@decentnetwork/peer 0.1.67 → 0.1.69

package/dist/peer.d.ts

@@ -201,6 +201,10 @@ export declare class Peer {
          *  peer (null = never). Used to confirm Phase 1.2 retries are
          *  actually firing. */
         cookieRequestSentMs: number | null;
+        /** The peer's physical-LAN host we've locked onto (set by the periodic
+         *  offer/maintenance LAN-adoption code). When set and equal to udpRemote's
+         *  host, the per-packet receive path refuses a public/hairpin downgrade. */
+        lanRemoteHost: string | null;
     } | null;
     waitForFriendRequest(timeoutMs?: number): Promise<FriendRequest>;
     /**

package/dist/peer.js

@@ -82,6 +82,11 @@ const FRIEND_PING_INTERVAL_MS = readEnvInt("DECENT_FRIEND_PING_INTERVAL_MS", 400
 // slow enough not to burn CPU on idle peers. Tunable via env.
 const FRIEND_CONNECTION_LOOP_MS = readEnvInt("DECENT_FRIEND_CONNECTION_LOOP_MS", 250);
 const FRIEND_TIMEOUT_MS = readEnvInt("DECENT_FRIEND_TIMEOUT_MS", 32000);
+// How long the direct UDP path may go without an inbound packet before we
+// release a physical-LAN lock (so a peer that left the LAN can recover onto the
+// public/relay path). 12s ≈ 3 missed 4s keepalives — long enough to never trip
+// on a healthy same-LAN path, short enough to recover quickly.
+const LAN_LOCK_STALE_MS = readEnvInt("DECENT_LAN_LOCK_STALE_MS", 12000);
 // Half-open breaker: if the peer proposes a NEW session key this many times over
 // this long while our session looks "alive", accept it (the peer can't decrypt
 // our current session — a desynced half-open session, observed as a flood of
@@ -1084,6 +1089,7 @@ export class Peer {
             endpointCandidatesCount: s.endpointCandidates?.length ?? 0,
             endpointCandidates: (s.endpointCandidates ?? []).map((c) => `${c.host}:${c.port}`),
             cookieRequestSentMs: s.cookieRequestSentMs ?? null,
+            lanRemoteHost: s.lanRemoteHost ?? null,
         };
     }
     waitForFriendRequest(timeoutMs = 30000) {
@@ -1312,7 +1318,7 @@ export class Peer {
             // poison the UDP send-back path.
             const fromTcp = this.#remoteIsTcp(remote);
             if (!fromTcp) {
-                matchedSession.remote = { host: remote.address, port: remote.port };
+                this.#adoptRemote(matchedSession, remote.address, remote.port);
             }
             else {
                 matchedSession.hasTcpRoute = true;
@@ -1386,7 +1392,7 @@ export class Peer {
                     state.hasTcpRoute = true;
                 }
                 else {
-                    state.remote = { host: remote.address, port: remote.port };
+                    this.#adoptRemote(state, remote.address, remote.port);
                 }
                 state.lastPingRecvMs = Date.now();
                 this.#debugVerboseLog(`hs_recv duplicate friend=${friendId} remote=${remote.address}:${remote.port} (session preserved)`);
@@ -1476,7 +1482,7 @@ export class Peer {
                 // Don't set state.remote — there's no UDP endpoint for this peer.
             }
             else {
-                state.remote = { host: remote.address, port: remote.port };
+                this.#adoptRemote(state, remote.address, remote.port);
             }
             if (isNewSession) {
                 state.sendPacketNumber = 0;
@@ -1646,22 +1652,12 @@ export class Peer {
                     state.lastRelayRecvMs = Date.now();
                 }
                 else {
-                    // Adopt the source as our send endpoint — but NEVER downgrade from a
-                    // locked same-LAN (physical) path to a non-LAN source (a hairpin packet
-                    // via the peer's public / Tailscale-exit endpoint must not knock us off
-                    // the direct LAN path, which is strictly better).
-                    //
-                    // CCTV-safe: the LAN decision (which needs a networkInterfaces() syscall)
-                    // is made ONLY in the periodic offer/maintenance paths, which record the
-                    // locked peer LAN host in state.lanRemoteHost. Here in the per-packet hot
-                    // path we do a single string compare — NO interface syscall — so a
-                    // high-rate stream (CCTV: thousands of packets/sec) never pays for it.
-                    // (The per-packet getPhysicalLanSubnets() call this replaces was the
-                    // CCTV CPU regression.)
-                    const lockedOnLan = !!state.lanRemoteHost && state.remote?.host === state.lanRemoteHost;
-                    if (!lockedOnLan || remote.address === state.lanRemoteHost) {
-                        state.remote = { host: remote.address, port: remote.port };
-                    }
+                    // Adopt the source as our send endpoint — via #adoptRemote, which
+                    // refuses to downgrade off a locked physical-LAN path to a public /
+                    // Tailscale-exit hairpin source. Cheap string compare, NO interface
+                    // syscall (that was the CCTV CPU regression) — safe at CCTV packet
+                    // rates.
+                    this.#adoptRemote(state, remote.address, remote.port);
                     if (!state.lastUdpRecvMs) {
                         this.#debugLog(`udp_confirmed friend=${friendId} via=${remote.address}:${remote.port} (direct UDP path live)`);
                     }
@@ -3128,7 +3124,7 @@ export class Peer {
             };
             this.#friendSessions.set(friendId, session);
         }
-        session.remote = { host, port };
+        this.#adoptRemote(session, host, port);
         this.#rememberEndpointCandidate(session, host, port);
         if (realPublicKey && !session.friendRealPublicKey) {
             session.friendRealPublicKey = realPublicKey;
@@ -3137,6 +3133,22 @@ export class Peer {
             session.friendDhtPublicKey = dhtPublicKey;
         }
     }
+    /** Single choke point for setting session.remote (the direct-UDP send
+     *  endpoint). Never downgrades off a LOCKED physical-LAN path to a non-LAN
+     *  endpoint (public srflx / Tailscale-exit hairpin): the LAN lock
+     *  (session.lanRemoteHost) is decided at candidate-learn / maintenance time —
+     *  the only places allowed the getPhysicalLanSubnets() syscall — so this guard
+     *  is just a string compare and is safe to call from the per-packet hot path.
+     *  Replacing the per-packet getPhysicalLanSubnets() call here was the fix for
+     *  the CCTV CPU regression. */
+    #adoptRemote(session, host, port) {
+        if (session.lanRemoteHost &&
+            session.remote?.host === session.lanRemoteHost &&
+            host !== session.lanRemoteHost) {
+            return; // stay locked on the physical-LAN path
+        }
+        session.remote = { host, port };
+    }
     #rememberEndpointCandidate(session, host, port) {
         const now = Date.now();
         const next = (session.endpointCandidates ?? []).filter((candidate) => !(candidate.host === host && candidate.port === port));
@@ -3144,6 +3156,15 @@ export class Peer {
         session.endpointCandidates = next
             .sort((a, b) => b.updatedMs - a.updatedMs)
             .slice(0, 12);
+        // The moment we learn the peer's physical-LAN host candidate, record it as
+        // the LAN lock so the per-packet/handshake hot paths refuse a public/hairpin
+        // downgrade (cheap string compare there, no syscall). This runs at
+        // candidate-learn time (offer/discovery), not per packet, so the cached
+        // getPhysicalLanSubnets() call is fine here.
+        if (isPrivateAddress(host) && !isCgnatAddress(host) &&
+            getPhysicalLanSubnets().some((s) => isInIpv4Subnet(host, s))) {
+            session.lanRemoteHost = host;
+        }
     }
     /**
      * Learn our own server-reflexive (public) UDP endpoint by sending a
@@ -3472,7 +3493,7 @@ export class Peer {
         const haveLanCandidate = (session.endpointCandidates ?? []).some((c) => isPrivateAddress(c.host) && !isCgnatAddress(c.host) &&
             getPhysicalLanSubnets().some((s) => isInIpv4Subnet(c.host, s)));
         if (!haveRealUdp && !haveLanCandidate) {
-            session.remote = { host, port };
+            this.#adoptRemote(session, host, port);
         }
         // Nudge a keepalive out immediately so the upgrade doesn't wait for
         // the next periodic ALIVE — fans out over UDP (punched) + TCP.
@@ -3657,7 +3678,7 @@ export class Peer {
         if (tcpAvailable)
             session.hasTcpRoute = true;
         if (connectCandidates.length > 0) {
-            session.remote = connectCandidates[0];
+            this.#adoptRemote(session, connectCandidates[0].host, connectCandidates[0].port);
             const endpointKey = `${connectCandidates[0].host}:${connectCandidates[0].port}`;
             if (this.#lastEndpointSelectedKey.get(friendId) !== endpointKey) {
                 this.#debugLog(`endpoint_selected friend=${friendId} endpoint=${endpointKey}`);
@@ -4061,6 +4082,17 @@ export class Peer {
             for (const [friendId, session] of this.#friendSessions.entries()) {
                 if (!session.established)
                     continue;
+                // Release a stale LAN lock. If we're locked onto a LAN host but the
+                // direct UDP path has gone quiet (peer left the LAN / changed network),
+                // the lock would otherwise block recovery onto the public/relay path.
+                // Clearing it lets the hot-path guard adopt a working endpoint again.
+                if (session.lanRemoteHost &&
+                    session.remote?.host === session.lanRemoteHost &&
+                    session.lastUdpRecvMs !== undefined &&
+                    Date.now() - session.lastUdpRecvMs > LAN_LOCK_STALE_MS) {
+                    this.#debugLog(`lan_lock_released friend=${friendId} host=${session.lanRemoteHost} (no direct UDP recv for >${LAN_LOCK_STALE_MS}ms)`);
+                    session.lanRemoteHost = undefined;
+                }
                 const r = session.remote;
                 const remoteIsSameLan = !!r && isPrivateAddress(r.host) && !isCgnatAddress(r.host) &&
                     getPhysicalLanSubnets().some((s) => isInIpv4Subnet(r.host, s));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.67",
+  "version": "0.1.69",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",