mirror of https://github.com/vitorpamplona/amethyst.git synced 2026-08-10 16:33:27 +00:00

Files

T

Claude 70d51cc98b fix(relay): parse the authority instead of substring-matching the url

Audit of the IPv6 work found a family of bugs in isLocalHost/isOnion, most
predating this branch, all with one root cause: the predicates ran `contains`
over the whole url rather than parsing the authority. These decide whether a
relay is exempt from Tor, and relay urls arrive from other people (NIP-65
lists, relay hints, r tags), so they are attacker-controlled input.

- A path could impersonate the host. `wss://evil.example.com/127.0.0.1`
  answered isLocalHost() == true, so any relay list could hand the app a url
  that silently dropped its own Tor routing. The IPv6 lookup added earlier on
  this branch had the same flaw via `/[fd00::1]`, and IPv6 canonicalization
  could rewrite a path outright, corrupting the url.

- `.onion:8080` never matched the `.onion/` test, so an onion relay on an
  explicit port was not treated as onion at all: never forced onto Tor, and its
  hostname went to the clearnet DNS resolver. The fully-qualified `.onion.`
  spelling missed the same way.

- Host tests were case-sensitive, but fix() asks them before the RFC 3986 pass
  folds case, so LOCALHOST:8080 and ABC.ONION:8080 were handed a wss:// scheme
  neither host can serve.

- Private IPv4 was substring-matched, which missed 10.0.0.5, 172.16.3.4 and
  127.1.2.3 — a LAN relay got wss:// and was dialed through Tor — while
  matching 192.168.evil.com and 127.0.0.1.evil.com, registrable domains that
  could therefore exempt themselves from Tor. Same for notlocalhost.example.com
  against `contains("localhost")`.

- A `://` inside a path was read as a scheme separator, so
  `relay.com/x://127.0.0.1` read its path as the authority.

Fixes: a shared hostStart/hostEnd/hostEndWithoutPort trio bounds every test to
the authority, strips :port and trailing dots and validates the scheme; private
ranges are parsed via a new Ipv4 util rather than substring-matched;
comparisons are case-insensitive per RFC 4343; NormalizedRelayUrl.isOnion()
delegates instead of keeping a second, weaker copy of the test.

No performance regression: the old form ran six full-string scans, the new one
bounds its work to the authority and rejects a DNS host from an IP parse on one
character. Ipv6.isLiteral gained a two-colon gate so the schemeless host:port
case answers without allocating the parser's buffer.

Ipv6 is now pinned by a differential test: 4000 random addresses round-trip
against java.net.InetAddress in both directions, and the canonical form is
asserted equal to OkHttp's host for the same address, so the relay identity the
app stores provably matches the host it dials.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DQr8CDsznzCRUeB5tS8VYk

2026-08-05 04:22:59 +00:00

README.md

quartz plans

Audited 2026-06-30. 11 plans: 7 shipped (archived), 0 in-progress, 3 queued, 1 closed (negative result).

Queued

Plan	Summary
2026-05-08-local-headers-explorer.md	Headers-only Bitcoin P2P client to verify NIP-03 OTS attestations without a trusted block explorer.
2026-06-12-giftwrap-deletion-requests.md	Let a recipient-authored kind-5 delete/block a gift wrap (kind 1059) addressed to them.
2026-07-03-incremental-negentropy-storage.md	Always-current (created_at, id) index so cold NEG-OPENs stop paying a full scan + seal (~340 ms at 50k vs strfry's ~21 ms).
2026-07-04-small-req-floor.md	Small-REQ dispatch floor: decomposed, inline fast path tried and reverted (no wire-level win); floor is transport-side.

Archived (shipped)

Plan	Summary
archive/2026-06-03-fix-nip46-bunker-double-resume-plan.md	Fix NIP-46 bunker double-resume crash and retry id-reuse races via Channel-per-request + fresh id per attempt.
archive/2026-06-04-auth-scope-vs-policy.md	Move relay-server authenticated-identity state from the policy into the engine-owned connection scope.
archive/2026-06-09-clink.md	Implement CLINK (Offers/Debits/Manage) Lightning-over-Nostr pointers, events, and client/server in Quartz.
archive/2026-06-11-runstr-interop.md	RUNSTR kind-1301 workout events and supporting fitness kinds in Quartz plus Amethyst fitness screens.
archive/2026-06-19-napplet-nip5a-resolver.md	Platform-agnostic NIP-5A static-site resolver verifying content-addressed Blossom blobs against signed manifests.
archive/2026-06-20-powr-interop.md	Parse and render the POWR/NIP-101e kind-1301 strength-workout dialect alongside the existing RUNSTR dialect.
archive/2026-06-28-git-smart-http-browser.md	Git smart-HTTP v2 client to browse NIP-34 repo file trees and render source from the clone URL.