Protect cold ingress before the third routed node is announced

src/routing_layer/nat_detection.c

@@ -1204,7 +1204,7 @@ static uint64_t candidate_fingerprint(struct nat_socket *state, int ready) {
             group_total += hash;
         }
         if (ready || (candidates >= 2 && observers)) total += group_total;
-        if (!ready) DEBUG_DEBUG(DEBUG_CATEGORY_NAT, "NAT cold group candidates node=%016llx socket=%s group=%016llx candidates=%u observers=%u",
+        if (!ready) DEBUG_TRACE(DEBUG_CATEGORY_NAT, "NAT cold group candidates node=%016llx socket=%s group=%016llx candidates=%u observers=%u",
                                 (unsigned long long)detector->instance->node_id, state->socket->name,
                                 (unsigned long long)group->group_id, candidates, observers);
     }
@@ -1248,7 +1248,7 @@ int nat_detection_ping_allowed(struct NAT_DETECTION *detector, struct ETCP_SOCKE
     if (!detector || !socket || socket->probe_only || (flags & ETCP_PING_FLAG_ADDRESS_CHECK)) return 1;
     nat_detection_probe_delay(detector);
     struct nat_socket *state = socket_state(detector, socket, 0);
-    if (!state || !state->reservation_fingerprint || state->cold_until <= get_time_tb() ||
+    if (!state || (!state->reservation_fingerprint && !state->available_fingerprint) || state->cold_until <= get_time_tb() ||
         (!detector->automatic && !state->phase && !state->forced) ||
         (state->measured_profile.source == ADDRESS_SOURCE_ETCP && state->measured_profile.mapping && state->measured_profile.inbound)) return 1;
     uint64_t peer = sc_derive_node_id_from_pubkey(peer_key);

tests/test_nat_detection.c

@@ -57,6 +57,9 @@ static void test_all_groups_tcp(void) {
     struct UTUN_INSTANCE *helper = nat_fixture_node(&fixture, "127.0.0.4", NULL,
         "[server:tcp]\naddr=127.0.0.4:0\ntype=public\ntransport=tcp\n[chatserver]\ngroup_autoconnect=0\n");
     nat_detection_set_automatic(observer->nat_det, 0); nat_detection_set_automatic(helper->nat_det, 0);
+    /* NODEINFO обновляет общий NCD всеми парами: helper UDP оставляем для проб, без транспортного приёма INIT. */
+    struct ETCP_SOCKET *helper_socket = test_etcp_bound_socket(helper, "udp");
+    assert(!uasync_remove_socket_t(fixture.ua, helper_socket->fd)); helper_socket->socket_id = NULL;
     struct ETCP_CONN *ab = nat_fixture_connect(&fixture, owner, "udp", observer);
     struct ETCP_SOCKET *socket = test_etcp_bound_socket(owner, "udp");
     nat_detection_request_check_all(owner->nat_det);
@@ -86,7 +89,7 @@ static void test_all_groups_tcp(void) {
     do { uasync_poll(fixture.ua, 10); bc = node_conn_direct_get_conn(*handle); }
     while (get_time_tb() < end && (!bc || !bc->links_up));
     assert(bc && bc->links_up && !topo_group_new_conn(groups[1], bc));
-    for (struct ETCP_LINK *link = bc->links; link; link = link->next) assert(link->is_tcp);
+    for (struct ETCP_LINK *link = bc->links; link; link = link->next) if (link->link_status) assert(link->is_tcp);
     end = get_time_tb() + 50000;
     while (get_time_tb() < end && (!topo_group_peer_ready(groups[0], observer->node_id) ||
         !topo_group_peer_ready(groups[1], helper->node_id) || !topo_node_best_path(topo_node_find_by_id(groups[0], helper->node_id))))
@@ -95,6 +98,7 @@ static void test_all_groups_tcp(void) {
     assert(!instance_find_conn(owner, helper->node_id));
     wait_profile(&fixture, socket, ADDRESS_MAP_UNCHANGED, ADDRESS_IN_OPEN);
     assert(!nat_detection_get_status(owner->nat_det, socket, &status) && status.group_id == 42 && status.helper == helper->node_id);
+    for (struct ETCP_LINK *link = bc->links; link; link = link->next) if (link->link_status) assert(link->is_tcp);
     assert(!instance_find_conn(owner, helper->node_id));
     uint64_t old_round = status.round;
     assert(!nat_detection_request_check_socket(owner->nat_det, socket, observer->node_id));