mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-06 11:38:24 +00:00
ArjenandJohnathan Corgan
4ecc192456
Two control-socket commands answered success without doing what the
caller asked. They land as one commit because they share a test file:
the connect fix creates `src/node/tests/control.rs` and the `mod
control;` line that declares it, and the disconnect fix adds to that
file without declaring it, so the disconnect fix on its own does not
build.
Each original commit message follows in full.
--- connect must refresh the path of an already-connected peer ---
`connect` on a peer the node already holds a session to is silently a
no-op. `api_connect` builds an ephemeral PeerConfig and hands it to
`initiate_peer_connection`, which returns Ok(()) as soon as
`self.peers.contains_key(&peer_node_addr)`. The control socket answers
`{"status":"ok"}` and `fipsctl connect` prints success, but the node
never tries the address it was given.
That is the wrong answer whenever the caller knows a path the node does
not. An operator moving a peer onto a freshly-provisioned link, or a
supervising process that has just observed a second, faster path come
up, has no way to make the node use it — the peer stays on whatever path
it first authenticated over until that path dies and the ordinary retry
machinery rediscovers it.
`update_peers`, the other runtime peer-mutation entry point, already
gets this right: for a peer that is currently active it calls
`try_active_peer_alternative_addresses`, which drops candidates matching
the peer's current path, keeps the rest, and starts a parallel
handshake — promotion happens only after that handshake authenticates,
so a bad or spoofed address cannot displace a healthy link. Route
`api_connect`'s already-connected case through the same helper rather
than growing a second mechanism beside it.
Behaviour for an unknown or merely-connecting peer is unchanged, and
`connect` stays ephemeral: the peer is not persisted to config and gets
no auto-reconnect, so a refresh that fails leaves no residue. The
response gains one additive field, `refreshed`, so the caller can tell
"started an alternate-path handshake" from "already on this exact path
and it is fresh", which was previously indistinguishable from a dial.
`fipsctl` pretty-prints the whole `data` object and `fipstop` reads only
`status`, so neither is disturbed.
Note that `connect` deliberately bypasses the reconciler's opportunistic
discovery budget — it is a manual command and the caller is treated as
authoritative about what it can see — so it is bounded only by
`path_candidate_attempt_budget`. A caller that re-announces the same
peer on the same fresh path every cycle now provably costs nothing:
that case is a no-op with a regression test.
--- disconnect must close the transport connection, not just the peer ---
`api_disconnect` notifies the peer and calls `remove_active_peer`, which
frees every node-side structure — session, indices, link, address
mapping, tree and bloom state. It never touches the transport. On a
connection-oriented transport (TCP, Tor, Nym, BLE) the pool entry, the
underlying socket and its inbound-slot accounting therefore survive the
peer the node has just forgotten, until the far end closes or the
receive loop errors. An operator who disconnects a peer to free a slot
does not free the slot.
This is the same hazard `cleanup_stale_connection` was fixed for, and
the reasoning there applies verbatim: closing twice is harmless, because
every `close_connection` implementation is `if let Some(conn) =
pool.remove(addr)` and the connectionless default is a no-op. Read the
peer's transport id and current address before removal and close the
connection after it, mirroring that path. `current_addr` rather than the
link's remote address, because roaming updates the former and it is the
address the pool entry is keyed by.
No effect on UDP, Ethernet or loopback, whose `close_connection` is the
connectionless no-op — the change is a real leak fix on TCP and Tor
today, and on pooled link transports generally.
Not addressed here: `disconnect` still errors with `peer not found` for
an identity that is only mid-handshake, so withdrawing a peer during its
handshake leaves that leg resending msg1 until the handshake timeout
bounds it. That is a separate, timeout-bounded case.
Tests: a TCP two-node test asserts the pool entry is gone after
`api_disconnect` (it fails on the pre-fix code with `Connected`); a
connectionless test asserts the no-op default neither errors nor panics
and that a repeat withdrawal is a clean `peer not found`.
--- changelog ---
Both fixes get an entry under Fixed. Each names the mechanism and what
stays unchanged, and the disconnect entry carries the case its commit
says it does not fix. A duplicate blank line in the Changed section,
left there by an earlier entry, is removed here as well.
227 lines
15 KiB
Markdown
227 lines
15 KiB
Markdown
# Control Socket Protocol
|
|
|
|
The FIPS daemon and `fips-gateway` each expose a local control socket
|
|
that accepts line-delimited JSON requests and returns line-delimited
|
|
JSON responses. `fipsctl` and `fipstop` are clients of this protocol;
|
|
operators can also drive it directly with any tool that can speak
|
|
length-bounded JSON over a stream socket.
|
|
|
|
## Connection
|
|
|
|
### Unix
|
|
|
|
A Unix domain socket. The default path is resolved in this order:
|
|
|
|
1. `/run/fips/control.sock` (or `/run/fips/gateway.sock` for the
|
|
gateway), if `/run/fips` exists. This is what the `fips.service`
|
|
systemd unit creates.
|
|
2. On macOS and FreeBSD, `/var/run/fips/control.sock` if its private
|
|
directory exists. A privileged macOS daemon selects this path before the
|
|
directory exists and creates it at bind time, so the packaged LaunchDaemon
|
|
recreates its runtime state after every boot. The FreeBSD rc.d service
|
|
creates the directory before starting FIPS.
|
|
3. `$XDG_RUNTIME_DIR/fips/control.sock` otherwise.
|
|
4. `/tmp/fips-control.sock` if none of the above is available.
|
|
|
|
The daemon sets the socket to group `fips`, mode `0770`. It sets a private
|
|
parent directory to group `fips`, mode `0750`, both when it creates that
|
|
directory and when a service manager pre-creates a canonical runtime directory
|
|
(`/run/fips`, `/var/run/fips`, or `$XDG_RUNTIME_DIR/fips`). Existing shared or
|
|
custom parents remain unchanged, so fallback locations such as `/tmp` retain
|
|
their system ownership and mode. Members of the `fips` group can connect
|
|
without root.
|
|
|
|
The path can be overridden at the daemon side via
|
|
`node.control.socket_path` in the YAML config, and at the client side
|
|
via `fipsctl -s PATH` or `fipstop -s PATH`.
|
|
|
|
### Windows
|
|
|
|
A TCP listener bound to `127.0.0.1`. The daemon's port is `21210` by
|
|
default; the gateway's is `21211`. Only loopback connections are
|
|
accepted. Override via `node.control.socket_path` (which takes a port
|
|
number string on Windows).
|
|
|
|
Windows TCP does not provide filesystem-level ACLs — any local user
|
|
can connect. See the security note in
|
|
[configuration.md](configuration.md#control-socket-nodecontrol).
|
|
|
|
## Request Format
|
|
|
|
One JSON object per line, terminated by `\n`. Maximum request size is
|
|
4096 bytes; longer requests are dropped with `request too large`.
|
|
|
|
```json
|
|
{"command": "<name>", "params": {<object>}}
|
|
```
|
|
|
|
| Field | Type | Required | Description |
|
|
| ----- | ---- | -------- | ----------- |
|
|
| `command` | string | yes | Command name. See [Daemon command catalog](#daemon-command-catalog) and [Gateway command catalog](#gateway-command-catalog). |
|
|
| `params` | object | only for commands that take parameters | Parameter object. Unknown fields are ignored; missing required fields produce an error response. |
|
|
|
|
Unknown top-level fields in the request are silently ignored.
|
|
|
|
## Response Format
|
|
|
|
One JSON object per line.
|
|
|
|
```json
|
|
{"status": "ok", "data": {<object>}}
|
|
{"status": "error", "message": "<reason>"}
|
|
```
|
|
|
|
| Field | Type | When present |
|
|
| ----- | ---- | ------------ |
|
|
| `status` | string | always; one of `"ok"` or `"error"`. |
|
|
| `data` | object | on `ok` responses. |
|
|
| `message` | string | on `error` responses. |
|
|
|
|
### I/O timeouts
|
|
|
|
The daemon enforces a 5-second timeout for both the request read and
|
|
the response write. If the connection idles longer than that, the
|
|
daemon closes it with no response.
|
|
|
|
### Common error messages
|
|
|
|
| Message | Cause |
|
|
| ------- | ----- |
|
|
| `empty request` | Connection closed before a newline was received. |
|
|
| `invalid request: <serde error>` | Malformed JSON or missing `command`. |
|
|
| `request too large` | Request exceeded 4096 bytes. |
|
|
| `read timeout` / `read error: ...` | Slow client or transport failure. |
|
|
| `unknown command: <name>` | Command not registered with this daemon. |
|
|
| `missing params for <name>` | Command requires `params` but none were provided. |
|
|
| `missing '<field>' parameter` | Required parameter missing. |
|
|
| `query timeout` | Internal handler did not respond within 5 seconds. |
|
|
| `node shutting down` | Daemon is exiting. |
|
|
| `gateway not yet initialized` | (Gateway socket only) snapshot has not been published yet. |
|
|
|
|
## Daemon Command Catalog
|
|
|
|
Read-only queries are dispatched in `src/control/queries.rs`;
|
|
mutating commands are dispatched in `src/control/commands.rs`. The
|
|
table below lists every command currently registered.
|
|
|
|
### Read-only queries
|
|
|
|
| Command | Params | `data` shape (top-level keys) |
|
|
| ------- | ------ | ----------------------------- |
|
|
| `show_status` | — | `version`, `npub`, `node_addr`, `ipv6_addr`, `state`, `is_leaf_only`, `is_root` (bool — this node is the spanning-tree root), `root` (hex node-addr of the current tree root), `persistent` (bool — identity is persisted, i.e. `persistent` set or an `nsec` configured), `peer_count`, `session_count`, `link_count`, `transport_count`, `connection_count`, `transport_peer_counts` (object mapping transport-type name to its connected-peer count; configured transports appear with `0`), `tun_state`, `tun_name`, `effective_ipv6_mtu`, `control_socket`, `pid`, `exe_path`, `uptime_secs`, `estimated_mesh_size`, `forwarding`, `sparklines`. |
|
|
| `show_acl` | — | `allow_file`, `deny_file`, `enforcement_active`, `effective_mode`, `default_decision`, `allow_all`, `deny_all`, `allow_file_entries`, `deny_file_entries`, `allow_entries`, `deny_entries`. |
|
|
| `show_peers` | — | `peers[]` — per-peer object: `node_addr`, `npub`, `display_name`, `ipv6_addr`, `connectivity`, `link_id`, `direction`, `transport_addr`, `transport_type`, `is_parent`, `is_child`, `tree_depth`, `effective_depth` (`tree_depth + link_cost` — the metric `evaluate_parent` ranks on; `null` when the peer has no coords, or is unmeasured while another peer has an SRTT sample, per the cold-start gate), `stats`, `noise`, `current_k_bit`, `mmp`, plus optional `nostr_traversal`, `rekey_in_progress`, `rekey_draining`. |
|
|
| `show_links` | — | `links[]` — `link_id`, `transport_id`, `remote_addr`, `direction`, `state`, `created_at_ms`, `stats`. |
|
|
| `show_tree` | — | `my_node_addr`, `root`, `root_npub` (bech32 npub of the current tree root), `is_root`, `depth`, `my_coords[]`, `parent`, `parent_display_name`, `declaration_sequence`, `declaration_signed`, `peer_tree_count`, `peers[]`, `stats`. |
|
|
| `show_sessions` | — | `sessions[]` — `remote_addr`, `npub`, `display_name`, `state` (`established`, `initiating`, `awaiting_msg3`, `unknown`), `is_initiator`, `last_activity_ms`, `stats`, optional `mmp`, `current_k_bit`, `is_draining`. |
|
|
| `show_bloom` | — | `own_node_addr`, `is_leaf_only`, `sequence`, `leaf_dependent_count`, `leaf_dependents[]`, `peer_filters[]`, `uptree_fill_ratio` (fill ratio of the last filter actually sent to the tree parent), `uptree_estimated_count` (cardinality estimate of that uptree filter — this node's whole subtree under split-horizon, not the mesh; both are `null` for a root node or before the first announce), `stats`. |
|
|
| `show_mmp` | — | `peers[]` (link-layer per peer), `sessions[]` (session-layer per session). Each entry includes loss/RTT/ETX/goodput, smoothed values, trends. |
|
|
| `show_cache` | — | `count`, `max_entries`, `fill_ratio`, `default_ttl_ms`, `expired`, `avg_age_ms`, `entries[]` — per-destination coords, depth, age, last-used, optional `path_mtu`. |
|
|
| `show_connections` | — | `connections[]` — pending handshakes: `link_id`, `direction`, `handshake_state`, `started_at_ms`, `idle_ms`, `resend_count`, optional `expected_peer`. |
|
|
| `show_transports` | — | `transports[]` — `transport_id`, `type`, `state`, `mtu`, `name`, `local_addr`, optional `tor_mode`, `onion_address`, `tor_monitoring`, `stats`. |
|
|
| `show_routing` | — | `coord_cache_entries`, `identity_cache_entries`, `pending_lookups[]`, `pending_tun_destinations`, `pending_tun_packets`, `recent_requests`, `retries[]`, `forwarding`, `discovery` (request/response sub-counters; includes `req_deduplicated` — requests suppressed as recent duplicates — and `req_dedup_cache_full` — requests admitted because the dedup cache was full), `error_signals`, `congestion`. |
|
|
| `show_identity_cache` | — | `entries[]`, `count`, `max_entries`. Each entry: `node_addr`, `npub`, `display_name`, `ipv6_addr`, `last_seen_ms`, `age_ms`. |
|
|
| `show_listening_sockets` | — | `fips0_addr`, `firewall_active` (bool — `inet fips` table loaded), `sockets[]`. Each entry: `proto` (`tcp` / `udp`), `local_addr` (`::` or the node's fd00::/8 address), `port`, `pid` (nullable), `process` (nullable), `wildcard_bind` (bool — `local_addr == ::`), `filter` (`accept` / `drop` / `unknown` / `no_firewall`). Linux-only; returns an empty `sockets[]` on other platforms. |
|
|
| `show_stats_list` | — | `metrics[]` (each with `name`, `unit`, `scope`), `fast_ring_seconds`, `slow_ring_minutes`, `peer_retention_seconds`. |
|
|
| `show_metrics` | — | Flat snapshot of every counter family in the metrics registry: `forwarding`, `discovery`, `tree`, `bloom`, `congestion`, `errors`. Each value is that family's counter snapshot object. Counter-only — gauges/histograms that need the live node are excluded. Served off the main loop. Silent-rejection sites classify their reason as a typed `RejectReason` and increment the matching per-family counter exposed here — see [Rejection reasons](#rejection-reasons). |
|
|
| `show_stats_history` | `metric` (req), `peer` (req for per-peer metrics), `window` (`<N>s` / `<N>m` / `<N>h`, default `10m`), `granularity` (`1s` / `1m`, default `1s`) | A single `Series`: `metric`, `unit`, `granularity_seconds`, `values[]`. |
|
|
| `show_stats_all_history` | `peer` (optional npub), `window`, `granularity` | `granularity_seconds`, `window_seconds`, `peer`, `series[]` (one per metric). |
|
|
| `show_stats_peers` | — | `peers[]`, `count`. Each entry: `npub`, `node_addr`, `display_name`, `is_active`, `first_seen_secs_ago`, `last_contact_secs_ago`. |
|
|
| `show_stats_history_all_peers` | `metric` (req per-peer name), `window`, `granularity` | `metric`, `unit`, `granularity_seconds`, `window_seconds`, `peers[]` (each with `node_addr`, `display_name`, `is_active`, `values[]`). |
|
|
|
|
The schema of each query response is pinned by snapshot tests in
|
|
`src/control/snapshots/`; intentional schema changes regenerate those
|
|
fixtures.
|
|
|
|
### Rejection reasons
|
|
|
|
Silent-rejection paths across the node classify why a message was
|
|
dropped via a typed `RejectReason` rather than only logging it, so the
|
|
*what* of a rejection is visible in the counter snapshots above. The
|
|
top-level reason set has eight families, mirroring the protocol-layer /
|
|
subsystem split of the metrics:
|
|
|
|
- **Tree** — spanning-tree `TreeAnnounce` processing rejections.
|
|
- **Bloom** — bloom-filter `FilterAnnounce` processing rejections.
|
|
- **Discovery** — discovery request / response processing rejections.
|
|
- **Handshake** — Noise handshake state-machine rejections.
|
|
- **Session** — FSP session state-machine rejections.
|
|
- **Mmp** — MMP link-layer rejections.
|
|
- **Forwarding** — forwarding-path rejections (no-route, TTL, MTU).
|
|
- **Transport** — transport-layer rejections (admission caps, framing).
|
|
|
|
Each rejection increments the corresponding counter in its family's
|
|
stats, surfaced through `show_metrics` (the `tree`, `bloom`,
|
|
`discovery`, and `forwarding` families carry their own counters; the
|
|
`errors` family and the remaining subsystem counters carry the rest).
|
|
The full per-family variant list lives in `src/node/reject.rs`; it is
|
|
not reproduced here to avoid duplicating the source.
|
|
|
|
### Mutating commands
|
|
|
|
| Command | Required params | Behaviour |
|
|
| ------- | --------------- | --------- |
|
|
| `connect` | `npub` (bech32), `address` (transport endpoint), `transport` (`udp`, `tcp`, `tor`, `nym`, `ethernet`) | Asks the node to dial the peer over the named transport. The named transport must be configured and running. Returns the API result on success or an error string on failure. |
|
|
| `disconnect` | `npub` (bech32) | Asks the node to drop the link to the named peer. |
|
|
|
|
`connect` on a peer the node is **already connected to** neither tears the
|
|
live link down nor ignores the address: the address is tried as an alternate
|
|
path alongside the existing one, and the peer moves to it only if that
|
|
handshake authenticates. The response carries `refreshed` — `true` when such a
|
|
handshake was started, `false` when the peer is already on this exact path and
|
|
that path is fresh (a successful no-op). A `connect` that starts an ordinary
|
|
dial to a peer the node does not yet hold also reports `refreshed: false`.
|
|
|
|
`connect` is ephemeral either way: the peer is not written to the config file
|
|
and gets no auto-reconnect, so an attempt that fails leaves no residue.
|
|
|
|
Both commands run on the daemon's main task and may block briefly
|
|
while the node mutates its state.
|
|
|
|
#### Profiler toggle (`--features profiling` builds only)
|
|
|
|
| Command | Params | Behaviour |
|
|
| ------- | ------ | --------- |
|
|
| `profile_tick_on` | `dir` (optional directory path; default `/var/log/fips`) | Creates the capture file, publishes its path, and starts the writer thread. `data`: `state`, `path`, `interval_secs`, `byte_cap`. Errors if a capture is already running (naming the active file) or the directory is unwritable. |
|
|
| `profile_tick_off` | — | Stops the capture, drains once more, joins the writer. `data`: `state`, `stopped`, `stopped_by_cap`, `stopped_by_error`, `path`, `bytes`. |
|
|
| `profile_tick_status` | — | `data`: `state` (`idle` / `running` / `stopped_by_cap` / `stopped_by_error`), `path`, `bytes`, `byte_cap`, `interval_secs`. |
|
|
|
|
Unlike `connect` and `disconnect`, these three are served in the
|
|
control accept task rather than on the daemon's main task. All of their
|
|
state is process statics and none of them needs `&mut Node`, so
|
|
routing them through the main loop would only make the toggle queue
|
|
behind the tick body it exists to measure. They are absent from a
|
|
default build, where the daemon answers them as unknown commands.
|
|
|
|
## Gateway Command Catalog
|
|
|
|
`fips-gateway` exposes a separate control socket with its own command
|
|
set. Dispatch lives in `src/gateway/control.rs`.
|
|
|
|
| Command | Params | `data` shape |
|
|
| ------- | ------ | ------------ |
|
|
| `show_gateway` | — | `pool_total`, `pool_allocated`, `pool_active`, `pool_draining`, `pool_free`, `nat_mappings`, `dns_listen`, `uptime_secs`, `pool_cidr`, `lan_interface`, `dns_upstream`, `dns_ttl`, `pool_grace_period`. |
|
|
| `show_mappings` | — | `mappings[]` — `virtual_ip`, `mesh_addr`, `node_addr`, `dns_name`, `state` (`Allocated`, `Active`, `Draining`), `sessions`, `age_secs`, `last_ref_secs`. |
|
|
|
|
Until the first snapshot has been published (very early in startup),
|
|
both commands return `gateway not yet initialized`.
|
|
|
|
## Driving the Socket Directly
|
|
|
|
```sh
|
|
# Linux / macOS
|
|
echo '{"command":"show_status"}' | sudo nc -U /run/fips/control.sock
|
|
|
|
# Windows (PowerShell with a TCP-capable tool of your choice)
|
|
```
|
|
|
|
The newline at the end of the request is required: the daemon reads
|
|
one line per connection. The connection is closed after the single
|
|
response is written.
|
|
|
|
## See also
|
|
|
|
- [`fipsctl`](cli-fipsctl.md) — full-featured client.
|
|
- [`fipstop`](cli-fipstop.md) — read-only TUI.
|
|
- [configuration.md](configuration.md) — `node.control.*` keys.
|