Skip to content

Commit 9f4738e

Browse files
hacdiashacdias
committed
feat(gw): trustless mode via OnlyTrustless
1 parent 3a15a0f commit 9f4738e

File tree

7 files changed

+68
-22
lines changed

7 files changed

+68
-22
lines changed

‎config/gateway.go‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
package config
22

3-
const DefaultInlineDNSLink = false
3+
const (
4+
DefaultInlineDNSLink = false
5+
DefaultOnlyTrustless = false
6+
)
47

58
type GatewaySpec struct {
69
// Paths is explicit list of path prefixes that should be handled by
@@ -25,6 +28,10 @@ type GatewaySpec struct {
2528
// (FQDN) into a single DNS label in order to interop with wildcard TLS certs
2629
// and Origin per CID isolation provided by rules like https://publicsuffix.org
2730
InlineDNSLink Flag
31+
32+
// OnlyTrustless configures this gateway to only respond to trustless requests,
33+
// as per: https://specs.ipfs.tech/http-gateways/trustless-gateway/
34+
OnlyTrustless Flag
2835
}
2936

3037
// Gateway contains options for the HTTP gateway server.
@@ -56,6 +63,11 @@ type Gateway struct {
5663
// This flag can be overridden per FQDN in PublicGateways.
5764
NoDNSLink bool
5865

66+
// OnlyTrustless configures this gateway to only respond to trustless requests,
67+
// as per: https://specs.ipfs.tech/http-gateways/trustless-gateway/. This can
68+
// be overridden per FQDN in PublicGateways.
69+
OnlyTrustless Flag
70+
5971
// PublicGateways configures behavior of known public gateways.
6072
// Each key is a fully qualified domain name (FQDN).
6173
PublicGateways map[string]*GatewaySpec

‎core/corehttp/gateway.go‎

Lines changed: 26 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -28,22 +28,11 @@ import (
2828

2929
func GatewayOption(paths ...string) ServeOption {
3030
return func(n *core.IpfsNode, _ net.Listener, mux *http.ServeMux) (*http.ServeMux, error) {
31-
cfg, err := n.Repo.Config()
31+
gwConfig, err := getGatewayConfig(n)
3232
if err != nil {
3333
return nil, err
3434
}
3535

36-
headers := make(map[string][]string, len(cfg.Gateway.HTTPHeaders))
37-
for h, v := range cfg.Gateway.HTTPHeaders {
38-
headers[http.CanonicalHeaderKey(h)] = v
39-
}
40-
41-
gateway.AddAccessControlHeaders(headers)
42-
43-
gwConfig := gateway.Config{
44-
Headers: headers,
45-
}
46-
4736
gwAPI, err := newGatewayBackend(n)
4837
if err != nil {
4938
return nil, err
@@ -65,7 +54,7 @@ func GatewayOption(paths ...string) ServeOption {
6554

6655
func HostnameOption() ServeOption {
6756
return func(n *core.IpfsNode, _ net.Listener, mux *http.ServeMux) (*http.ServeMux, error) {
68-
cfg, err := n.Repo.Config()
57+
gwConfig, err := getGatewayConfig(n)
6958
if err != nil {
7059
return nil, err
7160
}
@@ -75,9 +64,8 @@ func HostnameOption() ServeOption {
7564
return nil, err
7665
}
7766

78-
publicGateways := convertPublicGateways(cfg.Gateway.PublicGateways)
7967
childMux := http.NewServeMux()
80-
mux.HandleFunc("/", gateway.WithHostname(childMux, gwAPI, publicGateways, cfg.Gateway.NoDNSLink).ServeHTTP)
68+
mux.HandleFunc("/", gateway.WithHostname(gwConfig, gwAPI, childMux).ServeHTTP)
8169
return childMux, nil
8270
}
8371
}
@@ -212,6 +200,28 @@ var defaultKnownGateways = map[string]*gateway.Specification{
212200
"localhost": subdomainGatewaySpec,
213201
}
214202

203+
func getGatewayConfig(n *core.IpfsNode) (gateway.Config, error) {
204+
cfg, err := n.Repo.Config()
205+
if err != nil {
206+
return gateway.Config{}, err
207+
}
208+
209+
headers := make(map[string][]string, len(cfg.Gateway.HTTPHeaders))
210+
for h, v := range cfg.Gateway.HTTPHeaders {
211+
headers[http.CanonicalHeaderKey(h)] = v
212+
}
213+
gateway.AddAccessControlHeaders(headers)
214+
215+
gwConfig := gateway.Config{
216+
Headers: headers,
217+
TrustedMode: !cfg.Gateway.OnlyTrustless.WithDefault(config.DefaultOnlyTrustless),
218+
NoDNSLink: cfg.Gateway.NoDNSLink,
219+
PublicGateways: convertPublicGateways(cfg.Gateway.PublicGateways),
220+
}
221+
222+
return gwConfig, nil
223+
}
224+
215225
func convertPublicGateways(publicGateways map[string]*config.GatewaySpec) map[string]*gateway.Specification {
216226
gws := map[string]*gateway.Specification{}
217227

@@ -234,6 +244,7 @@ func convertPublicGateways(publicGateways map[string]*config.GatewaySpec) map[st
234244
NoDNSLink: gw.NoDNSLink,
235245
UseSubdomains: gw.UseSubdomains,
236246
InlineDNSLink: gw.InlineDNSLink.WithDefault(config.DefaultInlineDNSLink),
247+
TrustedMode: !gw.OnlyTrustless.WithDefault(config.DefaultOnlyTrustless),
237248
}
238249
}
239250

‎docs/examples/kubo-as-a-library/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ go 1.18
77
replace github.com/ipfs/kubo => ./../../..
88

99
require (
10-
github.com/ipfs/boxo v0.8.1-0.20230411232920-5d6c73c8e35e
10+
github.com/ipfs/boxo v0.8.1-0.20230424053216-c26b26ae98f6
1111
github.com/ipfs/kubo v0.0.0-00010101000000-000000000000
1212
github.com/libp2p/go-libp2p v0.27.0
1313
github.com/multiformats/go-multiaddr v0.9.0

‎docs/examples/kubo-as-a-library/go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -321,8 +321,8 @@ github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:
321321
github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
322322
github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
323323
github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
324-
github.com/ipfs/boxo v0.8.1-0.20230411232920-5d6c73c8e35e h1:8wmBhjwJk2drWZjNwoN7uc+IkG+N93laIhjY69rjMqw=
325-
github.com/ipfs/boxo v0.8.1-0.20230411232920-5d6c73c8e35e/go.mod h1:xJ2hVb4La5WyD7GvKYE0lq2g1rmQZoCD2K4WNrV6aZI=
324+
github.com/ipfs/boxo v0.8.1-0.20230424053216-c26b26ae98f6 h1:casmvQKtnJw+TzgT6ELlYm+KVICtWB4zm4itFqXmimM=
325+
github.com/ipfs/boxo v0.8.1-0.20230424053216-c26b26ae98f6/go.mod h1:xJ2hVb4La5WyD7GvKYE0lq2g1rmQZoCD2K4WNrV6aZI=
326326
github.com/ipfs/go-bitfield v1.1.0 h1:fh7FIo8bSwaJEh6DdTWbCeZ1eqOaOkKFI74SCnsWbGA=
327327
github.com/ipfs/go-bitfield v1.1.0/go.mod h1:paqf1wjq/D2BBmzfTVFlJQ9IlFOZpg422HL0HqsGWHU=
328328
github.com/ipfs/go-block-format v0.0.2/go.mod h1:AWR46JfpcObNfg3ok2JHDUfdiHRgWhJgCQF+KIgOPJY=

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ require (
1616
github.com/gogo/protobuf v1.3.2
1717
github.com/google/uuid v1.3.0
1818
github.com/hashicorp/go-multierror v1.1.1
19-
github.com/ipfs/boxo v0.8.1-0.20230411232920-5d6c73c8e35e
19+
github.com/ipfs/boxo v0.8.1-0.20230424053216-c26b26ae98f6
2020
github.com/ipfs/go-block-format v0.1.2
2121
github.com/ipfs/go-cid v0.4.1
2222
github.com/ipfs/go-cidutil v0.1.0

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -356,8 +356,8 @@ github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:
356356
github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
357357
github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
358358
github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
359-
github.com/ipfs/boxo v0.8.1-0.20230411232920-5d6c73c8e35e h1:8wmBhjwJk2drWZjNwoN7uc+IkG+N93laIhjY69rjMqw=
360-
github.com/ipfs/boxo v0.8.1-0.20230411232920-5d6c73c8e35e/go.mod h1:xJ2hVb4La5WyD7GvKYE0lq2g1rmQZoCD2K4WNrV6aZI=
359+
github.com/ipfs/boxo v0.8.1-0.20230424053216-c26b26ae98f6 h1:casmvQKtnJw+TzgT6ELlYm+KVICtWB4zm4itFqXmimM=
360+
github.com/ipfs/boxo v0.8.1-0.20230424053216-c26b26ae98f6/go.mod h1:xJ2hVb4La5WyD7GvKYE0lq2g1rmQZoCD2K4WNrV6aZI=
361361
github.com/ipfs/go-bitfield v1.1.0 h1:fh7FIo8bSwaJEh6DdTWbCeZ1eqOaOkKFI74SCnsWbGA=
362362
github.com/ipfs/go-bitfield v1.1.0/go.mod h1:paqf1wjq/D2BBmzfTVFlJQ9IlFOZpg422HL0HqsGWHU=
363363
github.com/ipfs/go-block-format v0.0.2/go.mod h1:AWR46JfpcObNfg3ok2JHDUfdiHRgWhJgCQF+KIgOPJY=

‎test/cli/gateway_test.go‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -506,4 +506,27 @@ func TestGateway(t *testing.T) {
506506
})
507507
})
508508
})
509+
510+
t.Run("OnlyTrustless Enabled", func(t *testing.T) {
511+
// Trusted and trustless responses are tested in more detail in Boxo.
512+
t.Parallel()
513+
node := harness.NewT(t).NewNode().Init()
514+
node.UpdateConfig(func(cfg *config.Config) {
515+
cfg.Gateway.OnlyTrustless = config.True
516+
})
517+
node.StartDaemon()
518+
519+
cidFoo := node.IPFSAddStr("foo")
520+
521+
t.Run("trusted response fails", func(t *testing.T) {
522+
t.Parallel()
523+
assert.Equal(t, http.StatusNotImplemented, node.GatewayClient().Get("/ipfs/"+cidFoo).StatusCode)
524+
})
525+
526+
t.Run("trustless response succeeds", func(t *testing.T) {
527+
t.Parallel()
528+
assert.Equal(t, http.StatusOK, node.GatewayClient().Get("/ipfs/"+cidFoo+"?format=raw").StatusCode)
529+
})
530+
})
531+
509532
}

0 commit comments

Comments
 (0)