@decentnetwork/peer 0.1.62 → 0.1.64

package/dist/peer.js

@@ -92,7 +92,13 @@ const REHS_ACCEPT_MS = readEnvInt("DECENT_REHS_ACCEPT_MS", 2500);
 const REHS_WINDOW_MS = readEnvInt("DECENT_REHS_WINDOW_MS", 8000);
 // Re-handshake when we keep receiving undecryptable crypto data from a known
 // friend's endpoint (desynced sessions), rate-limited per friend.
-const REINIT_ON_DESYNC_MS = readEnvInt("DECENT_REINIT_ON_DESYNC_MS", 2000);
+// Conservative: deleting a session forces a re-handshake which ROTATES our
+// ephemeral key, so doing it too eagerly turns a transient blip into a
+// rotate→desync→delete thrash. Only nuke a session that's been UNABLE to
+// decrypt anything for a long time (genuinely dead, well past any
+// establishment-transition window), and at most once per long interval.
+const REINIT_ON_DESYNC_MS = readEnvInt("DECENT_REINIT_ON_DESYNC_MS", 12000);
+const REINIT_STUCK_MS = readEnvInt("DECENT_REINIT_STUCK_MS", 20000);
 // How long a relay path stays "confirmed" (carrying bulk data on its own, no
 // tcp-relay fan-out) after the last packet received over it. The relay
 // keepalive refreshes this every ~4s on a healthy path, so a generous window
@@ -267,6 +273,9 @@ export class Peer {
     // #initiateSession every few seconds for every friend; without this
     // dedupe, lower-pubkey side floods the log with "deferring to peer".
     #initiateSkipLogged = new Set();
+    // Per-friend last time we deleted a desynced session (rate-limit; survives the
+    // session deletion, unlike a field on the session object itself).
+    #lastDesyncDeleteMs = new Map();
     // Cached server-reflexive (public) UDP endpoint of our #udp socket,
     // learned via STUN. Cone-NAT mappings are stable for the socket
     // lifetime, so we only re-probe every ~60s. Used to tell friends where
@@ -1832,24 +1841,41 @@ export class Peer {
                 this.#debugVerboseLog(`unknown messenger packet kind ${kind} from ${friendId}`);
                 return;
             }
-            // We received crypto data we can't decrypt from a KNOWN friend's endpoint:
-            // our two sessions are desynced (different keys) and NEITHER side will
-            // re-handshake on its own, because each believes it is still established
-            // (the half-open breaker can't help — no handshakes are being exchanged).
-            // Kick a fresh handshake so we re-converge. Rate-limited per friend so a
-            // flood of undecryptable packets doesn't spam cookie requests.
-            if (!this.#remoteIsTcp(remote) && !viaRelay) {
+            // We received crypto data we can't decrypt from a KNOWN friend: our two
+            // sessions are desynced (different keys) and both are "established", so
+            // neither re-handshakes (#initiateSession no-ops on an established session,
+            // and the lower-pubkey side defers entirely). DELETE the stale session so
+            // the connection loop re-establishes cleanly via the single-initiator path
+            // (higher pubkey initiates a fresh cookie chain, lower responds, both
+            // derive the SAME key). This covers BOTH transports — the desync shows up
+            // over the TCP relay (remote = tcp:<friendId>:0) as well as direct UDP.
+            let desyncedFid;
+            if (this.#remoteIsTcp(remote)) {
+                const m = /^tcp:([A-Za-z0-9]+)/.exec(remote.address);
+                if (m && this.#friendSessions.has(m[1]))
+                    desyncedFid = m[1];
+            }
+            else if (!viaRelay) {
                 for (const [fid, st] of this.#friendSessions.entries()) {
-                    const matches = (st.remote?.host === remote.address && st.remote?.port === remote.port) ||
-                        (st.endpointCandidates ?? []).some((c) => c.host === remote.address && c.port === remote.port);
-                    if (!matches)
-                        continue;
-                    if (Date.now() - (st.lastReinitMs ?? 0) > REINIT_ON_DESYNC_MS) {
-                        st.lastReinitMs = Date.now();
-                        this.#debugLog(`no-session-matched from ${remote.address}:${remote.port} (friend ${fid}) — desynced, re-initiating handshake`);
-                        void this.#initiateSession(fid).catch(() => undefined);
+                    if ((st.remote?.host === remote.address && st.remote?.port === remote.port) ||
+                        (st.endpointCandidates ?? []).some((c) => c.host === remote.address && c.port === remote.port)) {
+                        desyncedFid = fid;
+                        break;
                     }
-                    break;
+                }
+            }
+            if (desyncedFid) {
+                const st = this.#friendSessions.get(desyncedFid);
+                // Only a GENUINELY stuck session (no successful decrypt for a while) —
+                // never nuke a healthy one on a stray/late undecryptable packet — and
+                // rate-limited via a map that survives the delete.
+                const working = st.lastPingRecvMs !== undefined && Date.now() - st.lastPingRecvMs < REINIT_STUCK_MS;
+                const lastDel = this.#lastDesyncDeleteMs.get(desyncedFid) ?? 0;
+                if (!working && Date.now() - lastDel > REINIT_ON_DESYNC_MS) {
+                    this.#lastDesyncDeleteMs.set(desyncedFid, Date.now());
+                    this.#debugLog(`no-session-matched from ${remote.address} (friend ${desyncedFid}) — desynced, deleting session for clean re-handshake`);
+                    this.#friendSessions.delete(desyncedFid);
+                    void this.#initiateSession(desyncedFid).catch(() => undefined);
                 }
             }
             this.#debugVerboseLog(`crypto data received from ${remote.address}:${remote.port} but no session matched`);
@@ -3476,7 +3502,14 @@ export class Peer {
         // upgrading the path to direct UDP in both directions with no new
         // handshake. If UDP never works, the periodic offer re-punches.
         const haveRealUdp = session.remote && !session.remote.host?.startsWith("tcp:") && session.remote.port !== 0;
-        if (!haveRealUdp) {
+        // NEVER point the session at the public srflx when we know a same-LAN
+        // candidate for this peer: the physical LAN is strictly better, and letting
+        // the srflx win here caused a LAN↔public FLAP (the LAN block above set
+        // remote=LAN, then this overwrote it with the Tailscale-exit public IP),
+        // so the direct LAN path never stabilised and udpRecv never confirmed.
+        const haveLanCandidate = (session.endpointCandidates ?? []).some((c) => isPrivateAddress(c.host) && !isCgnatAddress(c.host) &&
+            getPhysicalLanSubnets().some((s) => isInIpv4Subnet(c.host, s)));
+        if (!haveRealUdp && !haveLanCandidate) {
             session.remote = { host, port };
         }
         // Nudge a keepalive out immediately so the upgrade doesn't wait for

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.62",
+  "version": "0.1.64",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",