laantungir/fips
1
0
Fork 0
mirror of https://github.com/jmcorgan/fips.git synced 2026-08-09 08:14:42 +00:00
Code Issues Packages Projects Releases Wiki Activity
60 Commits 5 Branches 10 Tags
d41009b7780d95c2ccbb02eb2ca31e394db18022
Commit Graph
8 Commits
Author SHA1 Message Date
Johnathan Corgan 9a6fa07e77 Session 46: Noise IK peer authentication implementation 
Implement Noise Protocol Framework for peer authentication using the IK
pattern, which allows responders to learn initiator identity from the
encrypted handshake message.

Protocol: Noise_IK_secp256k1_ChaChaPoly_SHA256
- Message 1: 82 bytes (ephemeral + encrypted static)
- Message 2: 33 bytes (ephemeral only)

New noise.rs module (~600 lines):
- HandshakeState: Manages handshake for both initiator/responder roles
- NoiseSession: Post-handshake symmetric encryption
- CipherState: ChaCha20-Poly1305 with nonce counter
- SymmetricState: HKDF-SHA256 key derivation

PeerConnection integration:
- Simplified HandshakeState enum (Initial/SentMsg1/ReceivedMsg1/Complete/Failed)
- start_handshake(): Initiator generates msg1
- receive_handshake_init(): Responder processes msg1, discovers identity
- complete_handshake(): Initiator completes with msg2
- take_session(): Extract NoiseSession for ActivePeer

Identity helpers:
- Identity::keypair() for Noise operations
- PeerIdentity::from_pubkey_full() preserves parity for ECDH
- PeerIdentity::pubkey_full() returns full key or derives with even parity

Node changes:
- initiate_peer_connection() now starts handshake and sends msg1
- Method is async to use transport's async send

All 219 tests pass.
 2026-02-01 01:28:01 +00:00
Johnathan Corgan a5a62b3768 Session 43: CLI config option and state machine design 
Add command-line argument parsing with clap:
- -c/--config option to specify config file path
- Overrides default search path when provided
- Proper error handling for missing/invalid files

Improve logging:
- Peer connection log now uses separate log entries per field
- Better readability with aligned timestamps

Fix ICMPv6 error handling:
- Add multicast destination filter to should_send_icmp_error()
- Router Solicitation packets (ff02::2) now silently dropped
- Add test case for multicast destination

Add phase-based state machine design document:
- Document pattern where lifecycle phases use distinct structs in enum
- PeerSlot::Connecting(PeerConnection) -> PeerSlot::Active(ActivePeer)
- Benefits: type safety, memory efficiency, security
- Describes timeout handling and lookup table requirements
 2026-01-31 23:33:02 +00:00
Johnathan Corgan 385033fcb7 Add ICMPv6 Destination Unreachable and TUN reader/writer architecture 
- New icmp.rs module: builds RFC 4443 compliant ICMPv6 Type 1 Code 0
  responses with proper checksum and packet validation
- TUN reader/writer separation: fd duplication allows independent I/O
  on separate threads
- TunWriter services mpsc queue for multiple future packet sources
- Reader now sends ICMPv6 errors for unroutable packets instead of
  silently dropping them
- 171 tests passing
 2026-01-30 05:25:28 +00:00
Johnathan Corgan db8aa5825d Session 33: TUN interface lifecycle management 
- Add TUN interface detection on startup, delete existing before create
- Add proper interface deletion on shutdown via netlink
- Add TUN packet reader in separate thread with DEBUG logging
- Add graceful shutdown handling for expected "Bad address" error
- Add take_tun_device() to Node for reader ownership transfer
- Add shutdown_tun_interface() public function for cleanup by name
- Add tokio signal feature for Ctrl+C handling
 2026-01-30 04:57:35 +00:00
Johnathan Corgan 6d95bdc979 Add TUN interface with async netlink configuration 
- Implement fips.rs binary with config loading, node creation, and logging
- Create src/tun.rs module (TunDevice, TunState, TunError)
- Use rtnetlink crate for IPv6 address configuration
- Make TunDevice::create() and Node::init_tun() async
- Add IPv6 disabled check with helpful error message
- Add rtnetlink, tokio, futures dependencies
- Single tokio current_thread runtime for entire driver

162 tests pass.
 2026-01-29 22:12:27 +00:00
Johnathan Corgan b80b3fbecf Add YAML configuration system and nsec encoding 
Configuration system:
- New config module with cascading file search
- Priority: ./fips.yaml > ~/.config/fips/ > ~/.fips.yaml > /etc/fips/
- Identity section with optional nsec (bech32 or hex format)
- Generate new keypair if nsec not configured

Identity module additions:
- encode_nsec() and decode_nsec() for NIP-19 bech32 format
- decode_secret() accepts both nsec and hex formats
- Identity::from_secret_str() constructor

Dependencies: serde, serde_yaml, dirs, hex

41 tests passing (20 identity + 15 config + 6 nsec)
 2026-01-25 01:08:02 +00:00
Johnathan Corgan ac2f6a75c8 Add npub encoding and PeerIdentity to identity module 
- Add bech32 dependency for NIP-19 npub encoding
- Add encode_npub/decode_npub functions
- Add Identity::npub() method
- Add PeerIdentity type for remote peers (public key only)
  - from_npub() constructor
  - verify() for signature verification
- Export new types from lib.rs
- Update main.rs with verbose authentication demo
- 20 tests passing
 2026-01-25 00:40:59 +00:00
Johnathan Corgan 5c0e84f239 Add identity module with NodeId, FipsAddress, and auth challenge 
Implements FIPS Identity System (Section 1 of design doc):
- NodeId: 32-byte SHA-256 hash of npub, with Ord for root election
- FipsAddress: 128-bit IPv6-compatible address (0xfd prefix)
- Identity: keypair holder with sign/verify methods
- AuthChallenge/AuthResponse: challenge-response authentication

All 11 tests passing.
 2026-01-24 23:57:48 +00:00