|
| 1 | +package client |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "fmt" |
| 6 | + "net" |
| 7 | + "strings" |
| 8 | + "time" |
| 9 | + |
| 10 | + "github.com/caddyserver/certmagic" |
| 11 | + logging "github.com/ipfs/go-log/v2" |
| 12 | + "github.com/libp2p/go-libp2p" |
| 13 | + "github.com/libp2p/go-libp2p/core/host" |
| 14 | + "github.com/libp2p/go-libp2p/core/peer" |
| 15 | + libp2pquic "github.com/libp2p/go-libp2p/p2p/transport/quic" |
| 16 | + "github.com/libp2p/go-libp2p/p2p/transport/tcp" |
| 17 | + libp2pwebrtc "github.com/libp2p/go-libp2p/p2p/transport/webrtc" |
| 18 | + libp2pws "github.com/libp2p/go-libp2p/p2p/transport/websocket" |
| 19 | + libp2pwebtransport "github.com/libp2p/go-libp2p/p2p/transport/webtransport" |
| 20 | + "github.com/mholt/acmez/v2" |
| 21 | + "github.com/mholt/acmez/v2/acme" |
| 22 | + "github.com/multiformats/go-multiaddr" |
| 23 | + manet "github.com/multiformats/go-multiaddr/net" |
| 24 | + "github.com/multiformats/go-multibase" |
| 25 | +) |
| 26 | + |
| 27 | +var log = logging.Logger("p2p-forge/client") |
| 28 | + |
| 29 | +type P2PForgeCertMgr struct { |
| 30 | + forgeDomain string |
| 31 | + forgeRegistrationEndpoint string |
| 32 | + cfg *certmagic.Config |
| 33 | + h *hostWrapper |
| 34 | +} |
| 35 | + |
| 36 | +type hostWrapper struct { |
| 37 | + host.Host |
| 38 | +} |
| 39 | + |
| 40 | +type hostCloseWrapper struct { |
| 41 | + host.Host |
| 42 | + closeFn func() error |
| 43 | +} |
| 44 | + |
| 45 | +func (h hostCloseWrapper) Close() error { |
| 46 | + return h.closeFn() |
| 47 | +} |
| 48 | + |
| 49 | +var libp2pDirectWssComponent = multiaddr.StringCast("/tls/sni/*.libp2p.direct/ws") |
| 50 | + |
| 51 | +func NewHostWithP2PForge(forgeDomain string, forgeRegistrationEndpoint string, opts ...libp2p.Option) (host.Host, error) { |
| 52 | + certMgr := NewP2PForgeCertMgt(forgeDomain, forgeRegistrationEndpoint) |
| 53 | + tlsCfg := certMgr.cfg.TLSConfig() |
| 54 | + tlsCfg.NextProtos = nil // remove the ACME ALPN |
| 55 | + |
| 56 | + var h host.Host |
| 57 | + var err error |
| 58 | + // TODO: Option passing mechanism here isn't respectful of which transports the user wants to support or the addresses they want to listen on |
| 59 | + h, err = libp2p.New(libp2p.ChainOptions(libp2p.ChainOptions(opts...), |
| 60 | + libp2p.DefaultListenAddrs, |
| 61 | + libp2p.ListenAddrStrings([]string{ // TODO: Grab these addresses from a TCP listener and share the ports |
| 62 | + fmt.Sprintf("/ip4/0.0.0.0/tcp/0/tls/sni/*.%s/ws", forgeDomain), |
| 63 | + fmt.Sprintf("/ip6/::/tcp/0/tls/sni/*.%s/ws", forgeDomain), |
| 64 | + }...), |
| 65 | + libp2p.Transport(tcp.NewTCPTransport), |
| 66 | + libp2p.Transport(libp2pquic.NewTransport), |
| 67 | + libp2p.Transport(libp2pws.New, libp2pws.WithTLSConfig(tlsCfg)), |
| 68 | + libp2p.Transport(libp2pwebtransport.New), |
| 69 | + libp2p.Transport(libp2pwebrtc.New), |
| 70 | + libp2p.AddrsFactory(func(multiaddrs []multiaddr.Multiaddr) []multiaddr.Multiaddr { |
| 71 | + if h == nil { |
| 72 | + return multiaddrs |
| 73 | + } |
| 74 | + |
| 75 | + retAddrs := make([]multiaddr.Multiaddr, len(multiaddrs)) |
| 76 | + for i, a := range multiaddrs { |
| 77 | + if isRelayAddr(a) || !isPublicAddr(a) { |
| 78 | + retAddrs[i] = a |
| 79 | + continue |
| 80 | + } |
| 81 | + |
| 82 | + // We expect the address to be of the form: /ipX/<IP address>/tcp/<Port>/tls/sni/*.libp2p.direct/ws |
| 83 | + // We'll then replace the * with the IP address |
| 84 | + withoutLibp2pDirectWSS := a.Decapsulate(libp2pDirectWssComponent) |
| 85 | + if !withoutLibp2pDirectWSS.Equal(a) { |
| 86 | + retAddrs[i] = a |
| 87 | + continue |
| 88 | + } |
| 89 | + |
| 90 | + index := 0 |
| 91 | + var escapedIPStr string |
| 92 | + var ipMaStr string |
| 93 | + var tcpPortStr string |
| 94 | + multiaddr.ForEach(a, func(c multiaddr.Component) bool { |
| 95 | + switch index { |
| 96 | + case 0: |
| 97 | + switch c.Protocol().Code { |
| 98 | + case multiaddr.P_IP4: |
| 99 | + ipMaStr = c.String() |
| 100 | + ipAddr := c.Value() |
| 101 | + escapedIPStr = strings.ReplaceAll(ipAddr, ".", "-") |
| 102 | + case multiaddr.P_IP6: |
| 103 | + ipMaStr = c.String() |
| 104 | + ipAddr := c.Value() |
| 105 | + escapedIPStr = strings.ReplaceAll(ipAddr, ":", "-") |
| 106 | + if escapedIPStr[0] == '-' { |
| 107 | + escapedIPStr = "0" + escapedIPStr |
| 108 | + } |
| 109 | + if escapedIPStr[len(escapedIPStr)-1] == '-' { |
| 110 | + escapedIPStr = escapedIPStr + "0" |
| 111 | + } |
| 112 | + default: |
| 113 | + return false |
| 114 | + } |
| 115 | + case 1: |
| 116 | + if c.Protocol().Code != multiaddr.P_TCP { |
| 117 | + return false |
| 118 | + } |
| 119 | + tcpPortStr = c.Value() |
| 120 | + default: |
| 121 | + index++ |
| 122 | + return false |
| 123 | + } |
| 124 | + index++ |
| 125 | + return true |
| 126 | + }) |
| 127 | + if index != 2 || escapedIPStr == "" || tcpPortStr == "" { |
| 128 | + continue |
| 129 | + } |
| 130 | + |
| 131 | + pidStr := peer.ToCid(h.ID()).Encode(multibase.MustNewEncoder(multibase.Base36)) |
| 132 | + |
| 133 | + newMaStr := fmt.Sprintf("%s/tcp/%s/tls/sni/%s.%s.%s/w", ipMaStr, tcpPortStr, escapedIPStr, pidStr, forgeDomain) |
| 134 | + newMA, err := multiaddr.NewMultiaddr(newMaStr) |
| 135 | + if err != nil { |
| 136 | + log.Errorf("error creating new multiaddr from %q: %s", newMaStr, err.Error()) |
| 137 | + continue |
| 138 | + } |
| 139 | + retAddrs[i] = newMA |
| 140 | + } |
| 141 | + return retAddrs |
| 142 | + }), |
| 143 | + )) |
| 144 | + if err != nil { |
| 145 | + return nil, err |
| 146 | + } |
| 147 | + |
| 148 | + ctx, cancel := context.WithCancel(context.Background()) |
| 149 | + if err := certMgr.Run(ctx, h); err != nil { |
| 150 | + cancel() |
| 151 | + return nil, err |
| 152 | + } |
| 153 | + |
| 154 | + w := &hostCloseWrapper{Host: h, closeFn: func() error { |
| 155 | + cancel() |
| 156 | + err := h.Close() |
| 157 | + return err |
| 158 | + }} |
| 159 | + |
| 160 | + return w, nil |
| 161 | +} |
| 162 | + |
| 163 | +func isRelayAddr(a multiaddr.Multiaddr) bool { |
| 164 | + found := false |
| 165 | + multiaddr.ForEach(a, func(c multiaddr.Component) bool { |
| 166 | + found = c.Protocol().Code == multiaddr.P_CIRCUIT |
| 167 | + return !found |
| 168 | + }) |
| 169 | + return found |
| 170 | +} |
| 171 | + |
| 172 | +var publicCIDR6 = "2000::/3" |
| 173 | +var public6 *net.IPNet |
| 174 | + |
| 175 | +func init() { |
| 176 | + _, public6, _ = net.ParseCIDR(publicCIDR6) |
| 177 | +} |
| 178 | + |
| 179 | +// isPublicAddr follows the logic of manet.IsPublicAddr, except it uses |
| 180 | +// a stricter definition of "public" for ipv6: namely "is it in 2000::/3"? |
| 181 | +func isPublicAddr(a multiaddr.Multiaddr) bool { |
| 182 | + ip, err := manet.ToIP(a) |
| 183 | + if err != nil { |
| 184 | + return false |
| 185 | + } |
| 186 | + if ip.To4() != nil { |
| 187 | + return !inAddrRange(ip, manet.Private4) && !inAddrRange(ip, manet.Unroutable4) |
| 188 | + } |
| 189 | + |
| 190 | + return public6.Contains(ip) |
| 191 | +} |
| 192 | + |
| 193 | +func inAddrRange(ip net.IP, ipnets []*net.IPNet) bool { |
| 194 | + for _, ipnet := range ipnets { |
| 195 | + if ipnet.Contains(ip) { |
| 196 | + return true |
| 197 | + } |
| 198 | + } |
| 199 | + |
| 200 | + return false |
| 201 | +} |
| 202 | + |
| 203 | +func NewP2PForgeCertMgt(forgeDomain string, forgeRegistrationEndpoint string) *P2PForgeCertMgr { |
| 204 | + cfg := certmagic.NewDefault() |
| 205 | + cfg.Storage = &certmagic.FileStorage{Path: "foo"} |
| 206 | + h := &hostWrapper{} |
| 207 | + myACME := certmagic.NewACMEIssuer(cfg, certmagic.ACMEIssuer{ // TODO: UX around user passed emails + agreement |
| 208 | + CA: certmagic.LetsEncryptStagingCA, // TODO: Switch to real CA by default |
| 209 | + Email: "you@yours.com", |
| 210 | + Agreed: true, |
| 211 | + DNS01Solver: &dns01P2PForgeSolver{forgeRegistrationEndpoint, h}, |
| 212 | + }) |
| 213 | + cfg.Issuers = []certmagic.Issuer{myACME} |
| 214 | + return &P2PForgeCertMgr{forgeDomain, forgeRegistrationEndpoint, cfg, h} |
| 215 | +} |
| 216 | + |
| 217 | +func (m *P2PForgeCertMgr) Run(ctx context.Context, h host.Host) error { |
| 218 | + m.h.Host = h |
| 219 | + pb36 := peer.ToCid(h.ID()).Encode(multibase.MustNewEncoder(multibase.Base36)) |
| 220 | + |
| 221 | + if err := m.cfg.ManageAsync(ctx, []string{fmt.Sprintf("*.%s.libp2p.direct", pb36)}); err != nil { |
| 222 | + return err |
| 223 | + } |
| 224 | + return nil |
| 225 | +} |
| 226 | + |
| 227 | +type dns01P2PForgeSolver struct { |
| 228 | + forge string |
| 229 | + host host.Host |
| 230 | +} |
| 231 | + |
| 232 | +func (d *dns01P2PForgeSolver) Wait(ctx context.Context, challenge acme.Challenge) error { |
| 233 | + // TODO: query the authoritative DNS |
| 234 | + time.Sleep(time.Second * 5) |
| 235 | + return nil |
| 236 | +} |
| 237 | + |
| 238 | +func (d *dns01P2PForgeSolver) Present(ctx context.Context, challenge acme.Challenge) error { |
| 239 | + return SendChallenge(ctx, d.forge, d.host.ID(), d.host.Peerstore().PrivKey(d.host.ID()), challenge.DNS01KeyAuthorization(), d.host.Addrs()) |
| 240 | +} |
| 241 | + |
| 242 | +func (d *dns01P2PForgeSolver) CleanUp(ctx context.Context, challenge acme.Challenge) error { |
| 243 | + //TODO: Should we implement this, or is doing delete and Last-Writer-Wins enough? |
| 244 | + return nil |
| 245 | +} |
| 246 | + |
| 247 | +var _ acmez.Solver = (*dns01P2PForgeSolver)(nil) |
| 248 | +var _ acmez.Waiter = (*dns01P2PForgeSolver)(nil) |
0 commit comments