@decentnetwork/peer 0.1.68 → 0.1.69

package/dist/peer.js

@@ -1318,7 +1318,7 @@ export class Peer {
             // poison the UDP send-back path.
             const fromTcp = this.#remoteIsTcp(remote);
             if (!fromTcp) {
-                matchedSession.remote = { host: remote.address, port: remote.port };
+                this.#adoptRemote(matchedSession, remote.address, remote.port);
             }
             else {
                 matchedSession.hasTcpRoute = true;
@@ -1392,13 +1392,7 @@ export class Peer {
                     state.hasTcpRoute = true;
                 }
                 else {
-                    // Same LAN-lock guard as the crypto-data path: a duplicate handshake
-                    // retransmitted via the public/hairpin endpoint must not knock us off
-                    // a locked physical-LAN path. Cheap string compare — no syscall.
-                    const lockedOnLan = !!state.lanRemoteHost && state.remote?.host === state.lanRemoteHost;
-                    if (!lockedOnLan || remote.address === state.lanRemoteHost) {
-                        state.remote = { host: remote.address, port: remote.port };
-                    }
+                    this.#adoptRemote(state, remote.address, remote.port);
                 }
                 state.lastPingRecvMs = Date.now();
                 this.#debugVerboseLog(`hs_recv duplicate friend=${friendId} remote=${remote.address}:${remote.port} (session preserved)`);
@@ -1488,13 +1482,7 @@ export class Peer {
                 // Don't set state.remote — there's no UDP endpoint for this peer.
             }
             else {
-                // LAN-lock guard (see crypto-data path): don't let an establish/
-                // re-handshake arriving over the public/hairpin endpoint downgrade us
-                // off a locked physical-LAN path. Cheap string compare — no syscall.
-                const lockedOnLan = !!state.lanRemoteHost && state.remote?.host === state.lanRemoteHost;
-                if (!lockedOnLan || remote.address === state.lanRemoteHost) {
-                    state.remote = { host: remote.address, port: remote.port };
-                }
+                this.#adoptRemote(state, remote.address, remote.port);
             }
             if (isNewSession) {
                 state.sendPacketNumber = 0;
@@ -1664,22 +1652,12 @@ export class Peer {
                     state.lastRelayRecvMs = Date.now();
                 }
                 else {
-                    // Adopt the source as our send endpoint — but NEVER downgrade from a
-                    // locked same-LAN (physical) path to a non-LAN source (a hairpin packet
-                    // via the peer's public / Tailscale-exit endpoint must not knock us off
-                    // the direct LAN path, which is strictly better).
-                    //
-                    // CCTV-safe: the LAN decision (which needs a networkInterfaces() syscall)
-                    // is made ONLY in the periodic offer/maintenance paths, which record the
-                    // locked peer LAN host in state.lanRemoteHost. Here in the per-packet hot
-                    // path we do a single string compare — NO interface syscall — so a
-                    // high-rate stream (CCTV: thousands of packets/sec) never pays for it.
-                    // (The per-packet getPhysicalLanSubnets() call this replaces was the
-                    // CCTV CPU regression.)
-                    const lockedOnLan = !!state.lanRemoteHost && state.remote?.host === state.lanRemoteHost;
-                    if (!lockedOnLan || remote.address === state.lanRemoteHost) {
-                        state.remote = { host: remote.address, port: remote.port };
-                    }
+                    // Adopt the source as our send endpoint — via #adoptRemote, which
+                    // refuses to downgrade off a locked physical-LAN path to a public /
+                    // Tailscale-exit hairpin source. Cheap string compare, NO interface
+                    // syscall (that was the CCTV CPU regression) — safe at CCTV packet
+                    // rates.
+                    this.#adoptRemote(state, remote.address, remote.port);
                     if (!state.lastUdpRecvMs) {
                         this.#debugLog(`udp_confirmed friend=${friendId} via=${remote.address}:${remote.port} (direct UDP path live)`);
                     }
@@ -3146,7 +3124,7 @@ export class Peer {
             };
             this.#friendSessions.set(friendId, session);
         }
-        session.remote = { host, port };
+        this.#adoptRemote(session, host, port);
         this.#rememberEndpointCandidate(session, host, port);
         if (realPublicKey && !session.friendRealPublicKey) {
             session.friendRealPublicKey = realPublicKey;
@@ -3155,6 +3133,22 @@ export class Peer {
             session.friendDhtPublicKey = dhtPublicKey;
         }
     }
+    /** Single choke point for setting session.remote (the direct-UDP send
+     *  endpoint). Never downgrades off a LOCKED physical-LAN path to a non-LAN
+     *  endpoint (public srflx / Tailscale-exit hairpin): the LAN lock
+     *  (session.lanRemoteHost) is decided at candidate-learn / maintenance time —
+     *  the only places allowed the getPhysicalLanSubnets() syscall — so this guard
+     *  is just a string compare and is safe to call from the per-packet hot path.
+     *  Replacing the per-packet getPhysicalLanSubnets() call here was the fix for
+     *  the CCTV CPU regression. */
+    #adoptRemote(session, host, port) {
+        if (session.lanRemoteHost &&
+            session.remote?.host === session.lanRemoteHost &&
+            host !== session.lanRemoteHost) {
+            return; // stay locked on the physical-LAN path
+        }
+        session.remote = { host, port };
+    }
     #rememberEndpointCandidate(session, host, port) {
         const now = Date.now();
         const next = (session.endpointCandidates ?? []).filter((candidate) => !(candidate.host === host && candidate.port === port));
@@ -3499,7 +3493,7 @@ export class Peer {
         const haveLanCandidate = (session.endpointCandidates ?? []).some((c) => isPrivateAddress(c.host) && !isCgnatAddress(c.host) &&
             getPhysicalLanSubnets().some((s) => isInIpv4Subnet(c.host, s)));
         if (!haveRealUdp && !haveLanCandidate) {
-            session.remote = { host, port };
+            this.#adoptRemote(session, host, port);
         }
         // Nudge a keepalive out immediately so the upgrade doesn't wait for
         // the next periodic ALIVE — fans out over UDP (punched) + TCP.
@@ -3684,7 +3678,7 @@ export class Peer {
         if (tcpAvailable)
             session.hasTcpRoute = true;
         if (connectCandidates.length > 0) {
-            session.remote = connectCandidates[0];
+            this.#adoptRemote(session, connectCandidates[0].host, connectCandidates[0].port);
             const endpointKey = `${connectCandidates[0].host}:${connectCandidates[0].port}`;
             if (this.#lastEndpointSelectedKey.get(friendId) !== endpointKey) {
                 this.#debugLog(`endpoint_selected friend=${friendId} endpoint=${endpointKey}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.68",
+  "version": "0.1.69",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",