* smp server: delayed AUTH responses
* plan
* update
* simplify
* simplify
* stat when sent without delay
* update schema
* round up response time to the nearest delay multiple
---------
Co-authored-by: Evgeny @ SimpleX Chat <259188159+evgeny-simplex@users.noreply.github.com>
* crypto: Ethereum primitives for SimpleX names
secp256k1 (vendored libsecp256k1 v0.8.0, recoverable ECDSA), BIP-39
mnemonics, BIP-32 derivation, Keccak-256, EIP-55 addresses and EIP-712
typed data hashing.
Client-side signing only: no RLP, no transaction construction, no chain
writes. The resolver path stays read-only.
Verified against published vectors — the 24 official BIP-39 English
vectors, BIP-32 spec vectors 1 and 2, the EIP-55 spec addresses and the
EIP-712 Mail example.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* tiny fixes
* plan update
* expose what's necessary for stealth addresses too"
* add string encoding
* streamline hex encoding
* core: ethereumPath takes the address index
The BIP-44 path is the same for every address under an account, so the
caller that wants one names it, rather than rebuilding the path around the
one this hard-coded.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rvc3HbiWBTqbAvRT45G5oX
* core: embed the BIP-39 wordlist as the upstream file
The list was transcoded into Haskell, which can only be audited by reading
2048 words against the source. The upstream english.txt is vendored instead
and embedded at compile time, so auditing it is one sha256sum, and a test
pins that checksum so the copy cannot drift.
file-embed moves into the library, where it was already a dependency of the
executables and the test suite.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rvc3HbiWBTqbAvRT45G5oX
* review fixes
* fix review findings iterate self-reviews with /goal
* next review round
* cut to the min
* cut comments
* streamline
* Update src/Simplex/Messaging/Crypto/BIP32.hs
Co-authored-by: Evgeny <evgeny@poberezkin.com>
* Update CHANGELOG.md
Co-authored-by: Evgeny <evgeny@poberezkin.com>
* Update src/Simplex/Messaging/Crypto/BIP32.hs
Co-authored-by: Evgeny <evgeny@poberezkin.com>
* Update src/Simplex/Messaging/Crypto/Secp256k1.hs
Co-authored-by: Evgeny <evgeny@poberezkin.com>
* Update src/Simplex/Messaging/Crypto/Secp256k1.hs
Co-authored-by: Evgeny <evgeny@poberezkin.com>
* opus 5.5 /goal iterations
* self-review rounds
* self-review iteration 2
* self-review iteration 3
* self-review iteration 3ff
* self-review iteration 3fff
* self-review iteration 5
* more doc tweaks
* self-review iteration 9
* self-review iteration 10
* wip
* rng preserve
* finish wip and factor in test vectors
* make wallet creation and account derivation infallible like trezor does
* review iterations
* limit derivation retries to 3
* remove unnecessary export
* random
* security, simplify, imports
* use static context
* fix test
* restore public api to use rng
* back to IO
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Evgeny @ SimpleX Chat <259188159+evgeny-simplex@users.noreply.github.com>
Co-authored-by: Evgeny <evgeny@poberezkin.com>
* smp-server: namespaces resolver scaffolding
* smp-server: Names resolver hardening + cleanup
* smp-server: fuse parallel dispatchers
* smp-server: JSON wire format for NameRecord + Names.hs restructure
* smp-server: redact RpcAuth in Show
* smp-server: JSON wire fixups + spec rewrite + small cleanups
* plan: prepend implementation-diverged banner
* move SimplexName into shared module
* smp-server: name + contract whitelist on RSLV
* smp-server: address audit findings (canonical JSON, INI guards, SSRF, TLD case, shutdown)
* smp-server: round 2 audit fixes (label case, response cap, ipv6 link-local)
* smp-server: round 3 audit fixes (SSRF coverage, drop noop closeManager, CSV order)
* smp-server: round 4 audit fixes (0X-hex host, expanded IPv6 forms, pingEndpoint timeout)
* smp-server: hardcode TldRegistries (drop registry_tld_* INI keys)
* smp-server: round 6 audit fixes (IPv6 SSRF, redirects, ASCII labels)
- Reject IPv6 aliases of 169.254.169.254 (IPv4-compatible / IPv4-mapped /
6to4 / NAT64) via numeric range check on parsed IPv6.
- Disable HTTP redirects on the Eth RPC request.
- Restrict SimplexName labels to ASCII (Cyrillic/Greek/full-width otherwise
hash to different on-chain records and diverge from UTS-46 registrars).
- pingEndpoint: only JsonRpcErr means "reachable"; transport/decode failures
fail startup. boundedIniInt: readMaybe over partial read.
- Add 127.0.0.0/8 and 0.0.0.0 to isLoopback.
- Replace hand-rolled hex helpers with Data.ByteArray.Encoding; raise
managerConnCount to match rpcMaxConcurrency; hex Show for NameOwner.
- Fuse parallel http/https when into unless+case; drop reverse/re-reverse
in mkDomain TLDWeb; first AbiInvariantViolated; Nothing <$ decodeAddress;
forM_ (eitherToMaybe ...); >>= chain in NameOwner FromJSON.
- Drop dead imports/exports/pragmas and two restating comments.
- Tests: factor unsafeOwner/unsafeLink, addr1/2/3, testNamesConfig; add
non-ASCII label rejection coverage.
* namespace: bound parser input to 253 bytes (DoS defense)
The bare-name fallback and bareDomain parser would otherwise consume
arbitrarily many non-space bytes via takeWhile1 before any validation
or length check. A crafted multi-megabyte token would be decoded as
UTF-8 and re-parsed in full before being rejected.
Introduce `boundedNonSpace` (scan with 253-byte cap) at the two
takeWhile1 sites. Inputs longer than 253 bytes leave residue that
parseOnly's implicit endOfInput rejects, so the parser fails fast
without ever allocating the full input.
The bound is the DNS full-domain limit, chosen for being a familiar
ceiling generous enough to cover any realistic SimpleX name (longest
plausible @user.subdomain.simplex stays well under 100 bytes). No
per-label cap — SimpleX names don't go through DNS label resolution
and there's no semantic reason to constrain individual labels.
* namespace: switch to Python HTTP resolver + agent plumbing (#1796)
* namespace: relax resolver_endpoint validation (path prefix, http without auth)
validateUrl gains two operator-friendly relaxations and a regression test:
- Allow a path prefix (e.g. https://gw.example.com:443/snrc) for a resolver
behind a reverse-proxy sub-path; /resolve/<name> and /health are appended
(HttpResolver already strips one trailing slash, so root and sub-path
behave identically). Query/fragment/userinfo stay rejected.
- Off-loopback, reject only http WITH resolver_auth (the Authorization header
would travel in cleartext). http without auth is now allowed (no secret to
leak; resolver data is public — also lets dev setups reach a host resolver
via http://host.docker.internal). https is always allowed, with or without
auth. Plain http has no response integrity; intended for trusted/local
networks only.
Exports validateUrl and adds validateUrlSpec (11 cases) to SMPNamesTests.
* namespace: NameRecord links as arrays (multi-link, cap 5)
* namespace: distinct RSLV error responses
RSLV collapsed every non-hit (no resolver, malformed name, not found,
backing-store failure) to ERR AUTH, so a client iterating its configured
servers could not tell "this router has no resolver, try the next" from
"name not registered, stop", and a transient backend error read as an
authoritative miss.
Names capability is runtime config, orthogonal to the linear SMP version
(a future v21 router without [NAMES] must still advertise v21), so it is
signalled by a command-time error like allowSMPProxy, not by the version
range:
no resolver configured -> ERR CMD PROHIBITED (client skips, tries next)
backing-store failure -> ERR INTERNAL (transient: retry/surface)
not found / malformed -> ERR AUTH (authoritative "no such name")
Update the protocol spec error table and add agent tests for the
no-resolver (CMD PROHIBITED) and backend-failure (INTERNAL) paths.
* refactor(names): server role + one error type
Addresses epoberezkin's review (PR #1784). Name resolution becomes a
server role like proxy; the agent owns resolution + server selection;
one error type flows through the whole stack.
- ServerRoles gains `names`; UserServers gains `nameSrvs` (opt-in list);
resolveSimplexName drops the explicit server arg and picks a
names-capable server via getNextServer.
- RSLV carries SimplexNameDomain (was RslvRequest): no JSON on the wire,
contract dropped, name validated at parse (invalid -> CMD SYNTAX).
- Version check moves from the encoder to Client.hs (no ERR to server).
- ErrorType.NAME {nameErr :: NameErrorType} (+ AgentErrorType.NAME),
wire- and JSON-encoded; resolver errors surface with diagnostics.
Success response renamed NAME -> RNAME to free the collision.
- NameOwner -> EthAddress (record selector); NameRecord derives FromJSON
and gains field-ordered Encoding; per-field caps removed.
- Remove newEnvWithNames / runSMPServerBlockingWithNames test seams;
stub resolver folded into ServerConfig.namesResolverCall_.
* test(server): update stats backup line count
NameResolverStatsData adds 6 lines to the server stats backup (the
"rslvStats:" header plus the reqs/succ/notFound/resolverErrs/disabled
fields), so testRestoreMessages' expected stats-backup line count is
95 -> 101.
* feat(names): public-namespace resolution via RSLV/RNAME
SNRC names resolver role: RSLV command -> HTTP resolver -> RNAME record.
Agent owns server selection (ServerRoles.names); NAME error family; async,
concurrency-bounded resolution; length-prefixed extensible wire; spec.
* remove comments
Co-authored-by: Evgeny <evgeny@poberezkin.com>
* simplify
* move tests name
* simplify: text addresses, Tail JSON, drop admitRslv
* fix
* remove spaghetti
* reduce diff
* async again, refactor
* different threads limit for name resolutions
* remove comment
* FromField instance for SimplexNameInfo
* remove comments
* unStrJSON
* add sameConnShortLink
* remove scheme prefix
* remove unused import
* remove connecttarget tests
* remove comment
* comment
---------
Co-authored-by: Evgeny Poberezkin <evgeny@poberezkin.com>
Co-authored-by: Evgeny @ SimpleX Chat <259188159+evgeny-simplex@users.noreply.github.com>
shum