smp-server: support namespaces by shumvgolove · Pull Request #1784 · simplex-chat/simplexmq

shumvgolove · 2026-05-22T08:00:15Z

No description provided.

… TLD case, shutdown)

…local)

…r, CSV order)

…ngEndpoint timeout)

- Reject IPv6 aliases of 169.254.169.254 (IPv4-compatible / IPv4-mapped / 6to4 / NAT64) via numeric range check on parsed IPv6. - Disable HTTP redirects on the Eth RPC request. - Restrict SimplexName labels to ASCII (Cyrillic/Greek/full-width otherwise hash to different on-chain records and diverge from UTS-46 registrars). - pingEndpoint: only JsonRpcErr means "reachable"; transport/decode failures fail startup. boundedIniInt: readMaybe over partial read. - Add 127.0.0.0/8 and 0.0.0.0 to isLoopback. - Replace hand-rolled hex helpers with Data.ByteArray.Encoding; raise managerConnCount to match rpcMaxConcurrency; hex Show for NameOwner. - Fuse parallel http/https when into unless+case; drop reverse/re-reverse in mkDomain TLDWeb; first AbiInvariantViolated; Nothing <$ decodeAddress; forM_ (eitherToMaybe ...); >>= chain in NameOwner FromJSON. - Drop dead imports/exports/pragmas and two restating comments. - Tests: factor unsafeOwner/unsafeLink, addr1/2/3, testNamesConfig; add non-ASCII label rejection coverage.

The bare-name fallback and bareDomain parser would otherwise consume arbitrarily many non-space bytes via takeWhile1 before any validation or length check. A crafted multi-megabyte token would be decoded as UTF-8 and re-parsed in full before being rejected. Introduce `boundedNonSpace` (scan with 253-byte cap) at the two takeWhile1 sites. Inputs longer than 253 bytes leave residue that parseOnly's implicit endOfInput rejects, so the parser fails fast without ever allocating the full input. The bound is the DNS full-domain limit, chosen for being a familiar ceiling generous enough to cover any realistic SimpleX name (longest plausible @user.subdomain.simplex stays well under 100 bytes). No per-label cap — SimpleX names don't go through DNS label resolution and there's no semantic reason to constrain individual labels.

…out auth) validateUrl gains two operator-friendly relaxations and a regression test: - Allow a path prefix (e.g. https://gw.example.com:443/snrc) for a resolver behind a reverse-proxy sub-path; /resolve/<name> and /health are appended (HttpResolver already strips one trailing slash, so root and sub-path behave identically). Query/fragment/userinfo stay rejected. - Off-loopback, reject only http WITH resolver_auth (the Authorization header would travel in cleartext). http without auth is now allowed (no secret to leak; resolver data is public — also lets dev setups reach a host resolver via http://host.docker.internal). https is always allowed, with or without auth. Plain http has no response integrity; intended for trusted/local networks only. Exports validateUrl and adds validateUrlSpec (11 cases) to SMPNamesTests.

RSLV collapsed every non-hit (no resolver, malformed name, not found, backing-store failure) to ERR AUTH, so a client iterating its configured servers could not tell "this router has no resolver, try the next" from "name not registered, stop", and a transient backend error read as an authoritative miss. Names capability is runtime config, orthogonal to the linear SMP version (a future v21 router without [NAMES] must still advertise v21), so it is signalled by a command-time error like allowSMPProxy, not by the version range: no resolver configured -> ERR CMD PROHIBITED (client skips, tries next) backing-store failure -> ERR INTERNAL (transient: retry/surface) not found / malformed -> ERR AUTH (authoritative "no such name") Update the protocol spec error table and add agent tests for the no-resolver (CMD PROHIBITED) and backend-failure (INTERNAL) paths.

evgeny-simplex · 2026-06-20T09:42:53Z

+        \# Operator runs the resolver alongside smp-server (default port 8000)\n\
+        \# with its own Ethereum JSON-RPC endpoint configured in resolver.toml.\n\
+        \# Co-locating with the proxy role logs a startup advisory: slow RSLV calls can\n\
+        \# serialise other forwarded commands on the same proxy-relay session.\n\
+        \# For high-volume deployments, run [NAMES] on a separate host.\n\
+        \# Restart required to change settings.\n\


this is wrong and should not be the case

also, we don't colocate it with SMP, right?

evgeny-simplex · 2026-06-20T09:44:51Z

+          else case J.eitherDecodeStrict (BL.toStrict bs) of
+            Left e -> pure (Left (InvalidJson e))
+            Right v -> pure (Right v)


Suggested change

else case J.eitherDecodeStrict (BL.toStrict bs) of

Left e -> pure (Left (InvalidJson e))

Right v -> pure (Right v)

else first InvalidJson <$> J.eitherDecodeStrict (BL.toStrict bs)

in general, please review and refactor such trivial cases into forM, mapM, first, second, bimap, maybe, etc.

evgeny-simplex · 2026-06-20T09:50:35Z

+
+doGet :: ResolverEnv -> Text -> IO (Either ResolverError J.Value)
+doGet ResolverEnv {manager, baseUrl, authHdr, timeoutMicro, maxResponseBytes} path = do
+  req0 <- parseRequest (T.unpack (baseUrl <> path))


this T.unpack is a smell that incorrect type is passed from upstream

evgeny-simplex · 2026-06-20T09:51:34Z

+-- | Percent-encode a name component (path-safe). Aggressive: encode every
+-- byte that isn't an unreserved character per RFC 3986. The resolver expects
+-- raw labels (e.g., `alice.simplex`); slashes and other ASCII punctuation
+-- would change the request path semantics if passed through verbatim.
+percentEncode :: Text -> Text
+percentEncode = decodeLatin1 . urlEncode True . encodeUtf8


trivial function that is not needed if you use correct types (String or ByteString)

evgeny-simplex · 2026-06-20T09:53:22Z

+                -- and the smpEncoded NameRecord is <= its JSON body, so capping
+                -- the body here guarantees the response always frames. An
+                -- over-cap body fails as BodyTooLarge -> ERR (NAME (RESOLVER ..)).
+                resolverMaxResponseBytes = boundedIniInt 16000 1024 16000 "resolver_max_response_bytes"


and in some other place it's 64kb and no 16. If we need larger size, we could use zstd compression in SMP protocol.

evgeny-simplex · 2026-06-20T09:54:06Z

+    other -> Left $ "unexpected port syntax: " <> other
+  unless (null (uriQuery uri)) $ Left "query string not allowed (it does not compose with the appended /resolve/<name> path)"
+  unless (null (uriFragment uri)) $ Left "fragment not allowed (fragments are never sent to the server)"
+  -- A path prefix is allowed and used as the base for /resolve/<name> and


this is very complex and unreadable, needs to be simplified

we use library for URI parsing, why we are re-implement it here?

evgeny-simplex · 2026-06-20T10:00:02Z

+  | -- | no name-resolving servers configured (agent-originated only)
+    NO_SERVERS


as it's agent-originated, it must not be in this type - it must be in Agent errors

This type is only for errors returned by the server, it can't contain errors reported upstream

evgeny-simplex · 2026-06-20T10:02:20Z

+  = -- | the names role / resolver is not configured on this server
+    NO_RESOLVER
+  | -- | the name is not registered (resolver returned not-found)
+    NO_NAME


NOT_FOUND would be more typical

There may also be expired error - I don't know how it will be reported by resolver, so probably not needed for now.

evgeny-simplex · 2026-06-20T10:03:17Z

+    -- Name is validated at parse (invalid syntax fails here -> CMD error),
+    -- so the handler only ever sees a valid SimplexNameDomain.


Suggested change

-- Name is validated at parse (invalid syntax fails here -> CMD error),

-- so the handler only ever sees a valid SimplexNameDomain.

redundant

evgeny-simplex · 2026-06-20T10:04:10Z

    PRXY host auth_ -> e (PRXY_, ' ', host, auth_)
    PFWD fwdV pubKey (EncTransmission s) -> e (PFWD_, ' ', fwdV, pubKey, Tail s)
    RFWD (EncFwdTransmission s) -> e (RFWD_, ' ', Tail s)
+    -- Version gating is the client's job (Client.hs), not the encoder's.


Suggested change

-- Version gating is the client's job (Client.hs), not the encoder's.

evgeny-simplex · 2026-06-20T10:06:11Z

    PFWD fwdV pubKey (EncTransmission s) -> e (PFWD_, ' ', fwdV, pubKey, Tail s)
    RFWD (EncFwdTransmission s) -> e (RFWD_, ' ', Tail s)
+    -- Version gating is the client's job (Client.hs), not the encoder's.
+    RSLV d -> e (RSLV_, ' ', Tail (strEncode d))


Suggested change

RSLV d -> e (RSLV_, ' ', Tail (strEncode d))

RSLV d -> e (RSLV_, ' ', d)

maybe I am missing something, but using Tail explicitly here is redundant - all it achieves is preventing length prefixing of the string. Directly using d here achieves the same.

evgeny-simplex · 2026-06-20T10:07:30Z

+    -- so the handler only ever sees a valid SimplexNameDomain.
+    CT SResolver RSLV_ -> do
+      Tail bs <- _smpP
+      either fail (pure . Cmd SResolver . RSLV) (strDecode bs)


Suggested change

either fail (pure . Cmd SResolver . RSLV) (strDecode bs)

Cmd . SResolver . RSLV <$> _smpP

evgeny-simplex · 2026-06-20T10:08:13Z

    PONG -> e PONG_
+    -- Field-ordered Encoding NameRecord (no JSON on the wire); a response that
+    -- arrived is already on a supported version, so no version gate.
+    RNAME rec -> e (RNAME_, ' ', rec)


Suggested change

RNAME rec -> e (RNAME_, ' ', rec)

RNAME rec -> e (RNAME_, ' ', Tail $ toStrict $ J.encode rec)

evgeny-simplex · 2026-06-20T10:09:40Z

    OK_ -> pure OK
    ERR_ -> ERR <$> _smpP
    PONG_ -> pure PONG
+    RNAME_ -> RNAME <$> _smpP


Suggested change

RNAME_ -> RNAME <$> _smpP

RNAME_ -> fmap RNAME . J.decodeStrict . unTail <$?> _smpP

evgeny-simplex · 2026-06-20T10:10:49Z

+  smpEncode = \case
+    NO_RESOLVER -> "NO_RESOLVER"
+    NO_NAME -> "NO_NAME"
+    NO_SERVERS -> "NO_SERVERS"


evgeny-simplex · 2026-06-20T10:12:35Z

+        -- error that reaches the client as ERR (NAME ...).
+        (selector, msg) <- asks namesEnv >>= \case
+          Nothing -> pure (rslvDisabled, ERR $ NAME NO_RESOLVER)
+          Just nenv -> liftIO (resolveName nenv d) <&> \case


that's the crux of the problem. You call resolver inline, blocking further command processing (and that's what all those comments were about). This has to use the same pattern as we use to create proxy session - it must be processed asynchronously, and response send from forked thread. The function simply returns Nothing as command response, deferring response to forked thread.

SNRC names resolver role: RSLV command -> HTTP resolver -> RNAME record. Agent owns server selection (ServerRoles.names); NAME error family; async, concurrency-bounded resolution; length-prefixed extensible wire; spec.

Co-authored-by: Evgeny <evgeny@poberezkin.com>

shumvgolove requested review from epoberezkin and spaced4ndy as code owners May 22, 2026 08:00

shumvgolove force-pushed the sh/smp-namespace branch 3 times, most recently from a6b960b to 236e69d Compare May 22, 2026 11:26

epoberezkin and others added 11 commits May 29, 2026 09:37

Merge branch 'master' into stable

92fb0ea

smp-server: namespaces resolver scaffolding

19db2c8

smp-server: Names resolver hardening + cleanup

3999fac

smp-server: fuse parallel dispatchers

99b1330

smp-server: JSON wire format for NameRecord + Names.hs restructure

c0e14e3

smp-server: redact RpcAuth in Show

6b216ca

smp-server: JSON wire fixups + spec rewrite + small cleanups

c812725

plan: prepend implementation-diverged banner

66bca0c

move SimplexName into shared module

daac3e2

Merge origin/stable

1e2cf23

smp-server: name + contract whitelist on RSLV

c3e7b61

shumvgolove force-pushed the sh/smp-namespace branch from 37764a4 to c3e7b61 Compare May 29, 2026 16:11

shumvgolove added 8 commits June 1, 2026 09:51

smp-server: address audit findings (canonical JSON, INI guards, SSRF,…

3c93489

… TLD case, shutdown)

smp-server: round 2 audit fixes (label case, response cap, ipv6 link-…

f686a94

…local)

smp-server: round 3 audit fixes (SSRF coverage, drop noop closeManage…

ba245e7

…r, CSV order)

smp-server: round 4 audit fixes (0X-hex host, expanded IPv6 forms, pi…

1d394f5

…ngEndpoint timeout)

smp-server: hardcode TldRegistries (drop registry_tld_* INI keys)

b66d973

Merge remote-tracking branch 'origin/master' into sh/smp-namespace

1950634

shumvgolove force-pushed the sh/smp-namespace branch from e90b13e to 9e4d8d9 Compare June 3, 2026 19:04

shumvgolove and others added 4 commits June 8, 2026 11:37

namespace: switch to Python HTTP resolver + agent plumbing (#1796)

92b3d04

namespace: NameRecord links as arrays (multi-link, cap 5)

f555e9a

evgeny-simplex reviewed Jun 20, 2026

View reviewed changes

Comment thread src/Simplex/Messaging/Server/Main.hs

evgeny-simplex reviewed Jun 20, 2026

View reviewed changes

Comment thread src/Simplex/Messaging/Server/Main.hs

evgeny-simplex reviewed Jun 20, 2026

View reviewed changes

shumvgolove added 2 commits June 22, 2026 09:02

Merge remote-tracking branch 'origin/master' into sh/smp-namespace

27045c7

feat(names): public-namespace resolution via RSLV/RNAME

5e0b757

SNRC names resolver role: RSLV command -> HTTP resolver -> RNAME record. Agent owns server selection (ServerRoles.names); NAME error family; async, concurrency-bounded resolution; length-prefixed extensible wire; spec.

epoberezkin reviewed Jun 22, 2026

View reviewed changes

Comment thread src/Simplex/Messaging/Server.hs Outdated

epoberezkin reviewed Jun 22, 2026

View reviewed changes

Comment thread src/Simplex/Messaging/Server.hs Outdated

epoberezkin and others added 8 commits June 22, 2026 22:49

remove comments

2e2bc86

Co-authored-by: Evgeny <evgeny@poberezkin.com>

simplify

c57cdce

move tests name

67367c4

simplify: text addresses, Tail JSON, drop admitRslv

6843b14

fix

55c6717

remove spaghetti

4b28841

reduce diff

94a0541

async again, refactor

ae3aefd

		\| -- \| no name-resolving servers configured (agent-originated only)
		NO_SERVERS

		-- Name is validated at parse (invalid syntax fails here -> CMD error),
		-- so the handler only ever sees a valid SimplexNameDomain.

	RSLV d -> e (RSLV_, ' ', Tail (strEncode d))
	RSLV d -> e (RSLV_, ' ', d)

	either fail (pure . Cmd SResolver . RSLV) (strDecode bs)
	Cmd . SResolver . RSLV <$> _smpP

	RNAME rec -> e (RNAME_, ' ', rec)
	RNAME rec -> e (RNAME_, ' ', Tail $ toStrict $ J.encode rec)

	RNAME_ -> RNAME <$> _smpP
	RNAME_ -> fmap RNAME . J.decodeStrict . unTail <$?> _smpP

Uh oh!

Conversation

shumvgolove commented May 22, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

evgeny-simplex Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

evgeny-simplex Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

evgeny-simplex Jun 20, 2026 •

edited

Loading

evgeny-simplex Jun 20, 2026 •

edited

Loading