mirror of
https://github.com/jmcorgan/fips.git
synced 2026-08-09 00:04:54 +00:00
Johnathan Corgan
ae0f791dbc
Replace the 3-message XK handshake with XX for FSP session establishment. XX requires no prior knowledge of the peer's static key — the responder's identity is revealed in msg2, the initiator's in msg3. Key changes: - session.rs: XX initiator/responder, post-handshake identity verification using x-only key comparison (parity-independent for npub compatibility), negotiation payload in msg2/msg3 (FSP version [0,0], features=0) - Rekey: switched from XK to XX for FSP rekey handshake - timeout.rs: suppress msg1 resends when target peer is already promoted, preventing cross-connection session mismatch from duplicate handshakes - Test template: discovery backoff 3s and handshake timeout 10s for faster convergence in integration tests - Integration test timeouts restored to 45s (ping) and 60s (rekey) Squashed commits: - Switch FSP handshake from Noise XK to XX - Fix integration test convergence by reducing discovery backoff - Fix cross-connection session mismatch from msg1 resend - Fix FSP identity verification parity mismatch
35 lines
712 B
YAML
35 lines
712 B
YAML
# FIPS Node {{NODE_NAME}} configuration ({{TOPOLOGY}} topology)
|
|
#
|
|
# Identity: {{NPUB}}
|
|
|
|
node:
|
|
identity:
|
|
nsec: "{{NSEC}}"
|
|
|
|
discovery:
|
|
backoff_base_secs: 3
|
|
rate_limit:
|
|
handshake_timeout_secs: 10
|
|
|
|
tun:
|
|
enabled: true
|
|
name: fips0
|
|
mtu: 1280
|
|
|
|
dns:
|
|
enabled: true
|
|
bind_addr: "127.0.0.1"
|
|
|
|
transports:
|
|
udp:
|
|
bind_addr: "0.0.0.0:2121"
|
|
mtu: 1472
|
|
# recv_buf_size: 2097152 # 2 MB (default)
|
|
# send_buf_size: 2097152 # 2 MB (default)
|
|
# Note: The kernel clamps socket buffers to net.core.rmem_max / wmem_max.
|
|
# Ensure these sysctls are >= the configured buffer sizes:
|
|
# sysctl -w net.core.rmem_max=2097152
|
|
# sysctl -w net.core.wmem_max=2097152
|
|
|
|
peers:
|
|
{{PEERS}} |