@decentnetwork/peer 0.1.63 → 0.1.65

package/dist/peer.js

@@ -92,7 +92,13 @@ const REHS_ACCEPT_MS = readEnvInt("DECENT_REHS_ACCEPT_MS", 2500);
 const REHS_WINDOW_MS = readEnvInt("DECENT_REHS_WINDOW_MS", 8000);
 // Re-handshake when we keep receiving undecryptable crypto data from a known
 // friend's endpoint (desynced sessions), rate-limited per friend.
-const REINIT_ON_DESYNC_MS = readEnvInt("DECENT_REINIT_ON_DESYNC_MS", 2000);
+// Conservative: deleting a session forces a re-handshake which ROTATES our
+// ephemeral key, so doing it too eagerly turns a transient blip into a
+// rotate→desync→delete thrash. Only nuke a session that's been UNABLE to
+// decrypt anything for a long time (genuinely dead, well past any
+// establishment-transition window), and at most once per long interval.
+const REINIT_ON_DESYNC_MS = readEnvInt("DECENT_REINIT_ON_DESYNC_MS", 12000);
+const REINIT_STUCK_MS = readEnvInt("DECENT_REINIT_STUCK_MS", 20000);
 // How long a relay path stays "confirmed" (carrying bulk data on its own, no
 // tcp-relay fan-out) after the last packet received over it. The relay
 // keepalive refreshes this every ~4s on a healthy path, so a generous window
@@ -267,6 +273,9 @@ export class Peer {
     // #initiateSession every few seconds for every friend; without this
     // dedupe, lower-pubkey side floods the log with "deferring to peer".
     #initiateSkipLogged = new Set();
+    // Per-friend last time we deleted a desynced session (rate-limit; survives the
+    // session deletion, unlike a field on the session object itself).
+    #lastDesyncDeleteMs = new Map();
     // Cached server-reflexive (public) UDP endpoint of our #udp socket,
     // learned via STUN. Cone-NAT mappings are stable for the socket
     // lifetime, so we only re-probe every ~60s. Used to tell friends where
@@ -1447,30 +1456,13 @@ export class Peer {
                 const lastAlive = state.lastPingRecvMs ?? state.sessionEstablishedAtMs;
                 const currentSessionAlive = Date.now() - lastAlive < FRIEND_TIMEOUT_MS;
                 if (sinceEstablished > 1000 && currentSessionAlive) {
-                    // Half-open breaker. Our session looks alive — but "alive" only means
-                    // WE are receiving (possibly only over the relay). If the peer KEEPS
-                    // proposing a new key, THEIR side can't decrypt our packets: a desynced
-                    // half-open session (observed snoopy↔mac on one LAN as 288k "no session
-                    // matched"). Rejecting forever deadlocks. So count sustained attempts
-                    // and, past the threshold, accept the new key to re-converge. Bounded
-                    // to sustained attempts so it never disturbs a healthy session.
-                    const now = Date.now();
-                    if (state.rehsFirstMs === undefined || now - (state.rehsLastMs ?? 0) > REHS_WINDOW_MS) {
-                        state.rehsFirstMs = now;
-                        state.rehsCount = 0;
-                    }
-                    state.rehsLastMs = now;
-                    state.rehsCount = (state.rehsCount ?? 0) + 1;
-                    const stuck = state.rehsCount >= REHS_ACCEPT_COUNT && now - state.rehsFirstMs >= REHS_ACCEPT_MS;
-                    if (!stuck) {
-                        this.#debugVerboseLog(`hs_recv ignored friend=${friendId} (new session pubkey on live session, attempt ${state.rehsCount}, ${sinceEstablished}ms after establish)`);
-                        return;
-                    }
-                    this.#debugLog(`hs_recv accepting re-handshake friend=${friendId} (half-open breaker: ${state.rehsCount} new-key attempts over ${now - state.rehsFirstMs}ms — peer can't decrypt our session)`);
+                    // Reject a new-key handshake while our session is alive — toxcore does
+                    // the same. (The "half-open breaker" that accepted these after N tries
+                    // was reverted: accepting a new key ROTATES the session, which churned
+                    // healthy sessions; the real fix was the TURN-crash fix, not this.)
+                    this.#debugVerboseLog(`hs_recv ignored friend=${friendId} (new session pubkey on live established session, ${sinceEstablished}ms after establish)`);
+                    return;
                 }
-                // Converging on a fresh session — clear the breaker counter.
-                state.rehsCount = 0;
-                state.rehsFirstMs = undefined;
                 this.#debugLog(`hs_recv accepting re-handshake friend=${friendId} (current session wedged/dead, ` +
                     `lastPingRecv=${state.lastPingRecvMs ? Date.now() - state.lastPingRecvMs + "ms ago" : "never"})`);
             }
@@ -1832,26 +1824,15 @@ export class Peer {
                 this.#debugVerboseLog(`unknown messenger packet kind ${kind} from ${friendId}`);
                 return;
             }
-            // We received crypto data we can't decrypt from a KNOWN friend's endpoint:
-            // our two sessions are desynced (different keys) and NEITHER side will
-            // re-handshake on its own, because each believes it is still established
-            // (the half-open breaker can't help — no handshakes are being exchanged).
-            // Kick a fresh handshake so we re-converge. Rate-limited per friend so a
-            // flood of undecryptable packets doesn't spam cookie requests.
-            if (!this.#remoteIsTcp(remote) && !viaRelay) {
-                for (const [fid, st] of this.#friendSessions.entries()) {
-                    const matches = (st.remote?.host === remote.address && st.remote?.port === remote.port) ||
-                        (st.endpointCandidates ?? []).some((c) => c.host === remote.address && c.port === remote.port);
-                    if (!matches)
-                        continue;
-                    if (Date.now() - (st.lastReinitMs ?? 0) > REINIT_ON_DESYNC_MS) {
-                        st.lastReinitMs = Date.now();
-                        this.#debugLog(`no-session-matched from ${remote.address}:${remote.port} (friend ${fid}) — desynced, re-initiating handshake`);
-                        void this.#initiateSession(fid).catch(() => undefined);
-                    }
-                    break;
-                }
-            }
+            // Reverted: we used to DELETE a "desynced" session here to force a clean
+            // re-handshake. It caused more harm than good — deleting a session
+            // interrupts the data plane, and a transient/late undecryptable packet
+            // (common over the relay) triggered a delete→re-key→re-desync thrash that
+            // churned MANY friends' sessions (observed: CCTV jitter + slow file
+            // transfer to 4090, not just snoopy). The real instability was the daemon
+            // CRASH (TURN DNS); with that fixed, sessions stay converged on their own.
+            // Just drop the undecryptable packet — net_crypto's normal re-handshake
+            // path recovers a genuinely dead session.
             this.#debugVerboseLog(`crypto data received from ${remote.address}:${remote.port} but no session matched`);
             return;
         }
@@ -5046,50 +5027,53 @@ function isCgnatAddress(host) {
 }
 /** Local IPv4 addresses on PHYSICAL interfaces only (excludes overlay/virtual
  *  interfaces by name and the CGNAT range). Used for LAN-direct host candidates. */
-function getPhysicalLanAddresses() {
-    const out = [];
+// CACHED interface enumeration. getPhysicalLanSubnets/Addresses are called on
+// the receive hot path (the same-LAN downgrade guard runs per packet); calling
+// networkInterfaces() — a syscall — for every CRYPTO_DATA packet pegged the CPU
+// on a high-rate stream (CCTV jitter/instability). Cache the result for 5s; LAN
+// interfaces almost never change, so this is safe and ~free.
+let _lanIfaceCacheMs = 0;
+let _lanAddrsCache = [];
+let _lanSubnetsCache = [];
+function refreshLanIfaceCache() {
+    const now = Date.now();
+    if (_lanIfaceCacheMs !== 0 && now - _lanIfaceCacheMs < 5000)
+        return;
+    _lanIfaceCacheMs = now;
+    const addrs = [];
+    const subnets = [];
     try {
         for (const [name, list] of Object.entries(networkInterfaces())) {
             if (!list || VIRTUAL_IFACE_RE.test(name))
                 continue;
             for (const info of list) {
-                if (info.family !== "IPv4" || info.internal)
-                    continue;
-                if (isCgnatAddress(info.address))
+                if (info.family !== "IPv4" || info.internal || isCgnatAddress(info.address))
                     continue;
-                out.push(info.address);
+                addrs.push(info.address);
+                const addr = ipv4ToInt(info.address);
+                const mask = netmaskToInt(info.netmask);
+                if (addr !== undefined && mask !== undefined && mask !== 0) {
+                    subnets.push({ networkBits: (addr & mask) >>> 0, maskBits: mask });
+                }
             }
         }
     }
     catch {
         // best-effort
     }
-    return out;
+    _lanAddrsCache = addrs;
+    _lanSubnetsCache = subnets;
+}
+function getPhysicalLanAddresses() {
+    refreshLanIfaceCache();
+    return _lanAddrsCache;
 }
 /** Subnets of PHYSICAL interfaces only — for matching a peer's host candidate
  *  to OUR real LAN (so we never match a peer's Tailscale/TUN address against our
- *  own overlay subnet). */
+ *  own overlay subnet). Cached (see refreshLanIfaceCache). */
 function getPhysicalLanSubnets() {
-    const out = [];
-    try {
-        for (const [name, list] of Object.entries(networkInterfaces())) {
-            if (!list || VIRTUAL_IFACE_RE.test(name))
-                continue;
-            for (const info of list) {
-                if (info.family !== "IPv4" || info.internal || isCgnatAddress(info.address))
-                    continue;
-                const addr = ipv4ToInt(info.address);
-                const mask = netmaskToInt(info.netmask);
-                if (addr === undefined || mask === undefined || mask === 0)
-                    continue;
-                out.push({ networkBits: (addr & mask) >>> 0, maskBits: mask });
-            }
-        }
-    }
-    catch {
-        // best-effort
-    }
-    return out;
+    refreshLanIfaceCache();
+    return _lanSubnetsCache;
 }
 function isPrivateAddress(host) {
     // RFC1918 IPv4: 10/8, 172.16/12, 192.168/16; loopback 127/8;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.63",
+  "version": "0.1.65",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",