configurable pubsub singing

I'd like to sneak this into the release so we can turn on strict verification ASAP. License: MIT Signed-off-by: Steven Allen <steven@stebalien.com>
ipfs · Oct 25, 2018 · 95935fb · 95935fb
1 parent 7ecd675
commit 95935fb
Show file tree

Hide file tree

Showing 4 changed files with 134 additions and 65 deletions.
diff --git a/core/core.go b/core/core.go
@@ -35,10 +35,10 @@ import (
 	bsnet "gx/ipfs/QmNkxFCmPtr2RQxjZNRCNryLud4L9wMEiBJsLgF14MqTHj/go-bitswap/network"
 	cid "gx/ipfs/QmPSQnBKM9g7BaUcZCvswUJVscQ1ipjmwxN5PXCjkp9EQ7/go-cid"
 	u "gx/ipfs/QmPdKqUcHGFdeSpvjVoaTRPPstGif9GBZb5Q56RVw9o69A/go-ipfs-util"
-	psrouter "gx/ipfs/QmPgUM9uSnDuM8MAF56htHLMLn33KuUqT82PBsF13qyJNk/go-libp2p-pubsub-router"
 	ic "gx/ipfs/QmPvyPwuCgJ7pDmrKDxRtsScJgBaM5h4EpRL2qQJsmXf4n/go-libp2p-crypto"
 	dht "gx/ipfs/QmQHnqaNULV8WeUGgh97o9K3KAW6kWQmDyNf9UuikgnPTe/go-libp2p-kad-dht"
 	dhtopts "gx/ipfs/QmQHnqaNULV8WeUGgh97o9K3KAW6kWQmDyNf9UuikgnPTe/go-libp2p-kad-dht/opts"
+	psrouter "gx/ipfs/QmQzS2rX2um81ChScDCLakw8U7L4obH1tjSeByZxWmDesf/go-libp2p-pubsub-router"
 	exchange "gx/ipfs/QmR1nncPsZR14A4hWr39mq8Lm7BGgS68bHVT9nop8NpWEM/go-ipfs-exchange-interface"
 	"gx/ipfs/QmRKuTyCzg7HFBcV1YUhzStroGtJSb8iWgyxfsDCwFhWTS/go-path/resolver"
 	goprocess "gx/ipfs/QmSF8fPo3jgVBAy8fpdjjYqgG87dkJgUprRBHRd2tmfgpP/goprocess"
@@ -54,6 +54,7 @@ import (
 	rhost "gx/ipfs/QmUDTcnDp2WssbmiDLC6aYurUeyt7QeRakHUQMxA2mZ5iB/go-libp2p/p2p/host/routed"
 	identify "gx/ipfs/QmUDTcnDp2WssbmiDLC6aYurUeyt7QeRakHUQMxA2mZ5iB/go-libp2p/p2p/protocol/identify"
 	ping "gx/ipfs/QmUDTcnDp2WssbmiDLC6aYurUeyt7QeRakHUQMxA2mZ5iB/go-libp2p/p2p/protocol/ping"
+	pubsub "gx/ipfs/QmUH39qXjpgtfETLVYPQyxE4L6NXHeLtGaPYmvw3SZExZ4/go-libp2p-pubsub"
 	quic "gx/ipfs/QmVX7uSFmFLZRFsN9QNPDJf7Pmhuv4GdedrKYrt2xXm5ag/go-libp2p-quic-transport"
 	circuit "gx/ipfs/QmVYDvJjiKb9iFEyHxx4i1TJSRBLkQhGb5Fc8XpmDuNCEA/go-libp2p-circuit"
 	ifconnmgr "gx/ipfs/QmWRvjn5BHMLCGkf48Hk1LDc4W72RPA9H59AAVCXmn9esJ/go-libp2p-interface-connmgr"
@@ -63,7 +64,6 @@ import (
 	merkledag "gx/ipfs/QmY8BMUSpCwNiTmFhACmC9Bt1qT63cHP35AoQAus4x14qH/go-merkledag"
 	smux "gx/ipfs/QmY9JXR3FupnYAYJWK9aMr9bCpqWKcToQ1tz8DVGTrHpHw/go-stream-muxer"
 	logging "gx/ipfs/QmZChCsSt8DctjceaL56Eibc29CVQq4dGKRXC5JRZ6Ppae/go-log"
-	pubsub "gx/ipfs/QmZuwf2M6vSPpHh9KWp59HFq3kAibka77hAbKhxeb7uW3T/go-libp2p-pubsub"
 	record "gx/ipfs/Qma9Eqp16mNHDX1EL73pcxhFfzbyXVcAYtaDd1xdmDRDtL/go-libp2p-record"
 	ds "gx/ipfs/QmaRb5yNXKonhbkpNxNawoydk4N6es6b4fPj19sjEKsh5D/go-datastore"
 	mplex "gx/ipfs/QmaveCPGVaKJU57tBErGCDjzLaqEMZkFygoiv4BhYwWUGc/go-smux-multiplex"
@@ -475,14 +475,23 @@ func (n *IpfsNode) startOnlineServicesWithHost(ctx context.Context, host p2phost
 
 		var service *pubsub.PubSub
 
+		var pubsubOptions []pubsub.Option
+		if cfg.Pubsub.DisableSigning {
+			pubsubOptions = append(pubsubOptions, pubsub.WithMessageSigning(false))
+		}
+
+		if cfg.Pubsub.StrictSignatureVerification {
+			pubsubOptions = append(pubsubOptions, pubsub.WithStrictSignatureVerification(true))
+		}
+
 		switch cfg.Pubsub.Router {
 		case "":
 			fallthrough
 		case "floodsub":
-			service, err = pubsub.NewFloodSub(ctx, host)
+			service, err = pubsub.NewFloodSub(ctx, host, pubsubOptions...)
 
 		case "gossipsub":
-			service, err = pubsub.NewGossipSub(ctx, host)
+			service, err = pubsub.NewGossipSub(ctx, host, pubsubOptions...)
 
 		default:
 			err = fmt.Errorf("Unknown pubsub router %s", cfg.Pubsub.Router)

diff --git a/core/coreapi/pubsub.go b/core/coreapi/pubsub.go
@@ -14,7 +14,7 @@ import (
 	cid "gx/ipfs/QmPSQnBKM9g7BaUcZCvswUJVscQ1ipjmwxN5PXCjkp9EQ7/go-cid"
 	peer "gx/ipfs/QmTRhk7cgjUf2gfQ3p2M9KPECNZEW9XUrmHcFCgog4cPgB/go-libp2p-peer"
 	pstore "gx/ipfs/QmTTJcDL3gsnGDALjh2fDGg1onGRUdVgNL2hU2WEZcVrMX/go-libp2p-peerstore"
-	pubsub "gx/ipfs/QmZuwf2M6vSPpHh9KWp59HFq3kAibka77hAbKhxeb7uW3T/go-libp2p-pubsub"
+	pubsub "gx/ipfs/QmUH39qXjpgtfETLVYPQyxE4L6NXHeLtGaPYmvw3SZExZ4/go-libp2p-pubsub"
 )
 
 type PubSubAPI CoreAPI

diff --git a/package.json b/package.json
@@ -458,9 +458,9 @@
     },
     {
       "author": "stebalien",
-      "hash": "QmPgUM9uSnDuM8MAF56htHLMLn33KuUqT82PBsF13qyJNk",
+      "hash": "QmQzS2rX2um81ChScDCLakw8U7L4obH1tjSeByZxWmDesf",
       "name": "go-libp2p-pubsub-router",
-      "version": "0.4.14"
+      "version": "0.5.0"
     },
     {
       "author": "Stebalien",
@@ -583,9 +583,9 @@
     },
     {
       "author": "whyrusleeping",
-      "hash": "QmZuwf2M6vSPpHh9KWp59HFq3kAibka77hAbKhxeb7uW3T",
+      "hash": "QmUH39qXjpgtfETLVYPQyxE4L6NXHeLtGaPYmvw3SZExZ4",
       "name": "go-libp2p-pubsub",
-      "version": "0.10.2"
+      "version": "0.11.0"
     }
   ],
   "gxVersion": "0.10.0",

diff --git a/test/sharness/t0180-pubsub.sh b/test/sharness/t0180-pubsub.sh
@@ -10,83 +10,143 @@ test_expect_success 'init iptb' '
   iptb init -n $NUM_NODES --bootstrap=none --port=0
 '
 
-startup_cluster $NUM_NODES --enable-pubsub-experiment
+run_pubsub_tests() {
+  test_expect_success 'peer ids' '
+    PEERID_0=$(iptb get id 0) &&
+    PEERID_2=$(iptb get id 2)
+  '
+
+  # ipfs pubsub sub
+  test_expect_success 'pubsub' '
+    echo "testOK" > expected &&
+    touch empty &&
+    mkfifo wait ||
+    test_fsh echo init fail
+  
+    # ipfs pubsub sub is long-running so we need to start it in the background and
+    # wait put its output somewhere where we can access it
+    (
+      ipfsi 0 pubsub sub --enc=ndpayload testTopic | if read line; then
+          echo $line > actual &&
+          echo > wait
+        fi
+    ) &
+  '
+
+  test_expect_success "wait until ipfs pubsub sub is ready to do work" '
+    go-sleep 500ms
+  '
+
+  test_expect_success "can see peer subscribed to testTopic" '
+    ipfsi 1 pubsub peers testTopic > peers_out
+  '
+
+  test_expect_success "output looks good" '
+    echo $PEERID_0 > peers_exp &&
+    test_cmp peers_exp peers_out
+  '
+
+  test_expect_success "publish something" '
+    ipfsi 1 pubsub pub testTopic "testOK" &> pubErr
+  '
+
+  test_expect_success "wait until echo > wait executed" '
+    cat wait &&
+    test_cmp pubErr empty &&
+    test_cmp expected actual
+  '
+
+  test_expect_success "wait for another pubsub message" '
+    echo "testOK2" > expected &&
+    mkfifo wait2 ||
+    test_fsh echo init fail
+  
+    # ipfs pubsub sub is long-running so we need to start it in the background and
+    # wait put its output somewhere where we can access it
+    (
+      ipfsi 2 pubsub sub --enc=ndpayload testTopic | if read line; then
+          echo $line > actual &&
+          echo > wait2
+        fi
+    ) &
+  '
+
+  test_expect_success "wait until ipfs pubsub sub is ready to do work" '
+    go-sleep 500ms
+  '
+
+  test_expect_success "publish something" '
+    echo "testOK2" | ipfsi 3 pubsub pub testTopic &> pubErr
+  '
+
+  test_expect_success "wait until echo > wait executed" '
+    echo "testOK2" > expected &&
+    cat wait2 &&
+    test_cmp pubErr empty &&
+    test_cmp expected actual
+  '
+
+  test_expect_success 'cleanup fifos' '
+    rm -f wait wait2
+  '
+
+}
+
+# Normal tests
 
-test_expect_success 'peer ids' '
-  PEERID_0=$(iptb get id 0) &&
-  PEERID_2=$(iptb get id 2)
+startup_cluster $NUM_NODES --enable-pubsub-experiment
+run_pubsub_tests
+test_expect_success 'stop iptb' '
+  iptb stop
 '
 
-# ipfs pubsub sub
-test_expect_success 'pubsub' '
-  echo "testOK" > expected &&
-  touch empty &&
-  mkfifo wait ||
-  test_fsh echo init fail
-
-  # ipfs pubsub sub is long-running so we need to start it in the background and
-  # wait put its output somewhere where we can access it
-  (
-    ipfsi 0 pubsub sub --enc=ndpayload testTopic | if read line; then
-        echo $line > actual &&
-        echo > wait
-      fi
-  ) &
-'
+# Test with some nodes not signing messages.
 
-test_expect_success "wait until ipfs pubsub sub is ready to do work" '
-  go-sleep 500ms
+test_expect_success 'disable signing on node 1' '
+  ipfsi 1 config --json Pubsub.DisableSigning true
 '
 
-test_expect_success "can see peer subscribed to testTopic" '
-  ipfsi 1 pubsub peers testTopic > peers_out
+startup_cluster $NUM_NODES --enable-pubsub-experiment
+run_pubsub_tests
+test_expect_success 'stop iptb' '
+  iptb stop
 '
 
-test_expect_success "output looks good" '
-  echo $PEERID_0 > peers_exp &&
-  test_cmp peers_exp peers_out
-'
+# Test strict message verification.
 
-test_expect_success "publish something" '
-  ipfsi 1 pubsub pub testTopic "testOK" &> pubErr
+test_expect_success 'enable strict signature verification on node 4' '
+  ipfsi 4 config --json Pubsub.StrictSignatureVerification true
 '
 
-test_expect_success "wait until echo > wait executed" '
-  cat wait &&
-  test_cmp pubErr empty &&
-  test_cmp expected actual
+startup_cluster $NUM_NODES --enable-pubsub-experiment
+
+test_expect_success 'set node 4 to listen on testTopic' '
+  ipfsi 4 pubsub sub --enc=ndpayload testTopic > node4_actual &
 '
 
-test_expect_success "wait for another pubsub message" '
-  echo "testOK2" > expected &&
-  mkfifo wait2 ||
-  test_fsh echo init fail
-
-  # ipfs pubsub sub is long-running so we need to start it in the background and
-  # wait put its output somewhere where we can access it
-  (
-    ipfsi 2 pubsub sub --enc=ndpayload testTopic | if read line; then
-        echo $line > actual &&
-        echo > wait2
-      fi
-  ) &
+run_pubsub_tests
+
+test_expect_success 'stop iptb' '
+  iptb stop
 '
 
-test_expect_success "wait until ipfs pubsub sub is ready to do work" '
-  go-sleep 500ms
+test_expect_success 'node 4 only got the signed message' '
+  echo "testOK2" > node4_expected &&
+  test_cmp node4_actual node4_expected
 '
 
-test_expect_success "publish something" '
-  echo "testOK2" | ipfsi 1 pubsub pub testTopic &> pubErr
+# Test all nodes signing with strict verification
+
+test_expect_success 're-enable signing on node 1' '
+  ipfsi 1 config --json Pubsub.DisableSigning false
 '
 
-test_expect_success "wait until echo > wait executed" '
-  echo "testOK2" > expected &&
-  cat wait2 &&
-  test_cmp pubErr empty &&
-  test_cmp expected actual
+test_expect_success 'enable strict signature verification on all nodes' '
+  iptb for-each ipfs config --json Pubsub.StrictSignatureVerification true
 '
 
+startup_cluster $NUM_NODES --enable-pubsub-experiment
+run_pubsub_tests
 test_expect_success 'stop iptb' '
   iptb stop
 '