type(feat): Enable authenticated private relays to have a higher rate limit - #321
okdistribute wants to merge 2 commits into
Conversation
|
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review. 📝 WalkthroughWalkthroughSummaryThe PR adds a shared iroh endpoint builder with iroh-services relay configuration. Native, protocol, WASM, and bridge endpoint creation now use the helper. Relay URL classification and pairing coverage include iroh-services URLs. ChangesShared endpoint construction
Suggested reviewers: Priority: ➖ Normal Merge Risk: 🟡 Moderate · up to Private authenticated relay support changes how clients establish and advertise relay connections. A reusable client-side relay credential could be abused, and overly broad relay-host matching could omit a required relay from pairing metadata, leaving a moderate merge-readiness risk. 🚥 Pre-merge checks | ❌ 1❌ Failed checks (1 warning)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Warning Some tools did not complete. Review the errors below. 🔧 Clippy (1.97.1)Clippy execution failed Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
okdistribute
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 97cfa734-bcf7-47e0-a80b-81e160041a32
⛔ Files ignored due to path filters (3)
engine/Cargo.lockis excluded by!**/*.locksrc-tauri/Cargo.lockis excluded by!**/*.lockwasm-bridge/Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (13)
engine/native/src/node.rsengine/native/src/receive.rsengine/native/src/send.rsengine/protocol/Cargo.tomlengine/protocol/src/discovery.rsengine/protocol/src/endpoint.rsengine/protocol/src/lib.rsengine/protocol/src/receive.rsengine/protocol/src/relay.rsengine/tests/test_pairing.rsengine/wasm-io/src/receive.rsengine/wasm-io/src/send.rswasm-bridge/src/lib.rs
Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.
| const IROH_SERVICES_API_SECRET: &str = | ||
| "servicesaaqizynrq3pdxtwxnnrlcxg5rpezbcpthntqlwpxc5oren2557x6nkgjlxfzhaykym52alh56n2vwg5b5sme5k2r3ez6rbuyevxwsx2cgeaa"; |
There was a problem hiding this comment.
🔒 Security & Privacy | 🛡️ Analyzed with Security Review | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🤖 get_repo_knowledge executed:
get_repo_knowledge tonyantony300/dashbeam /tmp/coderabbit-repo-knowledge/tonyantony300-dashbeam-aad65dbd
Length of output: 370
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- endpoint.rs ---'
sed -n '1,90p' engine/protocol/src/endpoint.rs
printf '%s\n' '--- direct references to the secret and builder ---'
rg -n -C 3 'IROH_SERVICES_API_SECRET|api_secret_from_str|endpoint_builder' engine/protocol
printf '%s\n' '--- dependency declarations ---'
rg -n -C 2 'iroh-services|iroh' Cargo.toml engine Cargo.lock 2>/dev/null | head -120Repository: tonyantony300/dashbeam
Length of output: 14408
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- iroh-services declarations and lock entries ---'
rg -n -C 5 'iroh-services|iroh_svc|relay\.iroh-svc\.com|api_secret' . --glob '!target/**' --glob '!node_modules/**' | head -200
printf '%s\n' '--- public entry callers for default mode ---'
sed -n '150,200p' engine/protocol/src/discovery.rs
sed -n '160,195p' engine/protocol/src/relay.rs
sed -n '330,360p' engine/protocol/src/relay.rs
sed -n '250,285p' engine/protocol/src/receive.rsRepository: tonyantony300/dashbeam
Length of output: 14396
🌐 Web query:
iroh-services 1.0.0 api_secret_from_str API secret relay authorization documentation
💡 Result:
In the iroh-services 1.0.0 Rust crate, the api_secret_from_str method is a function provided by the IrohServicesPreset builder (and ClientBuilder) used to configure an Iroh Services client with an API secret [1][2][3]. When you provide an API secret string via api_secret_from_str, the method parses the encoded string into an ApiSecret and stashes it on the builder [1][3]. This API secret is then used by the iroh-services SDK to automatically authenticate your endpoint when it connects to managed relays [4][5][6]. Key points regarding relay authorization and the API secret: 1. Automatic Authentication: You do not need to manually manage Authorization headers or tokens for managed relays [4][6]. The iroh-services preset uses your API secret to mint short-lived, signed access tokens scoped to your endpoint's specific identity [5][6]. 2. Security: The API secret itself never leaves your application or is sent over the wire [5][6]. Only the derived, short-lived token is presented to the relay during the connection handshake [5][6]. 3. Configuration: While api_secret_from_str allows you to set the secret directly from a string (e.g., from a config file), it is recommended to use api_secret_from_env to load the secret from the IROH_SERVICES_API_SECRET environment variable in production environments [7][3][8]. Example usage: let preset = iroh_services::preset.api_secret_from_str("YOUR_API_KEY")? // Sets the secret from a string [8].build?; let endpoint = Endpoint::bind(preset.clone).await?; let client = preset.client_builder(&endpoint).build.await?; [7][8] If you are running your own, non-managed relay, the authentication mechanism differs; those relays typically require shared tokens or HTTP callout configurations defined in their own server settings rather than using the iroh-services preset API secret [9].
Citations:
- 1: https://docs.rs/iroh-services/latest/iroh_services/struct.PresetBuilder.html
- 2: https://docs.rs/iroh-services/latest/iroh_services/struct.ClientBuilder.html
- 3: https://docs.rs/iroh-services/latest/src/iroh_services/preset.rs.html
- 4: https://docs.iroh.computer/iroh-services/relays/managed
- 5: https://docs.iroh.computer/concepts/relays
- 6: https://www.iroh.computer/blog/authenticated-relays
- 7: https://docs.iroh.computer/iroh-services/access
- 8: https://docs.iroh.computer/iroh-services/quickstart
- 9: https://docs.rs/crate/iroh-relay/latest
Sensitive Data Exposure
Reachability: External
Exploitability: Trivial
CWE: CWE-798 — Use of Hard-coded Credentials
Remove the client-embedded relay credential.
IROH_SERVICES_API_SECRET is embedded in client code. Anyone can recover it from the source or a distributed binary and mint relay access tokens under the shared service account. This can exhaust shared relay quotas or rate limits.
Issue per-user or short-lived credentials from an authenticated service. If this value is intended to be public, do not use it as relay authorization.
| url.contains("relay.n0.iroh.link") || url.contains(".iroh.link") | ||
| url.contains("relay.n0.iroh.link") | ||
| || url.contains(".iroh.link") | ||
| || url.contains(".relay.iroh-svc.com") |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Match the relay host boundary.
contains accepts untrusted hosts such as https://x.relay.iroh-svc.com.attacker.example/. This classifies the URL as public. Pairing can then omit the configured relay URL and cause recipients to use the wrong relay.
Parse the URL and test host_str() with an exact suffix check, such as host.ends_with(".relay.iroh-svc.com").
2 participants
Description
This PR enables private authenticated relays which have higher rate limits than the public relays for use in Dashbeam. This default relay is managed by the n0.computer team, the same as the public relays, but with higher rate limits and better monitoring capabilities because traffic is not mixed in with all other iroh traffic.
Checklist
type(scope): description)pnpm lintbefore raising this PRpnpm formatbefore raising this PR