@decentnetwork/peer 0.1.57 → 0.1.59

package/dist/peer.js

@@ -82,6 +82,17 @@ const FRIEND_PING_INTERVAL_MS = readEnvInt("DECENT_FRIEND_PING_INTERVAL_MS", 400
 // slow enough not to burn CPU on idle peers. Tunable via env.
 const FRIEND_CONNECTION_LOOP_MS = readEnvInt("DECENT_FRIEND_CONNECTION_LOOP_MS", 250);
 const FRIEND_TIMEOUT_MS = readEnvInt("DECENT_FRIEND_TIMEOUT_MS", 32000);
+// Half-open breaker: if the peer proposes a NEW session key this many times over
+// this long while our session looks "alive", accept it (the peer can't decrypt
+// our current session — a desynced half-open session, observed as a flood of
+// "no session matched"). Each handshake carries a fresh cookie so these are
+// genuine attempts, not replays. Bounded so it never fires on a healthy session.
+const REHS_ACCEPT_COUNT = readEnvInt("DECENT_REHS_ACCEPT_COUNT", 4);
+const REHS_ACCEPT_MS = readEnvInt("DECENT_REHS_ACCEPT_MS", 2500);
+const REHS_WINDOW_MS = readEnvInt("DECENT_REHS_WINDOW_MS", 8000);
+// Re-handshake when we keep receiving undecryptable crypto data from a known
+// friend's endpoint (desynced sessions), rate-limited per friend.
+const REINIT_ON_DESYNC_MS = readEnvInt("DECENT_REINIT_ON_DESYNC_MS", 2000);
 // How long a relay path stays "confirmed" (carrying bulk data on its own, no
 // tcp-relay fan-out) after the last packet received over it. The relay
 // keepalive refreshes this every ~4s on a healthy path, so a generous window
@@ -1436,12 +1447,30 @@ export class Peer {
                 const lastAlive = state.lastPingRecvMs ?? state.sessionEstablishedAtMs;
                 const currentSessionAlive = Date.now() - lastAlive < FRIEND_TIMEOUT_MS;
                 if (sinceEstablished > 1000 && currentSessionAlive) {
-                    // Verbose only — peers retransmit handshakes aggressively, so
-                    // this line fires dozens of times per minute on a stuck pair
-                    // and drowns out signal. Visible with DECENT_DEBUG_VERBOSE=1.
-                    this.#debugVerboseLog(`hs_recv ignored friend=${friendId} (new session pubkey on live established session, ${sinceEstablished}ms after establish)`);
-                    return;
+                    // Half-open breaker. Our session looks alive — but "alive" only means
+                    // WE are receiving (possibly only over the relay). If the peer KEEPS
+                    // proposing a new key, THEIR side can't decrypt our packets: a desynced
+                    // half-open session (observed snoopy↔mac on one LAN as 288k "no session
+                    // matched"). Rejecting forever deadlocks. So count sustained attempts
+                    // and, past the threshold, accept the new key to re-converge. Bounded
+                    // to sustained attempts so it never disturbs a healthy session.
+                    const now = Date.now();
+                    if (state.rehsFirstMs === undefined || now - (state.rehsLastMs ?? 0) > REHS_WINDOW_MS) {
+                        state.rehsFirstMs = now;
+                        state.rehsCount = 0;
+                    }
+                    state.rehsLastMs = now;
+                    state.rehsCount = (state.rehsCount ?? 0) + 1;
+                    const stuck = state.rehsCount >= REHS_ACCEPT_COUNT && now - state.rehsFirstMs >= REHS_ACCEPT_MS;
+                    if (!stuck) {
+                        this.#debugVerboseLog(`hs_recv ignored friend=${friendId} (new session pubkey on live session, attempt ${state.rehsCount}, ${sinceEstablished}ms after establish)`);
+                        return;
+                    }
+                    this.#debugLog(`hs_recv accepting re-handshake friend=${friendId} (half-open breaker: ${state.rehsCount} new-key attempts over ${now - state.rehsFirstMs}ms — peer can't decrypt our session)`);
                 }
+                // Converging on a fresh session — clear the breaker counter.
+                state.rehsCount = 0;
+                state.rehsFirstMs = undefined;
                 this.#debugLog(`hs_recv accepting re-handshake friend=${friendId} (current session wedged/dead, ` +
                     `lastPingRecv=${state.lastPingRecvMs ? Date.now() - state.lastPingRecvMs + "ms ago" : "never"})`);
             }
@@ -1799,7 +1828,27 @@ export class Peer {
                 this.#debugVerboseLog(`unknown messenger packet kind ${kind} from ${friendId}`);
                 return;
             }
-            this.#debugLog(`crypto data received from ${remote.address}:${remote.port} but no session matched`);
+            // We received crypto data we can't decrypt from a KNOWN friend's endpoint:
+            // our two sessions are desynced (different keys) and NEITHER side will
+            // re-handshake on its own, because each believes it is still established
+            // (the half-open breaker can't help — no handshakes are being exchanged).
+            // Kick a fresh handshake so we re-converge. Rate-limited per friend so a
+            // flood of undecryptable packets doesn't spam cookie requests.
+            if (!this.#remoteIsTcp(remote) && !viaRelay) {
+                for (const [fid, st] of this.#friendSessions.entries()) {
+                    const matches = (st.remote?.host === remote.address && st.remote?.port === remote.port) ||
+                        (st.endpointCandidates ?? []).some((c) => c.host === remote.address && c.port === remote.port);
+                    if (!matches)
+                        continue;
+                    if (Date.now() - (st.lastReinitMs ?? 0) > REINIT_ON_DESYNC_MS) {
+                        st.lastReinitMs = Date.now();
+                        this.#debugLog(`no-session-matched from ${remote.address}:${remote.port} (friend ${fid}) — desynced, re-initiating handshake`);
+                        void this.#initiateSession(fid).catch(() => undefined);
+                    }
+                    break;
+                }
+            }
+            this.#debugVerboseLog(`crypto data received from ${remote.address}:${remote.port} but no session matched`);
             return;
         }
         if (packet[0] === NET_PACKET_ONION_DATA_RESPONSE && this.#announceDataKey) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.57",
+  "version": "0.1.59",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",