@decentnetwork/peer 0.1.113 → 0.1.115

package/dist/peer.js

@@ -340,6 +340,14 @@ export class Peer {
      *  When a DHT packet later arrives from one of these sources, its sender pk
      *  is that friend's CURRENT DHT key — see #refreshFriendDhtKeyFromDht. */
     #lanProbeTargets = new Map();
+    /** Exclusive turn-taking for OWN-HOST probe targets. Own-host targets
+     *  (our IPs + loopback at native ports) are shared by every stranded
+     *  friend, so concurrent probes overwrite each other's #lanProbeTargets
+     *  mapping and the reply gets credited to whoever probed last (observed
+     *  live: the simulator's key landed on an unrelated friend). One friend
+     *  holds the slot at a time; per-friend candidate probes are unaffected. */
+    #ownHostProbeFriendId;
+    #ownHostProbeUntilMs = 0;
     #dhtMaintenanceTimer;
     // Per-friend last DHT-PK send time, keyed by friendId, used even when no
     // session entry exists yet so the connection loop does not flood DHT-PK
@@ -1800,6 +1808,20 @@ export class Peer {
             if (!fromTcp) {
                 this.#cacheFriendRemote(senderId, remote.address, remote.port, request.senderRealPublicKey, request.senderDhtPublicKey);
             }
+            else if (request.senderDhtPublicKey && request.senderDhtPublicKey.length === 32) {
+                // TCP arrival: skip the endpoint, but STILL learn the sender's DHT
+                // key. Natives rotate it every app restart and the relay routes
+                // CRYPTO_DATA by it — a relay-only native (its UDP unreachable to
+                // us) otherwise kept its stale key here, every routed send went to
+                // a key the relay didn't know, and the peer — never receiving our
+                // data — re-keyed every 8s forever (the iPhone churn loop).
+                const session = this.#friendSessions.get(senderId);
+                if (session && !(session.friendDhtPublicKey && Buffer.from(session.friendDhtPublicKey).equals(Buffer.from(request.senderDhtPublicKey)))) {
+                    this.#debugLog(`dht_key_from_tcp_cookie friend=${senderId} new=${carrierIdFromPublicKey(request.senderDhtPublicKey)}`);
+                    session.friendDhtPublicKey = request.senderDhtPublicKey;
+                }
+                this.#learnFriendDhtKey(senderId, request.senderDhtPublicKey);
+            }
             const response = createCookieResponse({
                 request,
                 receiverDhtSecretKey: this.#keyPair.secretKey,
@@ -2063,8 +2085,18 @@ export class Peer {
             else {
                 if (!state.friendRealPublicKey)
                     state.friendRealPublicKey = hs.senderRealPublicKey;
-                if (!state.friendDhtPublicKey)
+                // ALWAYS take the handshake's DHT key, not only when empty: the
+                // handshake authenticates the sender's real key, and natives rotate
+                // their DHT key every restart. Keeping a stale key here sent every
+                // relay-routed CRYPTO_DATA packet to a key the relay didn't know —
+                // silent drop, peer re-keys every 8s (iPhone churn loop).
+                if (hs.senderDhtPublicKey && hs.senderDhtPublicKey.length === 32 &&
+                    !(state.friendDhtPublicKey && Buffer.from(state.friendDhtPublicKey).equals(Buffer.from(hs.senderDhtPublicKey)))) {
+                    if (state.friendDhtPublicKey) {
+                        this.#debugLog(`dht_key_from_hs friend=${friendId} new=${carrierIdFromPublicKey(hs.senderDhtPublicKey)}`);
+                    }
                     state.friendDhtPublicKey = hs.senderDhtPublicKey;
+                }
             }
             if (hs.senderDhtPublicKey && hs.senderDhtPublicKey.length === 32) {
                 this.#learnFriendDhtKey(friendId, hs.senderDhtPublicKey);
@@ -5188,6 +5220,7 @@ export class Peer {
                 };
                 const tried = new Set();
                 // (b) known candidates — refresh a rotated DHT key at a live endpoint.
+                // Per-friend targets: no mapping ambiguity, always allowed.
                 for (const candidate of connectCandidates) {
                     const key = `${candidate.host}:${candidate.port}`;
                     if (tried.has(key))
@@ -5196,17 +5229,25 @@ export class Peer {
                     await probe(candidate.host, candidate.port, false); // cookie already sent above
                 }
                 // (a)+(b) own-host targets — find a same-host peer after an IP change.
-                for (const host of [...getLocalIpv4Addresses(), "127.0.0.1"]) {
-                    if (isOwnVirtualAddress(host))
-                        continue; // never probe into the overlay
-                    for (const port of LAN_SWEEP_PORTS) {
-                        if (port === ourLocalPort)
-                            continue; // our own socket
-                        const key = `${host}:${port}`;
-                        if (tried.has(key))
-                            continue;
-                        tried.add(key);
-                        await probe(host, port, true);
+                // SHARED targets: only the current slot holder probes them, so the
+                // reply maps to exactly one friend. Slot rotates by expiry; the
+                // cookie backoff staggers contenders so every stranded friend
+                // eventually gets a turn.
+                if (this.#ownHostProbeFriendId === friendId || probeNow >= this.#ownHostProbeUntilMs) {
+                    this.#ownHostProbeFriendId = friendId;
+                    this.#ownHostProbeUntilMs = probeNow + 10_000;
+                    for (const host of [...getLocalIpv4Addresses(), "127.0.0.1"]) {
+                        if (isOwnVirtualAddress(host))
+                            continue; // never probe into the overlay
+                        for (const port of LAN_SWEEP_PORTS) {
+                            if (port === ourLocalPort)
+                                continue; // our own socket
+                            const key = `${host}:${port}`;
+                            if (tried.has(key))
+                                continue;
+                            tried.add(key);
+                            await probe(host, port, true);
+                        }
                     }
                 }
             }
@@ -5237,9 +5278,18 @@ export class Peer {
         }
         catch (error) {
             this.#debugLog(`cookie request send failed for ${friendId}: ${error.message}`);
+            // A failed send is still a failed ATTEMPT: count it so (a) backoff
+            // grows instead of hammering a dead address at base cadence forever,
+            // and (b) the rescue probes (gated on retryCount >= 1) still fire for
+            // a friend whose sole candidate errors at the syscall level — before
+            // this, such a friend never probed and could never be rescued.
+            this.#cookieRetryCount.set(friendId, (this.#cookieRetryCount.get(friendId) ?? 0) + 1);
             session.pendingEcho = undefined;
             session.pendingCookiePeerDhtPublicKey = undefined;
-            session.cookieRequestSentMs = undefined;
+            // Keep cookieRequestSentMs (set at attempt start): it is the loop's
+            // `lastAttempt`. Clearing it made lastAttempt 0, so the cooldown gate
+            // always passed and a friend whose sends error retried every 250ms
+            // tick forever — the "cookie request send failed" log flood.
             return false;
         }
     }
@@ -5486,11 +5536,36 @@ export class Peer {
         }
         if (!friendId)
             return;
-        // The sender identifies as an existing DIFFERENT friend (JS peers use
-        // their stable real key as DHT key) — don't cross-wire.
+        // If ANY established session already uses this DHT key, the key's owner
+        // is known and it is not `friendId` — a shared own-host target (the
+        // simulator) answers EVERY prober's probe, and without this check each
+        // stranded friend in turn "adopted" the sim's key during its slot,
+        // endlessly poisoning its own routing.
+        for (const [fid, s] of this.#friendSessions) {
+            if (fid === friendId || !s.established || !s.friendDhtPublicKey)
+                continue;
+            if (Buffer.from(s.friendDhtPublicKey).equals(Buffer.from(senderDhtPk)))
+                return;
+        }
+        // The sender pk currently maps to a DIFFERENT friend. If that friend's
+        // session is ESTABLISHED, the key genuinely belongs to them — don't
+        // cross-wire. If it is NOT established, the mapping itself may be a
+        // mis-credited earlier probe reply (shared own-host targets), and
+        // refusing here would permanently lock the true owner out — steal it
+        // and scrub the other friend's stale copy so routing stops confusing
+        // the two. A wrong steal self-corrects: the real-key handshake cannot
+        // complete against the wrong node.
         const byDht = this.#friendByDhtPk(senderId);
-        if (byDht && byDht.friendId !== friendId)
-            return;
+        if (byDht && byDht.friendId !== friendId) {
+            const otherSession = this.#friendSessions.get(byDht.friendId);
+            if (otherSession?.established)
+                return;
+            this.#debugLog(`dht_key_steal ${senderId} from=${byDht.friendId} to=${friendId} (other unestablished)`);
+            if (otherSession?.friendDhtPublicKey && Buffer.from(otherSession.friendDhtPublicKey).equals(Buffer.from(senderDhtPk))) {
+                otherSession.friendDhtPublicKey = undefined;
+            }
+            this.#friendDhtKeys.delete(byDht.friendId);
+        }
         if (senderId === friendId)
             return; // already keyed by real pk — nothing to refresh
         const session = this.#friendSessions.get(friendId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.113",
+  "version": "0.1.115",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",