wire-mesh 3.4.0 → 3.5.0

package/README.md

@@ -56,7 +56,7 @@ curl http://<host>:8787/health
 
 With `--webtransport <host:port>` the node also serves WebTransport on a UDP port, for a browser that has no way to trust a certificate for this node's LAN address. The node mints self-signed ECDSA certificates, each valid for under two weeks, and prints an address of the form `https://<host>:<port>#sha256=<hash>[,<hash>...]` for each address of this machine a client can reach (when bound to a wildcard, one per non-internal IPv4 address). Give one of them to a console (the Node field takes it as typed): a browser accepts the certificate whose hash matches any in the list, with no certificate authority and no internet.
 
-The list holds the certificate served now and the ones that will replace it. The node rotates to the next certificate every half lifetime, by replacing its WebTransport server, so open sessions on that server end and a console reconnects, and an address stays usable for about three of those periods after it was copied. Without `--state-dir` the certificates live in memory, so a restart starts a new set and every address already handed out stops working; with it the certificates, private keys included, are kept in that directory (created readable by this user only) and a restart resumes them. The server is the optional `@fails-components/webtransport` dependency with its native binary; where it is not installed the flag fails at startup rather than serving without it. The prebuilt binary needs glibc 2.38 or newer on Linux.
+The list holds the certificate served now and the ones that will replace it. The node rotates to the next certificate every half lifetime, by replacing its WebTransport server, so open sessions on that server end and a console reconnects, and an address stays usable for about three of those periods after it was copied, and a console that reconnects is told the current list by the node, so one that keeps reconnecting never needs a new address. Without `--state-dir` the certificates live in memory, so a restart starts a new set and every address already handed out stops working; with it the certificates, private keys included, are kept in that directory (created readable by this user only) and a restart resumes them. The server is the optional `@fails-components/webtransport` dependency with its native binary; where it is not installed the flag fails at startup rather than serving without it. The prebuilt binary needs glibc 2.38 or newer on Linux.
 
 With `--mailbox-dir` the node also serves the announcer role and `/health` says so (`"roles":["relay","announcer"]`). It then holds other devices' `core/data` logs in that directory while those devices are offline, so a peer that reconnects catches up from the node. Only the device that owns a log can write to it: the node takes a log's entries from the connection whose verified advert names that device and from no one else. Any client that has gossiped an advert can read a log. Entries are opaque bytes to the node, and the applications that write them sign and encrypt their own. The number of logs, the bytes in each and the size of an entry are bounded (`src/mailbox-limits.ts`), and a frame that would exceed a bound is refused whole; nothing is evicted, so a full log stays full until the directory is cleared.
 

package/dist/server.cjs

@@ -261,6 +261,8 @@ async function advanceCertificateSchedule(storage, now, options = {}) {
 /** The path a client opens its WebTransport session on. */
 const WEBTRANSPORT_PATH = "/wire-mesh";
 const SECRET_BYTES = 32;
+/** How long to wait before trying a failed rotation again: the port may still be held by the server just stopped. */
+const ROTATION_RETRY_MS = 1e3;
 /** The application close code and reason sent when a certificate rotation ends a session; the code is arbitrary, and 0 is what a normal close carries. */
 const SESSION_CLOSE_CODE = 0;
 const ROTATION_CLOSE_REASON = "certificate rotated";
@@ -288,7 +290,7 @@ async function loadHttp3Server() {
 	}
 }
 function isIncomingSession(value) {
-	return typeof value === "object" && value !== null && "ready" in value && value.ready instanceof Promise && "closed" in value && value.closed instanceof Promise && "close" in value && typeof value.close === "function" && "incomingBidirectionalStreams" in value && value.incomingBidirectionalStreams instanceof ReadableStream;
+	return typeof value === "object" && value !== null && "ready" in value && value.ready instanceof Promise && "closed" in value && value.closed instanceof Promise && "close" in value && typeof value.close === "function" && "createUnidirectionalStream" in value && typeof value.createUnidirectionalStream === "function" && "incomingBidirectionalStreams" in value && value.incomingBidirectionalStreams instanceof ReadableStream;
 }
 /**
 * A WebTransport Transport: each session carries one connection, on the first bidirectional stream the client opens, framed as length-prefixed CBOR (core's byte-stream-connection). A server binds a UDP port and serves a self-signed ECDSA certificate it renews on a schedule, which a browser accepts by pinning its hash (`serverCertificateHashes`) with no certificate authority involved.
@@ -346,6 +348,9 @@ function createWebTransportTransport(options = {}) {
 						session.closed.catch(() => void 0).finally(() => {
 							liveSessions.delete(session);
 						});
+						const announcer = (await session.createUnidirectionalStream()).getWriter();
+						await announcer.write((0, wire_mesh_core_domain_pinned_address.encodeCertificateHashes)(schedule.advertised.map((certificate) => certificate.sha256Hex)));
+						await announcer.close();
 						const reader = session.incomingBidirectionalStreams.getReader();
 						const first = await reader.read();
 						reader.releaseLock();
@@ -364,14 +369,19 @@ function createWebTransportTransport(options = {}) {
 			};
 			let running = await startServer();
 			const advertise = () => reachableHosts(host).map((reachable) => (0, wire_mesh_core_domain_pinned_address.formatPinnedAddress)(`${reachable}:${String(port)}`, schedule.advertised.map((certificate) => certificate.sha256Hex)));
+			/** Drains and stops the running server, if there is one: cleared first, so a rotation that failed after this point is retried by starting a server rather than by retiring one that is already gone. */
 			const retire = async () => {
-				await running.drain();
-				running.server.stopServer();
-				await running.server.closed;
+				const current = running;
+				running = void 0;
+				if (current === void 0) return;
+				await current.drain();
+				current.server.stopServer();
+				await current.server.closed;
 			};
 			let rotation;
 			let closed = false;
-			const armRotation = () => {
+			const untilRotation = () => Math.max(schedule.rotatesAt.getTime() - now().getTime(), 0);
+			const armRotation = (delayMs) => {
 				rotation = setTimeout(() => {
 					(async () => {
 						schedule = await advanceCertificateSchedule(storage, now(), scheduleOptions);
@@ -379,12 +389,16 @@ function createWebTransportTransport(options = {}) {
 						if (closed) return;
 						running = await startServer();
 						options.onCertificateRenewed?.(advertise());
-						armRotation();
-					})().catch(reportError);
-				}, Math.max(schedule.rotatesAt.getTime() - now().getTime(), 0));
+					})().then(() => {
+						if (!closed) armRotation(untilRotation());
+					}, (error) => {
+						reportError(error);
+						if (!closed) armRotation(ROTATION_RETRY_MS);
+					});
+				}, delayMs);
 				rotation.unref();
 			};
-			armRotation();
+			armRotation(untilRotation());
 			return {
 				get address() {
 					return `${host}:${String(port)}`;

package/dist/server.mjs

@@ -11,7 +11,7 @@ import { createNodeFsStorage } from "wire-mesh-core/adapters/node-fs-storage";
 import { randomBytes } from "node:crypto";
 import { networkInterfaces } from "node:os";
 import { connectionFromByteStream } from "wire-mesh-core/adapters/byte-stream-connection";
-import { formatPinnedAddress } from "wire-mesh-core/domain/pinned-address";
+import { encodeCertificateHashes, formatPinnedAddress } from "wire-mesh-core/domain/pinned-address";
 import { createMemoryStorage } from "wire-mesh-core/adapters/memory-storage";
 import "reflect-metadata";
 import { BasicConstraintsExtension, ExtendedKeyUsage, ExtendedKeyUsageExtension, KeyUsageFlags, KeyUsagesExtension, X509CertificateGenerator } from "@peculiar/x509";
@@ -260,6 +260,8 @@ async function advanceCertificateSchedule(storage, now, options = {}) {
 /** The path a client opens its WebTransport session on. */
 const WEBTRANSPORT_PATH = "/wire-mesh";
 const SECRET_BYTES = 32;
+/** How long to wait before trying a failed rotation again: the port may still be held by the server just stopped. */
+const ROTATION_RETRY_MS = 1e3;
 /** The application close code and reason sent when a certificate rotation ends a session; the code is arbitrary, and 0 is what a normal close carries. */
 const SESSION_CLOSE_CODE = 0;
 const ROTATION_CLOSE_REASON = "certificate rotated";
@@ -287,7 +289,7 @@ async function loadHttp3Server() {
 	}
 }
 function isIncomingSession(value) {
-	return typeof value === "object" && value !== null && "ready" in value && value.ready instanceof Promise && "closed" in value && value.closed instanceof Promise && "close" in value && typeof value.close === "function" && "incomingBidirectionalStreams" in value && value.incomingBidirectionalStreams instanceof ReadableStream;
+	return typeof value === "object" && value !== null && "ready" in value && value.ready instanceof Promise && "closed" in value && value.closed instanceof Promise && "close" in value && typeof value.close === "function" && "createUnidirectionalStream" in value && typeof value.createUnidirectionalStream === "function" && "incomingBidirectionalStreams" in value && value.incomingBidirectionalStreams instanceof ReadableStream;
 }
 /**
 * A WebTransport Transport: each session carries one connection, on the first bidirectional stream the client opens, framed as length-prefixed CBOR (core's byte-stream-connection). A server binds a UDP port and serves a self-signed ECDSA certificate it renews on a schedule, which a browser accepts by pinning its hash (`serverCertificateHashes`) with no certificate authority involved.
@@ -345,6 +347,9 @@ function createWebTransportTransport(options = {}) {
 						session.closed.catch(() => void 0).finally(() => {
 							liveSessions.delete(session);
 						});
+						const announcer = (await session.createUnidirectionalStream()).getWriter();
+						await announcer.write(encodeCertificateHashes(schedule.advertised.map((certificate) => certificate.sha256Hex)));
+						await announcer.close();
 						const reader = session.incomingBidirectionalStreams.getReader();
 						const first = await reader.read();
 						reader.releaseLock();
@@ -363,14 +368,19 @@ function createWebTransportTransport(options = {}) {
 			};
 			let running = await startServer();
 			const advertise = () => reachableHosts(host).map((reachable) => formatPinnedAddress(`${reachable}:${String(port)}`, schedule.advertised.map((certificate) => certificate.sha256Hex)));
+			/** Drains and stops the running server, if there is one: cleared first, so a rotation that failed after this point is retried by starting a server rather than by retiring one that is already gone. */
 			const retire = async () => {
-				await running.drain();
-				running.server.stopServer();
-				await running.server.closed;
+				const current = running;
+				running = void 0;
+				if (current === void 0) return;
+				await current.drain();
+				current.server.stopServer();
+				await current.server.closed;
 			};
 			let rotation;
 			let closed = false;
-			const armRotation = () => {
+			const untilRotation = () => Math.max(schedule.rotatesAt.getTime() - now().getTime(), 0);
+			const armRotation = (delayMs) => {
 				rotation = setTimeout(() => {
 					(async () => {
 						schedule = await advanceCertificateSchedule(storage, now(), scheduleOptions);
@@ -378,12 +388,16 @@ function createWebTransportTransport(options = {}) {
 						if (closed) return;
 						running = await startServer();
 						options.onCertificateRenewed?.(advertise());
-						armRotation();
-					})().catch(reportError);
-				}, Math.max(schedule.rotatesAt.getTime() - now().getTime(), 0));
+					})().then(() => {
+						if (!closed) armRotation(untilRotation());
+					}, (error) => {
+						reportError(error);
+						if (!closed) armRotation(ROTATION_RETRY_MS);
+					});
+				}, delayMs);
 				rotation.unref();
 			};
-			armRotation();
+			armRotation(untilRotation());
 			return {
 				get address() {
 					return `${host}:${String(port)}`;