@decentnetwork/peer 0.1.56 → 0.1.58

package/dist/peer.d.ts

@@ -194,6 +194,9 @@ export declare class Peer {
          *  tcp-relay, discovery itself is broken — we don't even know
          *  where to send a cookie request. */
         endpointCandidatesCount: number;
+        /** The actual candidate endpoints (host:port) — lets diag see whether a
+         *  same-LAN host candidate (e.g. 10.0.0.x) was received but not adopted. */
+        endpointCandidates: string[];
         /** Last time we sent an outbound cookie request via UDP for this
          *  peer (null = never). Used to confirm Phase 1.2 retries are
          *  actually firing. */

package/dist/peer.js

@@ -82,6 +82,14 @@ const FRIEND_PING_INTERVAL_MS = readEnvInt("DECENT_FRIEND_PING_INTERVAL_MS", 400
 // slow enough not to burn CPU on idle peers. Tunable via env.
 const FRIEND_CONNECTION_LOOP_MS = readEnvInt("DECENT_FRIEND_CONNECTION_LOOP_MS", 250);
 const FRIEND_TIMEOUT_MS = readEnvInt("DECENT_FRIEND_TIMEOUT_MS", 32000);
+// Half-open breaker: if the peer proposes a NEW session key this many times over
+// this long while our session looks "alive", accept it (the peer can't decrypt
+// our current session — a desynced half-open session, observed as a flood of
+// "no session matched"). Each handshake carries a fresh cookie so these are
+// genuine attempts, not replays. Bounded so it never fires on a healthy session.
+const REHS_ACCEPT_COUNT = readEnvInt("DECENT_REHS_ACCEPT_COUNT", 4);
+const REHS_ACCEPT_MS = readEnvInt("DECENT_REHS_ACCEPT_MS", 2500);
+const REHS_WINDOW_MS = readEnvInt("DECENT_REHS_WINDOW_MS", 8000);
 // How long a relay path stays "confirmed" (carrying bulk data on its own, no
 // tcp-relay fan-out) after the last packet received over it. The relay
 // keepalive refreshes this every ~4s on a healthy path, so a generous window
@@ -1062,6 +1070,7 @@ export class Peer {
             ourLocalUdpPort: this.#udp?.localPort() ?? null,
             friendUdpEndpoint: friendUdp,
             endpointCandidatesCount: s.endpointCandidates?.length ?? 0,
+            endpointCandidates: (s.endpointCandidates ?? []).map((c) => `${c.host}:${c.port}`),
             cookieRequestSentMs: s.cookieRequestSentMs ?? null,
         };
     }
@@ -1435,12 +1444,30 @@ export class Peer {
                 const lastAlive = state.lastPingRecvMs ?? state.sessionEstablishedAtMs;
                 const currentSessionAlive = Date.now() - lastAlive < FRIEND_TIMEOUT_MS;
                 if (sinceEstablished > 1000 && currentSessionAlive) {
-                    // Verbose only — peers retransmit handshakes aggressively, so
-                    // this line fires dozens of times per minute on a stuck pair
-                    // and drowns out signal. Visible with DECENT_DEBUG_VERBOSE=1.
-                    this.#debugVerboseLog(`hs_recv ignored friend=${friendId} (new session pubkey on live established session, ${sinceEstablished}ms after establish)`);
-                    return;
+                    // Half-open breaker. Our session looks alive — but "alive" only means
+                    // WE are receiving (possibly only over the relay). If the peer KEEPS
+                    // proposing a new key, THEIR side can't decrypt our packets: a desynced
+                    // half-open session (observed snoopy↔mac on one LAN as 288k "no session
+                    // matched"). Rejecting forever deadlocks. So count sustained attempts
+                    // and, past the threshold, accept the new key to re-converge. Bounded
+                    // to sustained attempts so it never disturbs a healthy session.
+                    const now = Date.now();
+                    if (state.rehsFirstMs === undefined || now - (state.rehsLastMs ?? 0) > REHS_WINDOW_MS) {
+                        state.rehsFirstMs = now;
+                        state.rehsCount = 0;
+                    }
+                    state.rehsLastMs = now;
+                    state.rehsCount = (state.rehsCount ?? 0) + 1;
+                    const stuck = state.rehsCount >= REHS_ACCEPT_COUNT && now - state.rehsFirstMs >= REHS_ACCEPT_MS;
+                    if (!stuck) {
+                        this.#debugVerboseLog(`hs_recv ignored friend=${friendId} (new session pubkey on live session, attempt ${state.rehsCount}, ${sinceEstablished}ms after establish)`);
+                        return;
+                    }
+                    this.#debugLog(`hs_recv accepting re-handshake friend=${friendId} (half-open breaker: ${state.rehsCount} new-key attempts over ${now - state.rehsFirstMs}ms — peer can't decrypt our session)`);
                 }
+                // Converging on a fresh session — clear the breaker counter.
+                state.rehsCount = 0;
+                state.rehsFirstMs = undefined;
                 this.#debugLog(`hs_recv accepting re-handshake friend=${friendId} (current session wedged/dead, ` +
                     `lastPingRecv=${state.lastPingRecvMs ? Date.now() - state.lastPingRecvMs + "ms ago" : "never"})`);
             }
@@ -1628,7 +1655,19 @@ export class Peer {
                     state.lastRelayRecvMs = Date.now();
                 }
                 else {
-                    state.remote = { host: remote.address, port: remote.port };
+                    // Adopt the source as our send endpoint — but NEVER downgrade from a
+                    // same-LAN (physical) path to a non-LAN source. A packet that loops in
+                    // via the peer's public / Tailscale-exit endpoint must not knock us off
+                    // the direct LAN path, which is strictly better. (This is the other
+                    // half of the "use the physical LAN, not Tailscale" rule.)
+                    const cur = state.remote?.host;
+                    const onSameLanAlready = !!cur && !cur.startsWith("tcp:") && isPrivateAddress(cur) && !isCgnatAddress(cur) &&
+                        getPhysicalLanSubnets().some((s) => isInIpv4Subnet(cur, s));
+                    const incomingSameLan = isPrivateAddress(remote.address) && !isCgnatAddress(remote.address) &&
+                        getPhysicalLanSubnets().some((s) => isInIpv4Subnet(remote.address, s));
+                    if (incomingSameLan || !onSameLanAlready) {
+                        state.remote = { host: remote.address, port: remote.port };
+                    }
                     if (!state.lastUdpRecvMs) {
                         this.#debugLog(`udp_confirmed friend=${friendId} via=${remote.address}:${remote.port} (direct UDP path live)`);
                     }
@@ -3353,8 +3392,19 @@ export class Peer {
                     if (++ln >= 6)
                         clearInterval(lanTimer);
                 }, 120);
-                const haveRealUdp = session.remote && !session.remote.host?.startsWith("tcp:") && session.remote.port !== 0;
-                if (!haveRealUdp) {
+                // The physical LAN is strictly better than ANY public path — direct, no
+                // NAT, no relay, and crucially no Tailscale-exit hairpin (a peer whose
+                // internet egresses via Tailscale advertises its exit's public IP as
+                // its srflx, so the "direct" public path actually loops out through
+                // Tailscale and back). So adopt the LAN candidate as session.remote even
+                // when we already have a public "real UDP" remote — UNLESS we're already
+                // on a same-LAN address (don't flap between two LAN candidates). Without
+                // this the session stuck to the public/Tailscale endpoint and never sent
+                // over the LAN (observed: session.remote stayed public, data on relay).
+                const cur = session.remote?.host;
+                const onSameLanAlready = !!cur && !cur.startsWith("tcp:") && isPrivateAddress(cur) && !isCgnatAddress(cur) &&
+                    getPhysicalLanSubnets().some((s) => isInIpv4Subnet(cur, s));
+                if (!onSameLanAlready) {
                     session.remote = { host: lanHost, port: lanPort };
                 }
                 if (session.established) {
@@ -4920,7 +4970,15 @@ function isInIpv4Subnet(host, subnet) {
 // path onto the overlay or loops into our own mesh, then silently falls back to
 // the relay — the snoopy/lili "lastUdpRecv=never -> bufferbloat" path. (lili
 // runs Tailscale; that's exactly this.)
-const VIRTUAL_IFACE_RE = /^(utun|tun|tap|wg|tailscale|zt|ham|agentnet|awdl|llw|gif|stf|bridge|vnic|vmnet|veth|docker)/i;
+// Names of interfaces that are NOT a real physical LAN — overlays (tailscale,
+// zerotier, wireguard, the agentnet TUN), and especially container/VM bridges.
+// Docker creates `docker0` AND per-network `br-<hash>` bridges (172.x); libvirt
+// `virbr0`; k8s `cni0`/`flannel`/`kube`. These were leaking their 172.x address
+// into the LAN host-candidate offer, so a peer on a real 10.x LAN advertised a
+// Docker-bridge IP its LAN partner could never match → LAN-direct never engaged
+// (observed: two boxes on one 10.0.0.0/24 stuck hairpinning through the public
+// internet). `^bridge` did NOT cover `br-…`.
+const VIRTUAL_IFACE_RE = /^(utun|tun|tap|wg|tailscale|zt|ham|agentnet|awdl|llw|gif|stf|bridge|br-|virbr|cni|flannel|weave|kube|vnet|vnic|vmnet|veth|docker)/i;
 /** True for RFC 6598 carrier-grade-NAT space 100.64.0.0/10 (Tailscale's range). */
 function isCgnatAddress(host) {
     const o = host.split(".");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.56",
+  "version": "0.1.58",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",