mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Origami74andJohnathan Corgan
852f561fa0
Add dual-approach MTU handling to prevent TCP connections from hanging when packets exceed the transport MTU after FIPS encapsulation. ICMPv6 Packet Too Big: - Generate RFC 4443 PTB messages for oversized packets at TUN outbound - Inject back via TUN for local delivery to the application - Per-source rate limiting (100ms interval, 10s entry expiry) - MTU check in handle_tun_outbound before session encapsulation TCP MSS Clamping: - Intercept SYN packets in run_tun_reader() (outbound) - Intercept SYN-ACK packets in TunWriter (inbound) - Clamp MSS option to fit within effective MTU (transport - 127 overhead) - Recalculate TCP checksum after modification Code organization: - ICMP, TCP MSS, and rate limiter modules in upper/ alongside existing protocol-specific packet handling (dns.rs, tun.rs) - Shared FIPS_OVERHEAD constant (127 bytes) and effective_ipv6_mtu() function in upper/icmp.rs - Node::effective_ipv6_mtu() delegates to the shared function - run_tun_reader() accepts actual transport MTU from config Example config corrections: - UDP transport MTU set to 1472 across all configs (correct max UDP payload for standard Ethernet: 1500 - 20 IPv4 - 8 UDP) - Startup logging of effective MTU and max MSS values
FIPS Design Documents
Protocol design specifications and analysis for the Federated Interoperable Peering System.
Suggested Reading Order
Start with the high-level architecture, then work through session flow, routing concepts, and finally the wire-level protocol details.
1. Introduction and Overview
| Document | Description |
|---|---|
| fips-intro.md | Protocol introduction: goals, concepts, architecture |
2. Protocol Flow (How Traffic Works)
| Document | Description |
|---|---|
| fips-session-protocol.md | End-to-end session flow, Noise IK encryption, terminology |
3. Routing (How Packets Find Their Way)
| Document | Description |
|---|---|
| fips-routing.md | Routing concepts: bloom filters, discovery, greedy routing |
| spanning-tree-dynamics.md | Tree protocol behavior: convergence, partitions, recovery |
| fips-gossip-protocol.md | Wire formats: TreeAnnounce, FilterAnnounce, Lookup messages |
4. Link Layer (How Peer Connections Work)
| Document | Description |
|---|---|
| fips-wire-protocol.md | Transport layer: Noise IK, session indices, roaming, security |
| fips-transports.md | Transport-specific: UDP, Ethernet, Tor, radio characteristics |
Implementation
| Document | Description |
|---|---|
| fips-software-architecture.md | Software architecture: entities, state machines, configuration |
| fips-tun-driver.md | TUN interface driver: reader/writer threads, ICMPv6, packet flow |
| fips-state-machines.md | Phase-based state machine pattern: peer lifecycle, transitions |
Document Cross-References
fips-intro.md
│
┌────────────┴────────────┐
▼ ▼
fips-session-protocol.md fips-software-architecture.md
│ │
┌─────────┴─────────┐ ▼
▼ ▼ fips-transports.md
fips-routing.md fips-wire-protocol.md
│ │
▼ ▼
spanning-tree-dynamics.md ←→ fips-gossip-protocol.md