Server-side release. Clients need no update for these fixes — but the server does,
and both fixes only help clients running an app older than 1.0.2.
Fixed
Old clients discarded the ServerHello and reconnected forever
A pre-Variant-A client compares the ClientNetworkConfig version byte for
EQUALITY and drops the whole message when it differs. Wire v2 appended a
keepalive byte and bumped that version, so the handshake completed on the
server, the ServerHello went out, and the client silently threw it away: no
ratchet, no data, another handshake minutes later, forever.
Caught on a live server — the same client handshaking from the same source port
every few minutes, answered every time, and never sending a packet in between.
The server now emits the v1 form to a peer it has flagged as legacy, which costs
only the keepalive hint that such a client never had.
On production this took one looping client from 37 handshakes per 5 minutes to
one per 10 minutes, and uplink decrypt failures from 2567 to zero.
One client's stale packets locked out its whole home network
The handshake-failure cooldown was keyed by source IP, and every device behind a
home NAT shares one. When a single phone retried with stale keys, the server
blocked handshakes from that IP for up to 16 seconds — taking every other client
behind the same router with it. Two clients on one router were observed looping
in lockstep, neither able to reconnect.
Worse, the failure that armed the cooldown was often not a failure at all. A
packet from a live session reaches the handshake path whenever the tag lookup
misses — the tag window drifted, or the global rescan budget (20/s across all
sessions) was already spent that second. The server then tried it as a
handshake, found no matching client, and locked the peer out. The client kept
sending, so the count kept climbing and the lockout kept renewing.
Cooldowns are now keyed by the full peer address, and a peer that still has a
session is exempt from both the block and the accounting: its packet is dropped
as stale instead. Spoofed-source floods stay bounded by the global handshake-scan
budget, which varying source ports does not evade.
Verified
Both fixes were developed against a production server with 23 registered clients
and deployed there. Over the 10 minutes after deployment, with the client that
had been looping worst: 1 handshake (down from 37 per 5 minutes), 0 uplink
decrypt failures (down from 2567), 0 errors.
Not covered
One client on a modern app was still observed reconnecting every few seconds
against that server, sending small data packets that decrypt correctly and
receiving no reply. That is a separate defect, still open, and unrelated to the
legacy-compatibility path fixed here.