laantungir/fips
1
0
Fork 0
mirror of https://github.com/jmcorgan/fips.git synced 2026-07-30 19:46:15 +00:00
Code Issues Packages Projects Releases Wiki Activity
763 Commits 5 Branches 10 Tags
master
Commit Graph
113 Commits
Author SHA1 Message Date
Johnathan Corgan 58be9e2e59 Separate protocol layers: link vs session message types 
Refactor protocol.rs to cleanly separate two protocol layers:

Link layer (hop-by-hop, peer-to-peer):
- LinkMessageType: TreeAnnounce, FilterAnnounce, LookupRequest,
  LookupResponse, SessionDatagram
- New SessionDatagram struct for encapsulating session payloads

Session layer (end-to-end):
- SessionMessageType: SessionSetup, SessionAck, DataPacket,
  CoordsRequired, PathBroken

Also:
- Remove obsolete Hello/Challenge/Auth/AuthAck types (replaced by Noise IK)
- Update all design docs for consistency with two-layer architecture
- Add "Link vs Session Encryption" documentation

All 219 tests pass.
 2026-02-01 03:19:54 +00:00
Johnathan Corgan a5a62b3768 Session 43: CLI config option and state machine design 
Add command-line argument parsing with clap:
- -c/--config option to specify config file path
- Overrides default search path when provided
- Proper error handling for missing/invalid files

Improve logging:
- Peer connection log now uses separate log entries per field
- Better readability with aligned timestamps

Fix ICMPv6 error handling:
- Add multicast destination filter to should_send_icmp_error()
- Router Solicitation packets (ff02::2) now silently dropped
- Add test case for multicast destination

Add phase-based state machine design document:
- Document pattern where lifecycle phases use distinct structs in enum
- PeerSlot::Connecting(PeerConnection) -> PeerSlot::Active(ActivePeer)
- Benefits: type safety, memory efficiency, security
- Describes timeout handling and lookup table requirements
 2026-01-31 23:33:02 +00:00
Johnathan Corgan 738775258a Session 41: Peer authentication protocol design 
Design 3-message peer auth handshake (AuthInit → AuthChallenge → AuthComplete):
- Deterministic crossing connection handling via npub ordering
- Domain-separated signatures (fips-peer-auth-v1)
- New message types: 0x09 AuthInit, 0x0a AuthChallenge, 0x0b AuthComplete

fips-design.md:
- Replace 4-message auth with 3-message design
- Add crossing connection handling rules
- Add message structures and signature construction

fips-architecture.md:
- Expand peer lifecycle state machine with auth states
- Add Node Startup Sequence section
- Add Static Peer Retry Policy (exponential backoff, jitter)
- Add Inbound Connection Acceptance section
- Update peer config for static-only initial impl

fips-protocol-flow.md:
- Add §7 Peer Connection Establishment
- Add §7.2 Post-Authentication flow

Design decisions: static peers only, always do peer auth regardless of
transport, accept all authenticated inbound connections.
 2026-01-31 19:13:15 +00:00
Johnathan Corgan b54c347e76 Session 40: Reconcile design docs with protocol flow decisions 
Align terminology and cross-references across all FIPS design documents
based on decisions made in fips-protocol-flow.md (Session 39).

Key changes:
- Distinguish "Routing Session" (hop-by-hop cache) from "Crypto Session"
  (end-to-end Noise KK encryption) throughout all docs
- Add handshake_payload field to SessionSetup/SessionAck for combined
  establishment of routing and crypto sessions
- Update fips-design.md encryption section to reference Noise KK
- Add SessionSetup (0x06), SessionAck (0x07), CoordsRequired (0x08)
  message types
- Add Crypto Session Management config section to fips-architecture.md
- Add cross-references to fips-protocol-flow.md in all design docs
- Update reconciliation tracking in protocol-flow.md §7
 2026-01-31 18:28:14 +00:00
Johnathan Corgan 5d190885ec Session 39: Protocol traffic flow design document 
Add comprehensive design doc for FIPS protocol message flow covering:

- DNS-based identity cache priming (npub.fips format)
- TUN reader processing pipeline
- Crypto session (Noise KK with secp256k1) vs routing session distinction
- Combined establishment model (routing + crypto in single round-trip)
- Noise KK pattern with ChaCha20-Poly1305, AEAD-only authentication
- Route discovery via bloom filters and LookupRequest flooding
- Crossing hellos handling with deterministic tie-breaker (lower npub wins)

Includes reconciliation section tracking alignment with existing design docs
(fips-routing.md terminology updates pending).
 2026-01-31 18:09:38 +00:00
Johnathan Corgan ca24ba02b7 Add TUN driver design document 
- docs/design/fips-tun-driver.md: comprehensive TUN interface documentation
- Architecture diagrams, component descriptions, packet flow
- Implementation status checklist (completed vs planned)
- Testing instructions and configuration reference
 2026-01-30 05:38:58 +00:00
Johnathan Corgan 185fe50570 Restructure config to match sysctl-style paths 
- Add NodeConfig wrapper: node.identity.nsec, node.leaf_only
- YAML structure mirrors architecture documentation exactly
- Move main.rs to src/bin/fips.rs (empty binary placeholder)
- Add "Connection Model" section to fips-transports.md documenting
  connectionless vs connection-oriented transport categories
- Fix clippy warnings (dead_code, clone_on_copy, assertions_on_constants)
 2026-01-29 19:49:37 +00:00
Johnathan Corgan 3b6a4da17d Complete FIPS architecture review cleanup 
- Rename fips-links.md to fips-transports.md, update all references
- Update README with all 6 design documents in organized sections
- Reorganize architecture review: remove verbose resolved items, consolidate
  deferred items, focus on actionable issues
- Clarify Transport/Link/Peer lifecycle in architecture doc:
  - Transports static after startup
  - Links on-demand, driven by peer lifecycle
  - Connectionless transports (UDP) immediate established
  - Connection-oriented (Tor) require link setup before auth
- Add Resource Limits configuration section (max_peers, max_transports,
  max_pending_auth, max_pending_lookups, memory_budget)
- Close timer management as non-issue (tokio handles scale)
- Defer init/shutdown to future iteration

Review status: 6 resolved, 5 deferred, 4 low-priority open
 2026-01-29 18:17:07 +00:00
Johnathan Corgan fc20c47119 Resolve architecture review items and reconcile terminology 
- Standardize coordinate ordering to [self, parent, ..., root] across all docs
- Fix 8 coordinate ordering instances in spanning-tree-dynamics.md
- Clarify cache naming: discovery.cache and session.cache configure Node.coord_cache
- Reconcile Transport vs Link terminology:
  - Transport = interface/medium (UDP socket, Ethernet NIC)
  - Link = connection instance to a specific peer
- Update fips-design.md: replace FipsLink trait with architecture reference
- Rename fips-links.md to "Transport Protocols", add terminology section
- Update review doc: mark items 1, 5, 13 RESOLVED; items 2-4, 7 DEFERRED
 2026-01-29 17:00:33 +00:00
Johnathan Corgan c2ba0e3fcb Add FIPS software architecture document 
Create comprehensive architecture document covering:
- Core entities: Node, Transport, Link, Peer hierarchy
- Transport vs Link distinction (interface vs connection)
- State machines for Transport, Link, and Peer lifecycles
- Reference transport types: UDP/IP, Ethernet, WiFi, Tor
- Spanning tree and Bloom filter state requirements
- Self-healing protocol design (no ack/retry needed)
- Leaf-only operation for constrained devices
- Comprehensive sysctl-style configuration reference

Also add architecture review document capturing identified
issues to resolve before implementation begins.
 2026-01-29 16:36:46 +00:00
Johnathan Corgan dc0acf32ea Add FIPS routing design document 
Create fips-routing.md covering the complete routing architecture:
- Bloom filter design: 4KB filters, K=2 scope, event-driven updates
- Discovery protocol: LookupRequest/Response with signed proofs
- Greedy tree routing using coordinates from discovery
- Session establishment model for minimal data packet overhead
- Router coordinate caching with LRU eviction

Key design decisions:
- Leaf-only mode for constrained devices (single peer handles routing)
- Separation of discovery (find destination) from routing (deliver packets)
- Session setup pays coordinate cost once; data packets carry only addresses
- 36-byte data packet header comparable to IPv6

Update design docs README to include new document.
 2026-01-26 00:12:47 +00:00
Johnathan Corgan d8cba510a7 Add FIPS link protocol design document 
New docs/design/fips-links.md covering:
- Link terminology (L2/L2-equivalent, not "transport")
- Link categories: overlay, shared medium, point-to-point
- Characteristics table: encapsulation, addressing, MTU, latency,
  reliability, bandwidth, discovery
- TCP-over-TCP problem and UDP preference rationale
- NAT/firewall traversal requirements
- IPv6 interface exposure to applications

Update README.md with new document entry.
 2026-01-25 22:52:37 +00:00
Johnathan Corgan 7194200f55 Add docs/design directory with protocol specifications 
Move design documents from working directory into source tree:
- fips-design.md - Full protocol design specification
- spanning-tree-dynamics.md - Spanning tree protocol dynamics study

Add README index files for docs/ and docs/design/.
 2026-01-25 22:02:54 +00:00