fleetmesh-node 0.2.0__py3-none-any.whl

node/testnet/fips_daemon.py

@@ -0,0 +1,230 @@
+"""A FIPS daemon stand-in for the local testnet.
+
+Speaks enough of the fipsd control socket protocol for node/fips_transport.py
+to bind, send and receive datagrams between the cluster's nodes on one
+machine, with no real fipsd installed. It is a test double, and it lives
+apart from node/testnet/cluster.py because two suites (test_cluster_fips,
+test_didcomm_inbound) drive it on its own, with no cluster around it.
+"""
+from __future__ import annotations
+
+import array
+import json
+import os
+import socket
+import threading
+from typing import Optional
+
+
+class ClusterFipsDaemon:
+    """In-process FIPS Native Control daemon for LocalCluster simulation.
+
+    Manages bilateral datagram flows between cluster nodes without requiring
+    an external fipsd daemon:
+    - Handles 'listen' and 'connect' commands over Unix domain control socket.
+    - Passes connected datagram sockets to clients via SCM_RIGHTS.
+    - Routes bilateral datagrams directly between peer sockets.
+    """
+
+    def __init__(self, sock_path: str) -> None:
+        self.sock_path = os.path.abspath(sock_path)
+        if os.path.exists(self.sock_path):
+            try:
+                os.unlink(self.sock_path)
+            except OSError:
+                pass
+        os.makedirs(os.path.dirname(self.sock_path), exist_ok=True)
+        self.srv_sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+        self.srv_sock.bind(self.sock_path)
+        self.srv_sock.listen(32)
+        self.running = True
+        self._lock = threading.Lock()
+        self.peer_listeners: dict[tuple[str, int], socket.socket] = {}
+        self.listeners: dict[int, list[socket.socket]] = {}
+        self.listener_conns: dict[socket.socket, socket.socket] = {}
+        self.active_pairs: list[tuple[socket.socket, socket.socket]] = []
+        self.threads: list[threading.Thread] = []
+        self.thread = threading.Thread(target=self._run, daemon=True)
+        self.thread.start()
+
+    def _run(self) -> None:
+        while self.running:
+            try:
+                conn, _ = self.srv_sock.accept()
+            except Exception:
+                break
+            t = threading.Thread(target=self._handle_client, args=(conn,), daemon=True)
+            t.start()
+            self.threads.append(t)
+
+    def _handle_client(self, conn: socket.socket) -> None:
+        buf = b""
+        client_node_pk: Optional[str] = None
+        registered_listeners: list[tuple[Optional[str], int, socket.socket]] = []
+        try:
+            while self.running:
+                try:
+                    chunk = conn.recv(4096)
+                    if not chunk:
+                        break
+                    buf += chunk
+                    while b"\n" in buf:
+                        line, buf = buf.split(b"\n", 1)
+                        if not line.strip():
+                            continue
+                        req = json.loads(line.decode("utf-8"))
+                        cmd = req.get("command") or req.get("cmd")
+                        params = req.get("params") if isinstance(req.get("params"), dict) else req
+                        port = int(params.get("local_port") or params.get("remote_port") or params.get("port") or 11801)
+
+                        # The socket protocol has three verbs; a request naming none of them
+                        # is ignored and the connection stays open, as before.
+                        match cmd:
+                            case "listen":
+                                # Client wishes to listen on port
+                                client_node_pk = params.get("node_pk") or req.get("node_pk") or client_node_pk
+                                client_sock, daemon_sock = socket.socketpair(socket.AF_UNIX, socket.SOCK_DGRAM)
+                                with self._lock:
+                                    self.active_pairs.append((client_sock, daemon_sock))
+                                    self.listeners.setdefault(port, []).append(daemon_sock)
+                                    if client_node_pk:
+                                        self.peer_listeners[(client_node_pk, port)] = daemon_sock
+                                    self.listener_conns[daemon_sock] = conn
+                                    registered_listeners.append((client_node_pk, port, daemon_sock))
+
+                                resp_dict = {
+                                    "status": "ok",
+                                    "port": port,
+                                    "state": "listening",
+                                    "data": {
+                                        "backlog": 16,
+                                        "local_port": port,
+                                        "node": client_node_pk or "local",
+                                    },
+                                }
+                                resp = json.dumps(resp_dict).encode("utf-8") + b"\n"
+                                fds = array.array("i", [client_sock.fileno()])
+                                cmsg = [(socket.SOL_SOCKET, socket.SCM_RIGHTS, fds)]
+                                conn.sendmsg([resp], cmsg)
+                                client_sock.close()
+
+                            case "connect":
+                                peer = str(params.get("peer") or req.get("peer") or "")
+                                if not client_node_pk and (params.get("caller") or req.get("caller")):
+                                    client_node_pk = params.get("caller") or req.get("caller")
+
+                                with self._lock:
+                                    target_sock = self.peer_listeners.get((peer, port))
+                                    if not target_sock:
+                                        for (p_k, p_port), s_sock in self.peer_listeners.items():
+                                            if p_port == port and (p_k.startswith(peer) or peer.startswith(p_k)):
+                                                target_sock = s_sock
+                                                break
+                                    if not target_sock and not peer and port in self.listeners and self.listeners[port]:
+                                        target_sock = self.listeners[port][0]
+
+                                    if target_sock is not None:
+                                        target_conn = self.listener_conns.get(target_sock)
+                                        if target_conn is not None:
+                                            try:
+                                                peek = target_conn.recv(1, socket.MSG_PEEK | socket.MSG_DONTWAIT)
+                                                if peek == b"":
+                                                    target_sock = None
+                                            except (BlockingIOError, socket.error):
+                                                pass
+                                            except Exception:
+                                                target_sock = None
+
+                                if target_sock is None or getattr(target_sock, 'fileno', lambda: -1)() == -1:
+                                    resp = json.dumps({"status": "error", "error": f"peer {peer}:{port} not listening or unreachable"}).encode("utf-8") + b"\n"
+                                    conn.sendall(resp)
+                                    continue
+
+                                client_sock, daemon_sock = socket.socketpair(socket.AF_UNIX, socket.SOCK_DGRAM)
+                                with self._lock:
+                                    self.active_pairs.append((client_sock, daemon_sock))
+
+                                def forward(src: socket.socket, dst: socket.socket):
+                                    while self.running:
+                                        try:
+                                            data = src.recv(65536)
+                                            if not data:
+                                                break
+                                            dst.send(data)
+                                        except Exception:
+                                            break
+                                t = threading.Thread(target=forward, args=(daemon_sock, target_sock), daemon=True)
+                                t.start()
+                                self.threads.append(t)
+
+                                resp_dict = {
+                                    "status": "connected",
+                                    "port": port,
+                                    "peer": peer,
+                                    "flow": f"{peer}:{port}",
+                                    "data": {
+                                        "flow_id": len(self.active_pairs),
+                                        "local_port": 49152,
+                                        "max_payload": 1170,
+                                        "node": client_node_pk or "local",
+                                        "peer": peer,
+                                        "remote_port": port,
+                                    },
+                                }
+                                resp = json.dumps(resp_dict).encode("utf-8") + b"\n"
+                                fds = array.array("i", [client_sock.fileno()])
+                                cmsg = [(socket.SOL_SOCKET, socket.SCM_RIGHTS, fds)]
+                                conn.sendmsg([resp], cmsg)
+                                client_sock.close()
+
+                            case "status":
+                                resp = json.dumps({
+                                    "status": "ok",
+                                    "protocol": "fleetmesh-fips/1",
+                                    "listeners": len(self.listeners),
+                                    "active_flows": len(self.active_pairs),
+                                }).encode("utf-8") + b"\n"
+                                conn.sendall(resp)
+                except Exception:
+                    break
+        finally:
+            with self._lock:
+                for pk, p, ds in registered_listeners:
+                    if pk and (pk, p) in self.peer_listeners and self.peer_listeners[(pk, p)] is ds:
+                        del self.peer_listeners[(pk, p)]
+                    if p in self.listeners and ds in self.listeners[p]:
+                        try:
+                            self.listeners[p].remove(ds)
+                        except ValueError:
+                            pass
+                    self.listener_conns.pop(ds, None)
+            try:
+                conn.close()
+            except Exception:
+                pass
+
+    def stop(self) -> None:
+        self.running = False
+        try:
+            self.srv_sock.close()
+        except Exception:
+            pass
+        with self._lock:
+            for c_sock, d_sock in self.active_pairs:
+                try:
+                    c_sock.close()
+                except Exception:
+                    pass
+                try:
+                    d_sock.close()
+                except Exception:
+                    pass
+            self.active_pairs.clear()
+            self.listeners.clear()
+            self.peer_listeners.clear()
+            self.listener_conns.clear()
+        if os.path.exists(self.sock_path):
+            try:
+                os.unlink(self.sock_path)
+            except OSError:
+                pass

node/transport/__init__.py

@@ -0,0 +1,94 @@
+"""The transport adapter, and its first implementation: gift wraps over relays.
+
+A DIDComm plaintext message goes out as a JWE (didcomm.py) inside a NIP-59
+wrap (giftwrap.py) published as kind 21059 to every relay this node uses,
+addressed to the peer's node key. Inbound, the node holds one subscription
+per relay for kind 21059 with #p equal to its own key, unwraps, decrypts,
+and checks that the three names agree: the seal's signer, the envelope's
+skid, and the plaintext's `from` must all be the same node. Any disagreement
+is dropped, not surfaced, because a message that lies about who sent it is
+not a message.
+
+Every message carries a thread. A reply's `thid` is the id of the message it
+answers, so request() can wait for exactly its answer while unrelated
+traffic goes to the inbox. This is the interface the direct rungs (fips-native,
+iroh, libp2p) implement behind TransportRouter; the NIP says this one always works.
+
+It does not. A relay can accept a stored wrap, answer OK, and never serve it -
+relay.pocketstr.com did exactly that to every receipt for seventeen hours on
+2026-09-07, and four of the largest public relays refuse the ephemeral kind
+outright. The publish result is the relay's word about itself, not about
+delivery, and nothing in this node could tell the two apart. So every stored
+message now asks for an acknowledgment and is held until one arrives, using
+the two headers DIDComm v2.1 defines for it: `please_ack` on the message and
+`ack` on the answer, carried by the empty message when nothing else is due.
+A peer that has spoken since and still has not acknowledged is the proof
+that the stored path failed, and that is what `sweep()` records. The ack is
+a live wrap, because the peer is online by construction when it sends one.
+"""
+from __future__ import annotations
+
+import os
+import sys
+
+sys.path.insert(0, os.path.abspath(os.path.join(os.path.dirname(os.path.abspath(__file__)), '..', '..')))
+# nostr and router do `from . import const` while this file is still running;
+# that resolves as a submodule import against the half-built package, so the
+# order here is not load-bearing. const is a leaf and stays first anyway, so
+# the dependency reads the way it runs. node/tests/test_imports.py imports
+# the package and each submodule cold to hold that.
+from . import const, fips_rung, iroh_rung, ladder, netfetch, relay_rung, router, ws  # noqa: E402
+from .const import (  # noqa: E402
+    WRAP_KIND,
+    RELAY_CONTENT_MAX,
+    FRAGMENT_BYTES,
+    MAX_FRAGMENTS,
+    ENVELOPE_MAX,
+    SEEN_MAX,
+    PARTIALS_PER_SENDER,
+    PARTIALS_MAX,
+    INBOX_MAX,
+    DROPPED_KEPT,
+    BACKOFF_MAX,
+    EMPTY_TYPE,
+    ACK_SLACK,
+    ACK_GRACE,
+    ACK_EXPIRE,
+    TransportError,
+    Inbound,
+    _foreign,
+)
+from .relay_rung import NostrTransport, RelayRung  # noqa: E402
+from .router import TransportRouter  # noqa: E402
+
+__all__ = [
+    'WRAP_KIND',
+    'RELAY_CONTENT_MAX',
+    'FRAGMENT_BYTES',
+    'MAX_FRAGMENTS',
+    'ENVELOPE_MAX',
+    'SEEN_MAX',
+    'PARTIALS_PER_SENDER',
+    'PARTIALS_MAX',
+    'INBOX_MAX',
+    'DROPPED_KEPT',
+    'BACKOFF_MAX',
+    'EMPTY_TYPE',
+    'ACK_SLACK',
+    'ACK_GRACE',
+    'ACK_EXPIRE',
+    'TransportError',
+    'Inbound',
+    '_foreign',
+    'NostrTransport',
+    'RelayRung',
+    'TransportRouter',
+    'ladder',
+    'const',
+    'fips_rung',
+    'iroh_rung',
+    'netfetch',
+    'relay_rung',
+    'router',
+    'ws',
+]

node/transport/const.py

@@ -0,0 +1,110 @@
+"""Limits, kinds and timeouts shared by every transport rung, plus TransportError and Inbound.
+
+Separate so that the rungs and the router can read each value through this module at call time,
+which is what lets a test (or an operator) reassign one and have every reader see the new value.
+"""
+from __future__ import annotations
+
+from typing import Any
+
+from . import didcomm_inbound
+from fleetmesh_core.crypto import giftwrap
+
+
+WRAP_KIND: int = giftwrap.WRAP_LIVE
+# A wrap's seal is one nip44/2 payload, and nip44 caps plaintext at 65535
+# bytes. A deliver of a few dozen events with their envelopes is bigger, so
+# an envelope larger than this rides in numbered fragments, each its own wrap,
+# reassembled by the receiver before anything is decrypted.
+# A fragment is plaintext; what reaches the relay is that text sealed and then
+# wrapped, two NIP-44 layers, each padded and base64. A 40000-byte fragment
+# became a 76548-byte wrap content, and relay.pocketstr.com caps content at
+# 65536, so every deliver over one fragment was refused and the peer waited on
+# an envelope that never finished. 24000 wraps to 54704: under the cap with
+# room for a relay that pads differently. test_transport.py holds it there.
+RELAY_CONTENT_MAX: int = 65536
+FRAGMENT_BYTES: int = 24000
+# The receiver refuses an envelope claiming more than this many fragments, so
+# a sender that splits into more is publishing wraps nobody will ever
+# reassemble. It recorded nothing and the peer simply timed out - the same
+# shape as the fragment that did not fit: the sender never looked at whether
+# what it sent could arrive. Both ends read this number.
+MAX_FRAGMENTS: int = 64
+ENVELOPE_MAX: int = FRAGMENT_BYTES * MAX_FRAGMENTS
+# How long a peer's kind 10050 relay list (NIP-17) is trusted before it is read again.
+DM_RELAYS_TTL: int = 3600
+# What a peer, or a relay, may make this node hold on its behalf. Every one of
+# these was unbounded: the set of wrap ids seen, the fragments of envelopes
+# nobody finished, the inbox, and the list of drops. A node that runs for a
+# month must not remember every wrap it ever saw, and a peer that sends the
+# first fragment of ten thousand envelopes must not own the node's memory.
+SEEN_MAX: int = 20000
+PARTIALS_PER_SENDER: int = 4
+PARTIALS_MAX: int = 64
+INBOX_MAX: int = 10000
+DROPPED_KEPT: int = 200
+BACKOFF_MAX: float = 30.0
+# The empty message: DIDComm v2.1's carrier for headers with no body, which
+# is what a pure acknowledgment is. It is handled here, below the protocols,
+# and never reaches a handler.
+EMPTY_TYPE: str = 'https://didcomm.org/empty/1.0/empty'
+# A stored message is judged undelivered only against the peer's own
+# behaviour, never against a clock alone: the peer may be offline for a day,
+# which is the reason the message was stored. ACK_SLACK is how long after the
+# send a message from the peer counts as "heard since" - a relay serves a
+# stored wrap to a live subscription within seconds, so a peer that is
+# talking two minutes later has had it if it was ever going to. ACK_GRACE is
+# how long after that first hearing the verdict waits, because a node coming
+# back may send a receipt before it opens the replayed wrap. ACK_EXPIRE is the
+# relay's own horizon: past it nothing can arrive and the entry is dropped
+# without a verdict.
+ACK_SLACK: int = 120
+ACK_GRACE: int = 60
+ACK_EXPIRE: int = giftwrap.TWO_DAYS
+
+
+class TransportError(Exception):
+    pass
+
+
+# Anoncrypt on a direct rung. A JWE with no skid proves nothing about who
+# wrote it, and on a fips flow, an iroh stream or a libp2p stream there is
+# no seal either, so Inbound.sender is whatever `from` claimed. Every
+# handler in this node identifies the peer by inbound.sender, and the one
+# that checks `authenticated` for itself (mediation) is the exception, not
+# the rule. So a direct rung delivers an unauthenticated message only when
+# its type is one that is anonymous by design: a protocol whose handler
+# already treats the sender as a stranger. On the relay rung the seal
+# signer is verified (giftwrap.unwrap), so this gate does not apply there.
+#
+# - routing/2.0/forward: anyone may post to a leaf through its mediator;
+#   handle_forward checks body.next against the keylist, never the sender.
+# - trust-ping/2.0: reachability, anonymous by the DIDComm spec; no handler
+#   in this node acts on it.
+# - discover-features/2.0/queries: answered from the public descriptor, so a
+#   stranger learns nothing a relay would not tell it; the handler writes
+#   nothing against the sender.
+# Peering propose is NOT here: the offer handler writes a grant to `sender`.
+ANONYMOUS_OK: tuple[str, ...] = (
+    'https://didcomm.org/routing/2.0/forward',
+    'https://didcomm.org/trust-ping/2.0/',
+    'https://didcomm.org/discover-features/2.0/queries',
+)
+
+
+def anonymous_allowed(msg_type: Any) -> bool:
+    """True if an unauthenticated (anoncrypt) message of this type may be
+    delivered off a direct rung. Exact match or prefix with a trailing slash."""
+    if not isinstance(msg_type, str):
+        return False
+    for allowed in ANONYMOUS_OK:
+        if msg_type == allowed or (allowed.endswith('/') and msg_type.startswith(allowed)):
+            return True
+    return False
+
+
+# Inbound and the envelope-opening rule live in didcomm_inbound so that every
+# rung imports one definition; the name is re-exported here because the rest
+# of the node has always said transport.Inbound.
+Inbound = didcomm_inbound.Inbound
+_foreign = didcomm_inbound.foreign