4 Commits

Include renames

Author	SHA1	Message	Date
Johnathan Corgan	53ad528f7d	fipstop: add "Listening on fips0" panel to Node tab ... Surfaces local services reachable from the mesh, paired with their current `inet fips` baseline filter classification. Lands to the right of the existing TUN section in the Traffic block. A new daemon control query `show_listening_sockets` returns IPv6 listeners bound to either `::` (wildcard) or the node's fd00::/8 address, each classified as Accept / Drop / Unknown / NoFirewall against the running inbound chain. fipstop renders the result as a table beside the Traffic counters: Accept rows in default White, Drop / Unknown in DarkGray, a yellow banner above the table when `fips-firewall.service` is inactive, and a trailing `*` on wildcard binds to remind the operator the bind is not fips0-specific. Daemon side: - `src/control/listening.rs` walks `/proc/net/tcp6` and `/proc/net/udp6` via the procfs crate (LISTEN state for TCP, wildcard remote for UDP), filters to fips0-reachable binds, and resolves inodes to PID / comm via `/proc/<pid>/fd`. - `src/control/firewall_state.rs` shells out to `nft -j list table inet fips` and walks the inbound chain. Recognises canonical accepts (`tcp/udp dport N accept`, `dport { ... } accept`, `dport A-B accept`), the iifname-scoping line, conntrack and icmpv6 lines (skipped). Any rule with unrecognised matchers (saddr filters, jumps, daddr filters) or non-terminal verdicts forces Unknown classification for the ports it references. Eleven unit tests cover the classification logic; the listening enumerator carries a /proc-parsing test of its own. - `show_listening_sockets` emits `{fips0_addr, firewall_active, sockets[]}` with per-row `{proto, local_addr, port, pid, process, filter, wildcard_bind}`. fipstop side: - `src/bin/fipstop/ui/dashboard.rs` splits the Traffic block into a 50/50 horizontal layout; the existing TUN + Forwarded panel occupies the left half. - `src/bin/fipstop/ui/listening.rs` renders the right half. - `main.rs` fetches the new query each tick when the Node tab is active. Errors are non-fatal: an old daemon without the query leaves the payload at None and the panel renders "loading...". `Cargo.toml` gains `procfs = "0.18"` on the Linux target. IPv4 listeners are not enumerated — fips0 is IPv6-only. Folded in: revert the default-socket lookup from writability-probe back to existence-based selection. The previous tempfile-probe on `/run/fips` silently steered fipstop / fipsctl onto an XDG path the daemon never bound for any user in the `fips` group whose shell session had not yet picked up the supplementary group (no re-login after `usermod -aG`). `XDG_RUNTIME_DIR` is set on every modern systemd-managed user session, so this hit the common case. The kernel checks actual group membership at `connect(2)`, so a user who genuinely cannot connect now gets a clear `EACCES` rather than a silent path mismatch. Drops the now-unused `is_writable_dir` helper. `XDG_RUNTIME_DIR` existence validation is preserved. Documentation: - `docs/reference/cli-fipstop.md` — Node-tab row updated, new "Listening on fips0 panel" section. - `docs/reference/control-socket.md` — `show_listening_sockets` added to the read-only queries table. - `docs/how-to/enable-mesh-firewall.md` — new "Verify with fipstop" section. - `docs/tutorials/host-a-service.md` — fipstop callouts at Steps 3, 5, 6 + Troubleshooting bullet + wildcard-bind reminder under "What you've learned". - `CHANGELOG.md` — new bullet under `Added / Operator Tooling`, resolver `Fixed` entry rewritten to describe the existence-based final shape.	2026-05-08 21:36:42 +00:00
Johnathan Corgan	e4f37082c2	docs: gateway tutorial review feedback ... Two small improvements to the OpenWrt gateway deploy tutorial: - Add a router-side ping step at the top of Step 4 (post-gateway-start client test). Confirms the router itself reaches the mesh before bringing the LAN segment into the diagnosis: if this fails the troubleshooting target is the daemon / mesh side; if it succeeds and the LAN-client test below fails, the target is the LAN segment (proxy_ndp, RA pool route, or DNS forwarding through dnsmasq). - Mark the inbound port-forward section heading as Optional. The outbound half is the steady-state use of a gateway and applies to every deployment; the inbound port-forward half is a per-service opt-in that many operators won't need.	2026-05-08 14:52:33 +00:00
Johnathan Corgan	0fcf0f6f8f	gateway: change dns.listen default to [::1]:5353 ... The gateway is designed for systems already serving DHCP and DNS to a LAN segment (canonically an OpenWrt AP). On those systems port 53 is already taken by the existing resolver, so the prior `[::]:53` default conflicted with the gateway's intended deployment target out of the box. The OpenWrt ipk previously overrode this in its packaged config as a workaround; matching the source default to what the canonical deployment actually wants makes the override redundant and removes a foot-gun for fresh manual Linux-host installs. The redundant `dns.listen` line in `packaging/openwrt-ipk/files/etc/fips/fips.yaml` is dropped along with this change. Operators on a host without a pre-existing resolver on port 53 can opt back into the wildcard bind by setting `dns.listen: "[::]:53"` explicitly. The new default binds IPv6 loopback only — Linux IPv6 sockets bound to explicit `::1` do not accept v4-mapped traffic, so forwarders that reach the gateway over IPv4 loopback need to be pointed at an explicit IPv4 listen address instead. Touches the gateway config struct and its default-value test, the commented-out gateway example in the Debian common fips.yaml, the OpenWrt ipk config (override removed), the gateway reference / how-to / design / tutorial / troubleshoot docs, and a CHANGELOG entry under [Unreleased] -> Changed.	2026-05-08 14:02:05 +00:00
Johnathan Corgan	5abf9a9325	docs: four-section /docs/ restructure with new-user content, accuracy pass, and gateway feature-set rewrite ... Restructures /docs/ by reader purpose (tutorials, how-to, reference, design), adds the new-user-progression and operator-recipe content the prior layout lacked, runs an accuracy pass against current source across the pre-existing design docs, and rewrites the gateway feature-set documentation end-to-end around its actual operational profile (a niche feature designed for systems already serving DHCP/DNS to a LAN, with two independent halves — outbound LAN→mesh, inbound mesh→LAN — sharing one nftables table, one binary, and one control socket). Top-level README and getting-started rewritten around two equally-weighted deployment modes (overlay on existing IP networks; ground-up over non-IP transports). ## Additions - 11 new tutorials in docs/tutorials/: an 8-step new-user progression from single-daemon test-mesh peering through to a ground-up two-device mesh, an IPv6-adapter side-trip walkthrough, an Advanced Tutorials index, and a hand-held OpenWrt walk-through for fips-gateway deployment that exercises both halves of the feature. - 12 new how-tos in docs/how-to/: firewall activation, Nostr discovery (resolve / advertise / open across five scenarios), Tor onion (directory + control_port modes), UDP buffer tuning, unprivileged-user setup, persistent identity, host aliases, Bluetooth LE peering, MTU diagnostics, manual Linux-host gateway deployment (covers both halves), gateway troubleshooting (organised by half), and a section index. - 9 new reference docs in docs/reference/: configuration, wire formats, control-socket protocol, four CLI references (fips, fipsctl, fipstop, fips-gateway), security posture matrix, and Nostr events catalog. Configuration and wire-formats are renamed-and-extended from prior design/ versions; the other seven are net-new. - 6 new design docs: fips-concepts, fips-architecture, and fips-prior-work split out of the deleted fips-intro.md; consolidated fips-mmp and fips-mtu aggregations; and a new generic port-advertisement-and-nat-traversal doc (Nostr-signaled port advertisement plus UDP NAT-traversal protocol, FIPS as an example implementation, suitable for eventual NIP submission). - Top-level docs/getting-started.md walking through the binary-installer-only Install story. - packaging/common/hosts pre-populated with the eight public test-mesh nodes so shortnames resolve out of the box on every fresh install. ## Changes - 23 wire-format diagrams relocated to reference/diagrams/ alongside the wire-formats move. - 4 design diagrams corrected against source code (fips-protocol-stack, fips-identity-derivation, fips-coordinate-discovery, fips-routing-decision). - 10 pre-existing design docs reconciled with current source. Numeric corrections: stale link-MMP report bounds (now [1s, 5s] with 200 ms cold-start floor); UDP default MTU (now 1280, IPv6 minimum); node_addr formula (SHA-256(pubkey)[..16]); Noise patterns (IK at link, XK at session); peer-ACL semantics (strict allowlist requires ALL in peers.deny); daemon DNS upstream ([::1]:5354); on-the-wire bloom-filter size (1,071 bytes); obsolete Cargo-feature references (PR #79 dropped them) removed. - Transport framing tightened across the docs: TCP is for UDP-filtered networks (not NAT traversal); Tor is a deployment mode (not failover); WebSocket dropped (not a shipped FIPS transport); WiFi promoted to Implemented via Ethernet in infrastructure mode; classic-Bluetooth row removed (BLE is the only Bluetooth-mode transport). - docs/design/fips-gateway.md rewritten end-to-end to lead with the niche-feature framing and the two-halves structure. Title moved from "FIPS Outbound LAN Gateway" to "FIPS Gateway"; architecture section describes the common machinery (the fips-gateway service, the nftables table, the control socket) before splitting into separate "Outbound Half" and "Inbound Half" sections of equal weight; security considerations split per-half; no Future Work section (speculative directions live in the project tracker, not in protocol design docs). Inbound port forwarding is a first-class half rather than a buried "Implemented Extensions" subsection. - Gateway terminology unified across all gateway docs as a separate Linux service running alongside the fips daemon (its own systemd unit / OpenWrt init script). Container- pattern terms (sidecar) are reserved for the Docker/Kubernetes sidecar deployment examples — the testing/sidecar/ tree, examples/k8s-sidecar/, examples/sidecar-nostr-relay/, examples/wireguard-sidecar-macos/, and the related CHANGELOG / top-level README entries — where the term carries its standard container meaning. - Net-new design body content: rekey section in fips-mesh-layer (Noise IK msg1/msg2 over the established link, K-bit cutover, drain window, smaller-NodeAddr-wins tie-breaker on dual-init); Mesh Size Estimation and Antipoison FPR Cap sections in fips-bloom-filters; Mesh-Interface Query Filter subsection in fips-ipv6-adapter; failure-suppression knobs and clock- skew tolerance in fips-nostr-discovery; loop-rejection and mid-chain ancestor swap added to spanning-tree propagation / stability rules; Priority Chain in fips-mesh-operation renumbered to match the routing-decision diagram. - Top-level README: dropped the stale nostr-discovery cargo-feature parenthetical. docs/README.md and the four section READMEs (tutorials, how-to, reference, design) refreshed for the new structure; index rows reflect both halves of the gateway feature and the new fips-gateway CLI reference. - Cargo.toml [package.metadata.deb] assets path updated for the fips-security.md move; .gitignore /reference/ rule anchored to repo root so docs/reference/ is trackable. - packaging/openwrt-ipk/files/etc/fips/fips.yaml configuration-doc URL updated to the new docs/reference/configuration.md location. ## Deletions - docs/design/fips-intro.md (split into the three new intro design docs). - docs/design/document-relationships.svg (orphan, no longer referenced). - docs/proposals/ tree removed; the only proposal it contained (the Nostr UDP hole-punch protocol) was rewritten as the new generic design/port-advertisement-and-nat-traversal.md.	2026-05-08 03:02:12 +00:00