Johnathan Corgan
a26423b0ed
Carries the seven security fixes up from the mainline. Six of them apply here; the seventh does not, because this branch's FSP rekey is Noise XX where the mainline's is XK. Landed complete: the coordinate-cache guard and its test, the flap dampening re-arm with its clamp and its reporting, the traversal target filter, the signal freshness bound, the path MTU floor with its cache release, and the routing-signal sender binding. The floor constant is where the mainline moved it, in the protocol layer with the upper layer re-exporting it. Deferred to a follow-on commit: never destroy an established session on an unauthenticated setup message. Its established-session arm is written against XK, whose msg1 and msg3 handling and whose dual-initiation states differ from this branch's, so the arm has to be re-implemented rather than merged. Everything that fix touches is held back with it — the clock-free core's abandonment decision and its snapshot field, the shell arm that executes it, the three session-entry helpers, and the tests and test helper that drive them — so the branch does not carry half of it. The typed rejection variants and the counters merged cleanly and read zero until the fix lands. Two mechanical adaptations were needed for the fixes that did apply. The routing-signal test helpers build a handshake in a given lifecycle state and had to use this branch's XX constructors, which take no pinned remote static. The shared test-node builder gained an MTU parameter on the mainline; here it delegates to the builder this branch already had, and its two existing callers pass the value the one-argument version hardcoded, so their behaviour is unchanged. Green: fmt, build, clippy --all-targets -D warnings and test --lib at 1903 passed.
FIPS Documentation
FIPS (Free Internetworking Peering System) is a self-organizing encrypted mesh network built on Nostr identities, capable of operating over arbitrary transports — local networks, the public internet, Tor, Bluetooth, or point-to-point links — without central infrastructure.
With FIPS, your machine becomes a node in the mesh with a self-generated cryptographic identity. There are two ways to deploy it.
As an overlay on top of existing IP networks, FIPS lets your node reach any other FIPS node wherever it sits — behind a NAT, on a different ISP, on a phone over cellular, on a laptop with only Bluetooth in range, or behind a Tor onion. The mesh forwards IPv6 traffic transparently and end-to-end encrypted, with no central VPN concentrator or coordinating server.
From the ground up over raw Ethernet, WiFi, or Bluetooth, FIPS provides a complete permissionless network without any pre-existing IP infrastructure, ISP, or DNS. Any node that joins the link gets routable IPv6 addresses, peer discovery, and a path to every other node automatically.
Either way, existing networking software runs over it unchanged: SSH, HTTP servers, file transfer, anything IPv6-native works the same way it would on a local network.
New to FIPS? Start with the Getting Started guide.
Documentation Sections
Tutorials
If you are starting from scratch and want a guided path to a working mesh, go here.
How-To Guides
If you have a specific task in mind — enabling a feature, deploying a component, diagnosing a problem — go here.
Reference
If you need to look up wire formats, configuration keys, command flags, or counter inventories, go here.
Design
If you want to understand how the mesh self-organizes, why FIPS makes the choices it does, or how the pieces fit together, go here.