librats 1.0.2 → 2.2.0

package/native-src/src/librats_discovery.cpp

@@ -1,402 +0,0 @@
-#include "librats.h"
-#include "librats_log_macros.h"
-#include "sha1.h"
-
-namespace librats {
-
-// =========================================================================
-// Peer Discovery Methods
-// =========================================================================
-
-bool RatsClient::start_dht_discovery(int dht_port) {
-    if (dht_client_ && dht_client_->is_running()) {
-        LOG_CLIENT_WARN("DHT discovery is already running");
-        return true;
-    }
-
-    LOG_CLIENT_INFO("Starting DHT discovery on port " << dht_port <<
-                   (bind_address_.empty() ? "" : " bound to " + bind_address_));
-
-    auto bootstrap_nodes = DhtClient::get_default_bootstrap_nodes();
-
-    // IPv4 DHT (also shared with the BitTorrent subsystem) - required.
-    dht_client_ = std::make_unique<DhtClient>(dht_port, bind_address_, data_directory_, AddressFamily::IPv4);
-    if (!dht_client_->start()) {
-        LOG_CLIENT_ERROR("Failed to start IPv4 DHT client");
-        dht_client_.reset();
-        return false;
-    }
-    if (!dht_client_->bootstrap(bootstrap_nodes)) {
-        LOG_CLIENT_WARN("Failed to bootstrap IPv4 DHT");
-    }
-
-    // IPv6 DHT - best effort. Shares the same port via a V6ONLY socket. If the host has
-    // no usable IPv6 stack, socket creation fails and we simply run IPv4-only.
-    dht_client_v6_ = std::make_unique<DhtClient>(dht_port, bind_address_, data_directory_, AddressFamily::IPv6);
-    if (dht_client_v6_->start()) {
-        if (!dht_client_v6_->bootstrap(bootstrap_nodes)) {
-            LOG_CLIENT_WARN("Failed to bootstrap IPv6 DHT");
-        }
-        LOG_CLIENT_INFO("IPv6 DHT client started");
-    } else {
-        LOG_CLIENT_INFO("IPv6 DHT unavailable on this host, running IPv4-only");
-        dht_client_v6_.reset();
-    }
-
-    // Forward the DHT's UDP port through the router, in addition to the TCP peer
-    // port mapped at start(). Like libtorrent (which maps both the TCP listen port
-    // and the UDP DHT/uTP port per listen socket), this makes the node reachable by
-    // inbound DHT traffic behind NAT. No-op when port mapping is disabled; the
-    // mapping uses external==internal so outgoing queries and inbound packets share
-    // one public port. The backends wake their workers to install it immediately.
-    // Use the *actual* bound port: start() may have fallen back to an ephemeral one
-    // when the requested dht_port was taken.
-    uint16_t bound_dht_port = dht_client_->get_port();
-    if (bound_dht_port != 0) {
-        add_port_mapping(PortMapProtocol::UDP, bound_dht_port);
-    }
-
-    // Start automatic peer discovery (this thread also performs the best-effort STUN probe
-    // that derives our BEP 42 node ID — see automatic_discovery_loop).
-    start_automatic_peer_discovery();
-
-    LOG_CLIENT_INFO("DHT discovery started successfully");
-    return true;
-}
-
-void RatsClient::stop_dht_discovery() {
-    if (!dht_client_ && !dht_client_v6_) {
-        return;
-    }
-
-    LOG_CLIENT_INFO("Stopping DHT discovery");
-
-    // Stop automatic peer discovery
-    stop_automatic_peer_discovery();
-
-    if (dht_client_) {
-        dht_client_->stop();
-        dht_client_.reset();
-    }
-    if (dht_client_v6_) {
-        dht_client_v6_->stop();
-        dht_client_v6_.reset();
-    }
-    LOG_CLIENT_INFO("DHT discovery stopped");
-}
-
-bool RatsClient::find_peers_by_hash(const std::string& content_hash, std::function<void(const std::vector<std::string>&)> callback) {
-    if (!is_dht_running()) {
-        LOG_CLIENT_ERROR("DHT client not running");
-        return false;
-    }
-
-    if (content_hash.length() != CONTENT_HASH_HEX_LENGTH) {
-        LOG_CLIENT_ERROR("Invalid content hash length: " << content_hash.length() << " (expected " << CONTENT_HASH_HEX_LENGTH << ")");
-        return false;
-    }
-
-    LOG_CLIENT_INFO("Finding peers for content hash: " << content_hash);
-
-    InfoHash info_hash = hex_to_node_id(content_hash);
-
-    // Shared wrapper: discovered peers (IPv4 or IPv6) are delivered through the same callback.
-    PeerDiscoveryCallback peer_callback = [callback](const std::vector<Peer>& peers, const InfoHash&) {
-        std::vector<std::string> peer_addresses;
-        peer_addresses.reserve(peers.size());
-        for (const auto& peer : peers) {
-            peer_addresses.emplace_back(peer.ip + ":" + std::to_string(peer.port));
-        }
-        if (callback) {
-            callback(peer_addresses);
-        }
-    };
-
-    // Fan out to both Kademlia networks; succeed if at least one accepts the search.
-    bool started = false;
-    if (dht_client_ && dht_client_->is_running()) {
-        started |= dht_client_->find_peers(info_hash, peer_callback);
-    }
-    if (dht_client_v6_ && dht_client_v6_->is_running()) {
-        started |= dht_client_v6_->find_peers(info_hash, peer_callback);
-    }
-    return started;
-}
-
-bool RatsClient::announce_for_hash(const std::string& content_hash, uint16_t port,
-                                   std::function<void(const std::vector<std::string>&)> callback) {
-    if (!is_dht_running()) {
-        LOG_CLIENT_ERROR("DHT client not running");
-        return false;
-    }
-
-    if (content_hash.length() != CONTENT_HASH_HEX_LENGTH) {
-        LOG_CLIENT_ERROR("Invalid content hash length: " << content_hash.length() << " (expected " << CONTENT_HASH_HEX_LENGTH << ")");
-        return false;
-    }
-
-    if (port == 0) {
-        port = listen_port_;
-    }
-
-    LOG_CLIENT_INFO("Announcing for content hash: " << content_hash << " on port " << port
-                   << (callback ? " with peer callback" : ""));
-
-    InfoHash info_hash = hex_to_node_id(content_hash);
-
-    // Create wrapper callback that converts Peer to string addresses (if callback provided)
-    PeerDiscoveryCallback peer_callback = nullptr;
-    if (callback) {
-        peer_callback = [callback](const std::vector<Peer>& peers, const InfoHash& hash) {
-            std::vector<std::string> peer_addresses;
-            peer_addresses.reserve(peers.size());
-            for (const auto& peer : peers) {
-                peer_addresses.push_back(peer.ip + ":" + std::to_string(peer.port));
-            }
-            callback(peer_addresses);
-        };
-    }
-
-    // Announce on both Kademlia networks so IPv4 and IPv6 peers can both find us.
-    bool started = false;
-    if (dht_client_ && dht_client_->is_running()) {
-        started |= dht_client_->announce_peer(info_hash, port, peer_callback);
-    }
-    if (dht_client_v6_ && dht_client_v6_->is_running()) {
-        started |= dht_client_v6_->announce_peer(info_hash, port, peer_callback);
-    }
-    return started;
-}
-
-bool RatsClient::is_dht_running() const {
-    return (dht_client_ && dht_client_->is_running()) ||
-           (dht_client_v6_ && dht_client_v6_->is_running());
-}
-
-size_t RatsClient::get_dht_routing_table_size() const {
-    size_t total = 0;
-    if (dht_client_) {
-        total += dht_client_->get_routing_table_size();
-    }
-    if (dht_client_v6_) {
-        total += dht_client_v6_->get_routing_table_size();
-    }
-    return total;
-}
-
-void RatsClient::handle_dht_peer_discovery(const std::vector<Peer>& peers, const InfoHash& info_hash) {
-    LOG_CLIENT_INFO("DHT discovered " << peers.size() << " peers for info hash: " << node_id_to_hex(info_hash));
-    
-    // Auto-connect to discovered peers
-    for (const auto& peer : peers) {
-        if (!can_connect_to_peer(peer.ip, peer.port)) {
-            continue;
-        }
-        
-        LOG_CLIENT_DEBUG("Attempting to connect to discovered peer: " << peer.ip << ":" << peer.port);
-        
-        // Try to connect to the peer (non-blocking, managed thread for graceful shutdown)
-        add_managed_thread(std::thread([this, peer]() {
-            if (connect_to_peer(peer.ip, peer.port)) {
-                LOG_CLIENT_INFO("Successfully connected to DHT discovered peer: " << peer.ip << ":" << peer.port);
-            } else {
-                LOG_CLIENT_DEBUG("Failed to connect to DHT discovered peer: " << peer.ip << ":" << peer.port);
-            }
-        }), "dht-connect-" + peer.ip);
-    }
-}
-
-void RatsClient::start_automatic_peer_discovery() {
-    if (auto_discovery_running_.load()) {
-        LOG_CLIENT_WARN("Automatic peer discovery is already running");
-        return;
-    }
-    
-    LOG_CLIENT_INFO("Starting automatic rats peer discovery");
-    auto_discovery_running_.store(true);
-    auto_discovery_thread_ = std::thread(&RatsClient::automatic_discovery_loop, this);
-}
-
-void RatsClient::stop_automatic_peer_discovery() {
-    if (!auto_discovery_running_.load()) {
-        return;
-    }
-    
-    LOG_CLIENT_INFO("Stopping automatic peer discovery");
-    auto_discovery_running_.store(false);
-    
-    if (auto_discovery_thread_.joinable()) {
-        auto_discovery_thread_.join();
-    }
-    
-    LOG_CLIENT_INFO("Automatic peer discovery stopped");
-}
-
-bool RatsClient::is_automatic_discovery_running() const {
-    return auto_discovery_running_.load();
-}
-
-std::chrono::seconds RatsClient::calculate_discovery_interval() const {
-    int peer_count = get_peer_count();
-    
-    // No peers - aggressive discovery
-    if (peer_count == 0) {
-        return std::chrono::seconds(15);
-    }
-    
-    // Calculate fill ratio
-    float fill_ratio = static_cast<float>(peer_count) / static_cast<float>(max_peers_);
-    
-    // Graduated intervals based on fill ratio
-    if (fill_ratio < 0.25f) {
-        // Less than 25% full - still fairly aggressive
-        return std::chrono::seconds(60);       // 1 minute
-    } else if (fill_ratio < 0.50f) {
-        // 25-50% full - moderate
-        return std::chrono::seconds(180);      // 3 minutes
-    } else if (fill_ratio < 0.75f) {
-        // 50-75% full - relaxed
-        return std::chrono::seconds(600);      // 10 minutes
-    } else {
-        // 75-100% full - very relaxed (mostly just re-announcing)
-        return std::chrono::seconds(1800);     // 30 minutes
-    }
-}
-
-void RatsClient::automatic_discovery_loop() {
-    LOG_CLIENT_INFO("Automatic peer discovery loop started");
-
-    // Best-effort: discover our public IP via STUN and derive a BEP 42 node ID from it BEFORE
-    // the initial bootstrap delay below. The DHT starts receiving KRPC responses (each carrying
-    // our address in the "ip" field) immediately on bootstrap, and that in-DHT vote can reach
-    // EXTERNAL_IP_VOTE_THRESHOLD within a few seconds. Probing STUN first lets set_external_ip()
-    // adopt the address and regenerate the node ID up front, so the DHT bootstraps under the
-    // correct ID and the ip-field voting silently confirms the already-adopted address instead
-    // of racing it to consensus. The voting remains the fallback when STUN is unavailable or the
-    // address later changes.
-    //
-    // This runs on the discovery thread (not a standalone one) on purpose: stop_dht_discovery()
-    // joins this thread via stop_automatic_peer_discovery() BEFORE resetting the DHT clients, so
-    // set_external_ip() can never touch a destroyed DhtClient.
-    if (auto_discovery_running_.load() && running_.load()) {
-        auto mapped = discover_public_address("stun.l.google.com", 19302, 4000);
-        if (mapped) {
-            // set_external_ip validates the address family, so feeding both instances is safe:
-            // only the matching-family DHT adopts it. (A default IPv4 STUN server yields an IPv4
-            // address; the IPv6 node ID is learned organically from IPv6 DHT responses.)
-            if (dht_client_) {
-                dht_client_->set_external_ip(mapped->address);
-            }
-            if (dht_client_v6_) {
-                dht_client_v6_->set_external_ip(mapped->address);
-            }
-        }
-    }
-
-    // Initial delay to let DHT bootstrap
-    {
-        std::unique_lock<std::mutex> lock(shutdown_mutex_);
-        if (shutdown_cv_.wait_for(lock, std::chrono::seconds(INITIAL_DISCOVERY_DELAY_SECONDS), [this] { return !auto_discovery_running_.load() || !running_.load(); })) {
-            LOG_CLIENT_INFO("Automatic peer discovery loop stopped during initial delay");
-            return;
-        }
-    }
-
-    // Announce immediately - this also discovers peers during traversal
-    announce_rats_peer();
-
-    auto last_announce = std::chrono::steady_clock::now();
-    
-    while (auto_discovery_running_.load()) {
-        auto now = std::chrono::steady_clock::now();
-        
-        // Announce combines both announcing our presence and discovering peers
-        // Interval scales based on peer count: aggressive when empty, relaxed when nearly full
-        auto interval = calculate_discovery_interval();
-        
-        if (now - last_announce >= interval) {
-            LOG_CLIENT_DEBUG("Discovery interval: " << interval.count() << "s (peers: " 
-                            << get_peer_count() << "/" << max_peers_ << ")");
-            announce_rats_peer();
-            last_announce = now;
-        }
-        
-        // Use conditional variable for responsive shutdown
-        {
-            std::unique_lock<std::mutex> lock(shutdown_mutex_);
-            if (shutdown_cv_.wait_for(lock, std::chrono::milliseconds(500), [this] { return !auto_discovery_running_.load() || !running_.load(); })) {
-                break;
-            }
-        }
-    }
-    
-    LOG_CLIENT_INFO("Automatic peer discovery loop stopped");
-}
-
-void RatsClient::announce_rats_peer() {
-    if (!dht_client_ || !dht_client_->is_running()) {
-        LOG_CLIENT_WARN("DHT client not running, cannot announce peer");
-        return;
-    }
-    
-    std::string discovery_hash = get_discovery_hash();
-
-    // Advertise the mapped public TCP port when UPnP/NAT-PMP has established one,
-    // so WAN peers connect to (external_ip, external_port) rather than our NATed
-    // local listen port. Falls back to listen_port_ when no mapping is active.
-    // (Mirrors libtorrent feeding the port-mapping result into what it announces.)
-    uint16_t announce_port = get_advertised_port();
-    LOG_CLIENT_INFO("Announcing peer for discovery hash: " << discovery_hash << " on port " << announce_port);
-
-    InfoHash info_hash = hex_to_node_id(discovery_hash);
-
-    // Skip only if every running DHT network already has this announce in flight.
-    // (announce_peer() also dedups internally, so this is just to avoid redundant work.)
-    bool v4_busy = !dht_client_ || !dht_client_->is_running() || dht_client_->is_announce_active(info_hash);
-    bool v6_busy = !dht_client_v6_ || !dht_client_v6_->is_running() || dht_client_v6_->is_announce_active(info_hash);
-    if (v4_busy && v6_busy) {
-        LOG_CLIENT_WARN("Announce already in progress for info hash: " << node_id_to_hex(info_hash));
-        return;
-    }
-    
-    // Use announce with callback - combines announce and find_peers in one traversal
-    // Peers discovered during traversal will be returned through the callback
-    if (announce_for_hash(discovery_hash, announce_port, [this, info_hash](const std::vector<std::string>& peer_addresses) {
-        LOG_CLIENT_INFO("Announce discovered " << peer_addresses.size() << " peers during traversal");
-        
-        // Convert peer addresses to Peer objects for handle_dht_peer_discovery()
-        std::vector<Peer> peers;
-        peers.reserve(peer_addresses.size());
-        for (const auto& peer_address : peer_addresses) {
-            std::string ip;
-            int port;
-            if (parse_address_string(peer_address, ip, port)) {
-                peers.push_back(Peer(ip, port));
-            }
-        }
-        
-        // Auto-connect to discovered peers
-        if (!peers.empty()) {
-            handle_dht_peer_discovery(peers, info_hash);
-        }
-    })) {
-        LOG_CLIENT_DEBUG("Successfully started announce with peer discovery for discovery hash");
-    } else {
-        LOG_CLIENT_WARN("Failed to announce peer for discovery");
-    }
-}
-
-std::string RatsClient::get_discovery_hash() const {
-    std::lock_guard<std::mutex> lock(protocol_config_mutex_);
-    // Generate discovery hash based on current protocol configuration
-    std::string discovery_string = custom_protocol_name_ + "_peer_discovery_v" + custom_protocol_version_;
-    return SHA1::hash(discovery_string);
-}
-
-std::string RatsClient::get_rats_peer_discovery_hash() {
-    // Well-known hash for rats peer discovery
-    // Compute SHA1 hash of "rats_peer_discovery_v1.0"
-    return SHA1::hash("rats_peer_discovery_v1.0");
-}
-
-}

package/native-src/src/librats_encryption.cpp

@@ -1,275 +0,0 @@
-#include "librats.h"
-#include "librats_log_macros.h"
-
-namespace librats {
-
-// =========================================================================
-// Encryption Functionality - Noise Protocol Implementation
-// =========================================================================
-
-void RatsClient::initialize_noise_keypair() {
-    std::lock_guard<std::mutex> lock(encryption_mutex_);
-    if (!noise_keypair_initialized_) {
-        rats::noise_generate_keypair(noise_static_keypair_);
-        noise_keypair_initialized_ = true;
-        LOG_CLIENT_INFO("Noise Protocol static keypair generated");
-    }
-}
-
-bool RatsClient::initialize_encryption(bool enable) {
-    std::lock_guard<std::mutex> lock(encryption_mutex_);
-    encryption_enabled_ = enable;
-    
-    if (enable && !noise_keypair_initialized_) {
-        rats::noise_generate_keypair(noise_static_keypair_);
-        noise_keypair_initialized_ = true;
-        LOG_CLIENT_INFO("Noise Protocol initialized with new static keypair");
-    }
-    
-    LOG_CLIENT_INFO("Encryption " << (enable ? "enabled" : "disabled"));
-    return true;
-}
-
-void RatsClient::set_encryption_enabled(bool enabled) {
-    std::lock_guard<std::mutex> lock(encryption_mutex_);
-    encryption_enabled_ = enabled;
-    
-    if (enabled && !noise_keypair_initialized_) {
-        rats::noise_generate_keypair(noise_static_keypair_);
-        noise_keypair_initialized_ = true;
-    }
-    
-    LOG_CLIENT_DEBUG("Encryption set to " << (enabled ? "enabled" : "disabled"));
-}
-
-bool RatsClient::is_encryption_enabled() const {
-    std::lock_guard<std::mutex> lock(encryption_mutex_);
-    return encryption_enabled_;
-}
-
-bool RatsClient::is_peer_encrypted(const std::string& peer_id) const {
-    std::lock_guard<std::mutex> lock(peers_mutex_);
-    auto it = peers_.find(peer_id);
-    if (it != peers_.end()) {
-        return it->second.noise_handshake_completed && 
-               it->second.send_cipher && 
-               it->second.recv_cipher;
-    }
-    return false;
-}
-
-bool RatsClient::set_noise_static_keypair(const uint8_t private_key[32]) {
-    std::lock_guard<std::mutex> lock(encryption_mutex_);
-    
-    memcpy(noise_static_keypair_.private_key, private_key, 32);
-    rats::noise_derive_public_key(private_key, noise_static_keypair_.public_key);
-    noise_static_keypair_.has_keys = true;
-    noise_keypair_initialized_ = true;
-    
-    LOG_CLIENT_INFO("Noise Protocol static keypair set from provided private key");
-    return true;
-}
-
-std::vector<uint8_t> RatsClient::get_noise_static_public_key() const {
-    std::lock_guard<std::mutex> lock(encryption_mutex_);
-    
-    if (!noise_keypair_initialized_) {
-        return std::vector<uint8_t>();
-    }
-    
-    return std::vector<uint8_t>(noise_static_keypair_.public_key, 
-                                 noise_static_keypair_.public_key + 32);
-}
-
-std::vector<uint8_t> RatsClient::get_peer_noise_public_key(const std::string& peer_id) const {
-    std::lock_guard<std::mutex> lock(peers_mutex_);
-    auto it = peers_.find(peer_id);
-    if (it != peers_.end() && it->second.noise_handshake_completed) {
-        return it->second.remote_static_key;
-    }
-    return std::vector<uint8_t>();
-}
-
-std::vector<uint8_t> RatsClient::get_peer_handshake_hash(const std::string& peer_id) const {
-    // Handshake hash is not stored after handshake for memory efficiency
-    // This could be added to RatsPeer if needed for channel binding
-    (void)peer_id;
-    return std::vector<uint8_t>();
-}
-
-// =========================================================================
-// Async Noise Handshake (non-blocking, driven by io_loop)
-// =========================================================================
-
-/*
- * Noise XX pattern (3 messages):
- *   Initiator: write msg0 → read msg1 → write msg2 → split
- *   Responder: read msg0 → write msg1 → read msg2 → split
- *
- * noise_step tracks where we are in this sequence:
- *   Initiator: 0 = need write, 1 = need read, 2 = need write, 3 = done
- *   Responder: 0 = need read,  1 = need write, 2 = need read,  3 = done
- *
- * start_noise_handshake_async() initialises noise_hs and writes the first
- * outgoing message (if initiator).  Subsequent messages are processed by
- * handle_noise_frame() which is called from handle_readable when
- * handshake_state == NOISE_PENDING.
- */
-
-void RatsClient::start_noise_handshake_async(RatsPeer& peer) {
-    LOG_CLIENT_INFO("Starting async Noise handshake for " << peer.peer_id 
-                    << " (initiator: " << peer.is_outgoing << ")");
-    
-    // Get our static keypair
-    rats::NoiseKeyPair static_keypair;
-    {
-        std::lock_guard<std::mutex> lock(encryption_mutex_);
-        if (!noise_keypair_initialized_) {
-            rats::noise_generate_keypair(noise_static_keypair_);
-            noise_keypair_initialized_ = true;
-        }
-        memcpy(static_keypair.private_key, noise_static_keypair_.private_key, 32);
-        memcpy(static_keypair.public_key, noise_static_keypair_.public_key, 32);
-        static_keypair.has_keys = true;
-    }
-    
-    // Allocate handshake state on the peer's IO context
-    peer.io_.noise_hs = std::make_unique<rats::NoiseHandshakeState>();
-    peer.io_.noise_step = 0;
-    
-    auto err = peer.io_.noise_hs->initialize(peer.is_outgoing, &static_keypair);
-    if (err != rats::NoiseError::OK) {
-        LOG_CLIENT_ERROR("Failed to initialise Noise handshake: " << static_cast<int>(err));
-        peer.handshake_state = RatsPeer::HandshakeState::FAILED;
-        return;
-    }
-    
-    // Initiator sends message 0 immediately
-    if (peer.is_outgoing) {
-        uint8_t msg_buf[256];
-        size_t msg_len = sizeof(msg_buf);
-        err = peer.io_.noise_hs->write_message(nullptr, 0, msg_buf, &msg_len);
-        if (err != rats::NoiseError::OK) {
-            LOG_CLIENT_ERROR("Failed to write Noise msg 0: " << static_cast<int>(err));
-            peer.handshake_state = RatsPeer::HandshakeState::FAILED;
-            return;
-        }
-        
-        // Enqueue as a length-prefixed frame (same framing as data messages)
-        std::vector<uint8_t> payload(msg_buf, msg_buf + msg_len);
-        enqueue_message_unlocked(peer, payload);
-        peer.io_.noise_step = 1;  // next: need to read msg 1
-        LOG_CLIENT_DEBUG("Sent Noise msg 0 (" << msg_len << " bytes) to " << peer.peer_id);
-    }
-    // Responder waits for msg 0 from initiator (noise_step stays 0)
-}
-
-bool RatsClient::handle_noise_frame(RatsPeer& peer) {
-    // The caller (handle_readable) has already verified that a complete
-    // length-prefixed frame is available in the receive buffer, but hasn't
-    // consumed it yet.  We read the payload from recv_buf (skip 4-byte length).
-    auto& recv_buf = peer.io_.recv_buffer;
-    
-    // Read payload length
-    uint32_t net_len;
-    memcpy(&net_len, recv_buf.data(), 4);
-    uint32_t frame_len = ntohl(net_len);
-    
-    const uint8_t* frame_data = recv_buf.data() + 4;
-    
-    if (!peer.io_.noise_hs) {
-        LOG_CLIENT_ERROR("Noise frame received but no handshake state for " << peer.peer_id);
-        return false;
-    }
-    
-    auto& hs = *peer.io_.noise_hs;
-    bool is_initiator = peer.is_outgoing;
-    rats::NoiseError err;
-    uint8_t out_buf[256];
-    size_t out_len;
-    
-    /*
-     * Step table (noise_step → action):
-     *   Initiator: 0=write, 1=read, 2=write, 3=done
-     *   Responder: 0=read,  1=write, 2=read,  3=done
-     *
-     * This function is only called when we received a frame, so the current
-     * step must expect a "read".
-     */
-    
-    // ── Read the incoming Noise message ──
-    out_len = sizeof(out_buf);
-    err = hs.read_message(frame_data, frame_len, out_buf, &out_len);
-    if (err != rats::NoiseError::OK) {
-        LOG_CLIENT_ERROR("Noise read_message failed (step " << peer.io_.noise_step 
-                         << "): " << static_cast<int>(err));
-        return false;
-    }
-    LOG_CLIENT_DEBUG("Read Noise msg (step " << peer.io_.noise_step 
-                     << ", " << frame_len << " bytes) from " << peer.peer_id);
-    
-    peer.io_.noise_step++;
-    
-    // ── If there's a reply to write, do it now ──
-    bool need_write = false;
-    if (is_initiator) {
-        // Initiator writes on steps 0 and 2 → after reading (step becomes 2), write
-        need_write = (peer.io_.noise_step == 2);
-    } else {
-        // Responder writes on step 1 → after reading (step becomes 1), write
-        need_write = (peer.io_.noise_step == 1);
-    }
-    
-    if (need_write) {
-        out_len = sizeof(out_buf);
-        err = hs.write_message(nullptr, 0, out_buf, &out_len);
-        if (err != rats::NoiseError::OK) {
-            LOG_CLIENT_ERROR("Noise write_message failed (step " << peer.io_.noise_step 
-                             << "): " << static_cast<int>(err));
-            return false;
-        }
-        
-        std::vector<uint8_t> payload(out_buf, out_buf + out_len);
-        enqueue_message_unlocked(peer, payload);
-        LOG_CLIENT_DEBUG("Sent Noise msg (step " << peer.io_.noise_step 
-                         << ", " << out_len << " bytes) to " << peer.peer_id);
-        peer.io_.noise_step++;
-    }
-    
-    // ── Check if handshake is complete ──
-    if (hs.is_handshake_complete()) {
-        auto send_cipher = std::make_shared<rats::NoiseCipherState>();
-        auto recv_cipher = std::make_shared<rats::NoiseCipherState>();
-        
-        err = hs.split(*send_cipher, *recv_cipher);
-        if (err != rats::NoiseError::OK) {
-            LOG_CLIENT_ERROR("Noise split failed: " << static_cast<int>(err));
-            return false;
-        }
-        
-        // Store ciphers and remote static key
-        peer.send_cipher = std::move(send_cipher);
-        peer.recv_cipher = std::move(recv_cipher);
-        peer.noise_handshake_completed = true;
-        
-        if (hs.has_remote_static()) {
-            const uint8_t* remote_key = hs.get_remote_static_public();
-            peer.remote_static_key.assign(remote_key, remote_key + 32);
-        }
-        
-        // Free handshake state (no longer needed)
-        peer.io_.noise_hs.reset();
-        peer.io_.noise_step = 0;
-        
-        // Mark handshake completed
-        peer.handshake_state = RatsPeer::HandshakeState::COMPLETED;
-        validated_peer_count_.fetch_add(1, std::memory_order_relaxed);
-        log_handshake_completion_unlocked(peer);
-        
-        LOG_CLIENT_INFO("Noise handshake completed with " << peer.peer_id);
-    }
-    
-    return true;
-}
-
-} // namespace librats