@decentnetwork/peer 0.1.38 → 0.1.39

package/dist/peer.js

@@ -3058,7 +3058,7 @@ export class Peer {
         // "direct" option we advertise is our srflx (public) address, which the
         // NAT must hairpin back onto the LAN — most don't, so two machines in one
         // office silently fall back to the TURN relay (~260ms for a <1ms hop).
-        const lanIp = getLocalIpv4Addresses().find((ip) => isPrivateAddress(ip));
+        const lanIp = getPhysicalLanAddresses().find((ip) => isPrivateAddress(ip));
         const lanOctets = lanIp ? lanIp.split(".").map((s) => parseInt(s, 10)) : undefined;
         const lanPort = this.#udp.localPort() ?? 0;
         const lanValid = !!lanOctets && lanOctets.length === 4 && !lanOctets.some((o) => Number.isNaN(o)) && lanPort > 0;
@@ -3147,8 +3147,9 @@ export class Peer {
             const lanPort = ((payload[16] << 8) | payload[17]) >>> 0;
             const sameLan = lanPort !== 0 &&
                 isPrivateAddress(lanHost) &&
-                getLocalIpv4Subnets().some((s) => isInIpv4Subnet(lanHost, s)) &&
-                !(getLocalIpv4Addresses().includes(lanHost) && this.#udp.localPort() === lanPort);
+                !isCgnatAddress(lanHost) &&
+                getPhysicalLanSubnets().some((s) => isInIpv4Subnet(lanHost, s)) &&
+                !(getPhysicalLanAddresses().includes(lanHost) && this.#udp.localPort() === lanPort);
             if (sameLan) {
                 this.#rememberEndpointCandidate(session, lanHost, lanPort);
                 this.#debugLog(`udp-endpoint LAN candidate from ${friendId}: ${lanHost}:${lanPort} (same subnet) — punching`);
@@ -4433,6 +4434,72 @@ function isInIpv4Subnet(host, subnet) {
         return false;
     return ((ip & subnet.maskBits) >>> 0) === subnet.networkBits;
 }
+// Interface names that are VIRTUAL / overlay networks, not a physical LAN:
+// Tailscale & utun tunnels (utun* on macOS, tailscale*/tun* on Linux),
+// WireGuard (wg*), ZeroTier (zt*), the decentlan TUN itself (agentnet*), and
+// assorted macOS virtual links (awdl/llw/gif/stf/bridge). A LAN-direct host
+// candidate MUST be a physical-LAN address: advertising/punching an overlay
+// address (e.g. Tailscale 100.x, or our own 10.86.x mesh IP) sends the "direct"
+// path onto the overlay or loops into our own mesh, then silently falls back to
+// the relay — the snoopy/lili "lastUdpRecv=never -> bufferbloat" path. (lili
+// runs Tailscale; that's exactly this.)
+const VIRTUAL_IFACE_RE = /^(utun|tun|tap|wg|tailscale|zt|ham|agentnet|awdl|llw|gif|stf|bridge|vnic|vmnet|veth|docker)/i;
+/** True for RFC 6598 carrier-grade-NAT space 100.64.0.0/10 (Tailscale's range). */
+function isCgnatAddress(host) {
+    const o = host.split(".");
+    if (o.length !== 4)
+        return false;
+    const a = Number(o[0]);
+    const b = Number(o[1]);
+    return a === 100 && b >= 64 && b <= 127;
+}
+/** Local IPv4 addresses on PHYSICAL interfaces only (excludes overlay/virtual
+ *  interfaces by name and the CGNAT range). Used for LAN-direct host candidates. */
+function getPhysicalLanAddresses() {
+    const out = [];
+    try {
+        for (const [name, list] of Object.entries(networkInterfaces())) {
+            if (!list || VIRTUAL_IFACE_RE.test(name))
+                continue;
+            for (const info of list) {
+                if (info.family !== "IPv4" || info.internal)
+                    continue;
+                if (isCgnatAddress(info.address))
+                    continue;
+                out.push(info.address);
+            }
+        }
+    }
+    catch {
+        // best-effort
+    }
+    return out;
+}
+/** Subnets of PHYSICAL interfaces only — for matching a peer's host candidate
+ *  to OUR real LAN (so we never match a peer's Tailscale/TUN address against our
+ *  own overlay subnet). */
+function getPhysicalLanSubnets() {
+    const out = [];
+    try {
+        for (const [name, list] of Object.entries(networkInterfaces())) {
+            if (!list || VIRTUAL_IFACE_RE.test(name))
+                continue;
+            for (const info of list) {
+                if (info.family !== "IPv4" || info.internal || isCgnatAddress(info.address))
+                    continue;
+                const addr = ipv4ToInt(info.address);
+                const mask = netmaskToInt(info.netmask);
+                if (addr === undefined || mask === undefined || mask === 0)
+                    continue;
+                out.push({ networkBits: (addr & mask) >>> 0, maskBits: mask });
+            }
+        }
+    }
+    catch {
+        // best-effort
+    }
+    return out;
+}
 function isPrivateAddress(host) {
     // RFC1918 IPv4: 10/8, 172.16/12, 192.168/16; loopback 127/8;
     // link-local 169.254/16; carrier-grade NAT 100.64/10. IPv6 link-local fe80::/10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.38",
+  "version": "0.1.39",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",