fleetmesh-node 0.2.0__py3-none-any.whl

sidecar/fleetmesh_p2p.py

@@ -0,0 +1,373 @@
+#!/usr/bin/env python3
+"""The libp2p half of the direct P2P transport, in its own process.
+
+    fleetmesh-p2p DIR [--port N] [--socket PATH] [--listen MULTIADDR]...
+
+Serves the stream protocol `/fleetmesh/didcomm/1.0.0` (schema/messages.json,
+`transports.libp2p`) and dials it. One stream carries one message: the dialer
+writes a JWE as a single line, half-closes, and the listener answers one
+JSON line `{"ack": true}` after it has queued the message for the node. The
+node talks to this process over `p2p.sock` in its directory, one JSON object
+per line, the protocol `fleetmesh-p2p/1`, the shape `node/p2p_wire/compartment.py` speaks.
+
+**What this process holds.** The Ed25519 transport key, read from
+`transport_seed` in the node's `keys.json`, and nothing else from it. That
+key is the libp2p PeerId (an Ed25519 key is small enough to be inlined under
+an identity multihash), and it is the `key transport` Multikey the node's
+descriptor publishes, so a peer that dials this process proves the same key
+its descriptor claims. `node_sk` is never read here: a compromise of this
+process costs one descriptor republish, which the specification allows to be
+free, and not the node's identity.
+
+**What this process does not authenticate.** The libp2p security handshake
+proves which transport key wrote to a stream. The node never sees that
+proof - it reads a line off a local socket, and on a shared host anyone with
+the socket could write one - so the payload is handed over with the remote
+PeerId's raw key and treated by the node exactly as a stream off the internet
+is: a JWE it can open, whose sender is whoever the ECDH-1PU agreement proves
+and never the `from` field. A plaintext body on this path is a drop with a
+reason on the node side.
+
+Why a separate process: the same reason as `fleetmesh_announce.py`. `node/`
+depends on `cryptography` alone and `fleetmesh_core/` on nothing; the libp2p stack is
+sixty-odd packages, several compiled, and it runs on trio where the node is
+threads. A node without this process has the relay rung and works.
+"""
+from __future__ import annotations
+
+import argparse
+import collections
+import json
+import os
+import stat
+import sys
+import time
+from typing import Any, Deque, Mapping, Optional
+
+import multiaddr
+import trio
+from libp2p import new_host
+from libp2p.crypto.ed25519 import create_new_key_pair
+from libp2p.custom_types import TProtocol
+from libp2p.network.stream.exceptions import StreamEOF, StreamError
+from libp2p.peer.id import ID
+from libp2p.peer.peerinfo import info_from_p2p_addr
+
+_ROOT = os.path.abspath(os.path.join(os.path.dirname(os.path.abspath(__file__)), '..'))
+sys.path.insert(0, _ROOT)
+from node.planes.transport.p2p.compartment import (DRAIN_MAX, MAX_LINE, PROTOCOL,      # noqa: E402
+                           STREAM_PROTOCOL, socket_path)
+
+PROTO: TProtocol = TProtocol(STREAM_PROTOCOL)
+# Inbound messages held for the node to drain. The node ticks every thirty
+# seconds; a burst must not outgrow the interval, so the oldest goes and the
+# loss is counted rather than hidden.
+INBOUND_MAX: int = 256
+# A JWE for one DIDComm message. Anything larger is refused before it is
+# buffered, on both the stream and the control socket.
+MESSAGE_MAX: int = MAX_LINE
+# How long one dial, one write and one ack may take together. The ladder's
+# attempt budget is five seconds (schema/constants.json transport), so a
+# rung that takes longer has already lost to the next one.
+DIAL_TIMEOUT: float = 5.0
+# A dialer that opens a stream and then says nothing holds a task; this is
+# how long it may do so.
+INBOUND_TIMEOUT: float = 10.0
+# The control socket: a client that connects and does not finish a line.
+CONTROL_TIMEOUT: float = 10.0
+
+
+def transport_seed(directory: str) -> bytes:
+    """The Ed25519 seed out of the node's key file, and nothing else from it."""
+    path = os.path.join(directory, 'keys.json')
+    mode = stat.S_IMODE(os.stat(path).st_mode)
+    if mode & 0o077:
+        raise PermissionError('%s is readable by others (mode %o); refusing to load' % (path, mode))
+    with open(path, encoding='utf-8') as f:
+        d = json.load(f)
+    if d.get('format') != 'meshnode-keys/1':
+        raise ValueError('not a meshnode key file')
+    seed = bytes.fromhex(d['transport_seed'])
+    if len(seed) != 32:
+        raise ValueError('the transport seed is 32 bytes')
+    return seed
+
+
+def ed25519_of(peer: ID) -> Optional[str]:
+    """The raw Ed25519 public key a PeerId carries, as hex, or None.
+
+    An RSA or secp256k1 peer has a hashed id and returns None; fleetmesh nodes
+    are Ed25519 by the key table, so such a peer is refused.
+    """
+    try:
+        pub = peer.extract_public_key()
+    except Exception:
+        return None
+    if pub is None:
+        return None
+    raw = pub.to_bytes()
+    return raw.hex() if len(raw) == 32 else None
+
+
+async def read_line(stream: Any, limit: int, timeout: float) -> Optional[bytes]:
+    """One newline-terminated line off a stream, or None when it is over
+    `limit`, unterminated at EOF, or slower than `timeout`.
+
+    libp2p signals EOF by raising rather than by returning b'', so both
+    spellings end the read.
+    """
+    buf = b''
+    with trio.move_on_after(timeout) as scope:
+        while len(buf) <= limit:
+            try:
+                chunk = await stream.read(65536)
+            except (StreamEOF, StreamError):
+                break
+            if not chunk:
+                break
+            buf += chunk
+            if buf.endswith(b'\n'):
+                break
+    if scope.cancelled_caught or not buf.endswith(b'\n') or len(buf) > limit + 1:
+        return None
+    return buf
+
+
+class P2P:
+    """The host, what it carried, and what it refused."""
+
+    def __init__(self, now: Any = None) -> None:
+        self.now = now or (lambda: int(time.time()))
+        self.host: Any = None
+        self.inbound: Deque[Mapping[str, Any]] = collections.deque(maxlen=INBOUND_MAX)
+        self.refused: collections.Counter[str] = collections.Counter()
+        self.received: int = 0
+        self.sent: int = 0
+        self.overflowed: int = 0
+        self.sent_bytes: int = 0
+        self.recv_bytes: int = 0
+
+    # ---- the stream protocol ------------------------------------------------
+    async def handle(self, stream: Any) -> None:
+        """One inbound stream: one line, one ack."""
+        try:
+            remote = stream.muxed_conn.peer_id
+            origin = ed25519_of(remote)
+            if origin is None:
+                self.refused['originator is not an Ed25519 peer'] += 1
+                await stream.reset()
+                return
+            line = await read_line(stream, MESSAGE_MAX, INBOUND_TIMEOUT)
+            if line is None:
+                self.refused['no complete line within %d bytes and %ds' % (MESSAGE_MAX, INBOUND_TIMEOUT)] += 1
+                await stream.reset()
+                return
+            try:
+                msg = json.loads(line)
+            except ValueError:
+                self.refused['not JSON'] += 1
+                await stream.reset()
+                return
+            if not isinstance(msg, dict):
+                self.refused['not an object'] += 1
+                await stream.reset()
+                return
+            if len(self.inbound) == self.inbound.maxlen:
+                self.overflowed += 1
+            self.inbound.append({'from_peer': str(remote), 'from_key': origin,
+                                 'message': msg, 'at': self.now()})
+            self.received += 1
+            self.recv_bytes += len(line)
+            await stream.write(b'{"ack":true}\n')
+            await stream.close()
+        except (StreamEOF, StreamError, trio.BrokenResourceError, trio.ClosedResourceError, OSError):
+            pass
+
+    async def send(self, target: str, payload: Mapping[str, Any]) -> Mapping[str, Any]:
+        """Dial `target` and deliver one message; accepted only after the ack.
+
+        `target` is a full multiaddr ending in /p2p/<PeerId>. The PeerId is
+        what the connection authenticates, so a caller that learned it from
+        the peer's descriptor has bound the pipe to the descriptor's key.
+        """
+        if self.host is None:
+            raise RuntimeError('the host is not up yet')
+        body = json.dumps(payload, separators=(',', ':'), sort_keys=True).encode('utf-8') + b'\n'
+        if len(body) > MESSAGE_MAX:
+            raise ValueError('a message of %d bytes is over the %d the stream carries' % (len(body), MESSAGE_MAX))
+        info = info_from_p2p_addr(multiaddr.Multiaddr(target))
+        ack: Optional[bytes] = None
+        with trio.move_on_after(DIAL_TIMEOUT) as scope:
+            await self.host.connect(info)
+            stream = await self.host.new_stream(info.peer_id, [PROTO])
+            try:
+                await stream.write(body)
+                await stream.close_write()
+                ack = await read_line(stream, 1024, DIAL_TIMEOUT)
+            finally:
+                await stream.close()
+        if scope.cancelled_caught:
+            raise TimeoutError('%s did not answer within %.0fs' % (target, DIAL_TIMEOUT))
+        if ack is None or not json.loads(ack).get('ack'):
+            raise RuntimeError('%s took the stream but did not acknowledge' % target)
+        self.sent += 1
+        self.sent_bytes += len(body)
+        return {'accepted': True, 'peer_id': str(info.peer_id), 'bytes': len(body)}
+
+    # ---- the control socket -------------------------------------------------
+    async def serve(self, path: str) -> None:
+        # Refuse to take a socket another instance is answering on; a stale
+        # file left by a crash is unlinked.
+        if os.path.exists(path):
+            probe = trio.socket.socket(trio.socket.AF_UNIX, trio.socket.SOCK_STREAM)
+            try:
+                await probe.connect(path)
+            except OSError:
+                os.unlink(path)
+            else:
+                raise RuntimeError('another fleetmesh-p2p is already serving %s' % path)
+            finally:
+                probe.close()
+        s = trio.socket.socket(trio.socket.AF_UNIX, trio.socket.SOCK_STREAM)
+        old = os.umask(0o177)
+        try:
+            await s.bind(path)
+            os.chmod(path, 0o600)
+        finally:
+            os.umask(old)
+        s.listen(8)
+        await trio.serve_listeners(self._one, [trio.SocketListener(s)])
+
+    async def _one(self, stream: trio.SocketStream) -> None:
+        try:
+            buf = b''
+            with trio.move_on_after(CONTROL_TIMEOUT):
+                while not buf.endswith(b'\n') and len(buf) <= MAX_LINE:
+                    chunk = await stream.receive_some(65536)
+                    if not chunk:
+                        break
+                    buf += chunk
+            try:
+                if not buf.endswith(b'\n') or len(buf) > MAX_LINE:
+                    raise ValueError('a request is one JSON line under %d bytes' % MAX_LINE)
+                req = json.loads(buf.decode('utf-8'))
+                if not isinstance(req, dict) or not isinstance(req.get('cmd'), str):
+                    raise ValueError('a request is {"cmd": ..., "args": {...}}')
+                args = req.get('args') or {}
+                if not isinstance(args, dict):
+                    raise ValueError('args is an object')
+                result = await self.dispatch(req['cmd'], args)
+                reply = {'ok': True, 'protocol': PROTOCOL, 'result': result}
+            except Exception as e:                  # one bad request answers one request
+                reply = {'ok': False, 'protocol': PROTOCOL, 'error': '%s: %s' % (type(e).__name__, e)}
+            await stream.send_all((json.dumps(reply) + '\n').encode('utf-8'))
+        except (trio.BrokenResourceError, trio.ClosedResourceError, OSError):
+            pass
+        finally:
+            await trio.aclose_forcefully(stream)
+
+    async def dispatch(self, cmd: str, args: Mapping[str, Any]) -> Any:
+        match cmd:
+            case 'status':
+                return self.status()
+            case 'drain':
+                try:
+                    want = min(int(args.get('max_items') or DRAIN_MAX), INBOUND_MAX)
+                except (TypeError, ValueError):
+                    want = DRAIN_MAX
+                out = [self.inbound.popleft() for _ in range(min(want, len(self.inbound)))]
+                refused = dict(self.refused)
+                self.refused.clear()
+                return {'items': out, 'refused': refused, 'overflowed': self.overflowed}
+            case 'send':
+                target = args.get('target')
+                payload = args.get('payload')
+                if not isinstance(target, str) or '/p2p/' not in target:
+                    raise ValueError('target is a multiaddr ending in /p2p/<PeerId>')
+                if not isinstance(payload, dict):
+                    raise ValueError('payload is one message object')
+                return await self.send(target, payload)
+            case 'inject':
+                # The test hook: what an inbound stream would have queued,
+                # without a second host. It is labelled as such so a node
+                # cannot mistake it for a stream that was authenticated.
+                msg = args.get('message')
+                if not isinstance(msg, dict):
+                    raise ValueError('message is an object')
+                self.inbound.append({'from_peer': str(args.get('from_peer', 'injected')),
+                                     'from_key': None, 'message': msg, 'at': self.now(),
+                                     'injected': True})
+                return {'injected': True}
+            case _:
+                raise KeyError(cmd)
+
+    def status(self) -> Mapping[str, Any]:
+        addrs = [str(a) for a in self.host.get_addrs()] if self.host is not None else []
+        return {
+            'protocol': PROTOCOL,
+            'stream_protocol': STREAM_PROTOCOL,
+            'peer_id': str(self.host.get_id()) if self.host is not None else None,
+            'transport_key': ed25519_of(self.host.get_id()) if self.host is not None else None,
+            'addrs': addrs,
+            'connected_peers': len(self.host.get_connected_peers()) if self.host is not None else 0,
+            'inbound_buffered': len(self.inbound),
+            'received': self.received,
+            'sent': self.sent,
+            'sent_bytes': self.sent_bytes,
+            'recv_bytes': self.recv_bytes,
+            'overflowed': self.overflowed,
+        }
+
+
+async def run(directory: str, port: int, listen: list[str], path: Optional[str] = None) -> None:
+    key_pair = create_new_key_pair(transport_seed(directory))
+    host = new_host(key_pair=key_pair)
+    state = P2P()
+    state.host = host
+    sock = path or socket_path(directory)
+    addrs = [multiaddr.Multiaddr(a) for a in listen] or [multiaddr.Multiaddr('/ip4/0.0.0.0/tcp/%d' % port)]
+    async with host.run(listen_addrs=addrs), trio.open_nursery() as nursery:
+        host.set_stream_handler(PROTO, state.handle)
+        print('%s  peer %s' % (STREAM_PROTOCOL, host.get_id()), flush=True)
+        for a in host.get_addrs():
+            print('  listening %s' % a, flush=True)
+        nursery.start_soon(state.serve, sock)
+        print('  socket %s' % sock, flush=True)
+        await trio.sleep_forever()
+
+
+def _leaves(e: BaseException) -> list[BaseException]:
+    """The real exceptions under however many ExceptionGroups trio nested."""
+    subs = getattr(e, 'exceptions', None)
+    if not subs:
+        return [e]
+    out: list[BaseException] = []
+    for s in subs:
+        out.extend(_leaves(s))
+    return out
+
+
+def main(argv: Optional[list[str]] = None) -> int:
+    ap = argparse.ArgumentParser(prog='fleetmesh-p2p', description=__doc__.splitlines()[0])
+    ap.add_argument('directory', help='the node directory, for keys.json and the socket')
+    ap.add_argument('--port', type=int, default=0, help='tcp port to listen on (0 asks the kernel)')
+    ap.add_argument('--listen', action='append', default=[], metavar='MULTIADDR',
+                    help='listen on this multiaddr instead of /ip4/0.0.0.0/tcp/PORT; repeatable')
+    ap.add_argument('--socket', default=None, help='where to listen (default: p2p.sock in the directory)')
+    a = ap.parse_args(argv)
+    try:
+        trio.run(run, a.directory, a.port, a.listen, a.socket)
+    except KeyboardInterrupt:
+        return 0
+    except Exception as e:
+        # A refusal at startup - a live socket, a loose keys.json, a missing
+        # key file - is one line, not a nursery traceback. trio wraps what a
+        # nursery task raised in an ExceptionGroup; unwrap for the message.
+        for inner in _leaves(e):
+            print('fleetmesh-p2p: %s: %s' % (type(inner).__name__, inner), file=sys.stderr, flush=True)
+        return 1
+    return 0
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())