Johnathan Corgan
13c0b70dc3
Add rustfmt formatting policy and reformat codebase
...
Add rustfmt.toml with stable defaults and apply cargo fmt to all
source files. This establishes a consistent formatting baseline
for CI enforcement.
2026-04-10 08:27:07 +00:00
Johnathan Corgan
a8d3627072
Add link-layer heartbeat and liveness timeout for dead peer detection
...
Sends a 1-byte encrypted heartbeat (0x51) to each peer every 10s.
If no frame is received from a peer within 30s, the peer is removed
via remove_active_peer(), triggering tree reconvergence, coord cache
flush, and bloom filter recomputation.
This fixes the critical bug where UDP peers that silently died
(e.g., container stopped) were never detected or removed, leaving
the spanning tree permanently stale.
Both intervals are configurable via node.heartbeat_interval_secs
and node.link_dead_timeout_secs.
2026-02-19 20:53:51 +00:00
Johnathan Corgan
04d9fd625d
FSP wire format revision and session-layer MMP implementation
...
FSP wire format revision (TASK-2026-0007):
Introduce the FIPS Session Protocol (FSP) wire format with a 4-byte
common prefix [ver_phase:1][flags:1][payload_len:2 LE] replacing the
old 1-byte msg_type dispatch. All session messages share this prefix
with phase-based dispatch (Established, Setup, Ack, Unencrypted).
- New session_wire.rs: FSP constants, header types, parse/build helpers
- SessionMessageType enum: DataPacket (0x10), SenderReport (0x11),
ReceiverReport (0x12), PathMtuNotification (0x13)
- FspFlags (CP/K/U) and FspInnerFlags (SP) for flag management
- SessionSenderReport, SessionReceiverReport, PathMtuNotification
message structs with encode/decode
- FSP send pipeline: 12-byte header as AAD, 6-byte inner header
(timestamp + msg_type + inner_flags), encrypt_with_aad()
- FSP receive pipeline: parse header, extract cleartext coords (CP),
AEAD decrypt with AAD, strip inner header, msg_type dispatch
- Forwarding: transit nodes parse cleartext coords without decryption
- Removed DataPacket struct and associated types
- SessionEntry: session_start_ms, mark_established(), session_timestamp()
- FIPS_OVERHEAD: 144 → 150 bytes (+6 for FSP inner header)
- Design docs updated for new wire format
Session-layer MMP implementation (TASK-2026-0008):
Implement complete session-layer MMP reusing the link-layer algorithm
modules (SenderState, ReceiverState, MmpMetrics, SpinBitState) with
independent configuration and higher report interval clamps.
- SessionMmpConfig: separate config section (node.session_mmp.*)
- MmpSessionState: session-specific wrapper with PathMtuState tracking
- Session-layer constants (500ms-10s report intervals, 1s cold start)
- Parameterized interval methods (new_with_cold_start,
update_report_interval_with_bounds) on SenderState/ReceiverState
- Bidirectional From conversions between link/session report types
- SessionEntry: mmp and is_initiator fields, initialized on Established
- send_session_msg() for reports/notifications
- Per-message RX recording with spin bit state tracking
- Handlers for SenderReport, ReceiverReport, PathMtuNotification
- path_mtu threaded from SessionDatagram envelope through to handlers
- check_session_mmp_reports() tick handler with collect-then-send pattern
- Periodic and teardown operator logging for session metrics
- PathMtuState: destination observes incoming MTU on all session messages,
source seeded from outbound transport MTU, decrease-immediate /
increase-requires-3-consecutive rules
Link-layer MMP fix:
- Stop feeding spin bit RTT samples into SRTT estimator; inter-frame
timing in the mesh is irregular, inflating spin-bit RTT by variable
processing delays; timestamp-echo provides accurate RTT
29 files changed, 602 tests pass, 0 clippy warnings.
2026-02-19 03:15:05 +00:00
Johnathan Corgan
d8cb4d407e
FLP wire format revision and MMP link-layer measurement protocol
...
## FLP Wire Format Revision
Replace the 1-byte discriminator with a structured wire format:
- 4-byte common prefix (ver+phase, flags, payload_len) and 16-byte
established frame header with AEAD AAD binding
- 5-byte encrypted inner header (4-byte session-relative timestamp +
1-byte message type) on all link messages
- Phase-based packet dispatch replacing discriminator-based dispatch
- SessionDatagram reassigned from type 0x40 to 0x00; add SenderReport
(0x01) and ReceiverReport (0x02) message types for MMP
- SessionDatagram: rename hop_limit to ttl, add path_mtu field (u16 LE)
with min(datagram.path_mtu, transport.mtu()) at forwarding
- Updated handshake packets (msg1: 87->90 bytes, msg2: 42->45 bytes)
- FIPS_OVERHEAD updated from 135 to 144 bytes
## MMP Link-Layer Measurement Protocol
Add the Metrics Measurement Protocol for link quality measurement
between FIPS peers. Measures RTT, loss, jitter, throughput, OWD trend,
and ETX from periodic sender/receiver reports exchanged over established
links.
Module layout:
- mmp/algorithms.rs: JitterEstimator, SrttEstimator, DualEwma, OwdTrend,
SpinBit, ETX computation
- mmp/report.rs: SenderReport (48B) and ReceiverReport (68B) wire format
- mmp/sender.rs: per-peer TX counters and interval tracking
- mmp/receiver.rs: per-peer RX counters, jitter, loss, gap tracking
- mmp/metrics.rs: derived metrics from report processing (SRTT, goodput_bps)
- mmp/mod.rs: MmpMode (Full/Lightweight/Minimal), MmpConfig, MmpPeerState
- node/handlers/mmp.rs: report dispatch, timer-driven generation, operator
logging (periodic + teardown)
Integration: per-frame TX/RX hooks in encrypted message handling, report
dispatch from link message router, timer-driven generation from tick
handler, and periodic operator logging with throughput formatting.
Three operating modes: Full (sender + receiver reports, spin bit, CE echo),
Lightweight (receiver reports only), Minimal (spin bit + CE echo only).
## Design Documentation
Updated FLP sections across all design documents to match the implemented
wire format, including revised overhead calculations and numeric values.
568 tests pass, clippy clean.
2026-02-18 21:54:21 +00:00
Johnathan Corgan
62ce267677
Session message encode/decode, disconnect and routing integration tests
...
Add encode/decode for all session-layer message types (SessionSetup,
SessionAck, DataPacket, CoordsRequired, PathBroken) and SessionDatagram
link-layer envelope. Wire format follows design doc §8.0-8.6 with
address-only coordinate serialization (16 bytes/entry).
Struct additions: handshake_payload on SessionSetup/SessionAck, flags
on SessionAck, optional src_coords/dest_coords on DataPacket for route
cache warming (COORDS_PRESENT flag).
New disconnect integration tests verify cascading cleanup in multi-node
networks: chain peer removal, star hub departure, chain partition with
bloom filter update verification, all reason codes.
New routing tests validate bloom-filter-only transit behavior and peer
removal effects: confirm transit nodes without cached coords return None
(loop prevention), routing stops after partition, source-only coords
insufficient for multi-hop delivery.
361 tests pass (up from 335), zero warnings.
2026-02-12 13:01:29 +00:00
Johnathan Corgan
d41009b778
SessionDatagram redesign: add src_addr, reclassify error signals
...
Add src_addr to SessionDatagram envelope (34-byte header: msg_type +
src_addr + dest_addr + hop_limit) so transit routers can route error
signals back to the packet's originator.
Reclassify CoordsRequired/PathBroken as link-layer error signals
(plaintext inside SessionDatagram) rather than e2e encrypted session
messages. Transit routers generate these when forwarding fails and
route them to src_addr; if source is also unreachable, drop silently.
Remove redundant src_addr/dest_addr/hop_limit from SessionSetup,
SessionAck, and DataPacket (now in envelope). DataPacket header
reduced from 36 to 4 bytes. Remove PathBroken.original_src.
Fix routing loop vulnerability: gate bloom filter path on having
cached dest_coords to prevent blind forwarding between peers.
Simplify select_best_candidate() to require coordinates.
Fix gossip protocol type codes (0x11->0x20, 0x12->0x30, 0x13->0x31)
for consistency across all design docs.
All 5 design docs updated and cross-checked for consistency.
335 tests pass, zero warnings.
2026-02-12 11:32:45 +00:00
Johnathan Corgan
066865ddd7
Split protocol.rs into protocol/ directory, standardize imports, clean lib.rs
...
- Replace use super::*; in node/lifecycle.rs with explicit imports,
remove 10 resulting unused imports from node/mod.rs
- Split protocol.rs (1838 lines) into protocol/ directory:
mod.rs (re-exports), error.rs, link.rs, tree.rs, filter.rs,
discovery.rs, session.rs — each with co-located tests
- Remove unused flat re-exports from lib.rs for internal utility
modules (wire, index, rate_limit, icmp, noise, tun)
- 316 tests pass, zero warnings
2026-02-11 05:02:02 +00:00
Johnathan Corgan