feat: optional TLS for P2P connections (#1420)

config/src/comments.rs

@@ -324,6 +324,24 @@ fn comments() -> HashMap<String, String> {
 # A preferred dandelion_peer, mainly used for testing dandelion
 # dandelion_peer = \"10.0.0.1:13144\"
 
+# Encrypt P2P connections with TLS (privacy against passive observers).
+# Both peers must enable TLS to connect. Certificates are self-signed by default
+# (authentication is not the goal — encryption for privacy is). Default: false.
+# When enabled, this node advertises the TLS capability so others can discover it.
+#tls_enabled = false
+
+# Only connect outbound to peers known to advertise the TLS capability
+# (and request TLS-capable peers in peer-list queries). Requires tls_enabled.
+# Seeds, preferred, and allow-listed addresses are still tried for bootstrap.
+# Default: false.
+#tls_required = false
+
+# Optional PEM certificate / private key for P2P TLS.
+# If omitted while tls_enabled = true, a self-signed cert is auto-generated
+# under the node data directory (p2p_tls/).
+#tls_certificate_file = \"/path/to/p2p.crt\"
+#tls_certificate_key = \"/path/to/p2p.key\"
+
 #########################################
 ### MEMPOOL CONFIGURATION             ###
 #########################################

p2p/Cargo.toml

@@ -21,6 +21,9 @@ tempfile = "3.1"
 log = "0.4"
 chrono = { version = "0.4.11", features = ["serde"] }
 bytes = "0.5"
+rustls = { version = "0.23.41", default-features = false, features = ["logging", "ring", "std", "tls12"] }
+rustls-pemfile = "1.0"
+rcgen = "0.13"
 
 grin_core = { path = "../core", version = "5.5.1-alpha.0" }
 grin_store = { path = "../store", version = "5.5.1-alpha.0" }

p2p/src/codec.rs

@@ -28,12 +28,12 @@ use crate::{
 	core::core::block::{BlockHeader, UntrustedBlockHeader},
 	msg::HeadersData,
 };
+use crate::stream::Stream;
 use bytes::{Buf, BufMut, Bytes, BytesMut};
 use core::ser::Reader;
 use std::cmp::min;
 use std::io::Read;
 use std::mem;
-use std::net::TcpStream;
 use std::sync::Arc;
 use std::time::{Duration, Instant};
 use MsgHeaderWrapper::*;
@@ -65,14 +65,14 @@ impl State {
 
 pub struct Codec {
 	pub version: ProtocolVersion,
-	stream: TcpStream,
+	stream: Stream,
 	buffer: BytesMut,
 	state: State,
 	bytes_read: usize,
 }
 
 impl Codec {
-	pub fn new(version: ProtocolVersion, stream: TcpStream) -> Self {
+	pub fn new(version: ProtocolVersion, stream: Stream) -> Self {
 		Self {
 			version,
 			stream,
@@ -82,8 +82,8 @@ impl Codec {
 		}
 	}
 
-	/// Destroy the codec and return the reader
-	pub fn stream(self) -> TcpStream {
+	/// Destroy the codec and return the underlying stream
+	pub fn stream(self) -> Stream {
 		self.stream
 	}
 

p2p/src/conn.rs

@@ -23,11 +23,12 @@
 use crate::codec::{Codec, BODY_IO_TIMEOUT};
 use crate::core::ser::ProtocolVersion;
 use crate::msg::{write_message, Consumed, Message, Msg};
+use crate::stream::Stream;
 use crate::types::Error;
 use crate::util::{RateCounter, RwLock};
 use std::fs::File;
 use std::io::{self, Write};
-use std::net::{Shutdown, TcpStream};
+use std::net::Shutdown;
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::mpsc::RecvTimeoutError;
 use std::sync::{mpsc, Arc};
@@ -172,7 +173,7 @@ impl Tracker {
 /// the current thread, instead just returns a future and the Connection
 /// itself.
 pub fn listen<H>(
-	stream: TcpStream,
+	stream: Stream,
 	version: ProtocolVersion,
 	tracker: Arc<Tracker>,
 	handler: H,
@@ -209,7 +210,7 @@ where
 }
 
 fn poll<H>(
-	conn: TcpStream,
+	conn: Stream,
 	conn_handle: ConnHandle,
 	version: ProtocolVersion,
 	handler: H,
@@ -220,7 +221,8 @@ fn poll<H>(
 where
 	H: MessageHandler,
 {
-	// Split out tcp stream out into separate reader/writer halves.
+	// Split out stream into separate reader/writer halves.
+	// Plain TCP uses OS-level clone; TLS shares a mutex-backed session.
 	let reader = conn.try_clone().expect("clone conn for reader failed");
 	let mut writer = conn.try_clone().expect("clone conn for writer failed");
 	let reader_stopped = stopped.clone();

p2p/src/handshake.rs

@@ -18,13 +18,14 @@ use crate::core::pow::Difficulty;
 use crate::core::ser::ProtocolVersion;
 use crate::msg::{read_message, user_agent, write_message, Hand, Msg, Shake, Type};
 use crate::peer::Peer;
+use crate::stream::Stream;
 use crate::types::{
 	Capabilities, Direction, Error, NetAdapter, P2PConfig, PeerAddr, PeerInfo, PeerLiveInfo,
 };
 use crate::util::RwLock;
 use rand::{thread_rng, Rng};
 use std::collections::VecDeque;
-use std::net::{SocketAddr, TcpStream};
+use std::net::SocketAddr;
 use std::sync::Arc;
 use std::time::Duration;
 
@@ -99,7 +100,7 @@ impl Handshake {
 		capabilities: Capabilities,
 		total_difficulty: Difficulty,
 		self_addr: PeerAddr,
-		conn: &mut TcpStream,
+		conn: &mut Stream,
 	) -> Result<PeerInfo, Error> {
 		// Set explicit timeouts on the tcp stream for hand/shake messages.
 		// Once the peer is up and running we will set new values for these.
@@ -170,7 +171,7 @@ impl Handshake {
 		&self,
 		capab: Capabilities,
 		total_difficulty: Difficulty,
-		conn: &mut TcpStream,
+		conn: &mut Stream,
 		adapter: &Arc<dyn NetAdapter>,
 	) -> Result<PeerInfo, Error> {
 		// Set explicit timeouts on the tcp stream for hand/shake messages.
@@ -258,7 +259,7 @@ impl Handshake {
 }
 
 /// Resolve the correct peer_addr based on the connection and the advertised port.
-fn resolve_peer_addr(advertised: PeerAddr, conn: &TcpStream) -> PeerAddr {
+fn resolve_peer_addr(advertised: PeerAddr, conn: &Stream) -> PeerAddr {
 	let port = advertised.0.port();
 	if let Ok(addr) = conn.peer_addr() {
 		PeerAddr(SocketAddr::new(addr.ip(), port))

p2p/src/lib.rs

@@ -45,6 +45,7 @@ mod peers;
 mod protocol;
 mod serv;
 pub mod store;
+mod stream;
 pub mod types;
 
 pub use crate::conn::SEND_CHANNEL_CAP;

p2p/src/peer.rs

@@ -16,7 +16,7 @@ use crate::util::{Mutex, RwLock};
 use lru_cache::LruCache;
 use std::fmt;
 use std::fs::File;
-use std::net::{Shutdown, TcpStream};
+use std::net::Shutdown;
 use std::path::PathBuf;
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::Arc;
@@ -34,6 +34,7 @@ use crate::msg::{
 	self, BanReason, GetPeerAddrs, Locator, Msg, Ping, SegmentRequest, TxHashSetRequest, Type,
 };
 use crate::protocol::Protocol;
+use crate::stream::Stream;
 use crate::types::{
 	Capabilities, ChainAdapter, Error, HeaderSegmentAcceptance, NetAdapter, P2PConfig, PeerAddr,
 	PeerInfo, ReasonForBan, TxHashSetRead,
@@ -76,7 +77,7 @@ impl fmt::Debug for Peer {
 
 impl Peer {
 	// Only accept and connect can be externally used to build a peer
-	fn new(info: PeerInfo, conn: TcpStream, adapter: Arc<dyn NetAdapter>) -> std::io::Result<Peer> {
+	fn new(info: PeerInfo, conn: Stream, adapter: Arc<dyn NetAdapter>) -> std::io::Result<Peer> {
 		let state = Arc::new(RwLock::new(State::Connected));
 		let state_sync_requested = Arc::new(AtomicBool::new(false));
 		let tracking_adapter = TrackingAdapter::new(adapter);
@@ -101,7 +102,7 @@ impl Peer {
 	}
 
 	pub fn accept(
-		mut conn: TcpStream,
+		mut conn: Stream,
 		capab: Capabilities,
 		total_difficulty: Difficulty,
 		hs: &Handshake,
@@ -126,7 +127,7 @@ impl Peer {
 	}
 
 	pub fn connect(
-		mut conn: TcpStream,
+		mut conn: Stream,
 		capab: Capabilities,
 		total_difficulty: Difficulty,
 		self_addr: PeerAddr,