explewd/waste-go
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

Migrate to YAW/2 protocol: WebRTC transport, anchor signaling, nacl/box crypto

Browse Source 
Replace the original raw-TCP peer connections and Blowfish/RSA-era design with
the YAW/2 protocol stack:

Transport
- internal/mesh/peer.go: raw TCP + manual ECDH replaced with pion/webrtc
  DataChannels (ICE, DTLS, SCTP). Peers negotiate via sealed offer/answer/
  candidate exchange rather than direct dialling.
- internal/nat: deleted — ICE subsumes everything this package was going to do.

Signaling
- cmd/anchor: new WebSocket signaling server (replaces cmd/relay). Verifies
  Ed25519 challenge/join signatures, routes opaque nacl/box blobs, broadcasts
  peer-join/peer-leave events. Never sees plaintext signaling content.
- internal/anchor: new anchor client. Manages PeerConnection lifecycle,
  decides offerer by peer-id comparison, seals/opens signaling payloads with
  nacl/box, implements mesh.Anchor.

Crypto (internal/crypto)
- PeerID encoding: base64url → lowercase hex (64 chars, YAW/2 §2).
- Sign/Verify: hex signatures throughout.
- Added CurvePublicKey/CurvePrivateKey: X25519 keys derived from Ed25519
  identity via Montgomery conversion (filippo.io/edwards25519), matching
  libsodium's crypto_sign_ed25519_*_to_curve25519.
- Added SignalingBox/SignalingOpen: nacl/box (XSalsa20-Poly1305) seal/open
  for signaling payloads.

Wire types (internal/proto)
- ChatMessage gains Mid (random 16-byte hex) for mesh deduplication (§8).
- FileChunk removed from PeerMessage — chunks go on a separate binary
  DataChannel labelled "f:<xid>"; FileDone added.
- New types: SignalingPayload, AnchorMessage, HelloMessage, HelloBindString.
- PeerID.Short() now returns first 16 hex chars grouped in 4s.
- IPC: CmdConnect removed; CmdJoinNetwork/CmdLeaveNetwork added;
  EvtSessionReady added (fires when DataChannel opens and hello is received).

IPC (internal/ipc)
- join_network/leave_network replace connect (direct TCP dial).
- Network joins are context-scoped: leave_network or client disconnect
  cancels the anchor connection cleanly.

README updated to reflect new project layout, getting-started commands,
IPC protocol, and roadmap state.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Fredrik Johansson
2026-06-21 17:48:14 +02:00
parent de2d1cada0
commit 3e058bee9b
14 changed files with 1716 additions and 671 deletions
Download Patch File Download Diff File Expand all files Collapse all files

93
README.md
View File

@@ -8,19 +8,19 @@ friend-to-friend encrypted mesh networking with chat and file sharing. Written i
```
waste-go/
├── cmd/
│ ├── daemon/ The peer process — run one on each friend's machine
│ └── relay/ Bootstrap/relay server — run this on your Hetzner VPS
│ ├── daemon/ The peer process — run one on each friend's machine
│ └── anchor/ WebSocket signaling server — run this on your Hetzner VPS
└── internal/
├── proto/ All wire types (shared by daemon and relay)
├── crypto/ Ed25519 identity, X25519 ECDH, ChaCha20-Poly1305
├── mesh/ Connected peer state + per-connection handler
├── ipc/ Local JSON API (UI talks to daemon here, port 17337)
└── nat/ Relay client (hole-punching lives here later)
├── proto/ All wire types (shared by daemon and anchor)
├── crypto/ Ed25519 identity, nacl/box signaling, ChaCha20-Poly1305
<EFBFBD><EFBFBD><EFBFBD>── mesh/ Connected peer state + DataChannel helpers
├── anchor/ Anchor client — WebRTC signaling via the anchor server
└── ipc/ Local JSON API (UI talks to daemon here, port 17337)
```
## Prerequisites
- Go 1.22+ → https://go.dev/dl/
- Go 1.24+ → https://go.dev/dl/
- VS Code with the Go extension (`golang.go`)
On first open VS Code will prompt you to install `gopls`, `dlv`, and `goimports` — accept all of them.
@@ -34,38 +34,39 @@ go mod tidy
# Build everything (confirms it compiles)
go build ./...
# Terminal 1 — relay (optional for LAN testing, required across internet)
go run ./cmd/relay -bind 127.0.0.1:17339
# Terminal 1 — anchor (required for peers to find each other)
go run ./cmd/anchor -bind 127.0.0.1:17339
# Terminal 2 — peer A
go run ./cmd/daemon -alias alice -data-dir /tmp/waste-alice -peer-port 17338 -ipc-port 17337
go run ./cmd/daemon -alias alice -data-dir /tmp/waste-alice -ipc-port 17337 -anchor ws://127.0.0.1:17339/ws
# Terminal 3 — peer B
go run ./cmd/daemon -alias bob -data-dir /tmp/waste-bob -peer-port 17340 -ipc-port 17341
go run ./cmd/daemon -alias bob -data-dir /tmp/waste-bob -ipc-port 17341 -anchor ws://127.0.0.1:17339/ws
```
Then connect B → A and send a message (netcat works fine as a quick test):
Both peers join the same named network via IPC:
```bash
# Tell peer B to connect to peer A
echo '{"type":"connect","addr":"127.0.0.1:17338"}' | nc 127.0.0.1 17341
# Join peer A to a network called "friends"
echo '{"type":"join_network","network_name":"friends"}' | nc 127.0.0.1 17337
# In another terminal — subscribe to peer A's events, then send a message from B
# Join peer B to the same network
echo '{"type":"join_network","network_name":"friends"}' | nc 127.0.0.1 17341
# Subscribe to peer A's events (in a separate terminal)
nc 127.0.0.1 17337 &
# Send a message from B
echo '{"type":"send_message","room":"general","body":"hello from bob"}' | nc 127.0.0.1 17341
```
**On Windows** — use PowerShell's built-in TCP client instead of `nc`:
```powershell
# Open a connection to peer B's IPC port and keep it open
$c = [System.Net.Sockets.TcpClient]::new('127.0.0.1', 17341)
$w = [System.IO.StreamWriter]::new($c.GetStream()); $w.AutoFlush = $true
# Tell peer B to connect to peer A
$w.WriteLine('{"type":"connect","addr":"127.0.0.1:17338"}')
# Send a chat message from B
$w.WriteLine('{"type":"join_network","network_name":"friends"}')
$w.WriteLine('{"type":"send_message","room":"general","body":"hello from bob"}')
# In a separate terminal — subscribe to peer A's events
@@ -74,20 +75,18 @@ $reader = [System.IO.StreamReader]::new($r.GetStream())
while ($true) { $reader.ReadLine() }
```
Keep `$c` / `$w` in scope for the session; closing them disconnects the peer.
## Deploying the relay on your Hetzner VPS
## Deploying the anchor on your Hetzner VPS
```bash
GOOS=linux GOARCH=amd64 go build -o bin/waste-relay ./cmd/relay
scp bin/waste-relay user@your-vps:~/
GOOS=linux GOARCH=amd64 go build -o bin/waste-anchor ./cmd/anchor
scp bin/waste-anchor user@your-vps:~/
# On the VPS
./waste-relay -bind 0.0.0.0:17339
# On the VPS (also run coturn in STUN-only mode on port 3478)
./waste-anchor -bind 0.0.0.0:17339
```
Then start daemons with `-relay your-vps-ip:17339` and they'll register and
be able to find each other across NAT.
Then start daemons with `-anchor ws://your-vps-ip:17339/ws` and they'll connect via WebRTC
with ICE (STUN-assisted hole punching) through the anchor for signaling.
## IPC protocol (plain JSON over TCP)
@@ -95,7 +94,8 @@ Everything is newline-delimited JSON. You can test with `nc 127.0.0.1 17337`.
**Commands you send:**
```jsonc
{"type":"connect","addr":"1.2.3.4:17338"}
{"type":"join_network","network_name":"friends"}
{"type":"leave_network"}
{"type":"send_message","room":"general","body":"hi"}
{"type":"get_state"}
```
@@ -104,8 +104,9 @@ Everything is newline-delimited JSON. You can test with `nc 127.0.0.1 17337`.
```jsonc
{"type":"state_snapshot","local_peer":{...},"connected_peers":[...]}
{"type":"peer_connected","peer":{...}}
{"type":"message_received","message":{"from":"...","body":"hi","room":"general"}}
{"type":"peer_disconnected","peer_id":"..."}
{"type":"session_ready","peer_id":"<hex>","nick":"alice"}
{"type":"message_received","message":{"from":"<hex>","body":"hi","room":"general"}}
{"type":"peer_disconnected","peer_id":"<hex>"}
```
## Crypto choices
@@ -113,17 +114,25 @@ Everything is newline-delimited JSON. You can test with `nc 127.0.0.1 17337`.
| Purpose | Algorithm | Notes |
|---|---|---|
| Identity | Ed25519 | Fast, small keys, standard |
| Key exchange | X25519 ECDH | Per-session ephemeral keys |
| Symmetric | ChaCha20-Poly1305 | No AES-NI needed, authenticated |
| Hashing | SHA-256 | File integrity |
| Peer ID | Hex-encoded Ed25519 pubkey | 64 lowercase hex chars (YAW/2 §2) |
| Signaling encryption | XSalsa20-Poly1305 (`nacl/box`) | X25519 keys derived from Ed25519 identity (YAW/2 §3) |
| Transport | WebRTC DataChannels (DTLS+SCTP) | pion/webrtc — ICE, hole punching included |
| Hashing | SHA-256 | File integrity, network name hashing |
Replaces WASTE's original Blowfish/PCBC (broken cipher mode) + RSA.
> Peer IDs are 64-char lowercase hex (Ed25519 public key). Existing `identity.json` files
> on disk are unaffected — only the over-the-wire representation changed from base64url.
## Roadmap
- [ ] UDP hole-punching (STUN) in `internal/nat`
- [ ] Invite file format (`.waste-invite`) — share a keypair + address hint
- [ ] Peer gossip → auto-connect to friends-of-friends
- [ ] File transfer
- [ ] Message persistence (SQLite via `modernc.org/sqlite`)
- [ ] Tauri or simple web UI consuming the IPC port
- [x] **Crypto layer** — hex peer IDs, `nacl/box` signaling, Ed25519→X25519 key derivation
- [x] **Proto additions** — `mid` field, signaling types, anchor wire types, `hello` message, `FileDone`
- [x] **Anchor server** (`cmd/anchor`) — WebSocket signaling server (replaces TCP relay)
- [x] **WebRTC peer connections** — pion/webrtc DataChannels replace raw TCP in `internal/mesh`
- [x] **Anchor client** (`internal/anchor`) — ICE offer/answer/candidate lifecycle, `nacl/box` sealing
- [x] **IPC updates** — `join_network`/`leave_network` replace `connect`; `session_ready` event added
- [ ] **File transfer** — chunked binary DataChannel (`f:<xid>`)
- [ ] **Message persistence** — SQLite via `modernc.org/sqlite`
- [ ] **TUI** — Bubble Tea client consuming the IPC port
- [ ] **Native UI** — web frontend with native packaging (Tauri-style)