From 9f7698340e5148f8f247fe0d70a57f7f37f1f72d Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Tue, 1 Sep 2026 18:56:01 +0200 Subject: feat(node): [node] quic_enabled flag, off by default MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The QUIC MNP listener was started unconditionally whenever aioquic was importable — but nothing speaks QUIC: the browser and desktop clients use WebRTC, QuicChunkClient has no production caller, and the hub-less `group://` sidecar (D9) is unbuilt. So on every node it was an open UDP port with no client and no working NAT traversal (`punch_nat()` is a direct-connection helper, not a traversal stack). daemon startup now gates QuicChunkServer on `self._config.node.quic_enabled` (default False; `MESHBAY_QUIC_ENABLED` overrides). The generated node.toml templates (config.py, the CLI, the desktop client) carry the line, commented for what it is. Removes the exposure the third review's M2 lives on until a QUIC client exists; the parity fix for the handlers themselves is the next commit. Third security review, finding M2 (mitigation). Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG --- packages/meshbay-client/src/main.js | 1 + packages/meshbay-node/src/meshbay_node/config.py | 15 ++++++- packages/meshbay-node/src/meshbay_node/daemon.py | 9 +++- packages/meshbay-node/tests/test_quic_enabled.py | 53 ++++++++++++++++++++++++ 4 files changed, 76 insertions(+), 2 deletions(-) create mode 100644 packages/meshbay-node/tests/test_quic_enabled.py (limited to 'packages') diff --git a/packages/meshbay-client/src/main.js b/packages/meshbay-client/src/main.js index e3735e6..e071074 100644 --- a/packages/meshbay-client/src/main.js +++ b/packages/meshbay-client/src/main.js @@ -871,6 +871,7 @@ function registerBridge() { `username = "${username}"`, '', '[node]', + 'quic_enabled = false # QUIC direct path; no client uses it yet', 'quic_port = 19010', 'ui_port = 18000', '', diff --git a/packages/meshbay-node/src/meshbay_node/config.py b/packages/meshbay-node/src/meshbay_node/config.py index b1ebd54..78ee873 100644 --- a/packages/meshbay-node/src/meshbay_node/config.py +++ b/packages/meshbay-node/src/meshbay_node/config.py @@ -36,7 +36,10 @@ url = "https://meshbay.org" username = "myusername" [node] -quic_port = 19010 # QUIC (MNP) — LAN, port-forwarded, hub-less direct access +# QUIC (MNP) direct path — LAN, port-forwarded, hub-less. Off by default: no +# client speaks QUIC yet, so leaving it on only opens a UDP port. +quic_enabled = false +quic_port = 19010 ui_port = 18000 # local control API — JSON, 127.0.0.1 only, token-gated # One-time codes. An invitation waits for someone to read their messages; an @@ -129,6 +132,13 @@ class HubConfig: @dataclass class NodeConfig: quic_port: int = 19010 + # The QUIC MNP listener. Off by default: no shipping client speaks QUIC yet + # (the browser and the desktop client use WebRTC; the hub-less `group://` + # sidecar is unbuilt), so starting it only opens a UDP port with nothing to + # reach it. Turn on for LAN / port-forwarded / hub-less direct access once a + # client for it exists. `punch_nat()` is a direct-connection helper, not a + # NAT-traversal stack — a peer behind NAT still needs the port forwarded. + quic_enabled: bool = False ui_port: int = 18000 # How long a one-time code stays usable. Invitations travel through a human # conversation and are answered days later; operator pairing happens during @@ -303,6 +313,7 @@ def load_config(path: Path = DEFAULT_CONFIG_PATH) -> Config: # `port` (TCP+TLS) and `http_port` no longer exist — both listeners were removed # in Phase 11.5 (findings C1, C6). Regenerate node.toml with `meshbay-node init`. cfg.node.quic_port = nd.get("quic_port", cfg.node.quic_port) + cfg.node.quic_enabled = bool(nd.get("quic_enabled", cfg.node.quic_enabled)) cfg.node.ui_port = nd.get("ui_port", cfg.node.ui_port) cfg.node.invite_ttl_hours = int( nd.get("invite_ttl_hours", cfg.node.invite_ttl_hours)) @@ -371,6 +382,8 @@ def load_config(path: Path = DEFAULT_CONFIG_PATH) -> Config: cfg.hub.username = user if port := os.environ.get("MESHBAY_QUIC_PORT"): cfg.node.quic_port = int(port) + if (qe := os.environ.get("MESHBAY_QUIC_ENABLED")) is not None: + cfg.node.quic_enabled = qe.strip().lower() in ("1", "true", "yes", "on") if streams := os.environ.get("MESHBAY_MAX_CONCURRENT_STREAMS"): cfg.node.max_concurrent_streams = _positive( streams, cfg.node.max_concurrent_streams, diff --git a/packages/meshbay-node/src/meshbay_node/daemon.py b/packages/meshbay-node/src/meshbay_node/daemon.py index 056371a..8f9307c 100644 --- a/packages/meshbay-node/src/meshbay_node/daemon.py +++ b/packages/meshbay-node/src/meshbay_node/daemon.py @@ -537,7 +537,11 @@ class NodeDaemon: log.warning("WebRTC not available (aiortc not installed)") # 7. QUIC chunk server (LAN / port-forwarded / hub-less direct access) - if QUIC_AVAILABLE: + # + # Off unless `[node] quic_enabled = true`: no shipping client speaks + # QUIC (browser and desktop use WebRTC; the `group://` sidecar is + # unbuilt), so starting it by default only exposes a UDP port. + if QUIC_AVAILABLE and self._config.node.quic_enabled: self._quic_server = QuicChunkServer( sk_node=keys.sk_ed25519, hub_pk_pem=session.hub_pk_pem, @@ -553,6 +557,8 @@ class NodeDaemon: await self._quic_server.start() log.info("QUIC server on port %d (%d groups)", self._config.node.quic_port, len(groups_ctx)) + elif QUIC_AVAILABLE: + log.info("QUIC server disabled ([node] quic_enabled = false)") # 8. Hub WebSocket (signaling + revocations + WebRTC offers) async def on_webrtc_offer(sdp, peer_id, ice_candidates): @@ -1708,6 +1714,7 @@ def main() -> None: f'username = "{username}"', "", "[node]", + "quic_enabled = false # QUIC direct path; no client uses it yet", "quic_port = 19010", "ui_port = 18000", "", diff --git a/packages/meshbay-node/tests/test_quic_enabled.py b/packages/meshbay-node/tests/test_quic_enabled.py new file mode 100644 index 0000000..c0c1568 --- /dev/null +++ b/packages/meshbay-node/tests/test_quic_enabled.py @@ -0,0 +1,53 @@ +""" +The QUIC MNP listener is off unless the operator turns it on. + +No shipping client speaks QUIC (browser and desktop use WebRTC; the hub-less +`group://` sidecar is unbuilt), so a node that started it by default would only +be exposing a UDP port. `daemon.py` gates `QuicChunkServer` on +`self._config.node.quic_enabled`; these follow the value down the config path. +""" + +import textwrap +from pathlib import Path + +from meshbay_node.config import load_config + + +def _cfg(tmp_path: Path, body: str): + p = tmp_path / "node.toml" + p.write_text(textwrap.dedent(body)) + return load_config(p) + + +def test_off_by_default(tmp_path): + cfg = _cfg(tmp_path, """ + [node] + quic_port = 19010 + """) + assert cfg.node.quic_enabled is False + + +def test_the_operator_turns_it_on(tmp_path): + cfg = _cfg(tmp_path, """ + [node] + quic_enabled = true + """) + assert cfg.node.quic_enabled is True + + +def test_the_environment_can_force_it_on(tmp_path, monkeypatch): + monkeypatch.setenv("MESHBAY_QUIC_ENABLED", "1") + cfg = _cfg(tmp_path, """ + [node] + quic_enabled = false + """) + assert cfg.node.quic_enabled is True + + +def test_the_environment_can_force_it_off(tmp_path, monkeypatch): + monkeypatch.setenv("MESHBAY_QUIC_ENABLED", "false") + cfg = _cfg(tmp_path, """ + [node] + quic_enabled = true + """) + assert cfg.node.quic_enabled is False -- cgit v1.2.3