@decentnetwork/peer 0.1.130 → 0.1.131

package/dist/peer.js

@@ -4855,6 +4855,26 @@ export class Peer {
         if (this.#isUnroutableSelfSource(host, port, observed)) {
             return;
         }
+        // An ADVERTISED private address is only usable if we are on that network.
+        //
+        // Same provenance rule as the self-address check above, one step wider: a
+        // packet that ARRIVED from a private address proves the path exists, but a
+        // peer merely listing one proves nothing — RFC1918 ranges are reused
+        // everywhere. Seen in the field between tokyo (Japan) and a laptop at home:
+        // tokyo adopted 10.0.0.245, an address that only means anything inside that
+        // house, and sent every IP packet there. Friend online, session
+        // established, transport "both", ping 100% loss.
+        //
+        // Only reached for advertised candidates, so the cached-but-not-free
+        // getPhysicalLanSubnets() stays off the per-packet path (see the CCTV CPU
+        // regression note on #isUnroutableSelfSource).
+        if (!observed &&
+            isPrivateAddress(host) &&
+            !isCgnatAddress(host) &&
+            !getPhysicalLanSubnets().some((sub) => isInIpv4Subnet(host, sub))) {
+            this.#debugLog(`ignoring advertised private endpoint ${host}:${port} — not on any of our LANs`);
+            return;
+        }
         if (session.lanRemoteHost &&
             session.remote?.host === session.lanRemoteHost &&
             host !== session.lanRemoteHost &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.130",
+  "version": "0.1.131",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",