mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
ArjenandGitHub
f624013b83
Access layer for phones and laptops to reach FIPS routers on OpenWrt, stacked on the 802.11s mesh backhaul from #123. Squashed from five commits by Arjen (Origami74); their original messages follow. * feat(openwrt): open !FIPS access SSID — fips-ap-setup helper, default transport binding, how-to Client access layer for phones and laptops: every FIPS router broadcasts the same open SSID ('!FIPS' — the leading '!' sorts it to the top of alphabetically ordered network pickers), forming one standard ESS. Clients save it once and roam between all FIPS routers natively, with FIPS's Noise IK handshake as the only security layer: - fips-ap-setup: opt-in UCI helper that creates the 'fips-ap0' open AP (encryption none — security type must be uniform across routers or clients treat the ESS as different saved networks), an isolated network with a static ULA /64, RA-only odhcpd addressing (stateless SLAAC, no DHCP — the minimum that satisfies Android's provisioning check; no internet by design, so phones keep cellular as default route), and a locked-down fips_ap firewall zone (no path to br-lan or the WAN; only ICMPv6, mDNS, and the FIPS transports reachable). 'remove' subcommand undoes it. Radio setup stays opt-in; a package must not commandeer radios on install. - fips.yaml: ship 'ap0'/'ap1' Ethernet-transport entries commented out (matching the 802.11s mesh backhaul) so a stock install that never creates fips-ap* logs no per-boot "interface missing" bind warning; fips-ap-setup uncomments the matching block when it creates the interface and re-comments it on remove. - Regression test: extend shipped_openwrt_config_parses to assert the ap0/ap1 entries ship commented out and still parse once uncommented, alongside mesh0/mesh1. - Packaging: install the helper in ipk/apk/buildroot (three synced copies), extend CI structural checks and shellcheck targets. - docs/how-to/set-up-open-access-ssid.md: full guide, including the one-time 'no internet, stay connected' acceptance (stored per SSID, covers every FIPS router) and the security-type-uniformity constraint. * docs(openwrt): correct open-SSID/mesh security framing — peering is open by design The fips-ap-setup/fips-mesh-setup comments and both how-tos claimed a stranger "cannot pass the FIPS handshake" / "their frames die at the handshake" / the handshake surface "drops them". That is wrong: FIPS peer admission is open. An inbound handshake from any net-new identity is promoted (node::handlers::handshake::promote_connection), gated only by the daemon's max-peers cap — there is no allowlist, no PSK, and the AuthChallenge path is not wired to admission. The Noise IK handshake provides authentication (no impersonation of another identity, no MITM), not authorization. Restate the model accurately in all five places: a stranger on the open SSID (or the open mesh) can associate AND form a FIPS peer link — that is the point of open access. Containment is the isolated fips_ap zone (no path to br-lan or the WAN) plus the max-peers cap, not the handshake. Clarify that AP client isolation is an L2 control only: a peered stranger is an overlay peer like any other, so the FIPS overlay, not L2, is the trust boundary between clients. * feat(openwrt): serve DHCPv4 on the access SSID from a fixed roamable subnet RA-only addressing satisfied Android's provisioning check but left anything expecting IPv4 with a self-assigned address and a "no IP" complaint. dnsmasq now leases out of 10.21.<N>.0/24 (N = radio index; prefix echoes FIPS port 2121), deliberately identical on every router: a roaming client keeps its lease across the ESS, and dnsmasq's authoritative mode — the OpenWrt default, pinned by the helper — ACKs the renew a foreign router never issued. Lease collisions across routers surface as a NAK on renew and the client re-DHCPs. The dhcp section's 'dhcpv4 server' is read by both dnsmasq (default images) and odhcpd (only with maindhcp), so either arrangement serves. A DHCPv4/udp-67 accept rule joins the fips_ap zone; DHCPv6 stays off, the ULA RA stays as-is, and nothing depends on an upstream. The zone remains isolated — no forwardings, no internet. * feat(openwrt): enable mDNS rendezvous from fips-ap-setup Phone FIPS apps cannot open raw-Ethernet sockets, so DNS-SD is how they find the router's daemon — but node.rendezvous.lan defaults to off. Ship the lan block commented in fips.yaml (consistent with the apN transport entries) and have fips-ap-setup uncomment it when creating the access SSID. The awk match is scoped to node.rendezvous because transports.ethernet carries a 'lan' entry at the same indent. The switch is daemon-wide, so 'remove' deliberately leaves it on rather than guess whether other transports rely on it. * fix(openwrt): bind UDP dual-stack [::]:2121 so access-SSID clients reach it The shipped router config bound the UDP transport "0.0.0.0:2121" (IPv4 wildcard) while the mDNS LAN advert announces every interface address, including the router's IPv6 link-local — which phones on the !FIPS access SSID rightly prefer (their cellular default route swallows v4, and fd00::/8 is captured by the Myco mesh TUN). Result: the client's Noise msg1 arrives on an unbound v6 port and is silently lost; the handshake resends and times out. Symptom chain (observed on-device): mDNS resolve OK, platform push OK, "Sent Noise handshake message 1" to [fe80::…%N]:2121, four resends, no reply, 30 s stale-timeout. OpenWrt is Linux (bindv6only=0), so "[::]" accepts IPv4 via v4-mapped addresses too — nothing is lost. packaging/common is deliberately left on "0.0.0.0" for now: Windows defaults IPV6_V6ONLY=1, where "[::]" would drop v4 instead.
197 lines
7.1 KiB
YAML
197 lines
7.1 KiB
YAML
# FIPS Node Configuration
|
|
|
|
node:
|
|
identity:
|
|
# By default, a new ephemeral keypair is generated on each start.
|
|
# Uncomment persistent to keep the same identity across restarts;
|
|
# on first start a keypair is saved to fips.key/fips.pub next to
|
|
# this config file (mode 0600/0644).
|
|
# persistent: true
|
|
#
|
|
# Or set an explicit key (overrides persistent):
|
|
# nsec: "nsec1..."
|
|
# Mesh-lookup protocol (node.lookup.*): the overlay coordinate-lookup engine
|
|
# (mesh address -> coordinates). Defaults shown; uncomment to override.
|
|
# lookup:
|
|
# ttl: 64
|
|
# attempt_timeouts_secs: [1, 2, 4, 8]
|
|
# recent_expiry_secs: 10
|
|
# backoff_base_secs: 0
|
|
# backoff_max_secs: 0
|
|
# forward_min_interval_secs: 2
|
|
rendezvous:
|
|
# Optional Nostr-mediated overlay endpoint rendezvous.
|
|
# nostr:
|
|
# enabled: true
|
|
# policy: configured_only # disabled | configured_only | open
|
|
# open_discovery_max_pending: 64 # caps queued open-rendezvous retries
|
|
# app: "fips-overlay-v1"
|
|
# advertise: true
|
|
# advert_relays:
|
|
# - "wss://relay.damus.io"
|
|
# - "wss://nos.lol"
|
|
# - "wss://offchain.pub"
|
|
# dm_relays:
|
|
# - "wss://relay.damus.io"
|
|
# - "wss://nos.lol"
|
|
# - "wss://offchain.pub"
|
|
# # Optional override. If omitted, FIPS uses the built-in STUN list.
|
|
# # Built-in relay/STUN defaults are best-effort and should be
|
|
# # overridden by operators for production use.
|
|
# stun_servers:
|
|
# - "stun:stun.l.google.com:19302"
|
|
# - "stun:stun.cloudflare.com:3478"
|
|
# - "stun:global.stun.twilio.com:3478"
|
|
|
|
# mDNS/DNS-SD peer rendezvous on the local link. Ships commented (the
|
|
# daemon default is off); 'fips-ap-setup' uncomments it when creating
|
|
# the access SSID — phone FIPS apps cannot see raw-Ethernet beacons,
|
|
# so mDNS is how they find this router's daemon. Daemon-wide switch,
|
|
# left enabled on 'fips-ap-setup remove'.
|
|
# lan:
|
|
# enabled: true
|
|
|
|
tun:
|
|
enabled: true
|
|
name: fips0
|
|
mtu: 1280
|
|
|
|
dns:
|
|
enabled: true
|
|
# bind_addr defaults to "::1" (IPv6 loopback). The shipped
|
|
# fips-dns-setup script configures systemd-resolved with a global
|
|
# /etc/systemd/resolved.conf.d/fips.conf drop-in pointing at
|
|
# [::1]:5354.
|
|
#
|
|
# Set "::" to expose the responder to mesh peers as well (e.g. for
|
|
# gateway hosts that resolve .fips on behalf of LAN clients). The
|
|
# mesh-interface filter in src/upper/dns.rs will still defend
|
|
# /etc/fips/hosts aliases from cross-mesh enumeration.
|
|
# bind_addr: "::1"
|
|
port: 5354
|
|
|
|
transports:
|
|
udp:
|
|
# Dual-stack wildcard, not "0.0.0.0": access-SSID clients (phones) learn
|
|
# this node's addresses from the mDNS advert and prefer the IPv6
|
|
# link-local — a v4-only bind silently drops their Noise msg1.
|
|
# OpenWrt is Linux (bindv6only=0), so "[::]" accepts v4 too.
|
|
bind_addr: "[::]:2121"
|
|
# advertise_on_nostr: true
|
|
# public: false # false => advertise udp:nat; true => advertise bound host:port
|
|
# accept_connections: true # default; refuse inbound msg1 when false
|
|
# outbound_only: false # true => bind ephemeral, no listener on a
|
|
# # known port. Forces advertise_on_nostr=false
|
|
# # and accept_connections=false. Pure-client
|
|
# # posture; bind_addr is ignored.
|
|
|
|
tcp:
|
|
# Accepts inbound connections. No static outbound peers.
|
|
bind_addr: "0.0.0.0:8443"
|
|
# advertise_on_nostr: true
|
|
|
|
# Ethernet transport — physical port names, NOT bridge names.
|
|
# Run 'ip link show' on the router to identify port names.
|
|
ethernet:
|
|
wan:
|
|
interface: "eth0"
|
|
listen: true
|
|
announce: true
|
|
auto_connect: true
|
|
accept_connections: true
|
|
wwan:
|
|
interface: "phy0-sta0"
|
|
listen: true
|
|
announce: true
|
|
auto_connect: true
|
|
accept_connections: true
|
|
lan:
|
|
interface: "br-lan"
|
|
listen: true
|
|
announce: true
|
|
auto_connect: true
|
|
accept_connections: true
|
|
|
|
# 802.11s mesh backhaul between FIPS routers. These entries ship
|
|
# commented out so a stock install that never creates fips-mesh*
|
|
# logs no per-boot "interface missing" bind warning. Running
|
|
# 'fips-mesh-setup <radio>' creates the interface AND uncomments the
|
|
# matching block here (once per radio; radio0 -> fips-mesh0, radio1 ->
|
|
# fips-mesh1); 'fips-mesh-setup remove' re-comments it. Restart fips
|
|
# after — a transport whose interface is missing at startup is skipped,
|
|
# not retried. Dual-band routers can mesh on both bands at once —
|
|
# failover, not multipath: FIPS keeps one active link per peer, the
|
|
# other band stands by. The mesh runs OPEN (no SAE) with 802.11s
|
|
# forwarding off: FIPS's Noise handshake is the encryption and
|
|
# authentication, and FIPS is the routing layer. See
|
|
# docs/how-to/set-up-80211s-mesh-backhaul.md.
|
|
# mesh0:
|
|
# interface: "fips-mesh0"
|
|
# discovery: true
|
|
# announce: true
|
|
# auto_connect: true
|
|
# accept_connections: true
|
|
# mesh1:
|
|
# interface: "fips-mesh1"
|
|
# discovery: true
|
|
# announce: true
|
|
# auto_connect: true
|
|
# accept_connections: true
|
|
|
|
# Open "!FIPS" access SSID for phones and laptops running FIPS. These
|
|
# entries ship commented out so a stock install that never creates
|
|
# fips-ap* logs no per-boot "interface missing" bind warning. Running
|
|
# 'fips-ap-setup <radio>' creates the interface AND uncomments the
|
|
# matching block here (once per radio; radio0 -> fips-ap0, radio1 ->
|
|
# fips-ap1); 'fips-ap-setup remove' re-comments it. Restart fips after
|
|
# — a transport whose interface is missing at startup is skipped, not
|
|
# retried. The SSID is OPEN and isolated on purpose: FIPS's Noise
|
|
# handshake is the only security layer, and associated clients reach
|
|
# nothing but the FIPS handshake surface. See
|
|
# docs/how-to/set-up-open-access-ssid.md.
|
|
# ap0:
|
|
# interface: "fips-ap0"
|
|
# discovery: true
|
|
# announce: true
|
|
# auto_connect: true
|
|
# accept_connections: true
|
|
# ap1:
|
|
# interface: "fips-ap1"
|
|
# discovery: true
|
|
# announce: true
|
|
# auto_connect: true
|
|
# accept_connections: true
|
|
|
|
# Bluetooth Low Energy transport — requires BlueZ and the 'ble' feature.
|
|
# ble:
|
|
# adapter: "hci0"
|
|
# mtu: 2048
|
|
# advertise: true
|
|
# scan: true
|
|
# auto_connect: true
|
|
# accept_connections: true
|
|
|
|
# Outbound LAN gateway. dnsmasq forwards .fips queries to listen=[::1]:5353
|
|
# (configured by the fips init script). Requires IPv6 forwarding enabled.
|
|
gateway:
|
|
enabled: true
|
|
pool: "fd01::/112"
|
|
lan_interface: "br-lan"
|
|
dns:
|
|
listen: "[::1]:5353"
|
|
upstream: "[::1]:5354"
|
|
ttl: 60
|
|
pool_grace_period: 60
|
|
|
|
peers: []
|
|
# Static peers for bootstrapping (UDP or TCP):
|
|
# - npub: "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98"
|
|
# alias: "gateway"
|
|
# via_nostr: true
|
|
# addresses:
|
|
# - transport: udp
|
|
# addr: "test-us01.fips.network:2121" # IP or hostname (e.g., "peer.example.com:2121")
|
|
# - transport: udp
|
|
# addr: "nat" # Use node.rendezvous.nostr for Nostr/STUN hole punching
|
|
# connect_policy: auto_connect
|