diff --git a/CHANGELOG.md b/CHANGELOG.md index b824606..5f4f947 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,7 +5,7 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). -## [Unreleased] +## [0.2.1] - 2026-05-11 ### Added diff --git a/Cargo.lock b/Cargo.lock index 3669c62..4912318 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -783,7 +783,7 @@ checksum = "9844ddc3a6e533d62bba727eb6c28b5d360921d5175e9ff0f1e621a5c590a4d5" [[package]] name = "fips" -version = "0.2.1-dev" +version = "0.2.1" dependencies = [ "bech32", "chacha20poly1305", diff --git a/Cargo.toml b/Cargo.toml index 0109f9e..eb53a5b 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "fips" -version = "0.2.1-dev" +version = "0.2.1" edition = "2024" description = "A distributed, decentralized network routing protocol for mesh nodes connecting over arbitrary transports" license = "MIT" diff --git a/README.md b/README.md index c93c135..a274607 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ ![banner](docs/logos/fips_banner.png) [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE) [![Rust](https://img.shields.io/badge/rust-1.85%2B-orange.svg)](https://www.rust-lang.org/) -[![Status](https://img.shields.io/badge/status-v0.2.0-green.svg)](#status--roadmap) +[![Status](https://img.shields.io/badge/status-v0.2.1-green.svg)](#status--roadmap) A distributed, decentralized network routing protocol for mesh nodes connecting over arbitrary transports. @@ -239,7 +239,7 @@ testing/ Docker-based integration test harnesses ## Status & Roadmap -FIPS is at **v0.2.0**. The core protocol works end-to-end over UDP, TCP, +FIPS is at **v0.2.1**. The core protocol works end-to-end over UDP, TCP, Ethernet, and Tor with a small live mesh of deployed nodes. ### What works today diff --git a/RELEASE-NOTES.md b/RELEASE-NOTES.md new file mode 100644 index 0000000..b267816 --- /dev/null +++ b/RELEASE-NOTES.md @@ -0,0 +1,141 @@ +# FIPS v0.2.1 + +**Released**: 2026-05-11 + +v0.2.1 is a maintenance release on the v0.2.x line. No new features +and no wire-format changes; operators running v0.2.0 can upgrade in +place. The release rolls up bug fixes and operational hardening for +issues surfaced in v0.2.0 deployments, plus a bloom-filter fill-ratio +validation that protects mesh-size estimates from saturated-filter +inputs. + +## At a glance + +- 22 commits since v0.2.0, 5 committers plus 2 issue reporters. +- All changes are backwards-compatible with v0.2.0 on the wire. +- Bloom filter fill-ratio validation hardens the FilterAnnounce + ingress path. +- TreeAnnounce ancestry validation tightened to match the + spanning-tree specification. +- Signed-tarball + `.deb` artifact workflow added for tagged + releases; AUR auto-publish on stable tags. + +## Behavior changes worth flagging + +- **Bloom filter fill-ratio validation** runs on every inbound + `FilterAnnounce`. Filters whose derived false-positive rate exceeds + `node.bloom.max_inbound_fpr` (new config field, default `0.05`) are + rejected silently on the wire, logged at WARN, and counted in a + new `bloom.fill_exceeded` counter. A rate-limited WARN also fires + when the local outgoing filter exceeds the cap. + `BloomFilter::estimated_count` now takes `max_fpr` and returns + `Option`, returning `None` for saturated filters; this + propagates through `compute_mesh_size` into `estimated_mesh_size`. +- **TreeAnnounce ancestry validation** is now run before tree-state + mutation, enforcing ancestry-self-match, root-single-entry, + parent-second-entry, and root-is-minimum-NodeAddr. Non-conforming + announces are rejected with a WARN. Mixed v0.2.0 / v0.2.1 meshes + may produce WARN log lines on the v0.2.1 side until all peers + upgrade; behavior is correct, log noise only. + +## Notable bug fixes + +- **Control socket path detection** in `fipsctl` and `fipstop` now + checks for the `/run/fips/` directory instead of the socket file + inside it. Users not yet in the `fips` group get a clear + "Permission denied" error instead of a misleading "No such file" + fallback to `$XDG_RUNTIME_DIR` + ([#30](https://github.com/jmcorgan/fips/issues/30), reported by + [@Sebastix](https://github.com/Sebastix)). +- **`fd00::/8` routing protected from Tailscale interception.** The + daemon installs an IPv6 routing-policy rule + (`ip -6 rule to fd00::/8 lookup main priority 5265`) at TUN setup, + so Tailscale's table 52 default route can no longer divert mesh + traffic. +- **Bloom filter routing greedy-tree fallback.** `find_next_hop` no + longer returns `NoRoute` when the bloom candidate set is non-empty + but no candidate is strictly closer than the current node; it + falls through to greedy tree routing instead. Previously, this + caused dropped packets in topologies where the tree parent was + closer but not a bloom candidate. +- **Auto-connect peers reconnect after a graceful Disconnect.** + Previously, a clean upstream shutdown left the auto-connect peer + orphaned; only the link-dead, decrypt-fail, and peer-restart paths + scheduled a reconnect + ([#60](https://github.com/jmcorgan/fips/issues/60), reported by + [@SwapMarket](https://github.com/SwapMarket)). +- **`fipsctl connect` rejects FIPS mesh addresses** (`fd00::/8`) for + `udp`, `tcp`, and `ethernet` transports with a clear error message + instead of echoing success while the daemon silently failed the + bind with `EAFNOSUPPORT` + ([#61](https://github.com/jmcorgan/fips/issues/61), reported by + [@SwapMarket](https://github.com/SwapMarket)). +- **OpenWrt ipk** cross-compiles cleanly again after excluding the + BLE feature that requires D-Bus, which is unavailable on OpenWrt + targets. + +## Packaging + +- **Linux release artifact workflow** builds x86_64 and aarch64 + tarballs and `.deb` packages on `v*` tag push, with SHA-256 + checksums, and publishes them to the GitHub release page. +- **AUR publish workflow** auto-publishes the `fips` PKGBUILD on + stable `v*` tags. + +## Upgrade notes + +Operator-actionable items when moving from v0.2.0 to v0.2.1: + +- **Bloom filter fill-ratio cap (default 0.05).** Inbound + `FilterAnnounce` messages whose derived FPR exceeds the cap are + rejected silently on the wire. Operators with unusually saturated + filters in the field may want to confirm that the default applies + cleanly to their deployment; check the new `bloom.fill_exceeded` + counter if mesh-size estimates drift after upgrade. +- **TreeAnnounce ancestry tightening.** Mixed v0.2.0 / v0.2.1 meshes + may produce WARN log lines on the v0.2.1 side until all peers + upgrade. Behavior is correct, log noise only. + +## Getting v0.2.1 + +- **Linux x86_64 / aarch64**: `.deb` and tarball at the + [v0.2.1 release page](https://github.com/jmcorgan/fips/releases/tag/v0.2.1). +- **Arch Linux**: `fips` from the AUR. +- **OpenWrt**: `.ipk` at the v0.2.1 release page. +- **From source**: `cargo build --release` from a checkout of the + v0.2.1 tag. + +The full per-commit changelog lives in +[`CHANGELOG.md`](../../CHANGELOG.md). Issues and discussion at +[github.com/jmcorgan/fips](https://github.com/jmcorgan/fips). + +## Contributors + +Thanks to everyone who contributed code or bug reports to this +release. + +**Code and packaging**: + +- [@jcorgan](https://github.com/jmcorgan): release shepherd, bloom + fill-ratio validation, auto-connect reconnect fix, `fipsctl` + mesh-address rejection, control-socket path detection, + Tailscale-vs-`fd00::/8` routing policy, bloom routing greedy + fallback, rustfmt baseline. +- [@Origami74](https://github.com/Origami74): OpenWrt ipk + BLE-feature build fix. +- [@jodobear](https://github.com/jodobear): Linux release-artifact + workflow and target-aware build scripts. +- [@dskvr](https://github.com/dskvr): AUR publish workflow. +- [@SatsAndSports](https://github.com/SatsAndSports): TreeAnnounce + semantic validation. + +**Issue reports that drove fixes in this release**: + +- [@Sebastix](https://github.com/Sebastix): `fipsctl` / `fipstop` + control-socket path detection + ([#30](https://github.com/jmcorgan/fips/issues/30)). +- [@SwapMarket](https://github.com/SwapMarket): auto-connect + reconnect after graceful disconnect + ([#60](https://github.com/jmcorgan/fips/issues/60)) and + `fipsctl` mesh-address rejection + ([#61](https://github.com/jmcorgan/fips/issues/61)). diff --git a/docs/releases/release-notes-v0.2.1.md b/docs/releases/release-notes-v0.2.1.md new file mode 100644 index 0000000..b267816 --- /dev/null +++ b/docs/releases/release-notes-v0.2.1.md @@ -0,0 +1,141 @@ +# FIPS v0.2.1 + +**Released**: 2026-05-11 + +v0.2.1 is a maintenance release on the v0.2.x line. No new features +and no wire-format changes; operators running v0.2.0 can upgrade in +place. The release rolls up bug fixes and operational hardening for +issues surfaced in v0.2.0 deployments, plus a bloom-filter fill-ratio +validation that protects mesh-size estimates from saturated-filter +inputs. + +## At a glance + +- 22 commits since v0.2.0, 5 committers plus 2 issue reporters. +- All changes are backwards-compatible with v0.2.0 on the wire. +- Bloom filter fill-ratio validation hardens the FilterAnnounce + ingress path. +- TreeAnnounce ancestry validation tightened to match the + spanning-tree specification. +- Signed-tarball + `.deb` artifact workflow added for tagged + releases; AUR auto-publish on stable tags. + +## Behavior changes worth flagging + +- **Bloom filter fill-ratio validation** runs on every inbound + `FilterAnnounce`. Filters whose derived false-positive rate exceeds + `node.bloom.max_inbound_fpr` (new config field, default `0.05`) are + rejected silently on the wire, logged at WARN, and counted in a + new `bloom.fill_exceeded` counter. A rate-limited WARN also fires + when the local outgoing filter exceeds the cap. + `BloomFilter::estimated_count` now takes `max_fpr` and returns + `Option`, returning `None` for saturated filters; this + propagates through `compute_mesh_size` into `estimated_mesh_size`. +- **TreeAnnounce ancestry validation** is now run before tree-state + mutation, enforcing ancestry-self-match, root-single-entry, + parent-second-entry, and root-is-minimum-NodeAddr. Non-conforming + announces are rejected with a WARN. Mixed v0.2.0 / v0.2.1 meshes + may produce WARN log lines on the v0.2.1 side until all peers + upgrade; behavior is correct, log noise only. + +## Notable bug fixes + +- **Control socket path detection** in `fipsctl` and `fipstop` now + checks for the `/run/fips/` directory instead of the socket file + inside it. Users not yet in the `fips` group get a clear + "Permission denied" error instead of a misleading "No such file" + fallback to `$XDG_RUNTIME_DIR` + ([#30](https://github.com/jmcorgan/fips/issues/30), reported by + [@Sebastix](https://github.com/Sebastix)). +- **`fd00::/8` routing protected from Tailscale interception.** The + daemon installs an IPv6 routing-policy rule + (`ip -6 rule to fd00::/8 lookup main priority 5265`) at TUN setup, + so Tailscale's table 52 default route can no longer divert mesh + traffic. +- **Bloom filter routing greedy-tree fallback.** `find_next_hop` no + longer returns `NoRoute` when the bloom candidate set is non-empty + but no candidate is strictly closer than the current node; it + falls through to greedy tree routing instead. Previously, this + caused dropped packets in topologies where the tree parent was + closer but not a bloom candidate. +- **Auto-connect peers reconnect after a graceful Disconnect.** + Previously, a clean upstream shutdown left the auto-connect peer + orphaned; only the link-dead, decrypt-fail, and peer-restart paths + scheduled a reconnect + ([#60](https://github.com/jmcorgan/fips/issues/60), reported by + [@SwapMarket](https://github.com/SwapMarket)). +- **`fipsctl connect` rejects FIPS mesh addresses** (`fd00::/8`) for + `udp`, `tcp`, and `ethernet` transports with a clear error message + instead of echoing success while the daemon silently failed the + bind with `EAFNOSUPPORT` + ([#61](https://github.com/jmcorgan/fips/issues/61), reported by + [@SwapMarket](https://github.com/SwapMarket)). +- **OpenWrt ipk** cross-compiles cleanly again after excluding the + BLE feature that requires D-Bus, which is unavailable on OpenWrt + targets. + +## Packaging + +- **Linux release artifact workflow** builds x86_64 and aarch64 + tarballs and `.deb` packages on `v*` tag push, with SHA-256 + checksums, and publishes them to the GitHub release page. +- **AUR publish workflow** auto-publishes the `fips` PKGBUILD on + stable `v*` tags. + +## Upgrade notes + +Operator-actionable items when moving from v0.2.0 to v0.2.1: + +- **Bloom filter fill-ratio cap (default 0.05).** Inbound + `FilterAnnounce` messages whose derived FPR exceeds the cap are + rejected silently on the wire. Operators with unusually saturated + filters in the field may want to confirm that the default applies + cleanly to their deployment; check the new `bloom.fill_exceeded` + counter if mesh-size estimates drift after upgrade. +- **TreeAnnounce ancestry tightening.** Mixed v0.2.0 / v0.2.1 meshes + may produce WARN log lines on the v0.2.1 side until all peers + upgrade. Behavior is correct, log noise only. + +## Getting v0.2.1 + +- **Linux x86_64 / aarch64**: `.deb` and tarball at the + [v0.2.1 release page](https://github.com/jmcorgan/fips/releases/tag/v0.2.1). +- **Arch Linux**: `fips` from the AUR. +- **OpenWrt**: `.ipk` at the v0.2.1 release page. +- **From source**: `cargo build --release` from a checkout of the + v0.2.1 tag. + +The full per-commit changelog lives in +[`CHANGELOG.md`](../../CHANGELOG.md). Issues and discussion at +[github.com/jmcorgan/fips](https://github.com/jmcorgan/fips). + +## Contributors + +Thanks to everyone who contributed code or bug reports to this +release. + +**Code and packaging**: + +- [@jcorgan](https://github.com/jmcorgan): release shepherd, bloom + fill-ratio validation, auto-connect reconnect fix, `fipsctl` + mesh-address rejection, control-socket path detection, + Tailscale-vs-`fd00::/8` routing policy, bloom routing greedy + fallback, rustfmt baseline. +- [@Origami74](https://github.com/Origami74): OpenWrt ipk + BLE-feature build fix. +- [@jodobear](https://github.com/jodobear): Linux release-artifact + workflow and target-aware build scripts. +- [@dskvr](https://github.com/dskvr): AUR publish workflow. +- [@SatsAndSports](https://github.com/SatsAndSports): TreeAnnounce + semantic validation. + +**Issue reports that drove fixes in this release**: + +- [@Sebastix](https://github.com/Sebastix): `fipsctl` / `fipstop` + control-socket path detection + ([#30](https://github.com/jmcorgan/fips/issues/30)). +- [@SwapMarket](https://github.com/SwapMarket): auto-connect + reconnect after graceful disconnect + ([#60](https://github.com/jmcorgan/fips/issues/60)) and + `fipsctl` mesh-address rejection + ([#61](https://github.com/jmcorgan/fips/issues/61)).