use std::{
collections::HashSet,
fs::{self, File},
future::Future,
io::{Read, Write},
net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr},
path::{Path, PathBuf},
sync::{Arc, LazyLock, atomic::AtomicBool},
time::Duration,
};
use anyhow::Context;
use directories::ProjectDirs;
use either::Either;
use serde::{Deserialize, Serialize};
use tokio::runtime::Runtime;
use crate::{
dev_tool::PeerId,
local_node::OperationMode,
tracing::tracer::get_log_dir,
transport::{CongestionControlAlgorithm, CongestionControlConfig, TransportKeypair},
};
pub(crate) mod kek;
mod secret;
pub use kek::{
KEK_SIZE, KekBackend, KekBackendKind, KekError, ensure_kek_loaded, load_from_backend,
read_backend_marker, replace_backend_marker, resolve_first_start, write_backend_marker,
};
pub use secret::*;
pub const DEFAULT_MAX_CONNECTIONS: usize = crate::ring::Ring::DEFAULT_MAX_CONNECTIONS;
pub const DEFAULT_MIN_CONNECTIONS: usize = crate::ring::Ring::DEFAULT_MIN_CONNECTIONS;
pub const DEFAULT_RANDOM_PEER_CONN_THRESHOLD: usize = 7;
pub const DEFAULT_MAX_HOPS_TO_LIVE: usize = 10;
pub const DEFAULT_GATEWAY_PORT: u16 = 31337;
pub(crate) const OPERATION_TTL: Duration = Duration::from_secs(60);
pub(crate) const PCK_VERSION: &str = env!("CARGO_PKG_VERSION");
pub(crate) const MIN_COMPATIBLE_VERSION: &str = env!("FREENET_MIN_COMPATIBLE_VERSION");
static ASYNC_RT: LazyLock<Option<Runtime>> = LazyLock::new(GlobalExecutor::initialize_async_rt);
const DEFAULT_TRANSIENT_BUDGET: usize = 2048;
const DEFAULT_TRANSIENT_TTL_SECS: u64 = 30;
const DEFAULT_EVENT_LOOP_CHANNEL_CAPACITY: usize = 2048;
const QUALIFIER: &str = "";
const ORGANIZATION: &str = "The Freenet Project Inc";
const APPLICATION: &str = "Freenet";
const FREENET_GATEWAYS_INDEX: &str = "https://freenet.org/keys/gateways.toml";
#[derive(clap::Parser, Debug, Clone)]
pub struct ConfigArgs {
#[arg(value_enum, env = "MODE")]
pub mode: Option<OperationMode>,
#[command(flatten)]
pub ws_api: WebsocketApiArgs,
#[command(flatten)]
pub network_api: NetworkArgs,
#[command(flatten)]
pub secrets: SecretArgs,
#[arg(long, env = "LOG_LEVEL")]
pub log_level: Option<tracing::log::LevelFilter>,
#[command(flatten)]
pub config_paths: ConfigPathsArgs,
#[arg(long, hide = true)]
pub id: Option<String>,
#[arg(long, short)]
pub version: bool,
#[arg(long, env = "MAX_BLOCKING_THREADS")]
pub max_blocking_threads: Option<usize>,
#[arg(long, env = "MAX_HOSTING_STORAGE")]
pub max_hosting_storage: Option<u64>,
#[arg(long, env = "HOSTING_DISK_PCT")]
pub hosting_disk_pct: Option<f64>,
#[arg(long, env = "MAX_HOSTING_DISK")]
pub max_hosting_disk: Option<u64>,
#[arg(long = "per-user-secret-quota", env = "PER_USER_SECRET_QUOTA")]
pub per_user_secret_quota_bytes: Option<u64>,
#[arg(long = "per-user-inactive-ttl", env = "PER_USER_INACTIVE_TTL")]
pub per_user_inactive_ttl_secs: Option<u64>,
#[arg(
long = "inactive-user-sweep-interval",
env = "INACTIVE_USER_SWEEP_INTERVAL"
)]
pub inactive_user_sweep_interval_secs: Option<u64>,
#[arg(long, env = "FREENET_MODULE_CACHE_BUDGET_BYTES")]
pub module_cache_budget_bytes: Option<usize>,
#[arg(
long = "enable-event-log",
env = "FREENET_ENABLE_EVENT_LOG",
num_args = 0..=1,
default_missing_value = "true"
)]
pub enable_event_log: Option<bool>,
#[arg(long, env = "SHUTDOWN_DRAIN_SECS")]
pub shutdown_drain_secs: Option<u64>,
#[arg(long = "disable-auto-update")]
pub disable_auto_update: bool,
#[command(flatten)]
pub telemetry: TelemetryArgs,
}
impl Default for ConfigArgs {
fn default() -> Self {
Self {
mode: Some(OperationMode::Network),
network_api: NetworkArgs {
address: Some(default_listening_address()),
network_port: Some(default_network_api_port()),
public_address: None,
public_port: None,
is_gateway: false,
skip_load_from_network: true,
ignore_protocol_checking: false,
gateways: None,
gateway: None,
location: None,
bandwidth_limit: Some(3_000_000), total_bandwidth_limit: None,
min_bandwidth_per_connection: None,
blocked_addresses: None,
event_loop_channel_capacity: None,
transient_budget: Some(DEFAULT_TRANSIENT_BUDGET),
transient_ttl_secs: Some(DEFAULT_TRANSIENT_TTL_SECS),
min_connections: None,
max_connections: None,
streaming_threshold: None, ledbat_min_ssthresh: None, congestion_control: None, bbr_startup_rate: None, },
ws_api: WebsocketApiArgs {
address: None,
ws_api_port: Some(default_ws_api_port()),
token_ttl_seconds: None,
token_cleanup_interval_seconds: None,
allowed_host: None,
allowed_source_cidrs: None,
hosted_mode: None,
per_user_op_rate_limit: None,
per_user_op_burst: None,
per_user_export_min_interval_secs: None,
},
secrets: Default::default(),
log_level: Some(tracing::log::LevelFilter::Info),
config_paths: Default::default(),
id: None,
version: false,
max_blocking_threads: None,
max_hosting_storage: None,
hosting_disk_pct: None,
max_hosting_disk: None,
per_user_secret_quota_bytes: None,
per_user_inactive_ttl_secs: None,
inactive_user_sweep_interval_secs: None,
module_cache_budget_bytes: None,
enable_event_log: None,
shutdown_drain_secs: None,
disable_auto_update: false,
telemetry: Default::default(),
}
}
}
const CONFIG_KEY_SPELLINGS: &[&[&str]] = &[
&["public_network_address", "public-network-address"],
&["public_port", "public-network-port", "public-port"],
&["bandwidth_limit", "bandwidth-limit"],
&["total_bandwidth_limit", "total-bandwidth-limit"],
&[
"min_bandwidth_per_connection",
"min-bandwidth-per-connection",
],
&["blocked_addresses", "blocked-addresses"],
&["event_loop_channel_capacity", "event-loop-channel-capacity"],
&["skip_load_from_network", "skip-load-from-network"],
&["transport_keypair", "transport-keypair"],
&["log_level", "log-level"],
&["contracts_dir", "contracts-dir"],
&["delegates_dir", "delegates-dir"],
&["secrets_dir", "secrets-dir"],
&["db_dir", "db-dir"],
&["event_log", "event-log"],
&["data_dir", "data-dir"],
&["config_dir", "config-dir"],
&["log_dir", "log-dir"],
&["wasmtime_cache_dir", "wasmtime-cache-dir"],
&["is_gateway", "is-gateway"],
&["max_blocking_threads", "max-blocking-threads"],
];
const GATEWAY_KEY_SPELLINGS: &[&[&str]] = &[&["public_key", "public-key"]];
const GATEWAY_ADDRESS_KEY_SPELLINGS: &[&[&str]] = &[&["host_address", "host-address"]];
fn redundant_key_spellings(
groups: &[&[&'static str]],
source: &str,
contains: impl Fn(&str) -> bool,
value_of: impl Fn(&str) -> String,
) -> Vec<(&'static str, String)> {
let mut redundant = Vec::new();
for group in groups {
let mut present = group.iter().copied().filter(|key| contains(key));
let Some(keep) = present.next() else {
continue;
};
for ignored in present {
let render = |key| {
let value = value_of(key);
let value = if value.contains(['\n', '\r', '\u{2028}', '\u{2029}']) {
format!("{value:?}")
} else {
value
};
match value.char_indices().nth(200) {
Some((cut, _)) => format!("{}… (truncated)", &value[..cut]),
None => value,
}
};
let (kept_value, ignored_value) = (render(keep), render(ignored));
let message = format!(
"`{ignored} = {ignored_value}` in {source} is ignored: \
`{keep} = {kept_value}` is also set and wins. They are two \
spellings of one setting (#5124), and the node is using \
{kept_value}. To use {ignored_value} instead, delete the \
`{keep}` line."
);
tracing::warn!("{message}");
eprintln!("warning: {message}");
redundant.push((ignored, message));
}
}
redundant
}
fn parse_gateways_toml(content: &str, source: &str) -> Result<Gateways, toml::de::Error> {
let mut table = toml::from_str::<toml::Table>(content)?;
let mut normalized = false;
if let Some(toml::Value::Array(entries)) = table.get_mut("gateways") {
for entry in entries {
let Some(map) = entry.as_table_mut() else {
continue;
};
let redundant = redundant_key_spellings(
GATEWAY_KEY_SPELLINGS,
source,
|key| map.contains_key(key),
|key| map.get(key).map(|v| v.to_string()).unwrap_or_default(),
);
for (key, _) in redundant {
map.remove(key);
normalized = true;
}
if let Some(address) = map.get_mut("address").and_then(|a| a.as_table_mut()) {
let redundant = redundant_key_spellings(
GATEWAY_ADDRESS_KEY_SPELLINGS,
source,
|key| address.contains_key(key),
|key| address.get(key).map(|v| v.to_string()).unwrap_or_default(),
);
for (key, _) in redundant {
address.remove(key);
normalized = true;
}
}
}
}
if normalized {
toml::Value::Table(table).try_into::<Gateways>()
} else {
toml::from_str::<Gateways>(content)
}
}
impl ConfigArgs {
pub fn current_version(&self) -> &str {
PCK_VERSION
}
fn read_config(dir: &PathBuf) -> std::io::Result<Option<Config>> {
if !dir.exists() {
return Ok(None);
}
let mut read_dir = std::fs::read_dir(dir)?;
let config_args: Option<(String, String)> = read_dir.find_map(|e| {
if let Ok(e) = e {
if e.path().is_dir() {
return None;
}
let filename = e.file_name().to_string_lossy().into_owned();
let ext = filename.rsplit('.').next().map(|s| s.to_owned());
if let Some(ext) = ext {
if filename.starts_with("config") {
match ext.as_str() {
"toml" => {
tracing::debug!(filename = %filename, "Found configuration file");
return Some((filename, ext));
}
"json" => {
return Some((filename, ext));
}
_ => {}
}
}
}
}
None
});
match config_args {
Some((filename, ext)) => {
let path = dir.join(filename).with_extension(&ext);
tracing::debug!(path = ?path, "Reading configuration file");
match ext.as_str() {
"toml" => {
let mut file = File::open(&path)?;
let mut content = String::new();
file.read_to_string(&mut content)?;
let invalid_data = |e: toml::de::Error| {
std::io::Error::new(std::io::ErrorKind::InvalidData, e.to_string())
};
let mut table =
toml::from_str::<toml::Table>(&content).map_err(invalid_data)?;
let redundant = redundant_key_spellings(
CONFIG_KEY_SPELLINGS,
&path.display().to_string(),
|key| table.contains_key(key),
|key| table.get(key).map(|v| v.to_string()).unwrap_or_default(),
);
let mut config = if redundant.is_empty() {
toml::from_str::<Config>(&content).map_err(invalid_data)?
} else {
for (key, _) in redundant {
table.remove(key);
}
toml::Value::Table(table)
.try_into::<Config>()
.map_err(invalid_data)?
};
let secrets = Self::read_secrets(
config.secrets.transport_keypair_path.clone(),
config.secrets.nonce_path.clone(),
config.secrets.cipher_path.clone(),
)?;
config.secrets = secrets;
Ok(Some(config))
}
"json" => {
let mut file = File::open(&path)?;
let mut content = String::new();
file.read_to_string(&mut content)?;
let mut object = serde_json::from_str::<serde_json::Value>(&content)?;
let mut rewritten = false;
if let Some(map) = object.as_object_mut() {
let nulls: Vec<&str> = CONFIG_KEY_SPELLINGS
.iter()
.filter(|group| {
group.iter().filter(|key| map.contains_key(**key)).count() > 1
})
.flat_map(|group| group.iter().copied())
.filter(|key| map.get(*key).is_some_and(|value| value.is_null()))
.collect();
for key in nulls {
map.remove(key);
rewritten = true;
}
let redundant = redundant_key_spellings(
CONFIG_KEY_SPELLINGS,
&path.display().to_string(),
|key| map.contains_key(key),
|key| map.get(key).map(|v| v.to_string()).unwrap_or_default(),
);
for (key, _) in redundant {
map.remove(key);
rewritten = true;
}
}
let mut config = if rewritten {
serde_json::from_value::<Config>(object)?
} else {
serde_json::from_str::<Config>(&content)?
};
let secrets = Self::read_secrets(
config.secrets.transport_keypair_path.clone(),
config.secrets.nonce_path.clone(),
config.secrets.cipher_path.clone(),
)?;
config.secrets = secrets;
Ok(Some(config))
}
ext => Err(std::io::Error::new(
std::io::ErrorKind::InvalidInput,
format!("Invalid configuration file extension: {ext}"),
)),
}
}
None => Ok(None),
}
}
pub async fn build(self) -> anyhow::Result<Config> {
self.build_with_gateways_index(FREENET_GATEWAYS_INDEX).await
}
async fn build_with_gateways_index(mut self, gateways_index: &str) -> anyhow::Result<Config> {
let cfg = if let Some(path) = self.config_paths.config_dir.as_ref() {
if !path.exists() {
return Err(anyhow::Error::new(std::io::Error::new(
std::io::ErrorKind::NotFound,
"Configuration directory not found",
)));
}
Self::read_config(path)?
} else {
let (config, data, is_temp_dir) = {
match ConfigPathsArgs::default_dirs(self.id.as_deref())? {
Either::Left(defaults) => (
defaults.config_local_dir().to_path_buf(),
defaults.data_local_dir().to_path_buf(),
false,
),
Either::Right(dir) => (dir.clone(), dir, true),
}
};
self.config_paths.config_dir = Some(config.clone());
if self.config_paths.data_dir.is_none() {
self.config_paths.data_dir = Some(data);
}
if is_temp_dir {
None
} else {
Self::read_config(&config)?.inspect(|_| {
tracing::debug!("Found configuration file in default directory");
})
}
};
let mut dropped_persisted_wildcard: Option<IpAddr> = None;
let cidrs_granted_this_boot = self.ws_api.allowed_source_cidrs.clone();
if let Some(cfg) = cfg {
self.secrets.merge(cfg.secrets);
self.mode.get_or_insert(cfg.mode);
if !is_auto_derivable_ws_api_address(cfg.ws_api.address) {
self.ws_api.address.get_or_insert(cfg.ws_api.address);
} else if self.ws_api.address.is_none() {
dropped_persisted_wildcard = Some(cfg.ws_api.address);
}
self.ws_api.ws_api_port.get_or_insert(cfg.ws_api.port);
self.ws_api
.token_ttl_seconds
.get_or_insert(cfg.ws_api.token_ttl_seconds);
self.ws_api
.token_cleanup_interval_seconds
.get_or_insert(cfg.ws_api.token_cleanup_interval_seconds);
if !cfg.ws_api.allowed_hosts.is_empty() {
self.ws_api
.allowed_host
.get_or_insert(cfg.ws_api.allowed_hosts);
}
if !cfg.ws_api.allowed_source_cidrs.is_empty() {
self.ws_api.allowed_source_cidrs.get_or_insert(
cfg.ws_api
.allowed_source_cidrs
.iter()
.map(|net| net.to_string())
.collect(),
);
}
self.ws_api
.hosted_mode
.get_or_insert(cfg.ws_api.hosted_mode);
self.ws_api
.per_user_op_rate_limit
.get_or_insert(cfg.ws_api.per_user_op_rate_limit);
self.ws_api
.per_user_op_burst
.get_or_insert(cfg.ws_api.per_user_op_burst);
self.ws_api
.per_user_export_min_interval_secs
.get_or_insert(cfg.ws_api.per_user_export_min_interval_secs);
self.network_api
.address
.get_or_insert(cfg.network_api.address);
self.network_api
.network_port
.get_or_insert(cfg.network_api.port);
if let Some(addr) = cfg.network_api.public_address {
self.network_api.public_address.get_or_insert(addr);
}
if let Some(port) = cfg.network_api.public_port {
self.network_api.public_port.get_or_insert(port);
}
if let Some(limit) = cfg.network_api.bandwidth_limit {
self.network_api.bandwidth_limit.get_or_insert(limit);
}
if let Some(addrs) = cfg.network_api.blocked_addresses {
self.network_api
.blocked_addresses
.get_or_insert_with(|| addrs.into_iter().collect());
}
self.network_api
.transient_budget
.get_or_insert(cfg.network_api.transient_budget);
self.network_api
.transient_ttl_secs
.get_or_insert(cfg.network_api.transient_ttl_secs);
self.network_api
.min_connections
.get_or_insert(cfg.network_api.min_connections);
self.network_api
.max_connections
.get_or_insert(cfg.network_api.max_connections);
if cfg.network_api.streaming_threshold != default_streaming_threshold() {
self.network_api
.streaming_threshold
.get_or_insert(cfg.network_api.streaming_threshold);
}
if self.network_api.ledbat_min_ssthresh.is_none() {
self.network_api.ledbat_min_ssthresh = cfg.network_api.ledbat_min_ssthresh;
}
if self.network_api.congestion_control.is_none()
&& cfg.network_api.congestion_control != default_congestion_control()
{
self.network_api
.congestion_control
.get_or_insert(cfg.network_api.congestion_control);
}
if self.network_api.bbr_startup_rate.is_none() {
self.network_api.bbr_startup_rate = cfg.network_api.bbr_startup_rate;
}
if let Some(limit) = cfg.network_api.total_bandwidth_limit {
self.network_api.total_bandwidth_limit.get_or_insert(limit);
}
if let Some(min_bw) = cfg.network_api.min_bandwidth_per_connection {
self.network_api
.min_bandwidth_per_connection
.get_or_insert(min_bw);
}
self.network_api
.event_loop_channel_capacity
.get_or_insert(cfg.network_api.event_loop_channel_capacity);
if cfg.is_gateway {
self.network_api.is_gateway = true;
}
if cfg.network_api.skip_load_from_network {
self.network_api.skip_load_from_network = true;
}
if let Some(loc) = cfg.location {
self.network_api.location.get_or_insert(loc);
}
self.log_level.get_or_insert(cfg.log_level);
if cfg.max_hosting_storage != crate::ring::LEGACY_FLAT_HOSTING_BUDGET_BYTES {
self.max_hosting_storage
.get_or_insert(cfg.max_hosting_storage);
}
self.hosting_disk_pct.get_or_insert(cfg.hosting_disk_pct);
self.max_hosting_disk.get_or_insert(cfg.max_hosting_disk);
if let Some(persisted) = cfg.enable_event_log {
self.enable_event_log.get_or_insert(persisted);
}
self.per_user_secret_quota_bytes
.get_or_insert(cfg.per_user_secret_quota_bytes);
self.per_user_inactive_ttl_secs
.get_or_insert(cfg.per_user_inactive_ttl_secs);
self.inactive_user_sweep_interval_secs
.get_or_insert(cfg.inactive_user_sweep_interval_secs);
const OLD_AUTO_MODULE_CACHE_BUDGET_SENTINEL: usize = 1_610_612_736;
if cfg.module_cache_budget_bytes != OLD_AUTO_MODULE_CACHE_BUDGET_SENTINEL {
self.module_cache_budget_bytes
.get_or_insert(cfg.module_cache_budget_bytes);
}
self.shutdown_drain_secs
.get_or_insert(cfg.shutdown_drain_secs);
self.max_blocking_threads
.get_or_insert(cfg.max_blocking_threads);
self.config_paths.merge(cfg.config_paths.as_ref().clone());
if !cfg.telemetry.enabled {
self.telemetry.enabled = false;
}
if self.telemetry.endpoint.is_none() {
self.telemetry
.endpoint
.get_or_insert(cfg.telemetry.endpoint);
}
self.telemetry
.transport_snapshot_interval_secs
.get_or_insert(cfg.telemetry.transport_snapshot_interval_secs);
if cfg.telemetry.reference_ping_enabled {
self.telemetry.reference_ping_enabled = true;
}
if cfg.telemetry.iface_tx_enabled {
self.telemetry.iface_tx_enabled = true;
}
}
self.network_api.validate()?;
let mode = self.mode.unwrap_or(OperationMode::Network);
let config_paths = self.config_paths.build(self.id.as_deref())?;
let secrets = self.secrets.build(Some(&config_paths.secrets_dir(mode)))?;
let peer_id = self
.network_api
.public_address
.zip(self.network_api.public_port)
.map(|(addr, port)| {
PeerId::new(
secrets.transport_keypair.public().clone(),
(addr, port).into(),
)
});
let gateways_file = config_paths.config_dir.join("gateways.toml");
let remotely_loaded_gateways = if mode == OperationMode::Local {
Gateways::default()
} else if !self.network_api.skip_load_from_network {
load_gateways_from_index(gateways_index, &config_paths.secrets_dir)
.await
.inspect_err(|error| {
tracing::error!(
error = %error,
index = gateways_index,
"Failed to load gateways from index"
);
})
.unwrap_or_default()
} else if let Some(gateways) = self.network_api.gateways {
let gateways = gateways
.into_iter()
.map(|cfg| {
let cfg = serde_json::from_str::<InlineGwConfig>(&cfg)?;
Ok::<_, anyhow::Error>(GatewayConfig {
address: Address::HostAddress(cfg.address),
public_key_path: cfg.public_key_path,
location: cfg.location,
})
})
.collect::<Result<Vec<_>, _>>()?;
Gateways { gateways }
} else {
Gateways::default()
};
let has_cli_gateways = self
.network_api
.gateway
.as_ref()
.is_some_and(|v| !v.is_empty());
let gateways = if mode == OperationMode::Local {
Gateways { gateways: vec![] }
} else if !self.network_api.skip_load_from_network
&& !remotely_loaded_gateways.gateways.is_empty()
{
if let Ok(content) = fs::read_to_string(&gateways_file) {
if let Ok(local_cache) = parse_gateways_toml(&content, "gateways.toml") {
let dropped = gateways_dropped_by_remote_replace(
&local_cache.gateways,
&remotely_loaded_gateways.gateways,
);
if !dropped.is_empty() {
tracing::warn!(
dropped = ?dropped,
file = ?gateways_file,
"Remote gateway index does not list {} locally-cached \
gateway(s); they will be discarded. If you pinned them \
manually, run with --skip-load-from-network to keep a \
custom peer set.",
dropped.len()
);
}
}
}
tracing::info!(
gateway_count = remotely_loaded_gateways.gateways.len(),
"Replacing local gateways with gateways from remote index"
);
if let Err(e) = remotely_loaded_gateways.save_to_file(&gateways_file) {
tracing::warn!(
error = %e,
file = ?gateways_file,
"Failed to save updated gateways to file"
);
}
remotely_loaded_gateways
} else if self.network_api.skip_load_from_network && self.network_api.is_gateway {
if remotely_loaded_gateways.gateways.is_empty() {
tracing::info!(
"Gateway running in isolated mode (skip_load_from_network), not connecting to other gateways"
);
Gateways { gateways: vec![] }
} else {
remotely_loaded_gateways
}
} else if self.network_api.skip_load_from_network && has_cli_gateways {
tracing::info!(
"skip_load_from_network with --gateway entries: \
ignoring on-disk gateways.toml; using only CLI-supplied gateways"
);
remotely_loaded_gateways
} else {
let remote_fetch_failed = !self.network_api.skip_load_from_network
&& remotely_loaded_gateways.gateways.is_empty();
if remote_fetch_failed {
tracing::warn!(
file = ?gateways_file,
"Remote gateway fetch failed, falling back to local cache"
);
}
let mut gateways = match File::open(&*gateways_file) {
Ok(mut file) => {
let mut content = String::new();
file.read_to_string(&mut content)?;
parse_gateways_toml(&content, "gateways.toml").map_err(|e| {
std::io::Error::new(std::io::ErrorKind::InvalidData, e.to_string())
})?
}
Err(err) => {
if peer_id.is_none()
&& !self.network_api.is_gateway
&& mode == OperationMode::Network
&& remotely_loaded_gateways.gateways.is_empty()
&& !has_cli_gateways
{
let hint = if remote_fetch_failed {
"Cannot initialize node without gateways. \
The remote gateway index could not be reached and no \
local cache exists yet. Check your network connection \
and firewall settings, then try again."
} else {
"Cannot initialize node without gateways"
};
tracing::error!(
file = ?gateways_file,
error = %err,
remote_fetch_failed,
"{hint}"
);
return Err(anyhow::Error::new(std::io::Error::new(
std::io::ErrorKind::NotFound,
hint,
)));
}
if remotely_loaded_gateways.gateways.is_empty() {
tracing::warn!("No gateways file found, initializing disjoint gateway");
}
Gateways { gateways: vec![] }
}
};
if !remotely_loaded_gateways.gateways.is_empty() {
gateways.merge_and_deduplicate(remotely_loaded_gateways);
}
gateways
};
let mut gateways = gateways;
if let Some(cli_entries) = self.network_api.gateway {
let secrets_dir = config_paths.secrets_dir(mode);
if let Ok(entries) = fs::read_dir(&secrets_dir) {
for entry in entries.flatten() {
if entry
.file_name()
.to_str()
.is_some_and(|n| n.starts_with("cli_gw_") && n.ends_with(".pub"))
{
if let Err(e) = fs::remove_file(entry.path()) {
tracing::debug!(
error = %e,
file = ?entry.path(),
"Failed to remove stale CLI gateway key file"
);
}
}
}
}
let mut cli_gateways = Gateways { gateways: vec![] };
let mut seen_addrs = HashSet::new();
for entry in &cli_entries {
match parse_gateway(entry, &secrets_dir) {
Ok(gw) => {
if !seen_addrs.insert(gw.address.clone()) {
tracing::warn!(
address = ?gw.address,
"Skipping duplicate --gateway address"
);
continue;
}
tracing::info!(
address = ?gw.address,
"Adding user-specified gateway via --gateway"
);
cli_gateways.gateways.push(gw);
}
Err(e) => {
return Err(anyhow::anyhow!(
"Failed to parse --gateway \"{entry}\": {e}"
));
}
}
}
cli_gateways.merge_and_deduplicate(gateways);
gateways = cli_gateways;
}
let ws_api_allowed_hosts = self.ws_api.allowed_host.clone().unwrap_or_default();
let ws_api_hosted_mode = self.ws_api.hosted_mode.unwrap_or(false);
let (ws_api_address, ws_api_address_source) = resolve_ws_api_address(
mode,
self.ws_api.address,
cidrs_granted_this_boot.as_deref(),
dropped_persisted_wildcard,
);
let ws_api_exposure = WsApiExposure {
source: ws_api_address_source,
dropped_persisted_address: dropped_persisted_wildcard
.filter(|persisted| *persisted != ws_api_address),
};
let this = Config {
mode,
peer_id,
network_api: NetworkApiConfig {
address: self.network_api.address.unwrap_or_else(|| match mode {
OperationMode::Local => default_local_address(),
OperationMode::Network => default_listening_address(),
}),
port: self
.network_api
.network_port
.unwrap_or_else(default_network_api_port),
public_address: self.network_api.public_address,
public_port: self.network_api.public_port,
ignore_protocol_version: self.network_api.ignore_protocol_checking,
bandwidth_limit: self.network_api.bandwidth_limit,
total_bandwidth_limit: self.network_api.total_bandwidth_limit,
min_bandwidth_per_connection: self.network_api.min_bandwidth_per_connection,
blocked_addresses: self
.network_api
.blocked_addresses
.map(|addrs| addrs.into_iter().collect()),
event_loop_channel_capacity: self
.network_api
.event_loop_channel_capacity
.unwrap_or_else(default_event_loop_channel_capacity),
transient_budget: self
.network_api
.transient_budget
.unwrap_or(DEFAULT_TRANSIENT_BUDGET),
transient_ttl_secs: self
.network_api
.transient_ttl_secs
.unwrap_or(DEFAULT_TRANSIENT_TTL_SECS),
min_connections: self
.network_api
.min_connections
.unwrap_or(DEFAULT_MIN_CONNECTIONS),
max_connections: self
.network_api
.max_connections
.unwrap_or(DEFAULT_MAX_CONNECTIONS),
streaming_threshold: self
.network_api
.streaming_threshold
.unwrap_or_else(default_streaming_threshold),
ledbat_min_ssthresh: self
.network_api
.ledbat_min_ssthresh
.or_else(default_ledbat_min_ssthresh),
congestion_control: self
.network_api
.congestion_control
.clone()
.unwrap_or_else(default_congestion_control),
bbr_startup_rate: self.network_api.bbr_startup_rate,
skip_load_from_network: self.network_api.skip_load_from_network,
},
ws_api: WebsocketApiConfig {
address: ws_api_address,
port: self.ws_api.ws_api_port.unwrap_or(default_ws_api_port()),
token_ttl_seconds: self
.ws_api
.token_ttl_seconds
.unwrap_or(default_token_ttl_seconds()),
token_cleanup_interval_seconds: self
.ws_api
.token_cleanup_interval_seconds
.unwrap_or(default_token_cleanup_interval_seconds()),
allowed_hosts: ws_api_allowed_hosts,
allowed_source_cidrs: self
.ws_api
.allowed_source_cidrs
.as_ref()
.map(|cidrs| {
cidrs
.iter()
.map(|s| {
let net = s.parse::<ipnet::IpNet>().map_err(|e| {
anyhow::anyhow!(
"invalid CIDR `{s}` in allowed-source-cidrs: {e}"
)
})?;
crate::server::validate_source_cidr(&net).map_err(|msg| {
anyhow::anyhow!("allowed-source-cidrs: {msg}")
})?;
Ok::<_, anyhow::Error>(net)
})
.collect::<Result<Vec<_>, _>>()
})
.transpose()?
.unwrap_or_default(),
hosted_mode: ws_api_hosted_mode,
per_user_op_rate_limit: self
.ws_api
.per_user_op_rate_limit
.unwrap_or_else(default_per_user_op_rate_limit),
per_user_op_burst: self
.ws_api
.per_user_op_burst
.unwrap_or_else(default_per_user_op_burst),
per_user_export_min_interval_secs: self
.ws_api
.per_user_export_min_interval_secs
.unwrap_or_else(default_per_user_export_min_interval_secs),
secrets_dir: config_paths.secrets_dir(mode),
webapp_cache_dir: default_webapp_cache_dir(),
exposure: ws_api_exposure,
},
secrets,
log_level: self.log_level.unwrap_or(tracing::log::LevelFilter::Info),
config_paths: Arc::new(config_paths),
gateways: gateways.gateways.clone(),
is_gateway: self.network_api.is_gateway,
location: self.network_api.location,
max_blocking_threads: self
.max_blocking_threads
.unwrap_or_else(default_max_blocking_threads),
enable_event_log: self.enable_event_log,
max_hosting_storage: self
.max_hosting_storage
.unwrap_or_else(crate::ring::default_hosting_budget_bytes),
hosting_disk_pct: self
.hosting_disk_pct
.unwrap_or(crate::ring::DEFAULT_HOSTING_DISK_PCT),
max_hosting_disk: self
.max_hosting_disk
.unwrap_or(crate::ring::DEFAULT_MAX_HOSTING_DISK_BYTES),
per_user_secret_quota_bytes: self
.per_user_secret_quota_bytes
.unwrap_or(crate::wasm_runtime::DEFAULT_PER_USER_SECRET_QUOTA_BYTES as u64),
per_user_inactive_ttl_secs: self
.per_user_inactive_ttl_secs
.unwrap_or(default_per_user_inactive_ttl_secs()),
inactive_user_sweep_interval_secs: {
let v = self
.inactive_user_sweep_interval_secs
.unwrap_or(default_inactive_user_sweep_interval_secs());
if v == 0 {
default_inactive_user_sweep_interval_secs()
} else {
v
}
},
module_cache_budget_bytes: self
.module_cache_budget_bytes
.unwrap_or_else(crate::wasm_runtime::default_module_cache_budget_bytes),
shutdown_drain_secs: self
.shutdown_drain_secs
.unwrap_or_else(default_shutdown_drain_secs),
disable_auto_update: self.disable_auto_update,
telemetry: TelemetryConfig {
enabled: self.telemetry.enabled,
endpoint: self
.telemetry
.endpoint
.unwrap_or_else(|| DEFAULT_TELEMETRY_ENDPOINT.to_string()),
transport_snapshot_interval_secs: self
.telemetry
.transport_snapshot_interval_secs
.unwrap_or_else(default_transport_snapshot_interval_secs),
is_test_environment: self.id.is_some(),
reference_ping_enabled: self.telemetry.reference_ping_enabled,
iface_tx_enabled: self.telemetry.iface_tx_enabled,
},
};
fs::create_dir_all(this.config_dir())?;
if !self.network_api.skip_load_from_network {
gateways.save_to_file(&gateways_file)?;
}
let config_path = this.config_dir().join("config.toml");
let new_config_toml = toml::to_string(&this)
.map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, e))?;
let current = std::fs::read_to_string(&config_path).ok();
if current.as_deref() != Some(new_config_toml.as_str()) {
tracing::info!(path = ?config_path, "Persisting configuration");
let tmp_path = config_path.with_extension(format!("{}.toml.tmp", std::process::id()));
let mut file = File::create(&tmp_path)?;
file.write_all(new_config_toml.as_bytes())?;
file.sync_all()?;
drop(file);
std::fs::rename(&tmp_path, &config_path)?;
}
Ok(this)
}
}
mod serde_log_level_filter {
use serde::{Deserialize, Deserializer, Serializer};
use tracing::log::LevelFilter;
pub fn parse_log_level_str<'a, D>(level: &str) -> Result<LevelFilter, D::Error>
where
D: serde::Deserializer<'a>,
{
Ok(match level.trim() {
"off" | "Off" | "OFF" => LevelFilter::Off,
"error" | "Error" | "ERROR" => LevelFilter::Error,
"warn" | "Warn" | "WARN" => LevelFilter::Warn,
"info" | "Info" | "INFO" => LevelFilter::Info,
"debug" | "Debug" | "DEBUG" => LevelFilter::Debug,
"trace" | "Trace" | "TRACE" => LevelFilter::Trace,
s => return Err(serde::de::Error::custom(format!("unknown log level: {s}"))),
})
}
pub fn serialize<S>(level: &LevelFilter, serializer: S) -> Result<S::Ok, S::Error>
where
S: Serializer,
{
let level = match level {
LevelFilter::Off => "off",
LevelFilter::Error => "error",
LevelFilter::Warn => "warn",
LevelFilter::Info => "info",
LevelFilter::Debug => "debug",
LevelFilter::Trace => "trace",
};
serializer.serialize_str(level)
}
pub fn deserialize<'de, D>(deserializer: D) -> Result<LevelFilter, D::Error>
where
D: Deserializer<'de>,
{
let level = String::deserialize(deserializer)?;
parse_log_level_str::<D>(level.as_str())
}
}
#[derive(Debug, Serialize, Deserialize, Clone)]
pub struct Config {
pub mode: OperationMode,
#[serde(flatten)]
pub network_api: NetworkApiConfig,
#[serde(flatten)]
pub ws_api: WebsocketApiConfig,
#[serde(flatten)]
pub secrets: Secrets,
#[serde(with = "serde_log_level_filter", alias = "log-level")]
pub log_level: tracing::log::LevelFilter,
#[serde(flatten)]
config_paths: Arc<ConfigPaths>,
#[serde(skip)]
pub(crate) peer_id: Option<PeerId>,
#[serde(skip)]
pub(crate) gateways: Vec<GatewayConfig>,
#[serde(alias = "is-gateway")]
pub(crate) is_gateway: bool,
pub(crate) location: Option<f64>,
#[serde(
default = "default_max_blocking_threads",
alias = "max-blocking-threads"
)]
pub max_blocking_threads: usize,
#[serde(
default = "default_max_hosting_storage",
rename = "max-hosting-storage",
skip_serializing_if = "is_default_hosting_budget"
)]
pub max_hosting_storage: u64,
#[serde(default = "default_hosting_disk_pct", rename = "hosting-disk-pct")]
pub hosting_disk_pct: f64,
#[serde(default = "default_max_hosting_disk", rename = "max-hosting-disk")]
pub max_hosting_disk: u64,
#[serde(
default = "default_per_user_secret_quota_bytes",
rename = "per-user-secret-quota"
)]
pub per_user_secret_quota_bytes: u64,
#[serde(
default = "default_per_user_inactive_ttl_secs",
rename = "per-user-inactive-ttl"
)]
pub per_user_inactive_ttl_secs: u64,
#[serde(
default = "default_inactive_user_sweep_interval_secs",
rename = "inactive-user-sweep-interval"
)]
pub inactive_user_sweep_interval_secs: u64,
#[serde(
default = "default_module_cache_budget_bytes",
rename = "module-cache-budget-bytes"
)]
pub module_cache_budget_bytes: usize,
#[serde(
default,
rename = "enable-event-log",
skip_serializing_if = "Option::is_none"
)]
pub enable_event_log: Option<bool>,
#[serde(flatten)]
pub telemetry: TelemetryConfig,
#[serde(
default = "default_shutdown_drain_secs",
rename = "shutdown-drain-secs"
)]
pub shutdown_drain_secs: u64,
#[serde(skip)]
pub disable_auto_update: bool,
}
fn default_shutdown_drain_secs() -> u64 {
30
}
fn default_max_blocking_threads() -> usize {
std::thread::available_parallelism()
.map(|n| (n.get() * 2).clamp(4, 32))
.unwrap_or(8)
}
fn default_max_hosting_storage() -> u64 {
crate::ring::default_hosting_budget_bytes()
}
fn default_hosting_disk_pct() -> f64 {
crate::ring::DEFAULT_HOSTING_DISK_PCT
}
fn default_max_hosting_disk() -> u64 {
crate::ring::DEFAULT_MAX_HOSTING_DISK_BYTES
}
fn is_default_hosting_budget(v: &u64) -> bool {
*v == default_max_hosting_storage()
}
fn default_per_user_secret_quota_bytes() -> u64 {
crate::wasm_runtime::DEFAULT_PER_USER_SECRET_QUOTA_BYTES as u64
}
const fn default_per_user_inactive_ttl_secs() -> u64 {
crate::wasm_runtime::DEFAULT_PER_USER_INACTIVE_TTL_SECS
}
const fn default_inactive_user_sweep_interval_secs() -> u64 {
3_600
}
fn default_module_cache_budget_bytes() -> usize {
crate::wasm_runtime::default_module_cache_budget_bytes()
}
impl Config {
pub fn transport_keypair(&self) -> &TransportKeypair {
self.secrets.transport_keypair()
}
pub fn paths(&self) -> Arc<ConfigPaths> {
self.config_paths.clone()
}
pub fn log_client_api_exposure(&self) {
let address = self.ws_api.address;
for (legacy, replacement) in [
("WS_API_ADDRESS", "FREENET_WS_API_ADDRESS"),
("ALLOWED_HOST", "FREENET_ALLOWED_HOST"),
("ALLOWED_SOURCE_CIDRS", "FREENET_ALLOWED_SOURCE_CIDRS"),
] {
if std::env::var_os(legacy).is_some() && std::env::var_os(replacement).is_none() {
tracing::warn!(
legacy,
replacement,
"The environment variable `{legacy}` is no longer read (it was \
unnamespaced, and it can now decide whether the client API listens \
beyond this machine). Rename it to `{replacement}`."
);
}
}
if let Some(persisted) = self.ws_api.exposure.dropped_persisted_address {
if address.is_loopback() {
tracing::warn!(
%persisted,
resolved = %address,
"The client API now defaults to loopback, so the `ws-api-address` \
previously auto-written to config.toml has been re-derived. Clients \
on OTHER machines can no longer reach this node's API. If they \
should, add --ws-api-address :: to the node's invocation and KEEP it \
there — a value only persisted in config.toml is not enough, because \
this code cannot tell its own past output from your choice. On a \
systemd install add it with `systemctl edit` as a drop-in; do not \
hand-edit the generated unit, which marks it user-modified and opts \
this node out of future unit updates."
);
} else {
tracing::warn!(
%persisted,
resolved = %address,
"The loopback `ws-api-address` in config.toml was re-derived — this \
code writes that value itself, so it cannot be distinguished from a \
deliberate pin — and --allowed-source-cidrs then widened the bind. \
The client API is now reachable from OTHER machines, which the \
config file alone said it should not be. Pass --ws-api-address \
explicitly to pin it either way."
);
}
}
if self.ws_api.exposure.source == WsApiAddressSource::AutoWidened {
tracing::info!(
%address,
"Client API bound to all interfaces because --allowed-source-cidrs is \
set, preserving an invocation that relied on the old network-mode \
default (that flag is inert on a loopback socket). The default is now \
loopback; pass --ws-api-address explicitly to override this either \
way, and keep the flag in the invocation — a grant left only in \
config.toml does not widen a later boot."
);
}
if let Some(reason) = ws_api_shares_one_namespace_with_remote_clients(
self.ws_api.hosted_mode,
address,
&self.ws_api.allowed_hosts,
) {
tracing::warn!(
%address,
allowed_hosts = ?self.ws_api.allowed_hosts,
hosted_mode = self.ws_api.hosted_mode,
"Client API exposure: {reason}. A connection that presents no per-user \
token drives this node's SHARED namespace and can read and modify its \
contract state, identities and keys. Bind loopback \
(--ws-api-address ::1) unless you intend this."
);
}
}
}
#[derive(clap::Parser, Debug, Default, Clone, Serialize, Deserialize)]
pub struct NetworkArgs {
#[arg(
name = "network_address",
long = "network-address",
env = "NETWORK_ADDRESS"
)]
#[serde(rename = "network-address", skip_serializing_if = "Option::is_none")]
pub address: Option<IpAddr>,
#[arg(long, env = "NETWORK_PORT")]
#[serde(rename = "network-port", skip_serializing_if = "Option::is_none")]
pub network_port: Option<u16>,
#[arg(long = "public-network-address", env = "PUBLIC_NETWORK_ADDRESS")]
#[serde(
rename = "public-network-address",
skip_serializing_if = "Option::is_none"
)]
pub public_address: Option<IpAddr>,
#[arg(long = "public-network-port", env = "PUBLIC_NETWORK_PORT")]
#[serde(
rename = "public-network-port",
skip_serializing_if = "Option::is_none"
)]
pub public_port: Option<u16>,
#[arg(long)]
pub is_gateway: bool,
#[arg(long)]
pub skip_load_from_network: bool,
#[arg(long, hide = true)]
pub gateways: Option<Vec<String>>,
#[arg(long)]
#[serde(rename = "gateway", skip_serializing_if = "Option::is_none")]
pub gateway: Option<Vec<String>>,
#[arg(long, hide = true, env = "LOCATION")]
pub location: Option<f64>,
#[arg(long)]
pub ignore_protocol_checking: bool,
#[arg(long)]
pub bandwidth_limit: Option<usize>,
#[arg(long)]
#[serde(
rename = "total-bandwidth-limit",
skip_serializing_if = "Option::is_none"
)]
pub total_bandwidth_limit: Option<usize>,
#[arg(long)]
#[serde(
rename = "min-bandwidth-per-connection",
skip_serializing_if = "Option::is_none"
)]
pub min_bandwidth_per_connection: Option<usize>,
#[arg(long, num_args = 0..)]
pub blocked_addresses: Option<Vec<SocketAddr>>,
#[arg(long, env = "EVENT_LOOP_CHANNEL_CAPACITY")]
#[serde(
rename = "event-loop-channel-capacity",
skip_serializing_if = "Option::is_none"
)]
pub event_loop_channel_capacity: Option<usize>,
#[arg(long, env = "TRANSIENT_BUDGET")]
#[serde(rename = "transient-budget", skip_serializing_if = "Option::is_none")]
pub transient_budget: Option<usize>,
#[arg(long, env = "TRANSIENT_TTL_SECS")]
#[serde(rename = "transient-ttl-secs", skip_serializing_if = "Option::is_none")]
pub transient_ttl_secs: Option<u64>,
#[arg(long = "min-number-of-connections", env = "MIN_NUMBER_OF_CONNECTIONS")]
#[serde(
rename = "min-number-of-connections",
skip_serializing_if = "Option::is_none"
)]
pub min_connections: Option<usize>,
#[arg(long = "max-number-of-connections", env = "MAX_NUMBER_OF_CONNECTIONS")]
#[serde(
rename = "max-number-of-connections",
skip_serializing_if = "Option::is_none"
)]
pub max_connections: Option<usize>,
#[arg(long, env = "STREAMING_THRESHOLD")]
#[serde(
rename = "streaming-threshold",
skip_serializing_if = "Option::is_none"
)]
pub streaming_threshold: Option<usize>,
#[arg(long, env = "LEDBAT_MIN_SSTHRESH")]
#[serde(
rename = "ledbat-min-ssthresh",
skip_serializing_if = "Option::is_none"
)]
pub ledbat_min_ssthresh: Option<usize>,
#[arg(long, env = "FREENET_CONGESTION_CONTROL")]
#[serde(rename = "congestion-control", skip_serializing_if = "Option::is_none")]
pub congestion_control: Option<String>,
#[arg(long, env = "FREENET_BBR_STARTUP_RATE")]
#[serde(rename = "bbr-startup-rate", skip_serializing_if = "Option::is_none")]
pub bbr_startup_rate: Option<u64>,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct InlineGwConfig {
pub address: SocketAddr,
#[serde(rename = "public_key")]
pub public_key_path: PathBuf,
pub location: Option<f64>,
}
fn parse_gateway(input: &str, secrets_dir: &Path) -> anyhow::Result<GatewayConfig> {
let (addr_str, key_hex) = input.split_once(',').ok_or_else(|| {
anyhow::anyhow!(
"Invalid --gateway format: expected \"ip:port,hex-pubkey\", got \"{input}\""
)
})?;
let addr: SocketAddr = addr_str
.trim()
.parse()
.map_err(|e| anyhow::anyhow!("Invalid socket address \"{addr_str}\" in --gateway: {e}"))?;
let key_bytes = hex::decode(key_hex.trim())
.map_err(|e| anyhow::anyhow!("Invalid hex public key in --gateway: {e}"))?;
if key_bytes.len() != 32 {
anyhow::bail!(
"Invalid public key length {} in --gateway (expected 32 bytes / 64 hex chars)",
key_bytes.len()
);
}
fs::create_dir_all(secrets_dir)?;
let key_filename = format!("cli_gw_{}.pub", hex::encode(addr.to_string()));
let key_path = secrets_dir.join(&key_filename);
#[cfg(unix)]
{
use std::io::Write;
use std::os::unix::fs::OpenOptionsExt;
let mut file = fs::OpenOptions::new()
.write(true)
.create(true)
.truncate(true)
.mode(0o600)
.open(&key_path)?;
file.write_all(key_hex.trim().as_bytes())?;
}
#[cfg(not(unix))]
{
fs::write(&key_path, key_hex.trim())?;
}
Ok(GatewayConfig {
address: Address::HostAddress(addr),
public_key_path: key_path,
location: None,
})
}
impl NetworkArgs {
pub(crate) fn validate(&self) -> anyhow::Result<()> {
if self.is_gateway {
if self.public_address.is_none() {
return Err(anyhow::anyhow!(
"Gateway nodes must specify a public network address (--public-network-address)"
));
}
if self.public_port.is_none() {
return Err(anyhow::anyhow!(
"Gateway nodes must specify a public network port (--public-network-port)"
));
}
}
Ok(())
}
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct NetworkApiConfig {
#[serde(default = "default_listening_address", rename = "network-address")]
pub address: IpAddr,
#[serde(default = "default_network_api_port", rename = "network-port")]
pub port: u16,
#[serde(
rename = "public_network_address",
alias = "public-network-address",
skip_serializing_if = "Option::is_none"
)]
pub public_address: Option<IpAddr>,
#[serde(
rename = "public_port",
alias = "public-network-port",
alias = "public-port",
skip_serializing_if = "Option::is_none"
)]
pub public_port: Option<u16>,
#[serde(skip)]
pub ignore_protocol_version: bool,
#[serde(alias = "bandwidth-limit", skip_serializing_if = "Option::is_none")]
pub bandwidth_limit: Option<usize>,
#[serde(
alias = "total-bandwidth-limit",
skip_serializing_if = "Option::is_none"
)]
pub total_bandwidth_limit: Option<usize>,
#[serde(
alias = "min-bandwidth-per-connection",
skip_serializing_if = "Option::is_none"
)]
pub min_bandwidth_per_connection: Option<usize>,
#[serde(alias = "blocked-addresses", skip_serializing_if = "Option::is_none")]
pub blocked_addresses: Option<HashSet<SocketAddr>>,
#[serde(
default = "default_event_loop_channel_capacity",
alias = "event-loop-channel-capacity"
)]
pub event_loop_channel_capacity: usize,
#[serde(default = "default_transient_budget", rename = "transient-budget")]
pub transient_budget: usize,
#[serde(default = "default_transient_ttl_secs", rename = "transient-ttl-secs")]
pub transient_ttl_secs: u64,
#[serde(
default = "default_min_connections",
rename = "min-number-of-connections"
)]
pub min_connections: usize,
#[serde(
default = "default_max_connections",
rename = "max-number-of-connections"
)]
pub max_connections: usize,
#[serde(
default = "default_streaming_threshold",
rename = "streaming-threshold"
)]
pub streaming_threshold: usize,
#[serde(
default = "default_ledbat_min_ssthresh",
rename = "ledbat-min-ssthresh",
skip_serializing_if = "Option::is_none"
)]
pub ledbat_min_ssthresh: Option<usize>,
#[serde(default = "default_congestion_control", rename = "congestion-control")]
pub congestion_control: String,
#[serde(
default = "default_bbr_startup_rate",
rename = "bbr-startup-rate",
skip_serializing_if = "Option::is_none"
)]
pub bbr_startup_rate: Option<u64>,
#[serde(default, alias = "skip-load-from-network")]
pub skip_load_from_network: bool,
}
impl NetworkApiConfig {
pub fn build_congestion_config(&self) -> CongestionControlConfig {
let algo = match self.congestion_control.to_lowercase().as_str() {
"bbr" => CongestionControlAlgorithm::Bbr,
"ledbat" => CongestionControlAlgorithm::Ledbat,
_ => CongestionControlAlgorithm::FixedRate, };
let mut config = CongestionControlConfig::new(algo);
if algo == CongestionControlAlgorithm::Bbr {
if let Some(rate) = self.bbr_startup_rate {
tracing::debug!("Using custom BBR startup pacing rate: {} bytes/sec", rate);
config = config.with_startup_min_pacing_rate(rate);
}
}
config
}
}
mod port_allocation;
use port_allocation::find_available_port;
pub fn default_network_api_port() -> u16 {
find_available_port().unwrap_or(31337) }
pub(crate) fn default_event_loop_channel_capacity() -> usize {
DEFAULT_EVENT_LOOP_CHANNEL_CAPACITY
}
fn default_transient_budget() -> usize {
DEFAULT_TRANSIENT_BUDGET
}
fn default_transient_ttl_secs() -> u64 {
DEFAULT_TRANSIENT_TTL_SECS
}
fn default_min_connections() -> usize {
DEFAULT_MIN_CONNECTIONS
}
fn default_max_connections() -> usize {
DEFAULT_MAX_CONNECTIONS
}
fn default_streaming_threshold() -> usize {
64 * 1024
}
fn default_ledbat_min_ssthresh() -> Option<usize> {
Some(100 * 1024) }
fn default_congestion_control() -> String {
"fixedrate".to_string()
}
fn default_bbr_startup_rate() -> Option<u64> {
None
}
#[derive(clap::Parser, Debug, Default, Clone, Serialize, Deserialize)]
pub struct WebsocketApiArgs {
#[arg(
name = "ws_api_address",
long = "ws-api-address",
env = "FREENET_WS_API_ADDRESS"
)]
#[serde(rename = "ws-api-address", skip_serializing_if = "Option::is_none")]
pub address: Option<IpAddr>,
#[arg(long, env = "WS_API_PORT")]
#[serde(rename = "ws-api-port", skip_serializing_if = "Option::is_none")]
pub ws_api_port: Option<u16>,
#[arg(long, env = "TOKEN_TTL_SECONDS")]
#[serde(rename = "token-ttl-seconds", skip_serializing_if = "Option::is_none")]
pub token_ttl_seconds: Option<u64>,
#[arg(long, env = "TOKEN_CLEANUP_INTERVAL_SECONDS")]
#[serde(
rename = "token-cleanup-interval-seconds",
skip_serializing_if = "Option::is_none"
)]
pub token_cleanup_interval_seconds: Option<u64>,
#[arg(long, env = "FREENET_ALLOWED_HOST")]
#[serde(rename = "allowed-host", skip_serializing_if = "Option::is_none")]
pub allowed_host: Option<Vec<String>>,
#[arg(
long = "allowed-source-cidrs",
env = "FREENET_ALLOWED_SOURCE_CIDRS",
value_delimiter = ','
)]
#[serde(
rename = "allowed-source-cidrs",
skip_serializing_if = "Option::is_none"
)]
pub allowed_source_cidrs: Option<Vec<String>>,
#[arg(
long = "hosted-mode",
env = "FREENET_HOSTED_MODE",
num_args = 0..=1,
default_missing_value = "true"
)]
#[serde(rename = "hosted-mode", skip_serializing_if = "Option::is_none")]
pub hosted_mode: Option<bool>,
#[arg(long = "per-user-op-rate-limit", env = "PER_USER_OP_RATE_LIMIT")]
pub per_user_op_rate_limit: Option<u64>,
#[arg(long = "per-user-op-burst", env = "PER_USER_OP_BURST")]
pub per_user_op_burst: Option<u64>,
#[arg(
long = "per-user-export-min-interval-secs",
env = "PER_USER_EXPORT_MIN_INTERVAL_SECS"
)]
pub per_user_export_min_interval_secs: Option<u64>,
}
pub const DEFAULT_TELEMETRY_ENDPOINT: &str = "http://nova.locut.us:4318";
#[derive(clap::Parser, Debug, Clone, Serialize, Deserialize)]
pub struct TelemetryArgs {
#[arg(
long = "telemetry-enabled",
env = "FREENET_TELEMETRY_ENABLED",
default_value = "true"
)]
#[serde(rename = "telemetry-enabled", default = "default_telemetry_enabled")]
pub enabled: bool,
#[arg(long = "telemetry-endpoint", env = "FREENET_TELEMETRY_ENDPOINT")]
#[serde(rename = "telemetry-endpoint", skip_serializing_if = "Option::is_none")]
pub endpoint: Option<String>,
#[arg(
long = "transport-snapshot-interval-secs",
env = "FREENET_TRANSPORT_SNAPSHOT_INTERVAL_SECS"
)]
#[serde(
rename = "transport-snapshot-interval-secs",
skip_serializing_if = "Option::is_none"
)]
pub transport_snapshot_interval_secs: Option<u64>,
#[arg(
long = "reference-ping-enabled",
env = "FREENET_REFERENCE_PING_ENABLED",
default_value = "false"
)]
#[serde(
rename = "reference-ping-enabled",
default = "default_reference_ping_enabled"
)]
pub reference_ping_enabled: bool,
#[arg(
long = "iface-tx-enabled",
env = "FREENET_IFACE_TX_ENABLED",
default_value = "false"
)]
#[serde(rename = "iface-tx-enabled", default = "default_iface_tx_enabled")]
pub iface_tx_enabled: bool,
}
impl Default for TelemetryArgs {
fn default() -> Self {
Self {
enabled: true,
endpoint: None,
transport_snapshot_interval_secs: None,
reference_ping_enabled: false,
iface_tx_enabled: false,
}
}
}
fn default_telemetry_enabled() -> bool {
true
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct TelemetryConfig {
#[serde(default = "default_telemetry_enabled", rename = "telemetry-enabled")]
pub enabled: bool,
#[serde(default = "default_telemetry_endpoint", rename = "telemetry-endpoint")]
pub endpoint: String,
#[serde(
default = "default_transport_snapshot_interval_secs",
rename = "transport-snapshot-interval-secs"
)]
pub transport_snapshot_interval_secs: u64,
#[serde(skip)]
pub is_test_environment: bool,
#[serde(
default = "default_reference_ping_enabled",
rename = "reference-ping-enabled"
)]
pub reference_ping_enabled: bool,
#[serde(default = "default_iface_tx_enabled", rename = "iface-tx-enabled")]
pub iface_tx_enabled: bool,
}
fn default_transport_snapshot_interval_secs() -> u64 {
30
}
fn default_telemetry_endpoint() -> String {
DEFAULT_TELEMETRY_ENDPOINT.to_string()
}
fn default_reference_ping_enabled() -> bool {
false
}
fn default_iface_tx_enabled() -> bool {
false
}
impl Default for TelemetryConfig {
fn default() -> Self {
Self {
enabled: true,
endpoint: DEFAULT_TELEMETRY_ENDPOINT.to_string(),
transport_snapshot_interval_secs: default_transport_snapshot_interval_secs(),
is_test_environment: false,
reference_ping_enabled: false,
iface_tx_enabled: false,
}
}
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct WebsocketApiConfig {
#[serde(default = "default_local_address", rename = "ws-api-address")]
pub address: IpAddr,
#[serde(default = "default_ws_api_port", rename = "ws-api-port")]
pub port: u16,
#[serde(default = "default_token_ttl_seconds", rename = "token-ttl-seconds")]
pub token_ttl_seconds: u64,
#[serde(
default = "default_token_cleanup_interval_seconds",
rename = "token-cleanup-interval-seconds"
)]
pub token_cleanup_interval_seconds: u64,
#[serde(default, rename = "allowed-host")]
pub allowed_hosts: Vec<String>,
#[serde(default, rename = "allowed-source-cidrs")]
pub allowed_source_cidrs: Vec<ipnet::IpNet>,
#[serde(default, rename = "hosted-mode")]
pub hosted_mode: bool,
#[serde(
default = "default_per_user_op_rate_limit",
rename = "per-user-op-rate-limit"
)]
pub per_user_op_rate_limit: u64,
#[serde(default = "default_per_user_op_burst", rename = "per-user-op-burst")]
pub per_user_op_burst: u64,
#[serde(
default = "default_per_user_export_min_interval_secs",
rename = "per-user-export-min-interval-secs"
)]
pub per_user_export_min_interval_secs: u64,
#[serde(skip)]
pub secrets_dir: std::path::PathBuf,
#[serde(skip)]
pub exposure: WsApiExposure,
#[serde(skip)]
pub webapp_cache_dir: std::path::PathBuf,
}
pub fn default_webapp_cache_dir() -> std::path::PathBuf {
resolve_webapp_cache_dir(std::env::var_os(WEBAPP_CACHE_DIR_ENV))
}
const WEBAPP_CACHE_DIR_ENV: &str = "FREENET_WEBAPP_CACHE_DIR";
fn resolve_webapp_cache_dir(override_dir: Option<std::ffi::OsString>) -> std::path::PathBuf {
match override_dir {
Some(dir) if !dir.is_empty() => return std::path::PathBuf::from(dir),
Some(_) => tracing::warn!(
env = WEBAPP_CACHE_DIR_ENV,
"webapp cache: override is set but empty; ignoring it and using the \
default cache directory. An empty root would place the cache under \
the node's working directory and disable its size bound entirely."
),
None => {}
}
directories::ProjectDirs::from("", "The Freenet Project Inc", "freenet")
.map(|dirs| dirs.cache_dir().to_path_buf())
.unwrap_or_else(|| std::env::temp_dir().join("freenet"))
.join("webapp_cache")
}
#[inline]
const fn default_token_ttl_seconds() -> u64 {
86400 }
#[inline]
const fn default_token_cleanup_interval_seconds() -> u64 {
300 }
#[inline]
const fn default_per_user_op_rate_limit() -> u64 {
crate::client_events::user_op_rate_limit::DEFAULT_PER_USER_OP_RATE_LIMIT
}
#[inline]
const fn default_per_user_op_burst() -> u64 {
crate::client_events::user_op_rate_limit::DEFAULT_PER_USER_OP_BURST
}
#[inline]
const fn default_per_user_export_min_interval_secs() -> u64 {
crate::client_events::user_op_rate_limit::DEFAULT_PER_USER_EXPORT_MIN_INTERVAL_SECS
}
impl From<SocketAddr> for WebsocketApiConfig {
fn from(addr: SocketAddr) -> Self {
Self {
address: addr.ip(),
port: addr.port(),
token_ttl_seconds: default_token_ttl_seconds(),
token_cleanup_interval_seconds: default_token_cleanup_interval_seconds(),
allowed_hosts: Vec::new(),
allowed_source_cidrs: Vec::new(),
hosted_mode: false,
per_user_op_rate_limit: default_per_user_op_rate_limit(),
per_user_op_burst: default_per_user_op_burst(),
per_user_export_min_interval_secs: default_per_user_export_min_interval_secs(),
secrets_dir: std::path::PathBuf::new(),
webapp_cache_dir: default_webapp_cache_dir(),
exposure: WsApiExposure::default(),
}
}
}
impl Default for WebsocketApiConfig {
#[inline]
fn default() -> Self {
Self {
address: default_local_address(),
port: default_ws_api_port(),
token_ttl_seconds: default_token_ttl_seconds(),
token_cleanup_interval_seconds: default_token_cleanup_interval_seconds(),
allowed_hosts: Vec::new(),
allowed_source_cidrs: Vec::new(),
hosted_mode: false,
per_user_op_rate_limit: default_per_user_op_rate_limit(),
per_user_op_burst: default_per_user_op_burst(),
per_user_export_min_interval_secs: default_per_user_export_min_interval_secs(),
secrets_dir: std::path::PathBuf::new(),
webapp_cache_dir: default_webapp_cache_dir(),
exposure: WsApiExposure::default(),
}
}
}
#[inline]
const fn default_listening_address() -> IpAddr {
IpAddr::V6(Ipv6Addr::UNSPECIFIED)
}
#[inline]
const fn default_local_address() -> IpAddr {
IpAddr::V6(Ipv6Addr::LOCALHOST)
}
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
pub enum WsApiAddressSource {
#[default]
Explicit,
DefaultLoopback,
AutoWidened,
}
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
pub struct WsApiExposure {
pub source: WsApiAddressSource,
pub dropped_persisted_address: Option<IpAddr>,
}
fn is_auto_derivable_ws_api_address(addr: IpAddr) -> bool {
match addr {
IpAddr::V4(v4) => v4 == Ipv4Addr::UNSPECIFIED || v4 == Ipv4Addr::LOCALHOST,
IpAddr::V6(v6) => v6 == Ipv6Addr::UNSPECIFIED || v6 == Ipv6Addr::LOCALHOST,
}
}
fn ws_api_default_for_family(family_hint: Option<IpAddr>, wildcard: bool) -> IpAddr {
match (family_hint, wildcard) {
(Some(IpAddr::V4(_)), false) => IpAddr::V4(Ipv4Addr::LOCALHOST),
(Some(IpAddr::V4(_)), true) => IpAddr::V4(Ipv4Addr::UNSPECIFIED),
(_, false) => default_local_address(),
(_, true) => default_listening_address(),
}
}
fn grants_anything(list: Option<&[String]>) -> bool {
list.is_some_and(|entries| entries.iter().any(|e| !e.trim().is_empty()))
}
fn resolve_ws_api_address(
mode: OperationMode,
explicit: Option<IpAddr>,
cidrs_granted_this_boot: Option<&[String]>,
family_hint: Option<IpAddr>,
) -> (IpAddr, WsApiAddressSource) {
if let Some(addr) = explicit {
return (addr, WsApiAddressSource::Explicit);
}
let compat_widen =
matches!(mode, OperationMode::Network) && grants_anything(cidrs_granted_this_boot);
if compat_widen {
(
ws_api_default_for_family(family_hint, true),
WsApiAddressSource::AutoWidened,
)
} else {
(
ws_api_default_for_family(family_hint, false),
WsApiAddressSource::DefaultLoopback,
)
}
}
fn ws_api_shares_one_namespace_with_remote_clients(
hosted_mode: bool,
address: IpAddr,
allowed_hosts: &[String],
) -> Option<&'static str> {
if !address.is_loopback() {
return Some(if hosted_mode {
"the client API is bound to a non-loopback address, and hosted mode does \
not close that: a connection which simply omits `userToken` still lands \
in this node's shared single-user namespace"
} else {
"the client API is bound to a non-loopback address, so any host that can \
route to it can drive this node"
});
}
if hosted_mode {
return None;
}
if !allowed_hosts.is_empty() {
return Some(
"--allowed-host names a reverse proxy in front of this node, and a proxy \
terminates the connection itself, so every visitor arrives looking local \
and the source-IP filters cannot tell them apart",
);
}
None
}
#[inline]
const fn default_ws_api_port() -> u16 {
7509
}
#[derive(clap::Parser, Default, Debug, Clone, Serialize, Deserialize)]
pub struct ConfigPathsArgs {
#[arg(long, default_value = None, env = "CONFIG_DIR")]
pub config_dir: Option<PathBuf>,
#[arg(long, default_value = None, env = "DATA_DIR")]
pub data_dir: Option<PathBuf>,
#[arg(long, default_value = None, env = "LOG_DIR")]
pub log_dir: Option<PathBuf>,
}
impl ConfigPathsArgs {
fn merge(&mut self, other: ConfigPaths) {
self.config_dir.get_or_insert(other.config_dir);
self.data_dir.get_or_insert(other.data_dir);
self.log_dir = self.log_dir.take().or(other.log_dir);
}
fn default_dirs(id: Option<&str>) -> std::io::Result<Either<ProjectDirs, PathBuf>> {
let default_dir: Either<_, _> = if cfg!(any(test, debug_assertions)) || id.is_some() {
let base_name = if let Some(id) = id {
format!("freenet-{id}")
} else {
"freenet".into()
};
let temp_path = std::env::temp_dir().join(&base_name);
if temp_path.exists() && fs::remove_dir_all(&temp_path).is_err() {
let unique_path =
std::env::temp_dir().join(format!("{}-{}", base_name, std::process::id()));
let _cleanup = fs::remove_dir_all(&unique_path);
return Ok(Either::Right(unique_path));
}
Either::Right(temp_path)
} else {
Either::Left(
ProjectDirs::from(QUALIFIER, ORGANIZATION, APPLICATION)
.ok_or(std::io::ErrorKind::NotFound)?,
)
};
Ok(default_dir)
}
pub fn build(self, id: Option<&str>) -> std::io::Result<ConfigPaths> {
#[allow(unused_variables)]
let has_custom_data_dir = self.data_dir.is_some();
let app_data_dir = self
.data_dir
.map(Ok::<_, std::io::Error>)
.unwrap_or_else(|| {
let default_dirs = Self::default_dirs(id)?;
let Either::Left(defaults) = default_dirs else {
unreachable!("default_dirs should return Left if data_dir is None and id is not set for temp dir")
};
Ok(defaults.data_local_dir().to_path_buf())
})?;
#[cfg(target_os = "windows")]
if !has_custom_data_dir && id.is_none() {
if let Ok(Either::Left(ref proj)) = Self::default_dirs(None) {
let old_roaming = proj.data_dir().to_path_buf();
if old_roaming != app_data_dir
&& old_roaming.join("contracts").exists()
&& !app_data_dir.join("contracts").exists()
{
tracing::info!(
old = ?old_roaming,
new = ?app_data_dir,
"Migrating data from Roaming to Local AppData"
);
if let Some(parent) = app_data_dir.parent() {
let _ = fs::create_dir_all(parent);
}
if let Err(e) = fs::rename(&old_roaming, &app_data_dir) {
tracing::warn!(
error = %e,
"Failed to migrate data directory; starting fresh"
);
}
}
}
}
let contracts_dir = app_data_dir.join("contracts");
let delegates_dir = app_data_dir.join("delegates");
let secrets_dir = app_data_dir.join("secrets");
let db_dir = app_data_dir.join("db");
let wasmtime_cache_dir = app_data_dir.join("wasmtime-cache");
if !contracts_dir.exists() {
fs::create_dir_all(&contracts_dir)?;
fs::create_dir_all(contracts_dir.join("local"))?;
}
if !delegates_dir.exists() {
fs::create_dir_all(&delegates_dir)?;
fs::create_dir_all(delegates_dir.join("local"))?;
}
if !secrets_dir.exists() {
fs::create_dir_all(&secrets_dir)?;
fs::create_dir_all(secrets_dir.join("local"))?;
}
if !db_dir.exists() {
fs::create_dir_all(&db_dir)?;
fs::create_dir_all(db_dir.join("local"))?;
}
if !wasmtime_cache_dir.exists() {
fs::create_dir_all(&wasmtime_cache_dir)?;
}
let event_log = app_data_dir.join("_EVENT_LOG");
if !event_log.exists() {
fs::write(&event_log, [])?;
let mut local_file = event_log.clone();
local_file.set_file_name("_EVENT_LOG_LOCAL");
fs::write(local_file, [])?;
}
let config_dir = self
.config_dir
.map(Ok::<_, std::io::Error>)
.unwrap_or_else(|| {
let default_dirs = Self::default_dirs(id)?;
let Either::Left(defaults) = default_dirs else {
unreachable!("default_dirs should return Left if config_dir is None and id is not set for temp dir")
};
Ok(defaults.config_dir().to_path_buf())
})?;
let log_dir = self.log_dir.or_else(get_log_dir);
Ok(ConfigPaths {
config_dir,
data_dir: app_data_dir,
contracts_dir,
delegates_dir,
secrets_dir,
db_dir,
wasmtime_cache_dir,
event_log,
log_dir,
})
}
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ConfigPaths {
#[serde(alias = "contracts-dir")]
contracts_dir: PathBuf,
#[serde(alias = "delegates-dir")]
delegates_dir: PathBuf,
#[serde(alias = "secrets-dir")]
secrets_dir: PathBuf,
#[serde(alias = "db-dir")]
db_dir: PathBuf,
#[serde(alias = "event-log")]
event_log: PathBuf,
#[serde(alias = "data-dir")]
data_dir: PathBuf,
#[serde(alias = "config-dir")]
config_dir: PathBuf,
#[serde(default = "get_log_dir", alias = "log-dir")]
log_dir: Option<PathBuf>,
#[serde(default, alias = "wasmtime-cache-dir")]
wasmtime_cache_dir: PathBuf,
}
impl ConfigPaths {
pub fn db_dir(&self, mode: OperationMode) -> PathBuf {
match mode {
OperationMode::Local => self.db_dir.join("local"),
OperationMode::Network => self.db_dir.to_owned(),
}
}
pub fn with_db_dir(mut self, db_dir: PathBuf) -> Self {
self.db_dir = db_dir;
self
}
pub fn contracts_dir(&self, mode: OperationMode) -> PathBuf {
match mode {
OperationMode::Local => self.contracts_dir.join("local"),
OperationMode::Network => self.contracts_dir.to_owned(),
}
}
pub fn with_contract_dir(mut self, contracts_dir: PathBuf) -> Self {
self.contracts_dir = contracts_dir;
self
}
pub fn delegates_dir(&self, mode: OperationMode) -> PathBuf {
match mode {
OperationMode::Local => self.delegates_dir.join("local"),
OperationMode::Network => self.delegates_dir.to_owned(),
}
}
pub fn with_delegates_dir(mut self, delegates_dir: PathBuf) -> Self {
self.delegates_dir = delegates_dir;
self
}
pub fn config_dir(&self) -> PathBuf {
self.config_dir.clone()
}
pub fn data_dir(&self) -> PathBuf {
self.data_dir.clone()
}
pub fn wasmtime_cache_dir(&self) -> PathBuf {
self.wasmtime_cache_dir.clone()
}
pub fn secrets_dir(&self, mode: OperationMode) -> PathBuf {
match mode {
OperationMode::Local => self.secrets_dir.join("local"),
OperationMode::Network => self.secrets_dir.to_owned(),
}
}
pub fn with_secrets_dir(mut self, secrets_dir: PathBuf) -> Self {
self.secrets_dir = secrets_dir;
self
}
pub fn event_log(&self, mode: OperationMode) -> PathBuf {
match mode {
OperationMode::Local => {
let mut local_file = self.event_log.clone();
local_file.set_file_name("_EVENT_LOG_LOCAL");
local_file
}
OperationMode::Network => self.event_log.to_owned(),
}
}
pub fn log_dir(&self) -> Option<&Path> {
self.log_dir.as_deref()
}
pub fn with_event_log(mut self, event_log: PathBuf) -> Self {
self.event_log = event_log;
self
}
pub fn iter(&self) -> ConfigPathsIter<'_> {
ConfigPathsIter {
curr: 0,
config_paths: self,
}
}
fn path_by_index(&self, index: usize) -> (bool, &PathBuf) {
match index {
0 => (true, &self.contracts_dir),
1 => (true, &self.delegates_dir),
2 => (true, &self.secrets_dir),
3 => (true, &self.db_dir),
4 => (true, &self.data_dir),
5 => (false, &self.event_log),
6 => (true, &self.config_dir),
7 => (true, &self.wasmtime_cache_dir),
_ => panic!("invalid path index"),
}
}
const MAX_PATH_INDEX: usize = 7;
}
pub struct ConfigPathsIter<'a> {
curr: usize,
config_paths: &'a ConfigPaths,
}
impl<'a> Iterator for ConfigPathsIter<'a> {
type Item = (bool, &'a PathBuf);
fn next(&mut self) -> Option<Self::Item> {
if self.curr > ConfigPaths::MAX_PATH_INDEX {
None
} else {
let path = self.config_paths.path_by_index(self.curr);
self.curr += 1;
Some(path)
}
}
fn size_hint(&self) -> (usize, Option<usize>) {
(0, Some(ConfigPaths::MAX_PATH_INDEX))
}
}
impl core::iter::FusedIterator for ConfigPathsIter<'_> {}
impl Config {
pub fn db_dir(&self) -> PathBuf {
self.config_paths.db_dir(self.mode)
}
pub fn contracts_dir(&self) -> PathBuf {
self.config_paths.contracts_dir(self.mode)
}
pub fn wasmtime_cache_dir(&self) -> PathBuf {
self.config_paths.wasmtime_cache_dir()
}
pub fn delegates_dir(&self) -> PathBuf {
self.config_paths.delegates_dir(self.mode)
}
pub fn secrets_dir(&self) -> PathBuf {
self.config_paths.secrets_dir(self.mode)
}
pub fn event_log(&self) -> PathBuf {
self.config_paths.event_log(self.mode)
}
pub fn event_log_enabled(&self) -> bool {
self.enable_event_log
.unwrap_or(matches!(self.mode, OperationMode::Local))
}
pub fn config_dir(&self) -> PathBuf {
self.config_paths.config_dir()
}
pub fn data_dir(&self) -> PathBuf {
self.config_paths.data_dir()
}
}
#[derive(Debug, Serialize, Deserialize, Default)]
struct Gateways {
pub gateways: Vec<GatewayConfig>,
}
impl Gateways {
pub fn merge_and_deduplicate(&mut self, other: Gateways) {
let mut seen: HashSet<Address> = HashSet::new();
let mut merged = Vec::with_capacity(self.gateways.len() + other.gateways.len());
for gw in self.gateways.drain(..).chain(other.gateways) {
if seen.insert(gw.address.clone()) {
merged.push(gw);
}
}
self.gateways = merged;
}
pub fn save_to_file(&self, path: &Path) -> anyhow::Result<()> {
if let Some(parent) = path.parent() {
fs::create_dir_all(parent)?;
}
let content = toml::to_string(self)?;
fs::write(path, content)?;
Ok(())
}
}
fn gateways_dropped_by_remote_replace(
local: &[GatewayConfig],
remote: &[GatewayConfig],
) -> Vec<Address> {
let remote_addrs: HashSet<&Address> = remote.iter().map(|g| &g.address).collect();
local
.iter()
.filter(|g| !remote_addrs.contains(&g.address))
.map(|g| g.address.clone())
.collect()
}
#[derive(Debug, Serialize, Deserialize, Clone)]
pub struct GatewayConfig {
pub address: Address,
#[serde(rename = "public_key", alias = "public-key")]
pub public_key_path: PathBuf,
#[serde(skip_serializing_if = "Option::is_none")]
pub location: Option<f64>,
}
impl PartialEq for GatewayConfig {
fn eq(&self, other: &Self) -> bool {
self.address == other.address
}
}
impl Eq for GatewayConfig {}
impl std::hash::Hash for GatewayConfig {
fn hash<H: std::hash::Hasher>(&self, state: &mut H) {
self.address.hash(state);
}
}
#[derive(Debug, PartialEq, Eq, Hash, Clone)]
pub enum Address {
Host { host: String, port: u16 },
Hostname(String),
HostAddress(SocketAddr),
}
impl Serialize for Address {
fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
where
S: serde::Serializer,
{
use serde::ser::SerializeMap;
match self {
Address::Host { host, port } => {
let mut map = serializer.serialize_map(Some(2))?;
map.serialize_entry("host", host)?;
map.serialize_entry("port", port)?;
map.end()
}
Address::Hostname(hostname) => {
let mut map = serializer.serialize_map(Some(1))?;
map.serialize_entry("hostname", hostname)?;
map.end()
}
Address::HostAddress(addr) => {
let mut map = serializer.serialize_map(Some(1))?;
map.serialize_entry("host_address", &addr.to_string())?;
map.end()
}
}
}
}
impl<'de> Deserialize<'de> for Address {
fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
where
D: serde::Deserializer<'de>,
{
#[derive(Deserialize)]
struct AddressRepr {
host: Option<String>,
port: Option<u16>,
hostname: Option<String>,
#[serde(alias = "host-address")]
host_address: Option<SocketAddr>,
}
let repr = AddressRepr::deserialize(deserializer)?;
if repr.port.is_some() && repr.host.is_none() {
return Err(serde::de::Error::custom(
"gateway address `port` is only valid together with `host`; \
for the legacy single-string form put the port inside `hostname` \
(e.g. hostname = \"example.com:31337\")",
));
}
match (repr.host, repr.hostname, repr.host_address) {
(Some(host), None, None) => Ok(Address::Host {
host,
port: repr.port.unwrap_or(DEFAULT_GATEWAY_PORT),
}),
(None, Some(hostname), None) => Ok(Address::Hostname(hostname)),
(None, None, Some(addr)) => Ok(Address::HostAddress(addr)),
(None, None, None) => Err(serde::de::Error::custom(
"gateway address must specify one of `host`, `hostname`, or `host_address`",
)),
_ => Err(serde::de::Error::custom(
"gateway address must specify exactly one of `host`, `hostname`, or `host_address`",
)),
}
}
}
pub struct GlobalExecutor;
impl GlobalExecutor {
pub(crate) fn initialize_async_rt() -> Option<Runtime> {
if tokio::runtime::Handle::try_current().is_ok() {
tracing::debug!(target: "freenet::diagnostics::thread_explosion", "GlobalExecutor: runtime exists");
None
} else {
tracing::warn!(target: "freenet::diagnostics::thread_explosion", "GlobalExecutor: Creating fallback runtime");
let mut builder = tokio::runtime::Builder::new_multi_thread();
builder.enable_all().thread_name("freenet-node");
if cfg!(debug_assertions) {
builder.worker_threads(2).max_blocking_threads(2);
}
Some(builder.build().expect("failed to build tokio runtime"))
}
}
#[inline]
pub fn spawn<R: Send + 'static>(
f: impl Future<Output = R> + Send + 'static,
) -> tokio::task::JoinHandle<R> {
if let Ok(handle) = tokio::runtime::Handle::try_current() {
handle.spawn(f)
} else if let Some(rt) = &*ASYNC_RT {
tracing::warn!(target: "freenet::diagnostics::thread_explosion", "GlobalExecutor::spawn using fallback");
rt.spawn(f)
} else {
unreachable!("ASYNC_RT should be initialized if Handle::try_current fails")
}
}
}
use rand::rngs::SmallRng;
use rand::{Rng, RngCore, SeedableRng};
static THREAD_INDEX_COUNTER: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
std::thread_local! {
static THREAD_RNG: std::cell::RefCell<Option<SmallRng>> = const { std::cell::RefCell::new(None) };
static THREAD_INDEX: std::cell::Cell<Option<u64>> = const { std::cell::Cell::new(None) };
static THREAD_SEED: std::cell::Cell<Option<u64>> = const { std::cell::Cell::new(None) };
}
pub struct GlobalRng;
pub struct SeedGuard {
_private: (),
}
impl Drop for SeedGuard {
fn drop(&mut self) {
GlobalRng::clear_seed();
}
}
impl GlobalRng {
pub fn set_seed(seed: u64) {
THREAD_SEED.with(|s| s.set(Some(seed)));
THREAD_RNG.with(|rng| {
*rng.borrow_mut() = None;
});
THREAD_INDEX.with(|idx| idx.set(Some(0)));
}
pub fn clear_seed() {
THREAD_SEED.with(|s| s.set(None));
THREAD_RNG.with(|rng| {
*rng.borrow_mut() = None;
});
THREAD_INDEX.with(|idx| idx.set(None));
}
pub fn thread_index() -> u64 {
THREAD_INDEX.with(|c| match c.get() {
Some(idx) => idx,
None => {
let idx = THREAD_INDEX_COUNTER.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
c.set(Some(idx));
idx
}
})
}
pub fn is_seeded() -> bool {
THREAD_SEED.with(|s| s.get()).is_some()
}
pub fn seed_guard(seed: u64) -> SeedGuard {
Self::set_seed(seed);
SeedGuard { _private: () }
}
pub fn scoped_seed<F, R>(seed: u64, f: F) -> R
where
F: FnOnce() -> R,
{
let _guard = Self::seed_guard(seed);
f()
}
#[inline]
pub fn with_rng<F, R>(f: F) -> R
where
F: FnOnce(&mut dyn RngCore) -> R,
{
let seed = THREAD_SEED.with(|s| s.get());
if let Some(seed) = seed {
THREAD_RNG.with(|rng_cell| {
let mut rng_ref = rng_cell.borrow_mut();
if rng_ref.is_none() {
let thread_seed =
seed.wrapping_add(Self::thread_index().wrapping_mul(0x9E3779B97F4A7C15));
*rng_ref = Some(SmallRng::seed_from_u64(thread_seed));
}
f(rng_ref.as_mut().unwrap())
})
} else {
f(&mut rand::rng())
}
}
#[inline]
pub fn random_range<T, R>(range: R) -> T
where
T: rand::distr::uniform::SampleUniform,
R: rand::distr::uniform::SampleRange<T>,
{
Self::with_rng(|rng| rng.random_range(range))
}
#[inline]
pub fn random_bool(probability: f64) -> bool {
Self::with_rng(|rng| rng.random_bool(probability))
}
#[inline]
pub fn choose<T>(slice: &[T]) -> Option<&T> {
if slice.is_empty() {
None
} else {
let idx = Self::random_range(0..slice.len());
Some(&slice[idx])
}
}
#[inline]
pub fn shuffle<T>(slice: &mut [T]) {
Self::with_rng(|rng| {
use rand::seq::SliceRandom;
slice.shuffle(rng);
})
}
#[inline]
pub fn fill_bytes(dest: &mut [u8]) {
Self::with_rng(|rng| rng.fill_bytes(dest))
}
#[inline]
pub fn random_u64() -> u64 {
Self::with_rng(|rng| rng.random())
}
#[inline]
pub fn random_u32() -> u32 {
Self::with_rng(|rng| rng.random())
}
}
std::thread_local! {
static SIMULATION_TIME_MS: std::cell::Cell<Option<u64>> = const { std::cell::Cell::new(None) };
static SIMULATION_TIME_COUNTER: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
}
pub struct GlobalSimulationTime;
impl GlobalSimulationTime {
pub fn set_time_ms(time_ms: u64) {
SIMULATION_TIME_MS.with(|t| t.set(Some(time_ms)));
SIMULATION_TIME_COUNTER.with(|c| c.set(0));
}
pub fn clear_time() {
SIMULATION_TIME_MS.with(|t| t.set(None));
SIMULATION_TIME_COUNTER.with(|c| c.set(0));
}
pub fn current_time_ms() -> u64 {
SIMULATION_TIME_MS.with(|t| {
if let Some(base_time) = t.get() {
let counter = SIMULATION_TIME_COUNTER.with(|c| {
let val = c.get();
c.set(val + 1);
val
});
base_time.saturating_add(counter)
} else {
use std::time::{SystemTime, UNIX_EPOCH};
SystemTime::now()
.duration_since(UNIX_EPOCH)
.expect("system time before unix epoch")
.as_millis() as u64
}
})
}
pub fn read_time_ms() -> u64 {
SIMULATION_TIME_MS.with(|t| {
if let Some(base_time) = t.get() {
let counter = SIMULATION_TIME_COUNTER.with(|c| c.get());
base_time.saturating_add(counter)
} else {
use std::time::{SystemTime, UNIX_EPOCH};
SystemTime::now()
.duration_since(UNIX_EPOCH)
.expect("system time before unix epoch")
.as_millis() as u64
}
})
}
pub fn is_simulation_time() -> bool {
SIMULATION_TIME_MS.with(|t| t.get().is_some())
}
pub fn new_ulid() -> ulid::Ulid {
use ulid::Ulid;
if GlobalRng::is_seeded() || Self::is_simulation_time() {
let timestamp_ms = Self::current_time_ms();
let mut random_bytes = [0u8; 10];
GlobalRng::fill_bytes(&mut random_bytes);
let ts = (timestamp_ms as u128) << 80;
let rand_high = (random_bytes[0] as u128) << 72;
let rand_mid = u64::from_be_bytes([
random_bytes[1],
random_bytes[2],
random_bytes[3],
random_bytes[4],
random_bytes[5],
random_bytes[6],
random_bytes[7],
random_bytes[8],
]) as u128;
let rand_low = (random_bytes[9] as u128) << 56;
let ulid_value = ts | rand_high | (rand_mid << 8) | rand_low;
Ulid(ulid_value)
} else {
Ulid::new()
}
}
}
std::thread_local! {
static SIMULATION_TRANSPORT_OPT: std::cell::Cell<bool> = const { std::cell::Cell::new(false) };
static SIMULATION_IDLE_TIMEOUT: std::cell::Cell<bool> = const { std::cell::Cell::new(false) };
}
pub struct SimulationTransportOpt;
impl SimulationTransportOpt {
pub fn enable() {
SIMULATION_TRANSPORT_OPT.with(|f| f.set(true));
}
pub fn disable() {
SIMULATION_TRANSPORT_OPT.with(|f| f.set(false));
}
pub fn is_enabled() -> bool {
SIMULATION_TRANSPORT_OPT.with(|f| f.get())
}
}
pub struct SimulationIdleTimeout;
impl SimulationIdleTimeout {
pub fn enable() {
SIMULATION_IDLE_TIMEOUT.with(|f| f.set(true));
}
pub fn disable() {
SIMULATION_IDLE_TIMEOUT.with(|f| f.set(false));
}
pub fn is_enabled() -> bool {
SIMULATION_IDLE_TIMEOUT.with(|f| f.get())
}
}
std::thread_local! {
static GLOBAL_RESYNC_REQUESTS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_DELTA_SENDS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_FANOUT_SUMMARY_SKIPS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_BROADCAST_TARGETS_SUPPRESSED: std::cell::Cell<u64> =
const { std::cell::Cell::new(0) };
static GLOBAL_BROADCAST_SENDER_SKIPS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_BROADCAST_DELIVERIES: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_REDUNDANT_BROADCAST_DELIVERIES: std::cell::Cell<u64> =
const { std::cell::Cell::new(0) };
static GLOBAL_FULL_STATE_SENDS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_PENDING_OP_INSERTS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_PENDING_OP_REMOVES: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_PENDING_OP_HWM: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_NEIGHBOR_HOSTING_UPDATES: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_NOTIFICATION_COHOSTS_SKIPPED: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_NOTIFICATION_TARGETS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_NEIGHBOR_HOSTING_RETRACTIONS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_ANTI_STARVATION_TRIGGERS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_TERMINAL_CONSULT_ATTEMPTS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_TERMINAL_CONSULT_HITS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_TERMINAL_CONSULT_RESOLVED_FOUND: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_TERMINAL_CONSULT_STILL_NOT_FOUND: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_PUT_PROBE_NEW_CONTRACT_COUNT: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_PUT_PROBE_NEW_CONTRACT_BYTES: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_PUT_PROBE_EXISTING_MESH_DELTA_COUNT: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_PUT_PROBE_EXISTING_MESH_DELTA_BYTES: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_MERGES_SUPPRESSED_BY_BACKOFF: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_RESYNC_REQUESTS_SUPPRESSED: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_RESYNC_RESPONSES_SUPPRESSED_PER_PEER: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_RESYNC_RESPONSES_SUPPRESSED_GLOBAL: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_RESYNC_RESPONSES_UNSOLICITED: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_SUMMARY_DIGEST_MSGS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_SUMMARY_FULL_MSGS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_SUMMARY_FULL_BYTES: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_SUMMARY_CACHE_PEAK: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_SUMMARY_AGREE_SINGLE: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_SUMMARY_AGREE_MULTI: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_SUMMARY_MISMATCH_SINGLE: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_SUMMARY_MISMATCH_MULTI: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
static GLOBAL_SUMMARY_BYTE_REQUESTS: std::cell::Cell<u64> = const { std::cell::Cell::new(0) };
}
pub struct GlobalTestMetrics;
impl GlobalTestMetrics {
pub fn reset() {
GLOBAL_RESYNC_REQUESTS.with(|c| c.set(0));
GLOBAL_DELTA_SENDS.with(|c| c.set(0));
GLOBAL_FANOUT_SUMMARY_SKIPS.with(|c| c.set(0));
GLOBAL_BROADCAST_TARGETS_SUPPRESSED.with(|c| c.set(0));
GLOBAL_BROADCAST_SENDER_SKIPS.with(|c| c.set(0));
GLOBAL_BROADCAST_DELIVERIES.with(|c| c.set(0));
GLOBAL_REDUNDANT_BROADCAST_DELIVERIES.with(|c| c.set(0));
GLOBAL_FULL_STATE_SENDS.with(|c| c.set(0));
GLOBAL_PENDING_OP_INSERTS.with(|c| c.set(0));
GLOBAL_PENDING_OP_REMOVES.with(|c| c.set(0));
GLOBAL_PENDING_OP_HWM.with(|c| c.set(0));
GLOBAL_NEIGHBOR_HOSTING_UPDATES.with(|c| c.set(0));
GLOBAL_NOTIFICATION_COHOSTS_SKIPPED.with(|c| c.set(0));
GLOBAL_NOTIFICATION_TARGETS.with(|c| c.set(0));
GLOBAL_NEIGHBOR_HOSTING_RETRACTIONS.with(|c| c.set(0));
GLOBAL_ANTI_STARVATION_TRIGGERS.with(|c| c.set(0));
GLOBAL_TERMINAL_CONSULT_ATTEMPTS.with(|c| c.set(0));
GLOBAL_TERMINAL_CONSULT_HITS.with(|c| c.set(0));
GLOBAL_TERMINAL_CONSULT_RESOLVED_FOUND.with(|c| c.set(0));
GLOBAL_TERMINAL_CONSULT_STILL_NOT_FOUND.with(|c| c.set(0));
GLOBAL_PUT_PROBE_NEW_CONTRACT_COUNT.with(|c| c.set(0));
GLOBAL_PUT_PROBE_NEW_CONTRACT_BYTES.with(|c| c.set(0));
GLOBAL_PUT_PROBE_EXISTING_MESH_DELTA_COUNT.with(|c| c.set(0));
GLOBAL_PUT_PROBE_EXISTING_MESH_DELTA_BYTES.with(|c| c.set(0));
GLOBAL_MERGES_SUPPRESSED_BY_BACKOFF.with(|c| c.set(0));
GLOBAL_RESYNC_REQUESTS_SUPPRESSED.with(|c| c.set(0));
GLOBAL_RESYNC_RESPONSES_SUPPRESSED_PER_PEER.with(|c| c.set(0));
GLOBAL_RESYNC_RESPONSES_SUPPRESSED_GLOBAL.with(|c| c.set(0));
GLOBAL_RESYNC_RESPONSES_UNSOLICITED.with(|c| c.set(0));
GLOBAL_SUMMARY_DIGEST_MSGS.with(|c| c.set(0));
GLOBAL_SUMMARY_FULL_MSGS.with(|c| c.set(0));
GLOBAL_SUMMARY_FULL_BYTES.with(|c| c.set(0));
GLOBAL_SUMMARY_CACHE_PEAK.with(|c| c.set(0));
GLOBAL_SUMMARY_AGREE_SINGLE.with(|c| c.set(0));
GLOBAL_SUMMARY_AGREE_MULTI.with(|c| c.set(0));
GLOBAL_SUMMARY_MISMATCH_SINGLE.with(|c| c.set(0));
GLOBAL_SUMMARY_MISMATCH_MULTI.with(|c| c.set(0));
GLOBAL_SUMMARY_BYTE_REQUESTS.with(|c| c.set(0));
}
pub fn record_resync_request() {
GLOBAL_RESYNC_REQUESTS.with(|c| c.set(c.get() + 1));
}
pub fn resync_requests() -> u64 {
GLOBAL_RESYNC_REQUESTS.with(|c| c.get())
}
pub fn record_merge_suppressed_by_backoff() {
GLOBAL_MERGES_SUPPRESSED_BY_BACKOFF.with(|c| c.set(c.get() + 1));
}
pub fn merges_suppressed_by_backoff() -> u64 {
GLOBAL_MERGES_SUPPRESSED_BY_BACKOFF.with(|c| c.get())
}
pub fn record_resync_request_suppressed() {
GLOBAL_RESYNC_REQUESTS_SUPPRESSED.with(|c| c.set(c.get() + 1));
}
pub fn resync_requests_suppressed() -> u64 {
GLOBAL_RESYNC_REQUESTS_SUPPRESSED.with(|c| c.get())
}
pub fn record_resync_response_suppressed_per_peer() {
GLOBAL_RESYNC_RESPONSES_SUPPRESSED_PER_PEER.with(|c| c.set(c.get() + 1));
}
pub fn record_resync_response_suppressed_global() {
GLOBAL_RESYNC_RESPONSES_SUPPRESSED_GLOBAL.with(|c| c.set(c.get() + 1));
}
pub fn resync_responses_suppressed_per_peer() -> u64 {
GLOBAL_RESYNC_RESPONSES_SUPPRESSED_PER_PEER.with(|c| c.get())
}
pub fn resync_responses_suppressed_global() -> u64 {
GLOBAL_RESYNC_RESPONSES_SUPPRESSED_GLOBAL.with(|c| c.get())
}
pub fn record_resync_response_unsolicited() {
GLOBAL_RESYNC_RESPONSES_UNSOLICITED.with(|c| c.set(c.get() + 1));
}
pub fn resync_responses_unsolicited() -> u64 {
GLOBAL_RESYNC_RESPONSES_UNSOLICITED.with(|c| c.get())
}
pub fn resync_responses_suppressed() -> u64 {
Self::resync_responses_suppressed_per_peer() + Self::resync_responses_suppressed_global()
}
pub fn record_fanout_summary_skip() {
GLOBAL_FANOUT_SUMMARY_SKIPS.with(|c| c.set(c.get() + 1));
}
pub fn fanout_summary_skips() -> u64 {
GLOBAL_FANOUT_SUMMARY_SKIPS.with(|c| c.get())
}
pub fn record_broadcast_target_suppressed() {
GLOBAL_BROADCAST_TARGETS_SUPPRESSED.with(|c| c.set(c.get() + 1));
}
pub fn record_broadcast_sender_skipped() {
GLOBAL_BROADCAST_SENDER_SKIPS.with(|c| c.set(c.get() + 1));
}
pub fn broadcast_sender_skips() -> u64 {
GLOBAL_BROADCAST_SENDER_SKIPS.with(|c| c.get())
}
pub fn broadcast_targets_suppressed() -> u64 {
GLOBAL_BROADCAST_TARGETS_SUPPRESSED.with(|c| c.get())
}
pub fn record_broadcast_delivery(redundant: bool) {
GLOBAL_BROADCAST_DELIVERIES.with(|c| c.set(c.get() + 1));
if redundant {
GLOBAL_REDUNDANT_BROADCAST_DELIVERIES.with(|c| c.set(c.get() + 1));
}
}
pub fn broadcast_deliveries() -> u64 {
GLOBAL_BROADCAST_DELIVERIES.with(|c| c.get())
}
pub fn redundant_broadcast_deliveries() -> u64 {
GLOBAL_REDUNDANT_BROADCAST_DELIVERIES.with(|c| c.get())
}
pub fn record_delta_send() {
GLOBAL_DELTA_SENDS.with(|c| c.set(c.get() + 1));
}
pub fn delta_sends() -> u64 {
GLOBAL_DELTA_SENDS.with(|c| c.get())
}
pub fn record_full_state_send() {
GLOBAL_FULL_STATE_SENDS.with(|c| c.set(c.get() + 1));
}
pub fn full_state_sends() -> u64 {
GLOBAL_FULL_STATE_SENDS.with(|c| c.get())
}
pub fn record_pending_op_insert() {
GLOBAL_PENDING_OP_INSERTS.with(|c| c.set(c.get() + 1));
}
pub fn pending_op_inserts() -> u64 {
GLOBAL_PENDING_OP_INSERTS.with(|c| c.get())
}
pub fn record_pending_op_remove() {
GLOBAL_PENDING_OP_REMOVES.with(|c| c.set(c.get() + 1));
}
pub fn pending_op_removes() -> u64 {
GLOBAL_PENDING_OP_REMOVES.with(|c| c.get())
}
pub fn record_pending_op_size(len: u64) {
GLOBAL_PENDING_OP_HWM.with(|c| c.set(c.get().max(len)));
}
pub fn pending_op_high_water_mark() -> u64 {
GLOBAL_PENDING_OP_HWM.with(|c| c.get())
}
pub fn record_neighbor_hosting_update() {
GLOBAL_NEIGHBOR_HOSTING_UPDATES.with(|c| c.set(c.get() + 1));
}
pub fn neighbor_hosting_updates() -> u64 {
GLOBAL_NEIGHBOR_HOSTING_UPDATES.with(|c| c.get())
}
pub fn record_notification_cohosts_skipped(n: u64) {
GLOBAL_NOTIFICATION_COHOSTS_SKIPPED.with(|c| c.set(c.get() + n));
}
pub fn notification_cohosts_skipped() -> u64 {
GLOBAL_NOTIFICATION_COHOSTS_SKIPPED.with(|c| c.get())
}
pub fn record_notification_targets(n: u64) {
GLOBAL_NOTIFICATION_TARGETS.with(|c| c.set(c.get() + n));
}
pub fn notification_targets() -> u64 {
GLOBAL_NOTIFICATION_TARGETS.with(|c| c.get())
}
pub fn record_neighbor_hosting_retraction() {
GLOBAL_NEIGHBOR_HOSTING_RETRACTIONS.with(|c| c.set(c.get() + 1));
}
pub fn neighbor_hosting_retractions() -> u64 {
GLOBAL_NEIGHBOR_HOSTING_RETRACTIONS.with(|c| c.get())
}
pub fn record_anti_starvation_trigger() {
GLOBAL_ANTI_STARVATION_TRIGGERS.with(|c| c.set(c.get() + 1));
}
pub fn anti_starvation_triggers() -> u64 {
GLOBAL_ANTI_STARVATION_TRIGGERS.with(|c| c.get())
}
pub fn record_terminal_consult_attempt() {
GLOBAL_TERMINAL_CONSULT_ATTEMPTS.with(|c| c.set(c.get() + 1));
}
pub fn terminal_consult_attempts() -> u64 {
GLOBAL_TERMINAL_CONSULT_ATTEMPTS.with(|c| c.get())
}
pub fn record_terminal_consult_hit() {
GLOBAL_TERMINAL_CONSULT_HITS.with(|c| c.set(c.get() + 1));
}
pub fn terminal_consult_hits() -> u64 {
GLOBAL_TERMINAL_CONSULT_HITS.with(|c| c.get())
}
pub fn record_terminal_consult_resolved_found() {
GLOBAL_TERMINAL_CONSULT_RESOLVED_FOUND.with(|c| c.set(c.get() + 1));
}
pub fn terminal_consult_resolved_found() -> u64 {
GLOBAL_TERMINAL_CONSULT_RESOLVED_FOUND.with(|c| c.get())
}
pub fn record_terminal_consult_still_not_found() {
GLOBAL_TERMINAL_CONSULT_STILL_NOT_FOUND.with(|c| c.set(c.get() + 1));
}
pub fn terminal_consult_still_not_found() -> u64 {
GLOBAL_TERMINAL_CONSULT_STILL_NOT_FOUND.with(|c| c.get())
}
pub fn record_put_probe_new_contract(bytes: u64) {
GLOBAL_PUT_PROBE_NEW_CONTRACT_COUNT.with(|c| c.set(c.get() + 1));
GLOBAL_PUT_PROBE_NEW_CONTRACT_BYTES.with(|c| c.set(c.get() + bytes));
}
pub fn put_probe_new_contract_sends() -> u64 {
GLOBAL_PUT_PROBE_NEW_CONTRACT_COUNT.with(|c| c.get())
}
pub fn put_probe_new_contract_bytes() -> u64 {
GLOBAL_PUT_PROBE_NEW_CONTRACT_BYTES.with(|c| c.get())
}
pub fn record_put_probe_existing_mesh_delta(bytes: u64) {
GLOBAL_PUT_PROBE_EXISTING_MESH_DELTA_COUNT.with(|c| c.set(c.get() + 1));
GLOBAL_PUT_PROBE_EXISTING_MESH_DELTA_BYTES.with(|c| c.set(c.get() + bytes));
}
pub fn put_probe_existing_mesh_delta_sends() -> u64 {
GLOBAL_PUT_PROBE_EXISTING_MESH_DELTA_COUNT.with(|c| c.get())
}
pub fn put_probe_existing_mesh_delta_bytes() -> u64 {
GLOBAL_PUT_PROBE_EXISTING_MESH_DELTA_BYTES.with(|c| c.get())
}
pub fn record_summary_digest_msg() {
GLOBAL_SUMMARY_DIGEST_MSGS.with(|c| c.set(c.get() + 1));
}
pub fn record_summary_full_msg(bytes: u64) {
GLOBAL_SUMMARY_FULL_MSGS.with(|c| c.set(c.get() + 1));
GLOBAL_SUMMARY_FULL_BYTES.with(|c| c.set(c.get() + bytes));
}
pub fn note_summary_cache_size(len: usize) {
GLOBAL_SUMMARY_CACHE_PEAK.with(|c| c.set(c.get().max(len as u64)));
}
pub fn summary_cache_peak() -> u64 {
GLOBAL_SUMMARY_CACHE_PEAK.with(|c| c.get())
}
pub fn record_summary_digest_agreement(single_entry: bool) {
if single_entry {
GLOBAL_SUMMARY_AGREE_SINGLE.with(|c| c.set(c.get() + 1));
} else {
GLOBAL_SUMMARY_AGREE_MULTI.with(|c| c.set(c.get() + 1));
}
}
pub fn record_summary_digest_mismatch(single_entry: bool) {
if single_entry {
GLOBAL_SUMMARY_MISMATCH_SINGLE.with(|c| c.set(c.get() + 1));
} else {
GLOBAL_SUMMARY_MISMATCH_MULTI.with(|c| c.set(c.get() + 1));
}
}
pub fn summary_digest_agreements_single() -> u64 {
GLOBAL_SUMMARY_AGREE_SINGLE.with(|c| c.get())
}
pub fn summary_digest_agreements_multi() -> u64 {
GLOBAL_SUMMARY_AGREE_MULTI.with(|c| c.get())
}
pub fn summary_digest_mismatches_single() -> u64 {
GLOBAL_SUMMARY_MISMATCH_SINGLE.with(|c| c.get())
}
pub fn summary_digest_mismatches_multi() -> u64 {
GLOBAL_SUMMARY_MISMATCH_MULTI.with(|c| c.get())
}
pub fn summary_digest_agreements() -> u64 {
Self::summary_digest_agreements_single() + Self::summary_digest_agreements_multi()
}
pub fn record_summary_byte_request() {
GLOBAL_SUMMARY_BYTE_REQUESTS.with(|c| c.set(c.get() + 1));
}
pub fn summary_digest_msgs() -> u64 {
GLOBAL_SUMMARY_DIGEST_MSGS.with(|c| c.get())
}
pub fn summary_full_msgs() -> u64 {
GLOBAL_SUMMARY_FULL_MSGS.with(|c| c.get())
}
pub fn summary_full_bytes() -> u64 {
GLOBAL_SUMMARY_FULL_BYTES.with(|c| c.get())
}
pub fn summary_byte_requests() -> u64 {
GLOBAL_SUMMARY_BYTE_REQUESTS.with(|c| c.get())
}
}
pub fn set_logger(
level: Option<tracing::level_filters::LevelFilter>,
endpoint: Option<String>,
log_dir: Option<&Path>,
) {
#[cfg(feature = "trace")]
{
static LOGGER_SET: AtomicBool = AtomicBool::new(false);
if LOGGER_SET
.compare_exchange(
false,
true,
std::sync::atomic::Ordering::Release,
std::sync::atomic::Ordering::SeqCst,
)
.is_err()
{
return;
}
crate::tracing::tracer::init_tracer(level, endpoint, log_dir)
.expect("failed tracing initialization")
}
}
async fn load_gateways_from_index(url: &str, pub_keys_dir: &Path) -> anyhow::Result<Gateways> {
let client = reqwest::Client::builder()
.connect_timeout(std::time::Duration::from_secs(10))
.timeout(std::time::Duration::from_secs(30))
.build()?;
let response = client
.get(url)
.send()
.await?
.error_for_status()?
.text()
.await?;
let mut gateways: Gateways = parse_gateways_toml(&response, url)?;
let mut base_url = reqwest::Url::parse(url)?;
base_url.set_path("");
let mut valid_gateways = Vec::new();
for gateway in &mut gateways.gateways {
gateway.location = None; let public_key_url = base_url.join(&gateway.public_key_path.to_string_lossy())?;
let public_key_response = client
.get(public_key_url)
.send()
.await?
.error_for_status()?;
let file_name = gateway
.public_key_path
.file_name()
.ok_or_else(|| anyhow::anyhow!("Invalid public key path"))?;
let local_path = pub_keys_dir.join(file_name);
let mut public_key_file = File::create(&local_path)?;
let content = public_key_response.bytes().await?;
std::io::copy(&mut content.as_ref(), &mut public_key_file)?;
let mut key_file = File::open(&local_path).with_context(|| {
format!(
"failed loading gateway pubkey from {:?}",
gateway.public_key_path
)
})?;
let mut buf = String::new();
key_file.read_to_string(&mut buf)?;
let buf = buf.trim();
if buf.starts_with("-----BEGIN") {
tracing::warn!(
public_key_path = ?gateway.public_key_path,
"Gateway uses legacy RSA PEM public key format. \
Gateway needs to be updated to X25519 format. Skipping."
);
continue;
}
if let Ok(key_bytes) = hex::decode(buf) {
if key_bytes.len() == 32 {
gateway.public_key_path = local_path;
valid_gateways.push(gateway.clone());
} else {
tracing::warn!(
public_key_path = ?gateway.public_key_path,
"Invalid public key length {} (expected 32), ignoring",
key_bytes.len()
);
}
} else {
tracing::warn!(
public_key_path = ?gateway.public_key_path,
"Invalid public key hex encoding in remote gateway file, ignoring"
);
}
}
gateways.gateways = valid_gateways;
Ok(gateways)
}
#[cfg(test)]
mod tests {
use httptest::{Expectation, Server, matchers::*, responders::*};
use std::collections::BTreeSet;
use crate::node::NodeConfig;
use crate::transport::TransportKeypair;
use super::*;
const RELEASED_CONFIG_TOML: &str = r#"
mode = "network"
network-address = "0.0.0.0"
network-port = 31338
public_network_address = "203.0.113.7"
public_port = 31339
bandwidth_limit = 3000001
total_bandwidth_limit = 2000002
min_bandwidth_per_connection = 250003
blocked_addresses = ["198.51.100.9:1234"]
event_loop_channel_capacity = 4096
transient-budget = 1024
transient-ttl-secs = 45
min-number-of-connections = 25
max-number-of-connections = 200
streaming-threshold = 65537
ledbat-min-ssthresh = 102401
congestion-control = "bbr"
bbr-startup-rate = 12345678
skip_load_from_network = true
ws-api-address = "127.0.0.1"
ws-api-port = 7510
token-ttl-seconds = 86401
token-cleanup-interval-seconds = 301
allowed-host = ["example.invalid"]
allowed-source-cidrs = ["100.64.0.0/10"]
hosted-mode = true
per-user-op-rate-limit = 11
per-user-op-burst = 101
per-user-export-min-interval-secs = 12
transport_keypair = "/tmp/freenet-5124/secrets/transport_keypair"
nonce = "/tmp/freenet-5124/secrets/nonce"
cipher = "/tmp/freenet-5124/secrets/delegate_cipher"
log_level = "debug"
contracts_dir = "/tmp/freenet-5124/contracts"
delegates_dir = "/tmp/freenet-5124/delegates"
secrets_dir = "/tmp/freenet-5124/secrets"
db_dir = "/tmp/freenet-5124/db"
event_log = "/tmp/freenet-5124/_EVENT_LOG"
data_dir = "/tmp/freenet-5124"
config_dir = "/tmp/freenet-5124/config"
log_dir = "/tmp/freenet-5124/logs"
wasmtime_cache_dir = "/tmp/freenet-5124/wasmtime-cache"
is_gateway = true
location = 0.25
max_blocking_threads = 17
max-hosting-storage = 12345678
hosting-disk-pct = 0.25
max-hosting-disk = 23456789
per-user-secret-quota = 4194305
per-user-inactive-ttl = 2592001
inactive-user-sweep-interval = 3601
module-cache-budget-bytes = 4294967296
enable-event-log = true
telemetry-enabled = true
telemetry-endpoint = "http://127.0.0.1:14318"
transport-snapshot-interval-secs = 31
reference-ping-enabled = true
iface-tx-enabled = true
shutdown-drain-secs = 42
"#;
fn kebab_config_toml() -> String {
let mut doc = RELEASED_CONFIG_TOML.to_string();
for (underscored, kebab) in CONFIG_KEY_SPELLINGS.iter().map(|g| (g[0], g[1])) {
let from = format!("\n{underscored} = ");
let to = format!("\n{kebab} = ");
assert!(
doc.contains(&from),
"RELEASED_CONFIG_TOML is missing the `{underscored}` key that \
CONFIG_KEY_SPELLINGS pairs with `{kebab}`"
);
assert_ne!(from, to, "group `{underscored}` rewrites to itself");
doc = doc.replace(&from, &to);
}
assert_ne!(
doc, RELEASED_CONFIG_TOML,
"the kebab fixture is a byte copy of the released one, so every \
test built on it is vacuous"
);
doc
}
fn assert_seeded_values_bound(cfg: &Config) {
assert_seeded_values_bound_except_secrets(cfg);
assert_eq!(
cfg.secrets.transport_keypair_path.as_deref(),
Some(Path::new("/tmp/freenet-5124/secrets/transport_keypair"))
);
assert_eq!(
cfg.secrets.nonce_path.as_deref(),
Some(Path::new("/tmp/freenet-5124/secrets/nonce"))
);
assert_eq!(
cfg.secrets.cipher_path.as_deref(),
Some(Path::new("/tmp/freenet-5124/secrets/delegate_cipher"))
);
}
fn assert_seeded_values_bound_except_secrets(cfg: &Config) {
assert_eq!(
cfg.network_api.public_address,
Some("203.0.113.7".parse::<IpAddr>().unwrap())
);
assert_eq!(cfg.network_api.public_port, Some(31339));
assert_eq!(cfg.network_api.bandwidth_limit, Some(3_000_001));
assert_eq!(cfg.network_api.total_bandwidth_limit, Some(2_000_002));
assert_eq!(cfg.network_api.min_bandwidth_per_connection, Some(250_003));
assert_eq!(
cfg.network_api.blocked_addresses,
Some(HashSet::from(["198.51.100.9:1234".parse().unwrap()]))
);
assert_eq!(cfg.network_api.event_loop_channel_capacity, 4096);
assert!(cfg.network_api.skip_load_from_network);
assert_eq!(cfg.log_level, tracing::log::LevelFilter::Debug);
assert_eq!(
cfg.config_paths.contracts_dir,
PathBuf::from("/tmp/freenet-5124/contracts")
);
assert_eq!(
cfg.config_paths.delegates_dir,
PathBuf::from("/tmp/freenet-5124/delegates")
);
assert_eq!(
cfg.config_paths.secrets_dir,
PathBuf::from("/tmp/freenet-5124/secrets")
);
assert_eq!(
cfg.config_paths.db_dir,
PathBuf::from("/tmp/freenet-5124/db")
);
assert_eq!(
cfg.config_paths.event_log,
PathBuf::from("/tmp/freenet-5124/_EVENT_LOG")
);
assert_eq!(
cfg.config_paths.data_dir,
PathBuf::from("/tmp/freenet-5124")
);
assert_eq!(
cfg.config_paths.config_dir,
PathBuf::from("/tmp/freenet-5124/config")
);
assert_eq!(
cfg.config_paths.log_dir,
Some(PathBuf::from("/tmp/freenet-5124/logs"))
);
assert_eq!(
cfg.config_paths.wasmtime_cache_dir,
PathBuf::from("/tmp/freenet-5124/wasmtime-cache")
);
assert!(cfg.is_gateway);
assert_eq!(cfg.max_blocking_threads, 17);
assert_eq!(cfg.network_api.congestion_control, "bbr");
assert_eq!(cfg.ws_api.per_user_op_burst, 101);
assert_eq!(cfg.shutdown_drain_secs, 42);
}
#[test]
fn kebab_case_config_toml_keys_are_accepted() {
let cfg: Config = toml::from_str(&kebab_config_toml())
.expect("every config.toml key must be accepted in kebab-case");
assert_seeded_values_bound(&cfg);
}
#[test]
fn released_underscored_config_toml_keys_still_bind() {
let cfg: Config = toml::from_str(RELEASED_CONFIG_TOML)
.expect("a config.toml written by any release must still parse");
assert_seeded_values_bound(&cfg);
}
#[test]
fn released_and_kebab_config_toml_are_equivalent() {
let released: Config = toml::from_str(RELEASED_CONFIG_TOML).unwrap();
let kebab: Config = toml::from_str(&kebab_config_toml()).unwrap();
assert_eq!(
toml::to_string(&released).unwrap(),
toml::to_string(&kebab).unwrap(),
);
}
#[test]
fn both_kebab_spellings_of_public_port_are_accepted() {
for key in ["public-network-port", "public-port"] {
let doc = RELEASED_CONFIG_TOML.replace("\npublic_port = ", &format!("\n{key} = "));
assert_ne!(
doc, RELEASED_CONFIG_TOML,
"the substitution did not fire, so `{key}` is not actually \
being exercised"
);
let cfg: Config =
toml::from_str(&doc).unwrap_or_else(|e| panic!("`{key}` must be accepted: {e}"));
assert_eq!(cfg.network_api.public_port, Some(31339), "{key}");
}
}
#[tokio::test]
async fn every_emitted_config_key_is_also_accepted_in_kebab_case() {
let temp_dir = tempfile::tempdir().unwrap();
let base = clap_bare_args(temp_dir.path()).build().await.unwrap();
let seeded = config_with_every_field_seeded(&base);
let emitted = toml::to_string(&seeded).unwrap();
let table: toml::Table = toml::from_str(&emitted).unwrap();
let mut kebabbed = toml::Table::new();
for (key, value) in &table {
assert!(
kebabbed
.insert(key.replace('_', "-"), value.clone())
.is_none(),
"two emitted keys collide when hyphenated, at `{key}`"
);
}
let renamed = table.keys().filter(|k| k.contains('_')).count();
assert!(
renamed >= CONFIG_KEY_SPELLINGS.len(),
"expected at least {} underscored keys to rewrite, saw {renamed} — \
if emitted keys became kebab-case, this guard and #5130's rollout \
both need revisiting",
CONFIG_KEY_SPELLINGS.len()
);
let reparsed: Config = toml::from_str(&toml::to_string(&kebabbed).unwrap())
.expect("the kebab-case spelling of every emitted key must be accepted");
assert_eq!(
toml::to_string(&reparsed).unwrap(),
emitted,
"a key lost its value when spelled in kebab-case — it is missing a \
#[serde(alias = \"...\")] for the hyphenated form"
);
}
const KEYS_EMITTED_WITH_AN_UNDERSCORE: &[&str] = &[
"public_network_address",
"public_port",
"bandwidth_limit",
"total_bandwidth_limit",
"min_bandwidth_per_connection",
"blocked_addresses",
"event_loop_channel_capacity",
"skip_load_from_network",
"transport_keypair",
"log_level",
"contracts_dir",
"delegates_dir",
"secrets_dir",
"db_dir",
"event_log",
"data_dir",
"config_dir",
"log_dir",
"wasmtime_cache_dir",
"is_gateway",
"max_blocking_threads",
];
#[tokio::test]
async fn emitted_config_toml_keys_keep_their_released_spelling() {
let temp_dir = tempfile::tempdir().unwrap();
let base = clap_bare_args(temp_dir.path()).build().await.unwrap();
assert!(
base.secrets.transport_keypair_path.is_some(),
"the seeded config must carry a transport_keypair path, or this \
guard silently stops covering that key"
);
let seeded = config_with_every_field_seeded(&base);
let table: toml::Table = toml::from_str(&toml::to_string(&seeded).unwrap()).unwrap();
let emitted_underscored: BTreeSet<&str> = table
.keys()
.filter(|key| key.contains('_'))
.map(String::as_str)
.collect();
let tabled: BTreeSet<&str> = CONFIG_KEY_SPELLINGS
.iter()
.map(|group| group[0])
.filter(|key| key.contains('_'))
.collect();
let pinned: BTreeSet<&str> = KEYS_EMITTED_WITH_AN_UNDERSCORE.iter().copied().collect();
assert_eq!(
emitted_underscored, pinned,
"the keys WRITTEN with an underscore no longer match the set this \
release shipped, which breaks crash-loop rollback (#4073) — read \
KEYS_EMITTED_WITH_AN_UNDERSCORE's rustdoc and #5130 before \
changing it"
);
assert_eq!(
emitted_underscored, tabled,
"the set of keys WRITTEN with an underscore has changed. A key \
here but not in CONFIG_KEY_SPELLINGS is a new field that should \
have been named kebab-case from the start; a key there but not \
here means the emitted spelling MOVED, which breaks crash-loop \
rollback (#4073) — see this test's rustdoc and #5130."
);
assert_eq!(
CONFIG_KEY_SPELLINGS.len(),
KEYS_EMITTED_WITH_AN_UNDERSCORE.len(),
"CONFIG_KEY_SPELLINGS gained or lost a group without the pinned \
list moving with it"
);
}
#[tokio::test]
async fn a_kebab_written_config_is_normalized_to_the_emitted_spelling() {
let temp_dir = tempfile::tempdir().unwrap();
let dir = temp_dir.path();
let kebab = kebab_config_toml()
.lines()
.filter(|line| {
!["transport-keypair = ", "nonce = ", "cipher = "]
.iter()
.any(|key| line.starts_with(key))
})
.map(|line| line.replace("/tmp/freenet-5124", &dir.display().to_string()))
.collect::<Vec<_>>()
.join("\n");
std::fs::write(dir.join("config.toml"), kebab).unwrap();
clap_bare_args(dir).build().await.unwrap();
let rewritten: toml::Table =
toml::from_str(&std::fs::read_to_string(dir.join("config.toml")).unwrap()).unwrap();
for group in CONFIG_KEY_SPELLINGS {
let emitted = group[0];
for alias in &group[1..] {
assert!(
!rewritten.contains_key(*alias) || *alias == emitted,
"`{alias}` survived the write-back; a released binary \
cannot read it, so a rollback onto one would not start"
);
}
}
assert!(
rewritten.contains_key("log_level"),
"the rewritten file must use the emitted spelling"
);
}
fn released_config_toml_without_secret_paths() -> String {
RELEASED_CONFIG_TOML
.lines()
.filter(|line| {
!["transport_keypair = ", "nonce = ", "cipher = "]
.iter()
.any(|key| line.starts_with(key))
})
.collect::<Vec<_>>()
.join("\n")
}
#[test]
fn raw_deserialization_rejects_a_key_spelled_two_ways() {
let doc = format!("{RELEASED_CONFIG_TOML}bandwidth-limit = 999\n");
let err = toml::from_str::<Config>(&doc).expect_err(
"raw serde must reject the ambiguous file — read_config normalizes it first",
);
assert!(
err.to_string().contains("duplicate"),
"expected a duplicate-field error, got: {err}"
);
}
#[test]
fn a_key_spelled_two_ways_keeps_the_value_the_previous_release_used() {
let temp_dir = tempfile::tempdir().unwrap();
let doc = format!(
"{}\nbandwidth-limit = 999\n",
released_config_toml_without_secret_paths()
);
std::fs::write(temp_dir.path().join("config.toml"), doc).unwrap();
let cfg = ConfigArgs::read_config(&temp_dir.path().to_path_buf())
.expect("a config spelling one key two ways must still load")
.expect("config.toml is present");
assert_eq!(
cfg.network_api.bandwidth_limit,
Some(3_000_001),
"the spelling the node emits must win, so an upgrade never silently \
changes a node's effective configuration"
);
assert_seeded_values_bound_except_secrets(&cfg);
}
#[test]
fn two_aliases_of_one_key_resolve_deterministically() {
let temp_dir = tempfile::tempdir().unwrap();
let base = released_config_toml_without_secret_paths();
let substituted = base.replace("\npublic_port = ", "\npublic-network-port = ");
let doc = substituted.clone() + "\npublic-port = 31999\n";
assert!(
substituted != base,
"the substitution did not fire, so this would silently collapse \
into a duplicate of the emitted-vs-alias test and stop covering \
alias-vs-alias precedence"
);
std::fs::write(temp_dir.path().join("config.toml"), doc).unwrap();
let cfg = ConfigArgs::read_config(&temp_dir.path().to_path_buf())
.expect("two aliases of one key must not stop the node booting")
.expect("config.toml is present");
assert_eq!(cfg.network_api.public_port, Some(31339));
}
#[test]
fn a_well_formed_config_has_no_redundant_spellings() {
for doc in [RELEASED_CONFIG_TOML.to_string(), kebab_config_toml()] {
let table: toml::Table = toml::from_str(&doc).unwrap();
assert!(
redundant_key_spellings(
CONFIG_KEY_SPELLINGS,
"config.toml",
|key| table.contains_key(key),
|key| table.get(key).map(|v| v.to_string()).unwrap_or_default()
)
.is_empty(),
"no key is spelled twice here, so nothing may be dropped"
);
}
}
#[test]
fn key_spelling_groups_match_the_serde_aliases() {
let baseline =
toml::to_string(&toml::from_str::<Config>(RELEASED_CONFIG_TOML).unwrap()).unwrap();
for group in CONFIG_KEY_SPELLINGS {
let emitted = group[0];
for spelling in *group {
let doc = RELEASED_CONFIG_TOML
.replace(&format!("\n{emitted} = "), &format!("\n{spelling} = "));
assert!(
doc != RELEASED_CONFIG_TOML || *spelling == emitted,
"RELEASED_CONFIG_TOML does not carry `{emitted}`, so this \
group is untested"
);
let parsed = toml::from_str::<Config>(&doc).unwrap_or_else(|e| {
panic!("`{spelling}` is in CONFIG_KEY_SPELLINGS but is not accepted: {e}")
});
assert_eq!(
toml::to_string(&parsed).unwrap(),
baseline,
"`{spelling}` parsed but did not bind to the same field \
and value as `{emitted}` — it is being ignored as an \
unknown key"
);
}
}
}
#[tokio::test]
async fn config_json_accepts_both_spellings_and_resolves_duplicates() {
let as_json = || {
let table = toml::from_str::<toml::Table>(&released_config_toml_without_secret_paths())
.unwrap();
serde_json::to_value(table).unwrap()
};
let temp_dir = tempfile::tempdir().unwrap();
let mut doc = as_json();
let object = doc.as_object_mut().unwrap();
let value = object.remove("bandwidth_limit").unwrap();
object.insert("bandwidth-limit".to_string(), value);
std::fs::write(
temp_dir.path().join("config.json"),
serde_json::to_string_pretty(&doc).unwrap(),
)
.unwrap();
let cfg = ConfigArgs::read_config(&temp_dir.path().to_path_buf())
.expect("a config.json using the hyphenated key must load")
.expect("config.json is present");
assert_eq!(cfg.network_api.bandwidth_limit, Some(3_000_001));
let temp_dir = tempfile::tempdir().unwrap();
let mut doc = as_json();
doc.as_object_mut()
.unwrap()
.insert("bandwidth-limit".to_string(), 999.into());
std::fs::write(
temp_dir.path().join("config.json"),
serde_json::to_string_pretty(&doc).unwrap(),
)
.unwrap();
let cfg = ConfigArgs::read_config(&temp_dir.path().to_path_buf())
.expect("a config.json naming one key twice must still load")
.expect("config.json is present");
assert_eq!(
cfg.network_api.bandwidth_limit,
Some(3_000_001),
"the spelling the node emits must win, as it does for TOML"
);
}
#[tokio::test]
async fn config_json_null_does_not_shadow_or_break_the_other_spelling() {
for (name, null_key, value_key) in [
(
"null under the emitted spelling",
"bandwidth_limit",
"bandwidth-limit",
),
("null under the alias", "bandwidth-limit", "bandwidth_limit"),
] {
let temp_dir = tempfile::tempdir().unwrap();
let table = toml::from_str::<toml::Table>(&released_config_toml_without_secret_paths())
.unwrap();
let mut doc = serde_json::to_value(table).unwrap();
let object = doc.as_object_mut().unwrap();
object.insert(null_key.to_string(), serde_json::Value::Null);
object.insert(value_key.to_string(), 999.into());
std::fs::write(
temp_dir.path().join("config.json"),
serde_json::to_string(&doc).unwrap(),
)
.unwrap();
let cfg = ConfigArgs::read_config(&temp_dir.path().to_path_buf())
.unwrap_or_else(|e| panic!("{name}: the node must still start: {e}"))
.unwrap_or_else(|| panic!("{name}: config.json is present"));
assert_eq!(
cfg.network_api.bandwidth_limit,
Some(999),
"{name}: the real value must win over a null"
);
}
}
#[tokio::test]
async fn config_json_lone_null_leaves_the_setting_unset() {
let temp_dir = tempfile::tempdir().unwrap();
let table =
toml::from_str::<toml::Table>(&released_config_toml_without_secret_paths()).unwrap();
let mut doc = serde_json::to_value(table).unwrap();
doc.as_object_mut()
.unwrap()
.insert("bandwidth_limit".to_string(), serde_json::Value::Null);
std::fs::write(
temp_dir.path().join("config.json"),
serde_json::to_string(&doc).unwrap(),
)
.unwrap();
let cfg = ConfigArgs::read_config(&temp_dir.path().to_path_buf())
.expect("a lone null must not be an error")
.expect("config.json is present");
assert_eq!(cfg.network_api.bandwidth_limit, None);
}
#[tokio::test]
async fn a_lone_json_null_neither_widens_nor_costs_the_spans() {
let write =
|dir: &Path, mutate: &dyn Fn(&mut serde_json::Map<String, serde_json::Value>)| {
let table =
toml::from_str::<toml::Table>(&released_config_toml_without_secret_paths())
.unwrap();
let mut doc = serde_json::to_value(table).unwrap();
mutate(doc.as_object_mut().unwrap());
std::fs::write(
dir.join("config.json"),
serde_json::to_string(&doc).unwrap(),
)
.unwrap();
};
let temp_dir = tempfile::tempdir().unwrap();
write(temp_dir.path(), &|object| {
object.insert("max_blocking_threads".to_string(), serde_json::Value::Null);
});
ConfigArgs::read_config(&temp_dir.path().to_path_buf())
.expect_err("a lone null on a non-Option key must stay an error");
let temp_dir = tempfile::tempdir().unwrap();
write(temp_dir.path(), &|object| {
object.insert("bandwidth_limit".to_string(), serde_json::Value::Null);
object.insert("ws-api-port".to_string(), "not a port".into());
});
let err = ConfigArgs::read_config(&temp_dir.path().to_path_buf())
.expect_err("a type error must still be an error")
.to_string();
assert!(
err.contains("line") && err.contains("column"),
"a document with no duplicate spelling must keep the \
span-preserving parse; got: {err}"
);
}
#[test]
fn gateways_toml_public_key_spelled_two_ways_still_loads() {
let doc = "[[gateways]]\n\
public_key = \"/tmp/freenet-5124/vega.pub\"\n\
public-key = \"/tmp/freenet-5124/stale.pub\"\n\
location = 0.25\n\
\n\
[gateways.address]\n\
host = \"vega.locut.us\"\n\
port = 31337\n";
assert!(
toml::from_str::<Gateways>(doc).is_err(),
"precondition: raw serde rejects the ambiguous file"
);
let gateways = parse_gateways_toml(doc, "gateways.toml")
.expect("a gateways.toml naming one key twice must still load");
assert_eq!(
gateways.gateways[0].public_key_path,
PathBuf::from("/tmp/freenet-5124/vega.pub"),
"the spelling the node writes must win, as it does for config.toml"
);
assert_eq!(gateways.gateways[0].location, Some(0.25));
}
#[test]
fn the_gateways_warning_names_the_source_it_was_given() {
let table: toml::Table =
toml::from_str("public_key = \"/tmp/a.pub\"\npublic-key = \"/tmp/b.pub\"\n").unwrap();
for source in ["gateways.toml", "https://freenet.org/keys/gateways.toml"] {
let reported = redundant_key_spellings(
GATEWAY_KEY_SPELLINGS,
source,
|key| table.contains_key(key),
|key| table.get(key).map(|v| v.to_string()).unwrap_or_default(),
);
let [(_, message)] = reported.as_slice() else {
panic!("expected one redundant spelling, got {reported:?}");
};
assert!(
message.contains(source),
"the warning must name `{source}`; got: {message}"
);
}
}
#[test]
fn the_duplicate_spelling_warning_is_still_emitted_both_ways() {
let source = include_str!("config.rs");
let body = source
.split("fn redundant_key_spellings(")
.nth(1)
.expect("redundant_key_spellings must exist")
.split("\nfn ")
.next()
.expect("its body must be delimited by the next item");
for emission in [
format!("tracing::warn!(\"{{{}}}\")", "message"),
format!("eprintln!(\"warning: {{{}}}\")", "message"),
] {
assert!(
body.contains(&emission),
"`redundant_key_spellings` must still emit `{emission}` — see \
this test's rustdoc for why both are needed"
);
}
}
#[test]
fn the_remote_gateway_index_is_parsed_under_its_own_url() {
let source = include_str!("config.rs");
let needle = format!("parse_gateways_toml(&response, {})", "url");
assert!(
source.contains(&needle),
"load_gateways_from_index must pass the index URL as the source \
label, or a duplicate spelling published upstream tells every \
operator on the network to edit their own innocent gateways.toml"
);
}
#[test]
fn an_unambiguous_broken_gateways_toml_keeps_its_line_and_column() {
let doc = "[[gateways]]\npublic_key = 42\n\n[gateways.address]\nhost = \"a\"\n";
let err = parse_gateways_toml(doc, "gateways.toml")
.expect_err("a type error must still be an error")
.to_string();
assert!(
err.contains("line") && err.contains("column"),
"an unambiguous file must take the span-preserving parse; got: {err}"
);
}
#[test]
fn gateways_toml_host_address_is_accepted_in_both_spellings() {
for key in ["host_address", "host-address"] {
let doc = format!(
"[[gateways]]\npublic_key = \"/tmp/freenet-5124/vega.pub\"\n\
\n[gateways.address]\n{key} = \"203.0.113.1:31337\"\n"
);
let gateways = parse_gateways_toml(&doc, "gateways.toml")
.unwrap_or_else(|e| panic!("`{key}` must be accepted: {e}"));
assert_eq!(
gateways.gateways[0].address,
Address::HostAddress("203.0.113.1:31337".parse().unwrap()),
"{key}"
);
}
}
#[test]
fn gateways_toml_host_address_spelled_two_ways_still_loads() {
let doc = "[[gateways]]\n\
public_key = \"/tmp/freenet-5124/vega.pub\"\n\
\n\
[gateways.address]\n\
host_address = \"203.0.113.1:31337\"\n\
host-address = \"198.51.100.9:1234\"\n";
assert!(
toml::from_str::<Gateways>(doc).is_err(),
"precondition: raw serde rejects the ambiguous nested table"
);
let gateways = parse_gateways_toml(doc, "gateways.toml")
.expect("a nested address naming one key twice must still load");
assert_eq!(
gateways.gateways[0].address,
Address::HostAddress("203.0.113.1:31337".parse().unwrap()),
"the spelling the node writes must win"
);
}
#[test]
fn an_unambiguous_broken_config_keeps_its_line_and_column() {
let temp_dir = tempfile::tempdir().unwrap();
let doc = released_config_toml_without_secret_paths().replace(
"max_blocking_threads = 17",
"max_blocking_threads = \"not a number\"",
);
std::fs::write(temp_dir.path().join("config.toml"), doc).unwrap();
let err = ConfigArgs::read_config(&temp_dir.path().to_path_buf())
.expect_err("a type error must still be an error")
.to_string();
assert!(
err.contains("line") && err.contains("column"),
"an unambiguous file must take the span-preserving parse; got: {err}"
);
}
#[test]
fn the_duplicate_spelling_warning_names_both_values_and_the_remedy() {
let table: toml::Table =
toml::from_str("bandwidth_limit = 10000000\nbandwidth-limit = 50000000\n").unwrap();
let reported = redundant_key_spellings(
CONFIG_KEY_SPELLINGS,
"config.toml",
|key| table.contains_key(key),
|key| table.get(key).map(|v| v.to_string()).unwrap_or_default(),
);
let [(ignored, message)] = reported.as_slice() else {
panic!("expected exactly one redundant spelling, got {reported:?}");
};
assert_eq!(*ignored, "bandwidth-limit");
for expected in [
"bandwidth-limit", "= 50000000", "bandwidth_limit", "= 10000000", "delete the `bandwidth_limit` line", "config.toml", ] {
assert!(
message.contains(expected),
"the warning must mention `{expected}`; got: {message}"
);
}
let table: toml::Table =
toml::from_str("data_dir = \"/var/lib/freenet\"\ndata-dir = \"/srv/freenet\"\n")
.unwrap();
let reported = redundant_key_spellings(
CONFIG_KEY_SPELLINGS,
"config.toml",
|key| table.contains_key(key),
|key| table.get(key).map(|v| v.to_string()).unwrap_or_default(),
);
let [(_, message)] = reported.as_slice() else {
panic!("expected one redundant spelling");
};
assert!(
message.contains("= \"/srv/freenet\""),
"a string value must be quoted once, not escaped twice; got: {message}"
);
let table: toml::Table = toml::from_str(
"data_dir = \"/var/lib/freenet\"\ndata-dir = \"\"\"\nwarning: forged\n/srv\"\"\"\n",
)
.unwrap();
let reported = redundant_key_spellings(
CONFIG_KEY_SPELLINGS,
"config.toml",
|key| table.contains_key(key),
|key| table.get(key).map(|v| v.to_string()).unwrap_or_default(),
);
let [(_, message)] = reported.as_slice() else {
panic!("expected one redundant spelling");
};
assert!(
!message.contains('\n'),
"a newline-bearing value must not break the message onto a second \
line, or a remote index could forge log entries; got: {message}"
);
let table: toml::Table =
toml::from_str("data_dir = \"/var/lib/freenet\"\ndata-dir = \"a\\u2028b\\u2029c\"\n")
.unwrap();
let reported = redundant_key_spellings(
CONFIG_KEY_SPELLINGS,
"config.toml",
|key| table.contains_key(key),
|key| table.get(key).map(|v| v.to_string()).unwrap_or_default(),
);
let [(_, message)] = reported.as_slice() else {
panic!("expected one redundant spelling");
};
assert!(
!message.contains(['\u{2028}', '\u{2029}']),
"Unicode line separators must be escaped out of the message; got: \
{message}"
);
let long = "x".repeat(400);
let table: toml::Table =
toml::from_str(&format!("data_dir = \"/var\"\ndata-dir = \"{long}\"\n")).unwrap();
let reported = redundant_key_spellings(
CONFIG_KEY_SPELLINGS,
"config.toml",
|key| table.contains_key(key),
|key| table.get(key).map(|v| v.to_string()).unwrap_or_default(),
);
let [(_, message)] = reported.as_slice() else {
panic!("expected one redundant spelling");
};
assert!(
message.contains("(truncated)") && !message.contains(&long),
"a very long value must be capped; got {} chars",
message.len()
);
}
#[test]
fn every_serde_alias_is_listed_in_a_spelling_table() {
let listed: BTreeSet<&str> = CONFIG_KEY_SPELLINGS
.iter()
.chain(GATEWAY_KEY_SPELLINGS.iter())
.chain(GATEWAY_ADDRESS_KEY_SPELLINGS.iter())
.flat_map(|group| group.iter().copied())
.collect();
let mut found = 0usize;
for (file, source) in [
("config.rs", include_str!("config.rs")),
("config/secret.rs", include_str!("config/secret.rs")),
] {
for (line_no, line) in source.lines().enumerate() {
for occurrence in line.split("alias = \"").skip(1) {
let Some(spelling) = occurrence.split('"').next() else {
continue;
};
if spelling.is_empty()
|| !spelling.chars().all(|c| {
c.is_ascii_lowercase() || c.is_ascii_digit() || c == '-' || c == '_'
})
{
continue;
}
found += 1;
assert!(
listed.contains(spelling),
"{file}:{} declares `alias = \"{spelling}\"` but no \
spelling table lists it, so a config naming that key \
both ways would refuse to start instead of being \
resolved",
line_no + 1
);
}
}
}
let expected = CONFIG_KEY_SPELLINGS.len()
+ GATEWAY_KEY_SPELLINGS.len()
+ GATEWAY_ADDRESS_KEY_SPELLINGS.len();
assert!(
found >= expected,
"scraped only {found} aliases but {expected} spelling groups exist \
— the scraper has probably stopped matching the attribute format"
);
}
#[test]
fn gateways_toml_public_key_is_accepted_in_both_spellings() {
for key in ["public_key", "public-key"] {
let doc = format!(
"[[gateways]]\naddress = {{ host = \"vega.locut.us\", port = 31337 }}\n\
{key} = \"/tmp/freenet-5124/vega.pub\"\n"
);
let gateways: Gateways = toml::from_str(&doc)
.unwrap_or_else(|e| panic!("`{key}` must be accepted in gateways.toml: {e}"));
assert_eq!(
gateways.gateways[0].public_key_path,
PathBuf::from("/tmp/freenet-5124/vega.pub"),
"{key}"
);
}
}
#[tokio::test]
async fn test_serde_config_args() {
let temp_dir = tempfile::tempdir().unwrap();
let args = ConfigArgs {
mode: Some(OperationMode::Local),
config_paths: ConfigPathsArgs {
config_dir: Some(temp_dir.path().to_path_buf()),
data_dir: Some(temp_dir.path().to_path_buf()),
log_dir: Some(temp_dir.path().to_path_buf()),
},
..Default::default()
};
let cfg = args.build().await.unwrap();
let serialized = toml::to_string(&cfg).unwrap();
let _: Config = toml::from_str(&serialized).unwrap();
}
#[tokio::test]
async fn max_hosting_storage_defaults_to_ram_scaled_clamped() {
let temp_dir = tempfile::tempdir().unwrap();
let args = ConfigArgs {
mode: Some(OperationMode::Local),
config_paths: ConfigPathsArgs {
config_dir: Some(temp_dir.path().to_path_buf()),
data_dir: Some(temp_dir.path().to_path_buf()),
log_dir: Some(temp_dir.path().to_path_buf()),
},
..Default::default()
};
let cfg = args.build().await.unwrap();
let min = crate::ring::MIN_DEFAULT_HOSTING_BUDGET_BYTES;
let max = crate::ring::MAX_DEFAULT_HOSTING_BUDGET_BYTES;
assert_eq!(
cfg.max_hosting_storage,
crate::ring::default_hosting_budget_bytes(),
"default max_hosting_storage should resolve to the hosting cache's \
single-source-of-truth RAM-scaled default budget"
);
assert!(
(min..=max).contains(&cfg.max_hosting_storage),
"default budget {} must be within the [{min}, {max}] clamp",
cfg.max_hosting_storage
);
}
#[tokio::test]
async fn hosted_mode_defaults_to_off() {
let temp_dir = tempfile::tempdir().unwrap();
let args = ConfigArgs {
mode: Some(OperationMode::Local),
config_paths: ConfigPathsArgs {
config_dir: Some(temp_dir.path().to_path_buf()),
data_dir: Some(temp_dir.path().to_path_buf()),
log_dir: Some(temp_dir.path().to_path_buf()),
},
..Default::default()
};
let cfg = args.build().await.unwrap();
assert!(
!cfg.ws_api.hosted_mode,
"hosted_mode must default to false (inert unless explicitly enabled)"
);
}
fn event_log_args(dir: &std::path::Path, mode: OperationMode) -> ConfigArgs {
ConfigArgs {
mode: Some(mode),
network_api: {
let is_network = matches!(mode, OperationMode::Network);
NetworkArgs {
is_gateway: is_network,
public_address: is_network.then(|| "203.0.113.1".parse().unwrap()),
public_port: is_network.then_some(31337),
skip_load_from_network: true,
..Default::default()
}
},
config_paths: ConfigPathsArgs {
config_dir: Some(dir.to_path_buf()),
data_dir: Some(dir.to_path_buf()),
log_dir: Some(dir.to_path_buf()),
},
..Default::default()
}
}
#[tokio::test]
async fn event_log_defaults_off_in_network_mode() {
let temp_dir = tempfile::tempdir().unwrap();
let cfg = event_log_args(temp_dir.path(), OperationMode::Network)
.build()
.await
.unwrap();
assert!(
!cfg.event_log_enabled(),
"network mode must default to event log OFF"
);
}
#[tokio::test]
async fn event_log_defaults_on_in_local_mode() {
let temp_dir = tempfile::tempdir().unwrap();
let cfg = event_log_args(temp_dir.path(), OperationMode::Local)
.build()
.await
.unwrap();
assert!(
cfg.event_log_enabled(),
"local mode must default to event log ON so fdev verify-state keeps working"
);
}
#[tokio::test]
async fn event_log_explicit_setting_overrides_mode_default() {
let on_dir = tempfile::tempdir().unwrap();
let mut on = event_log_args(on_dir.path(), OperationMode::Network);
on.enable_event_log = Some(true);
assert!(
on.build().await.unwrap().event_log_enabled(),
"explicit true must enable the log on a network node"
);
let off_dir = tempfile::tempdir().unwrap();
let mut off = event_log_args(off_dir.path(), OperationMode::Local);
off.enable_event_log = Some(false);
assert!(
!off.build().await.unwrap().event_log_enabled(),
"explicit false must disable the log even in local mode"
);
}
#[tokio::test]
async fn event_log_absent_config_key_does_not_pin_local_mode_off() {
let temp_dir = tempfile::tempdir().unwrap();
let first = event_log_args(temp_dir.path(), OperationMode::Local)
.build()
.await
.unwrap();
assert!(first.event_log_enabled(), "precondition: first build is ON");
let persisted = tokio::fs::read_to_string(temp_dir.path().join("config.toml"))
.await
.expect("first build must persist a config.toml");
assert!(
!persisted.contains("enable-event-log"),
"precondition: an unset event-log flag must be omitted from config.toml, \
otherwise this test is not exercising the pre-#4968 upgrade shape. Got:\n{persisted}"
);
let second = event_log_args(temp_dir.path(), OperationMode::Local)
.build()
.await
.unwrap();
assert!(
second.event_log_enabled(),
"a config.toml with no enable-event-log key must NOT pin local mode to OFF"
);
}
#[tokio::test]
async fn event_log_persisted_true_is_honored_on_reboot() {
let temp_dir = tempfile::tempdir().unwrap();
let mut args = event_log_args(temp_dir.path(), OperationMode::Network);
args.enable_event_log = Some(true);
assert!(args.build().await.unwrap().event_log_enabled());
let persisted = tokio::fs::read_to_string(temp_dir.path().join("config.toml"))
.await
.unwrap();
assert!(
persisted.contains("enable-event-log"),
"an explicit setting must be written to config.toml. Got:\n{persisted}"
);
let rebooted = event_log_args(temp_dir.path(), OperationMode::Network)
.build()
.await
.unwrap();
assert!(
rebooted.event_log_enabled(),
"enable-event-log = true in config.toml must survive a reboot without the CLI flag"
);
}
#[test]
fn enable_event_log_cli_accepts_bare_flag_and_explicit_value() {
use clap::Parser;
let saved = std::env::var_os("FREENET_ENABLE_EVENT_LOG");
unsafe {
std::env::remove_var("FREENET_ENABLE_EVENT_LOG");
}
let absent = ConfigArgs::try_parse_from(["freenet"]).expect("bare argv should parse");
assert_eq!(
absent.enable_event_log, None,
"an absent flag must stay None so the mode default can apply"
);
let bare = ConfigArgs::try_parse_from(["freenet", "--enable-event-log"])
.expect("bare --enable-event-log should parse");
assert_eq!(
bare.enable_event_log,
Some(true),
"bare --enable-event-log must mean Some(true)"
);
let explicit_false = ConfigArgs::try_parse_from(["freenet", "--enable-event-log=false"])
.expect("--enable-event-log=false should parse");
assert_eq!(
explicit_false.enable_event_log,
Some(false),
"--enable-event-log=false must mean Some(false)"
);
let spaced = ConfigArgs::try_parse_from(["freenet", "--enable-event-log", "true"])
.expect("--enable-event-log true should parse");
assert_eq!(
spaced.enable_event_log,
Some(true),
"--enable-event-log true must mean Some(true)"
);
unsafe {
if let Some(v) = saved {
std::env::set_var("FREENET_ENABLE_EVENT_LOG", v);
}
}
}
#[tokio::test]
async fn hosted_mode_explicit_true_round_trips() {
let temp_dir = tempfile::tempdir().unwrap();
let args = ConfigArgs {
mode: Some(OperationMode::Local),
config_paths: ConfigPathsArgs {
config_dir: Some(temp_dir.path().to_path_buf()),
data_dir: Some(temp_dir.path().to_path_buf()),
log_dir: Some(temp_dir.path().to_path_buf()),
},
ws_api: WebsocketApiArgs {
hosted_mode: Some(true),
..Default::default()
},
..Default::default()
};
let cfg = args.build().await.unwrap();
assert!(
cfg.ws_api.hosted_mode,
"explicit --hosted-mode should resolve to true"
);
let serialized = toml::to_string(&cfg).unwrap();
let reparsed: Config = toml::from_str(&serialized).unwrap();
assert!(
reparsed.ws_api.hosted_mode,
"hosted_mode=true must survive a TOML serialize/deserialize round-trip"
);
}
#[test]
fn hosted_mode_cli_accepts_bare_flag_and_explicit_value() {
use clap::Parser;
let saved = std::env::var_os("FREENET_HOSTED_MODE");
unsafe {
std::env::remove_var("FREENET_HOSTED_MODE");
}
let bare = ConfigArgs::try_parse_from(["freenet", "--hosted-mode"])
.expect("bare --hosted-mode should parse");
assert_eq!(
bare.ws_api.hosted_mode,
Some(true),
"bare --hosted-mode must mean Some(true)"
);
let explicit_false = ConfigArgs::try_parse_from(["freenet", "--hosted-mode=false"])
.expect("--hosted-mode=false should parse");
assert_eq!(
explicit_false.ws_api.hosted_mode,
Some(false),
"--hosted-mode=false must mean Some(false)"
);
let explicit_true = ConfigArgs::try_parse_from(["freenet", "--hosted-mode", "true"])
.expect("--hosted-mode true should parse");
assert_eq!(
explicit_true.ws_api.hosted_mode,
Some(true),
"--hosted-mode true must mean Some(true)"
);
let absent =
ConfigArgs::try_parse_from(["freenet"]).expect("no hosted-mode flag should parse");
assert_eq!(
absent.ws_api.hosted_mode, None,
"absent --hosted-mode must leave it None for config/env layering"
);
unsafe {
if let Some(v) = saved {
std::env::set_var("FREENET_HOSTED_MODE", v);
}
}
}
#[tokio::test]
async fn max_hosting_storage_explicit_value_round_trips() {
let temp_dir = tempfile::tempdir().unwrap();
let custom = 2 * 1024 * 1024 * 1024_u64;
let args = ConfigArgs {
mode: Some(OperationMode::Local),
config_paths: ConfigPathsArgs {
config_dir: Some(temp_dir.path().to_path_buf()),
data_dir: Some(temp_dir.path().to_path_buf()),
log_dir: Some(temp_dir.path().to_path_buf()),
},
max_hosting_storage: Some(custom),
..Default::default()
};
let cfg = args.build().await.unwrap();
assert_eq!(cfg.max_hosting_storage, custom);
let serialized = toml::to_string(&cfg).unwrap();
assert!(
serialized.contains("max-hosting-storage"),
"an explicit operator value must be persisted, got:\n{serialized}"
);
let deserialized: Config = toml::from_str(&serialized).unwrap();
assert_eq!(deserialized.max_hosting_storage, custom);
}
#[tokio::test]
async fn auto_derived_hosting_budget_is_not_persisted_and_re_derives() {
let temp_dir = tempfile::tempdir().unwrap();
let args = ConfigArgs {
mode: Some(OperationMode::Local),
config_paths: ConfigPathsArgs {
config_dir: Some(temp_dir.path().to_path_buf()),
data_dir: Some(temp_dir.path().to_path_buf()),
log_dir: Some(temp_dir.path().to_path_buf()),
},
..Default::default()
};
let cfg = args.build().await.unwrap();
assert_eq!(
cfg.max_hosting_storage,
crate::ring::default_hosting_budget_bytes(),
"with no operator value, the budget must be the auto-derived default"
);
let serialized = toml::to_string(&cfg).unwrap();
assert!(
!serialized.contains("max-hosting-storage"),
"the auto-derived budget must not be pinned into config.toml, got:\n{serialized}"
);
let rebuilt: Config = toml::from_str(&serialized).unwrap();
assert_eq!(
rebuilt.max_hosting_storage,
crate::ring::default_hosting_budget_bytes(),
"a config.toml without the key must re-derive the budget from live RAM"
);
}
#[tokio::test]
async fn legacy_pinned_hosting_budget_re_derives_but_explicit_survives() {
let legacy_dir = tempfile::tempdir().unwrap();
clap_bare_args(legacy_dir.path()).build().await.unwrap();
let cfg_path = legacy_dir.path().join("config.toml");
let existing = std::fs::read_to_string(&cfg_path).unwrap();
assert!(
!existing.contains("max-hosting-storage"),
"fresh build must not persist the auto-derived value, got:\n{existing}"
);
std::fs::write(
&cfg_path,
format!("max-hosting-storage = 1073741824\n{existing}"),
)
.unwrap();
let upgraded = clap_bare_args(legacy_dir.path()).build().await.unwrap();
assert_eq!(
upgraded.max_hosting_storage,
crate::ring::default_hosting_budget_bytes(),
"a legacy auto-persisted 1 GiB default must re-derive from live RAM \
on upgrade, not stay pinned"
);
let explicit_dir = tempfile::tempdir().unwrap();
clap_bare_args(explicit_dir.path()).build().await.unwrap();
let cfg_path = explicit_dir.path().join("config.toml");
let existing = std::fs::read_to_string(&cfg_path).unwrap();
std::fs::write(
&cfg_path,
format!("max-hosting-storage = 2147483648\n{existing}"),
)
.unwrap();
let upgraded = clap_bare_args(explicit_dir.path()).build().await.unwrap();
assert_eq!(
upgraded.max_hosting_storage,
2 * 1024 * 1024 * 1024_u64,
"an explicit non-legacy persisted value must survive upgrade"
);
}
#[tokio::test]
async fn module_cache_budget_defaults_to_ram_scaled_clamped() {
let temp_dir = tempfile::tempdir().unwrap();
let args = ConfigArgs {
mode: Some(OperationMode::Local),
config_paths: ConfigPathsArgs {
config_dir: Some(temp_dir.path().to_path_buf()),
data_dir: Some(temp_dir.path().to_path_buf()),
log_dir: Some(temp_dir.path().to_path_buf()),
},
..Default::default()
};
let cfg = args.build().await.unwrap();
let min = crate::wasm_runtime::MIN_DEFAULT_MODULE_CACHE_BUDGET_BYTES;
let max = crate::wasm_runtime::MAX_DEFAULT_MODULE_CACHE_BUDGET_BYTES;
assert_eq!(
cfg.module_cache_budget_bytes,
crate::wasm_runtime::default_module_cache_budget_bytes(),
"default module cache budget should resolve to the wasm_runtime \
single-source-of-truth default"
);
assert!(
(min..=max).contains(&cfg.module_cache_budget_bytes),
"default budget {} must be within the [{min}, {max}] clamp",
cfg.module_cache_budget_bytes
);
}
#[tokio::test]
async fn module_cache_budget_explicit_value_round_trips() {
let temp_dir = tempfile::tempdir().unwrap();
let custom = 768 * 1024 * 1024_usize;
let args = ConfigArgs {
mode: Some(OperationMode::Local),
config_paths: ConfigPathsArgs {
config_dir: Some(temp_dir.path().to_path_buf()),
data_dir: Some(temp_dir.path().to_path_buf()),
log_dir: Some(temp_dir.path().to_path_buf()),
},
module_cache_budget_bytes: Some(custom),
..Default::default()
};
let cfg = args.build().await.unwrap();
assert_eq!(cfg.module_cache_budget_bytes, custom);
let serialized = toml::to_string(&cfg).unwrap();
assert!(serialized.contains("module-cache-budget-bytes"));
let deserialized: Config = toml::from_str(&serialized).unwrap();
assert_eq!(deserialized.module_cache_budget_bytes, custom);
}
async fn build_with_cidrs(cidrs: Option<Vec<String>>) -> anyhow::Result<Config> {
let temp_dir = tempfile::tempdir().unwrap();
let args = ConfigArgs {
mode: Some(OperationMode::Local),
config_paths: ConfigPathsArgs {
config_dir: Some(temp_dir.path().to_path_buf()),
data_dir: Some(temp_dir.path().to_path_buf()),
log_dir: Some(temp_dir.path().to_path_buf()),
},
ws_api: WebsocketApiArgs {
allowed_source_cidrs: cidrs,
..Default::default()
},
..Default::default()
};
args.build().await
}
#[tokio::test]
async fn allowed_source_cidrs_round_trip_through_build() {
let cfg = build_with_cidrs(Some(vec![
"100.64.0.0/10".to_string(),
"fd7a:115c:a1e0::/48".to_string(),
]))
.await
.unwrap();
assert_eq!(cfg.ws_api.allowed_source_cidrs.len(), 2);
assert_eq!(
cfg.ws_api.allowed_source_cidrs[0],
"100.64.0.0/10".parse::<ipnet::IpNet>().unwrap()
);
assert_eq!(
cfg.ws_api.allowed_source_cidrs[1],
"fd7a:115c:a1e0::/48".parse::<ipnet::IpNet>().unwrap()
);
}
#[tokio::test]
async fn allowed_source_cidrs_default_is_empty() {
let cfg = build_with_cidrs(None).await.unwrap();
assert!(cfg.ws_api.allowed_source_cidrs.is_empty());
}
#[tokio::test]
async fn allowed_source_cidrs_rejects_malformed() {
let err = build_with_cidrs(Some(vec!["not-a-cidr".to_string()]))
.await
.unwrap_err();
let msg = format!("{err:#}");
assert!(
msg.contains("allowed-source-cidrs") && msg.contains("not-a-cidr"),
"error should name the field and the offending value: {msg}"
);
}
#[tokio::test]
async fn allowed_source_cidrs_rejects_whole_internet_catchall() {
let err = build_with_cidrs(Some(vec!["0.0.0.0/0".to_string()]))
.await
.unwrap_err();
let msg = format!("{err:#}");
assert!(
msg.contains("0.0.0.0/0") && msg.contains("/8"),
"error should explain why and name the minimum: {msg}"
);
}
#[tokio::test]
async fn allowed_source_cidrs_rejects_ipv6_catchall() {
let err = build_with_cidrs(Some(vec!["::/0".to_string()]))
.await
.unwrap_err();
let msg = format!("{err:#}");
assert!(msg.contains("::/0") && msg.contains("/16"));
}
async fn write_config_toml_with_ws_api(dir: &Path, ws_api_patch: &WebsocketApiConfig) {
let base_args = ConfigArgs {
mode: Some(OperationMode::Local),
config_paths: ConfigPathsArgs {
config_dir: Some(dir.to_path_buf()),
data_dir: Some(dir.to_path_buf()),
log_dir: Some(dir.to_path_buf()),
},
..Default::default()
};
let mut base_cfg = base_args.build().await.unwrap();
base_cfg.ws_api = ws_api_patch.clone();
let toml_str = toml::to_string(&base_cfg).unwrap();
std::fs::write(dir.join("config.toml"), toml_str).unwrap();
}
#[tokio::test]
async fn file_config_cidrs_merged_into_build() {
let temp_dir = tempfile::tempdir().unwrap();
write_config_toml_with_ws_api(
temp_dir.path(),
&WebsocketApiConfig {
allowed_source_cidrs: vec![
"100.64.0.0/10".parse().unwrap(),
"fd7a:115c:a1e0::/48".parse().unwrap(),
],
allowed_hosts: vec!["my-tailscale-host".to_string()],
..Default::default()
},
)
.await;
let args = ConfigArgs {
mode: Some(OperationMode::Local),
config_paths: ConfigPathsArgs {
config_dir: Some(temp_dir.path().to_path_buf()),
data_dir: Some(temp_dir.path().to_path_buf()),
log_dir: Some(temp_dir.path().to_path_buf()),
},
..Default::default()
};
let cfg = args.build().await.unwrap();
assert_eq!(
cfg.ws_api.allowed_source_cidrs.len(),
2,
"CIDRs from config.toml must be present in built config"
);
assert_eq!(
cfg.ws_api.allowed_source_cidrs[0],
"100.64.0.0/10".parse::<ipnet::IpNet>().unwrap()
);
assert_eq!(
cfg.ws_api.allowed_source_cidrs[1],
"fd7a:115c:a1e0::/48".parse::<ipnet::IpNet>().unwrap()
);
assert_eq!(
cfg.ws_api.allowed_hosts,
vec!["my-tailscale-host".to_string()],
"allowed-host from config.toml must be present in built config"
);
}
fn local_args(dir: &Path) -> ConfigArgs {
ConfigArgs {
mode: Some(OperationMode::Local),
config_paths: ConfigPathsArgs {
config_dir: Some(dir.to_path_buf()),
data_dir: Some(dir.to_path_buf()),
log_dir: Some(dir.to_path_buf()),
},
..Default::default()
}
}
#[tokio::test]
async fn gateway_role_and_total_bandwidth_round_trip_through_build() {
let temp_dir = tempfile::tempdir().unwrap();
let mut first = local_args(temp_dir.path());
first.network_api.is_gateway = true;
first.network_api.public_address = Some("1.2.3.4".parse().unwrap());
first.network_api.public_port = Some(31337);
first.network_api.location = Some(0.5);
first.network_api.total_bandwidth_limit = Some(100_000_000);
first.network_api.max_connections = Some(2000);
first.build().await.unwrap();
assert!(
temp_dir.path().join("config.toml").exists(),
"first build with flags must persist config.toml"
);
let cfg = local_args(temp_dir.path()).build().await.unwrap();
assert!(
cfg.is_gateway,
"is_gateway from config.toml must survive a bare build (node must stay a gateway)"
);
assert_eq!(
cfg.location,
Some(0.5),
"location from config.toml must survive a bare build"
);
assert_eq!(
cfg.network_api.total_bandwidth_limit,
Some(100_000_000),
"total_bandwidth_limit from config.toml must survive a bare build"
);
assert_eq!(
cfg.network_api.max_connections, 2000,
"max_connections from config.toml must survive a bare build"
);
assert!(
cfg.peer_id.is_some(),
"peer_id must be reconstructed from the restored public address/port"
);
}
#[tokio::test]
async fn gateway_in_config_without_public_address_fails_validation() {
let temp_dir = tempfile::tempdir().unwrap();
let mut seeded = local_args(temp_dir.path()).build().await.unwrap();
seeded.is_gateway = true;
seeded.network_api.public_address = None;
seeded.network_api.public_port = None;
std::fs::write(
temp_dir.path().join("config.toml"),
toml::to_string(&seeded).unwrap(),
)
.unwrap();
let err = local_args(temp_dir.path()).build().await.unwrap_err();
let msg = format!("{err:#}");
assert!(
msg.contains("public network address"),
"an is_gateway=true config without a public address must fail validation: {msg}"
);
}
#[tokio::test]
async fn cli_total_bandwidth_limit_overrides_file_config() {
let temp_dir = tempfile::tempdir().unwrap();
let mut first = local_args(temp_dir.path());
first.network_api.total_bandwidth_limit = Some(100_000_000);
first.build().await.unwrap();
let mut second = local_args(temp_dir.path());
second.network_api.total_bandwidth_limit = Some(50_000_000);
let cfg = second.build().await.unwrap();
assert_eq!(
cfg.network_api.total_bandwidth_limit,
Some(50_000_000),
"CLI --total-bandwidth-limit must override the config.toml value"
);
}
#[tokio::test]
async fn cli_flag_set_on_a_later_run_is_persisted_to_config() {
let temp_dir = tempfile::tempdir().unwrap();
clap_bare_args(temp_dir.path()).build().await.unwrap();
let mut args = clap_bare_args(temp_dir.path());
args.network_api.total_bandwidth_limit = Some(50_000_000);
args.build().await.unwrap();
let cfg = clap_bare_args(temp_dir.path()).build().await.unwrap();
assert_eq!(
cfg.network_api.total_bandwidth_limit,
Some(50_000_000),
"a CLI flag set on a later run must be written back to config.toml"
);
}
#[tokio::test]
async fn bare_restart_does_not_rewrite_unchanged_config() {
let temp_dir = tempfile::tempdir().unwrap();
clap_bare_args(temp_dir.path()).build().await.unwrap();
let path = temp_dir.path().join("config.toml");
let before = std::fs::read_to_string(&path).unwrap();
clap_bare_args(temp_dir.path()).build().await.unwrap();
let after = std::fs::read_to_string(&path).unwrap();
assert_eq!(
before, after,
"a no-op restart must not rewrite config.toml"
);
}
#[tokio::test]
async fn persisting_config_never_truncates_existing_file_on_temp_write_failure() {
let temp_dir = tempfile::tempdir().unwrap();
clap_bare_args(temp_dir.path()).build().await.unwrap();
let config_path = temp_dir.path().join("config.toml");
let original = std::fs::read_to_string(&config_path).unwrap();
assert!(!original.is_empty());
std::fs::create_dir(config_path.with_extension(format!("{}.toml.tmp", std::process::id())))
.unwrap();
let mut args = clap_bare_args(temp_dir.path());
args.network_api.total_bandwidth_limit = Some(123_456_789);
let result = args.build().await;
assert!(
result.is_err(),
"build() must surface the forced temp-file write failure, not silently succeed"
);
let after = std::fs::read_to_string(&config_path).unwrap();
assert_eq!(
original, after,
"a failed persist must leave the existing config.toml completely untouched, \
never truncated or partially overwritten"
);
}
#[test]
fn warns_only_about_cached_gateways_absent_from_remote_index() {
fn gw(host: &str) -> GatewayConfig {
GatewayConfig {
address: Address::Host {
host: host.to_string(),
port: 31337,
},
public_key_path: PathBuf::from("/dev/null"),
location: None,
}
}
let local = vec![gw("a"), gw("b"), gw("c")];
let remote = vec![gw("b"), gw("c"), gw("d")];
assert_eq!(
gateways_dropped_by_remote_replace(&local, &remote),
vec![Address::Host {
host: "a".to_string(),
port: 31337
}],
);
assert!(gateways_dropped_by_remote_replace(&local, &local).is_empty());
assert!(gateways_dropped_by_remote_replace(&[], &remote).is_empty());
}
fn clap_bare_args(dir: &Path) -> ConfigArgs {
ConfigArgs {
mode: Some(OperationMode::Local),
network_api: NetworkArgs::default(),
ws_api: WebsocketApiArgs::default(),
secrets: Default::default(),
log_level: None,
config_paths: ConfigPathsArgs {
config_dir: Some(dir.to_path_buf()),
data_dir: Some(dir.to_path_buf()),
log_dir: Some(dir.to_path_buf()),
},
id: None,
version: false,
max_blocking_threads: None,
max_hosting_storage: None,
hosting_disk_pct: None,
max_hosting_disk: None,
per_user_secret_quota_bytes: None,
per_user_inactive_ttl_secs: None,
inactive_user_sweep_interval_secs: None,
module_cache_budget_bytes: None,
enable_event_log: None,
shutdown_drain_secs: None,
disable_auto_update: false,
telemetry: Default::default(),
}
}
#[tokio::test]
async fn disable_auto_update_flag_wires_through_build() {
let temp = tempfile::tempdir().unwrap();
let default_cfg = clap_bare_args(temp.path()).build().await.unwrap();
assert!(
!default_cfg.disable_auto_update,
"default must keep auto-update ON"
);
let temp2 = tempfile::tempdir().unwrap();
let mut args = clap_bare_args(temp2.path());
args.disable_auto_update = true;
let cfg = args.build().await.unwrap();
assert!(
cfg.disable_auto_update,
"--disable-auto-update must reach Config"
);
}
#[test]
fn disable_auto_update_flag_parses_from_cli() {
use clap::Parser;
let none = ConfigArgs::try_parse_from(["freenet"]).expect("bare parse");
assert!(!none.disable_auto_update, "no flag → auto-update ON");
let set =
ConfigArgs::try_parse_from(["freenet", "--disable-auto-update"]).expect("flag parse");
assert!(set.disable_auto_update, "--disable-auto-update → OFF");
}
fn config_with_every_field_seeded(base: &Config) -> Config {
Config {
mode: OperationMode::Local,
network_api: NetworkApiConfig {
address: "10.1.2.3".parse().unwrap(),
port: 40001,
public_address: Some("1.2.3.4".parse().unwrap()),
public_port: Some(40002),
ignore_protocol_version: false, bandwidth_limit: Some(7_000_000),
total_bandwidth_limit: Some(123_000_000),
min_bandwidth_per_connection: Some(2_000_000),
blocked_addresses: Some(
std::iter::once("9.9.9.9:1234".parse::<SocketAddr>().unwrap()).collect(),
),
event_loop_channel_capacity: 4096,
transient_budget: 4097,
transient_ttl_secs: 61,
min_connections: 11,
max_connections: 222,
streaming_threshold: 131_072,
ledbat_min_ssthresh: Some(200_000),
congestion_control: "bbr".to_string(),
bbr_startup_rate: Some(5_000),
skip_load_from_network: true,
},
ws_api: WebsocketApiConfig {
address: "10.1.2.4".parse().unwrap(),
port: 8123,
token_ttl_seconds: 4321,
token_cleanup_interval_seconds: 321,
allowed_hosts: vec!["my-host".to_string()],
allowed_source_cidrs: vec!["10.0.0.0/8".parse().unwrap()],
hosted_mode: true,
per_user_op_rate_limit: 33,
per_user_op_burst: 77,
per_user_export_min_interval_secs: 17,
secrets_dir: std::path::PathBuf::new(),
exposure: WsApiExposure {
source: WsApiAddressSource::AutoWidened,
dropped_persisted_address: Some(default_listening_address()),
},
webapp_cache_dir: default_webapp_cache_dir(),
},
secrets: base.secrets.clone(),
log_level: tracing::log::LevelFilter::Debug,
config_paths: base.config_paths.clone(),
peer_id: None,
gateways: vec![],
is_gateway: true,
location: Some(0.5),
max_blocking_threads: 7,
max_hosting_storage: 123_456_789,
hosting_disk_pct: 0.37,
max_hosting_disk: 9_876_543_210,
per_user_secret_quota_bytes: 7_654_321,
per_user_inactive_ttl_secs: 1_234_567,
inactive_user_sweep_interval_secs: 7_200,
module_cache_budget_bytes: 987_654_321,
enable_event_log: Some(false),
telemetry: TelemetryConfig {
enabled: false,
endpoint: "http://example.invalid:4318".to_string(),
transport_snapshot_interval_secs: 45,
is_test_environment: false, reference_ping_enabled: true,
iface_tx_enabled: true,
},
shutdown_drain_secs: 77,
disable_auto_update: true, }
}
#[tokio::test]
async fn all_persisted_config_fields_round_trip_through_build() {
let temp_dir = tempfile::tempdir().unwrap();
let base = clap_bare_args(temp_dir.path()).build().await.unwrap();
let seed = config_with_every_field_seeded(&base);
std::fs::write(
temp_dir.path().join("config.toml"),
toml::to_string(&seed).unwrap(),
)
.unwrap();
let rebuilt = clap_bare_args(temp_dir.path()).build().await.unwrap();
let Config {
mode,
network_api,
ws_api,
secrets: _, log_level,
config_paths: _, peer_id: _, gateways: _, is_gateway,
location,
max_blocking_threads,
max_hosting_storage,
hosting_disk_pct,
max_hosting_disk,
per_user_secret_quota_bytes,
per_user_inactive_ttl_secs,
inactive_user_sweep_interval_secs,
module_cache_budget_bytes,
enable_event_log,
telemetry,
shutdown_drain_secs,
disable_auto_update: _,
} = rebuilt;
assert_eq!(mode, seed.mode, "mode");
assert_eq!(log_level, seed.log_level, "log_level");
assert_eq!(is_gateway, seed.is_gateway, "is_gateway");
assert_eq!(location, seed.location, "location");
assert_eq!(
max_blocking_threads, seed.max_blocking_threads,
"max_blocking_threads"
);
assert_eq!(
max_hosting_storage, seed.max_hosting_storage,
"max_hosting_storage"
);
assert_eq!(hosting_disk_pct, seed.hosting_disk_pct, "hosting_disk_pct");
assert_eq!(max_hosting_disk, seed.max_hosting_disk, "max_hosting_disk");
assert_eq!(
per_user_secret_quota_bytes, seed.per_user_secret_quota_bytes,
"per_user_secret_quota_bytes"
);
assert_eq!(
per_user_inactive_ttl_secs, seed.per_user_inactive_ttl_secs,
"per_user_inactive_ttl_secs"
);
assert_eq!(
inactive_user_sweep_interval_secs, seed.inactive_user_sweep_interval_secs,
"inactive_user_sweep_interval_secs"
);
assert_eq!(
module_cache_budget_bytes, seed.module_cache_budget_bytes,
"module_cache_budget_bytes"
);
assert_eq!(
enable_event_log, seed.enable_event_log,
"enable_event_log (#4968) — an explicit setting must survive the \
config.toml merge, or an operator's opt-in is silently reverted"
);
assert_eq!(
shutdown_drain_secs, seed.shutdown_drain_secs,
"shutdown_drain_secs"
);
let NetworkApiConfig {
address,
port,
public_address,
public_port,
ignore_protocol_version: _, bandwidth_limit,
total_bandwidth_limit,
min_bandwidth_per_connection,
blocked_addresses,
event_loop_channel_capacity,
transient_budget,
transient_ttl_secs,
min_connections,
max_connections,
streaming_threshold,
ledbat_min_ssthresh,
congestion_control,
bbr_startup_rate,
skip_load_from_network,
} = network_api;
assert_eq!(address, seed.network_api.address, "network_api.address");
assert_eq!(port, seed.network_api.port, "network_api.port");
assert_eq!(
public_address, seed.network_api.public_address,
"public_address"
);
assert_eq!(public_port, seed.network_api.public_port, "public_port");
assert_eq!(
bandwidth_limit, seed.network_api.bandwidth_limit,
"bandwidth_limit"
);
assert_eq!(
total_bandwidth_limit, seed.network_api.total_bandwidth_limit,
"total_bandwidth_limit"
);
assert_eq!(
min_bandwidth_per_connection, seed.network_api.min_bandwidth_per_connection,
"min_bandwidth_per_connection"
);
assert_eq!(
blocked_addresses, seed.network_api.blocked_addresses,
"blocked_addresses"
);
assert_eq!(
event_loop_channel_capacity, seed.network_api.event_loop_channel_capacity,
"event_loop_channel_capacity"
);
assert_eq!(
transient_budget, seed.network_api.transient_budget,
"transient_budget"
);
assert_eq!(
transient_ttl_secs, seed.network_api.transient_ttl_secs,
"transient_ttl_secs"
);
assert_eq!(
min_connections, seed.network_api.min_connections,
"min_connections"
);
assert_eq!(
max_connections, seed.network_api.max_connections,
"max_connections"
);
assert_eq!(
streaming_threshold, seed.network_api.streaming_threshold,
"streaming_threshold"
);
assert_eq!(
ledbat_min_ssthresh, seed.network_api.ledbat_min_ssthresh,
"ledbat_min_ssthresh"
);
assert_eq!(
congestion_control, seed.network_api.congestion_control,
"congestion_control"
);
assert_eq!(
bbr_startup_rate, seed.network_api.bbr_startup_rate,
"bbr_startup_rate"
);
assert_eq!(
skip_load_from_network, seed.network_api.skip_load_from_network,
"skip_load_from_network"
);
let WebsocketApiConfig {
address: ws_address,
port: ws_port,
token_ttl_seconds,
token_cleanup_interval_seconds,
allowed_hosts,
allowed_source_cidrs,
hosted_mode,
per_user_op_rate_limit,
per_user_op_burst,
per_user_export_min_interval_secs,
secrets_dir: _, webapp_cache_dir: _,
exposure: _,
} = ws_api;
assert_eq!(ws_address, seed.ws_api.address, "ws_api.address");
assert_eq!(ws_port, seed.ws_api.port, "ws_api.port");
assert_eq!(
token_ttl_seconds, seed.ws_api.token_ttl_seconds,
"token_ttl_seconds"
);
assert_eq!(
token_cleanup_interval_seconds, seed.ws_api.token_cleanup_interval_seconds,
"token_cleanup_interval_seconds"
);
assert_eq!(allowed_hosts, seed.ws_api.allowed_hosts, "allowed_hosts");
assert_eq!(
allowed_source_cidrs, seed.ws_api.allowed_source_cidrs,
"allowed_source_cidrs"
);
assert_eq!(hosted_mode, seed.ws_api.hosted_mode, "ws_api.hosted_mode");
assert_eq!(
per_user_op_rate_limit, seed.ws_api.per_user_op_rate_limit,
"ws_api.per_user_op_rate_limit"
);
assert_eq!(
per_user_op_burst, seed.ws_api.per_user_op_burst,
"ws_api.per_user_op_burst"
);
assert_eq!(
per_user_export_min_interval_secs, seed.ws_api.per_user_export_min_interval_secs,
"ws_api.per_user_export_min_interval_secs"
);
let TelemetryConfig {
enabled,
endpoint,
transport_snapshot_interval_secs,
is_test_environment: _, reference_ping_enabled,
iface_tx_enabled,
} = telemetry;
assert_eq!(enabled, seed.telemetry.enabled, "telemetry.enabled");
assert_eq!(endpoint, seed.telemetry.endpoint, "telemetry.endpoint");
assert_eq!(
transport_snapshot_interval_secs, seed.telemetry.transport_snapshot_interval_secs,
"transport_snapshot_interval_secs"
);
assert_eq!(
reference_ping_enabled, seed.telemetry.reference_ping_enabled,
"reference_ping_enabled"
);
assert_eq!(
iface_tx_enabled, seed.telemetry.iface_tx_enabled,
"iface_tx_enabled"
);
}
#[tokio::test]
async fn module_cache_budget_old_auto_sentinel_re_derives_but_explicit_values_persist() {
let derived_default = crate::wasm_runtime::default_module_cache_budget_bytes();
async fn rebuilt_budget(seed: Option<usize>) -> usize {
let temp_dir = tempfile::tempdir().unwrap();
let mut base = clap_bare_args(temp_dir.path()).build().await.unwrap();
let toml_str = match seed {
Some(v) => {
base.module_cache_budget_bytes = v;
toml::to_string(&base).unwrap()
}
None => {
toml::to_string(&base)
.unwrap()
.lines()
.filter(|l| !l.trim_start().starts_with("module-cache-budget-bytes"))
.collect::<Vec<_>>()
.join("\n")
}
};
std::fs::write(temp_dir.path().join("config.toml"), toml_str).unwrap();
clap_bare_args(temp_dir.path())
.build()
.await
.unwrap()
.module_cache_budget_bytes
}
let from_sentinel = rebuilt_budget(Some(1_610_612_736)).await;
assert_eq!(
from_sentinel, derived_default,
"the old auto-derived 1.5 GiB sentinel must re-derive to the fresh \
default, not stay pinned at 1_610_612_736"
);
let explicit = 777_000_000usize;
let from_explicit = rebuilt_budget(Some(explicit)).await;
assert_eq!(
from_explicit, explicit,
"an explicit non-sentinel operator value must round-trip unchanged"
);
let from_absent = rebuilt_budget(None).await;
assert_eq!(
from_absent, derived_default,
"an absent field must resolve to the derived default"
);
}
#[tokio::test]
async fn cli_cidrs_override_file_config() {
let temp_dir = tempfile::tempdir().unwrap();
write_config_toml_with_ws_api(
temp_dir.path(),
&WebsocketApiConfig {
allowed_source_cidrs: vec!["10.0.0.0/8".parse().unwrap()],
allowed_hosts: vec!["file-host".to_string()],
..Default::default()
},
)
.await;
let args = ConfigArgs {
mode: Some(OperationMode::Local),
config_paths: ConfigPathsArgs {
config_dir: Some(temp_dir.path().to_path_buf()),
data_dir: Some(temp_dir.path().to_path_buf()),
log_dir: Some(temp_dir.path().to_path_buf()),
},
ws_api: WebsocketApiArgs {
allowed_source_cidrs: Some(vec!["172.16.0.0/12".to_string()]),
allowed_host: Some(vec!["cli-host".to_string()]),
..Default::default()
},
..Default::default()
};
let cfg = args.build().await.unwrap();
assert_eq!(cfg.ws_api.allowed_source_cidrs.len(), 1);
assert_eq!(
cfg.ws_api.allowed_source_cidrs[0],
"172.16.0.0/12".parse::<ipnet::IpNet>().unwrap(),
"CLI value must win over file config"
);
assert_eq!(
cfg.ws_api.allowed_hosts,
vec!["cli-host".to_string()],
"CLI value must win over file config"
);
}
#[tokio::test]
async fn test_load_gateways_from_index() {
let server = Server::run();
server.expect(
Expectation::matching(all_of!(request::method("GET"), request::path("/gateways")))
.respond_with(status_code(200).body(
r#"
[[gateways]]
address = { hostname = "example.com" }
public_key = "/path/to/public_key.pem"
"#,
)),
);
let url = server.url_str("/gateways");
let keypair = TransportKeypair::new();
let key_hex = hex::encode(keypair.public().as_bytes());
server.expect(
Expectation::matching(request::path("/path/to/public_key.pem"))
.respond_with(status_code(200).body(key_hex)),
);
let pub_keys_dir = tempfile::tempdir().unwrap();
let gateways = load_gateways_from_index(&url, pub_keys_dir.path())
.await
.unwrap();
assert_eq!(gateways.gateways.len(), 1);
assert_eq!(
gateways.gateways[0].address,
Address::Hostname("example.com".to_string())
);
assert_eq!(
gateways.gateways[0].public_key_path,
pub_keys_dir.path().join("public_key.pem")
);
assert!(pub_keys_dir.path().join("public_key.pem").exists());
}
#[test]
fn test_gateways() {
let gateways = Gateways {
gateways: vec![
GatewayConfig {
address: Address::HostAddress(
([127, 0, 0, 1], default_network_api_port()).into(),
),
public_key_path: PathBuf::from("path/to/key"),
location: None,
},
GatewayConfig {
address: Address::Hostname("technic.locut.us".to_string()),
public_key_path: PathBuf::from("path/to/key"),
location: None,
},
],
};
let serialized = toml::to_string(&gateways).unwrap();
let _: Gateways = toml::from_str(&serialized).unwrap();
}
#[test]
fn test_address_deser_legacy_hostname_string() {
let toml_str = r#"
[[gateways]]
public_key = "keys/public.vega.gw.pem"
[gateways.address]
hostname = "vega.locut.us:31337"
"#;
let gateways: Gateways = toml::from_str(toml_str).unwrap();
assert_eq!(gateways.gateways.len(), 1);
assert_eq!(
gateways.gateways[0].address,
Address::Hostname("vega.locut.us:31337".to_string())
);
}
#[test]
fn test_address_deser_legacy_hostname_string_no_port() {
let toml_str = r#"
[[gateways]]
public_key = "keys/public.vega.gw.pem"
[gateways.address]
hostname = "vega.locut.us"
"#;
let gateways: Gateways = toml::from_str(toml_str).unwrap();
assert_eq!(
gateways.gateways[0].address,
Address::Hostname("vega.locut.us".to_string())
);
}
#[test]
fn test_address_deser_legacy_host_address() {
let toml_str = r#"
[[gateways]]
public_key = "keys/k.pem"
[gateways.address]
host_address = "203.0.113.1:31337"
"#;
let gateways: Gateways = toml::from_str(toml_str).unwrap();
assert_eq!(
gateways.gateways[0].address,
Address::HostAddress("203.0.113.1:31337".parse().unwrap())
);
}
#[test]
fn test_address_deser_new_host_port() {
let toml_str = r#"
[[gateways]]
public_key = "keys/public.vega.gw.pem"
[gateways.address]
host = "vega.locut.us"
port = 31337
"#;
let gateways: Gateways = toml::from_str(toml_str).unwrap();
assert_eq!(
gateways.gateways[0].address,
Address::Host {
host: "vega.locut.us".to_string(),
port: 31337
}
);
}
#[test]
fn test_address_deser_new_host_explicit_nondefault_port() {
let toml_str = r#"
[[gateways]]
public_key = "keys/k.pem"
[gateways.address]
host = "example.com"
port = 12345
"#;
let gateways: Gateways = toml::from_str(toml_str).unwrap();
assert_eq!(
gateways.gateways[0].address,
Address::Host {
host: "example.com".to_string(),
port: 12345
}
);
}
#[test]
fn test_address_deser_new_host_default_port() {
let toml_str = r#"
[[gateways]]
public_key = "keys/public.vega.gw.pem"
[gateways.address]
host = "vega.locut.us"
"#;
let gateways: Gateways = toml::from_str(toml_str).unwrap();
assert_eq!(
gateways.gateways[0].address,
Address::Host {
host: "vega.locut.us".to_string(),
port: DEFAULT_GATEWAY_PORT
}
);
assert_eq!(DEFAULT_GATEWAY_PORT, 31337);
}
#[test]
fn test_address_deser_port_without_host_is_error() {
let toml_str = r#"
[[gateways]]
public_key = "keys/k.pem"
[gateways.address]
hostname = "example.com:80"
port = 31337
"#;
assert!(toml::from_str::<Gateways>(toml_str).is_err());
}
#[test]
fn test_address_deser_empty_is_error() {
let toml_str = r#"
[[gateways]]
public_key = "keys/k.pem"
[gateways.address]
"#;
assert!(toml::from_str::<Gateways>(toml_str).is_err());
}
#[test]
fn test_address_deser_conflicting_forms_is_error() {
let toml_str = r#"
[[gateways]]
public_key = "keys/k.pem"
[gateways.address]
host = "example.com"
hostname = "example.com:31337"
"#;
assert!(toml::from_str::<Gateways>(toml_str).is_err());
}
#[test]
fn test_address_host_variant_roundtrip() {
let gateways = Gateways {
gateways: vec![GatewayConfig {
address: Address::Host {
host: "vega.locut.us".to_string(),
port: 31337,
},
public_key_path: PathBuf::from("keys/k.pem"),
location: None,
}],
};
let serialized = toml::to_string(&gateways).unwrap();
assert!(
serialized.contains("host = \"vega.locut.us\"") && serialized.contains("port = 31337"),
"unexpected serialized form:\n{serialized}"
);
assert!(
!serialized.contains("[gateways.address.host]"),
"Host variant must not nest under its own sub-table:\n{serialized}"
);
let deserialized: Gateways = toml::from_str(&serialized).unwrap();
assert_eq!(
deserialized.gateways[0].address,
gateways.gateways[0].address
);
}
#[test]
fn test_address_legacy_variants_serialize_unchanged() {
let hostname = Gateways {
gateways: vec![GatewayConfig {
address: Address::Hostname("vega.locut.us:31337".to_string()),
public_key_path: PathBuf::from("keys/k.pem"),
location: None,
}],
};
let s = toml::to_string(&hostname).unwrap();
assert!(
s.contains("hostname = \"vega.locut.us:31337\""),
"legacy hostname form changed:\n{s}"
);
let host_addr = Gateways {
gateways: vec![GatewayConfig {
address: Address::HostAddress("203.0.113.1:31337".parse().unwrap()),
public_key_path: PathBuf::from("keys/k.pem"),
location: None,
}],
};
let s = toml::to_string(&host_addr).unwrap();
assert!(
s.contains("host_address = \"203.0.113.1:31337\""),
"legacy host_address form changed:\n{s}"
);
}
#[tokio::test]
#[ignore = "Requires gateway keys to be updated to X25519 format (issue #2531)"]
async fn test_remote_freenet_gateways() {
let tmp_dir = tempfile::tempdir().unwrap();
let gateways = load_gateways_from_index(FREENET_GATEWAYS_INDEX, tmp_dir.path())
.await
.unwrap();
assert!(!gateways.gateways.is_empty());
for gw in gateways.gateways {
assert!(gw.public_key_path.exists());
let key_contents = std::fs::read_to_string(&gw.public_key_path).unwrap();
let key_bytes =
hex::decode(key_contents.trim()).expect("Gateway public key should be valid hex");
assert_eq!(
key_bytes.len(),
32,
"Gateway public key should be 32 bytes (X25519)"
);
let socket = NodeConfig::parse_socket_addr(&gw.address).await.unwrap();
assert!(socket.port() > 1024); }
}
#[test]
fn test_streaming_config_defaults_via_serde() {
let minimal_config = r#"
network-address = "127.0.0.1"
network-port = 8080
"#;
let network_api: NetworkApiConfig = toml::from_str(minimal_config).unwrap();
assert_eq!(
network_api.streaming_threshold,
64 * 1024,
"Default streaming threshold should be 64KB"
);
}
#[test]
fn test_streaming_config_serde() {
let config_str = r#"
network-address = "127.0.0.1"
network-port = 8080
streaming-threshold = 131072
"#;
let config: NetworkApiConfig = toml::from_str(config_str).unwrap();
assert_eq!(config.streaming_threshold, 128 * 1024);
let serialized = toml::to_string(&config).unwrap();
assert!(serialized.contains("streaming-threshold = 131072"));
}
#[test]
fn test_network_args_streaming_defaults() {
let args = NetworkArgs::default();
assert!(
args.streaming_threshold.is_none(),
"NetworkArgs.streaming_threshold should be None by default"
);
}
#[test]
fn test_congestion_control_config_defaults() {
let config_str = r#"
network-address = "127.0.0.1"
network-port = 8080
"#;
let network_api: NetworkApiConfig = toml::from_str(config_str).unwrap();
assert_eq!(
network_api.congestion_control, "fixedrate",
"Default congestion control should be fixedrate"
);
assert!(
network_api.bbr_startup_rate.is_none(),
"Default BBR startup rate should be None"
);
let cc_config = network_api.build_congestion_config();
assert_eq!(cc_config.algorithm, CongestionControlAlgorithm::FixedRate);
}
#[test]
fn test_congestion_control_config_bbr() {
let config_str = r#"
network-address = "127.0.0.1"
network-port = 8080
congestion-control = "bbr"
bbr-startup-rate = 10000000
"#;
let config: NetworkApiConfig = toml::from_str(config_str).unwrap();
assert_eq!(config.congestion_control, "bbr");
assert_eq!(config.bbr_startup_rate, Some(10_000_000));
let cc_config = config.build_congestion_config();
assert_eq!(cc_config.algorithm, CongestionControlAlgorithm::Bbr);
}
#[test]
fn test_congestion_control_config_ledbat() {
let config_str = r#"
network-address = "127.0.0.1"
network-port = 8080
congestion-control = "ledbat"
"#;
let config: NetworkApiConfig = toml::from_str(config_str).unwrap();
assert_eq!(config.congestion_control, "ledbat");
let cc_config = config.build_congestion_config();
assert_eq!(cc_config.algorithm, CongestionControlAlgorithm::Ledbat);
}
#[test]
fn test_congestion_control_config_serde_roundtrip() {
let config_str = r#"
network-address = "127.0.0.1"
network-port = 8080
congestion-control = "bbr"
bbr-startup-rate = 5000000
"#;
let config: NetworkApiConfig = toml::from_str(config_str).unwrap();
let serialized = toml::to_string(&config).unwrap();
assert!(serialized.contains("congestion-control = \"bbr\""));
assert!(serialized.contains("bbr-startup-rate = 5000000"));
let config2: NetworkApiConfig = toml::from_str(&serialized).unwrap();
assert_eq!(config2.congestion_control, "bbr");
assert_eq!(config2.bbr_startup_rate, Some(5_000_000));
}
#[test]
fn test_set_seed_pins_thread_index_to_zero() {
GlobalRng::clear_seed();
GlobalRng::set_seed(0xDEAD_BEEF);
assert_eq!(GlobalRng::thread_index(), 0);
let val1 = GlobalRng::random_u64();
GlobalRng::set_seed(0xDEAD_BEEF);
let val2 = GlobalRng::random_u64();
assert_eq!(val1, val2);
GlobalRng::clear_seed();
}
#[tokio::test]
async fn test_config_build_with_gateway_flag() {
let keypair = TransportKeypair::new();
let key_hex = hex::encode(keypair.public().as_bytes());
let temp_dir = tempfile::tempdir().unwrap();
let args = ConfigArgs {
mode: Some(OperationMode::Local),
config_paths: ConfigPathsArgs {
config_dir: Some(temp_dir.path().to_path_buf()),
data_dir: Some(temp_dir.path().to_path_buf()),
log_dir: Some(temp_dir.path().to_path_buf()),
},
network_api: NetworkArgs {
gateway: Some(vec![format!("192.168.1.1:31337,{key_hex}")]),
..Default::default()
},
..Default::default()
};
let cfg = args.build().await.unwrap();
assert_eq!(cfg.gateways.len(), 1);
assert_eq!(
cfg.gateways[0].address,
Address::HostAddress("192.168.1.1:31337".parse().unwrap())
);
}
#[test]
fn test_parse_gateway_valid() {
let keypair = TransportKeypair::new();
let key_hex = hex::encode(keypair.public().as_bytes());
let input = format!("192.168.1.1:31337,{key_hex}");
let tmp_dir = tempfile::tempdir().unwrap();
let gw = parse_gateway(&input, tmp_dir.path()).unwrap();
assert_eq!(
gw.address,
Address::HostAddress("192.168.1.1:31337".parse().unwrap())
);
assert!(gw.public_key_path.exists());
let saved_key = std::fs::read_to_string(&gw.public_key_path).unwrap();
assert_eq!(saved_key, key_hex);
assert_eq!(gw.location, None);
}
#[test]
fn test_parse_gateway_invalid_format() {
let tmp_dir = tempfile::tempdir().unwrap();
assert!(parse_gateway("192.168.1.1:31337", tmp_dir.path()).is_err());
assert!(parse_gateway("192.168.1.1:31337,not_hex_at_all!", tmp_dir.path()).is_err());
let short_hex = "ab".repeat(16);
assert!(parse_gateway(&format!("192.168.1.1:31337,{short_hex}"), tmp_dir.path()).is_err());
let key_hex = "ab".repeat(32);
assert!(parse_gateway(&format!("not_an_addr,{key_hex}"), tmp_dir.path()).is_err());
}
#[test]
fn test_gateway_deduplication() {
let keypair = TransportKeypair::new();
let key_hex = hex::encode(keypair.public().as_bytes());
let tmp_dir = tempfile::tempdir().unwrap();
let addr: SocketAddr = "10.0.0.1:31337".parse().unwrap();
let file_loaded = Gateways {
gateways: vec![GatewayConfig {
address: Address::HostAddress(addr),
public_key_path: PathBuf::from("old/key/path"),
location: None,
}],
};
let gw = parse_gateway(&format!("{addr},{key_hex}"), tmp_dir.path()).unwrap();
let cli_key_path = gw.public_key_path.clone();
let mut cli = Gateways { gateways: vec![gw] };
cli.merge_and_deduplicate(file_loaded);
assert_eq!(cli.gateways.len(), 1);
assert_eq!(cli.gateways[0].public_key_path, cli_key_path);
}
#[tokio::test]
async fn test_config_build_network_mode_gateway_only() {
let keypair = TransportKeypair::new();
let key_hex = hex::encode(keypair.public().as_bytes());
let temp_dir = tempfile::tempdir().unwrap();
let args = ConfigArgs {
mode: Some(OperationMode::Network),
config_paths: ConfigPathsArgs {
config_dir: Some(temp_dir.path().to_path_buf()),
data_dir: Some(temp_dir.path().to_path_buf()),
log_dir: Some(temp_dir.path().to_path_buf()),
},
network_api: NetworkArgs {
gateway: Some(vec![format!("203.0.113.1:31337,{key_hex}")]),
skip_load_from_network: true,
..Default::default()
},
..Default::default()
};
let cfg = args.build().await.unwrap();
assert_eq!(cfg.gateways.len(), 1);
assert_eq!(
cfg.gateways[0].address,
Address::HostAddress("203.0.113.1:31337".parse().unwrap())
);
}
#[tokio::test]
async fn test_config_build_multiple_gateways() {
let kp1 = TransportKeypair::new();
let kp2 = TransportKeypair::new();
let kp3 = TransportKeypair::new();
let hex1 = hex::encode(kp1.public().as_bytes());
let hex2 = hex::encode(kp2.public().as_bytes());
let hex3 = hex::encode(kp3.public().as_bytes());
let temp_dir = tempfile::tempdir().unwrap();
let args = ConfigArgs {
mode: Some(OperationMode::Local),
config_paths: ConfigPathsArgs {
config_dir: Some(temp_dir.path().to_path_buf()),
data_dir: Some(temp_dir.path().to_path_buf()),
log_dir: Some(temp_dir.path().to_path_buf()),
},
network_api: NetworkArgs {
gateway: Some(vec![
format!("10.0.0.1:31337,{hex1}"),
format!("10.0.0.2:31337,{hex2}"),
format!("10.0.0.3:31337,{hex3}"),
]),
..Default::default()
},
..Default::default()
};
let cfg = args.build().await.unwrap();
assert_eq!(cfg.gateways.len(), 3);
let addrs: Vec<_> = cfg.gateways.iter().map(|g| g.address.clone()).collect();
assert!(addrs.contains(&Address::HostAddress("10.0.0.1:31337".parse().unwrap())));
assert!(addrs.contains(&Address::HostAddress("10.0.0.2:31337".parse().unwrap())));
assert!(addrs.contains(&Address::HostAddress("10.0.0.3:31337".parse().unwrap())));
}
#[tokio::test]
async fn test_gateway_overrides_file_loaded() {
let keypair = TransportKeypair::new();
let key_hex = hex::encode(keypair.public().as_bytes());
let tmp_dir = tempfile::tempdir().unwrap();
let addr: SocketAddr = "10.0.0.1:31337".parse().unwrap();
let mut file_gateways = Gateways {
gateways: vec![GatewayConfig {
address: Address::HostAddress(addr),
public_key_path: PathBuf::from("old/stale/key.pub"),
location: None,
}],
};
let gw = parse_gateway(&format!("{addr},{key_hex}"), tmp_dir.path()).unwrap();
let cli_key_path = gw.public_key_path.clone();
let mut cli_gateways = Gateways { gateways: vec![gw] };
cli_gateways.merge_and_deduplicate(file_gateways);
file_gateways = cli_gateways;
assert_eq!(file_gateways.gateways.len(), 1);
assert_eq!(file_gateways.gateways[0].public_key_path, cli_key_path);
}
#[tokio::test]
async fn test_config_build_network_mode_empty_gateway() {
let temp_dir = tempfile::tempdir().unwrap();
let args = ConfigArgs {
mode: Some(OperationMode::Network),
config_paths: ConfigPathsArgs {
config_dir: Some(temp_dir.path().to_path_buf()),
data_dir: Some(temp_dir.path().to_path_buf()),
log_dir: Some(temp_dir.path().to_path_buf()),
},
network_api: NetworkArgs {
gateway: Some(vec![]),
skip_load_from_network: true,
..Default::default()
},
..Default::default()
};
let err = args.build().await.unwrap_err();
assert!(
err.to_string()
.contains("Cannot initialize node without gateways"),
"Expected 'Cannot initialize node without gateways', got: {err}"
);
}
fn empty_gateways_index_server() -> (Server, String) {
let server = Server::run();
server.expect(
Expectation::matching(request::method("GET"))
.times(..)
.respond_with(status_code(200).body("")),
);
let url = server.url_str("/gateways.toml");
(server, url)
}
#[tokio::test]
async fn test_file_load_branch_isolated_gateway_succeeds() {
let temp_dir = tempfile::tempdir().unwrap();
let config_dir = temp_dir.path();
assert!(!config_dir.join("gateways.toml").exists());
let (_server, index_url) = empty_gateways_index_server();
let args = ConfigArgs {
mode: Some(OperationMode::Network),
config_paths: ConfigPathsArgs {
config_dir: Some(config_dir.to_path_buf()),
data_dir: Some(config_dir.to_path_buf()),
log_dir: Some(config_dir.to_path_buf()),
},
network_api: NetworkArgs {
is_gateway: true,
public_address: Some("203.0.113.10".parse().unwrap()),
public_port: Some(31337),
network_port: Some(31337),
..Default::default()
},
..Default::default()
};
let cfg = args
.build_with_gateways_index(&index_url)
.await
.expect("isolated gateway with no bootstrap gateways must be allowed to start");
assert!(cfg.is_gateway);
assert!(
cfg.gateways.is_empty(),
"isolated gateway should start with no bootstrap gateways, got {:?}",
cfg.gateways
);
assert!(
cfg.peer_id.is_some(),
"expected peer_id to be derived from public address + port"
);
}
#[tokio::test]
async fn test_gateway_without_public_port_is_rejected() {
let temp_dir = tempfile::tempdir().unwrap();
let config_dir = temp_dir.path();
let (_server, index_url) = empty_gateways_index_server();
let args = ConfigArgs {
mode: Some(OperationMode::Network),
config_paths: ConfigPathsArgs {
config_dir: Some(config_dir.to_path_buf()),
data_dir: Some(config_dir.to_path_buf()),
log_dir: Some(config_dir.to_path_buf()),
},
network_api: NetworkArgs {
is_gateway: true,
public_address: Some("203.0.113.10".parse().unwrap()),
network_port: Some(31337),
public_port: None,
..Default::default()
},
..Default::default()
};
let err = args
.build_with_gateways_index(&index_url)
.await
.expect_err("gateway without --public-network-port must be rejected");
assert!(
err.to_string().contains("public network port"),
"expected error to mention the missing public network port, got: {err}"
);
}
#[tokio::test]
async fn test_file_load_branch_non_gateway_without_gateways_is_rejected() {
let temp_dir = tempfile::tempdir().unwrap();
let config_dir = temp_dir.path();
assert!(!config_dir.join("gateways.toml").exists());
let (_server, index_url) = empty_gateways_index_server();
let args = ConfigArgs {
mode: Some(OperationMode::Network),
config_paths: ConfigPathsArgs {
config_dir: Some(config_dir.to_path_buf()),
data_dir: Some(config_dir.to_path_buf()),
log_dir: Some(config_dir.to_path_buf()),
},
network_api: NetworkArgs {
is_gateway: false,
..Default::default()
},
..Default::default()
};
let err = args
.build_with_gateways_index(&index_url)
.await
.expect_err("non-gateway peer without any gateways must be rejected");
assert!(
err.to_string()
.contains("Cannot initialize node without gateways"),
"Expected 'Cannot initialize node without gateways', got: {err}"
);
}
#[tokio::test]
async fn test_file_load_branch_public_non_gateway_bootstraps_disjoint() {
let temp_dir = tempfile::tempdir().unwrap();
let config_dir = temp_dir.path();
assert!(!config_dir.join("gateways.toml").exists());
let (_server, index_url) = empty_gateways_index_server();
let args = ConfigArgs {
mode: Some(OperationMode::Network),
config_paths: ConfigPathsArgs {
config_dir: Some(config_dir.to_path_buf()),
data_dir: Some(config_dir.to_path_buf()),
log_dir: Some(config_dir.to_path_buf()),
},
network_api: NetworkArgs {
is_gateway: false,
public_address: Some("198.51.100.7".parse().unwrap()),
public_port: Some(31337),
..Default::default()
},
..Default::default()
};
let cfg = args
.build_with_gateways_index(&index_url)
.await
.expect("public non-gateway peer must be allowed to bootstrap disjoint");
assert!(!cfg.is_gateway);
assert!(
cfg.gateways.is_empty(),
"disjoint peer should start with no gateways, got {:?}",
cfg.gateways
);
}
#[tokio::test]
async fn test_skip_load_from_network_with_cli_gateway_ignores_on_disk_file() {
let temp_dir = tempfile::tempdir().unwrap();
let config_dir = temp_dir.path();
let gateways_file = config_dir.join("gateways.toml");
let public_gateway_addr: SocketAddr = "203.0.113.99:31337".parse().unwrap();
let preexisting = toml::to_string(&Gateways {
gateways: vec![GatewayConfig {
address: Address::HostAddress(public_gateway_addr),
public_key_path: PathBuf::from("public_gateway.pub"),
location: None,
}],
})
.unwrap();
fs::write(&gateways_file, preexisting).unwrap();
let isolated_keypair = TransportKeypair::new();
let isolated_key_hex = hex::encode(isolated_keypair.public().as_bytes());
let isolated_addr: SocketAddr = "127.0.0.1:31338".parse().unwrap();
let args = ConfigArgs {
mode: Some(OperationMode::Network),
config_paths: ConfigPathsArgs {
config_dir: Some(config_dir.to_path_buf()),
data_dir: Some(config_dir.to_path_buf()),
log_dir: Some(config_dir.to_path_buf()),
},
network_api: NetworkArgs {
gateway: Some(vec![format!("{isolated_addr},{isolated_key_hex}")]),
skip_load_from_network: true,
..Default::default()
},
..Default::default()
};
let cfg = args.build().await.unwrap();
assert_eq!(cfg.gateways.len(), 1, "gateways={:?}", cfg.gateways);
assert_eq!(
cfg.gateways[0].address,
Address::HostAddress(isolated_addr),
"isolated gateway should be selected"
);
assert!(
!cfg.gateways
.iter()
.any(|gw| gw.address == Address::HostAddress(public_gateway_addr)),
"on-disk gateways.toml leaked into final config despite skip_load_from_network"
);
}
#[tokio::test]
async fn test_skip_load_from_network_without_cli_gateways_reads_on_disk_file() {
let temp_dir = tempfile::tempdir().unwrap();
let config_dir = temp_dir.path();
let gateways_file = config_dir.join("gateways.toml");
let test_gateway_addr: SocketAddr = "10.20.30.40:31337".parse().unwrap();
let preexisting = toml::to_string(&Gateways {
gateways: vec![GatewayConfig {
address: Address::HostAddress(test_gateway_addr),
public_key_path: PathBuf::from("test_gateway.pub"),
location: None,
}],
})
.unwrap();
fs::write(&gateways_file, preexisting).unwrap();
let args = ConfigArgs {
mode: Some(OperationMode::Network),
config_paths: ConfigPathsArgs {
config_dir: Some(config_dir.to_path_buf()),
data_dir: Some(config_dir.to_path_buf()),
log_dir: Some(config_dir.to_path_buf()),
},
network_api: NetworkArgs {
is_gateway: false,
public_address: Some("198.51.100.1".parse().unwrap()),
public_port: Some(31338),
skip_load_from_network: true,
..Default::default()
},
..Default::default()
};
let cfg = args.build().await.unwrap();
assert_eq!(cfg.gateways.len(), 1, "gateways={:?}", cfg.gateways);
assert_eq!(
cfg.gateways[0].address,
Address::HostAddress(test_gateway_addr),
"on-disk gateways.toml must be honored when --gateway is not supplied"
);
}
#[tokio::test]
async fn test_skip_load_from_network_gateway_mode_ignores_on_disk_file() {
let temp_dir = tempfile::tempdir().unwrap();
let config_dir = temp_dir.path();
let gateways_file = config_dir.join("gateways.toml");
let leaked_addr: SocketAddr = "192.0.2.50:31337".parse().unwrap();
let preexisting = toml::to_string(&Gateways {
gateways: vec![GatewayConfig {
address: Address::HostAddress(leaked_addr),
public_key_path: PathBuf::from("leaked.pub"),
location: None,
}],
})
.unwrap();
fs::write(&gateways_file, preexisting).unwrap();
let args = ConfigArgs {
mode: Some(OperationMode::Network),
config_paths: ConfigPathsArgs {
config_dir: Some(config_dir.to_path_buf()),
data_dir: Some(config_dir.to_path_buf()),
log_dir: Some(config_dir.to_path_buf()),
},
network_api: NetworkArgs {
is_gateway: true,
public_address: Some("198.51.100.1".parse().unwrap()),
public_port: Some(31337),
skip_load_from_network: true,
..Default::default()
},
..Default::default()
};
let cfg = args.build().await.unwrap();
assert!(cfg.is_gateway);
assert!(
cfg.gateways.is_empty(),
"isolated gateway must NOT read gateways.toml; got {:?}",
cfg.gateways
);
}
#[tokio::test]
async fn test_skip_load_from_network_preserves_inline_gateways_with_cli_gateway() {
let temp_dir = tempfile::tempdir().unwrap();
let config_dir = temp_dir.path();
let leaked_addr: SocketAddr = "192.0.2.99:31337".parse().unwrap();
let preexisting = toml::to_string(&Gateways {
gateways: vec![GatewayConfig {
address: Address::HostAddress(leaked_addr),
public_key_path: PathBuf::from("leaked.pub"),
location: None,
}],
})
.unwrap();
fs::write(config_dir.join("gateways.toml"), preexisting).unwrap();
let json_keypair = TransportKeypair::new();
let json_key_path = config_dir.join("json_gw.pub");
fs::write(
&json_key_path,
hex::encode(json_keypair.public().as_bytes()),
)
.unwrap();
let json_addr: SocketAddr = "10.10.10.10:31337".parse().unwrap();
let json_inline = serde_json::to_string(&InlineGwConfig {
address: json_addr,
public_key_path: json_key_path,
location: None,
})
.unwrap();
let cli_keypair = TransportKeypair::new();
let cli_key_hex = hex::encode(cli_keypair.public().as_bytes());
let cli_addr: SocketAddr = "10.20.20.20:31337".parse().unwrap();
let args = ConfigArgs {
mode: Some(OperationMode::Network),
config_paths: ConfigPathsArgs {
config_dir: Some(config_dir.to_path_buf()),
data_dir: Some(config_dir.to_path_buf()),
log_dir: Some(config_dir.to_path_buf()),
},
network_api: NetworkArgs {
gateway: Some(vec![format!("{cli_addr},{cli_key_hex}")]),
gateways: Some(vec![json_inline]),
skip_load_from_network: true,
..Default::default()
},
..Default::default()
};
let cfg = args.build().await.unwrap();
let addrs: Vec<_> = cfg.gateways.iter().map(|gw| gw.address.clone()).collect();
assert!(
addrs.contains(&Address::HostAddress(cli_addr)),
"CLI --gateway must be in final list: {addrs:?}"
);
assert!(
addrs.contains(&Address::HostAddress(json_addr)),
"Inline --gateways JSON entry must be in final list: {addrs:?}"
);
assert!(
!addrs.contains(&Address::HostAddress(leaked_addr)),
"On-disk gateways.toml must NOT leak when --gateway is supplied: {addrs:?}"
);
assert_eq!(
addrs.len(),
2,
"expected exactly cli + json entries: {addrs:?}"
);
}
#[tokio::test]
async fn test_skip_load_from_network_isolated_gateway_with_cli_gateway_ignores_file() {
let temp_dir = tempfile::tempdir().unwrap();
let config_dir = temp_dir.path();
let leaked_addr: SocketAddr = "192.0.2.77:31337".parse().unwrap();
let preexisting = toml::to_string(&Gateways {
gateways: vec![GatewayConfig {
address: Address::HostAddress(leaked_addr),
public_key_path: PathBuf::from("leaked.pub"),
location: None,
}],
})
.unwrap();
fs::write(config_dir.join("gateways.toml"), preexisting).unwrap();
let cli_keypair = TransportKeypair::new();
let cli_key_hex = hex::encode(cli_keypair.public().as_bytes());
let cli_addr: SocketAddr = "10.30.30.30:31337".parse().unwrap();
let args = ConfigArgs {
mode: Some(OperationMode::Network),
config_paths: ConfigPathsArgs {
config_dir: Some(config_dir.to_path_buf()),
data_dir: Some(config_dir.to_path_buf()),
log_dir: Some(config_dir.to_path_buf()),
},
network_api: NetworkArgs {
is_gateway: true,
public_address: Some("198.51.100.7".parse().unwrap()),
public_port: Some(31337),
gateway: Some(vec![format!("{cli_addr},{cli_key_hex}")]),
skip_load_from_network: true,
..Default::default()
},
..Default::default()
};
let cfg = args.build().await.unwrap();
let addrs: Vec<_> = cfg.gateways.iter().map(|gw| gw.address.clone()).collect();
assert!(cfg.is_gateway);
assert_eq!(addrs.len(), 1, "expected only the CLI gateway: {addrs:?}");
assert_eq!(addrs[0], Address::HostAddress(cli_addr));
assert!(
!addrs.contains(&Address::HostAddress(leaked_addr)),
"isolated gateway leaked file content: {addrs:?}"
);
}
#[tokio::test]
async fn test_config_build_invalid_gateway_error() {
let temp_dir = tempfile::tempdir().unwrap();
let args = ConfigArgs {
mode: Some(OperationMode::Local),
config_paths: ConfigPathsArgs {
config_dir: Some(temp_dir.path().to_path_buf()),
data_dir: Some(temp_dir.path().to_path_buf()),
log_dir: Some(temp_dir.path().to_path_buf()),
},
network_api: NetworkArgs {
gateway: Some(vec!["not-valid".into()]),
..Default::default()
},
..Default::default()
};
let err = args.build().await.unwrap_err();
assert!(
err.to_string().contains("Failed to parse --gateway"),
"Expected 'Failed to parse --gateway', got: {err}"
);
}
#[tokio::test]
async fn test_config_build_duplicate_gateway_entries() {
let keypair = TransportKeypair::new();
let key_hex = hex::encode(keypair.public().as_bytes());
let entry = format!("10.0.0.1:31337,{key_hex}");
let temp_dir = tempfile::tempdir().unwrap();
let args = ConfigArgs {
mode: Some(OperationMode::Local),
config_paths: ConfigPathsArgs {
config_dir: Some(temp_dir.path().to_path_buf()),
data_dir: Some(temp_dir.path().to_path_buf()),
log_dir: Some(temp_dir.path().to_path_buf()),
},
network_api: NetworkArgs {
gateway: Some(vec![entry.clone(), entry]),
..Default::default()
},
..Default::default()
};
let cfg = args.build().await.unwrap();
assert_eq!(cfg.gateways.len(), 1);
}
#[test]
fn test_parse_gateway_key_file_permissions() {
let keypair = TransportKeypair::new();
let key_hex = hex::encode(keypair.public().as_bytes());
let tmp_dir = tempfile::tempdir().unwrap();
let gw = parse_gateway(&format!("192.168.1.1:31337,{key_hex}"), tmp_dir.path()).unwrap();
assert!(gw.public_key_path.exists());
#[cfg(unix)]
{
use std::os::unix::fs::PermissionsExt;
let mode = std::fs::metadata(&gw.public_key_path)
.unwrap()
.permissions()
.mode()
& 0o777;
assert_eq!(mode, 0o600, "Key file should have 0600 permissions");
}
}
#[test]
fn an_empty_webapp_cache_dir_override_reads_as_unset() {
let default = resolve_webapp_cache_dir(None);
assert!(
default.is_absolute() && default.ends_with("webapp_cache"),
"premise: with no override the resolved root is the absolute XDG \
default; got {}",
default.display()
);
let explicit = std::path::PathBuf::from("/tmp/freenet-webapp-cache-test");
assert_eq!(
resolve_webapp_cache_dir(Some(explicit.clone().into_os_string())),
explicit,
"a non-empty override must be honoured verbatim"
);
assert_eq!(
resolve_webapp_cache_dir(Some(std::ffi::OsString::new())),
default,
"an override that is set but EMPTY must fall back to the default \
root. Honouring it roots the cache at \"\", which writes entries \
under the process's working directory and disables the size sweep \
entirely (read_dir(\"\") fails), with nothing logged or returned to \
say so."
);
}
#[test]
fn default_webapp_cache_dir_resolves_the_env_override() {
let src = production_source();
let body = extract_fn_body(src, "pub fn default_webapp_cache_dir()");
let collapsed: String = body.chars().filter(|c| !c.is_whitespace()).collect();
assert!(
collapsed.contains(concat!(
"resolve_webapp_cache_dir(std::env::var_os(",
"WEBAPP_CACHE_DIR_ENV))"
)),
"default_webapp_cache_dir must feed the environment read straight \
into the resolver; anything else means the operator override or \
the empty-value rule is no longer what production applies. Body: \
`{collapsed}`"
);
}
#[test]
fn standalone_websocket_api_config_resolves_the_real_webapp_cache_dir() {
let expected = default_webapp_cache_dir();
assert_eq!(
WebsocketApiConfig::default().webapp_cache_dir,
expected,
"Default must resolve the real cache root; see this test's rustdoc \
before changing it to an empty path"
);
assert_eq!(
WebsocketApiConfig::from(SocketAddr::from(([127, 0, 0, 1], 50509))).webapp_cache_dir,
expected,
"From<SocketAddr> must agree with Default; a split between them is \
how one composition path silently gets a different cache"
);
}
fn production_source() -> &'static str {
const FULL: &str = include_str!("config.rs");
let cutoff = FULL
.find(concat!("mod ", "tests {"))
.expect("config.rs must have a test module");
&FULL[..cutoff]
}
fn extract_fn_body<'a>(source: &'a str, signature_prefix: &str) -> &'a str {
let start = source
.find(signature_prefix)
.unwrap_or_else(|| panic!("could not find {signature_prefix}"));
let brace = source[start..].find('{').expect("fn signature has a body");
let body_start = start + brace + 1;
let bytes = source.as_bytes();
let mut depth: i32 = 1;
let mut i = body_start;
while i < bytes.len() {
match bytes[i] {
b'{' => depth += 1,
b'}' => {
depth -= 1;
if depth == 0 {
return &source[body_start..i];
}
}
_ => {}
}
i += 1;
}
panic!("unterminated body for {signature_prefix}");
}
fn ws_api_test_args(mode: OperationMode, config_dir: &std::path::Path) -> ConfigArgs {
ConfigArgs {
mode: Some(mode),
config_paths: ConfigPathsArgs {
config_dir: Some(config_dir.to_path_buf()),
data_dir: Some(config_dir.to_path_buf()),
log_dir: Some(config_dir.to_path_buf()),
},
network_api: NetworkArgs {
public_address: Some("198.51.100.7".parse().unwrap()),
public_port: Some(31337),
..Default::default()
},
..Default::default()
}
}
#[tokio::test]
async fn ws_api_defaults_to_loopback_in_network_mode() {
let temp_dir = tempfile::tempdir().unwrap();
let (_server, index_url) = empty_gateways_index_server();
let cfg = ws_api_test_args(OperationMode::Network, temp_dir.path())
.build_with_gateways_index(&index_url)
.await
.expect("build should succeed");
assert_eq!(
cfg.ws_api.address,
default_local_address(),
"a plain `freenet network` node must NOT expose its client API to the LAN"
);
assert!(cfg.ws_api.address.is_loopback());
}
#[tokio::test]
async fn ws_api_defaults_to_loopback_in_local_mode() {
let temp_dir = tempfile::tempdir().unwrap();
let (_server, index_url) = empty_gateways_index_server();
let cfg = ws_api_test_args(OperationMode::Local, temp_dir.path())
.build_with_gateways_index(&index_url)
.await
.expect("build should succeed");
assert_eq!(cfg.ws_api.address, default_local_address());
}
#[tokio::test]
async fn ws_api_auto_widens_when_allowed_source_cidrs_is_set() {
let temp_dir = tempfile::tempdir().unwrap();
let (_server, index_url) = empty_gateways_index_server();
let mut args = ws_api_test_args(OperationMode::Network, temp_dir.path());
args.ws_api.allowed_source_cidrs = Some(vec!["100.64.0.0/10".to_string()]);
let cfg = args
.build_with_gateways_index(&index_url)
.await
.expect("build should succeed");
assert_eq!(
cfg.ws_api.address,
default_listening_address(),
"--allowed-source-cidrs is a no-op on a loopback listener, so it must widen the bind"
);
}
#[tokio::test]
async fn allowed_host_alone_does_not_widen_the_bind() {
let temp_dir = tempfile::tempdir().unwrap();
let (_server, index_url) = empty_gateways_index_server();
let mut args = ws_api_test_args(OperationMode::Network, temp_dir.path());
args.ws_api.allowed_host = Some(vec!["node.example.org".to_string()]);
let cfg = args
.build_with_gateways_index(&index_url)
.await
.expect("build should succeed");
assert_eq!(cfg.ws_api.address, default_local_address());
assert_eq!(
cfg.ws_api.allowed_hosts.len(),
1,
"the allowlist still applies"
);
}
#[tokio::test]
async fn explicit_ws_api_address_is_never_auto_widened() {
let temp_dir = tempfile::tempdir().unwrap();
let (_server, index_url) = empty_gateways_index_server();
let mut args = ws_api_test_args(OperationMode::Network, temp_dir.path());
args.ws_api.address = Some(IpAddr::V4(Ipv4Addr::LOCALHOST));
args.ws_api.allowed_host = Some(vec!["try.freenet.org".to_string()]);
args.ws_api.allowed_source_cidrs = Some(vec!["100.64.0.0/10".to_string()]);
let cfg = args
.build_with_gateways_index(&index_url)
.await
.expect("build should succeed");
assert_eq!(cfg.ws_api.address, IpAddr::V4(Ipv4Addr::LOCALHOST));
}
#[test]
fn empty_allow_lists_do_not_widen() {
for mode in [OperationMode::Network, OperationMode::Local] {
assert_eq!(
resolve_ws_api_address(mode, None, Some(&[]), None),
(default_local_address(), WsApiAddressSource::DefaultLoopback)
);
assert_eq!(
resolve_ws_api_address(mode, None, None, None),
(default_local_address(), WsApiAddressSource::DefaultLoopback)
);
}
}
#[test]
fn blank_allow_list_entries_do_not_widen() {
assert_eq!(
resolve_ws_api_address(
OperationMode::Network,
None,
Some(&[String::new(), " ".to_string()]),
None,
),
(default_local_address(), WsApiAddressSource::DefaultLoopback)
);
}
#[test]
fn local_mode_never_auto_widens() {
for hint in [None, Some(IpAddr::V4(Ipv4Addr::UNSPECIFIED))] {
let (addr, source) = resolve_ws_api_address(
OperationMode::Local,
None,
Some(&["100.64.0.0/10".to_string()]),
hint,
);
assert_eq!(source, WsApiAddressSource::DefaultLoopback);
assert!(
addr.is_loopback(),
"local mode must stay loopback, got {addr}"
);
}
}
#[test]
fn resolve_ws_api_address_reports_how_it_decided() {
let explicit = IpAddr::V4(Ipv4Addr::new(192, 168, 1, 50));
for mode in [OperationMode::Network, OperationMode::Local] {
assert_eq!(
resolve_ws_api_address(mode, Some(explicit), None, None),
(explicit, WsApiAddressSource::Explicit)
);
}
assert_eq!(
resolve_ws_api_address(
OperationMode::Network,
None,
Some(&["10.0.0.0/8".to_string()]),
None
),
(default_listening_address(), WsApiAddressSource::AutoWidened)
);
assert_eq!(
resolve_ws_api_address(OperationMode::Network, None, None, None),
(default_local_address(), WsApiAddressSource::DefaultLoopback)
);
}
#[test]
fn auto_derivable_addresses_are_exactly_the_ones_this_code_writes() {
for auto in [
default_listening_address(),
IpAddr::V4(Ipv4Addr::UNSPECIFIED),
default_local_address(),
] {
assert!(is_auto_derivable_ws_api_address(auto), "{auto}");
}
assert!(is_auto_derivable_ws_api_address(IpAddr::V4(
Ipv4Addr::LOCALHOST
)));
for chosen in [
IpAddr::V4(Ipv4Addr::new(127, 0, 0, 5)),
IpAddr::V4(Ipv4Addr::new(192, 168, 1, 50)),
] {
assert!(!is_auto_derivable_ws_api_address(chosen), "{chosen}");
}
}
#[test]
fn exposure_warning_fires_only_when_one_namespace_is_reachable_remotely() {
let loopback = default_local_address();
let wildcard = default_listening_address();
let proxy = vec!["try.freenet.org".to_string()];
assert_eq!(
ws_api_shares_one_namespace_with_remote_clients(false, loopback, &[]),
None
);
assert_eq!(
ws_api_shares_one_namespace_with_remote_clients(true, loopback, &proxy),
None
);
let bind_reason = ws_api_shares_one_namespace_with_remote_clients(false, wildcard, &[])
.expect("a wildcard bind with hosted mode off must warn");
assert!(bind_reason.contains("non-loopback"), "{bind_reason}");
let hosted_wide = ws_api_shares_one_namespace_with_remote_clients(true, wildcard, &proxy)
.expect("a wildcard bind must warn even in hosted mode");
assert!(hosted_wide.contains("hosted mode does"), "{hosted_wide}");
let proxy_reason = ws_api_shares_one_namespace_with_remote_clients(false, loopback, &proxy)
.expect("a proxied node with hosted mode off must warn");
assert!(proxy_reason.contains("--allowed-host"), "{proxy_reason}");
}
#[tokio::test]
async fn persisted_legacy_wildcard_address_is_re_derived_to_loopback() {
let temp_dir = tempfile::tempdir().unwrap();
let (_server, index_url) = empty_gateways_index_server();
let mut first = ws_api_test_args(OperationMode::Network, temp_dir.path());
first.ws_api.address = Some(default_listening_address());
let first_cfg = first
.build_with_gateways_index(&index_url)
.await
.expect("first build should succeed");
assert_eq!(first_cfg.ws_api.address, default_listening_address());
let persisted =
std::fs::read_to_string(temp_dir.path().join("config.toml")).expect("config persisted");
assert!(
persisted.contains(r#"ws-api-address = "::""#),
"test premise: the wildcard must actually be written to config.toml, got:\n{persisted}"
);
let cfg = ws_api_test_args(OperationMode::Network, temp_dir.path())
.build_with_gateways_index(&index_url)
.await
.expect("second build should succeed");
assert_eq!(
cfg.ws_api.address,
default_local_address(),
"an upgrading node must stop exposing its client API to the LAN"
);
}
#[tokio::test]
async fn re_derivation_preserves_the_address_family() {
for (persisted, expected) in [
(
IpAddr::V4(Ipv4Addr::UNSPECIFIED),
IpAddr::V4(Ipv4Addr::LOCALHOST),
),
(
IpAddr::V6(Ipv6Addr::UNSPECIFIED),
IpAddr::V6(Ipv6Addr::LOCALHOST),
),
] {
let temp_dir = tempfile::tempdir().unwrap();
let (_server, index_url) = empty_gateways_index_server();
let mut first = ws_api_test_args(OperationMode::Network, temp_dir.path());
first.ws_api.address = Some(persisted);
first
.build_with_gateways_index(&index_url)
.await
.expect("first build should succeed");
let cfg = ws_api_test_args(OperationMode::Network, temp_dir.path())
.build_with_gateways_index(&index_url)
.await
.expect("second build should succeed");
assert_eq!(
cfg.ws_api.address, expected,
"persisted {persisted} must re-derive within its own family; \
crossing families is a fatal bind on a single-stack host"
);
}
}
#[tokio::test]
async fn auto_widen_preserves_the_address_family() {
let temp_dir = tempfile::tempdir().unwrap();
let (_server, index_url) = empty_gateways_index_server();
let mut first = ws_api_test_args(OperationMode::Network, temp_dir.path());
first.ws_api.address = Some(IpAddr::V4(Ipv4Addr::UNSPECIFIED));
first
.build_with_gateways_index(&index_url)
.await
.expect("first build should succeed");
let mut remedied = ws_api_test_args(OperationMode::Network, temp_dir.path());
remedied.ws_api.allowed_source_cidrs = Some(vec!["100.64.0.0/10".to_string()]);
let cfg = remedied
.build_with_gateways_index(&index_url)
.await
.expect("second build should succeed");
assert_eq!(cfg.ws_api.address, IpAddr::V4(Ipv4Addr::UNSPECIFIED));
}
#[tokio::test]
async fn persisted_explicit_address_survives_the_migration() {
for chosen in [
IpAddr::V4(Ipv4Addr::new(192, 168, 1, 50)),
IpAddr::V4(Ipv4Addr::new(127, 0, 0, 5)),
] {
let temp_dir = tempfile::tempdir().unwrap();
let (_server, index_url) = empty_gateways_index_server();
let mut first = ws_api_test_args(OperationMode::Network, temp_dir.path());
first.ws_api.address = Some(chosen);
first
.build_with_gateways_index(&index_url)
.await
.expect("first build should succeed");
let cfg = ws_api_test_args(OperationMode::Network, temp_dir.path())
.build_with_gateways_index(&index_url)
.await
.expect("second build should succeed");
assert_eq!(cfg.ws_api.address, chosen);
}
}
#[tokio::test]
async fn upgrading_node_with_cidr_grant_keeps_its_wildcard_bind() {
let temp_dir = tempfile::tempdir().unwrap();
let (_server, index_url) = empty_gateways_index_server();
let mut first = ws_api_test_args(OperationMode::Network, temp_dir.path());
first.ws_api.address = Some(default_listening_address());
first.ws_api.allowed_source_cidrs = Some(vec!["100.64.0.0/10".to_string()]);
first
.build_with_gateways_index(&index_url)
.await
.expect("first build should succeed");
let mut second = ws_api_test_args(OperationMode::Network, temp_dir.path());
second.ws_api.allowed_source_cidrs = Some(vec!["100.64.0.0/10".to_string()]);
let cfg = second
.build_with_gateways_index(&index_url)
.await
.expect("second build should succeed");
assert_eq!(cfg.ws_api.address, default_listening_address());
assert_eq!(cfg.ws_api.allowed_source_cidrs.len(), 1);
}
#[tokio::test]
async fn a_persisted_cidr_grant_does_not_widen_a_later_flagless_boot() {
let temp_dir = tempfile::tempdir().unwrap();
let (_server, index_url) = empty_gateways_index_server();
let mut first = ws_api_test_args(OperationMode::Network, temp_dir.path());
first.ws_api.allowed_source_cidrs = Some(vec!["100.64.0.0/10".to_string()]);
let widened = first
.build_with_gateways_index(&index_url)
.await
.expect("first build should succeed");
assert_eq!(widened.ws_api.address, default_listening_address());
let cfg = ws_api_test_args(OperationMode::Network, temp_dir.path())
.build_with_gateways_index(&index_url)
.await
.expect("second build should succeed");
assert_eq!(
cfg.ws_api.address,
default_local_address(),
"a grant the operator no longer passes must not keep the socket wide"
);
assert_eq!(cfg.ws_api.allowed_source_cidrs.len(), 1);
}
#[tokio::test]
async fn build_records_the_exposure_decision_for_later_reporting() {
let temp_dir = tempfile::tempdir().unwrap();
let (_server, index_url) = empty_gateways_index_server();
let mut args = ws_api_test_args(OperationMode::Network, temp_dir.path());
args.ws_api.allowed_source_cidrs = Some(vec!["100.64.0.0/10".to_string()]);
let widened = args
.build_with_gateways_index(&index_url)
.await
.expect("build should succeed");
assert_eq!(
widened.ws_api.exposure.source,
WsApiAddressSource::AutoWidened
);
assert_eq!(widened.ws_api.exposure.dropped_persisted_address, None);
let upgrade_dir = tempfile::tempdir().unwrap();
let mut first = ws_api_test_args(OperationMode::Network, upgrade_dir.path());
first.ws_api.address = Some(default_listening_address());
first
.build_with_gateways_index(&index_url)
.await
.expect("first build should succeed");
let migrated = ws_api_test_args(OperationMode::Network, upgrade_dir.path())
.build_with_gateways_index(&index_url)
.await
.expect("second build should succeed");
assert_eq!(
migrated.ws_api.exposure.dropped_persisted_address,
Some(default_listening_address()),
"the operator must be told their LAN clients just lost access"
);
assert_eq!(
migrated.ws_api.exposure.source,
WsApiAddressSource::DefaultLoopback
);
let mut widened_later = ws_api_test_args(OperationMode::Network, upgrade_dir.path());
widened_later.ws_api.allowed_source_cidrs = Some(vec!["100.64.0.0/10".to_string()]);
let cfg = widened_later
.build_with_gateways_index(&index_url)
.await
.expect("third build should succeed");
assert_eq!(cfg.ws_api.address, default_listening_address());
assert_eq!(cfg.ws_api.exposure.source, WsApiAddressSource::AutoWidened);
assert_eq!(
cfg.ws_api.exposure.dropped_persisted_address,
Some(default_local_address()),
"widening past a persisted loopback address must be reported, not silent"
);
}
#[tokio::test]
async fn remedy_still_works_after_the_upgrade_persisted_loopback() {
let temp_dir = tempfile::tempdir().unwrap();
let (_server, index_url) = empty_gateways_index_server();
let mut first = ws_api_test_args(OperationMode::Network, temp_dir.path());
first.ws_api.address = Some(default_listening_address());
first
.build_with_gateways_index(&index_url)
.await
.expect("first build should succeed");
let migrated = ws_api_test_args(OperationMode::Network, temp_dir.path())
.build_with_gateways_index(&index_url)
.await
.expect("second build should succeed");
assert_eq!(migrated.ws_api.address, default_local_address());
let persisted =
std::fs::read_to_string(temp_dir.path().join("config.toml")).expect("config persisted");
assert!(
persisted.contains(r#"ws-api-address = "::1""#),
"test premise: the loopback address must be persisted, got:\n{persisted}"
);
let mut remedied = ws_api_test_args(OperationMode::Network, temp_dir.path());
remedied.ws_api.allowed_source_cidrs = Some(vec!["100.64.0.0/10".to_string()]);
let cfg = remedied
.build_with_gateways_index(&index_url)
.await
.expect("third build should succeed");
assert_eq!(
cfg.ws_api.address,
default_listening_address(),
"the auto-widen remedy must still work once the migration has run"
);
}
#[tokio::test]
async fn the_loss_of_access_notice_does_not_repeat_after_the_migration_boot() {
let temp_dir = tempfile::tempdir().unwrap();
let (_server, index_url) = empty_gateways_index_server();
let mut first = ws_api_test_args(OperationMode::Network, temp_dir.path());
first.ws_api.address = Some(default_listening_address());
first
.build_with_gateways_index(&index_url)
.await
.expect("first build should succeed");
let migrated = ws_api_test_args(OperationMode::Network, temp_dir.path())
.build_with_gateways_index(&index_url)
.await
.expect("migration boot should succeed");
assert_eq!(
migrated.ws_api.exposure.dropped_persisted_address,
Some(default_listening_address()),
"the migration boot must report the loss of access exactly once"
);
let steady = ws_api_test_args(OperationMode::Network, temp_dir.path())
.build_with_gateways_index(&index_url)
.await
.expect("third build should succeed");
assert_eq!(steady.ws_api.address, default_local_address());
assert_eq!(
steady.ws_api.exposure.dropped_persisted_address, None,
"re-announcing an unchanged bind on every boot is how a log line \
gets tuned out"
);
}
#[test]
fn the_client_api_exposure_path_stays_wired_end_to_end() {
let src = production_source();
let build = extract_fn_body(
src,
"async fn build_with_gateways_index(mut self, gateways_index: &str)",
);
assert!(
build.contains("resolve_ws_api_address("),
"build_with_gateways_index no longer resolves the client-API bind through \
the shared helper"
);
assert!(
build.contains("exposure: ws_api_exposure"),
"build_with_gateways_index no longer records the exposure decision, so \
nothing downstream can report it"
);
assert!(
!build.contains("ws_api_shares_one_namespace_with_remote_clients("),
"the exposure warning must NOT be decided in build(): it runs before \
set_logger, so the message would be silently dropped"
);
let report = extract_fn_body(src, "pub fn log_client_api_exposure(&self)");
assert!(
report.contains("ws_api_shares_one_namespace_with_remote_clients("),
"log_client_api_exposure no longer consults the exposure predicate"
);
assert!(
report.contains("tracing::warn!"),
"log_client_api_exposure no longer warns about a shared-namespace exposure"
);
for (stem, direction) in [
("can no longer reach this node's API", "narrowing"),
("widened the bind", "widening"),
] {
assert!(
report.contains(stem),
"log_client_api_exposure no longer reports the {direction} \
re-derivation. Both directions must speak: silencing one is how \
a node that got MORE exposed stopped saying so."
);
}
for legacy in ["WS_API_ADDRESS", "ALLOWED_HOST", "ALLOWED_SOURCE_CIDRS"] {
assert!(
report.contains(&format!("(\"{legacy}\", \"FREENET_{legacy}\")")),
"log_client_api_exposure no longer reports a leftover `{legacy}`; a \
deployment relying on it goes loopback-only with no explanation"
);
}
let resolver = extract_fn_body(src, "fn resolve_ws_api_address(");
assert!(
resolver.contains("WsApiAddressSource::DefaultLoopback"),
"resolve_ws_api_address no longer has a loopback default branch"
);
let main_src = include_str!("bin/freenet.rs");
let main_body = extract_fn_body(main_src, "fn freenet_main() -> anyhow::Result<()>");
for (needle, why) in [
(
"config.log_client_api_exposure()",
"nothing would report the client API's exposure — build() cannot, it \
runs before set_logger",
),
(
"merge_pre_subcommand_ws_api_args(",
"flags placed before the subcommand would be silently discarded, \
leaving the node loopback-only against the operator's intent",
),
] {
assert!(
main_src.contains(needle),
"bin/freenet.rs no longer calls `{needle}`: {why}"
);
}
assert_eq!(
main_body
.matches("merge_pre_subcommand_ws_api_args(")
.count(),
2,
"merge_pre_subcommand_ws_api_args must be called from the Network arm \
AND the Local arm"
);
}
}