diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-09-26 02:44:52 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-09-26 02:44:52 +0200 |
| commit | 4500fe3854fd3a499d1139bc89ccc488d104cc29 (patch) | |
| tree | 98def256b30df2ac22a1ce7b88d12139e659f84d /docs | |
| parent | bfd12aee8e3452f078ec20e3ee4d45c4fe9b4521 (diff) | |
| download | meshbay-4500fe3854fd3a499d1139bc89ccc488d104cc29.tar.gz | |
fix(hub): the NAT-punch signal needs a shared active group, like the offer relay
POST /v1/nodes/{id}/incoming checked only the caller's own address, then revealed
whether the node was connected (404 vs 504) and, with QUIC on, made it punch —
so any authenticated account could poll it for a node's liveness or make a
stranger's node emit a UDP probe. The membership gate webrtc_offer did inline is
now require_shared_active_group() in api/signaling.py, called by both routes; in
notify_incoming it runs before anything depends on the node's connection state,
so a non-member gets one uniform 403 whether the node is up or not.
test_incoming_membership.py holds it (a non-member is refused with a membership
403 whether the node is connected or not; a member passes the gate); red before,
green after. The offer relay is unchanged in behaviour (it now calls the shared
helper); signaling/availability suites pass. Design §7.2 updated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/MESHBAY_DESIGN.md | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index baef40d..4daa094 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -1819,7 +1819,10 @@ groups from a client (**NS7**). Signaling is rate-limited, SDP-size bounded, capped per user, and **the caller must share an active group with the target node**. Otherwise any authenticated user could make a third party's machine allocate peer connections on demand (**H6**). -The address in a NAT-punch request must match the caller's source address. +The NAT-punch signal shares the offer relay's gate — the caller must share an +active group with the node, checked before anything reveals whether the node is +connected, so it is no liveness oracle — and the address it names must match the +caller's own source address. **The offer ceilings bound a member and never an ordinary one** (**AV30**). They are sized against an account with twenty groups on three devices, because a |