@decentnetwork/peer 0.1.67 → 0.1.68

package/dist/peer.d.ts

@@ -201,6 +201,10 @@ export declare class Peer {
          *  peer (null = never). Used to confirm Phase 1.2 retries are
          *  actually firing. */
         cookieRequestSentMs: number | null;
+        /** The peer's physical-LAN host we've locked onto (set by the periodic
+         *  offer/maintenance LAN-adoption code). When set and equal to udpRemote's
+         *  host, the per-packet receive path refuses a public/hairpin downgrade. */
+        lanRemoteHost: string | null;
     } | null;
     waitForFriendRequest(timeoutMs?: number): Promise<FriendRequest>;
     /**

package/dist/peer.js

@@ -82,6 +82,11 @@ const FRIEND_PING_INTERVAL_MS = readEnvInt("DECENT_FRIEND_PING_INTERVAL_MS", 400
 // slow enough not to burn CPU on idle peers. Tunable via env.
 const FRIEND_CONNECTION_LOOP_MS = readEnvInt("DECENT_FRIEND_CONNECTION_LOOP_MS", 250);
 const FRIEND_TIMEOUT_MS = readEnvInt("DECENT_FRIEND_TIMEOUT_MS", 32000);
+// How long the direct UDP path may go without an inbound packet before we
+// release a physical-LAN lock (so a peer that left the LAN can recover onto the
+// public/relay path). 12s ≈ 3 missed 4s keepalives — long enough to never trip
+// on a healthy same-LAN path, short enough to recover quickly.
+const LAN_LOCK_STALE_MS = readEnvInt("DECENT_LAN_LOCK_STALE_MS", 12000);
 // Half-open breaker: if the peer proposes a NEW session key this many times over
 // this long while our session looks "alive", accept it (the peer can't decrypt
 // our current session — a desynced half-open session, observed as a flood of
@@ -1084,6 +1089,7 @@ export class Peer {
             endpointCandidatesCount: s.endpointCandidates?.length ?? 0,
             endpointCandidates: (s.endpointCandidates ?? []).map((c) => `${c.host}:${c.port}`),
             cookieRequestSentMs: s.cookieRequestSentMs ?? null,
+            lanRemoteHost: s.lanRemoteHost ?? null,
         };
     }
     waitForFriendRequest(timeoutMs = 30000) {
@@ -1386,7 +1392,13 @@ export class Peer {
                     state.hasTcpRoute = true;
                 }
                 else {
-                    state.remote = { host: remote.address, port: remote.port };
+                    // Same LAN-lock guard as the crypto-data path: a duplicate handshake
+                    // retransmitted via the public/hairpin endpoint must not knock us off
+                    // a locked physical-LAN path. Cheap string compare — no syscall.
+                    const lockedOnLan = !!state.lanRemoteHost && state.remote?.host === state.lanRemoteHost;
+                    if (!lockedOnLan || remote.address === state.lanRemoteHost) {
+                        state.remote = { host: remote.address, port: remote.port };
+                    }
                 }
                 state.lastPingRecvMs = Date.now();
                 this.#debugVerboseLog(`hs_recv duplicate friend=${friendId} remote=${remote.address}:${remote.port} (session preserved)`);
@@ -1476,7 +1488,13 @@ export class Peer {
                 // Don't set state.remote — there's no UDP endpoint for this peer.
             }
             else {
-                state.remote = { host: remote.address, port: remote.port };
+                // LAN-lock guard (see crypto-data path): don't let an establish/
+                // re-handshake arriving over the public/hairpin endpoint downgrade us
+                // off a locked physical-LAN path. Cheap string compare — no syscall.
+                const lockedOnLan = !!state.lanRemoteHost && state.remote?.host === state.lanRemoteHost;
+                if (!lockedOnLan || remote.address === state.lanRemoteHost) {
+                    state.remote = { host: remote.address, port: remote.port };
+                }
             }
             if (isNewSession) {
                 state.sendPacketNumber = 0;
@@ -3144,6 +3162,15 @@ export class Peer {
         session.endpointCandidates = next
             .sort((a, b) => b.updatedMs - a.updatedMs)
             .slice(0, 12);
+        // The moment we learn the peer's physical-LAN host candidate, record it as
+        // the LAN lock so the per-packet/handshake hot paths refuse a public/hairpin
+        // downgrade (cheap string compare there, no syscall). This runs at
+        // candidate-learn time (offer/discovery), not per packet, so the cached
+        // getPhysicalLanSubnets() call is fine here.
+        if (isPrivateAddress(host) && !isCgnatAddress(host) &&
+            getPhysicalLanSubnets().some((s) => isInIpv4Subnet(host, s))) {
+            session.lanRemoteHost = host;
+        }
     }
     /**
      * Learn our own server-reflexive (public) UDP endpoint by sending a
@@ -4061,6 +4088,17 @@ export class Peer {
             for (const [friendId, session] of this.#friendSessions.entries()) {
                 if (!session.established)
                     continue;
+                // Release a stale LAN lock. If we're locked onto a LAN host but the
+                // direct UDP path has gone quiet (peer left the LAN / changed network),
+                // the lock would otherwise block recovery onto the public/relay path.
+                // Clearing it lets the hot-path guard adopt a working endpoint again.
+                if (session.lanRemoteHost &&
+                    session.remote?.host === session.lanRemoteHost &&
+                    session.lastUdpRecvMs !== undefined &&
+                    Date.now() - session.lastUdpRecvMs > LAN_LOCK_STALE_MS) {
+                    this.#debugLog(`lan_lock_released friend=${friendId} host=${session.lanRemoteHost} (no direct UDP recv for >${LAN_LOCK_STALE_MS}ms)`);
+                    session.lanRemoteHost = undefined;
+                }
                 const r = session.remote;
                 const remoteIsSameLan = !!r && isPrivateAddress(r.host) && !isCgnatAddress(r.host) &&
                     getPhysicalLanSubnets().some((s) => isInIpv4Subnet(r.host, s));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.67",
+  "version": "0.1.68",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",