From d1f998b42137465b610667439527917a00030b4d Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Mon, 7 Sep 2026 16:02:10 +0200 Subject: fix(mnp): give a reply an id, so it stops being routed by luck MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit MNP carried no correlation id. A reply named its own type and nothing else, so a client with more than one request in flight worked out which one a message answered from the message itself — and for the replies that name nothing it could not. `_dispatch` fell through to matching by arrival order, which is a guess. `_sendAndWait` had the right value all along: it keys `_pending` by `this._seqId++` and never put it on the wire. The guess fails asymmetrically, which is why it hid. The victim is not the request that was answered wrongly — it is the unrelated one that now waits out its own 30s timeout for a reply already delivered elsewhere. Live on 2026-09-06: five `music_meta_req` sat pending for over 100 seconds behind a failing MusicBrainz, and a `device_list_result` was handed to one of them. The composer is disabled while a send is in flight, so a chat message whose reply went astray the same way left the Chat tab looking frozen for thirty seconds, then unfroze on its own. The `ack` half of this was fixed on 2026-08-30 by matching on request type. That closed the instance and left the class open: a refusal has no type to match on either, and `_dispatch_message`'s catch-all answers every unforeseen failure with `{"type": "error", "detail": "Request failed"}` — 238 of this module's 240 error sends name nothing at all. `req_id` now rides on the request and comes back on the reply. On the node it is published for the whole handler in a ContextVar and stamped by `_send`: a parameter would have meant threading an argument through all 240 send sites, and asyncio copies the context into a task, so a handler that `_spawn`s its real work still answers under the right id. It is never stamped on a broadcast — those answer nothing, and the owner check in `_send` is what keeps a chat broadcast or an index push from reaching another peer looking like a reply. On the client, `_dispatch` resolves on `req_id` first and the arrival-order fallback is gone the moment a node proves it stamps (`_correlates`, armed by the handshake's own reply). The fallback stays for an MNP 1.0 node, unchanged and no wider: there it is the only thing there is, and removing it would leave device_list_result, join_result and the handshake replies reaching nobody. Two things fall out. `sendChat` refuses an `error` reply like every other request in the file — it returned it as success, which did not matter while a refusal reached the wrong caller anyway and would now show a rejected message as sent. And `_group_ctx` uses `.get`: a reload pops a removed group while sessions connected to it are open, and every request they had left raised KeyError into that same catch-all. Sealed index messages are the one exception to the fast path. They cannot be handed over until they are opened, which is asynchronous while `_dispatch` is not — resolving on the id alone gave `fetchIndex` the envelope and skipped `onIndexSync` entirely. Caught by extending `index_seal_probe.mjs` to stamp a reply the way a current node does, after the hub suite passed over it: the probe built its own frames and had never seen one. Tests, all failing before and passing after: `test_chat_send.py` drives the real ChatPanel over the real transport for both shapes of reply with an older request pending (3 of its 6 are new, and the 3 for `ack` pass either way, so it discriminates); `test_reply_correlation.py` pins the node's half — the refusals that name nothing else, the broadcast that must not be stamped, and a late reply from a spawned task answering under its own id rather than the most recent request's. Full suite: 1897 passed, same 11 pre-existing failures as before. QUIC keeps its own dispatch and is not stamped. It is disabled by default and no browser request reaches it, but the asymmetry is real. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Dn1xYx9uT69mCB6UDvyKAN --- .../meshbay-node/tests/test_reply_correlation.py | 147 +++++++++++++++++++++ 1 file changed, 147 insertions(+) create mode 100644 packages/meshbay-node/tests/test_reply_correlation.py (limited to 'packages/meshbay-node/tests') diff --git a/packages/meshbay-node/tests/test_reply_correlation.py b/packages/meshbay-node/tests/test_reply_correlation.py new file mode 100644 index 0000000..7c2138b --- /dev/null +++ b/packages/meshbay-node/tests/test_reply_correlation.py @@ -0,0 +1,147 @@ +""" +A reply names the request it answers. + +MNP carried no correlation id until 2026-09-07. A reply named its own type and +nothing else, so a client with more than one request outstanding had to work out +which one a message answered from the message itself — and for the replies that +name nothing, it could not. This module sends `{"type": "error"}` from 240 +places and two of them say what they are about; `_dispatch_message`'s catch-all +is one of the 238. Such a refusal reached no caller at all: the browser handed +it to whichever request happened to be waiting, and the request it belonged to +sat until its own 30s timeout. Live symptom (2026-09-06): the Chat composer is +disabled while a send is in flight, so a chat message whose refusal went astray +froze the tab for thirty seconds. + +`req_id` is the client's own pending-map key, put on the wire and stamped back +onto the reply by `_send`. What matters here, and what the browser cannot check +for itself: + + * a reply carries it, including the refusals that name nothing else; + * a *broadcast* does not — it answers no request, and stamping it would hand + another peer's client a reply to a request it never made; + * work handed to a background task still answers under the right id, which is + why this is a ContextVar and not an attribute on the session. +""" +import asyncio + +import msgpack +import pytest +from meshbay_common.protocol import MNP +from meshbay_node.transport.webrtc_server import WebRTCPeerSession + +pytestmark = pytest.mark.asyncio + + +class _Channel: + readyState = "open" + + def __init__(self): + self.sent = [] + + def send(self, framed): + # Skip the 4-byte length prefix _pack writes. + self.sent.append(msgpack.unpackb(framed[4:], raw=False)) + + +def _session(peer_id="p"): + s = WebRTCPeerSession.__new__(WebRTCPeerSession) + s._ctx = {} + s._peer_id = peer_id + s._user_id = None + s._group_id = "" + s._channel = _Channel() + s._tasks = set() + return s + + +async def test_a_refusal_that_names_nothing_else_names_the_request(): + """The reply at the root of the defect: no type of its own to match on.""" + s = _session() + # No handshake yet, so any other message is refused — a bare `error`, the + # same shape the catch-all sends and the same shape a browser could not + # route. + s._handle_message({"type": MNP.CHAT_MESSAGE, "req_id": 41}) + + (reply,) = s._channel.sent + assert reply["type"] == "error" + assert reply["req_id"] == 41, ( + "a refusal that names neither the request nor a type of its own is a " + "reply no caller can claim") + + +async def test_the_catch_all_refusal_names_the_request_too(): + """Every failure in the dispatch loop funnels into one generic reply.""" + s = _session() + s._user_id = "u" + + def _boom(msg): + raise RuntimeError("filesystem path that must not reach the peer") + s._do_chat_message = _boom + + s._handle_message({"type": MNP.CHAT_MESSAGE, "req_id": 7}) + + (reply,) = s._channel.sent + assert reply == {"type": "error", "detail": "Request failed", "req_id": 7}, ( + "the catch-all is where an unforeseen failure ends up, so it is exactly " + "the reply that must still be routable") + + +async def test_a_request_without_an_id_is_answered_without_one(): + """An older client sends none; nothing may be invented for it.""" + s = _session() + s._handle_message({"type": MNP.CHAT_MESSAGE}) + + (reply,) = s._channel.sent + assert "req_id" not in reply + + +async def test_a_broadcast_to_another_peer_is_not_stamped(): + """The reply goes to the asker; the broadcast goes to everyone else. + + They travel out of the same handler, and only the first answers anything. + Stamping the second would hand another browser a reply keyed to a pending + request of its own that it never sent — the very confusion this fixes. + """ + asker, other = _session("asker"), _session("other") + asker._user_id, other._user_id = "a", "b" + registry = {"a": asker, "b": other} + asker._peer_registry = lambda: registry + asker._user_names = lambda: {} + asker._audit = lambda *a, **k: None + asker._group_ctx = lambda: {} + + asker._handle_message({"type": MNP.CHAT_MESSAGE, "payload": "hi", "req_id": 3}) + + (ack,) = asker._channel.sent + assert ack["type"] == "ack" and ack["req_id"] == 3 + (broadcast,) = other._channel.sent + assert broadcast["type"] == MNP.CHAT_MESSAGE + assert "req_id" not in broadcast, ( + "a broadcast answers no request and must not look like a reply") + + +async def test_work_handed_to_a_task_still_answers_under_the_right_id(): + """Most handlers `_spawn` their real work, and the reply leaves long after + the dispatch call that started it has returned. + + This is the reason the id lives in a ContextVar: asyncio copies the current + context into a task, so the answer keeps the id even though nothing passed + it along. An attribute on the session would have been overwritten by the + next message to arrive in the meantime. + """ + s = _session() + s._user_id = "u" + + async def _late(reply): + await asyncio.sleep(0.01) + s._send({"type": "roster_read_resp", "detail": reply}) + s._do_chat_message = lambda msg: s._spawn(_late(msg["payload"])) + + s._handle_message({"type": MNP.CHAT_MESSAGE, "payload": "first", "req_id": 11}) + # A second request arrives while the first one's task is still asleep. + s._handle_message({"type": MNP.CHAT_MESSAGE, "payload": "second", "req_id": 12}) + await asyncio.gather(*list(s._tasks)) + + by_id = {m["req_id"]: m["detail"] for m in s._channel.sent} + assert by_id == {11: "first", 12: "second"}, ( + "a late reply answered under whichever request arrived most recently") -- cgit v1.2.3 From 77dd077491aea50e71e21e0d17555a2f91cf818b Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Mon, 7 Sep 2026 17:45:54 +0200 Subject: refactor(mnp)!: remove stream_seg, the last unencrypted content message MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `stream_seg` answered with an MPEG-TS segment as base64 with no encryption at all — the one message on the content plane that never went through a GEK-derived key. Live on both transports, answering any authenticated member. It predates `stream_data`, which does the same job properly (`chunk_ciphertext`, keyed per segment, AES-256-GCM) and has since Phase 12. Its only browser caller, `fetchStreamSegment`, was defined and never once invoked — a plaintext media endpoint with no client. Removed rather than repaired. Gone with it: `_extract_segment` and the ffmpeg semaphore in quic_server, the `fetch_stream_segment` QUIC client method, and `_b64decode` in transport.js, which had no other caller. The H6 regression test lived on this handler — it pinned `_do_stream_segment_async` to a coroutine so `subprocess.run` could not stall the event loop for thirty seconds per request. It is replaced by the property that outlives the handler: no transport carries media outside an AEAD, asserted on `stream_seg` and `data_b64` across all three transport modules. The half of H6 that survives — the live streaming path still spawns ffmpeg — keeps its own test. BREAKING CHANGE: `stream_seg` is no longer answered on either transport. No shipping client sends it. Recorded as part of MNP 2.0, whose other half — the sealed upload — carries the version bump. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01AsoWC3GmhNdwVFomW3QjH3 --- docs/devel-phases-next.md | 2 +- .../meshbay-common/src/meshbay_common/protocol.py | 8 ++- .../src/meshbay_hub/static/transport.js | 19 ------ .../src/meshbay_node/transport/quic_client.py | 19 ------ .../src/meshbay_node/transport/quic_server.py | 76 ---------------------- .../src/meshbay_node/transport/webrtc_server.py | 67 ------------------- .../tests/test_security_regressions.py | 48 +++++++++++--- packages/meshbay-node/tests/test_task_lifetime.py | 9 ++- .../meshbay-node/tests/test_webrtc_transport.py | 30 --------- 9 files changed, 53 insertions(+), 225 deletions(-) (limited to 'packages/meshbay-node/tests') diff --git a/docs/devel-phases-next.md b/docs/devel-phases-next.md index e842b62..7a4ee24 100644 --- a/docs/devel-phases-next.md +++ b/docs/devel-phases-next.md @@ -503,7 +503,7 @@ Browser Node - No seeking beyond buffered range (user must wait for data to arrive) - No adaptive bitrate (single quality stream) -- Requires ffmpeg/ffprobe on the node (already a dependency for the old STREAM_SEGMENT handler) +- Requires ffmpeg/ffprobe on the node (already a dependency for the live streaming path) --- diff --git a/packages/meshbay-common/src/meshbay_common/protocol.py b/packages/meshbay-common/src/meshbay_common/protocol.py index 6eff5b6..bb52a51 100644 --- a/packages/meshbay-common/src/meshbay_common/protocol.py +++ b/packages/meshbay-common/src/meshbay_common/protocol.py @@ -59,7 +59,13 @@ class MNP: INDEX_PROGRESS = "index_progress" FILE_REQUEST = "file_req" # request chunk(s) FILE_CHUNK = "file_chunk" # encrypted chunk response - STREAM_SEGMENT = "stream_seg" # HLS/DASH segment + # STREAM_SEGMENT ("stream_seg") was removed in MNP 2.0. It served an + # MPEG-TS segment as base64 **with no encryption at all** — the one message + # on the content plane that never was under a GEK-derived key. It predates + # STREAM_DATA, which does the same job properly (`chunk_ciphertext`, keyed + # per segment), and its browser caller `fetchStreamSegment` was defined and + # never once invoked. A live handler on both transports, plaintext media, + # and no client: removed rather than repaired. CHAT_MESSAGE = "chat_msg" # Double Ratchet message CHAT_ATTACHMENT = "chat_attach" # attachment metadata CHAT_HISTORY = "chat_hist" # request message history (newest, or before a cursor) diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js index e57ad8b..2668e02 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js @@ -1376,18 +1376,6 @@ class MeshBayTransport { return msg; } - async fetchStreamSegment(fileId, segmentIndex, segmentDuration) { - const msg = await this._sendAndWait({ - type: 'stream_seg', - v: '0.1', - file_id: fileId, - segment_index: segmentIndex, - segment_duration: segmentDuration || 4, - }); - if (msg.type === 'error') throw new Error(msg.detail); - return _b64decode(msg.data_b64); - } - /** * A page of chat history, newest first by default. * @@ -3029,13 +3017,6 @@ function _decodeMap(buf, view, offset, count) { return [obj, offset]; } -function _b64decode(b64) { - const binary = atob(b64); - const bytes = new Uint8Array(binary.length); - for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i); - return bytes; -} - function _extractDtlsFingerprint(sdp) { const match = sdp.match(/a=fingerprint:sha-256 ([0-9A-Fa-f:]+)/); if (!match) return new Uint8Array(0); diff --git a/packages/meshbay-node/src/meshbay_node/transport/quic_client.py b/packages/meshbay-node/src/meshbay_node/transport/quic_client.py index b22b8df..af87b70 100644 --- a/packages/meshbay-node/src/meshbay_node/transport/quic_client.py +++ b/packages/meshbay-node/src/meshbay_node/transport/quic_client.py @@ -317,22 +317,3 @@ class QuicChunkClient: # substitutes it would otherwise choose which key we decrypt with. return file_chunk_plaintext( self._gek, msg, file_hash=bytes.fromhex(file_id)) - - async def fetch_stream_segment( - self, file_id: str, segment_index: int, segment_duration: int = 4, - ) -> bytes: - """Fetch one HLS segment (MPEG-TS bytes) over QUIC.""" - sid = self._new_stream() - self._proto._send(sid, { - "type": MNP.STREAM_SEGMENT, - "v": MNP_VERSION, - "file_id": file_id, - "segment_index": segment_index, - "segment_duration": segment_duration, - }) - msg = await self._proto._recv(sid, timeout=30.0) - - if msg.get("type") == "error": - raise LookupError(msg.get("detail", "Unknown error")) - - return base64.b64decode(msg["data_b64"]) diff --git a/packages/meshbay-node/src/meshbay_node/transport/quic_server.py b/packages/meshbay-node/src/meshbay_node/transport/quic_server.py index 360b9ac..29dfef2 100644 --- a/packages/meshbay-node/src/meshbay_node/transport/quic_server.py +++ b/packages/meshbay-node/src/meshbay_node/transport/quic_server.py @@ -22,7 +22,6 @@ import base64 import logging import os import struct -import subprocess from pathlib import Path from typing import Any, Callable @@ -53,7 +52,6 @@ from meshbay_common.groupbox import PURPOSE_ACK, seal from meshbay_common.protocol import MNP, file_chunk_wire from meshbay_node.indexer import GroupIndex from meshbay_node.transport.wire import index_sync_message -from meshbay_node import platform log = logging.getLogger(__name__) @@ -61,16 +59,6 @@ CHUNK_SIZE = 1024 * 1024 MAX_MSG = 64 * 1024 * 1024 ALPN = ["meshbay-mnp"] -# ffmpeg is spawned per STREAM_SEGMENT request, and `_extract_segment` runs -# `subprocess.run` synchronously — so without a bound, an authenticated peer can -# both fork-bomb the node and block its event loop for up to 30 s per request -# (finding M2c). Extraction now runs in a thread and passes through this -# semaphore. Small on purpose: the QUIC path has no shipping client yet, this is -# parity work with the WebRTC transcode cap. -_MAX_CONCURRENT_SEGMENTS = 4 -_segment_sem = asyncio.Semaphore(_MAX_CONCURRENT_SEGMENTS) - - class Denylist: """ Denylist for revoked users, groups and invalidated JWTs. @@ -243,8 +231,6 @@ class _MNPServerProtocol(QuicConnectionProtocol): self._do_index_sync_sync(stream_id) elif mtype == MNP.FILE_REQUEST: self._do_file_request_sync(stream_id, msg) - elif mtype == MNP.STREAM_SEGMENT: - self._spawn(self._do_stream_segment(stream_id, msg)) elif mtype == MNP.CHAT_MESSAGE: self._do_chat_message_sync(stream_id, msg) elif mtype == MNP.PING: @@ -431,49 +417,6 @@ class _MNPServerProtocol(QuicConnectionProtocol): ctx["gek"], file_path, chunk_index, file_hash, entry.id) self._send(stream_id, chunk_data) - async def _do_stream_segment(self, stream_id: int, msg: dict) -> None: - """ - Extract and serve one segment via ffmpeg — off the event loop and behind - a concurrency bound, so one request can neither stall the whole node nor - fork-bomb it (finding M2c). The WebRTC path has had both since Phase 11.5. - """ - try: - ctx = self._group_ctx() - file_id = msg["file_id"] - segment_index = msg["segment_index"] - segment_duration = msg.get("segment_duration", 4) - - entry = ctx["index"].get_entry(file_id) - if not entry: - self._send(stream_id, {"type": "error", "detail": "File not found"}) - return - - file_path = entry_abs_path(ctx["roots"], entry) - if not file_path.exists(): - self._send(stream_id, {"type": "error", "detail": "File not on disk"}) - return - - start_time = segment_index * segment_duration - loop = asyncio.get_event_loop() - async with _segment_sem: - segment_data = await loop.run_in_executor( - None, _extract_segment, file_path, start_time, segment_duration) - if segment_data is None: - self._send(stream_id, {"type": "error", "detail": "Segment extraction failed"}) - return - - self._send(stream_id, { - "type": MNP.STREAM_SEGMENT, - "v": MNP_VERSION, - "file_id": file_id, - "segment_index": segment_index, - "data_b64": base64.b64encode(segment_data).decode(), - "size": len(segment_data), - }) - except Exception as e: - log.error("stream_segment: %s", e) - self._send(stream_id, {"type": "error", "detail": "Segment extraction failed"}) - def _do_chat_message_sync(self, stream_id: int, msg: dict) -> None: """ Store a chat message and broadcast it to the rest of THIS group. @@ -542,25 +485,6 @@ def _read_and_encrypt( return file_chunk_wire(gek, plaintext, chunk_index, file_hash, file_id) -def _extract_segment(file_path: Path, start_time: float, duration: float) -> bytes | None: - """Extract one HLS segment via ffmpeg. Returns MPEG-TS bytes or None on failure.""" - try: - result = subprocess.run( - [platform.ffmpeg_cmd(), "-hide_banner", "-loglevel", "error", - "-ss", str(start_time), - "-i", str(file_path), - "-t", str(duration), - "-c:v", "copy", "-c:a", "copy", - "-f", "mpegts", "pipe:1"], - capture_output=True, timeout=30, - ) - if result.returncode == 0 and result.stdout: - return result.stdout - return None - except Exception: - return None - - # ── QuicChunkServer ──────────────────────────────────────────────────────────── class QuicChunkServer: diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py index aaf3f81..f8b6c03 100644 --- a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py +++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py @@ -479,8 +479,6 @@ class WebRTCPeerSession: # Chunks are matched by file and index on the client, so # answering out of order is safe. self._spawn(self._do_file_request(msg)) - elif mtype == MNP.STREAM_SEGMENT: - self._do_stream_segment(msg) elif mtype == MNP.CHAT_MESSAGE: self._do_chat_message(msg) elif mtype == MNP.CHAT_HISTORY: @@ -3801,71 +3799,6 @@ class WebRTCPeerSession: "director": director, } - def _do_stream_segment(self, msg: dict) -> None: - self._spawn(self._do_stream_segment_async(msg)) - - async def _do_stream_segment_async(self, msg: dict) -> None: - """ - Legacy HLS segment extraction (superseded by stream_req/MSE). - - Finding H6: this ran subprocess.run(..., timeout=30) directly inside the - event loop, so a single request stalled the whole daemon — every peer, - every group — for up to thirty seconds. Now async and under the same - transcode semaphore as _stream_video. - """ - ctx = self._group_ctx() - file_id = msg["file_id"] - segment_index = msg["segment_index"] - segment_duration = msg.get("segment_duration", 4) - - entry = ctx["index"].get_entry(file_id) - if not entry: - self._send({"type": "error", "detail": "File not found"}) - return - - file_path = entry_abs_path(ctx["roots"], entry) - if not file_path.exists(): - self._send({"type": "error", "detail": "File not on disk"}) - return - - sem = self._transcode_semaphore() - - try: - async with sem: - proc = await asyncio.create_subprocess_exec( - platform.ffmpeg_cmd(), "-hide_banner", "-loglevel", "error", - "-ss", str(segment_index * segment_duration), - "-i", str(file_path), - "-t", str(segment_duration), - "-c:v", "copy", "-c:a", "copy", - "-f", "mpegts", "pipe:1", - stdout=asyncio.subprocess.PIPE, - stderr=asyncio.subprocess.DEVNULL, - ) - try: - stdout, _ = await asyncio.wait_for(proc.communicate(), timeout=30) - except asyncio.TimeoutError: - proc.kill() - await proc.wait() - self._send({"type": "error", "detail": "Segment extraction timed out"}) - return - if proc.returncode != 0 or not stdout: - self._send({"type": "error", "detail": "Segment extraction failed"}) - return - segment_data = stdout - except Exception: - self._send({"type": "error", "detail": "Segment extraction failed"}) - return - - self._send({ - "type": MNP.STREAM_SEGMENT, - "v": MNP_VERSION, - "file_id": file_id, - "segment_index": segment_index, - "data_b64": base64.b64encode(segment_data).decode(), - "size": len(segment_data), - }) - def _do_chat_message(self, msg: dict) -> None: # Per-group store — see _peer_registry() and finding H1. Reading chat_store # off the shared transport context sent every group's messages to the first diff --git a/packages/meshbay-node/tests/test_security_regressions.py b/packages/meshbay-node/tests/test_security_regressions.py index 1a318f7..fa821d9 100644 --- a/packages/meshbay-node/tests/test_security_regressions.py +++ b/packages/meshbay-node/tests/test_security_regressions.py @@ -743,20 +743,48 @@ def test_pre_handshake_message_budget_is_small(): list(buf.messages()) -def test_stream_segment_is_not_synchronous(): +def test_no_transport_ships_media_outside_the_aead(): """ - H6: _do_stream_segment ran subprocess.run(timeout=30) inside the event loop, - stalling every peer on the node for up to thirty seconds per request. + `stream_seg` served an MPEG-TS segment as base64 with no encryption at all + — the one content-plane message that never went through a GEK-derived key, + on both transports, answering any authenticated member. Its browser caller + was defined and never invoked. Removed in MNP 2.0 rather than repaired: + `stream_data` already does the job under `chunk_ciphertext`. - Asserts the property (the worker is a coroutine, ffmpeg is spawned through - asyncio) rather than grepping for "subprocess.run" — which also matches the - comment that documents the old behaviour. + Asserted as the property, not as "the function is gone": what matters is + that no transport has a field carrying media bytes past the AEAD. The old + H6 test lived here — it pinned `_do_stream_segment_async` to a coroutine so + ffmpeg could not block the event loop — and the handler outliving that + concern is exactly what this replaces. """ - import ast - import inspect - from meshbay_node.transport.webrtc_server import WebRTCPeerSession + import re + + from meshbay_common.protocol import MNP + + assert not hasattr(MNP, "STREAM_SEGMENT"), ( + "the constant outliving the handlers is how a deleted endpoint keeps " + "looking like part of the wire contract") + + root = Path(__file__).parent.parent / "src" / "meshbay_node" / "transport" + for name in ("webrtc_server.py", "quic_server.py", "quic_client.py"): + source = (root / name).read_text(encoding="utf-8") + # Word boundaries: `_stream_segments` and `STREAM_SEGMENT_SIZE` belong + # to the live `stream_data` path, which is encrypted and stays. + assert not re.search(r"\bstream_seg\b", source), ( + f"{name} still speaks stream_seg") + assert not re.search(r"\bSTREAM_SEGMENT\b", source), ( + f"{name} still names the removed type") + assert "data_b64" not in source, ( + f"{name} carries a base64 media field — media leaves this node " + "encrypted or not at all") - assert inspect.iscoroutinefunction(WebRTCPeerSession._do_stream_segment_async) + +def test_ffmpeg_never_blocks_the_event_loop(): + """ + H6, the half that survives `stream_seg`: the live streaming path still + spawns ffmpeg, and a synchronous spawn stalls every peer on the node. + """ + import ast source = (Path(__file__).parent.parent / "src" / "meshbay_node" / "transport" / "webrtc_server.py").read_text(encoding="utf-8") diff --git a/packages/meshbay-node/tests/test_task_lifetime.py b/packages/meshbay-node/tests/test_task_lifetime.py index 3a5b8a5..9dffedb 100644 --- a/packages/meshbay-node/tests/test_task_lifetime.py +++ b/packages/meshbay-node/tests/test_task_lifetime.py @@ -245,8 +245,13 @@ def test_chunks_wait_for_room_on_the_channel(session): work through the rest — which is what "stuck at 1 MB" looks like, one chunk being exactly one megabyte. """ - fn = session[session.index("async def _do_file_request"):] - fn = fn[:fn.index("\n def _do_stream_segment")] + start = session.index("async def _do_file_request") + # Up to whatever the next member is. This used to end at + # "\n def _do_stream_segment" — a neighbour removed in MNP 2.0 — and an + # `index()` on a name that no longer exists fails the test for a reason + # that has nothing to do with what it is about. + nxt = re.search(r"\n (?:@|(?:async )?def )", session[start:]) + fn = session[start:start + nxt.start()] if nxt else session[start:] assert "DOWNLOAD_BUFFER_HIGH" in fn, "the send buffer has to be watched" assert "await asyncio.sleep" in fn, "waiting for room is the point" assert 'readyState != "open"' in fn, ( diff --git a/packages/meshbay-node/tests/test_webrtc_transport.py b/packages/meshbay-node/tests/test_webrtc_transport.py index dc74752..88b6f63 100644 --- a/packages/meshbay-node/tests/test_webrtc_transport.py +++ b/packages/meshbay-node/tests/test_webrtc_transport.py @@ -742,36 +742,6 @@ async def test_webrtc_peer_cleanup_on_close(sk_node, sk_hub, gek, shared_dir): await browser_pc.close() -@pytest.mark.asyncio -async def test_webrtc_stream_segment_missing_file(sk_node, sk_hub, gek, shared_dir): - """WebRTC DataChannel: stream_segment for non-existent file returns error.""" - hub_pk_pem = _hub_pk_pem(sk_hub) - indexer = DirectoryIndexer(roots=one_root(shared_dir), group_id="g", sk_node=sk_node, gek=gek) - await indexer.initial_scan() - - transport = WebRTCTransport( - sk_node=sk_node, hub_pk_pem=hub_pk_pem, gek=gek, - roots=one_root(shared_dir), index=indexer.index, - stun_servers=[], - ) - - browser_pc, channel, received = await _setup_peer( - transport, sk_hub, gek, "peer-stream") - - channel.send(_pack({ - "type": MNP.STREAM_SEGMENT, "v": MNP_VERSION, - "file_id": "nonexistent-file-id", - "segment_index": 0, "segment_duration": 4, - })) - - msg = await asyncio.wait_for(received.get(), timeout=5.0) - assert msg["type"] == "error" - assert "not found" in msg["detail"].lower() - - await browser_pc.close() - await transport.close_all() - - @pytest.mark.asyncio async def test_webrtc_wrong_gek_proof_rejected(sk_node, sk_hub, gek, shared_dir): """WebRTC DataChannel: wrong GEK proof is rejected — hub admin can't fake membership.""" -- cgit v1.2.3 From 8980a8e42d94ab7c0bc9739283d39f938f8402b0 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Mon, 7 Sep 2026 17:46:33 +0200 Subject: feat(mnp)!: seal the upload under the group key MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Downloads have been encrypted under a GEK-derived key since the beginning: `file_chunk` and `stream_data` both go through `chunk_ciphertext`. Uploads never were. `file_upload` carried the filename and the raw bytes in plain msgpack, and `file_upload_ack` carried the name the node stored them under — so the same file was ciphertext leaving a node and plaintext arriving at one. There was no threat model behind that asymmetry. Both halves now travel sealed under a third groupbox purpose, HKDF(GEK, info="meshbay:upload:v1"). The filename, the destination folder and the bytes are all inside the seal; only `upload_id` and `chunk_index` stay in clear, because the node routes and orders on them before it can decrypt. This direction seals *towards* the node — it holds the GEK for its own group — and it opens the payload before it picks a destination or touches the disk. What that forced, and why none of it is optional: - `filename` was the correlation key on both sides. It cannot be: matching an ack to its request by name would hand back exactly what the seal hides. `upload_id` replaces it — client-drawn, opaque to the node, unique within a connection, never an authorization input. The property it guarded (one refusal fails one upload, not every upload in flight) is unchanged. - Refusals can no longer quote what they refused. `No directory named 'X'` becomes `No such directory in this group` plus the `code` that was already there; the client knows what it sent. - No plaintext fallback. A path that still accepts plaintext is not a sealed path, so an unsealed `file_upload` is refused with `upload_not_sealed`. Hardened while here, because what comes out of a seal is authenticated but not validated — a member can seal anything: `filename` and `data` have their types checked before any upload state is created, and `chunk_index`/`total_chunks`, which are outside the seal by necessity, can no longer raise where a refusal was meant. Tests. `test_upload_sealed.py` pins the node half: nothing identifying on the wire, tamper/wrong-key/wrong-group all refused with nothing written, and multi-chunk reassembly unchanged. `test_upload_seal_client.py` drives the shipped `uploadFile` over the shipped `crypto.js` under node and feeds its real frames to the real `_do_file_upload` — the file lands intact, and the ack the node actually produced comes back with the name it chose for a collision, which is the half a source-reading test cannot see. Both upload purposes join the JS/Python groupbox parity vectors. BREAKING CHANGE: MNP 2.0. `file_upload`/`file_upload_ack` change shape on the wire every deployed client speaks, which is MAJOR by the same rule 1.0 was — but the break is confined to uploads. `MNP_MIN_SUPPORTED` stays at "1.0", so a 1.x peer still connects, browses, downloads, streams and chats; only its uploads are refused, with a message saying which side is old. The client checks the node's version before sending a chunk, so neither side meets this as a timeout. This is the version negotiation shipped in 1.0 earning its keep: 1.0 cost a flag day, 2.0 costs a refusal code. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01AsoWC3GmhNdwVFomW3QjH3 --- docs/USERGUIDE.md | 2 +- .../meshbay-common/src/meshbay_common/__init__.py | 35 ++- .../meshbay-common/src/meshbay_common/groupbox.py | 17 ++ .../meshbay-common/src/meshbay_common/protocol.py | 109 ++++++++ .../meshbay-common/tests/test_js_python_parity.py | 13 +- .../meshbay-hub/src/meshbay_hub/static/crypto.js | 10 +- .../src/meshbay_hub/static/transport.js | 111 ++++++-- .../tests/harness/upload_seal_probe.mjs | 102 ++++++++ .../meshbay-hub/tests/test_transport_contracts.py | 50 +++- .../meshbay-hub/tests/test_upload_seal_client.py | 169 ++++++++++++ .../src/meshbay_node/transport/webrtc_server.py | 173 ++++++++----- packages/meshbay-node/tests/conftest.py | 31 +++ .../tests/test_root_writable_policy.py | 12 +- .../tests/test_security_regressions.py | 89 +++---- packages/meshbay-node/tests/test_upload_sealed.py | 285 +++++++++++++++++++++ 15 files changed, 1040 insertions(+), 168 deletions(-) create mode 100644 packages/meshbay-hub/tests/harness/upload_seal_probe.mjs create mode 100644 packages/meshbay-hub/tests/test_upload_seal_client.py create mode 100644 packages/meshbay-node/tests/test_upload_sealed.py (limited to 'packages/meshbay-node/tests') diff --git a/docs/USERGUIDE.md b/docs/USERGUIDE.md index de5ce3f..32f31dd 100644 --- a/docs/USERGUIDE.md +++ b/docs/USERGUIDE.md @@ -1127,7 +1127,7 @@ handshake that establishes what they are allowed to see: | `join_request` | `join_result` | Pairing code, or recognition of a pinned identity; carries the wrapped GEK on success | | `index_sync` | `index_sync` / `index_delta` | The group index | | `file_req` | `file_chunk` | One encrypted 1 MB chunk | -| `file_upload` | `file_upload_ack` | Upload into `uploads/`; the ack names the file as stored | +| `file_upload` | `file_upload_ack` | One chunk into the folder you are browsing; both halves sealed under the group key, so the filename and the bytes never appear on the wire in clear. The ack names the file as stored | | `dir_create` | `dir_create_ack` | Create a directory | | `file_delete` | `file_delete_ack` | Delete a file you uploaded | | `stream_req` | `stream_init`, `stream_data`, `stream_end` | MSE video | diff --git a/packages/meshbay-common/src/meshbay_common/__init__.py b/packages/meshbay-common/src/meshbay_common/__init__.py index b3e24e3..ac69e18 100644 --- a/packages/meshbay-common/src/meshbay_common/__init__.py +++ b/packages/meshbay-common/src/meshbay_common/__init__.py @@ -93,5 +93,38 @@ __version__ = "0.11.0" # The index at rest, `index_progress` (counters only, never a path — see # `groupbox.py` and daemon.py `_push_index_progress`), chat, and file content # on the operator's disk are all deliberately unchanged. -MNP_VERSION = "1.1" +# 1.1: `index_delta` carries `roots` (additive — a 1.0 client ignores it), and +# the per-root/per-app operations: `root_update`/`root_eject`/`root_plug`, +# `app_directories`, `chat_directory`, `chat_link_preview`. +# 2.0: the **write** path is sealed, and the last unencrypted content message +# is gone. +# +# - `file_upload` and `file_upload_ack` travel sealed under a GEK-derived +# subkey (`groupbox.PURPOSE_UPLOAD`). The filename, the destination folder +# and the bytes all ride inside the seal; `upload_id` — a fresh +# client-chosen correlation id — and `chunk_index` stay in clear because +# the node routes and orders on them. `filename` used to be the +# correlation key and cannot be any more, which is what forced `upload_id`. +# - `stream_seg` is **removed**. It answered with an MPEG-TS segment as +# base64 with no encryption at all, on both transports, to any +# authenticated member — the one content-plane message that never went +# through a GEK-derived key. `stream_data` has done the job properly since +# Phase 12, and `fetchStreamSegment`, its only browser caller, was defined +# and never once invoked. +# +# **Breaking, on the wire every deployed client speaks**, and MAJOR by the same +# rule 1.0 was: a 1.x client's upload reaches a 2.0 node with no `filename` and +# no `data` outside the seal. That is why the break is confined rather than +# total — `MNP_MIN_SUPPORTED` stays at "1.0", so a 1.x peer still connects, +# browses, downloads, streams and chats; only its uploads are refused, with +# `upload_not_sealed` and a message saying which side is old. A client refuses +# symmetrically before sending (`supportsSealedUpload` in transport.js), so +# neither side discovers this as a timeout. +# +# Still deliberately in clear, and none of it is content: the handshake itself, +# `index_progress` (counters only — see daemon.py `_push_index_progress`), the +# admin and configuration acks, and the media-metadata replies. Chat is next, +# under sender keys. The index at rest and file content on the operator's disk +# are unchanged. +MNP_VERSION = "2.0" MHP_VERSION = "0.1" diff --git a/packages/meshbay-common/src/meshbay_common/groupbox.py b/packages/meshbay-common/src/meshbay_common/groupbox.py index f1091c3..eb2f630 100644 --- a/packages/meshbay-common/src/meshbay_common/groupbox.py +++ b/packages/meshbay-common/src/meshbay_common/groupbox.py @@ -24,6 +24,14 @@ and group configuration. It buys nothing against a network observer (DTLS/TLS already covers that), nothing against the hub (it never sees channel traffic), and nothing against a member — who holds the GEK. That is the whole claim. +**Both, for the upload (MNP 2.0).** `file_upload` carried the filename and the raw +bytes in clear, and `file_upload_ack` carried the name it was stored under. The +download path had been sealed end to end since the beginning — so the same file was +ciphertext coming out of a node and plaintext going in, which is not a threat model, +it is an oversight. The node holds the GEK for its own group, so unlike the index +this direction seals *towards* the node: it opens the payload before it writes +anything to disk, and refuses a chunk that does not open rather than guessing. + Purpose separation is deliberate. `GroupIndex.serialize()` reuses `chunk_key_aes(gek, file_hash, chunk_index)` with a pseudo-file ("the index as chunk 0 of a virtual index file"), which borrows a file's key space for something that is @@ -41,6 +49,7 @@ from cryptography.hazmat.primitives.kdf.hkdf import HKDF PURPOSE_INDEX = "index" PURPOSE_ACK = "ack" +PURPOSE_UPLOAD = "upload" # `salt=None` here and `salt: new Uint8Array(0)` in crypto.js agree — RFC 5869 # extracts with a zero key either way. Already proven in production by @@ -48,8 +57,16 @@ PURPOSE_ACK = "ack" _INFO = { PURPOSE_INDEX: b"meshbay:index:v1", PURPOSE_ACK: b"meshbay:ack:v1", + PURPOSE_UPLOAD: b"meshbay:upload:v1", } +# One subkey per purpose, and `seal` draws a fresh 96-bit nonce per message, so +# the bound that matters is birthday collision under `PURPOSE_UPLOAD` — the only +# purpose with real volume, one message per 48 KiB chunk. 2**32 chunks is 200 TB +# uploaded under a single GEK before the collision probability reaches 2**-32, +# and `gek_rotate` exists. Deriving the nonce from the payload instead would be +# worse, not better: two chunks of identical bytes are ordinary in a file. + NONCE_LEN = 12 # 96-bit, the WebCrypto AES-GCM standard diff --git a/packages/meshbay-common/src/meshbay_common/protocol.py b/packages/meshbay-common/src/meshbay_common/protocol.py index bb52a51..876f465 100644 --- a/packages/meshbay-common/src/meshbay_common/protocol.py +++ b/packages/meshbay-common/src/meshbay_common/protocol.py @@ -30,6 +30,7 @@ number — it is a label chosen by the peer, and the only thing it decides is which local promise a reply belongs to. """ +import os from dataclasses import dataclass, field from typing import Any @@ -37,6 +38,7 @@ from typing import Any # second copy here said "0.1" while every message on the wire carried "0.2". # Nothing imported it, which is the only reason it was harmless. from meshbay_common import MNP_VERSION, MHP_VERSION # noqa: F401 (re-export) +from meshbay_common.groupbox import PURPOSE_UPLOAD, seal, unseal from meshbay_common.webcrypto import ( chunk_key_aes, decrypt_chunk_aes, @@ -370,3 +372,110 @@ def file_chunk_plaintext( file_hash = bytes.fromhex(msg["file_id"]) ckey = chunk_key_aes(gek, file_hash, msg["chunk_index"]) return decrypt_chunk_aes(ckey, msg["nonce"], msg["ct"]) + + +# ── Uploads (MNP 2.0) ───────────────────────────────────────────────────────── +# +# The write path, sealed under the group key the way the read path always was. +# One encoder for both directions, here rather than in the client, for the reason +# `file_chunk` has one: two copies of a wire shape with a single consumer each is +# how `index_sync` and `file_chunk` forked (finding C6), and nothing noticed +# until someone went looking. +# +# What stays in clear, and why each has to: +# `type`, `v` — routed and version-checked before anything can be decrypted +# `upload_id` — the correlation key. It replaces `filename`, which used to +# play that role and cannot any more: naming the file in clear +# to match an ack against a request would give back exactly +# what the seal is for. Client-chosen, opaque to the node, +# unique within one connection; never an authorization input. +# `chunk_index` — ordering, which the node enforces before it opens anything +# `total_chunks` — how many to expect +# +# `group_id` is *not* on the message: the session already decided which group it +# is on, and the node uses that as the AAD. A client naming its own group here +# would be choosing which key its bytes are checked against. + +UPLOAD_ID_LEN = 16 # 128 bits of client-chosen correlation, hex on the wire + + +def new_upload_id() -> str: + """A fresh correlation id for one upload.""" + return os.urandom(UPLOAD_ID_LEN).hex() + + +def file_upload_wire( + gek: bytes, + group_id: str, + *, + upload_id: str, + chunk_index: int, + total_chunks: int, + filename: str, + data: bytes, + dir: str = "", + root: str = "", +) -> dict: + """ + One sealed `file_upload` chunk. + + `filename`, `dir` and `root` ride inside the seal with the bytes: sealing the + content and announcing the name beside it would be theatre. They are repeated + on every chunk rather than sent once — a hundred bytes against a 48 KiB chunk + — because a header that arrives once is state the node has to carry, and + upload state that can disagree with the chunk in hand is what `_free_name` and + the chunk-ordering rule exist to prevent. + """ + payload = {"filename": filename, "data": data, "dir": dir, "root": root} + return { + "type": MNP.FILE_UPLOAD, + "v": MNP_VERSION, + "upload_id": upload_id, + "chunk_index": chunk_index, + "total_chunks": total_chunks, + **seal(gek, PURPOSE_UPLOAD, MNP.FILE_UPLOAD, group_id, payload), + } + + +def file_upload_payload(gek: bytes, group_id: str, msg: dict) -> dict: + """ + Open a `file_upload`. Raises on anything that does not open. + + Never a partial result and never a default: a chunk that does not open is not + an empty file with an empty name, it is a peer we cannot talk to. `unseal` + says why at length. + """ + return unseal(gek, PURPOSE_UPLOAD, MNP.FILE_UPLOAD, group_id, msg) + + +def file_upload_ack_wire( + gek: bytes, + group_id: str, + *, + upload_id: str, + chunk_index: int, + filename: str, + stored_as: str, + dir: str = "", +) -> dict: + """ + The node's answer to one chunk, sealed the same way. + + `stored_as` is the name the node settled on — it finds a free one rather than + replacing anything — and `dir` is where it landed. Both name the operator's + content, so both belong inside the seal; only `upload_id` and `chunk_index` + stay out, because the client matches on them. + """ + payload = {"filename": filename, "stored_as": stored_as, "dir": dir} + return { + "type": MNP.FILE_UPLOAD_ACK, + "v": MNP_VERSION, + "upload_id": upload_id, + "chunk_index": chunk_index, + **seal(gek, PURPOSE_UPLOAD, MNP.FILE_UPLOAD_ACK, group_id, payload), + } + + +def file_upload_ack_payload(gek: bytes, group_id: str, msg: dict) -> dict: + """Open a `file_upload_ack`. Raises on anything that does not open.""" + return unseal(gek, PURPOSE_UPLOAD, MNP.FILE_UPLOAD_ACK, group_id, msg) diff --git a/packages/meshbay-common/tests/test_js_python_parity.py b/packages/meshbay-common/tests/test_js_python_parity.py index 6f7437f..1abae75 100644 --- a/packages/meshbay-common/tests/test_js_python_parity.py +++ b/packages/meshbay-common/tests/test_js_python_parity.py @@ -258,6 +258,11 @@ GROUPBOX_VECTORS = [ ("index", "index_sync", "groupe-café-日本"), # A '|' inside the group id, which is the AAD's own separator. ("index", "index_sync", "a|b"), + # MNP 2.0 — the upload, and the only purpose the *browser* seals in + # production. A disagreement here means no file can be uploaded from any + # browser to any node, and the node reports only "it did not open". + ("upload", "file_upload", "g" * 32), + ("upload", "file_upload_ack", "g" * 32), ] GROUPBOX_GEK = bytes.fromhex("5a" * 32) @@ -349,9 +354,11 @@ def test_browser_opens_what_python_sealed(idx, vector, groupbox_js): @pytest.mark.parametrize("idx,vector", list(enumerate(GROUPBOX_VECTORS))) def test_python_opens_what_the_browser_sealed(idx, vector, groupbox_js): """ - The other direction. Nothing in the SPA seals today — `sealGroup` exists for - the chat plan, which needs the same primitive — but a codec that only ever - runs one way is a codec whose encoder is untested. + The other direction, and since MNP 2.0 it is a shipping path rather than a + precaution: `uploadFile` seals every chunk under `upload`, and the node + opens it with `unseal`. The index vectors above still only ever run one way + in production, and are kept because a codec whose encoder is untested is a + codec with half a test. """ from meshbay_common.groupbox import unseal diff --git a/packages/meshbay-hub/src/meshbay_hub/static/crypto.js b/packages/meshbay-hub/src/meshbay_hub/static/crypto.js index d2e19b7..4d26c6d 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/crypto.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/crypto.js @@ -111,8 +111,9 @@ async function decryptChunkBin(gek, fileHashHex, chunkIndex, nonce, ct) { // ── Sealing a payload under the group key ──────────────────────────────────── // -// Mirrors meshbay_common/groupbox.py. `index_sync`, `index_delta` and the -// `handshake_ack` config payload travel sealed under a GEK-derived subkey; the +// Mirrors meshbay_common/groupbox.py. `index_sync`, `index_delta`, the +// `handshake_ack` config payload and both halves of an upload travel sealed +// under a GEK-derived subkey; the // routing fields (type, v, group_id) and the ack's own authentication (node_pk, // proof, sig) stay in clear, because a receiver must route, version-check and // *authenticate* before it would trust a decryption. @@ -126,6 +127,11 @@ async function decryptChunkBin(gek, fileHashHex, chunkIndex, nonce, ct) { const GROUPBOX_INFO = { index: new TextEncoder().encode('meshbay:index:v1'), ack: new TextEncoder().encode('meshbay:ack:v1'), + // MNP 2.0: `file_upload` and `file_upload_ack`. This is the one purpose that + // seals *towards* the node — it holds the GEK for its own group — and the one + // with real message volume, one per 48 KB chunk. groupbox.py carries the + // nonce-collision arithmetic that makes a random 96-bit nonce fine at that rate. + upload: new TextEncoder().encode('meshbay:upload:v1'), }; /** diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js index 2668e02..681a9ba 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js @@ -248,7 +248,7 @@ window.addEventListener('hashchange', () => { // The `v: '0.1'` on every other message in this file is the historical value // and is read by nothing; it is left alone deliberately. The range is // negotiated once, at the start, not restated per message. -const MNP_V = '1.1'; +const MNP_V = '2.0'; const MNP_V_MIN = '1.0'; // Codes a NODE sends us, in its own vocabulary (meshbay_common/handshake.py's @@ -301,10 +301,17 @@ class MeshBayTransport { this._onStreamEnd = null; this._onStreamError = null; this._onIndexSync = null; - // filename → the uploader waiting on it. Keyed rather than FIFO because - // several uploads may be in flight at once and their acks interleave; the - // node names the file in every one. + // upload_id → the uploader waiting on it. Keyed rather than FIFO because + // several uploads may be in flight at once and their acks interleave. + // + // It was keyed by filename until MNP 2.0, which is no longer possible: the + // name is sealed under the group key, and echoing it in clear so the two + // sides could match on it would give back precisely what the seal is for. + // `upload_id` is drawn per upload here and is opaque to the node. this._uploaders = new Map(); + // Names, not ids: the "already being uploaded" guard is about the file the + // caller passed, and two `uploadFile` calls for one file draw two ids. + this._inFlightUploads = new Set(); // Set once close() runs — stops the automatic reconnect from firing on a // connection the caller tore down on purpose (leaving the group, page // unload), which would otherwise race back in right as everything else @@ -381,6 +388,19 @@ class MeshBayTransport { if (!m) return false; return (Number(m[1]) > 1) || (Number(m[1]) === 1 && Number(m[2]) >= 1); } + /** + * Whether the node opens a sealed upload (MNP 2.0). + * + * A 1.x node reads `filename` and `data` off the message itself, finds + * neither — they are inside the seal — and answers "Missing filename or + * data", an error about the wrong thing that names no upload_id and so fails + * every upload in flight. Asked before sending rather than discovered after, + * for the same reason `supportsAppOps` is. + */ + get supportsSealedUpload() { + const m = /^(\d+)\.(\d+)$/.exec(this._nodeVersion || ''); + return !!m && Number(m[1]) >= 2; + } set onAppsEnabled(fn) { this._onAppsEnabled = fn; } set onAppDirectories(fn) { this._onAppDirectories = fn; } set onChatDirectory(fn) { this._onChatDirectory = fn; } @@ -1812,10 +1832,21 @@ class MeshBayTransport { */ async uploadFile(file, { chunkSize, onProgress, signal, root, dir } = {}) { // The same file twice at once would confuse the node, which keys its own - // upload state by name — and would race for the same destination. - if (this._uploaders.has(file.name)) { + // upload state by name — and would race for the same destination. The guard + // is by name for that reason, even though the map below is keyed by id. + if (this._inFlightUploads.has(file.name)) { throw new Error(`${file.name} is already being uploaded`); } + if (!this._gekRaw) throw new Error('This group has no key on this device'); + if (!this.supportsSealedUpload) { + throw new Error( + 'This node is running an older MeshBay and cannot accept an upload ' + + 'from this page. Its operator has to update it.'); + } + const C = window.MeshBayCrypto; + const groupId = (this._connectArgs && this._connectArgs.groupId) || ''; + this._inFlightUploads.add(file.name); + const uploadId = _hex(crypto.getRandomValues(new Uint8Array(16))); const size = chunkSize || UPLOAD_CHUNK_SIZE; const total = Math.max(1, Math.ceil(file.size / size)); let acked = 0; @@ -1823,16 +1854,32 @@ class MeshBayTransport { let failure = null; const acks = []; - this._uploaders.set(file.name, (msg) => { - if (msg.type === 'error') { - failure = new Error(msg.detail || 'Upload refused'); - } else if (msg.stored_as) { - stored = msg; - } + const wake = () => { acked += 1; if (onProgress) onProgress(Math.min(file.size, acked * size), file.size); const waiter = acks.shift(); if (waiter) waiter(); + }; + this._uploaders.set(uploadId, (msg) => { + if (msg.type === 'error') { + failure = new Error(msg.detail || 'Upload refused'); + wake(); + return; + } + // The ack is sealed too — `stored_as` and the folder it landed in name + // the operator's content. Opening it is what makes the result usable, so + // a failure here fails the upload rather than being swallowed: a chat + // attachment that cannot learn its stored name would point at nothing. + C.openGroup(this._gekRaw, 'upload', 'file_upload_ack', groupId, msg) + .then((plain) => { + const payload = msgpack_decode(plain); + if (payload.stored_as) stored = payload; + }) + .catch((e) => { + failure = new Error( + `The node's upload reply did not open under the group key (${e.message})`); + }) + .finally(wake); }); const nextAck = () => new Promise(r => acks.push(r)); @@ -1854,15 +1901,20 @@ class MeshBayTransport { const buf = new Uint8Array( await file.slice(i * size, (i + 1) * size).arrayBuffer()); + // The name, the destination and the bytes go inside the seal together. + // Mirrors `file_upload_wire` in meshbay_common/protocol.py; only the + // fields the node routes on stay outside it. + const sealed = await C.sealGroup( + this._gekRaw, 'upload', 'file_upload', groupId, + msgpack_encode({ filename: file.name, data: buf, + dir: dir || '', root: root || '' })); this._send({ type: 'file_upload', v: '0.1', - filename: file.name, + upload_id: uploadId, chunk_index: i, total_chunks: total, - data: buf, - ...(root ? { root } : {}), - ...(dir ? { dir } : {}), + ...sealed, }); } while (acked < total) { @@ -1870,7 +1922,8 @@ class MeshBayTransport { if (failure) throw failure; } } finally { - this._uploaders.delete(file.name); + this._uploaders.delete(uploadId); + this._inFlightUploads.delete(file.name); } return stored || {}; } @@ -2427,21 +2480,21 @@ class MeshBayTransport { // While an upload is in flight the acks are its own, and there are many of // them: they must not be handed to whatever request happens to be oldest in // the pending map. - if (msg.type === 'file_upload_ack' && this._uploaders.has(msg.filename)) { - this._uploaders.get(msg.filename)(msg); + if (msg.type === 'file_upload_ack' && this._uploaders.has(msg.upload_id)) { + this._uploaders.get(msg.upload_id)(msg); return; } - // An upload refusal names the file it is about, so only that upload fails. - // It did not use to, and there was no way to tell whose error it was, so - // every upload in flight was failed together — send a second file whose - // name the node dislikes and both died. The broadcast is kept for a node - // that does not name it, where guessing wrong is worse than stopping. + // An upload refusal names the upload it is about, so only that upload + // fails. It did not use to, and there was no way to tell whose error it + // was, so every upload in flight was failed together — send a second file + // whose name the node dislikes and both died. The broadcast is kept for a + // refusal that names none, where guessing wrong is worse than stopping. if (msg.type === 'error' && this._uploaders.size) { - if (msg.filename && this._uploaders.has(msg.filename)) { - this._uploaders.get(msg.filename)(msg); + if (msg.upload_id && this._uploaders.has(msg.upload_id)) { + this._uploaders.get(msg.upload_id)(msg); return; } - if (!msg.filename) { + if (!msg.upload_id) { for (const handler of [...this._uploaders.values()]) handler(msg); return; } @@ -3017,6 +3070,10 @@ function _decodeMap(buf, view, offset, count) { return [obj, offset]; } +function _hex(bytes) { + return [...bytes].map(b => b.toString(16).padStart(2, '0')).join(''); +} + function _extractDtlsFingerprint(sdp) { const match = sdp.match(/a=fingerprint:sha-256 ([0-9A-Fa-f:]+)/); if (!match) return new Uint8Array(0); diff --git a/packages/meshbay-hub/tests/harness/upload_seal_probe.mjs b/packages/meshbay-hub/tests/harness/upload_seal_probe.mjs new file mode 100644 index 0000000..0b77e42 --- /dev/null +++ b/packages/meshbay-hub/tests/harness/upload_seal_probe.mjs @@ -0,0 +1,102 @@ +/** + * Does the browser's real `uploadFile` produce frames a real node can open — + * and does it read back what that node actually answered? + * + * Drives **the real `MeshBayTransport` over the real `crypto.js`**. Only the DOM + * and the DataChannel are stand-ins; the msgpack encode, the HKDF, the AES-GCM + * and the whole upload loop are the shipped code. + * + * It exists because a source-reading test cannot show either half of MNP 2.0's + * upload. `test_transport_contracts` can see that `sealGroup` is called; only + * this can show that what comes out opens under `meshbay_common.groupbox` — and + * that the caller of `uploadFile` is told the name the *node* chose, which now + * arrives sealed and would otherwise be `undefined` with nothing to notice it. + * + * node upload_seal_probe.mjs + * + * Two modes, because the node half runs in Python between them: + * "send" — run the upload, print every frame it emits, answer nothing + * "receive" — run it again, answering with acks Python built. Their + * `upload_id` is retargeted to this run's; it is outside the + * seal, so the ciphertext stays exactly the one Python produced. + */ +import fs from 'fs'; + +const STATIC = process.argv[2]; +const input = JSON.parse(fs.readFileSync(process.argv[3], 'utf8')); + +for (const level of ['log', 'warn', 'error', 'info', 'debug']) { + console[level] = (...args) => process.stderr.write(args.join(' ') + '\n'); +} + +globalThis.window = globalThis; +globalThis.addEventListener = () => {}; +globalThis.removeEventListener = () => {}; +globalThis.location = { hash: '' }; +globalThis.document = { + addEventListener() {}, removeEventListener() {}, visibilityState: 'visible', +}; + +new Function(fs.readFileSync(`${STATIC}/crypto.js`, 'utf8'))(); +const transportSrc = fs.readFileSync(`${STATIC}/transport.js`, 'utf8'); +new Function(transportSrc)(); +// The msgpack codec is private to transport.js — pulled out the same way the +// groupbox parity harness pulls out sealGroup, so this probe encodes and +// decodes with the codec that is actually shipped rather than a second one. +const { msgpack_encode, msgpack_decode } = + new Function(transportSrc + '\nreturn { msgpack_encode, msgpack_decode };')(); + +const hex = (s) => Uint8Array.from(s.match(/../g).map((b) => parseInt(b, 16))); +const toHex = (u8) => + Array.from(u8).map((b) => b.toString(16).padStart(2, '0')).join(''); + +// Just enough of a File: a name, a size, and slices that yield ArrayBuffers. +const bytes = hex(input.file.data); +const file = { + name: input.file.name, + size: bytes.length, + slice(a, b) { + const part = bytes.slice(a, b); + return { arrayBuffer: async () => part.buffer.slice( + part.byteOffset, part.byteOffset + part.byteLength) }; + }, +}; + +const tp = new window.MeshBayTransport('', 'token'); +tp._connected = true; +tp._channel = { readyState: 'open', bufferedAmount: 0, send() {}, close() {} }; +tp._pc = { close() {} }; +tp._gekRaw = hex(input.gek); +tp._connectArgs = { groupId: input.group_id }; +tp._nodeVersion = input.node_version; + +const frames = []; +let uploadId = null; +tp._send = (msg) => { + frames.push(toHex(msgpack_encode(msg))); + if (msg.upload_id) uploadId = msg.upload_id; + if (input.mode !== 'receive') return; + // Answer as the node did, on the next turn of the loop so the send path + // finishes first — which is also how a real ack arrives. + const ack = msgpack_decode(hex(input.acks[msg.chunk_index])); + ack.upload_id = uploadId; + // Through the real `_dispatch`, so the routing under test — matching an + // ack to its uploader by `upload_id` — is the shipped one. + setImmediate(() => tp._dispatch(ack)); +}; + +const out = { frames, mode: input.mode }; +const done = tp.uploadFile(file, { chunkSize: input.chunk_size, + dir: input.dir, root: input.root }); + +if (input.mode === 'receive') { + done.then((stored) => { out.state = 'resolved'; out.stored = stored; }) + .catch((e) => { out.state = 'rejected'; out.message = e.message; }) + .finally(() => { out.upload_id = uploadId; + process.stdout.write(JSON.stringify(out)); }); +} else { + // Nothing will answer, so let the send loop run itself out and report. + done.catch((e) => { out.state = 'rejected'; out.message = e.message; }); + setTimeout(() => { out.upload_id = uploadId; + process.stdout.write(JSON.stringify(out)); }, 250); +} diff --git a/packages/meshbay-hub/tests/test_transport_contracts.py b/packages/meshbay-hub/tests/test_transport_contracts.py index b462242..879062b 100644 --- a/packages/meshbay-hub/tests/test_transport_contracts.py +++ b/packages/meshbay-hub/tests/test_transport_contracts.py @@ -307,26 +307,60 @@ def test_no_setter_survives_the_state_it_belonged_to(): # ── Parallel uploads ────────────────────────────────────────────────────────── -def test_an_upload_refusal_names_the_file_it_is_about(transport): +def test_an_upload_refusal_names_the_upload_it_is_about(transport): """Reported 2026-08-16: a second upload started in parallel killed both. - An error used to carry no filename, so the client could not tell whose it - was and failed every upload in flight — one name the node disliked took the - other file with it. The node names the file now, and only that upload stops. + An error used to carry nothing identifying, so the client could not tell + whose it was and failed every upload in flight — one name the node disliked + took the other file with it. + + The node named the *file* until MNP 2.0 and names the `upload_id` now: the + filename moved inside the seal, and echoing it in clear so the two sides + could match on it would give back precisely what sealing the upload is for. + The property is unchanged — one refusal, one failed upload. """ body = transport[transport.index("if (msg.type === 'error' && this._uploaders.size)"):] body = body[:body.index("\n if (msg.type === 'chat_msg'")] - assert "this._uploaders.has(msg.filename)" in body, ( + assert "this._uploaders.has(msg.upload_id)" in body, ( "a named refusal must reach one uploader, not all of them") - assert "if (!msg.filename)" in body, ( + assert "if (!msg.upload_id)" in body, ( "an unnamed error from an older node must still stop everything — " "guessing which upload it belongs to would be worse") -def test_uploads_are_tracked_per_file(transport): +def test_uploads_are_tracked_per_upload(transport): """Acks interleave when two files are in flight.""" assert "this._uploaders = new Map()" in transport - assert "this._uploaders.set(file.name" in transport + assert "this._uploaders.set(uploadId" in transport + # And the "already being uploaded" guard still speaks in filenames, because + # that is what the caller passed and what it would recognise in the error. + assert "this._inFlightUploads.has(file.name)" in transport + + +def test_the_upload_itself_is_sealed(transport): + """ + MNP 2.0. The filename, the destination and the bytes go inside the seal + together — sealing the content and announcing the name beside it would be + theatre — and only what the node routes on stays outside. + """ + start = transport.index(" async uploadFile(file,") + body = transport[start:transport.index("\n /** Create a directory", start)] + assert "sealGroup(" in body and "'file_upload'" in body, ( + "the upload must be sealed under the group key") + assert "openGroup(" in body and "'file_upload_ack'" in body, ( + "the ack carries the stored name and must be opened, not read") + # The message the node actually receives: everything between `this._send({` + # and its close. Read on its own, because the same field names appear a few + # lines above inside `msgpack_encode({...})`, which is the sealed half. + sent = body[body.index("this._send({"):] + sent = sent[:sent.index("});")] + assert "filename" not in sent, "the filename is on the message in clear" + assert "data" not in sent, "the bytes are on the message in clear" + assert "dir" not in sent and "root" not in sent, ( + "the destination is on the message in clear") + assert "...sealed," in sent, "the message must carry the sealed pair" + assert "supportsSealedUpload" in body, ( + "an older node must be refused before a chunk is sent, not after") # ── MNP 1.0: the sealed handshake ack ──────────────────────────────────────── diff --git a/packages/meshbay-hub/tests/test_upload_seal_client.py b/packages/meshbay-hub/tests/test_upload_seal_client.py new file mode 100644 index 0000000..d6f9156 --- /dev/null +++ b/packages/meshbay-hub/tests/test_upload_seal_client.py @@ -0,0 +1,169 @@ +""" +The browser half of MNP 2.0's sealed upload, measured rather than read. + +`test_upload_sealed.py` (node side) proves the node opens what the shared +encoder produces and refuses everything else. This proves the *shipped browser +code* produces it — and, the part that matters more, that a caller of +`uploadFile` is still told the name the node stored the file under, which now +arrives sealed and would otherwise be `undefined` with nothing on screen to say +so: a chat attachment would point at a file that is not there. + +Driven through `harness/upload_seal_probe.mjs`, which runs the shipped +`transport.js` over the shipped `crypto.js`. The node half in between is the +real `_do_file_upload`, writing to a real directory. + +A source-reading test can see that `sealGroup` is called. Only this can see +whether what comes out of it opens. +""" + +import json +import shutil +import subprocess +import tempfile +from pathlib import Path + +import msgpack +import pytest +from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey +from meshbay_common.crypto import generate_gek +from meshbay_common.protocol import MNP +from meshbay_node.indexer.group_index import GroupIndex +from meshbay_node.roots import RootSet +from meshbay_node.transport.webrtc_server import WebRTCPeerSession + +STATIC = Path(__file__).resolve().parents[1] / "src" / "meshbay_hub" / "static" +PROBE = Path(__file__).resolve().parent / "harness" / "upload_seal_probe.mjs" + +pytestmark = pytest.mark.skipif( + shutil.which("node") is None or not PROBE.exists(), + reason="node unavailable — the client half cannot be measured", +) + +GROUP = "g-upload-probe" +CHUNK = 32 +BODY = bytes(range(256)) * 3 # 768 bytes → 24 chunks of 32 + + +def _run_probe(payload: dict) -> dict: + with tempfile.TemporaryDirectory() as d: + f = Path(d) / "input.json" + f.write_text(json.dumps(payload)) + proc = subprocess.run( + ["node", str(PROBE), str(STATIC), str(f)], + capture_output=True, text=True, timeout=60, + ) + if proc.returncode != 0 or not proc.stdout: + pytest.fail(f"upload probe failed:\n{proc.stderr}") + return json.loads(proc.stdout) + + +def _node_session(tmp_path: Path, gek: bytes) -> WebRTCPeerSession: + root = tmp_path / "library" + root.mkdir() + index = GroupIndex(group_id=GROUP, sk_node=Ed25519PrivateKey.generate()) + session = WebRTCPeerSession.__new__(WebRTCPeerSession) + session._ctx = { + "roots": RootSet.build([{"path": str(root), "name": "library", + "writable": True}]), + "index": index, "sk_node": index.sk_node, "gek": gek, + } + session._group_id = GROUP + session._user_id = "prober" + session._pk_user = "" + session._uploads = {} + session.sent = [] + session._send = session.sent.append + session._audit = lambda *a, **k: None + return session + + +def _probe_input(gek: bytes, mode: str, **extra) -> dict: + return { + "mode": mode, "gek": gek.hex(), "group_id": GROUP, + "node_version": "2.0", "chunk_size": CHUNK, "dir": "library", + "root": "library", + "file": {"name": "holiday.jpg", "data": BODY.hex()}, + **extra, + } + + +@pytest.fixture(scope="module") +def _gek(): + return generate_gek() + + +@pytest.fixture(scope="module") +def _sent(_gek): + """Every frame the shipped `uploadFile` puts on the wire, unanswered.""" + return _run_probe(_probe_input(_gek, "send")) + + +def test_the_browser_puts_no_filename_and_no_content_on_the_wire(_sent): + """The whole point, measured on the bytes rather than read off the source.""" + assert _sent["frames"], "the client sent nothing" + for hexframe in _sent["frames"]: + raw = bytes.fromhex(hexframe) + assert b"holiday.jpg" not in raw, "the filename is on the wire in clear" + msg = msgpack.unpackb(raw, raw=False) + assert set(msg) == {"type", "v", "upload_id", "chunk_index", + "total_chunks", "nonce", "ct"} + assert msg["type"] == MNP.FILE_UPLOAD + + +def test_a_real_node_opens_what_the_real_browser_sealed(tmp_path, _gek, _sent): + """ + End to end: the shipped browser encoder into the shipped node handler, with + the file that lands on disk as the assertion. A mismatch in the HKDF salt, + the AAD encoding or the payload shape shows up here as "did not open" — and + nowhere else until somebody tries to upload something. + """ + session = _node_session(tmp_path, _gek) + for hexframe in _sent["frames"]: + session._do_file_upload(msgpack.unpackb(bytes.fromhex(hexframe), raw=False)) + + errors = [m for m in session.sent if m.get("type") == "error"] + assert not errors, f"the node refused a frame the browser built: {errors[:1]}" + + root = session._ctx["roots"].roots[0].path + assert (root / "holiday.jpg").read_bytes() == BODY + assert not list(root.glob("*.part")), "a temp file was left behind" + + +def test_the_caller_is_told_the_name_the_node_chose(tmp_path, _gek, _sent): + """ + `stored_as` is sealed now, so reading it takes a decrypt that can fail + silently. It must not: the node finds a free name rather than replacing + anything, and a chat attachment that never learns which name points at + nothing. + + The acks below are the ones the node really produced — only their + `upload_id`, which is outside the seal, is retargeted to the second probe + run's own upload. + """ + session = _node_session(tmp_path, _gek) + # A file of that name is already there, so the node has to choose another. + (session._ctx["roots"].roots[0].path / "holiday.jpg").write_bytes(b"someone else's") + + for hexframe in _sent["frames"]: + session._do_file_upload(msgpack.unpackb(bytes.fromhex(hexframe), raw=False)) + acks = [msgpack.packb(m, use_bin_type=True).hex() + for m in session.sent if m.get("type") == MNP.FILE_UPLOAD_ACK] + assert len(acks) == len(_sent["frames"]) + + result = _run_probe(_probe_input(_gek, "receive", acks=acks)) + assert result["state"] == "resolved", result.get("message") + assert result["stored"]["stored_as"] == "holiday (2).jpg" + assert result["stored"]["dir"] == "library" + + +def test_the_client_refuses_an_older_node_before_sending_a_chunk(_gek): + """ + A 1.x node would answer "Missing filename or data" — an error about the + wrong thing, naming no upload, which fails every upload in flight. Asked + first instead, and nothing goes on the wire. + """ + result = _run_probe(_probe_input(_gek, "receive", acks=[], + node_version="1.1")) + assert result["state"] == "rejected" + assert "older MeshBay" in result["message"] + assert result["frames"] == [], "a chunk was sent to a node that cannot open it" diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py index f8b6c03..5318c25 100644 --- a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py +++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py @@ -103,7 +103,13 @@ from meshbay_common.join import ( ROLE_OPERATOR, join_transcript, ) -from meshbay_common.protocol import MNP, chunk_ciphertext, file_chunk_wire +from meshbay_common.protocol import ( + MNP, + chunk_ciphertext, + file_chunk_wire, + file_upload_ack_wire, + file_upload_payload, +) from meshbay_node.transport.wire import index_sync_message from meshbay_node.indexer import GroupIndex from meshbay_node.indexer.indexer import DirectoryIndexer @@ -3998,27 +4004,88 @@ class WebRTCPeerSession: self._send(resp) def _do_file_upload(self, msg: dict) -> None: + """ + One chunk of an upload, sealed under the group key (MNP 2.0). + + Sealing this direction is not symmetry for its own sake. Downloads have + been under a GEK-derived key since the beginning; uploads carried the + filename and the raw bytes in plain msgpack, so the same file was + ciphertext leaving a node and plaintext arriving at one. The node holds + the GEK for its own group, so it opens the payload here — before it + decides a destination, before it touches the disk — and refuses a chunk + that does not open. + + `upload_id` is the correlation key and stays in clear; `filename`, `dir` + and `root` moved inside the seal, which is why every refusal below names + the upload rather than the file. A `code` says which refusal it is, and + the client already knows what it sent. + """ ctx = self._group_ctx() - filename = msg.get("filename", "") - chunk_index = msg.get("chunk_index", 0) - total_chunks = msg.get("total_chunks", 1) - data = msg.get("data") + upload_id = str(msg.get("upload_id") or "")[:64] + + gek = ctx.get("gek") + if not gek: + self._send({"type": "error", "detail": "Group encryption not initialized", + "code": "no_group_key", "upload_id": upload_id}) + return + + try: + payload = file_upload_payload(gek, self._group_id or "", msg) + except Exception: + # Deliberately one answer for "not sealed at all" and "sealed wrong": + # distinguishing them tells a peer which of the two it got right. + # An MNP 1.x client lands here, which is the whole of the upgrade + # story — everything else it does still works. + self._audit("upload_refused", "unsealed") + self._send({ + "type": "error", + "detail": "This upload did not open under the group key — the " + "client may be running an older version", + "code": "upload_not_sealed", + "upload_id": upload_id, + }) + return + + filename = payload.get("filename") or "" + data = payload.get("data") + # From the clear part of the message, so peer-controlled and unchecked + # by the AEAD. Everything below compares and adds to them. + try: + chunk_index = int(msg.get("chunk_index", 0)) + total_chunks = int(msg.get("total_chunks", 1)) + except (TypeError, ValueError): + self._send({"type": "error", "detail": "Invalid chunk index", + "code": "bad_chunk_index", "upload_id": upload_id}) + return + + def _refuse(detail: str, code: str = "") -> None: + """A refusal names the upload, never the file: the name is sealed.""" + out = {"type": "error", "detail": detail, "upload_id": upload_id} + if code: + out["code"] = code + self._send(out) - if not filename or data is None: - self._send({"type": "error", "detail": "Missing filename or data", - "filename": filename}) + # Types first, and before any state is created. What comes out of a + # sealed payload is authenticated, not validated: it is msgpack a + # member wrote, and `SAFE_UPLOAD_NAME.match(123)` raises where a + # refusal was meant. + if not isinstance(filename, str) or not filename: + _refuse("Missing filename or data", "upload_incomplete") + return + # Bytes, always: base64 was the shape of the old plaintext `data` field + # and there is no sealed message that can carry a string here. + if not isinstance(data, (bytes, bytearray)): + _refuse("Invalid chunk encoding", "bad_chunk_encoding") return + chunk_bytes = bytes(data) if not SAFE_UPLOAD_NAME.match(filename): - self._send({"type": "error", "detail": "Invalid filename", - "filename": filename}) + _refuse("Invalid filename", "invalid_filename") return roots: RootSet | None = ctx.get("roots") if not roots: - self._send({"type": "error", - "detail": "No directories configured for this group", - "filename": filename}) + _refuse("No directories configured for this group", "no_roots") return # The client names the root it is uploading into — it is browsing one, @@ -4029,47 +4096,32 @@ class WebRTCPeerSession: # An unknown name is refused rather than falling back to a writable # root, because "the file went somewhere else" is discovered weeks # later — the same reason the old single upload root was never guessed. - # A client that names nothing is an MNP 1.0 one, and there was exactly - # one destination in its world: the first writable root. # `dir` is the folder being browsed, as a virtual path # (`Media/Films/1999`); `root` is the older, coarser form and is what - # its first segment means on its own. - target_rel = str(msg.get("dir") or "").strip().strip("/") + # its first segment means on its own. Both are sealed now, so a refusal + # below can no longer quote them back. + target_rel = str(payload.get("dir") or "").strip().strip("/") target_root_name = (target_rel.split("/")[0] if target_rel - else str(msg.get("root") or "").strip()) + else str(payload.get("root") or "").strip()) upload_root = None if target_root_name: upload_root = roots.by_name(target_root_name) if upload_root is None: - self._send({"type": "error", - "detail": f"No directory named " - f"{target_root_name!r} in this group", - "code": "no_such_root", - "filename": filename}) + _refuse("No such directory in this group", "no_such_root") return else: writable = roots.writable_roots upload_root = writable[0] if writable else None if upload_root is None: - self._send({"type": "error", - "detail": "No writable directory in this group", - "code": "no_writable_root", - "filename": filename}) + _refuse("No writable directory in this group", "no_writable_root") return if not upload_root.writable: - self._send({"type": "error", - "detail": f"Directory '{upload_root.name}' is read-only", - "code": "root_read_only", - "filename": filename}) + _refuse("That directory is read-only", "root_read_only") self._audit("upload_refused", filename[:64]) return if not upload_root.available: - self._send({"type": "error", - "detail": f"Directory '{upload_root.name}' is " - f"currently unavailable", - "code": "root_unavailable", - "filename": filename}) + _refuse("That directory is currently unavailable", "root_unavailable") return # The folder the sender is looking at, and no subdirectory of the node's @@ -4093,23 +4145,17 @@ class WebRTCPeerSession: if target_rel: target_dir = roots.resolve(target_rel) if target_dir is None or not target_dir.is_dir(): - self._send({"type": "error", - "detail": "Not a directory in this group", - "code": "no_such_directory", - "filename": filename}) + _refuse("Not a directory in this group", "no_such_directory") return rel_dir = target_rel else: - # An MNP 1.0 client names nothing; the root itself is where its one - # destination now is. + # A client that names nothing: the first writable root is where its + # one destination is. target_dir = upload_root.path rel_dir = upload_root.name if not target_dir.is_dir(): - self._send({"type": "error", - "detail": f"Directory '{upload_root.name}' is " - f"currently unavailable", - "code": "root_unavailable", - "filename": filename}) + _refuse("That directory is currently unavailable", + "root_unavailable") return upload_key = f"{rel_dir}/{filename}" @@ -4125,33 +4171,24 @@ class WebRTCPeerSession: # Backstop: _free_name already guarantees this, and it stays because # it asserts the invariant where the write happens. if final_path.exists(): - self._send({"type": "error", "detail": "File already exists", - "filename": filename}) + _refuse("File already exists", "already_exists") return state = {"next_index": 0, "bytes": 0, "stored_name": stored_name} self._uploads[upload_key] = state elif state is None: - self._send({"type": "error", "detail": "Upload not started", - "filename": filename}) + _refuse("Upload not started", "not_started") return # Reject out-of-order or replayed chunks — otherwise chunk_index>0 appends # blindly to whatever .part file is already on disk. if chunk_index != state["next_index"]: - self._send({"type": "error", "detail": "Unexpected chunk index", - "filename": filename}) + _refuse("Unexpected chunk index", "bad_chunk_index") return - if isinstance(data, str): - chunk_bytes = base64.b64decode(data) - else: - chunk_bytes = bytes(data) - if state["bytes"] + len(chunk_bytes) > MAX_UPLOAD_BYTES: self._uploads.pop(upload_key, None) tmp_path.unlink(missing_ok=True) - self._send({"type": "error", "detail": "Upload exceeds size limit", - "filename": filename}) + _refuse("Upload exceeds size limit", "too_large") return with open(tmp_path, "wb" if chunk_index == 0 else "ab") as f: @@ -4159,16 +4196,16 @@ class WebRTCPeerSession: state["next_index"] = chunk_index + 1 state["bytes"] += len(chunk_bytes) - self._send({ - "type": MNP.FILE_UPLOAD_ACK, - "v": MNP_VERSION, - "chunk_index": chunk_index, - "filename": filename, + self._send(file_upload_ack_wire( + gek, self._group_id or "", + upload_id=upload_id, + chunk_index=chunk_index, + filename=filename, # What it is actually called on disk, which a chat attachment has to # reference and the uploader deserves to be told. - "stored_as": stored_name, - "dir": rel_dir, - }) + stored_as=stored_name, + dir=rel_dir, + )) if chunk_index + 1 >= total_chunks: self._uploads.pop(upload_key, None) diff --git a/packages/meshbay-node/tests/conftest.py b/packages/meshbay-node/tests/conftest.py index 3dc9cd9..ba86c13 100644 --- a/packages/meshbay-node/tests/conftest.py +++ b/packages/meshbay-node/tests/conftest.py @@ -39,3 +39,34 @@ def one_root(path: Path, *, name: str = "", kind: str = "generic", """ return RootSet.build([{"path": str(path), "name": name, "kind": kind, "writable": writable}]) + + +def sealed_upload(session, *, filename: str, data: bytes, + chunk_index: int = 0, total_chunks: int = 1, + dir: str = "", root: str = "", + upload_id: str = "up-test") -> dict: + """ + A `file_upload` message as the shipping client builds one (MNP 2.0). + + Built through `file_upload_wire`, not by hand: a test that assembles the + wire shape itself is a second encoder, and a second encoder is how + `file_chunk` and `index_sync` forked between the transports (finding C6) + with nobody noticing. The key and the AAD are taken off the session, so + these agree with the handler by construction rather than by copying. + """ + from meshbay_common.protocol import file_upload_wire + + ctx = session._group_ctx() + return file_upload_wire( + ctx["gek"], session._group_id or "", + upload_id=upload_id, chunk_index=chunk_index, total_chunks=total_chunks, + filename=filename, data=data, dir=dir, root=root, + ) + + +def opened_ack(session, msg: dict) -> dict: + """The payload of a `file_upload_ack` the node sent, opened as a client would.""" + from meshbay_common.protocol import file_upload_ack_payload + + ctx = session._group_ctx() + return file_upload_ack_payload(ctx["gek"], session._group_id or "", msg) diff --git a/packages/meshbay-node/tests/test_root_writable_policy.py b/packages/meshbay-node/tests/test_root_writable_policy.py index 7eb75fd..8345880 100644 --- a/packages/meshbay-node/tests/test_root_writable_policy.py +++ b/packages/meshbay-node/tests/test_root_writable_policy.py @@ -21,13 +21,14 @@ anything. A deprecated instruction that still works is not deprecated, and this one would reopen uploads group-wide. """ -import base64 from pathlib import Path import pytest from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey +from conftest import sealed_upload from meshbay_common.adminop import OP_ROOT_UPDATE, OP_ROOT_EJECT, OP_ROOT_PLUG +from meshbay_common.crypto import generate_gek from meshbay_common.protocol import MNP from meshbay_node.indexer.group_index import GroupIndex from meshbay_node.roots import RootSet @@ -47,6 +48,8 @@ def _session(tmp_path: Path, user_id: str, *, "index": index, "sk_node": index.sk_node, "node_user_id": operator, + # Uploads are sealed under the group key since MNP 2.0. + "gek": generate_gek(), } session = WebRTCPeerSession.__new__(WebRTCPeerSession) session._ctx = ctx @@ -61,11 +64,8 @@ def _session(tmp_path: Path, user_id: str, *, def _upload(session, filename="clip.mp4", body=b"bytes"): - session._do_file_upload({ - "filename": filename, "dir": "shared", - "chunk_index": 0, "total_chunks": 1, - "data": base64.b64encode(body).decode(), - }) + session._do_file_upload(sealed_upload( + session, filename=filename, data=body, dir="shared")) def _uploads_dir(session) -> Path: diff --git a/packages/meshbay-node/tests/test_security_regressions.py b/packages/meshbay-node/tests/test_security_regressions.py index fa821d9..988aa46 100644 --- a/packages/meshbay-node/tests/test_security_regressions.py +++ b/packages/meshbay-node/tests/test_security_regressions.py @@ -16,10 +16,11 @@ from pathlib import Path import pytest from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey +from meshbay_common.crypto import generate_gek from meshbay_common.protocol import IndexEntry from meshbay_node.indexer.group_index import GroupIndex from meshbay_node.roots import RootSet -from conftest import one_root +from conftest import one_root, opened_ack, sealed_upload from meshbay_node.transport.webrtc_server import WebRTCPeerSession @@ -156,7 +157,10 @@ def _session(tmp_path: Path, user_id: str) -> WebRTCPeerSession: shared_root = tmp_path / "shared" shared_root.mkdir(exist_ok=True) index = GroupIndex(group_id="g" * 32, sk_node=Ed25519PrivateKey.generate()) - ctx = {"roots": one_root(shared_root), "index": index, "sk_node": index.sk_node} + # A group key, because uploads are sealed under it since MNP 2.0 — the + # handler opens the payload before it has a filename to refuse. + ctx = {"roots": one_root(shared_root), "index": index, + "sk_node": index.sk_node, "gek": generate_gek()} session = WebRTCPeerSession.__new__(WebRTCPeerSession) session._ctx = ctx @@ -188,12 +192,8 @@ def test_upload_cannot_overwrite_another_members_file(tmp_path): original.write_bytes(b"operator's original content") attacker = _session(tmp_path, "attacker-user") - attacker._do_file_upload({ - "filename": "important.mp4", - "chunk_index": 0, - "total_chunks": 1, - "data": base64.b64encode(b"attacker content").decode(), - }) + attacker._do_file_upload(sealed_upload( + attacker, filename="important.mp4", data=b"attacker content")) assert original.read_bytes() == b"operator's original content", ( "an upload replaced an existing file (C5a)") @@ -203,12 +203,15 @@ def test_upload_cannot_overwrite_another_members_file(tmp_path): def test_upload_second_attempt_cannot_replace_own_completed_file(tmp_path): """C5a: even the original uploader does not get to overwrite.""" session = _session(tmp_path, "user-1") - payload = {"filename": "movie.mp4", "chunk_index": 0, "total_chunks": 1, - "data": base64.b64encode(b"first").decode()} - session._do_file_upload(dict(payload)) - session.sent.clear() + def _send_it(): + # Sealed afresh each time: a nonce is drawn per message, so re-sending + # the same dict would be a replay rather than a second upload. + session._do_file_upload(sealed_upload( + session, filename="movie.mp4", data=b"first")) - session._do_file_upload(dict(payload)) + _send_it() + session.sent.clear() + _send_it() uploads = _uploads_dir(session) assert (uploads / "movie.mp4").read_bytes() == b"first", ( "the first upload was replaced") @@ -252,11 +255,8 @@ def test_the_client_names_a_folder_and_never_a_filesystem_path(tmp_path): for bad in ("../../etc", "/etc", "shared/../..", "shared/../../etc", "nope", "shared/missing"): session.sent.clear() - session._do_file_upload({ - "filename": "note.txt", "dir": bad, - "chunk_index": 0, "total_chunks": 1, - "data": base64.b64encode(b"x").decode(), - }) + session._do_file_upload(sealed_upload( + session, filename="note.txt", data=b"x", dir=bad)) refusal = [m for m in session.sent if m.get("type") == "error"] assert refusal, f"{bad!r} was accepted" assert refusal[0].get("code") in ("no_such_root", "no_such_directory"), bad @@ -274,11 +274,8 @@ def test_an_upload_lands_in_the_folder_it_names(tmp_path): root = session._ctx["roots"].roots[0] (root.path / "Albums").mkdir() - session._do_file_upload({ - "filename": "note.txt", "dir": f"{root.name}/Albums", - "chunk_index": 0, "total_chunks": 1, - "data": base64.b64encode(b"x").decode(), - }) + session._do_file_upload(sealed_upload( + session, filename="note.txt", data=b"x", dir=f"{root.name}/Albums")) assert (root.path / "Albums" / "note.txt").read_bytes() == b"x" assert not (root.path / "Albums" / "uploads").exists(), ( @@ -304,11 +301,8 @@ def test_an_upload_goes_to_the_root_it_names(tmp_path): {"path": str(incoming), "writable": True}, ]) - session._do_file_upload({ - "filename": "note.txt", "dir": "Incoming", - "chunk_index": 0, "total_chunks": 1, - "data": base64.b64encode(b"x").decode(), - }) + session._do_file_upload(sealed_upload( + session, filename="note.txt", data=b"x", dir="Incoming")) assert (incoming / "note.txt").read_bytes() == b"x" assert not (media / "note.txt").exists(), "it went to the first root instead" @@ -327,11 +321,8 @@ def test_a_read_only_root_refuses_an_upload(tmp_path): session._ctx["roots"] = RootSet.build([{"path": str(published)}]) session._is_node_admin = lambda: True - session._do_file_upload({ - "filename": "note.txt", "dir": "Published", - "chunk_index": 0, "total_chunks": 1, - "data": base64.b64encode(b"x").decode(), - }) + session._do_file_upload(sealed_upload( + session, filename="note.txt", data=b"x", dir="Published")) refusal = [m for m in session.sent if m.get("type") == "error"] assert refusal and refusal[0].get("code") == "root_read_only" @@ -349,11 +340,8 @@ def test_a_fully_read_only_group_refuses_an_unaddressed_upload(tmp_path): session = _session(tmp_path, "user-1") session._ctx["roots"] = RootSet.build([{"path": str(published)}]) - session._do_file_upload({ - "filename": "note.txt", - "chunk_index": 0, "total_chunks": 1, - "data": base64.b64encode(b"x").decode(), - }) + session._do_file_upload(sealed_upload( + session, filename="note.txt", data=b"x")) refusal = [m for m in session.sent if m.get("type") == "error"] assert refusal and refusal[0].get("code") == "no_writable_root" @@ -375,11 +363,8 @@ def test_an_ejected_root_refuses_an_upload(tmp_path): roots.roots[0].available = False session._ctx["roots"] = roots - session._do_file_upload({ - "filename": "note.txt", "dir": "USB", - "chunk_index": 0, "total_chunks": 1, - "data": base64.b64encode(b"x").decode(), - }) + session._do_file_upload(sealed_upload( + session, filename="note.txt", data=b"x", dir="USB")) refusal = [m for m in session.sent if m.get("type") == "error"] assert refusal and refusal[0].get("code") == "root_unavailable" @@ -392,22 +377,22 @@ def test_two_members_can_send_the_same_filename(tmp_path): IMG_1234.jpg. The second gets a free name; neither replaces the other. """ first = _session(tmp_path, "user-1") - first._do_file_upload({ - "filename": "IMG_1234.jpg", "chunk_index": 0, "total_chunks": 1, - "data": base64.b64encode(b"first").decode(), - }) + first._do_file_upload(sealed_upload( + first, filename="IMG_1234.jpg", data=b"first")) second = _session(tmp_path, "user-2") - second._do_file_upload({ - "filename": "IMG_1234.jpg", "chunk_index": 0, "total_chunks": 1, - "data": base64.b64encode(b"second").decode(), - }) + # Same group, so the same key: `_session` builds one per call, and two + # members of one group do not have two. + second._ctx["gek"] = first._ctx["gek"] + second._do_file_upload(sealed_upload( + second, filename="IMG_1234.jpg", data=b"second")) uploads = _uploads_dir(first) assert (uploads / "IMG_1234.jpg").read_bytes() == b"first" assert (uploads / "IMG_1234 (2).jpg").read_bytes() == b"second" ack = [m for m in second.sent if m.get("type") == "file_upload_ack"][-1] - assert ack["stored_as"] == "IMG_1234 (2).jpg", ( + assert "stored_as" not in ack, "the name the node chose must be sealed" + assert opened_ack(second, ack)["stored_as"] == "IMG_1234 (2).jpg", ( "the sender must be told the name that was used, or a chat attachment " "points at someone else's file") diff --git a/packages/meshbay-node/tests/test_upload_sealed.py b/packages/meshbay-node/tests/test_upload_sealed.py new file mode 100644 index 0000000..7c1be96 --- /dev/null +++ b/packages/meshbay-node/tests/test_upload_sealed.py @@ -0,0 +1,285 @@ +""" +The write path, sealed under the group key (MNP 2.0). + +Downloads have been encrypted under a GEK-derived key since the beginning: +`file_chunk` and `stream_data` both go through `chunk_ciphertext`. Uploads did +not. `file_upload` carried the filename and the raw bytes in plain msgpack and +`file_upload_ack` carried the name the node stored them under, so the same file +was ciphertext leaving a node and plaintext arriving at one — an asymmetry with +no threat model behind it. + +What sealing buys is what `groupbox.py` says and no more: nothing against a +network observer (DTLS covers that), nothing against the hub (never on this +channel), nothing against a member (they hold the GEK). It buys defence in +depth against our own next handshake bug, of a class already shipped twice — +C1, the unauthenticated node HTTP API, and C6, the transport that took a bare +JWT. Both were "a peer that had not finished the handshake was served data". +Sealed, the equivalent bug on this path leaks ciphertext instead of the +operator's filenames. +""" + +from pathlib import Path + +import pytest +from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey +from meshbay_common.crypto import generate_gek +from meshbay_common.protocol import MNP, file_upload_wire +from meshbay_node.indexer.group_index import GroupIndex +from meshbay_node.transport.webrtc_server import WebRTCPeerSession + +from conftest import one_root, opened_ack, sealed_upload + +GROUP = "g" * 32 + + +def _session(tmp_path: Path, *, gek: bytes | None = None) -> WebRTCPeerSession: + shared_root = tmp_path / "shared" + shared_root.mkdir(exist_ok=True) + index = GroupIndex(group_id=GROUP, sk_node=Ed25519PrivateKey.generate()) + session = WebRTCPeerSession.__new__(WebRTCPeerSession) + session._ctx = {"roots": one_root(shared_root), "index": index, + "sk_node": index.sk_node, "gek": gek or generate_gek()} + session._group_id = GROUP + session._user_id = "user-1" + session._pk_user = "" + session._uploads = {} + session.sent = [] + session._send = session.sent.append + session._audit = lambda *a, **k: None + return session + + +def _root(session): + return session._ctx["roots"].roots[0] + + +def _errors(session): + return [m for m in session.sent if m.get("type") == "error"] + + +def _wrote_anything(tmp_path) -> bool: + return any(p.is_file() for p in tmp_path.rglob("*")) + + +# ── The message itself ─────────────────────────────────────────────────────── + +def test_the_wire_message_carries_no_filename_and_no_plaintext(tmp_path): + """ + The point of the exercise. `upload_id` and `chunk_index` are outside the + seal because the node routes and orders on them before it can decrypt; + everything that names or is the operator's content is inside it. + """ + session = _session(tmp_path) + msg = sealed_upload(session, filename="holiday.jpg", data=b"JPEGDATA", + dir=f"{_root(session).name}") + + assert set(msg) == {"type", "v", "upload_id", "chunk_index", + "total_chunks", "nonce", "ct"} + blob = repr(msg).encode() + msg["ct"] + assert b"holiday.jpg" not in blob, "the filename is on the wire in clear" + assert b"JPEGDATA" not in blob, "the file content is on the wire in clear" + + +def test_the_ack_carries_no_stored_name(tmp_path): + """ + `stored_as` is the name the node settled on — it finds a free one rather + than replacing anything — and naming it in clear would hand back exactly + what the request took the trouble to hide. + """ + session = _session(tmp_path) + session._do_file_upload(sealed_upload( + session, filename="holiday.jpg", data=b"x", dir=_root(session).name)) + + ack = [m for m in session.sent if m.get("type") == MNP.FILE_UPLOAD_ACK][-1] + assert set(ack) == {"type", "v", "upload_id", "chunk_index", "nonce", "ct"} + assert b"holiday.jpg" not in repr(ack).encode() + ack["ct"] + assert opened_ack(session, ack) == { + "filename": "holiday.jpg", "stored_as": "holiday.jpg", + "dir": _root(session).name} + + +def test_the_ack_names_the_upload_so_one_refusal_fails_one_upload(tmp_path): + """ + `filename` used to be the correlation key on both sides. It cannot be one + any more, and `upload_id` replaces it — a client-chosen label, opaque to + the node, never an authorization input. Without it a client running several + uploads could only match replies by arrival order, which is how a refusal + for one file used to fail every upload in flight. + """ + session = _session(tmp_path) + session._do_file_upload(sealed_upload( + session, filename="a.txt", data=b"x", dir=_root(session).name, + upload_id="upload-A")) + session._do_file_upload(sealed_upload( + session, filename="../evil", data=b"x", dir=_root(session).name, + upload_id="upload-B")) + + ack = [m for m in session.sent if m.get("type") == MNP.FILE_UPLOAD_ACK][-1] + assert ack["upload_id"] == "upload-A" + assert _errors(session)[0]["upload_id"] == "upload-B" + + +# ── What is refused ────────────────────────────────────────────────────────── + +def test_a_plaintext_upload_is_refused(tmp_path): + """ + The MNP 1.x shape, which is what an un-updated client sends. Refused with a + code and a message saying which side is old — never accepted "just this + once", because a path that still takes plaintext is not a sealed path. + """ + session = _session(tmp_path) + session._do_file_upload({ + "filename": "note.txt", "dir": _root(session).name, + "chunk_index": 0, "total_chunks": 1, "data": b"x", + }) + + assert _errors(session)[0]["code"] == "upload_not_sealed" + assert not _wrote_anything(tmp_path) + + +def test_a_tampered_chunk_is_refused(tmp_path): + """ + AES-GCM's tag, asserted where it matters: a flipped bit in the ciphertext + must stop the upload, not produce a corrupt file with a plausible name. + """ + session = _session(tmp_path) + msg = sealed_upload(session, filename="note.txt", data=b"x" * 64, + dir=_root(session).name) + msg["ct"] = bytes([msg["ct"][0] ^ 0x01]) + msg["ct"][1:] + session._do_file_upload(msg) + + assert _errors(session)[0]["code"] == "upload_not_sealed" + assert not _wrote_anything(tmp_path) + + +def test_an_upload_sealed_for_another_group_is_refused(tmp_path): + """ + The group is the AAD, so a node hosting two groups cannot have a chunk + moved between them — and a member of one cannot write into the other by + reaching a session that is on it (finding H1's shape, on the write path). + """ + session = _session(tmp_path) + msg = file_upload_wire( + session._ctx["gek"], "some-other-group", + upload_id="u1", chunk_index=0, total_chunks=1, + filename="note.txt", data=b"x", dir=_root(session).name) + session._do_file_upload(msg) + + assert _errors(session)[0]["code"] == "upload_not_sealed" + assert not _wrote_anything(tmp_path) + + +def test_an_upload_under_another_key_is_refused(tmp_path): + """A peer past the handshake with the wrong GEK still writes nothing.""" + session = _session(tmp_path) + msg = file_upload_wire( + generate_gek(), GROUP, + upload_id="u1", chunk_index=0, total_chunks=1, + filename="note.txt", data=b"x", dir=_root(session).name) + session._do_file_upload(msg) + + assert _errors(session)[0]["code"] == "upload_not_sealed" + assert not _wrote_anything(tmp_path) + + +def test_an_ack_replayed_as_a_request_does_not_open(tmp_path): + """ + The message type is in the AAD, so the two halves of an upload cannot be + confused for each other. Cheap, and it closes a class that is tedious to + reason about after the fact. + """ + from cryptography.exceptions import InvalidTag + from meshbay_common.protocol import file_upload_ack_wire, file_upload_payload + + session = _session(tmp_path) + ack = file_upload_ack_wire( + session._ctx["gek"], GROUP, upload_id="u1", chunk_index=0, + filename="note.txt", stored_as="note.txt", dir="shared") + with pytest.raises(InvalidTag): + file_upload_payload(session._ctx["gek"], GROUP, ack) + + +def test_a_group_with_no_key_refuses_rather_than_falling_back(tmp_path): + """ + A node whose group has no GEK yet cannot open anything. It must say so, not + read the message as though it were the old plaintext shape. + """ + session = _session(tmp_path) + msg = sealed_upload(session, filename="note.txt", data=b"x", + dir=_root(session).name) + session._ctx["gek"] = b"" + session._do_file_upload(msg) + + assert _errors(session)[0]["code"] == "no_group_key" + assert not _wrote_anything(tmp_path) + + +# ── What must still work ───────────────────────────────────────────────────── + +def test_a_multi_chunk_upload_reassembles(tmp_path): + """ + Every chunk is sealed under its own nonce, and the node appends in order. + Nothing about the seal may change what lands on disk. + """ + session = _session(tmp_path) + body = bytes(range(256)) * 40 + parts = [body[i:i + 1024] for i in range(0, len(body), 1024)] + for i, part in enumerate(parts): + session._do_file_upload(sealed_upload( + session, filename="blob.bin", data=part, + chunk_index=i, total_chunks=len(parts), dir=_root(session).name)) + + assert (_root(session).path / "blob.bin").read_bytes() == body + assert not list(_root(session).path.glob("*.part")), "a temp file was left" + acks = [m for m in session.sent if m.get("type") == MNP.FILE_UPLOAD_ACK] + assert [m["chunk_index"] for m in acks] == list(range(len(parts))) + + +def test_two_identical_chunks_do_not_reuse_a_nonce(tmp_path): + """ + A file of repeated bytes is ordinary, so the nonce must come from the RNG + and never from the payload. Cheap to assert and expensive to discover. + """ + session = _session(tmp_path) + a = sealed_upload(session, filename="f", data=b"same", chunk_index=0) + b = sealed_upload(session, filename="f", data=b"same", chunk_index=0) + assert a["nonce"] != b["nonce"] + assert a["ct"] != b["ct"] + + +def test_a_sealed_payload_is_authenticated_not_validated(tmp_path): + """ + Opening a payload proves a member wrote it, not that they wrote something + sensible. A member can seal anything, so the fields still need their types + checked — `SAFE_UPLOAD_NAME.match(123)` raises where a refusal was meant, + and the dispatcher's catch-all would turn that into "Request failed". + """ + from meshbay_common.groupbox import PURPOSE_UPLOAD, seal + + session = _session(tmp_path) + for payload in ({"filename": 123, "data": b"x"}, + {"filename": "note.txt", "data": "not bytes"}, + {"filename": "note.txt"}): + session.sent.clear() + session._do_file_upload({ + "type": MNP.FILE_UPLOAD, "v": "2.0", "upload_id": "u1", + "chunk_index": 0, "total_chunks": 1, + **seal(session._ctx["gek"], PURPOSE_UPLOAD, MNP.FILE_UPLOAD, + GROUP, payload), + }) + errs = _errors(session) + assert errs, f"{payload!r} was accepted" + assert errs[0]["code"] in ("upload_incomplete", "bad_chunk_encoding") + assert not _wrote_anything(tmp_path) + + +def test_a_peer_controlled_chunk_index_cannot_crash_the_handler(tmp_path): + """`chunk_index` is outside the seal by necessity, so it is unchecked input.""" + session = _session(tmp_path) + msg = sealed_upload(session, filename="note.txt", data=b"x", + dir=_root(session).name) + msg["chunk_index"] = "zero" + session._do_file_upload(msg) + + assert _errors(session)[0]["code"] == "bad_chunk_index" + assert not _wrote_anything(tmp_path) -- cgit v1.2.3