fix(daemon): guard duplicate rekey initiation, fix blackhole detection for new peers

- tunnel.go: skip sendKeyExchangeToNode if already pending to prevent
  rapid SYN retransmits from exhausting MaxRekeyAttempts before relay path
  stabilises; reset Attempts counter when routing path flips to relay
- keyexchange: add ResetPendingRekeyAttempts for path-change resets
- routing: track firstOutboundSend as blackhole baseline for brand-new
  peers that have never replied on the direct path (symmetric NAT case)
- beacon: raise maxBeaconNodes 100k→500k after network exceeded threshold

Author: teovl

pkg/beacon/server.go

@@ -66,7 +66,9 @@ const relayQueueSize = 131072 // 128K buffered relay jobs before backpressure
 const maxRelayPayload = 65535
 
 // maxBeaconNodes caps the number of tracked nodes to prevent memory exhaustion.
-const maxBeaconNodes = 100_000
+// At ~32 bytes per node, 500k entries consume ~16 MB — well within fleet budget.
+// Raised from 100k after the network grew past that threshold (v1.9.4).
+const maxBeaconNodes = 500_000
 
 // beaconNodeTTL is how long a node entry lives without a discover refresh.
 // Set to 10 minutes (well above the 60s heartbeat-driven re-discover interval)

pkg/daemon/keyexchange/keyexchange.go

@@ -365,6 +365,20 @@ func (m *Manager) ClearPendingRekey(peerNodeID uint32) {
 	m.rkPendingMu.Unlock()
 }
 
+// ResetPendingRekeyAttempts zeroes the Attempts counter for peerNodeID
+// without cancelling the pending-rekey entry. Called when the routing
+// path changes (e.g. direct→relay flip) so the peer gets a fresh set
+// of retransmit slots on the new path rather than immediately hitting
+// the MaxRekeyAttempts give-up threshold from prior direct attempts.
+func (m *Manager) ResetPendingRekeyAttempts(peerNodeID uint32) {
+	m.rkPendingMu.Lock()
+	if st, ok := m.pendingRekey[peerNodeID]; ok {
+		st.Attempts = 0
+		st.LastSentAt = time.Time{} // force immediate retransmit on next tick
+	}
+	m.rkPendingMu.Unlock()
+}
+
 // ClearRekeyGaveUp lifts the post-give-up cooldown for peerNodeID. Must only
 // be called after a successful decrypt — proof that bidirectional crypto works.
 func (m *Manager) ClearRekeyGaveUp(peerNodeID uint32) {

pkg/daemon/routing/blackhole.go

@@ -10,10 +10,11 @@ import (
 
 // RecordDirectRecv stamps the lastDirectRecv timestamp for a peer. Called
 // from the L7 handleEncrypted path after a successful direct (non-beacon)
-// decrypt.
+// decrypt. Also clears firstOutboundSend since the direct path is confirmed.
 func (m *Manager) RecordDirectRecv(nodeID uint32, t time.Time) {
 	m.mu.Lock()
 	m.lastDirectRecv[nodeID] = t
+	delete(m.firstOutboundSend, nodeID)
 	m.mu.Unlock()
 }
 
@@ -34,10 +35,16 @@ func (m *Manager) LastDirectRecv(nodeID uint32) time.Time {
 }
 
 // RecordOutboundSend stamps the lastOutboundSend timestamp for a peer.
-// Used by NAT-keepalive logic.
+// Also sets firstOutboundSend on the very first write (never updated
+// after that), which gives MaybeFlipBlackhole a baseline for peers
+// that have never been heard from on the direct path.
+// Used by NAT-keepalive logic and blackhole detection.
 func (m *Manager) RecordOutboundSend(nodeID uint32, t time.Time) {
 	m.mu.Lock()
 	m.lastOutboundSend[nodeID] = t
+	if _, ok := m.firstOutboundSend[nodeID]; !ok {
+		m.firstOutboundSend[nodeID] = t
+	}
 	m.mu.Unlock()
 }
 
@@ -105,15 +112,28 @@ func (m *Manager) MaybeFlipBlackhole(nodeID uint32) (shouldRelay, flipped bool,
 	relay := m.relayPeers[nodeID]
 	bAddr := m.beaconAddr
 	lastRecv, hasRecv := m.lastDirectRecv[nodeID]
+	firstSend, hasSent := m.firstOutboundSend[nodeID]
 	m.mu.RUnlock()
 
 	if relay {
 		return true, false, 0, 0
 	}
-	if bAddr == nil || !hasRecv {
+	if bAddr == nil {
+		return false, false, 0, 0
+	}
+	if hasRecv {
+		// Established peer: measure silence since last direct receipt.
+		silentFor = time.Since(lastRecv)
+	} else if hasSent {
+		// Brand-new peer (no direct recv yet): measure silence since
+		// we first sent to them. This lets the blackhole heuristic fire
+		// for new peers on symmetric-NAT paths where the direct reply
+		// can never reach us — without this, !hasRecv would suppress
+		// blackhole detection forever and the peer would never flip to relay.
+		silentFor = time.Since(firstSend)
+	} else {
 		return false, false, 0, 0
 	}
-	silentFor = time.Since(lastRecv)
 	if silentFor <= DirectBlackholeThreshold {
 		return false, false, 0, 0
 	}

pkg/daemon/routing/relay.go

@@ -151,6 +151,7 @@ func (m *Manager) RemovePeer(nodeID uint32) {
 	delete(m.relayPeers, nodeID)
 	delete(m.relayPinned, nodeID)
 	delete(m.lastOutboundSend, nodeID)
+	delete(m.firstOutboundSend, nodeID)
 	delete(m.sendErrCount, nodeID)
 	delete(m.lastDirectRecv, nodeID)
 	delete(m.blackholeMissCount, nodeID)

pkg/daemon/routing/routing.go

@@ -10,6 +10,7 @@
 //   - sendErrCount map[uint32]int — consecutive ICMP-unreachable errors
 //   - lastDirectRecv map[uint32]time.Time — last direct-path receipt
 //   - lastOutboundSend map[uint32]time.Time — last successful send
+//   - firstOutboundSend map[uint32]time.Time — first ever send (blackhole baseline)
 //   - beaconAddr — the picked beacon for relay/punch
 //
 // Per docs/architecture/01-LAYERS.md L4:
@@ -123,6 +124,12 @@ type Manager struct {
 	// to each peer. Used by NAT-keepalive logic.
 	lastOutboundSend map[uint32]time.Time
 
+	// firstOutboundSend tracks when we FIRST sent to each peer. Unlike
+	// lastOutboundSend it is never updated after the initial write.
+	// Used by MaybeFlipBlackhole as the blackhole-detection baseline
+	// for brand-new peers that have no lastDirectRecv entry yet.
+	firstOutboundSend map[uint32]time.Time
+
 	// localNodeIDFn supplies our own node ID for relay-wrapping headers.
 	localNodeIDFn LocalNodeIDFn
 }
@@ -138,6 +145,7 @@ func New() *Manager {
 		directClearCount:   make(map[uint32]int),
 		sendErrCount:       make(map[uint32]int),
 		lastOutboundSend:   make(map[uint32]time.Time),
+		firstOutboundSend:  make(map[uint32]time.Time),
 	}
 }
 

pkg/daemon/tunnel.go

@@ -467,6 +467,11 @@ func (tm *TunnelManager) writeFrame(nodeID uint32, addr *net.UDPAddr, frame []by
 				"peer_node_id", nodeID,
 				"error", err)
 		}
+		// Reset the key-exchange attempt counter so the peer gets a fresh
+		// set of relay-based retransmit slots. Without this, Attempts has
+		// already reached MaxRekeyAttempts+1 from the failed direct attempts
+		// and the next tick immediately gives up before any relay frame lands.
+		tm.kx.ResetPendingRekeyAttempts(nodeID)
 	}
 
 	if errors.Is(err, routing.ErrNoAddress) {
@@ -1278,11 +1283,15 @@ func (tm *TunnelManager) SendTo(addr *net.UDPAddr, nodeID uint32, pkt *protocol.
 		}
 
 		// No key yet — initiate key exchange and queue the packet (C1 fix: no plaintext fallback).
-		// Skip if the peer is within the give-up cooldown: the key exchange
-		// will still be sent (one-shot, no retransmit) but queuing more data
-		// just fills the pending queue with undeliverable packets and floods
-		// the logs with "dropped oldest" warnings.
-		tm.sendKeyExchangeToNode(nodeID)
+		// Only trigger a new key exchange if one isn't already in-flight; the
+		// retransmit loop handles subsequent retries. Without this guard, rapid
+		// outbound traffic (e.g. SYN retransmits every 250ms during dial) calls
+		// sendKeyExchangeToNode repeatedly, each incrementing Attempts until it
+		// reaches MaxRekeyAttempts+1 within seconds and the peer gives up before
+		// the relay path is even established.
+		if !tm.kx.PendingRekeyHas(nodeID) {
+			tm.sendKeyExchangeToNode(nodeID)
+		}
 		if tm.kx.PeerInRekeyGaveUp(nodeID) {
 			return fmt.Errorf("%w (peer_node_id=%d)", ErrPendingDropped, nodeID)
 		}
@@ -1337,8 +1346,12 @@ func (tm *TunnelManager) AddPeer(nodeID uint32, addr *net.UDPAddr) {
 	tm.mu.Unlock()
 	slog.Debug("added peer", "node_id", nodeID, "addr", addr)
 
-	// If encryption is enabled, initiate key exchange (relay-aware)
-	if tm.encrypt {
+	// If encryption is enabled, initiate key exchange (relay-aware).
+	// Guard matches writeToNode's PendingRekeyHas check: concurrent AddPeer
+	// calls for the same node (e.g. two parallel dial goroutines) must not
+	// each increment Attempts, which would exhaust MaxRekeyAttempts before
+	// the retransmit loop can pace retries at RekeyRetransmitInterval.
+	if tm.encrypt && !tm.kx.PendingRekeyHas(nodeID) {
 		tm.sendKeyExchangeToNode(nodeID)
 	}
 }