diff options
Diffstat (limited to 'packages/meshbay-node/src/meshbay_node/transport')
| -rw-r--r-- | packages/meshbay-node/src/meshbay_node/transport/ice_filter.py | 115 |
1 files changed, 98 insertions, 17 deletions
diff --git a/packages/meshbay-node/src/meshbay_node/transport/ice_filter.py b/packages/meshbay-node/src/meshbay_node/transport/ice_filter.py index a91724e..f0f369e 100644 --- a/packages/meshbay-node/src/meshbay_node/transport/ice_filter.py +++ b/packages/meshbay-node/src/meshbay_node/transport/ice_filter.py @@ -15,6 +15,24 @@ the interfaces the operator actually wants. Two modes: Auto-excluded adapter name patterns: tailscale*, wt*, virbr*, docker*, veth*, br-*, podman*, cni*. + +Matching is "by adapter name", but an adapter does not have one name. ifaddr +reports `adapter.name` as the kernel name on Linux (`eth0`) and as a GUID on +Windows (`{846EE342-7039-11DE-9D20-806E6F6E6963}`), while `adapter.nice_name` +repeats the kernel name on Linux and carries the device *description* on +Windows. Neither is the connection name a Windows operator reads off +`ipconfig` ("Ethernet", "Wi-Fi"). So an include-list entry is compared, case +-insensitively, against the adapter's name, its nice_name, and its own IPv4 +addresses — an address is the one identifier visible on every platform, and +the settings field is free text, so operators write whichever they can see. + +A filter that matches nothing is worse than no filter: aioice binds one socket +per host address, so zero addresses means zero sockets, zero host candidates, +and an ICE session that can only ever offer a server-reflexive address. Behind +two layers of NAT that address is unreachable for a peer on the intermediate +LAN, so the connection cannot succeed at all — the failure looks like a network +problem and is silent. A filter that would return nothing therefore falls back +to the unfiltered list and logs a warning: slow beats unreachable. """ import ipaddress @@ -42,41 +60,104 @@ def _is_cgnat(addr: str) -> bool: return False +def _names(adapter) -> list[str]: + """Both identifiers ifaddr exposes; the same string twice on Linux.""" + return [n for n in (adapter.name, adapter.nice_name) if isinstance(n, str)] + + +def _ipv4s(adapter) -> list[str]: + return [ip.ip for ip in adapter.ips if isinstance(ip.ip, str)] + + +def _is_virtual(adapter) -> bool: + return any(_VIRTUAL_ADAPTER_RE.match(n) for n in _names(adapter)) + + +def _matches(adapter, include_set: set[str]) -> bool: + """True if the operator named this adapter, however they spelled it.""" + return any( + value.casefold() in include_set + for value in _names(adapter) + _ipv4s(adapter) + ) + + +def _addresses_of(adapter, use_ipv4: bool, use_ipv6: bool, *, + drop_cgnat: bool) -> list[str]: + """ + The usable addresses of one adapter. ifaddr gives IPv4 as a str and IPv6 + as an (address, flowinfo, scope_id) tuple, so the two are told apart by + type rather than by indexing — indexing a str yields characters, which + silently compare unequal to anything useful. + """ + out: list[str] = [] + for ip in adapter.ips: + if isinstance(ip.ip, str): + if not use_ipv4 or ip.ip == "127.0.0.1": + continue + if drop_cgnat and _is_cgnat(ip.ip): + continue + out.append(ip.ip) + elif isinstance(ip.ip, tuple) and len(ip.ip) >= 3: + # scope_id 0 == global; link-local needs a scope aioice has no use for + if use_ipv6 and ip.ip[0] != "::1" and ip.ip[2] == 0: + out.append(ip.ip[0]) + return out + + def install(include: list[str] | None = None) -> None: """Monkey-patch aioice.ice.get_host_addresses with a filtered version.""" import ifaddr - include_set = set(include) if include else None + include_set = {s.casefold() for s in include} if include else None def filtered_get_host_addresses( use_ipv4: bool = True, use_ipv6: bool = True, ) -> list[str]: + adapters = ifaddr.get_adapters() addresses: list[str] = [] - for adapter in ifaddr.get_adapters(): + + for adapter in adapters: if include_set is not None: - if adapter.name not in include_set: + if not _matches(adapter, include_set): continue - elif _VIRTUAL_ADAPTER_RE.match(adapter.name): - continue + # An explicitly named adapter is kept whatever its address range. + drop_cgnat = False + else: + if _is_virtual(adapter): + continue + drop_cgnat = True + addresses.extend( + _addresses_of(adapter, use_ipv4, use_ipv6, drop_cgnat=drop_cgnat)) + + if addresses: + return addresses - for ip in adapter.ips: - if isinstance(ip.ip, str) and use_ipv4 and ip.ip != "127.0.0.1": - if include_set is None and _is_cgnat(ip.ip): - continue - addresses.append(ip.ip) - elif use_ipv6 and ip.ip[0] != "::1" and ip.ip[2] == 0: - addresses.append(ip.ip[0]) - return addresses + # Nothing matched. Rather than gather no candidates at all, fall back to + # the unfiltered set — the operator loses the timeout saving, not the + # ability to connect. + fallback: list[str] = [] + for adapter in adapters: + fallback.extend( + _addresses_of(adapter, use_ipv4, use_ipv6, drop_cgnat=False)) + if fallback: + log.warning( + "ICE interface filter (%s) matched no address on this host; " + "using every interface instead. Adapters seen: %s", + "ice_interfaces=" + ", ".join(sorted(include)) if include + else "auto-exclude", + ", ".join(sorted({n for a in adapters for n in _names(a)})), + ) + return fallback aioice.ice.get_host_addresses = filtered_get_host_addresses if include_set: - log.info("ICE interfaces (explicit): %s", ", ".join(sorted(include_set))) + log.info("ICE interfaces (explicit): %s", ", ".join(sorted(include))) else: - all_adapters = [a.name for a in ifaddr.get_adapters()] excluded = [ - n for n in all_adapters - if _VIRTUAL_ADAPTER_RE.match(n) + a.nice_name or a.name + for a in ifaddr.get_adapters() + if _is_virtual(a) ] if excluded: log.info("ICE auto-excluded interfaces: %s", ", ".join(excluded)) |