Merge branch 'master' into anton/webrtc-transport

client/cli/src/params/network_params.rs

@@ -21,11 +21,10 @@ use crate::{
 	params::{node_key_params::NodeKeyParams, webrtc_certificate_params::WebRTCCertificateParams},
 };
 use clap::Args;
-use sc_network::{
-	config::{NetworkConfiguration, NodeKeyConfig, WebRTCConfig},
-	multiaddr::Protocol,
+use sc_network::{config::NetworkConfiguration, multiaddr::Protocol};
+use sc_network_common::config::{
+	NodeKeyConfig, NonReservedPeerMode, SetConfig, TransportConfig, WebRTCConfig,
 };
-use sc_network_common::config::{NonReservedPeerMode, SetConfig, TransportConfig};
 use sc_service::{
 	config::{Multiaddr, MultiaddrWithPeerId},
 	ChainSpec, ChainType,

client/network/common/Cargo.toml

@@ -28,6 +28,7 @@ futures-timer = "3.0.2"
 libp2p = { version = "0.50.0", features = ["request-response", "kad"] }
 linked_hash_set = "0.1.3"
 prometheus-endpoint = { package = "substrate-prometheus-endpoint", version = "0.10.0-dev", path = "../../../utils/prometheus" }
+rand = "0.8.5"
 smallvec = "1.8.0"
 sc-consensus = { version = "0.10.0-dev", path = "../../consensus/common" }
 sc-peerset = { version = "4.0.0-dev", path = "../../peerset" }

client/network/common/src/config.rs

@@ -31,7 +31,9 @@ pub use libp2p::{build_multiaddr, core::PublicKey, identity};
 use codec::Encode;
 use libp2p::{
 	identity::{ed25519, Keypair},
-	multiaddr, Multiaddr, PeerId,
+	multiaddr,
+	webrtc::tokio::certificate::Certificate as WebRTCCertificate,
+	Multiaddr, PeerId,
 };
 use zeroize::Zeroize;
 
@@ -401,6 +403,8 @@ pub struct NetworkConfiguration {
 	pub boot_nodes: Vec<MultiaddrWithPeerId>,
 	/// The node key configuration, which determines the node's network identity keypair.
 	pub node_key: NodeKeyConfig,
+	/// The WebRTC configuration, which determines the node's WebRTC network identity.
+	pub webrtc: WebRTCConfig,
 	/// List of request-response protocols that the node supports.
 	pub request_response_protocols: Vec<RequestResponseConfig>,
 	/// Configuration for the default set of nodes used for block syncing and transactions.
@@ -465,6 +469,7 @@ impl NetworkConfiguration {
 		node_name: SN,
 		client_version: SV,
 		node_key: NodeKeyConfig,
+		webrtc: WebRTCConfig,
 		net_config_path: Option<PathBuf>,
 	) -> Self {
 		let default_peers_set = SetConfig::default();
@@ -474,6 +479,7 @@ impl NetworkConfiguration {
 			public_addresses: Vec::new(),
 			boot_nodes: Vec::new(),
 			node_key,
+			webrtc,
 			request_response_protocols: Vec::new(),
 			default_peers_set_num_full: default_peers_set.in_peers + default_peers_set.out_peers,
 			default_peers_set,
@@ -494,8 +500,13 @@ impl NetworkConfiguration {
 	/// Create new default configuration for localhost-only connection with random port (useful for
 	/// testing)
 	pub fn new_local() -> NetworkConfiguration {
-		let mut config =
-			NetworkConfiguration::new("test-node", "test-client", Default::default(), None);
+		let mut config = NetworkConfiguration::new(
+			"test-node",
+			"test-client",
+			Default::default(),
+			WebRTCConfig::Ephemeral,
+			None,
+		);
 
 		config.listen_addresses =
 			vec![iter::once(multiaddr::Protocol::Ip4(Ipv4Addr::new(127, 0, 0, 1)))
@@ -509,8 +520,13 @@ impl NetworkConfiguration {
 	/// Create new default configuration for localhost-only connection with random port (useful for
 	/// testing)
 	pub fn new_memory() -> NetworkConfiguration {
-		let mut config =
-			NetworkConfiguration::new("test-node", "test-client", Default::default(), None);
+		let mut config = NetworkConfiguration::new(
+			"test-node",
+			"test-client",
+			Default::default(),
+			WebRTCConfig::Ephemeral,
+			None,
+		);
 
 		config.listen_addresses =
 			vec![iter::once(multiaddr::Protocol::Ip4(Ipv4Addr::new(127, 0, 0, 1)))
@@ -537,6 +553,66 @@ impl Default for NodeKeyConfig {
 	}
 }
 
+/// The configuration of a node's WebRTC certificate, describing how it is obtained.
+#[derive(Clone, Debug)]
+pub enum WebRTCConfig {
+	/// Certificate stored on disk.
+	/// A new certificate is randomly generated and written there if the file doesn't exist.
+	File(PathBuf),
+
+	/// A new certifiticate is randomly generated each time you start the node.
+	Ephemeral,
+}
+
+impl WebRTCConfig {
+	/// Evaluate a `WebRTCConfig` to obtain a [`WebRTCCertificate`]:
+	///
+	///  * If the certificate is configured as a file, it is read from that file, if it exists.
+	///    Otherwise a new certificate is generated and stored.
+	///  * If the certificate is configured as ephemeral, it is generated.
+	pub fn into_certificate(self) -> io::Result<WebRTCCertificate> {
+		use rand::thread_rng;
+		use std::os::unix::fs::OpenOptionsExt;
+
+		fn generate() -> io::Result<WebRTCCertificate> {
+			WebRTCCertificate::generate(&mut thread_rng())
+				.map_err(|e| io::Error::new(io::ErrorKind::Other, e.to_string()))
+		}
+
+		use WebRTCConfig::*;
+		match self {
+			File(filepath) => {
+				let f = std::fs::read(&filepath).or_else(|e| {
+					if e.kind() == io::ErrorKind::NotFound {
+						<PathBuf as AsRef<Path>>::as_ref(&filepath)
+							.parent()
+							.map_or(Ok(()), fs::create_dir_all)?;
+
+						let cert = generate()?;
+						let bytes = cert.serialize_pem().into_bytes();
+
+						let mut new_file = fs::OpenOptions::new()
+							.write(true)
+							.create_new(true)
+							.mode(0o600)
+							.open(filepath)?;
+						new_file.write_all(&bytes)?;
+
+						Ok(bytes)
+					} else {
+						Err(e)
+					}
+				})?;
+				let pem = String::from_utf8(f)
+					.map_err(|e| io::Error::new(io::ErrorKind::Other, e.to_string()))?;
+				WebRTCCertificate::from_pem(&pem)
+					.map_err(|e| io::Error::new(io::ErrorKind::Other, e.to_string()))
+			},
+			Ephemeral => generate(),
+		}
+	}
+}
+
 /// The options for obtaining a Ed25519 secret key.
 pub type Ed25519Secret = Secret<ed25519::SecretKey>;
 
@@ -699,4 +775,14 @@ mod tests {
 		let kp2 = NodeKeyConfig::Ed25519(Secret::New).into_keypair().unwrap();
 		assert!(secret_bytes(&kp1) != secret_bytes(&kp2));
 	}
+
+	#[test]
+	fn test_webrtc_certificate() {
+		let tmp = tempdir_with_prefix("x");
+		std::fs::remove_dir(tmp.path()).unwrap(); // should be recreated
+		let file = tmp.path().join("x").to_path_buf();
+		let kp1 = WebRTCConfig::File(file.clone()).into_certificate().unwrap();
+		let kp2 = WebRTCConfig::File(file.clone()).into_certificate().unwrap();
+		assert!(file.is_file() && kp1 == kp2)
+	}
 }