@decentnetwork/peer 0.1.68 → 0.1.70

package/dist/peer.js

@@ -82,6 +82,18 @@ const FRIEND_PING_INTERVAL_MS = readEnvInt("DECENT_FRIEND_PING_INTERVAL_MS", 400
 // slow enough not to burn CPU on idle peers. Tunable via env.
 const FRIEND_CONNECTION_LOOP_MS = readEnvInt("DECENT_FRIEND_CONNECTION_LOOP_MS", 250);
 const FRIEND_TIMEOUT_MS = readEnvInt("DECENT_FRIEND_TIMEOUT_MS", 32000);
+// A session whose keys we've PROVEN (decrypted ≥1 real packet from the peer) is
+// NOT torn down at FRIEND_TIMEOUT_MS. A transient all-transport blackout — e.g.
+// the GFW throttling a China<->abroad path for tens of seconds — must not trigger
+// a re-handshake: an ASYMMETRIC re-handshake (one side re-keys while the other
+// keeps its session) is exactly what desyncs the two sessions and produces the
+// connect/disconnect CHURN that breaks the exit. Instead we keep the proven keys
+// and keep probing over every transport; when the path recovers, a single packet
+// resumes the SAME session with no re-handshake. Only after this much longer hard
+// window do we treat the path as truly dead and re-handshake. (Unproven sessions
+// — established but never carried a packet — still tear down at FRIEND_TIMEOUT_MS
+// so a wedged handshake self-heals.)
+const PROVEN_SESSION_HARD_TIMEOUT_MS = readEnvInt("DECENT_PROVEN_SESSION_HARD_TIMEOUT_MS", 180_000);
 // How long the direct UDP path may go without an inbound packet before we
 // release a physical-LAN lock (so a peer that left the LAN can recover onto the
 // public/relay path). 12s ≈ 3 missed 4s keepalives — long enough to never trip
@@ -1318,7 +1330,7 @@ export class Peer {
             // poison the UDP send-back path.
             const fromTcp = this.#remoteIsTcp(remote);
             if (!fromTcp) {
-                matchedSession.remote = { host: remote.address, port: remote.port };
+                this.#adoptRemote(matchedSession, remote.address, remote.port);
             }
             else {
                 matchedSession.hasTcpRoute = true;
@@ -1392,13 +1404,7 @@ export class Peer {
                     state.hasTcpRoute = true;
                 }
                 else {
-                    // Same LAN-lock guard as the crypto-data path: a duplicate handshake
-                    // retransmitted via the public/hairpin endpoint must not knock us off
-                    // a locked physical-LAN path. Cheap string compare — no syscall.
-                    const lockedOnLan = !!state.lanRemoteHost && state.remote?.host === state.lanRemoteHost;
-                    if (!lockedOnLan || remote.address === state.lanRemoteHost) {
-                        state.remote = { host: remote.address, port: remote.port };
-                    }
+                    this.#adoptRemote(state, remote.address, remote.port);
                 }
                 state.lastPingRecvMs = Date.now();
                 this.#debugVerboseLog(`hs_recv duplicate friend=${friendId} remote=${remote.address}:${remote.port} (session preserved)`);
@@ -1488,13 +1494,7 @@ export class Peer {
                 // Don't set state.remote — there's no UDP endpoint for this peer.
             }
             else {
-                // LAN-lock guard (see crypto-data path): don't let an establish/
-                // re-handshake arriving over the public/hairpin endpoint downgrade us
-                // off a locked physical-LAN path. Cheap string compare — no syscall.
-                const lockedOnLan = !!state.lanRemoteHost && state.remote?.host === state.lanRemoteHost;
-                if (!lockedOnLan || remote.address === state.lanRemoteHost) {
-                    state.remote = { host: remote.address, port: remote.port };
-                }
+                this.#adoptRemote(state, remote.address, remote.port);
             }
             if (isNewSession) {
                 state.sendPacketNumber = 0;
@@ -1664,22 +1664,12 @@ export class Peer {
                     state.lastRelayRecvMs = Date.now();
                 }
                 else {
-                    // Adopt the source as our send endpoint — but NEVER downgrade from a
-                    // locked same-LAN (physical) path to a non-LAN source (a hairpin packet
-                    // via the peer's public / Tailscale-exit endpoint must not knock us off
-                    // the direct LAN path, which is strictly better).
-                    //
-                    // CCTV-safe: the LAN decision (which needs a networkInterfaces() syscall)
-                    // is made ONLY in the periodic offer/maintenance paths, which record the
-                    // locked peer LAN host in state.lanRemoteHost. Here in the per-packet hot
-                    // path we do a single string compare — NO interface syscall — so a
-                    // high-rate stream (CCTV: thousands of packets/sec) never pays for it.
-                    // (The per-packet getPhysicalLanSubnets() call this replaces was the
-                    // CCTV CPU regression.)
-                    const lockedOnLan = !!state.lanRemoteHost && state.remote?.host === state.lanRemoteHost;
-                    if (!lockedOnLan || remote.address === state.lanRemoteHost) {
-                        state.remote = { host: remote.address, port: remote.port };
-                    }
+                    // Adopt the source as our send endpoint — via #adoptRemote, which
+                    // refuses to downgrade off a locked physical-LAN path to a public /
+                    // Tailscale-exit hairpin source. Cheap string compare, NO interface
+                    // syscall (that was the CCTV CPU regression) — safe at CCTV packet
+                    // rates.
+                    this.#adoptRemote(state, remote.address, remote.port);
                     if (!state.lastUdpRecvMs) {
                         this.#debugLog(`udp_confirmed friend=${friendId} via=${remote.address}:${remote.port} (direct UDP path live)`);
                     }
@@ -2561,8 +2551,24 @@ export class Peer {
                 // non-established branch below, which re-initiates a fresh
                 // connection — turning a permanent wedge into a ~timeout self-heal.
                 const lastAlive = session.lastPingRecvMs ?? session.sessionEstablishedAtMs ?? now;
-                if (now - lastAlive > FRIEND_TIMEOUT_MS) {
-                    this.#debugLog(`session timeout for ${friendId} (no ping in ${now - lastAlive}ms; ` +
+                const silentFor = now - lastAlive;
+                // Proven = we've decrypted ≥1 real packet, so the keys are known-good and
+                // a silence is a transport blackout (GFW), not a desync. Give proven
+                // sessions a long grace so a blackout doesn't churn them via re-handshake;
+                // unproven sessions still time out fast to self-heal a wedged handshake.
+                const proven = session.lastPingRecvMs !== undefined;
+                const deadline = proven ? PROVEN_SESSION_HARD_TIMEOUT_MS : FRIEND_TIMEOUT_MS;
+                if (proven && silentFor > FRIEND_TIMEOUT_MS && silentFor <= deadline) {
+                    // Blackout grace: keep the proven session and keep probing (the
+                    // keepalive + UDP re-punch + relay-keepalive below all still run). Do
+                    // NOT delete or re-handshake — that's what desyncs and churns. The peer,
+                    // running the same logic, also keeps its half, so when the path recovers
+                    // both resume in sync. Status stays as-is; the exit's own health probe
+                    // (multi-exit router) handles failover meanwhile.
+                    this.#debugVerboseLog(`session blackout-grace ${friendId} (silent ${silentFor}ms, proven — keeping keys, not re-handshaking)`);
+                }
+                else if (silentFor > deadline) {
+                    this.#debugLog(`session timeout for ${friendId} (no ping in ${silentFor}ms, proven=${proven}; ` +
                         `lastPingRecv=${session.lastPingRecvMs ?? "never"}) — tearing down to re-handshake`);
                     this.#friendSessions.delete(friendId);
                     this.#setFriendOffline(friendId);
@@ -3146,7 +3152,7 @@ export class Peer {
             };
             this.#friendSessions.set(friendId, session);
         }
-        session.remote = { host, port };
+        this.#adoptRemote(session, host, port);
         this.#rememberEndpointCandidate(session, host, port);
         if (realPublicKey && !session.friendRealPublicKey) {
             session.friendRealPublicKey = realPublicKey;
@@ -3155,6 +3161,22 @@ export class Peer {
             session.friendDhtPublicKey = dhtPublicKey;
         }
     }
+    /** Single choke point for setting session.remote (the direct-UDP send
+     *  endpoint). Never downgrades off a LOCKED physical-LAN path to a non-LAN
+     *  endpoint (public srflx / Tailscale-exit hairpin): the LAN lock
+     *  (session.lanRemoteHost) is decided at candidate-learn / maintenance time —
+     *  the only places allowed the getPhysicalLanSubnets() syscall — so this guard
+     *  is just a string compare and is safe to call from the per-packet hot path.
+     *  Replacing the per-packet getPhysicalLanSubnets() call here was the fix for
+     *  the CCTV CPU regression. */
+    #adoptRemote(session, host, port) {
+        if (session.lanRemoteHost &&
+            session.remote?.host === session.lanRemoteHost &&
+            host !== session.lanRemoteHost) {
+            return; // stay locked on the physical-LAN path
+        }
+        session.remote = { host, port };
+    }
     #rememberEndpointCandidate(session, host, port) {
         const now = Date.now();
         const next = (session.endpointCandidates ?? []).filter((candidate) => !(candidate.host === host && candidate.port === port));
@@ -3499,7 +3521,7 @@ export class Peer {
         const haveLanCandidate = (session.endpointCandidates ?? []).some((c) => isPrivateAddress(c.host) && !isCgnatAddress(c.host) &&
             getPhysicalLanSubnets().some((s) => isInIpv4Subnet(c.host, s)));
         if (!haveRealUdp && !haveLanCandidate) {
-            session.remote = { host, port };
+            this.#adoptRemote(session, host, port);
         }
         // Nudge a keepalive out immediately so the upgrade doesn't wait for
         // the next periodic ALIVE — fans out over UDP (punched) + TCP.
@@ -3684,7 +3706,7 @@ export class Peer {
         if (tcpAvailable)
             session.hasTcpRoute = true;
         if (connectCandidates.length > 0) {
-            session.remote = connectCandidates[0];
+            this.#adoptRemote(session, connectCandidates[0].host, connectCandidates[0].port);
             const endpointKey = `${connectCandidates[0].host}:${connectCandidates[0].port}`;
             if (this.#lastEndpointSelectedKey.get(friendId) !== endpointKey) {
                 this.#debugLog(`endpoint_selected friend=${friendId} endpoint=${endpointKey}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decentnetwork/peer",
-  "version": "0.1.68",
+  "version": "0.1.70",
   "description": "Pure TypeScript port of Elastos Carrier (toxcore-derived) P2P messaging. DHT, onion routing, TCP relay, FlatBuffers app payloads, Express offline relay. Wire-compatible with iOS Beagle and the Carrier C SDK.",
   "type": "module",
   "main": "./dist/index.js",