WIP: Auto-TLS support for py-libp2p #1072
Conversation
examples/autotls/autotls.py
Outdated
| public_addrs = [f"/ip4/13.126.88.127/tcp/{port}/p2p/{host.get_id()}"] | ||
|
|
||
| server_id, bearer = http_peer_id_auth(host.get_private_key(), key_auth, public_addrs) |
There was a problem hiding this comment.
Auto-TLS will only work with public-routable multiaddrs, so here this ip 13.126.88.127 is from an aws-ec2 instance that I was using for testing this PR.
|
So presently the auto-tls code is running correctly upto fetching the DNS-01 challenge from the ACME servers, and completing the peer-id authentication with AUTO-TLS broker 
As seen in the last lines of these logs the inbound connection is failing. 
as seen from this particular packet-log: The inbound connection, was negotiation for |
@lla-dane : Hi Abhinav. Fantastic progress on autotls module. Thank you so much for sharing the details. Appreciate it. Wish to ask if you found the fix in trio.py. Please also resolve the ci/cd issues whenever you get a chance. |
- Enhanced get_remote_address() in TrioTCPStream with address caching and defensive checks to handle socket state transitions gracefully - Fixed Ed25519PublicKey initialization to use from_bytes() method - Added proper type annotation for server_id: ID | None - Added None check for hostname before passing to ClientInitiatedHandshake - Removed unused variables (commented with explanations for future use) - Removed dead code (unused function calls with hardcoded port) - Removed debug print statements in favor of proper logging - Fixed code formatting, import ordering, and line length violations This resolves the get_remote_address() exception that was occurring when the Auto-TLS broker dials back into the node. Fixes issue reported in PR libp2p#1072 comments.
Fixes for Auto-TLS PR #1072This commit addresses the 🔧 Main Fix: Enhanced
|
Add examples.autotls to the examples.rst toctree to resolve the documentation build warning about the document not being included in any toctree.
Add the auto-generated examples.autotls.rst file to the repository so that ReadTheDocs can find it when building the documentation. This file is generated by sphinx-apidoc and is referenced in the examples.rst toctree.
| async def negotiate( | ||
| self, | ||
| communicator: IMultiselectCommunicator, | ||
| negotiate_timeout: int = DEFAULT_NEGOTIATE_TIMEOUT, | ||
| ) -> tuple[TProtocol | None, StreamHandlerFn | None]: | ||
| """ | ||
| Negotiate performs protocol selection. | ||
| :param stream: stream to negotiate on | ||
| :param negotiate_timeout: timeout for negotiation | ||
| :return: selected protocol name, handler function | ||
| :raise MultiselectError: raised when negotiation failed | ||
| """ | ||
| try: | ||
| with trio.fail_after(negotiate_timeout): | ||
| await self.handshake(communicator) | ||
|
|
||
| while True: | ||
| try: | ||
| print("\nNEGOTIATE LOOP") | ||
| command = await communicator.read() | ||
| print("COMMAND: ", command) | ||
| except MultiselectCommunicatorError as error: | ||
| print("ERROR IN NEGOTIATE READ") | ||
| raise MultiselectError() from error | ||
|
|
||
| if command == "ls": | ||
| supported_protocols = [ | ||
| p for p in self.handlers.keys() if p is not None | ||
| ] | ||
| response = "\n".join(supported_protocols) + "\n" | ||
|
|
||
| try: | ||
| await communicator.write(response) | ||
| except MultiselectCommunicatorError as error: | ||
| raise MultiselectError() from error | ||
|
|
||
| else: | ||
| protocol_to_check = None if not command else TProtocol(command) | ||
| if protocol_to_check in self.handlers: | ||
| try: | ||
| await communicator.write(command) | ||
| except MultiselectCommunicatorError as error: | ||
| raise MultiselectError() from error | ||
|
|
||
| return protocol_to_check, self.handlers[protocol_to_check] | ||
| try: | ||
| await communicator.write(PROTOCOL_NOT_FOUND_MSG) | ||
| print("PROTOCOL NOT IN HANDLERS: ", command) | ||
|
|
||
| except MultiselectCommunicatorError as error: | ||
| print("ERROR IN NEGOTIATE WRITE") | ||
| raise MultiselectError() from error | ||
|
|
||
| raise MultiselectError("Negotiation failed: no matching protocol") |
There was a problem hiding this comment.
Debugged further and found an issue happening here:
These are the logs:
as we see the broker wrote tls/1.0.0 and we wrote back na as we did not had the handler for tls, so now after this, the loop should have continued, and the broker should try for another security option, but rather we got a read error.
There was a problem hiding this comment.
But this does not happen, when I dialed back to our python node, from a go-libp2p node.
Here the negotiation continued after this log
NEGOTIATE LOOP
COMMAND: /tls/1.0.0
PROTOCOL NOT IN HANDLERS: /tls/1.0.0
but the same thing does happen when the auto-tls broker dials in. I dont understand why this happens.
There was a problem hiding this comment.
@lla-dane I can't see the full images, can you please include the logs. with full commands, and output in text .
And a clear explanation to how to do the test and what you expect.
I'm confused sometimes I see echo and ping why ?
thanks
|
Yeah sure @acul71, I will explain everything properly. So in the autotls procedure, the autotls-broker has to dial in our node (which has to bee publicly accesible) and run identify protocol on our node, too see that our node is real or not. So presently when the autotls-broker is dialing in our node, there is some issue happening in the multiselect-stream protocol negotiation. LOGS: These are the first logs. There are basically to run the autotls-demo script. Here we got dialed in here in this part |
|
Since the p2p-forge autotls-broker repo: https://github.com/ipshipyard/p2p-forge, uses go-libp2p, I dialed in our node from a go-libp2p node to see what happens during the multistream-select protocol neogtiation. DIALER: LISTENER: for just debugging purpose, I dialed to our py-libp2p node from the echo example of go-libp2p. I just needed to see how the multistream-select protocol negotiation goes. |
|
@acul71: For testing, I have DM'd you the ec2 instance keys and how to connect to the instance on discord. There you can simply run the |
3 participants
Aims to resolve #555
Auto-TLS support for py-libp2p in reference with the auto-tls client spec.
References:
https://github.com/libp2p/specs/blob/master/tls/autotls-client.md
https://github.com/libp2p/specs/blob/master/http/peer-id-auth.md
https://blog.libp2p.io/autotls/