fix(autotls): renewal and AutoTLS.ShortAddrs (#10669)
* fix(autotls): renewal and AutoTLS.ShortAddrs updates to p2p-forge/client with fix from https://github.com/ipshipyard/p2p-forge/pull/42 we also add AutoTLS.ShortAddrs flag and enable it by default to benefit from shorter addrs discusses in https://github.com/ipshipyard/p2p-forge/pull/40 * test: fix flaky NewRandPort reducing chance of bind: address already in use (cherry picked from commit 256a739e3b0e24ae6f3b89ccc47de3bb4df04c3d)
Marcin Rataj committed
Jan 22, 2025 at 17:26 UTC
00cb38865ff1190c0b8b74221b5622984015a4c1
11 files changed
+39
-13
config/autotls.go
+4
@@ -23,6 +23,9 @@ type AutoTLS struct {
23
24
// Optional override of CA ACME API used by p2p-forge system
25
CAEndpoint *OptionalString `json:",omitempty"`
26
+
27
+ // Optional, controls if features like AutoWSS should generate shorter /dnsX instead of /ipX/../sni/..
28
+ ShortAddrs Flag `json:",omitempty"`
29
}
30
31
const (
@@ -31,4 +34,5 @@ const (
34
DefaultRegistrationEndpoint = p2pforge.DefaultForgeEndpoint
35
DefaultCAEndpoint = p2pforge.DefaultCAEndpoint
36
DefaultAutoWSS = true // requires AutoTLS.Enabled
37
+ DefaultAutoTLSShortAddrs = true // requires AutoTLS.Enabled
38
)
core/node/libp2p/addrs.go
+5
-3
@@ -136,11 +136,12 @@ func ListenOn(addresses []string) interface{} {
136
func P2PForgeCertMgr(repoPath string, cfg config.AutoTLS, atlsLog *logging.ZapEventLogger) interface{} {
137
return func() (*p2pforge.P2PForgeCertMgr, error) {
138
storagePath := filepath.Join(repoPath, "p2p-forge-certs")
139
+ rawLogger := atlsLog.Desugar()
140
140
- // TODO: this should not be necessary, but we do it to help tracking
141
- // down any race conditions causing
141
+ // TODO: this should not be necessary after
142
+ // https://github.com/ipshipyard/p2p-forge/pull/42 but keep it here for
143
+ // now to help tracking down any remaining conditions causing
144
// https://github.com/ipshipyard/p2p-forge/issues/8
143
- rawLogger := atlsLog.Desugar()
145
certmagic.Default.Logger = rawLogger.Named("default_fixme")
146
certmagic.DefaultACME.Logger = rawLogger.Named("default_acme_client_fixme")
147
@@ -153,6 +154,7 @@ func P2PForgeCertMgr(repoPath string, cfg config.AutoTLS, atlsLog *logging.ZapEv
154
p2pforge.WithForgeAuth(cfg.RegistrationToken.WithDefault(os.Getenv(p2pforge.ForgeAuthEnv))),
155
p2pforge.WithUserAgent(version.GetUserAgentVersion()),
156
p2pforge.WithCertificateStorage(certStorage),
157
+ p2pforge.WithShortForgeAddrs(cfg.ShortAddrs.WithDefault(config.DefaultAutoTLSShortAddrs)),
158
)
159
if err != nil {
160
return nil, err
docs/changelogs/v0.33.md
+1
-1
@@ -104,7 +104,7 @@ We have fixed a number of issues that were triggered by writing or copying many
104
- update `boxo` to [v0.27.0](https://github.com/ipfs/boxo/releases/tag/v0.27.0) (incl. [v0.25.0](https://github.com/ipfs/boxo/releases/tag/v0.25.0) + [v0.26.0](https://github.com/ipfs/boxo/releases/tag/v0.26.0) )
105
- update `go-libp2p` to [v0.38.2](https://github.com/libp2p/go-libp2p/releases/tag/v0.38.2) (incl. [v0.37.1](https://github.com/libp2p/go-libp2p/releases/tag/v0.37.1) + [v0.37.2](https://github.com/libp2p/go-libp2p/releases/tag/v0.37.2) + [v0.38.0](https://github.com/libp2p/go-libp2p/releases/tag/v0.38.0) + [v0.38.1](https://github.com/libp2p/go-libp2p/releases/tag/v0.38.1))
106
- update `go-libp2p-kad-dht` to [v0.28.2](https://github.com/libp2p/go-libp2p-kad-dht/releases/tag/v0.28.2)
107
-- update `p2p-forge/client` to [v0.2.2](https://github.com/ipshipyard/p2p-forge/releases/tag/v0.2.2) (incl. [v0.1.0](https://github.com/ipshipyard/p2p-forge/releases/tag/v0.1.0), [v0.2.0](https://github.com/ipshipyard/p2p-forge/releases/tag/v0.2.0), [v0.2.1](https://github.com/ipshipyard/p2p-forge/releases/tag/v0.2.1))
107
+- update `p2p-forge/client` to [v0.3.0](https://github.com/ipshipyard/p2p-forge/releases/tag/v0.3.0) (incl. [v0.1.0](https://github.com/ipshipyard/p2p-forge/releases/tag/v0.1.0), [v0.2.0](https://github.com/ipshipyard/p2p-forge/releases/tag/v0.2.0), [v0.2.1](https://github.com/ipshipyard/p2p-forge/releases/tag/v0.2.1), [v0.2.2](https://github.com/ipshipyard/p2p-forge/releases/tag/v0.2.2))
108
- update `ipfs-webui` to [v4.4.2](https://github.com/ipfs/ipfs-webui/releases/tag/v4.4.2) (incl. [v4.4.1](https://github.com/ipfs/ipfs-webui/releases/tag/v4.4.1))
109
110
#### Escape Redirect URL for Directory
docs/config.md
+12
@@ -30,6 +30,7 @@ config file at runtime.
30
- [`AutoTLS`](#autotls)
31
- [`AutoTLS.Enabled`](#autotlsenabled)
32
- [`AutoTLS.AutoWSS`](#autotlsautowss)
33
+ - [`AutoTLS.ShortAddrs`](#autotlsshortaddrs)
34
- [`AutoTLS.DomainSuffix`](#autotlsdomainsuffix)
35
- [`AutoTLS.RegistrationEndpoint`](#autotlsregistrationendpoint)
36
- [`AutoTLS.RegistrationToken`](#autotlsregistrationtoken)
@@ -530,6 +531,17 @@ Default: `true` (active only if `AutoTLS.Enabled` is `true` as well)
531
532
Type: `flag`
533
534
+### `AutoTLS.ShortAddrs`
535
+
536
+Optional. Controls if final AutoTLS listeners are announced under shorter `/dnsX/A.B.C.D.peerid.libp2p.direct/tcp/4001/tls/ws` addresses instead of fully resolved `/ip4/A.B.C.D/tcp/4001/tls/sni/A-B-C-D.peerid.libp2p.direct/tls/ws`.
537
+
538
+> [!TIP]
539
+> The main use for AutoTLS is allowing connectivity from Secure Context in a web browser, and DNS lookup needs to happen there anyway, making `/dnsX` a more compact, more interoperable option without obvious downside.
540
+
541
+Default: `true`
542
+
543
+Type: `flag`
544
+
545
### `AutoTLS.DomainSuffix`
546
547
Optional override of the parent domain suffix that will be used in DNS+TLS+WebSockets multiaddrs generated by [p2p-forge] client.
docs/examples/kubo-as-a-library/go.mod
+1
-1
@@ -112,7 +112,7 @@ require (
112
github.com/ipld/go-car/v2 v2.14.2 // indirect
113
github.com/ipld/go-codec-dagpb v1.6.0 // indirect
114
github.com/ipld/go-ipld-prime v0.21.0 // indirect
115
- github.com/ipshipyard/p2p-forge v0.2.2 // indirect
115
+ github.com/ipshipyard/p2p-forge v0.3.0 // indirect
116
github.com/jackpal/go-nat-pmp v1.0.2 // indirect
117
github.com/jbenet/go-temp-err-catcher v0.1.0 // indirect
118
github.com/jbenet/goprocess v0.1.4 // indirect
docs/examples/kubo-as-a-library/go.sum
+2
-2
@@ -407,8 +407,8 @@ github.com/ipld/go-ipld-prime v0.21.0 h1:n4JmcpOlPDIxBcY037SVfpd1G+Sj1nKZah0m6QH
407
github.com/ipld/go-ipld-prime v0.21.0/go.mod h1:3RLqy//ERg/y5oShXXdx5YIp50cFGOanyMctpPjsvxQ=
408
github.com/ipld/go-ipld-prime/storage/bsadapter v0.0.0-20230102063945-1a409dc236dd h1:gMlw/MhNr2Wtp5RwGdsW23cs+yCuj9k2ON7i9MiJlRo=
409
github.com/ipld/go-ipld-prime/storage/bsadapter v0.0.0-20230102063945-1a409dc236dd/go.mod h1:wZ8hH8UxeryOs4kJEJaiui/s00hDSbE37OKsL47g+Sw=
410
-github.com/ipshipyard/p2p-forge v0.2.2 h1:S8NlZ++AMIiXpOPjRGXg6Ob3Bb1K8wuBxRm2f9eRQWE=
411
-github.com/ipshipyard/p2p-forge v0.2.2/go.mod h1:L0TJMzniMEDjX8G+RB201U2woHvASwbsujNVDNVivDo=
410
+github.com/ipshipyard/p2p-forge v0.3.0 h1:mdeFqiq8ljX149OCQvveV0vOlKeIt4PWkJjXVfux/GE=
411
+github.com/ipshipyard/p2p-forge v0.3.0/go.mod h1:L0TJMzniMEDjX8G+RB201U2woHvASwbsujNVDNVivDo=
412
github.com/jackpal/go-nat-pmp v1.0.2 h1:KzKSgb7qkJvOUTqYl9/Hg/me3pWgBmERKrTGD7BdWus=
413
github.com/jackpal/go-nat-pmp v1.0.2/go.mod h1:QPH045xvCAeXUZOxsnwmrtiCoxIr9eob+4orBN1SBKc=
414
github.com/jbenet/go-cienv v0.1.0/go.mod h1:TqNnHUmJgXau0nCzC7kXWeotg3J9W34CUv5Djy1+FlA=
go.mod
+1
-1
@@ -49,7 +49,7 @@ require (
49
github.com/ipld/go-car/v2 v2.14.2
50
github.com/ipld/go-codec-dagpb v1.6.0
51
github.com/ipld/go-ipld-prime v0.21.0
52
- github.com/ipshipyard/p2p-forge v0.2.2
52
+ github.com/ipshipyard/p2p-forge v0.3.0
53
github.com/jbenet/go-temp-err-catcher v0.1.0
54
github.com/jbenet/goprocess v0.1.4
55
github.com/julienschmidt/httprouter v1.3.0
go.sum
+2
-2
@@ -475,8 +475,8 @@ github.com/ipld/go-ipld-prime v0.21.0 h1:n4JmcpOlPDIxBcY037SVfpd1G+Sj1nKZah0m6QH
475
github.com/ipld/go-ipld-prime v0.21.0/go.mod h1:3RLqy//ERg/y5oShXXdx5YIp50cFGOanyMctpPjsvxQ=
476
github.com/ipld/go-ipld-prime/storage/bsadapter v0.0.0-20230102063945-1a409dc236dd h1:gMlw/MhNr2Wtp5RwGdsW23cs+yCuj9k2ON7i9MiJlRo=
477
github.com/ipld/go-ipld-prime/storage/bsadapter v0.0.0-20230102063945-1a409dc236dd/go.mod h1:wZ8hH8UxeryOs4kJEJaiui/s00hDSbE37OKsL47g+Sw=
478
-github.com/ipshipyard/p2p-forge v0.2.2 h1:S8NlZ++AMIiXpOPjRGXg6Ob3Bb1K8wuBxRm2f9eRQWE=
479
-github.com/ipshipyard/p2p-forge v0.2.2/go.mod h1:L0TJMzniMEDjX8G+RB201U2woHvASwbsujNVDNVivDo=
478
+github.com/ipshipyard/p2p-forge v0.3.0 h1:mdeFqiq8ljX149OCQvveV0vOlKeIt4PWkJjXVfux/GE=
479
+github.com/ipshipyard/p2p-forge v0.3.0/go.mod h1:L0TJMzniMEDjX8G+RB201U2woHvASwbsujNVDNVivDo=
480
github.com/jackpal/go-nat-pmp v1.0.2 h1:KzKSgb7qkJvOUTqYl9/Hg/me3pWgBmERKrTGD7BdWus=
481
github.com/jackpal/go-nat-pmp v1.0.2/go.mod h1:QPH045xvCAeXUZOxsnwmrtiCoxIr9eob+4orBN1SBKc=
482
github.com/jbenet/go-cienv v0.1.0 h1:Vc/s0QbQtoxX8MwwSLWWh+xNNZvM3Lw7NsTcHrvvhMc=
test/cli/harness/peering.go
+8
@@ -3,6 +3,7 @@ package harness
3
import (
4
"fmt"
5
"math/rand"
6
+ "net"
7
"testing"
8
9
"github.com/ipfs/kubo/config"
@@ -14,6 +15,13 @@ type Peering struct {
15
}
16
17
func NewRandPort() int {
18
+ if a, err := net.ResolveTCPAddr("tcp", "localhost:0"); err == nil {
19
+ var l *net.TCPListener
20
+ if l, err = net.ListenTCP("tcp", a); err == nil {
21
+ defer l.Close()
22
+ return l.Addr().(*net.TCPAddr).Port
23
+ }
24
+ }
25
n := rand.Int()
26
return 3000 + (n % 1000)
27
}
test/dependencies/go.mod
+1
-1
@@ -131,7 +131,7 @@ require (
131
github.com/ipfs/kubo v0.31.0 // indirect
132
github.com/ipld/go-codec-dagpb v1.6.0 // indirect
133
github.com/ipld/go-ipld-prime v0.21.0 // indirect
134
- github.com/ipshipyard/p2p-forge v0.2.2 // indirect
134
+ github.com/ipshipyard/p2p-forge v0.3.0 // indirect
135
github.com/jackpal/go-nat-pmp v1.0.2 // indirect
136
github.com/jbenet/go-temp-err-catcher v0.1.0 // indirect
137
github.com/jbenet/goprocess v0.1.4 // indirect
test/dependencies/go.sum
+2
-2
@@ -364,8 +364,8 @@ github.com/ipld/go-codec-dagpb v1.6.0 h1:9nYazfyu9B1p3NAgfVdpRco3Fs2nFC72DqVsMj6
364
github.com/ipld/go-codec-dagpb v1.6.0/go.mod h1:ANzFhfP2uMJxRBr8CE+WQWs5UsNa0pYtmKZ+agnUw9s=
365
github.com/ipld/go-ipld-prime v0.21.0 h1:n4JmcpOlPDIxBcY037SVfpd1G+Sj1nKZah0m6QH9C2E=
366
github.com/ipld/go-ipld-prime v0.21.0/go.mod h1:3RLqy//ERg/y5oShXXdx5YIp50cFGOanyMctpPjsvxQ=
367
-github.com/ipshipyard/p2p-forge v0.2.2 h1:S8NlZ++AMIiXpOPjRGXg6Ob3Bb1K8wuBxRm2f9eRQWE=
368
-github.com/ipshipyard/p2p-forge v0.2.2/go.mod h1:L0TJMzniMEDjX8G+RB201U2woHvASwbsujNVDNVivDo=
367
+github.com/ipshipyard/p2p-forge v0.3.0 h1:mdeFqiq8ljX149OCQvveV0vOlKeIt4PWkJjXVfux/GE=
368
+github.com/ipshipyard/p2p-forge v0.3.0/go.mod h1:L0TJMzniMEDjX8G+RB201U2woHvASwbsujNVDNVivDo=
369
github.com/jackpal/go-nat-pmp v1.0.2 h1:KzKSgb7qkJvOUTqYl9/Hg/me3pWgBmERKrTGD7BdWus=
370
github.com/jackpal/go-nat-pmp v1.0.2/go.mod h1:QPH045xvCAeXUZOxsnwmrtiCoxIr9eob+4orBN1SBKc=
371
github.com/jbenet/go-cienv v0.1.0/go.mod h1:TqNnHUmJgXau0nCzC7kXWeotg3J9W34CUv5Djy1+FlA=