ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/cvsroot/AnyEvent-MP/MP/Transport.pm
Revision: 1.79
Committed: Wed Mar 21 15:22:16 2012 UTC (12 years, 3 months ago) by root
Branch: MAIN
Changes since 1.78: +56 -39 lines
Log Message:
*** empty log message ***

File Contents

# Content
1 =head1 NAME
2
3 AnyEvent::MP::Transport - actual transport protocol handler
4
5 =head1 SYNOPSIS
6
7 use AnyEvent::MP::Transport;
8
9 =head1 DESCRIPTION
10
11 This module implements (and documents) the actual transport protocol for
12 AEMP.
13
14 See the "PROTOCOL" section below if you want to write another client for
15 this protocol.
16
17 =head1 FUNCTIONS/METHODS
18
19 =over 4
20
21 =cut
22
23 package AnyEvent::MP::Transport;
24
25 use common::sense;
26
27 use Scalar::Util ();
28 use List::Util ();
29 use MIME::Base64 ();
30 use Storable ();
31 use JSON::XS ();
32
33 use Digest::MD6 ();
34 use Digest::HMAC_MD6 ();
35
36 use AE ();
37 use AnyEvent::Socket ();
38 use AnyEvent::Handle 4.92 ();
39
40 use AnyEvent::MP::Config ();
41
42 our $PROTOCOL_VERSION = 1;
43
44 our @HOOK_GREET; # called at connect/accept time
45 our @HOOK_GREETED; # called at greeting1 time
46 our @HOOK_CONNECT; # called at data phase
47 our @HOOK_DESTROY; # called at destroy time
48 our %HOOK_PROTOCOL = (
49 "aemp-dataconn" => sub {
50 require AnyEvent::MP::DataConn;
51 &AnyEvent::MP::DataConn::_inject;
52 },
53 );
54
55 =item $listener = mp_server $host, $port, <constructor-args>
56
57 Creates a listener on the given host/port using
58 C<AnyEvent::Socket::tcp_server>.
59
60 See C<new>, below, for constructor arguments.
61
62 Defaults for peerhost, peerport and fh are provided.
63
64 =cut
65
66 sub mp_server($$;%) {
67 my ($host, $port, %arg) = @_;
68
69 AnyEvent::Socket::tcp_server $host, $port, sub {
70 my ($fh, $host, $port) = @_;
71
72 my $tp = new AnyEvent::MP::Transport
73 fh => $fh,
74 peerhost => $host,
75 peerport => $port,
76 %arg,
77 ;
78 $tp->{keepalive} = $tp;
79 }, delete $arg{prepare}
80 }
81
82 =item $guard = mp_connect $host, $port, <constructor-args>, $cb->($transport)
83
84 =cut
85
86 sub mp_connect {
87 my $release = pop;
88 my ($host, $port, @args) = @_;
89
90 new AnyEvent::MP::Transport
91 connect => [$host, $port],
92 peerhost => $host,
93 peerport => $port,
94 release => $release,
95 @args,
96 ;
97 }
98
99 =item new AnyEvent::MP::Transport
100
101 Create a new transport - usually used via C<mp_server> or C<mp_connect>
102 instead.
103
104 # immediately starts negotiation
105 my $transport = new AnyEvent::MP::Transport
106 # mandatory
107 fh => $filehandle,
108 local_id => $identifier,
109 on_recv => sub { receive-callback },
110 on_error => sub { error-callback },
111
112 # optional
113 on_greet => sub { before sending greeting },
114 on_greeted => sub { after receiving greeting },
115 on_connect => sub { successful-connect-callback },
116 greeting => { key => value },
117
118 # tls support
119 tls_ctx => AnyEvent::TLS,
120 peername => $peername, # for verification
121 ;
122
123 =cut
124
125 sub new {
126 my ($class, %arg) = @_;
127
128 my $self = bless \%arg, $class;
129
130 {
131 Scalar::Util::weaken (my $self = $self);
132
133 my $config = $AnyEvent::MP::Kernel::CONFIG;
134
135 my $timeout = $config->{monitor_timeout};
136 my $lframing = $config->{framing_format};
137 my $auth_snd = $config->{auth_offer};
138 my $auth_rcv = $config->{auth_accept};
139
140 $self->{secret} = $config->{secret}
141 unless exists $self->{secret};
142
143 my $secret = $self->{secret};
144
145 if (exists $config->{cert}) {
146 $self->{tls_ctx} = {
147 sslv2 => 0,
148 sslv3 => 0,
149 tlsv1 => 1,
150 verify => 1,
151 cert => $config->{cert},
152 ca_cert => $config->{cert},
153 verify_require_client_cert => 1,
154 };
155 }
156
157 $self->{hdl} = new AnyEvent::Handle
158 +($self->{fh} ? (fh => $self->{fh}) : (connect => $self->{connect})),
159 autocork => $config->{autocork},
160 no_delay => exists $config->{nodelay} ? $config->{nodelay} : 1,
161 keepalive => 1,
162 on_error => sub {
163 $self->error ($_[2]);
164 },
165 rtimeout => $timeout,
166 ;
167
168 my $greeting_kv = $self->{local_greeting} ||= {};
169
170 $greeting_kv->{tls} = "1.0" if $self->{tls_ctx};
171 $greeting_kv->{provider} = "AE-$AnyEvent::MP::Config::VERSION";
172 $greeting_kv->{peeraddr} = AnyEvent::Socket::format_hostport $self->{peerhost}, $self->{peerport};
173
174 my $protocol = $self->{protocol} || "aemp";
175
176 # can modify greeting_kv
177 $_->($self) for $protocol eq "aemp" ? @HOOK_GREET : ();
178 (delete $self->{on_greet})->($self)
179 if exists $self->{on_greet};
180
181 # send greeting
182 my $lgreeting1 = "$protocol;$PROTOCOL_VERSION"
183 . ";$AnyEvent::MP::Kernel::NODE"
184 . ";" . (join ",", @$auth_rcv)
185 . ";" . (join ",", @$lframing)
186 . (join "", map ";$_=$greeting_kv->{$_}", keys %$greeting_kv);
187
188 my $lgreeting2 = MIME::Base64::encode_base64 AnyEvent::MP::Kernel::nonce (66), "";
189
190 $self->{hdl}->push_write ("$lgreeting1\012$lgreeting2\012");
191 return unless $self;
192
193 # expect greeting
194 $self->{hdl}->rbuf_max (4 * 1024);
195 $self->{hdl}->push_read (line => sub {
196 my $rgreeting1 = $_[1];
197
198 my ($aemp, $version, $rnode, $auths, $framings, @kv) = split /;/, $rgreeting1;
199
200 $self->{remote_node} = $rnode;
201
202 $self->{remote_greeting} = {
203 map /^([^=]+)(?:=(.*))?/ ? ($1 => $2) : (),
204 @kv
205 };
206
207 # maybe upgrade the protocol
208 if ($protocol eq "aemp" and $aemp =~ /^aemp-\w+$/) {
209 # maybe check for existence of the protocol handler?
210 $self->{protocol} = $protocol = $aemp;
211 }
212
213 $_->($self) for $protocol eq "aemp" ? @HOOK_GREETED : ();
214 (delete $self->{on_greeted})->($self)
215 if exists $self->{on_greeted};
216
217 if ($aemp ne $protocol and $aemp ne "aemp") {
218 return $self->error ("unparsable greeting, expected '$protocol', got '$aemp'");
219 } elsif ($version != $PROTOCOL_VERSION) {
220 return $self->error ("version mismatch (we: $PROTOCOL_VERSION, they: $version)");
221 } elsif ($protocol eq "aemp") {
222 if ($rnode eq $AnyEvent::MP::Kernel::NODE) {
223 return $self->error ("I refuse to talk to myself");
224 } elsif ($AnyEvent::MP::Kernel::NODE{$rnode} && $AnyEvent::MP::Kernel::NODE{$rnode}{transport}) {
225 return $self->error ("$rnode already connected, not connecting again.");
226 }
227 }
228
229 # read nonce
230 $self->{hdl}->push_read (line => sub {
231 my $rgreeting2 = $_[1];
232
233 "$lgreeting1\012$lgreeting2" ne "$rgreeting1\012$rgreeting2" # echo attack?
234 or return $self->error ("authentication error, echo attack?");
235
236 my $tls = $self->{tls_ctx} && 1 == int $self->{remote_greeting}{tls};
237
238 my $s_auth;
239 for my $auth_ (split /,/, $auths) {
240 if (grep $auth_ eq $_, @$auth_snd and ($auth_ !~ /^tls_/ or $tls)) {
241 $s_auth = $auth_;
242 last;
243 }
244 }
245
246 defined $s_auth
247 or return $self->error ("$auths: no common auth type supported");
248
249 my $s_framing;
250 for my $framing_ (split /,/, $framings) {
251 if (grep $framing_ eq $_, @$lframing) {
252 $s_framing = $framing_;
253 last;
254 }
255 }
256
257 defined $s_framing
258 or return $self->error ("$framings: no common framing method supported");
259
260 my $key;
261 my $lauth;
262
263 if ($tls) {
264 $self->{tls} = $lgreeting2 lt $rgreeting2 ? "connect" : "accept";
265 $self->{hdl}->starttls ($self->{tls}, $self->{tls_ctx});
266 return unless $self->{hdl}; # starttls might destruct us
267
268 $lauth =
269 $s_auth eq "tls_anon" ? ""
270 : $s_auth eq "tls_md6_64_256" ? Digest::MD6::md6_hex "$lgreeting1\012$lgreeting2\012$rgreeting1\012$rgreeting2\012"
271 : return $self->error ("$s_auth: fatal, selected unsupported snd auth method");
272
273 } elsif (length $secret) {
274 return $self->error ("$s_auth: fatal, selected unsupported snd auth method")
275 unless $s_auth eq "hmac_md6_64_256"; # hardcoded atm.
276
277 $key = Digest::MD6::md6 $secret;
278 # we currently only support hmac_md6_64_256
279 $lauth = Digest::HMAC_MD6::hmac_md6_hex $key, "$lgreeting1\012$lgreeting2\012$rgreeting1\012$rgreeting2\012", 64, 256;
280
281 } else {
282 return $self->error ("unable to handshake TLS and no shared secret configured");
283 }
284
285 $self->{hdl}->push_write ("$s_auth;$lauth;$s_framing\012");
286 return unless $self;
287
288 # read the authentication response
289 $self->{hdl}->push_read (line => sub {
290 my ($hdl, $rline) = @_;
291
292 my ($auth_method, $rauth2, $r_framing) = split /;/, $rline;
293
294 my $rauth =
295 $auth_method eq "hmac_md6_64_256" ? Digest::HMAC_MD6::hmac_md6_hex $key, "$rgreeting1\012$rgreeting2\012$lgreeting1\012$lgreeting2\012", 64, 256
296 : $auth_method eq "cleartext" ? unpack "H*", $secret
297 : $auth_method eq "tls_anon" ? ($tls ? "" : "\012\012") # \012\012 never matches
298 : $auth_method eq "tls_md6_64_256" ? ($tls ? Digest::MD6::md6_hex "$rgreeting1\012$rgreeting2\012$lgreeting1\012$lgreeting2\012" : "\012\012")
299 : return $self->error ("$auth_method: fatal, selected unsupported rcv auth method");
300
301 if ($rauth2 ne $rauth) {
302 return $self->error ("authentication failure/shared secret mismatch");
303 }
304
305 $self->{r_framing} = $r_framing;
306 $self->{s_framing} = $s_framing;
307
308 $hdl->rbuf_max (undef);
309
310 # we rely on TCP retransmit timeouts and keepalives
311 $self->{hdl}->rtimeout (undef);
312
313 $self->{remote_greeting}{untrusted} = 1
314 if $auth_method eq "tls_anon";
315
316 if ($protocol eq "aemp" and $self->{hdl}) {
317 # listener-less nodes need to continuously probe
318 # unless (@$AnyEvent::MP::Kernel::BINDS) {
319 # $self->{hdl}->wtimeout ($timeout);
320 # $self->{hdl}->on_wtimeout (sub { $self->{send}->([]) });
321 # }
322
323 # receive handling
324 $self->set_snd_framing;
325 $self->set_rcv_framing;
326 }
327
328 $self->connected;
329 });
330 });
331 });
332 }
333
334 $self
335 }
336
337 sub set_snd_framing {
338 my ($self) = @_;
339
340 my $framing = $self->{s_framing};
341 my $hdl = $self->{hdl};
342 my $push_write = $hdl->can ("push_write");
343
344 if ($framing eq "json") {
345 $self->{send} = sub {
346 $push_write->($hdl, JSON::XS::encode_json $_[0]);
347 };
348 } else {
349 $self->{send} = sub {
350 $push_write->($hdl, $framing => $_[0]);
351 };
352 }
353 }
354
355 sub set_rcv_framing {
356 my ($self) = @_;
357
358 my $node = $self->{remote_node};
359 my $framing = $self->{r_framing};
360 my $hdl = $self->{hdl};
361 my $push_read = $hdl->can ("push_read");
362
363 if ($framing eq "json") {
364 my $coder = JSON::XS->new->utf8;
365
366 $hdl->on_read (sub {
367 $AnyEvent::MP::Kernel::SRCNODE = $node;
368
369 AnyEvent::MP::Kernel::_inject (@$_)
370 for $coder->incr_parse (delete $_[0]{rbuf});
371
372 ()
373 });
374 } else {
375 my $rmsg; $rmsg = $self->{rmsg} = sub {
376 $push_read->($_[0], $framing => $rmsg);
377
378 $AnyEvent::MP::Kernel::SRCNODE = $node;
379 AnyEvent::MP::Kernel::_inject (@{ $_[1] });
380 };
381 eval {
382 $push_read->($hdl, $framing => $rmsg);
383 };
384 Scalar::Util::weaken $rmsg;
385 return $self->error ("$framing: unusable remote framing")
386 if $@;
387 }
388 }
389
390 sub error {
391 my ($self, $msg) = @_;
392
393 delete $self->{keepalive};
394
395 if ($self->{protocol}) {
396 $HOOK_PROTOCOL{$self->{protocol}}->($self, $msg);
397 } else {
398 $AnyEvent::MP::Kernel::WARN->(9, "$self->{peerhost}:$self->{peerport} $msg");#d#
399
400 $self->{node}->transport_error (transport_error => $self->{node}{id}, $msg)
401 if $self->{node} && $self->{node}{transport} == $self;
402 }
403
404 (delete $self->{release})->()
405 if exists $self->{release};
406
407 # $AnyEvent::MP::Kernel::WARN->(7, "$self->{peerhost}:$self->{peerport}: $msg");
408 $self->destroy;
409 }
410
411 sub connected {
412 my ($self) = @_;
413
414 delete $self->{keepalive};
415
416 if ($self->{protocol}) {
417 $self->{hdl}->on_error (undef);
418 $HOOK_PROTOCOL{$self->{protocol}}->($self, undef);
419 } else {
420 $AnyEvent::MP::Kernel::WARN->(9, "$self->{peerhost}:$self->{peerport} connected as $self->{remote_node}");
421
422 my $node = AnyEvent::MP::Kernel::add_node ($self->{remote_node});
423 Scalar::Util::weaken ($self->{node} = $node);
424 $node->transport_connect ($self);
425
426 $_->($self) for @HOOK_CONNECT;
427 }
428
429 (delete $self->{release})->()
430 if exists $self->{release};
431
432 (delete $self->{on_connect})->($self)
433 if exists $self->{on_connect};
434 }
435
436 sub destroy {
437 my ($self) = @_;
438
439 (delete $self->{release})->()
440 if exists $self->{release};
441
442 $self->{hdl}->destroy
443 if $self->{hdl};
444
445 (delete $self->{on_destroy})->($self)
446 if exists $self->{on_destroy};
447 $_->($self) for $self->{protocol} ? () : @HOOK_DESTROY;
448
449 $self->{protocol} = "destroyed"; # to keep hooks from invoked twice.
450 }
451
452 sub DESTROY {
453 my ($self) = @_;
454
455 $self->destroy;
456 }
457
458 =back
459
460 =head1 PROTOCOL
461
462 The AEMP protocol is comparatively simple, and consists of three phases
463 which are symmetrical for both sides: greeting (followed by optionally
464 switching to TLS mode), authentication and packet exchange.
465
466 The protocol is designed to allow both full-text and binary streams.
467
468 The greeting consists of two text lines that are ended by either an ASCII
469 CR LF pair, or a single ASCII LF (recommended).
470
471 =head2 GREETING
472
473 All the lines until after authentication must not exceed 4kb in length,
474 including line delimiter. Afterwards there is no limit on the packet size
475 that can be received.
476
477 =head3 First Greeting Line
478
479 Example:
480
481 aemp;0;rain;tls_md6_64_256,hmac_md6_64_256,tls_anon,cleartext;json,storable;timeout=12;peeraddr=10.0.0.1:48082
482
483 The first line contains strings separated (not ended) by C<;>
484 characters. The first five strings are fixed by the protocol, the
485 remaining strings are C<KEY=VALUE> pairs. None of them may contain C<;>
486 characters themselves (when escaping is needed, use C<%3b> to represent
487 C<;> and C<%25> to represent C<%>)-
488
489 The fixed strings are:
490
491 =over 4
492
493 =item protocol identification
494
495 The constant C<aemp> to identify this protocol.
496
497 =item protocol version
498
499 The protocol version supported by this end, currently C<1>. If the
500 versions don't match then no communication is possible. Minor extensions
501 are supposed to be handled through additional key-value pairs.
502
503 =item the node ID
504
505 This is the node ID of the connecting node.
506
507 =item the acceptable authentication methods
508
509 A comma-separated list of authentication methods supported by the
510 node. Note that AnyEvent::MP supports a C<hex_secret> authentication
511 method that accepts a clear-text password (hex-encoded), but will not use
512 this authentication method itself.
513
514 The receiving side should choose the first authentication method it
515 supports.
516
517 =item the acceptable framing formats
518
519 A comma-separated list of packet encoding/framing formats understood. The
520 receiving side should choose the first framing format it supports for
521 sending packets (which might be different from the format it has to accept).
522
523 =back
524
525 The remaining arguments are C<KEY=VALUE> pairs. The following key-value
526 pairs are known at this time:
527
528 =over 4
529
530 =item provider=<module-version>
531
532 The software provider for this implementation. For AnyEvent::MP, this is
533 C<AE-0.0> or whatever version it currently is at.
534
535 =item peeraddr=<host>:<port>
536
537 The peer address (socket address of the other side) as seen locally.
538
539 =item tls=<major>.<minor>
540
541 Indicates that the other side supports TLS (version should be 1.0) and
542 wishes to do a TLS handshake.
543
544 =item nproto=<major>.<fractional>
545
546 Informs the other side of the node protocol implemented by this
547 node. Major version mismatches are fatal. If this key is missing, then it
548 is assumed that the node doesn't support the node protocol.
549
550 The node protocol is currently undocumented, but includes port
551 monitoring, spawning and informational requests.
552
553 =item gproto=<major>.<fractional>
554
555 Informs the other side of the global protocol implemented by this
556 node. Major version mismatches are fatal. If this key is missing, then it
557 is assumed that the node doesn't support the global protocol.
558
559 The global protocol is currently undocumented, but includes node address
560 lookup and shared database operations.
561
562 =back
563
564 =head3 Second Greeting Line
565
566 After this greeting line there will be a second line containing a
567 cryptographic nonce, i.e. random data of high quality. To keep the
568 protocol text-only, these are usually 32 base64-encoded octets, but
569 it could be anything that doesn't contain any ASCII CR or ASCII LF
570 characters.
571
572 I<< The two nonces B<must> be different, and an aemp implementation
573 B<must> check and fail when they are identical >>.
574
575 Example of a nonce line (yes, it's random-looking because it is random
576 data):
577
578 2XYhdG7/O6epFa4wuP0ujAEx1rXYWRcOypjUYK7eF6yWAQr7gwIN9m/2+mVvBrTPXz5GJDgfGm9d8QRABAbmAP/s
579
580 =head2 TLS handshake
581
582 I<< If, after the handshake, both sides indicate interest in TLS, then the
583 connection B<must> use TLS, or fail to continue. >>
584
585 Both sides compare their nonces, and the side who sent the lower nonce
586 value ("string" comparison on the raw octet values) becomes the client,
587 and the one with the higher nonce the server.
588
589 =head2 AUTHENTICATION PHASE
590
591 After the greeting is received (and the optional TLS handshake),
592 the authentication phase begins, which consists of sending a single
593 C<;>-separated line with three fixed strings and any number of
594 C<KEY=VALUE> pairs.
595
596 The three fixed strings are:
597
598 =over 4
599
600 =item the authentication method chosen
601
602 This must be one of the methods offered by the other side in the greeting.
603
604 Note that all methods starting with C<tls_> are only valid I<iff> TLS was
605 successfully handshaked (and to be secure the implementation must enforce
606 this).
607
608 The currently supported authentication methods are:
609
610 =over 4
611
612 =item cleartext
613
614 This is simply the shared secret, lowercase-hex-encoded. This method is of
615 course very insecure if TLS is not used (and not completely secure even
616 if TLS is used), which is why this module will accept, but not generate,
617 cleartext auth replies.
618
619 =item hmac_md6_64_256
620
621 This method uses an MD6 HMAC with 64 bit blocksize and 256 bit hash, and
622 requires a shared secret. It is the preferred auth method when a shared
623 secret is available.
624
625 First, the shared secret is hashed with MD6:
626
627 key = MD6 (secret)
628
629 This secret is then used to generate the "local auth reply", by taking
630 the two local greeting lines and the two remote greeting lines (without
631 line endings), appending \012 to all of them, concatenating them and
632 calculating the MD6 HMAC with the key:
633
634 lauth = HMAC_MD6 key, "lgreeting1\012lgreeting2\012rgreeting1\012rgreeting2\012"
635
636 This authentication token is then lowercase-hex-encoded and sent to the
637 other side.
638
639 Then the remote auth reply is generated using the same method, but local
640 and remote greeting lines swapped:
641
642 rauth = HMAC_MD6 key, "rgreeting1\012rgreeting2\012lgreeting1\012lgreeting2\012"
643
644 This is the token that is expected from the other side.
645
646 =item tls_anon
647
648 This type is only valid I<iff> TLS was enabled and the TLS handshake
649 was successful. It has no authentication data, as the server/client
650 certificate was successfully verified.
651
652 This authentication type is somewhat insecure, as it allows a
653 man-in-the-middle attacker to change some of the connection parameters
654 (such as the framing format), although there is no known attack that
655 exploits this in a way that is worse than just denying the service.
656
657 By default, this implementation accepts but never generates this auth
658 reply.
659
660 =item tls_md6_64_256
661
662 This type is only valid I<iff> TLS was enabled and the TLS handshake was
663 successful.
664
665 This authentication type simply calculates:
666
667 lauth = MD6 "rgreeting1\012rgreeting2\012lgreeting1\012lgreeting2\012"
668
669 and lowercase-hex encodes the result and sends it as authentication
670 data. No shared secret is required (authentication is done by TLS). The
671 checksum exists only to make tinkering with the greeting hard.
672
673 =back
674
675 =item the authentication data
676
677 The authentication data itself, usually base64 or hex-encoded data, see
678 above.
679
680 =item the framing protocol chosen
681
682 This must be one of the framing protocols offered by the other side in the
683 greeting. Each side must accept the choice of the other side, and generate
684 packets in the format it chose itself.
685
686 =back
687
688 Example of an authentication reply:
689
690 hmac_md6_64_256;363d5175df38bd9eaddd3f6ca18aa1c0c4aa22f0da245ac638d048398c26b8d3;json
691
692 =head2 DATA PHASE
693
694 After this, packets get exchanged using the chosen framing protocol. It is
695 quite possible that both sides use a different framing protocol.
696
697 =head2 FULL EXAMPLE
698
699 This is an actual protocol dump of a handshake, followed by a single data
700 packet. The greater than/less than lines indicate the direction of the
701 transfer only.
702
703 > aemp;0;anon/57Cs1CggVJjzYaQp13XXg4;tls_md6_64_256,hmac_md6_64_256,tls_anon,cleartext;json,storable;provider=AE-0.8;timeout=12;peeraddr=10.0.0.17:4040
704 > yLgdG1ov/02shVkVQer3wzeuywZK+oraTdEQBmIqWHaegxSGDG4g+HqogLQbvdypFOsoDWJ1Sh4ImV4DMhvUBwTK
705
706 < aemp;0;ruth;tls_md6_64_256,hmac_md6_64_256,tls_anon,cleartext;json,storable;provider=AE-0.8;timeout=12;peeraddr=10.0.0.1:37108
707 < +xMQXP8ElfNmuvEhsmcp+s2wCJOuQAsPxSg3d2Ewhs6gBnJz+ypVdWJ/wAVrXqlIJfLeVS/CBy4gEGkyWHSuVb1L
708
709 > hmac_md6_64_256;5ad913855742ae5a03a5aeb7eafa4c78629de136bed6acd73eea36c9e98df44a;json
710
711 < hmac_md6_64_256;84cd590976f794914c2ca26dac3a207a57a6798b9171289c114de07cf0c20401;json
712 < ["","AnyEvent::MP::_spawn","57Cs1CggVJjzYaQp13XXg4.c","AnyEvent::MP::Global::connect",0,"anon/57Cs1CggVJjzYaQp13XXg4"]
713 ...
714
715 The shared secret in use was C<8ugxrtw6H5tKnfPWfaSr4HGhE8MoJXmzTT1BWq7sLutNcD0IbXprQlZjIbl7MBKoeklG3IEfY9GlJthC0pENzk>.
716
717 =head2 SIMPLE HANDSHAKE FOR NON-PERL NODES
718
719 Implementing the full set of options for handshaking can be a daunting
720 task.
721
722 If security is not so important (because you only connect locally and
723 control the host, a common case), and you want to interface with an AEMP
724 node from another programming language, then you can also implement a
725 simplified handshake.
726
727 For example, in a simple implementation you could decide to simply not
728 check the authenticity of the other side and use cleartext authentication
729 yourself. The the handshake is as simple as sending three lines of text,
730 reading three lines of text, and then you can exchange JSON-formatted
731 messages:
732
733 aemp;1;<nodename>;hmac_md6_64_256;json
734 <nonce>
735 cleartext;<hexencoded secret>;json
736
737 The nodename should be unique within the network, preferably unique with
738 every connection, the <nonce> could be empty or some random data, and the
739 hexencoded secret would be the shared secret, in lowercase hex (e.g. if
740 the secret is "geheim", the hex-encoded version would be "67656865696d").
741
742 Note that apart from the low-level handshake and framing protocol, there
743 is a high-level protocol, e.g. for monitoring, building the mesh or
744 spawning. All these messages are sent to the node port (the empty string)
745 and can safely be ignored if you do not need the relevant functionality.
746
747 =head3 USEFUL HINTS
748
749 Since taking part in the global protocol to find port groups is
750 nontrivial, hardcoding port names should be considered as well, i.e. the
751 non-Perl node could simply listen to messages for a few well-known ports.
752
753 Alternatively, the non-Perl node could call a (already loaded) function
754 in the Perl node by sending it a special message:
755
756 ["", "Some::Function::name", "myownport", 1, 2, 3]
757
758 This would call the function C<Some::Function::name> with the string
759 C<myownport> and some additional arguments.
760
761 =head2 MONITORING
762
763 Monitoring the connection itself is transport-specific. For TCP, all
764 connection monitoring is currently left to TCP retransmit time-outs
765 on a busy link, and TCP keepalive (which should be enabled) for idle
766 connections.
767
768 This is not sufficient for listener-less nodes, however: they need
769 to regularly send data (30 seconds, or the monitoring interval, is
770 recommended), so TCP actively probes.
771
772 Future implementations of AnyEvent::MP::Transport might query the kernel TCP
773 buffer after a write timeout occurs, and if it is non-empty, shut down the
774 connections, but this is an area of future research :)
775
776 =head2 NODE PROTOCOL
777
778 The transport simply transfers messages, but to implement a full node, a
779 special node port must exist that understands a number of requests.
780
781 If you are interested in implementing this, drop us a note so we finish
782 the documentation.
783
784 =head1 SEE ALSO
785
786 L<AnyEvent::MP>.
787
788 =head1 AUTHOR
789
790 Marc Lehmann <schmorp@schmorp.de>
791 http://home.schmorp.de/
792
793 =cut
794
795 1
796