From 9f7698340e5148f8f247fe0d70a57f7f37f1f72d Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Tue, 1 Sep 2026 18:56:01 +0200 Subject: feat(node): [node] quic_enabled flag, off by default MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The QUIC MNP listener was started unconditionally whenever aioquic was importable — but nothing speaks QUIC: the browser and desktop clients use WebRTC, QuicChunkClient has no production caller, and the hub-less `group://` sidecar (D9) is unbuilt. So on every node it was an open UDP port with no client and no working NAT traversal (`punch_nat()` is a direct-connection helper, not a traversal stack). daemon startup now gates QuicChunkServer on `self._config.node.quic_enabled` (default False; `MESHBAY_QUIC_ENABLED` overrides). The generated node.toml templates (config.py, the CLI, the desktop client) carry the line, commented for what it is. Removes the exposure the third review's M2 lives on until a QUIC client exists; the parity fix for the handlers themselves is the next commit. Third security review, finding M2 (mitigation). Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG --- packages/meshbay-node/src/meshbay_node/daemon.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'packages/meshbay-node/src/meshbay_node/daemon.py') diff --git a/packages/meshbay-node/src/meshbay_node/daemon.py b/packages/meshbay-node/src/meshbay_node/daemon.py index 056371a..8f9307c 100644 --- a/packages/meshbay-node/src/meshbay_node/daemon.py +++ b/packages/meshbay-node/src/meshbay_node/daemon.py @@ -537,7 +537,11 @@ class NodeDaemon: log.warning("WebRTC not available (aiortc not installed)") # 7. QUIC chunk server (LAN / port-forwarded / hub-less direct access) - if QUIC_AVAILABLE: + # + # Off unless `[node] quic_enabled = true`: no shipping client speaks + # QUIC (browser and desktop use WebRTC; the `group://` sidecar is + # unbuilt), so starting it by default only exposes a UDP port. + if QUIC_AVAILABLE and self._config.node.quic_enabled: self._quic_server = QuicChunkServer( sk_node=keys.sk_ed25519, hub_pk_pem=session.hub_pk_pem, @@ -553,6 +557,8 @@ class NodeDaemon: await self._quic_server.start() log.info("QUIC server on port %d (%d groups)", self._config.node.quic_port, len(groups_ctx)) + elif QUIC_AVAILABLE: + log.info("QUIC server disabled ([node] quic_enabled = false)") # 8. Hub WebSocket (signaling + revocations + WebRTC offers) async def on_webrtc_offer(sdp, peer_id, ice_candidates): @@ -1708,6 +1714,7 @@ def main() -> None: f'username = "{username}"', "", "[node]", + "quic_enabled = false # QUIC direct path; no client uses it yet", "quic_port = 19010", "ui_port = 18000", "", -- cgit v1.2.3