@decentnetwork/peer 0.1.133 → 0.1.135

package/dist/peer.js

@@ -34,7 +34,21 @@ import { createBoundUdp4Socket, closeDgramSocket } from "./transport/dgram-lifec
 const TURN_RELAY_SERVERS = (() => {
     const raw = process.env.DECENT_TURN_SERVERS?.trim();
     if (!raw) {
-        return [{ host: "tokyo.fi.chat", port: 3478, username: "allcom", password: "allcompass" }];
+        // MORE THAN ONE, ALWAYS. This list is not a preference — it is the only
+        // way a peer learns its own public endpoint, so when every entry is down
+        // nobody can hole-punch and the WHOLE network silently degrades to TCP
+        // relay. That is not hypothetical: coturn on tokyo core-dumped and stayed
+        // dead for ten days, and with tokyo as the sole entry every link in the
+        // network ran at relay latency (~1200ms instead of ~130ms) the entire
+        // time. Nothing alerted, because the port stayed open.
+        //
+        // Ordered by expected reachability from the biggest population of peers.
+        // A dead entry costs one timeout before the next is tried, so listing a
+        // spare is close to free; having none is a network-wide outage.
+        return [
+            { host: "tokyo.fi.chat", port: 3478, username: "allcom", password: "allcompass" },
+            { host: "gfax.cn", port: 3478, username: "allcom", password: "allcompass" },
+        ];
     }
     return raw
         .split(",")
@@ -5206,7 +5220,24 @@ export class Peer {
             // Permit the advertised private candidate when both peers share the same
             // public NAT; if it is a CGNAT/private collision and never validates, the
             // normal 12s stale-LAN-lock breaker restores the public/relay path.
-            const samePublicNat = !!this.#srflxCache?.addr.host && this.#srflxCache.addr.host === host;
+            // "We share one NAT" — the only reason to trust a peer's private address
+            // without checking our own subnets.
+            //
+            // It requires that we are actually BEHIND a NAT. A node with a public IP
+            // has srflx == its own address, so the naive comparison matched every
+            // offer whose observed source was that same address (relayed or
+            // reflected through us), and the subnet check below was bypassed for any
+            // private host at all. tokyo, on a public IP, took 10.0.0.245 from a
+            // laptop across the Pacific this way and pinned its session to it —
+            // re-adopting it within seconds of every self-heal, because this path
+            // writes session.remote directly and never goes through #adoptRemote.
+            //
+            // Behind a NAT, srflx is the NAT's address and differs from every local
+            // interface, so the extra test costs nothing there and closes the hole
+            // for public hosts.
+            const srflxHost = this.#srflxCache?.addr.host;
+            const weAreBehindNat = !!srflxHost && !getPhysicalLanAddresses().includes(srflxHost);
+            const samePublicNat = weAreBehindNat && srflxHost === host;
             const sameLan = lanPort !== 0 &&
                 isPrivateAddress(lanHost) &&
                 !isCgnatAddress(lanHost) &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.133",
+  "version": "0.1.135",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",