From 4b3e8c3b8b9d10c8ac333dd8db614a7569052472 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Mon, 10 Aug 2026 03:07:56 +0200 Subject: feat: Phase 7 — Node v2 (multi-group, Sender Keys, 0-RTT, chat, denylist) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Implements all 8 milestones (7.0-7.7): - 7.0: JWT carries `groups` claim; node verifies group membership at MNP handshake (QUIC + TCP+TLS). Resolves security review C2. - 7.1: QUIC 0-RTT session resumption via stored session tickets (17-21ms reconnect vs 47ms cold). - 7.2: Hub→node WebSocket signaling for NAT punch coordination (`client_incoming`/`punch_ready`) + jti denylist push. Denylist class blocks revoked users/jtis at handshake. - 7.3: Multi-group daemon — one QUIC port serves N groups with per-group GEK, shared_root, and index routing. - 7.4: HLS streaming via QUIC (STREAM_SEGMENT message type, ffmpeg segment extraction). - 7.5: Sender Keys protocol for group chat (Signal Groups approach). Each member has own sending chain key, HKDF chain ratchet, AES-256-GCM encryption, Ed25519 signing. Resolves security review C1. - 7.6: Chat store (SQLite via aiosqlite), CHAT_MESSAGE MNP wire type with peer broadcast, web UI with WebSocket push. - 7.7: Argon2id calibration CLI. First security review included (first-review.md). 109 tests, demo-v3 validated against meshbay.org production hub. Co-Authored-By: Claude Opus 4.6 --- .../src/meshbay_node/transport/quic_client.py | 45 +++++++++++++++++++--- 1 file changed, 40 insertions(+), 5 deletions(-) (limited to 'packages/meshbay-node/src/meshbay_node/transport/quic_client.py') diff --git a/packages/meshbay-node/src/meshbay_node/transport/quic_client.py b/packages/meshbay-node/src/meshbay_node/transport/quic_client.py index a2220ff..83b729e 100644 --- a/packages/meshbay-node/src/meshbay_node/transport/quic_client.py +++ b/packages/meshbay-node/src/meshbay_node/transport/quic_client.py @@ -100,18 +100,22 @@ class QuicChunkClient: jwt_token: str, gek: bytes, pk_node_b64: str, - local_port: int = 0, # 0 = OS choisit; spécifier pour hole punching Port-Restricted + local_port: int = 0, # 0 = OS picks; set for hole punching (Port-Restricted) + group_id: str = "", + session_ticket: object | None = None, ): self._host = host self._port = port self._jwt_token = jwt_token self._gek = gek self._local_port = local_port + self._group_id = group_id self._pk_node = Ed25519PublicKey.from_public_bytes( base64.b64decode(pk_node_b64)) self._proto: _MNPClientProtocol | None = None self._cm = None self._ctrl_stream = 0 + self._session_ticket = session_ticket async def __aenter__(self): await self.connect() @@ -120,6 +124,13 @@ class QuicChunkClient: async def __aexit__(self, *_): await self.close() + @property + def session_ticket(self) -> object | None: + return self._session_ticket + + def _save_ticket(self, ticket: object) -> None: + self._session_ticket = ticket + async def connect(self) -> None: import ssl config = QuicConfiguration( @@ -127,20 +138,25 @@ class QuicChunkClient: alpn_protocols=ALPN, verify_mode=ssl.CERT_NONE, # identity verified via Ed25519 at MNP layer ) + if self._session_ticket: + config.session_ticket = self._session_ticket self._cm = connect( self._host, self._port, configuration=config, create_protocol=_MNPClientProtocol, - local_port=self._local_port, # 0 = aléatoire; local_port=X pour hole punching + local_port=self._local_port, + session_ticket_handler=self._save_ticket, ) self._proto = await self._cm.__aenter__() - # MNP handshake on stream 0 - self._proto._send(self._ctrl_stream, { + handshake_msg = { "type": MNP.HANDSHAKE, "v": MNP_VERSION, "token": self._jwt_token, - }) + } + if self._group_id: + handshake_msg["group_id"] = self._group_id + self._proto._send(self._ctrl_stream, handshake_msg) ack = await self._proto._recv(self._ctrl_stream) if ack.get("type") != MNP.HANDSHAKE_ACK: raise ConnectionError(f"QUIC handshake rejected: {ack}") @@ -198,3 +214,22 @@ class QuicChunkClient: raise ValueError("Plaintext hash mismatch after decryption") return plaintext + + async def fetch_stream_segment( + self, file_id: str, segment_index: int, segment_duration: int = 4, + ) -> bytes: + """Fetch one HLS segment (MPEG-TS bytes) over QUIC.""" + sid = self._new_stream() + self._proto._send(sid, { + "type": MNP.STREAM_SEGMENT, + "v": MNP_VERSION, + "file_id": file_id, + "segment_index": segment_index, + "segment_duration": segment_duration, + }) + msg = await self._proto._recv(sid, timeout=30.0) + + if msg.get("type") == "error": + raise LookupError(msg.get("detail", "Unknown error")) + + return base64.b64decode(msg["data_b64"]) -- cgit v1.2.3