From 5022f2be149e40ac5bdd5fc362e926f3edcf44f0 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Fri, 4 Sep 2026 01:47:45 +0200 Subject: fix(client): resolve STUN hostnames in the main process Chromium's P2P socket manager failed every STUN hostname with ERR_NAME_NOT_RESOLVED in a restricted-resolver environment (a Windows KVM guest), even though its own general network stack, the OS resolver and Node's resolver all resolved the same names -- and mapping the names to IPs with --host-resolver-rules changed nothing, so it is not ordinary resolution. WebRTC was left with no server-reflexive candidate. The desktop client now resolves the STUN hostnames in the main process (`ice:resolve-stun`, Node's dns.resolve4) and hands `transport.js` the IP form; a name that will not resolve (the decommissioned Mozilla host) is dropped. In a browser there is no `meshbay` bridge and the hostnames are used unchanged -- a browser resolves them fine, so that path is untouched. Falls back to the hostname form if the bridge call throws. Also, scoped to win32: disable WebRtcHideLocalIpsWithMdns, so the client publishes its real local IP instead of a `.local` name the node's ICE stack cannot resolve across the KVM bridge. Changes nothing on Linux/macOS. Test-env workaround, revisit before release. Co-Authored-By: Claude Sonnet 5 --- packages/meshbay-client/src/preload.js | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'packages/meshbay-client/src/preload.js') diff --git a/packages/meshbay-client/src/preload.js b/packages/meshbay-client/src/preload.js index 7ffdf66..96d6790 100644 --- a/packages/meshbay-client/src/preload.js +++ b/packages/meshbay-client/src/preload.js @@ -47,6 +47,12 @@ contextBridge.exposeInMainWorld('meshbay', { // which CORS refuses and which is not a credential anyway. fetch: (url, init) => ipcRenderer.invoke('hub:fetch', url, init), + // Resolve STUN `stun:host:port` URLs to `stun:ip:port` using Node's resolver. + // Chromium's P2P socket manager fails STUN hostnames outright in some + // restricted-resolver environments; the renderer cannot do DNS, so it asks + // here. Unresolvable entries are dropped. + resolveStun: (urls) => ipcRenderer.invoke('ice:resolve-stun', urls), + // The device's hub key. Generated, held and used entirely in the main // process: the interface asks for a signature and never sees a key, because // it is the part of this application that parses hostile input. -- cgit v1.2.3