@decentnetwork/peer 0.1.133 → 0.1.134

package/dist/peer.js

@@ -5206,7 +5206,24 @@ export class Peer {
             // Permit the advertised private candidate when both peers share the same
             // public NAT; if it is a CGNAT/private collision and never validates, the
             // normal 12s stale-LAN-lock breaker restores the public/relay path.
-            const samePublicNat = !!this.#srflxCache?.addr.host && this.#srflxCache.addr.host === host;
+            // "We share one NAT" — the only reason to trust a peer's private address
+            // without checking our own subnets.
+            //
+            // It requires that we are actually BEHIND a NAT. A node with a public IP
+            // has srflx == its own address, so the naive comparison matched every
+            // offer whose observed source was that same address (relayed or
+            // reflected through us), and the subnet check below was bypassed for any
+            // private host at all. tokyo, on a public IP, took 10.0.0.245 from a
+            // laptop across the Pacific this way and pinned its session to it —
+            // re-adopting it within seconds of every self-heal, because this path
+            // writes session.remote directly and never goes through #adoptRemote.
+            //
+            // Behind a NAT, srflx is the NAT's address and differs from every local
+            // interface, so the extra test costs nothing there and closes the hole
+            // for public hosts.
+            const srflxHost = this.#srflxCache?.addr.host;
+            const weAreBehindNat = !!srflxHost && !getPhysicalLanAddresses().includes(srflxHost);
+            const samePublicNat = weAreBehindNat && srflxHost === host;
             const sameLan = lanPort !== 0 &&
                 isPrivateAddress(lanHost) &&
                 !isCgnatAddress(lanHost) &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.133",
+  "version": "0.1.134",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",