* smp-server: namespaces resolver scaffolding
* smp-server: Names resolver hardening + cleanup
* smp-server: fuse parallel dispatchers
* smp-server: JSON wire format for NameRecord + Names.hs restructure
* smp-server: redact RpcAuth in Show
* smp-server: JSON wire fixups + spec rewrite + small cleanups
* plan: prepend implementation-diverged banner
* move SimplexName into shared module
* smp-server: name + contract whitelist on RSLV
* smp-server: address audit findings (canonical JSON, INI guards, SSRF, TLD case, shutdown)
* smp-server: round 2 audit fixes (label case, response cap, ipv6 link-local)
* smp-server: round 3 audit fixes (SSRF coverage, drop noop closeManager, CSV order)
* smp-server: round 4 audit fixes (0X-hex host, expanded IPv6 forms, pingEndpoint timeout)
* smp-server: hardcode TldRegistries (drop registry_tld_* INI keys)
* smp-server: round 6 audit fixes (IPv6 SSRF, redirects, ASCII labels)
- Reject IPv6 aliases of 169.254.169.254 (IPv4-compatible / IPv4-mapped /
6to4 / NAT64) via numeric range check on parsed IPv6.
- Disable HTTP redirects on the Eth RPC request.
- Restrict SimplexName labels to ASCII (Cyrillic/Greek/full-width otherwise
hash to different on-chain records and diverge from UTS-46 registrars).
- pingEndpoint: only JsonRpcErr means "reachable"; transport/decode failures
fail startup. boundedIniInt: readMaybe over partial read.
- Add 127.0.0.0/8 and 0.0.0.0 to isLoopback.
- Replace hand-rolled hex helpers with Data.ByteArray.Encoding; raise
managerConnCount to match rpcMaxConcurrency; hex Show for NameOwner.
- Fuse parallel http/https when into unless+case; drop reverse/re-reverse
in mkDomain TLDWeb; first AbiInvariantViolated; Nothing <$ decodeAddress;
forM_ (eitherToMaybe ...); >>= chain in NameOwner FromJSON.
- Drop dead imports/exports/pragmas and two restating comments.
- Tests: factor unsafeOwner/unsafeLink, addr1/2/3, testNamesConfig; add
non-ASCII label rejection coverage.
* namespace: bound parser input to 253 bytes (DoS defense)
The bare-name fallback and bareDomain parser would otherwise consume
arbitrarily many non-space bytes via takeWhile1 before any validation
or length check. A crafted multi-megabyte token would be decoded as
UTF-8 and re-parsed in full before being rejected.
Introduce `boundedNonSpace` (scan with 253-byte cap) at the two
takeWhile1 sites. Inputs longer than 253 bytes leave residue that
parseOnly's implicit endOfInput rejects, so the parser fails fast
without ever allocating the full input.
The bound is the DNS full-domain limit, chosen for being a familiar
ceiling generous enough to cover any realistic SimpleX name (longest
plausible @user.subdomain.simplex stays well under 100 bytes). No
per-label cap — SimpleX names don't go through DNS label resolution
and there's no semantic reason to constrain individual labels.
* namespace: switch to Python HTTP resolver + agent plumbing (#1796)
* namespace: relax resolver_endpoint validation (path prefix, http without auth)
validateUrl gains two operator-friendly relaxations and a regression test:
- Allow a path prefix (e.g. https://gw.example.com:443/snrc) for a resolver
behind a reverse-proxy sub-path; /resolve/<name> and /health are appended
(HttpResolver already strips one trailing slash, so root and sub-path
behave identically). Query/fragment/userinfo stay rejected.
- Off-loopback, reject only http WITH resolver_auth (the Authorization header
would travel in cleartext). http without auth is now allowed (no secret to
leak; resolver data is public — also lets dev setups reach a host resolver
via http://host.docker.internal). https is always allowed, with or without
auth. Plain http has no response integrity; intended for trusted/local
networks only.
Exports validateUrl and adds validateUrlSpec (11 cases) to SMPNamesTests.
* namespace: NameRecord links as arrays (multi-link, cap 5)
* namespace: distinct RSLV error responses
RSLV collapsed every non-hit (no resolver, malformed name, not found,
backing-store failure) to ERR AUTH, so a client iterating its configured
servers could not tell "this router has no resolver, try the next" from
"name not registered, stop", and a transient backend error read as an
authoritative miss.
Names capability is runtime config, orthogonal to the linear SMP version
(a future v21 router without [NAMES] must still advertise v21), so it is
signalled by a command-time error like allowSMPProxy, not by the version
range:
no resolver configured -> ERR CMD PROHIBITED (client skips, tries next)
backing-store failure -> ERR INTERNAL (transient: retry/surface)
not found / malformed -> ERR AUTH (authoritative "no such name")
Update the protocol spec error table and add agent tests for the
no-resolver (CMD PROHIBITED) and backend-failure (INTERNAL) paths.
* refactor(names): server role + one error type
Addresses epoberezkin's review (PR #1784). Name resolution becomes a
server role like proxy; the agent owns resolution + server selection;
one error type flows through the whole stack.
- ServerRoles gains `names`; UserServers gains `nameSrvs` (opt-in list);
resolveSimplexName drops the explicit server arg and picks a
names-capable server via getNextServer.
- RSLV carries SimplexNameDomain (was RslvRequest): no JSON on the wire,
contract dropped, name validated at parse (invalid -> CMD SYNTAX).
- Version check moves from the encoder to Client.hs (no ERR to server).
- ErrorType.NAME {nameErr :: NameErrorType} (+ AgentErrorType.NAME),
wire- and JSON-encoded; resolver errors surface with diagnostics.
Success response renamed NAME -> RNAME to free the collision.
- NameOwner -> EthAddress (record selector); NameRecord derives FromJSON
and gains field-ordered Encoding; per-field caps removed.
- Remove newEnvWithNames / runSMPServerBlockingWithNames test seams;
stub resolver folded into ServerConfig.namesResolverCall_.
* test(server): update stats backup line count
NameResolverStatsData adds 6 lines to the server stats backup (the
"rslvStats:" header plus the reqs/succ/notFound/resolverErrs/disabled
fields), so testRestoreMessages' expected stats-backup line count is
95 -> 101.
* feat(names): public-namespace resolution via RSLV/RNAME
SNRC names resolver role: RSLV command -> HTTP resolver -> RNAME record.
Agent owns server selection (ServerRoles.names); NAME error family; async,
concurrency-bounded resolution; length-prefixed extensible wire; spec.
* remove comments
Co-authored-by: Evgeny <evgeny@poberezkin.com>
* simplify
* move tests name
* simplify: text addresses, Tail JSON, drop admitRslv
* fix
* remove spaghetti
* reduce diff
* async again, refactor
* different threads limit for name resolutions
* remove comment
* FromField instance for SimplexNameInfo
* remove comments
* unStrJSON
* add sameConnShortLink
* remove scheme prefix
* remove unused import
* remove connecttarget tests
* remove comment
* comment
---------
Co-authored-by: Evgeny Poberezkin <evgeny@poberezkin.com>
Co-authored-by: Evgeny @ SimpleX Chat <259188159+evgeny-simplex@users.noreply.github.com>
* parameterize transport by peer type (client/server)
* LogDebug level when test is retried
* support "flipped" HTTP2, fix test retry to avoid retrying pending tests
* move sync to the end of the tests
* smp protocol: short links types and other changes from RFC
* add fields for queue link ID and data
* create queue and ntf credentials with NEW command
* all tests
* simplfiy types, update rfc
* update rfc
* include SenderId in NEW request in case queue data is sent
* store queue data and generate link ID if needed
* update rfc
* agent API and types
* SMP commands and persistence for short links
* SMP client functions for short links
* agent client functions for short links
* create rcv queue with short link (TODO secret_box)
* encryption and encoding for link data, postgres client migration
* test creating short link
* get link and data, tests
* comments
* type signature
* server: support server roles and operators
* make server operator optional
* allRoles
* fix test
* different server host in tests
* remove ServerCfg fields used only in UI
* comments
* choose different server for invitation when connecting via address
* fix test in ghc8107
* simplify
* agent: do not mark subscriptions on expired sessions as active, do mark delayed subscriptions as active on the same session, SUBOK response in the next SMP protocol version
* client: prevent sub actions from zombie sessions (#1122)
* client: prevent sub actions from zombie sessions
* error handling
* add AERR to pass background errors to client
* switch to activeClientSession
* put closeClient under activeClientSession
* rename
* remove AERR, do not skip processing
* move check and state update to one transaction
* catch extra UPs
* fix
* check queue is still pending before making it active
---------
Co-authored-by: Evgeny Poberezkin <evgeny@poberezkin.com>
* do not forward agent error
* revert not expiring sending subs
* fixes
* track subscription responses better
* add pending connection
* Revert "revert not expiring sending subs"
This reverts commit 4310a69391.
* do not expire sending commands
* rename
* fix race
* function
---------
Co-authored-by: Alexander Bondarenko <486682+dpwiz@users.noreply.github.com>
* agent: mark work items failed (WIP)
* add tests, created_at
* getWorkItem for snd and rcv files
* fix
* tests
* fix
* tests
* test
* tests
* rename
* fix,refactor
* add indexes
* update schema
* do not try to get more work when resuming an existing worker
---------
Co-authored-by: spaced4ndy <8711996+spaced4ndy@users.noreply.github.com>
* Trace auto-subs flag
* Replace Bools with SubscriptionMode
* Handle SMOnlyCreate
* Wire remaining todos
* Update tests and fix
* Bump protocol level
* Apply suggestions from code review
Co-authored-by: Evgeny Poberezkin <2769109+epoberezkin@users.noreply.github.com>
* Scrub needs_sub from agent DB
* Scrub a few more needSubs from the agent api
* change API, fix test
* agent: do not subscribe to queue when creating reply queue
* fix encoding
* WIP: SMOnlyCreate test
* Add SM guard for confirmQueue
Allows the test case to pump the allowConnection
reply without getting PROHIBITED.
* Remove tracing
* add noMessages, remove unnecessary getConnectionMessage from test
* add sending messages to the test
---------
Co-authored-by: IC Rainbow <aenor.realm@gmail.com>
Co-authored-by: Alexander Bondarenko <486682+dpwiz@users.noreply.github.com>
* execute asynchronous commands for correct users
* pass transport session to message processing to avoid race condition
* account for server changes when determining unused servers
* enable one test
* enable all tests, remove log
* send "quota exceeded" message from SMP server when sender gets ERR QUOTA (ignored in the agent for now)
* send msg quota to the recipient to indicate that sender got ERR QUOTA, test
* switch between slow/fast retry intervals (tests do not pass yet)
* send QCONT message, refactor RetryInterval, test
* refactor
* remove comment
* remove space
* unit test for withRetryLock2
* refactor
* SMP v3: encrypt message timestamp and flags together with the body between server and recipient
* v3 tests
* update protocol doc
* add test for max size message
* delay in notifications test
* simplify v3
* encrypt server message to the recipient when sent
* refactor
* exit on error restoring the messages
* refactor, increase test timeout
* style
* add prints to the test
* remove error from unsafeMaxLenBS
* update protocol
* lint, improve test, change func param
