feat(network): Self-healing NAT state

[githubawn]

What this code did:

The ButtonFirewallRefresh button in OptionsMenu.cpp and FirewallNeedToRefresh in FirewallHelper.cpp / OptionPreferences.cpp:

1. Saved/read FirewallNeedToRefresh and LastFirewallIP boolean flags to/from Options.ini.
2. Required players to manually click a "Refresh NAT" button in the Options GUI when changing network interfaces or encountering P2P negotiation failures.
3. Contaminated GlobalData (TheWritableGlobalData->m_firewallBehavior) with disk-persisted firewall state across process restarts.

How the new system works:

1. Fully Asynchronous STUN Probing: The UDP NAT probe is now non-blocking. Players can enter the multiplayer lobby immediately while the probe resolves in the background.
2. Dynamic State Broadcasting: Introduced republishNATBehaviorIfChanged() to dynamically monitor the background thread. The instant the probe successfully classifies the network, it broadcasts the true NAT behavior over the network via UTM/SL/ packets, updating peer clients seamlessly.
3. Robust QuickMatch Guards: QuickMatch now explicitly validates that the UDP probe is both complete and successfully classified.
   • If the user clicks "Start" before the probe finishes, they receive a localized "Detecting Network Settings" message and are safely blocked from proceeding with an UNKNOWN state.
   • If the probe fundamentally fails (e.g., Strict NAT or DNS failure), it automatically triggers a fresh detectFirewallBehavior() retry in the background to ensure the session isn't permanently bricked.

Background & Reason for Removal:

• Obsolete Manual Workaround: Manual NAT refresh buttons are a legacy 2003 workaround; modern network stacks handle NAT re-detection automatically in-engine.
• Elimination of Disk I/O: Completely removes FirewallNeedToRefresh and LastFirewallIP from Options.ini, preventing stale or corrupted flags from persisting across game crashes or process restarts.
• Architectural Decoupling: Fully encapsulates STUN probing state inside FirewallHelperClass in memory, removing direct mutations to TheWritableGlobalData->m_firewallBehavior.

[greptile-apps]

Greptile Summary

Updates NAT detection to use an asynchronous, session-scoped firewall helper.

• Removes persisted firewall behavior and manual refresh handling.
• Retains detected NAT state for the GameSpy session and retries failed probes.
• Republishes completed NAT classifications through staging-room slot updates.
• Blocks Quick Match submission until classification succeeds.

Confidence Score: 5/5

The PR appears safe to merge with no remaining blocking failures related to the previous review threads.

No blocking failure remains after the revised helper lifecycle, retry behavior, and staging-room NAT republication changes.

Important Files Changed

Filename	Overview
Core/GameEngine/Source/GameNetwork/FirewallHelper.cpp	Moves firewall classification into resettable in-memory state with asynchronous detection and retry throttling.
Core/GameEngine/Source/GameNetwork/GameSpy/PeerDefs.cpp	Establishes GameSpy-session ownership for the firewall helper.
Core/GameEngine/Source/GameNetwork/NAT.cpp	Reuses live firewall state during traversal and restarts detection after negotiation failure.
Generals/Code/GameEngine/Source/GameClient/GUI/GUICallbacks/Menus/WOLGameSetupMenu.cpp	Republishes completed NAT classifications through host-mediated staging-room slot broadcasts.
GeneralsMD/Code/GameEngine/Source/GameClient/GUI/GUICallbacks/Menus/WOLGameSetupMenu.cpp	Mirrors the staging-room NAT republication flow for Zero Hour.
Generals/Code/GameEngine/Source/GameClient/GUI/GUICallbacks/Menus/WOLQuickMatchMenu.cpp	Prevents Quick Match submission until NAT detection completes successfully.
GeneralsMD/Code/GameEngine/Source/GameClient/GUI/GUICallbacks/Menus/WOLQuickMatchMenu.cpp	Mirrors the successful-classification guard for Zero Hour Quick Match.

Sequence Diagram

sequenceDiagram
    participant Menu as Multiplayer Menu
    participant Helper as FirewallHelper
    participant Mangler as STUN/Mangler Service
    participant Host as Staging Host
    participant Peers as Room Peers
    Menu->>Helper: behaviorDetectionUpdate()
    Helper->>Mangler: asynchronous NAT probes
    Mangler-->>Helper: mapped-port responses
    Helper->>Helper: classify NAT behavior
    alt Local player is host
        Menu->>Host: update local slot
        Host->>Peers: broadcast SL/ slot list
    else Local player is client
        Menu->>Host: "send REQ/ NAT=value"
        Host->>Peers: broadcast corrected SL/ slot list
    end

Loading

_{Reviews (29): Last reviewed commit: "another grepfile round" | Re-trigger Greptile}

[xezon]

How can this change be tested? Did you test it? Does it work?

[xezon]

Why does the WOL Login need a firewall helper update? Isn't the firewall helper needed for peer to peer connections?

[githubawn]

This is to move the firewall NAT detection as early as possible to heighten the chance it is known once you join a match.

[githubawn]

How can this change be tested? Did you test it? Does it work?

Tested this with a Gamespy emulator and it does follow the intended changes.
GO might want to validate this one manually. I have no clue in how many ways this can break.