mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-06 03:28:24 +00:00
Johnathan Corgan
1cc069f1a2
The TUN adapter, the .fips DNS responder, ICMPv6 generation and TCP MSS clamping are the host-side IPv6 plane, but the code was split between src/upper and inline bodies in the node's session handler and lifecycle. Gather it into one module, src/ipv6tun, and reduce its calls into the rest of the crate to a small explicit set. This prepares the TUN adapter to run later as a separate daemon over the native API, and gives embedders one place to find the host-side surface. Behaviour is unchanged apart from log target names. - Rename src/upper to src/ipv6tun. A `pub use ipv6tun as upper;` alias keeps every crate::upper:: and fips::upper:: path resolving, so no consumer has to change. - Move hosts.rs whole to src/hosts.rs, a top-level public module: the hosts file also serves peer display names, the peer ACL and fipsctl, so it is not host-side only. ipv6tun re-exports it for the old path. - Move the DNS socket helpers (dual-stack bind, IPV6_RECVPKTINFO, interface index lookup) from Node into ipv6tun::dns, unchanged. Node::mesh_ifindex, which reads the live TUN device name, becomes Handles::mesh_ifindex. - Move ICMPv6 Destination Unreachable and Packet Too Big sending into ipv6tun::icmp behind IcmpContext, which borrows the TUN channel, our address and the Packet Too Big rate limiter for one use. Packet Too Big is still rate limited and Destination Unreachable still is not. The discovery lookup timeout hands its queued packets over as one no-route report. - Split handle_tun_outbound. The host-side half, in ipv6tun::outbound, validates the packet, makes both Packet Too Big decisions and sends the ICMPv6 replies, reaching the mesh through a small Mesh trait Node implements. The mesh-side half, Node::send_outbound, stays with the pending queue. The checks run in the same order with the same thresholds, and Node::handle_tun_outbound remains the entry point. - Move the TUN and DNS child start and stop bodies into ipv6tun::lifecycle, and gather their nine supervisor fields and the node's TUN device name into one Handles struct the supervisor holds. The supervisor arms, their order and the child-exit reporting are unchanged. A TUN still counts as up when it has a device name, so an app-owned TUN produces no TUN teardown, and DNS counts as up while its task runs. The node passes a new peer-alias base to the running responder through Handles::publish_aliases. Node::tun_name, tun_tx, dns_local_addr and enable_app_owned_tun keep their behaviour; tests install a TUN sender through a test-only Node::install_tun. Tracing targets follow module paths, so lines from the moved code now log under fips::ipv6tun::* and fips::hosts instead of fips::upper::*, fips::node::lifecycle and fips::node::handlers::session. Update the RUST_LOG example in the MTU diagnosis guide and the test harness filters that relied on the old targets, and note the rename in the changelog.
How-To Guides
Task-oriented, step-by-step recipes for operators with a specific goal in mind. Each guide assumes the reader already knows what FIPS is and wants to get a particular thing done — enable a feature, deploy a component, troubleshoot a class of problem.
How-to guides do not teach concepts (that is the role of design/) and do not enumerate options (that is the role of reference/). They take the reader along the shortest correct path from "I want to do X" to "X is done".
Available Guides
| Guide | Goal |
|---|---|
| enable-mesh-firewall.md | Activate the default-deny nftables baseline on fips0 |
| enable-nostr-discovery.md | Turn on Nostr-mediated discovery (3 capabilities — resolve, advertise, open — across 5 scenarios) |
| deploy-tor-onion.md | Run a Tor onion service for inbound FIPS connections |
| tune-udp-buffers.md | Set host sysctls so FIPS UDP sockets don't get clamped |
| tune-file-descriptors.md | Raise RLIMIT_NOFILE so a busy node doesn't exhaust file descriptors (EMFILE) as peer count grows |
| run-as-unprivileged-user.md | Run the daemon under a dedicated unprivileged service account (drops the default-root posture) |
| deploy-gateway.md | Manually deploy fips-gateway on a non-OpenWrt Linux host (LAN-to-mesh outbound + mesh-to-LAN inbound port-forwards). For the OpenWrt path, see the gateway tutorial. |
| troubleshoot-gateway.md | Diagnostic recipes for the gateway, organised by half (outbound, inbound, common) |
| persistent-identity.md | Provision a stable Nostr keypair so the node keeps the same npub across restarts |
| host-aliases.md | Use shortnames (test-us01.fips, my-laptop.fips) instead of full npubs by editing /etc/fips/hosts or setting peer aliases |
| set-up-bluetooth-peer.md | Configure a Bluetooth Low Energy peer link |
| set-up-80211s-mesh-backhaul.md | Link OpenWrt FIPS routers over an open 802.11s radio backhaul (FIPS provides encryption, authentication, and routing) |
| set-up-open-access-ssid.md | Broadcast the open !FIPS access SSID so phones and laptops roam onto the mesh (one ESS: save once, roam every FIPS router) |
| diagnose-mtu-issues.md | Triage MTU-shaped failures and rule out their imposters (bufferbloat, transport saturation) |
| use-the-native-datagram-api.md | Enable the experimental native datagram API and write a program that sends and receives datagrams by pubkey and port (no IPv6 emulation, no TUN). Read the fips group warning first |
| write-a-native-api-client.md | Speak the native datagram API's line protocol directly from C, Python or Go, where there is no client library |
| serve-many-peers-on-one-thread.md | Handle every native API flow from one poll loop instead of a thread per peer |