laantungir/fips - fips - Gitea on NOSTR

615 Commits 6 Branches 10 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
Johnathan Corgan	567e6a535e	identity: reuse one shared secp256k1 context Every sign/verify/key-derive site built a fresh context via Secp256k1::new(), which allocates a Secp256k1<All> and runs randomization/blinding table setup on each call. Introduce one crate-wide LazyLock<Secp256k1<All>> and reuse it across the local, peer, and auth sites (and their tests). Behavior-neutral: identical secp256k1 API calls, only the context lifetime changes, and the shared All context still performs the standard construction-time blinding.	2026-07-12 16:33:53 +00:00
Johnathan Corgan	58664c7c77	Update dependencies: rand 0.10, rtnetlink 0.20, tun 0.8, and others Bump rand (0.8→0.10), rtnetlink (0.14→0.20), tun (0.7→0.8), simple-dns (0.9→0.11), socket2 (0.5→0.6), and criterion (0.5→0.8). Migrate all rand call sites: thread_rng()→rng(), gen()→random(), gen_range()→random_range(), RngCore→Rng trait. Work around secp256k1 0.30 requiring rand 0.8 by generating random bytes directly and constructing SecretKey from slice. Migrate rtnetlink to builder-based API: LinkSetRequest replaced with LinkUnspec builder + change(), RouteAddRequest replaced with RouteMessageBuilder. Remove bloom benchmark (criterion 0.8 incompatible with old harness config).	2026-02-24 18:02:06 +00:00
Johnathan Corgan	d71e48b0f2	Module reorganization, identity test coverage, design doc corrections Module reorganization: - Split identity.rs (930 lines) into identity/ directory module: mod.rs, node_addr.rs, address.rs, peer.rs, local.rs, auth.rs, encoding.rs, tests.rs — following established bloom/, tree/, noise/ pattern - Group TUN, DNS, and ICMPv6 into upper/ module as the IPv6 adaptation layer: move tun.rs, icmp.rs, node/dns.rs into upper/ Identity test coverage (28 new tests, 52 total): - Encoding error paths: invalid npub/nsec length, bad hex input - NodeAddr: Debug, Display, as_slice, AsRef, Hash - FipsAddress: from_slice, From trait, Debug, Display, Eq+Hash - PeerIdentity: from_pubkey_full, pubkey_full parity paths, Debug - Identity: keypair, pubkey_full, Debug - AuthChallenge: from_bytes Design doc corrections (fips-software-architecture.md): - Identity struct: npub+nsec fields → keypair: Keypair with accessors - Node struct: TunInterface → TunState, Transport → TransportHandle, Peer → PeerSlot - Peer section: monolithic Peer → two-phase PeerSlot (PeerConnection + ActivePeer) with HandshakeState/ConnectivityState - ActivePeer: npub → identity: PeerIdentity, ancestry Vec → Option, declaration/inbound_filter wrapped in Option - BloomState: add 4 missing fields, fix update_debounce type - DiscoveredPeer: field name and type corrections	2026-02-15 17:11:58 +00:00

Author

SHA1

Message

Date

Johnathan Corgan

567e6a535e

identity: reuse one shared secp256k1 context

Every sign/verify/key-derive site built a fresh context via
Secp256k1::new(), which allocates a Secp256k1<All> and runs
randomization/blinding table setup on each call. Introduce one
crate-wide LazyLock<Secp256k1<All>> and reuse it across the local, peer,
and auth sites (and their tests). Behavior-neutral: identical secp256k1
API calls, only the context lifetime changes, and the shared All context
still performs the standard construction-time blinding.

2026-07-12 16:33:53 +00:00

Johnathan Corgan

58664c7c77

Update dependencies: rand 0.10, rtnetlink 0.20, tun 0.8, and others

Bump rand (0.8→0.10), rtnetlink (0.14→0.20), tun (0.7→0.8),
simple-dns (0.9→0.11), socket2 (0.5→0.6), and criterion (0.5→0.8).

Migrate all rand call sites: thread_rng()→rng(), gen()→random(),
gen_range()→random_range(), RngCore→Rng trait. Work around secp256k1
0.30 requiring rand 0.8 by generating random bytes directly and
constructing SecretKey from slice.

Migrate rtnetlink to builder-based API: LinkSetRequest replaced with
LinkUnspec builder + change(), RouteAddRequest replaced with
RouteMessageBuilder.

Remove bloom benchmark (criterion 0.8 incompatible with old harness
config).

2026-02-24 18:02:06 +00:00

Johnathan Corgan

d71e48b0f2

Module reorganization, identity test coverage, design doc corrections

Module reorganization:

- Split identity.rs (930 lines) into identity/ directory module:
  mod.rs, node_addr.rs, address.rs, peer.rs, local.rs, auth.rs,
  encoding.rs, tests.rs — following established bloom/, tree/, noise/
  pattern

- Group TUN, DNS, and ICMPv6 into upper/ module as the IPv6 adaptation
  layer: move tun.rs, icmp.rs, node/dns.rs into upper/

Identity test coverage (28 new tests, 52 total):

- Encoding error paths: invalid npub/nsec length, bad hex input
- NodeAddr: Debug, Display, as_slice, AsRef, Hash
- FipsAddress: from_slice, From trait, Debug, Display, Eq+Hash
- PeerIdentity: from_pubkey_full, pubkey_full parity paths, Debug
- Identity: keypair, pubkey_full, Debug
- AuthChallenge: from_bytes

Design doc corrections (fips-software-architecture.md):

- Identity struct: npub+nsec fields → keypair: Keypair with accessors
- Node struct: TunInterface → TunState, Transport → TransportHandle,
  Peer → PeerSlot
- Peer section: monolithic Peer → two-phase PeerSlot (PeerConnection +
  ActivePeer) with HandshakeState/ConnectivityState
- ActivePeer: npub → identity: PeerIdentity, ancestry Vec → Option,
  declaration/inbound_filter wrapped in Option
- BloomState: add 4 missing fields, fix update_debounce type
- DiscoveredPeer: field name and type corrections

2026-02-15 17:11:58 +00:00