@decentnetwork/peer 0.1.123 → 0.1.126

package/dist/peer.js

@@ -109,6 +109,15 @@ const FRIEND_PING_INTERVAL_MS = readEnvInt("DECENT_FRIEND_PING_INTERVAL_MS", 400
 // middle of toxcore's reactive range — fast enough to keep responsiveness,
 // slow enough not to burn CPU on idle peers. Tunable via env.
 const FRIEND_CONNECTION_LOOP_MS = readEnvInt("DECENT_FRIEND_CONNECTION_LOOP_MS", 250);
+/** Minimum gap between onion DHT-PK announces to the SAME friend.
+ *
+ *  One announce fans out to several nodes and costs three X25519 scalar mults
+ *  per node (one per onion layer), so this budget is the difference between an
+ *  idle node and a busy core. Two call sites in #doFriendConnections need it —
+ *  they previously each spelled the interval out, drifted apart (25s vs the
+ *  enclosing 3s re-punch cadence), and the cheap one silently set the pace for
+ *  the expensive one. Shared here so they cannot diverge again. */
+const DHT_PK_ANNOUNCE_COOLDOWN_MS = readEnvInt("DECENT_DHT_PK_ANNOUNCE_COOLDOWN_MS", 25_000);
 const FRIEND_TIMEOUT_MS = readEnvInt("DECENT_FRIEND_TIMEOUT_MS", 32000);
 // A session whose keys we've PROVEN (decrypted ≥1 real packet from the peer) is
 // NOT torn down at FRIEND_TIMEOUT_MS. A transient all-transport blackout — e.g.
@@ -379,6 +388,14 @@ export class Peer {
     // session entry exists yet so the connection loop does not flood DHT-PK
     // requests when route discovery keeps failing.
     #dhtPkSendCooldown = new Map();
+    /** Last ONION-routed endpoint lookup per friend. Separate from
+     *  #dhtPkSendCooldown: they are two different expensive operations for the
+     *  same friend, and sharing one timestamp would let whichever ran first
+     *  suppress the other for a full budget. */
+    #onionLookupCooldown = new Map();
+    /** Consecutive failed endpoint lookups per (friend,target) — drives how wide
+     *  the next fan-out goes. Cleared on success. */
+    #onionLookupMisses = new Map();
     // Per-friend cooldown for re-asserting the TCP-relay route toward an
     // unconnected friend (the "accepted friend that never connects" wedge —
     // requestRoute only fired once at startup and was never retried).
@@ -1884,7 +1901,7 @@ export class Peer {
                     this.#debugLog(`cookie response: no tcp relay accepted oob send for ${senderId}`);
                 }
             }
-            else if (this.#isUnroutableSelfSource(remote.address, remote.port)) {
+            else if (this.#isUnroutableSelfSource(remote.address, remote.port, true)) {
                 // The request arrived sourced from our own TUN address (or our own
                 // socket) — an overlay routing artifact. Replying there loops into
                 // ourselves and dies. Answer over the relay OOB path instead, which
@@ -1979,7 +1996,7 @@ export class Peer {
             // poison the UDP send-back path.
             const fromTcp = this.#remoteIsTcp(remote);
             if (!fromTcp) {
-                this.#adoptRemote(matchedSession, remote.address, remote.port);
+                this.#adoptRemote(matchedSession, remote.address, remote.port, true);
             }
             else {
                 matchedSession.hasTcpRoute = true;
@@ -2053,7 +2070,7 @@ export class Peer {
                     state.hasTcpRoute = true;
                 }
                 else {
-                    this.#adoptRemote(state, remote.address, remote.port);
+                    this.#adoptRemote(state, remote.address, remote.port, true);
                 }
                 // CONVERGENCE RESYNC: the peer is retransmitting the SAME session pubkey
                 // we already hold, so OUR view of the session looks fine. But if we've
@@ -2250,7 +2267,7 @@ export class Peer {
                 // Don't set state.remote — there's no UDP endpoint for this peer.
             }
             else {
-                this.#adoptRemote(state, remote.address, remote.port);
+                this.#adoptRemote(state, remote.address, remote.port, true);
             }
             if (isNewSession) {
                 state.sendPacketNumber = 0;
@@ -2439,7 +2456,7 @@ export class Peer {
                     }
                     state.lastRelayRecvMs = Date.now();
                 }
-                else if (this.#isUnroutableSelfSource(remote.address, remote.port)) {
+                else if (this.#isUnroutableSelfSource(remote.address, remote.port, true)) {
                     // Sourced from our own TUN address / own socket (overlay routing
                     // artifact): the payload is real — deliver it — but this is NOT a
                     // usable bidirectional UDP path. Don't adopt it (replies loop into
@@ -2452,7 +2469,7 @@ export class Peer {
                     // Tailscale-exit hairpin source. Cheap string compare, NO interface
                     // syscall (that was the CCTV CPU regression) — safe at CCTV packet
                     // rates.
-                    this.#adoptRemote(state, remote.address, remote.port);
+                    this.#adoptRemote(state, remote.address, remote.port, true);
                     // A successfully decrypted packet arriving from a private address is
                     // stronger proof than an endpoint hint: it demonstrates that this
                     // exact host:port already reaches us. Do not require the address to be
@@ -2467,7 +2484,7 @@ export class Peer {
                     if (!state.lanRemoteHost &&
                         isPrivateAddress(remote.address) &&
                         !isCgnatAddress(remote.address) &&
-                        !this.#isUnroutableSelfSource(remote.address, remote.port)) {
+                        !this.#isUnroutableSelfSource(remote.address, remote.port, true)) {
                         state.lanRemoteHost = remote.address;
                         this.#rememberEndpointCandidate(state, remote.address, remote.port);
                         this.#debugLog(`lan_lock_confirmed friend=${friendId} host=${remote.address}:${remote.port} (decrypted UDP source)`);
@@ -3060,12 +3077,53 @@ export class Peer {
             return false;
         }
         const targetId = carrierIdFromPublicKey(searchPublicKey);
+        // Per-(friend, target) budget, enforced HERE rather than at the call sites.
+        //
+        // One run of this fans out to up to 24 nodes and each onion request costs
+        // three X25519 scalar mults (one per layer) — up to ~72 per call, tens of
+        // ms of pure CPU. There are four call sites and gating them one at a time
+        // just moves the cost to whichever one was missed: after gating only the
+        // re-punch path, this function was STILL the top crypto entry on
+        // smtp.gfax.cn. A choke point inside the function is the only version that
+        // cannot be bypassed by a call site added later.
+        //
+        // Keyed by target, not just friend, so the dhtPk lookup and the
+        // onion-routed fallback for the same friend keep independent budgets —
+        // throttling repeats of the SAME search, never the first try of a
+        // different one.
+        const budgetKey = `${friendId}:${targetId}`;
+        const lastLookup = this.#onionLookupCooldown.get(budgetKey) ?? 0;
+        const sinceLast = Date.now() - lastLookup;
+        if (sinceLast < DHT_PK_ANNOUNCE_COOLDOWN_MS) {
+            this.#debugLog(`endpoint lookup for ${friendId} skipped: ${Math.round(sinceLast / 1000)}s since last ` +
+                `(budget ${DHT_PK_ANNOUNCE_COOLDOWN_MS / 1000}s)`);
+            return false;
+        }
+        this.#onionLookupCooldown.set(budgetKey, Date.now());
+        // Adaptive fan-out. Each node in this queue costs TWO announce round trips
+        // (ping id, then the real query) and every onion request is three X25519
+        // scalar mults — so a full 24-node sweep is ~144 scalar mults, and the loop
+        // only exits early on SUCCESS. In steady state the lookups that repeat are
+        // exactly the ones that keep failing, so the old fixed width paid the
+        // maximum price precisely when it was least likely to pay off: measured
+        // ~10-23 announce sends/sec on smtp.gfax.cn, ~28% of a core.
+        //
+        // First attempt keeps the full width — that is the one most likely to find
+        // the peer, and discovery reliability is not what we are trading away.
+        // Repeats narrow to a probe, and every 8th attempt goes wide again so a
+        // peer that only just came back is still found without waiting for a
+        // restart. Widening beats a permanently narrow sweep: the failure we must
+        // not introduce is "never discovers", not "discovers a bit later".
+        const misses = this.#onionLookupMisses.get(budgetKey) ?? 0;
+        const fullWidth = Math.max(8, Math.min(24, MAX_FRIEND_ROUTE_ATTEMPTS));
+        const width = misses === 0 || misses % 8 === 0 ? fullWidth : 4;
         const queue = dedupeNodes(this.#knownNodes.length > 0 ? this.#knownNodes : this.#opts.bootstrapNodes)
             .filter((n) => !this.#isNodeBlacklisted(`${n.host}:${n.port}`))
             .sort((a, b) => this.#nodeScore(`${b.host}:${b.port}`) - this.#nodeScore(`${a.host}:${a.port}`))
-            .slice(0, Math.max(8, Math.min(24, MAX_FRIEND_ROUTE_ATTEMPTS)));
+            .slice(0, width);
         const directKnown = queue.find((node) => node.pk === targetId);
         if (directKnown) {
+            this.#onionLookupMisses.delete(budgetKey);
             this.#cacheFriendRemote(friendId, directKnown.host, directKnown.port);
             this.#debugLog(`friend endpoint matched known node for ${friendId} at ${directKnown.host}:${directKnown.port}`);
             return true;
@@ -3122,11 +3180,15 @@ export class Peer {
             }
             const exact = discovered.find((n) => n.pk === targetId);
             if (exact) {
+                this.#onionLookupMisses.delete(budgetKey);
                 this.#cacheFriendRemote(friendId, exact.host, exact.port);
                 this.#debugLog(`friend endpoint discovered for ${friendId} at ${exact.host}:${exact.port}`);
                 return true;
             }
         }
+        // Nothing found: remember, so the next sweep for this target probes
+        // narrowly instead of paying the full 24-node price again.
+        this.#onionLookupMisses.set(budgetKey, misses + 1);
         return false;
     }
     async #announceSelfBestEffort(force = false, deadlineMs = Number.POSITIVE_INFINITY) {
@@ -3547,9 +3609,29 @@ export class Peer {
                         if (friendRealPk && friendRealPk.length === 32) {
                             // 1. Re-announce our DHT-PK so peer learns *our* UDP endpoint
                             //    even if their own DHT lookup against us was stale.
-                            void this.#sendOnionDhtPk(friendRealPk).catch((error) => {
-                                this.#debugLog(`UDP retry: dhtpk_send for ${friendId} failed: ${error.message}`);
-                            });
+                            //
+                            //    This shares #dhtPkSendCooldown with the periodic branch
+                            //    below ON PURPOSE. The two operations in this `if` have very
+                            //    different costs and must not share the 3s cadence: the
+                            //    endpoint offer above is one UDP packet, while an onion
+                            //    DHT-PK announce fans out to several nodes and does THREE
+                            //    X25519 scalar mults per node (one per onion layer). At 3s
+                            //    per friend that dominated the CPU of any node with a few
+                            //    idle relay friends — measured on smtp.gfax.cn: 82% of wall
+                            //    clock inside nacl, 83% of it under createOnionRequest0,
+                            //    against 2% on a node with none. Note the trigger is NOT a
+                            //    broken friend: udpConfirmed needs UDP traffic within 4s, so
+                            //    a perfectly healthy but idle relay friend qualifies forever.
+                            //
+                            //    Keep the offer at 3s (cheap, and it is what actually
+                            //    re-punches); let the expensive announce keep its 25s budget.
+                            const lastAnnounce = this.#dhtPkSendCooldown.get(friendId) ?? 0;
+                            if (now - lastAnnounce > DHT_PK_ANNOUNCE_COOLDOWN_MS) {
+                                this.#dhtPkSendCooldown.set(friendId, now);
+                                void this.#sendOnionDhtPk(friendRealPk).catch((error) => {
+                                    this.#debugLog(`UDP retry: dhtpk_send for ${friendId} failed: ${error.message}`);
+                                });
+                            }
                             // 2. Try to discover the peer's UDP endpoint and kick a
                             //    fresh cookie request via UDP. discoverAndCacheFriend
                             //    Endpoint accepts EITHER the DHT-PK (preferred —
@@ -3560,6 +3642,19 @@ export class Peer {
                             //    session.friendDhtPublicKey is null. Falling back
                             //    to friendRealPk keeps the retry from being a no-op
                             //    in exactly the case it was designed to fix.
+                            //    COST NOTE: those two lookups are not the same price. With a
+                            //    dhtPk it is a direct DHT query. Without one it is an
+                            //    ONION-routed lookup — several nodes, three X25519 scalar
+                            //    mults each — and the fallback fires precisely on
+                            //    relay-only sessions, which are the long-lived ones. At the
+                            //    3s re-punch cadence that made it the single biggest CPU
+                            //    consumer on a node with idle relay friends (measured on
+                            //    smtp.gfax.cn: 31% of all crypto time entered here). So the
+                            //    cheap direct lookup keeps the 3s cadence and only the onion
+                            //    fallback is charged against the announce budget.
+                            //    The per-(friend, target) budget now lives INSIDE
+                            //    #discoverAndCacheFriendEndpoint, so this call site stays
+                            //    simple and every other caller is covered by the same gate.
                             const dhtPk = session.friendDhtPublicKey;
                             const searchKey = dhtPk ?? friendRealPk;
                             if (searchKey && searchKey.length === 32) {
@@ -3593,8 +3688,7 @@ export class Peer {
             // bootstrap nodes). Per-friend cooldown via #dhtPkSendCooldown so we
             // don't flood onion data requests every 5s loop tick.
             const lastDhtPkSent = this.#dhtPkSendCooldown.get(friendId) ?? 0;
-            const dhtPkInterval = 25_000;
-            if (now - lastDhtPkSent > dhtPkInterval) {
+            if (now - lastDhtPkSent > DHT_PK_ANNOUNCE_COOLDOWN_MS) {
                 let friendRealPk = session?.friendRealPublicKey;
                 if (!friendRealPk && friend.address) {
                     try {
@@ -4610,7 +4704,10 @@ export class Peer {
         }
         // An unroutable self-source is never the friend's endpoint (see
         // #adoptRemote) — don't let it poison the in-memory record either.
-        if (this.#isUnroutableSelfSource(host, port)) {
+        // observed=false: this path takes SPECULATIVE hints (DHT-PK extras,
+        // sendnodes-derived knownNodes), so a self-address here is a claim, not
+        // proof of a same-host peer.
+        if (this.#isUnroutableSelfSource(host, port, false)) {
             return;
         }
         // Important: do NOT persist this candidate to disk. Speculative endpoint
@@ -4661,19 +4758,37 @@ export class Peer {
      *  router and loop), or it's literally our own UDP socket. A self
      *  PHYSICAL address with a DIFFERENT port is routable — that's a
      *  same-host peer (e.g. the iOS simulator running on this Mac). */
-    #isUnroutableSelfSource(host, port) {
+    #isUnroutableSelfSource(host, port, observed) {
         if (isOwnVirtualAddress(host))
             return true;
         if (!isOwnAddress(host))
             return false;
         const ourPort = this.#udp?.localPort();
-        return ourPort !== undefined && port === ourPort;
+        if (ourPort !== undefined && port === ourPort)
+            return true;
+        // Our own physical IP on a DIFFERENT port is a same-host peer (the iOS
+        // simulator on this Mac) — but only when we actually RECEIVED a packet
+        // from there. A peer merely CLAIMING that address in its candidate list
+        // is not evidence: private ranges are reused everywhere, so two machines
+        // on unrelated networks routinely share one. Seen in the field between
+        // ubuntu-aaec and air-wli, both sitting on a 172.29/20: aaec adopted its
+        // OWN eth0 address as air-wli's endpoint and sent every IP packet to
+        // itself — friend "online", chat fine, ping 100% loss, and not a single
+        // drop recorded because nothing was dropped, just delivered to the wrong
+        // machine.
+        return !observed;
     }
-    #adoptRemote(session, host, port) {
+    /**
+     * @param observed true when host:port is the source of a datagram we
+     *   actually received, false when it is an address the peer advertised.
+     *   The distinction matters for self-addresses — see
+     *   {@link #isUnroutableSelfSource}.
+     */
+    #adoptRemote(session, host, port, observed = false) {
         // NEVER adopt an unroutable self-source as a friend's remote — replies
         // would loop into our own interface and die, the peer never hears back
         // and re-handshakes forever.
-        if (this.#isUnroutableSelfSource(host, port)) {
+        if (this.#isUnroutableSelfSource(host, port, observed)) {
             return;
         }
         if (session.lanRemoteHost &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.123",
+  "version": "0.1.126",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",