Brought Example up to spec

example/server/Cargo.toml

@@ -8,8 +8,11 @@ name = "server"
 path = "src/main.rs"
 
 [dependencies]
-mtp = { version = "0.2.0", path = "../../", features = ["crypto", "tls", "host", "files", "pipes"] }
+mtp = { version = "0.2.0", path = "../../", features = ["crypto", "tls", "web-server", "files", "pipes"] }
 tokio = { version = "1", features = ["full"] }
+tokio-rustls = "0.26"
+rustls = "0.23"
 serde_json = { version = "1" }
 hex = "0.4"
 base64 = "0.22"
+tracing-subscriber = "0.3.23"

example/server/src/clients.rs

@@ -1,14 +1,14 @@
 use std::collections::HashMap;
-use std::fs;
 use std::sync::{Arc, Mutex};
+use tokio::fs;
 
 use mtp::crypto::PublicKeyBundle;
 
-pub fn load_client_db(
+pub async fn load_client_db(
     path: &str,
 ) -> Result<(Arc<Mutex<HashMap<u64, PublicKeyBundle>>>, Arc<Mutex<u64>>), Box<dyn std::error::Error>>
 {
-    let clients_map = match fs::read_to_string(path) {
+    let clients_map = match fs::read_to_string(path).await {
         Ok(data) => match serde_json::from_str(&data) {
             Ok(clients) => clients,
             Err(e) => {

example/server/src/keys.rs

@@ -1,4 +1,4 @@
-use std::fs;
+use tokio::fs;
 
 use mtp::crypto::Keyring;
 use mtp::files::{load_keyring_raw, save_keyring_raw, save_public_key_bundle};
@@ -20,14 +20,16 @@ pub fn load_or_generate_host_keys(
     Ok((HOST_ID, keyring))
 }
 
-pub fn export_host_public_keys(host_keyring: &Keyring) -> Result<(), Box<dyn std::error::Error>> {
+pub async fn export_host_public_keys(
+    host_keyring: &Keyring,
+) -> Result<(), Box<dyn std::error::Error>> {
     let bundle = host_keyring.public_key_bundle();
     save_public_key_bundle(&bundle, "host.mpkb")?;
 
     /* The web client fetches the bundle as hex over HTTP. */
     let bundle_hex = hex::encode(bundle.as_bytes());
-    fs::write("host_public_key_bundle.hex", &bundle_hex)?;
-    fs::create_dir_all("web-client/public")?;
-    fs::write("web-client/public/host_public_key_bundle.hex", &bundle_hex)?;
+    fs::write("host_public_key_bundle.hex", &bundle_hex).await?;
+    fs::create_dir_all("web-client/public").await?;
+    fs::write("web-client/public/host_public_key_bundle.hex", &bundle_hex).await?;
     Ok(())
 }

example/server/src/main.rs

@@ -2,14 +2,19 @@ mod clients;
 mod handlers;
 mod keys;
 mod tls;
+#[path = "web-server.rs"]
+mod web_server;
 
-use mtp::host::{AuthenticationPolicy, HostConfig, MTPHost};
+use mtp::host::HostConfig;
 use mtp::type_map::TypeMap;
 use std::future::Future;
 use std::path::Path;
 use std::pin::Pin;
 use std::sync::Arc;
 
+const CONNECTION_IDLE_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(300);
+const MAX_MESSAGES_PER_CONNECTION: u64 = 10_000;
+
 fn dev_cert_paths() -> (String, String) {
     let cert = std::env::var("MTP_DEV_CERT").unwrap_or_else(|_| {
         if Path::new("example/dev-cert/cert.pem").exists() {
@@ -29,62 +34,81 @@ fn dev_cert_paths() -> (String, String) {
 }
 
 async fn handle_pipe_loopback(
-    conn: &mtp::host::MTPConnection,
-    req: mtp::host::PipeRequest,
+    conn: &mtp::webserver::WebMTPConnection,
+    request: mtp::host::PipeRequest<
+        mtp::webserver::WebMtpSender,
+        mtp::webserver::H3TransportReceiver,
+    >,
 ) -> Result<(), Box<dyn std::error::Error>> {
-    let pipe_id = req.id();
+    let pipe_id = request.id();
+    println!("  [loopback] Accepting pipe {pipe_id} ...");
+    let mut reader = request.accept().await?;
+
+    let return_pipe = conn.create_pipe("loopback").await?;
     println!(
-        "  [loopback] Pipe request: id={pipe_id} description={:?}",
-        req.description()
+        "  [loopback] Requested return pipe {}; waiting for client acceptance ...",
+        return_pipe.pipe_id()
     );
+    let Some(mut writer) = return_pipe.wait().await? else {
+        return Err("client denied the return pipe".into());
+    };
 
-    println!("  [loopback] Calling accept() for pipe {pipe_id} ...");
-    let mut reader = req.accept().await?;
-    println!("  [loopback] Pipe {pipe_id} accepted, reading data ...");
-
-    let handle = conn.create_pipe("loopback").await?;
-    println!(
-        "  [loopback] Return pipe created (id={}), waiting for client ...",
-        handle.pipe_id()
-    );
-
-    match handle.wait().await? {
-        Some(mut writer) => {
-            println!("  [loopback] Client accepted return pipe, echoing incoming bytes ...");
-            let mut total = 0usize;
-            let mut buf = [0u8; 16 * 1024];
-            loop {
-                let n = tokio::io::AsyncReadExt::read(&mut reader, &mut buf).await?;
-                if n == 0 {
-                    break;
-                }
-                total += n;
-                tokio::io::AsyncWriteExt::write_all(&mut writer, &buf[..n]).await?;
-            }
-            writer.finish().await?;
-            println!(
-                "  [loopback] Pipe {pipe_id} loopback complete ({} bytes)",
-                total
-            );
-        }
-        None => {
-            eprintln!("  [loopback] Return pipe denied by client for pipe {pipe_id}");
-        }
-    }
-
+    let copied = tokio::io::copy(&mut reader, &mut writer).await?;
+    writer.finish_async().await?;
+    println!("  [loopback] Pipe {pipe_id} complete ({copied} bytes)");
     Ok(())
 }
 
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    tracing_subscriber::fmt::init();
     let (cert_path, key_path) = dev_cert_paths();
-    let (cert_pem, key_pem) = tls::load_or_generate_tls(&cert_path, &key_path)?;
-    let cert_hash = tls::certificate_sha256_hex(&cert_pem)?;
-    tls::export_webtransport_cert_hash(&cert_hash)?;
+    let (cert_pem, key_pem) = tls::load_or_generate_tls(&cert_path, &key_path).await?;
+    let cert_hash = tls::certificate_sha256_hex(&cert_pem).await?;
+    tls::export_webtransport_cert_hash(&cert_hash).await?;
     println!("WebTransport certificate sha256: {cert_hash}");
 
     let (_host_id, host_keyring) = keys::load_or_generate_host_keys("host.mk")?;
-    keys::export_host_public_keys(&host_keyring)?;
+    keys::export_host_public_keys(&host_keyring).await?;
+
+    let (clients, next_id) = clients::load_client_db("clients.json").await?;
+    let clients_for_get = clients.clone();
+    let get_existing_client = move |id: u64, _description: Option<String>| {
+        let clients = clients_for_get.clone();
+        Box::pin(async move { clients.lock().ok()?.get(&id).cloned() })
+            as Pin<Box<dyn Future<Output = Option<mtp::crypto::PublicKeyBundle>> + Send>>
+    };
+    let clients_for_register = clients.clone();
+    let next_id_for_register = next_id.clone();
+    let complete_register = move |bundle: mtp::crypto::PublicKeyBundle,
+                                  _description: Option<String>| {
+        let clients = clients_for_register.clone();
+        let next_id = next_id_for_register.clone();
+
+        Box::pin(async move {
+            let id = {
+                let mut next = next_id.lock().expect("client id mutex poisoned");
+                let id = *next;
+                *next += 1;
+                id
+            };
+
+            let json = {
+                let mut db = clients.lock().expect("client database mutex poisoned");
+                db.insert(id, bundle);
+                serde_json::to_string_pretty(&*db).ok()
+            };
+
+            if let Some(json) = json {
+                if let Err(error) = tokio::fs::write("clients.json", json).await {
+                    eprintln!("Failed to persist clients.json: {error}");
+                }
+            }
+
+            println!("Registered new client with ID: {id}");
+            id
+        }) as Pin<Box<dyn Future<Output = u64> + Send>>
+    };
 
     let decrypt_keyring = Arc::new(
         match mtp::crypto::Keyring::from_bytes(&host_keyring.to_bytes()) {
@@ -95,51 +119,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         },
     );
 
-    let (clients, next_id) = clients::load_client_db("clients.json")?;
-
-    let clients_for_get = clients.clone();
-    let get_existing_user = move |id: u64, _description: Option<String>| {
-        let clients = clients_for_get.clone();
-        Box::pin(async move {
-            let result = clients.lock().unwrap().get(&id).cloned();
-            if result.is_some() {
-                println!("Auth lookup: client ID {id} found");
-            } else {
-                eprintln!("Auth lookup: unknown client ID {id}");
-            }
-            result
-        }) as Pin<Box<dyn Future<Output = Option<mtp::crypto::PublicKeyBundle>> + Send>>
-    };
-
-    let clients_for_register = clients.clone();
-    let next_id_for_register = next_id.clone();
-    let clients_path = "clients.json".to_string();
-    let complete_register = move |bundle: mtp::crypto::PublicKeyBundle,
-                                  _description: Option<String>| {
-        let db_arc = clients_for_register.clone();
-        let nid_arc = next_id_for_register.clone();
-        let path = clients_path.clone();
-        Box::pin(async move {
-            let mut db = db_arc.lock().unwrap();
-            let mut nid = nid_arc.lock().unwrap();
-            let id = *nid;
-            *nid += 1;
-            db.insert(id, bundle);
-            match serde_json::to_string_pretty(&*db) {
-                Ok(json) => match std::fs::write(&path, json) {
-                    Ok(()) => {}
-                    Err(e) => eprintln!("Failed to persist client database to {path}: {e}"),
-                },
-                Err(e) => {
-                    eprintln!("Failed to serialize client database after registering {id}: {e}")
-                }
-            }
-            println!("Registered new client with ID: {}", id);
-            id
-        }) as Pin<Box<dyn Future<Output = u64> + Send>>
-    };
-
-    println!("Starting MTP server on port 8080 ...");
+    println!("Starting integrated MTP web server on port 8080 ...");
 
     let config = HostConfig::new(
         std::net::IpAddr::V4(std::net::Ipv4Addr::UNSPECIFIED),
@@ -149,13 +129,21 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     )
     .with_authentication(
         host_keyring,
-        Box::new(get_existing_user),
+        Box::new(get_existing_client),
         Box::new(complete_register),
-    )
-    .with_authentication_policy(AuthenticationPolicy::ForceAuthentication);
+    );
 
-    let mut host = MTPHost::new(config).await?;
-    println!("Server listening on {}", host.local_addr());
+    let _https = web_server::spawn_https(
+        std::net::SocketAddr::new(config.ip, config.port),
+        &config.tls_fullchain,
+        &config.tls_key,
+    )
+    .await?;
+    let mut host = mtp::webserver::MTPWebServer::new(config, web_server::config()?).await?;
+    println!(
+        "Server listening on https://{} (TCP HTTPS + UDP WebTransport)",
+        host.local_addr()
+    );
 
     while let Some(conn) = host.accept().await? {
         let decrypt_keyring = Arc::clone(&decrypt_keyring);
@@ -170,56 +158,81 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
             let tm: &TypeMap = conn.codec.registry().get(&conn.version).unwrap();
 
             println!("Waiting for messages / pipe requests ...");
-            loop {
-                tokio::select! {
-                    biased;
+            let mut pipe_open = true;
+            let mut message_open = true;
+            let mut messages_received = 0_u64;
 
-                    pipe_req = conn.receive_pipe() => {
-                        match pipe_req {
-                            Ok(req) => {
-                                println!("  Pipe request: id={} desc={:?}", req.id(), req.description());
-                                if let Err(e) = handle_pipe_loopback(&conn, req).await {
-                                    eprintln!("  Pipe loopback error: {e}");
-                                }
-                            }
-                            Err(e) => {
-                                println!("Pipe channel closed: {e}");
-                                break;
-                            }
-                        }
-                    }
-                    msg = conn.receive() => {
-                        match msg {
-                            Ok(msg) => {
-                                println!("Received: {msg}");
-                                let response = match handlers::process_and_respond(
-                                    &msg,
-                                    tm,
-                                    conn.client_public_key.as_ref(),
-                                    &decrypt_keyring,
-                                ) {
-                                    Ok(response) => response,
-                                    Err(e) => {
-                                        eprintln!("Failed to build response: {e}");
-                                        continue;
+            while pipe_open || message_open {
+                let activity = tokio::time::timeout(CONNECTION_IDLE_TIMEOUT, async {
+                    tokio::select! {
+                        biased;
+                        pipe_request = conn.receive_pipe(), if pipe_open => {
+                            match pipe_request {
+                                Ok(request) => {
+                                    if let Err(error) = handle_pipe_loopback(&conn, request).await {
+                                        eprintln!("  [loopback] Pipe error: {error}");
                                     }
-                                };
-                                println!("Sending: {response}");
-                                if let Err(e) = conn.sender.send(&response).await {
-                                    eprintln!("Send error: {e}");
-                                    break;
+                                }
+                                Err(mtp::common::CommunicationError::StreamClosed)
+                                | Err(mtp::common::CommunicationError::ClosedByPeer) => {
+                                    println!("Pipe channel closed normally");
+                                    pipe_open = false;
+                                }
+                                Err(error) => {
+                                    println!("Pipe channel closed: {error}");
+                                    pipe_open = false;
                                 }
                             }
-                            Err(e) => {
-                                println!("Connection ended: {e}");
-                                break;
+                        }
+                        message = conn.receive(), if message_open => {
+                            match message {
+                                Ok(message) => {
+                                    messages_received += 1;
+                                    println!("Received: {message}");
+                                    match handlers::process_and_respond(
+                                        &message,
+                                        tm,
+                                        conn.client_public_key.as_ref(),
+                                        &decrypt_keyring,
+                                    ) {
+                                        Ok(response) => {
+                                            println!("Sending: {response}");
+                                            if let Err(error) = conn.sender.send(&response).await {
+                                                eprintln!("Send error: {error}");
+                                                pipe_open = false;
+                                                message_open = false;
+                                            }
+                                        }
+                                        Err(error) => {
+                                            eprintln!("Failed to build response: {error}");
+                                        }
+                                    }
+                                }
+                                Err(mtp::common::CommunicationError::StreamClosed)
+                                | Err(mtp::common::CommunicationError::ClosedByPeer) => {
+                                    println!("Message channel closed normally");
+                                    message_open = false;
+                                }
+                                Err(error) => {
+                                    println!("Message channel closed: {error}");
+                                    message_open = false;
+                                }
                             }
                         }
                     }
+                })
+                .await;
+
+                if activity.is_err() {
+                    println!("Connection idle timeout reached");
+                    break;
+                }
+                if messages_received >= MAX_MESSAGES_PER_CONNECTION {
+                    println!("Connection message limit reached");
+                    break;
                 }
             }
 
-            conn.sender.close();
             println!("Connection closed\n");
         });
     }

example/server/src/tls.rs

@@ -1,34 +1,34 @@
 use base64::Engine;
-use std::fs;
 use std::path::Path;
+use tokio::fs;
 
-pub fn load_or_generate_tls(
+pub async fn load_or_generate_tls(
     cert_path: &str,
     key_path: &str,
 ) -> Result<(Vec<u8>, Vec<u8>), Box<dyn std::error::Error>> {
-    if let (Ok(c), Ok(k)) = (fs::read(cert_path), fs::read(key_path)) {
+    if let (Ok(c), Ok(k)) = (fs::read(cert_path).await, fs::read(key_path).await) {
         println!("Using existing TLS cert from {cert_path}");
         return Ok((c, k));
     }
 
     println!("Generating self-signed TLS certificate ...");
     if let Some(parent) = Path::new(cert_path).parent() {
-        fs::create_dir_all(parent)?;
+        fs::create_dir_all(parent).await?;
     }
     if let Some(parent) = Path::new(key_path).parent() {
-        fs::create_dir_all(parent)?;
+        fs::create_dir_all(parent).await?;
     }
 
     let (cert_pem, key_pem) = mtp::crypto::tls::generate_self_signed_cert("localhost")?;
 
-    fs::write(cert_path, &cert_pem)?;
-    fs::write(key_path, &key_pem)?;
+    fs::write(cert_path, &cert_pem).await?;
+    fs::write(key_path, &key_pem).await?;
     println!("Wrote {cert_path} and {key_path}");
 
     Ok((cert_pem, key_pem))
 }
 
-pub fn certificate_sha256_hex(cert: &[u8]) -> Result<String, Box<dyn std::error::Error>> {
+pub async fn certificate_sha256_hex(cert: &[u8]) -> Result<String, Box<dyn std::error::Error>> {
     let der = if cert.starts_with(b"-----BEGIN CERTIFICATE-----") {
         let pem = std::str::from_utf8(cert)?;
         let base64 = pem
@@ -43,14 +43,14 @@ pub fn certificate_sha256_hex(cert: &[u8]) -> Result<String, Box<dyn std::error:
     Ok(hex::encode(mtp::crypto::sha256(&der)))
 }
 
-pub fn export_webtransport_cert_hash(hash: &str) -> Result<(), Box<dyn std::error::Error>> {
+pub async fn export_webtransport_cert_hash(hash: &str) -> Result<(), Box<dyn std::error::Error>> {
     let public_dir = if Path::new("web-client").exists() {
         Path::new("web-client/public")
     } else {
         Path::new("example/web-client/public")
     };
-    fs::create_dir_all(public_dir)?;
-    fs::write(public_dir.join("mtp_dev_cert_hash.txt"), hash)?;
+    fs::create_dir_all(public_dir).await?;
+    fs::write(public_dir.join("mtp_dev_cert_hash.txt"), hash).await?;
 
     let dev_cert_dir = if Path::new("dev-cert").exists() {
         Path::new("dev-cert")
@@ -58,7 +58,7 @@ pub fn export_webtransport_cert_hash(hash: &str) -> Result<(), Box<dyn std::erro
         Path::new("example/dev-cert")
     };
     if dev_cert_dir.exists() {
-        fs::write(dev_cert_dir.join("sha256.txt"), hash)?;
+        fs::write(dev_cert_dir.join("sha256.txt"), hash).await?;
     }
 
     Ok(())

example/server/src/web-server.rs

@@ -0,0 +1,138 @@
+use mtp::webserver::{Http3Request, Http3Response, WebServerConfig};
+use rustls::pki_types::{PrivateKeyDer, pem::PemObject};
+use std::{
+    io,
+    net::SocketAddr,
+    path::{Path, PathBuf},
+    sync::Arc,
+};
+use tokio::{
+    io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt},
+    net::TcpListener,
+    task::JoinHandle,
+};
+use tokio_rustls::TlsAcceptor;
+
+async fn ok(_request: Http3Request, response: Http3Response) -> Http3Response {
+    response
+        .header("content-type", "text/plain; charset=utf-8")
+        .body("OK")
+}
+
+pub fn config() -> Result<WebServerConfig, mtp::webserver::RouterError> {
+    WebServerConfig::new().route("/", ok)
+}
+
+/// Starts the conventional HTTPS side of the example host. WebTransport uses
+/// UDP/QUIC on the same port; browsers still need TCP/TLS to navigate to a URL.
+pub async fn spawn_https(
+    address: SocketAddr,
+    certificate_pem: &[u8],
+    key_pem: &[u8],
+) -> io::Result<JoinHandle<()>> {
+    // The TCP listener is created before the QUIC endpoint, so it must select
+    // rustls' process-wide provider itself.
+    mtp::crypto::ensure_crypto_provider();
+    let certificates = rustls::pki_types::CertificateDer::pem_slice_iter(certificate_pem)
+        .collect::<Result<Vec<_>, _>>()
+        .map_err(io::Error::other)?;
+    let key = PrivateKeyDer::from_pem_slice(key_pem).map_err(io::Error::other)?;
+    let tls = rustls::ServerConfig::builder()
+        .with_no_client_auth()
+        .with_single_cert(certificates, key)
+        .map_err(io::Error::other)?;
+    let listener = TcpListener::bind(address).await?;
+    let acceptor = TlsAcceptor::from(Arc::new(tls));
+    let asset_root = web_client_dist();
+    match &asset_root {
+        Some(_) => println!(
+            "HTTPS web client available at https://localhost:{}",
+            address.port()
+        ),
+        None => eprintln!(
+            "Web client build not found; HTTPS will show setup instructions. Run `pnpm --dir example/web-client build`."
+        ),
+    }
+    Ok(tokio::spawn(async move {
+        loop {
+            let Ok((stream, _)) = listener.accept().await else {
+                break;
+            };
+            let acceptor = acceptor.clone();
+            let asset_root = asset_root.clone();
+            tokio::spawn(async move {
+                let Ok(mut stream) = acceptor.accept(stream).await else {
+                    return;
+                };
+                let _ = serve_https_request(&mut stream, &asset_root).await;
+            });
+        }
+    }))
+}
+
+fn web_client_dist() -> Option<PathBuf> {
+    [
+        PathBuf::from("web-client/dist"),
+        PathBuf::from("example/web-client/dist"),
+    ]
+    .into_iter()
+    .find(|path| path.join("index.html").is_file())
+}
+
+async fn serve_https_request<S>(stream: &mut S, asset_root: &Option<PathBuf>) -> io::Result<()>
+where
+    S: AsyncRead + AsyncWrite + Unpin,
+{
+    let mut request = [0; 16 * 1024];
+    let size = stream.read(&mut request).await?;
+    let request = std::str::from_utf8(&request[..size]).unwrap_or_default();
+    let path = request
+        .lines()
+        .next()
+        .and_then(|line| line.split_whitespace().nth(1))
+        .unwrap_or("/")
+        .split('?')
+        .next()
+        .unwrap_or("/");
+    let (status, content_type, body) = match asset_root {
+        Some(asset_root) => {
+            let relative = path.trim_start_matches('/');
+            let candidate = asset_root.join(relative);
+            let file = if relative.is_empty() || !candidate.is_file() || relative.contains("..") {
+                asset_root.join("index.html")
+            } else {
+                candidate
+            };
+            let content_type = content_type(&file);
+            match tokio::fs::read(&file).await {
+                Ok(body) => ("200 OK", content_type, body),
+                Err(_) => ("404 Not Found", "text/plain; charset=utf-8", b"Not found".to_vec()),
+            }
+        }
+        None => (
+            "503 Service Unavailable",
+            "text/html; charset=utf-8",
+            b"<!doctype html><title>MTP web client not built</title><p>Run <code>pnpm --dir example/web-client build</code>.</p>".to_vec(),
+        ),
+    };
+
+    let response = format!(
+        "HTTP/1.1 {status}\r\nContent-Type: {content_type}\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
+        body.len()
+    );
+    stream.write_all(response.as_bytes()).await?;
+    stream.write_all(&body).await?;
+    stream.shutdown().await
+}
+
+fn content_type(file: &Path) -> &'static str {
+    match file.extension().and_then(|extension| extension.to_str()) {
+        Some("html") => "text/html; charset=utf-8",
+        Some("js") => "text/javascript; charset=utf-8",
+        Some("css") => "text/css; charset=utf-8",
+        Some("wasm") => "application/wasm",
+        Some("svg") => "image/svg+xml",
+        Some("json") => "application/json",
+        _ => "application/octet-stream",
+    }
+}