting a client claim.
- Exact address bans are the normal mode. CIDR requires explicit enablement;
ranges broader than IPv4
/24or IPv6/64require high-risk confirmation, and/16or/48are absolute limits.
JSON-backed compatibility state accepts only bounded JSON-safe values. Store network IDs and revision-like integers as canonical decimal strings when exact integer fidelity matters, because JSON numbers are decoded as floating-point values by the engine.
The familiar classes and facade names remain where they can be made safe.
Legacy arbitrary rpc_method, remote signal emission, arbitrary node removal,
and free-form node synchronization are rejected while online with the stable
status UNSAFE_LEGACY_API_REJECTED. Use registered messages, P2PNode, or the
replication services instead. Wire compatibility with the upstream addon is not
provided.
Set REDOT_BIN to the Redot 26.2 console executable, then run:
./tools/run_tests.ps1 -RedotBin $env:REDOT_BINBuild a reviewable addon archive without publishing it:
./tools/package_addon.ps1Generated test artifacts and packages are ignored by Git. See CONTRIBUTING.md and SECURITY.md.
- Upstream:
DawnGroveStudios/GodotP2PNetwork - Upstream baseline:
54256e434c4735f38bbfbaae7d01fb6a47bc0c8b - Intended downstream:
dominicbytes/RedotP2PNetwork - License: MIT; see LICENSE and NOTICE.md
The repository retains upstream Git ancestry. The addon path and protocol were changed intentionally for Redot and for safer defaults.
I vibe coded this in GPT Sol 5.6. Use at your own risk. Actual programmers are welcome to submit PR's and feedback.
Greetings! I am Dominic Bytes, the synth walker. I hail from the distant future. Where brains occupy robot bodies, time travel is a trip to the corner store, and the neon glow of our attire is powered by the light of our souls. Join me on a 1.21 gigawatt powered journey of chill vibes with gaming, anime, movies, and more!