The peer ACL changelog entry joins master's existing Links and
transports section under Security rather than opening a second one.
testing/root-tests.sh carries master's filters rather than maint's, in
two groups: the TUN warning, DNS responder and gateway mesh tests (18),
and the Linux TUN namespace tests (13). It needs ip, nft and sysctl
here, and its probe also writes a sysctl inside the namespace, as four
of the TUN tests do, so a container with a read-only /proc/sys is
reported as such.
GitHub's Linux job ran those groups as two steps; they are now one step
that runs the script under sudo. ci-local.sh takes --root-tests or
FIPS_CI_ROOT_TESTS=1 alongside --baremetal and --slow-tests, and --rerun
rejects both forms. The README section sits beside the known-defect
lane, and the comments that said which runners run these tests now name
the script.
The held-SYN re-clamp and ingress fragmentation for paths under 1280
are ported rather than taken as written: on master the IPv6 adapter
hands the node compressed datagrams and the node judges them in
handle_datagram.
- The fragmenter moves to src/ipv6tun/ipv6_frag.rs with its body and
tests unchanged, listed as one of the adapter's decision modules.
- outbound.rs gains can_split, split and reclamp, pure functions that
rebuild a held datagram's packet, fragment it or clamp its SYN, and
compress the result. mss.rs gains flow_ceiling, the per-flow MSS
ceiling the TUN reader and the release-time re-clamp now share.
- handle_datagram lets a datagram over the node-wide limit or an
established session's path MTU carry on whole when it can be
fragmented. The established send and the flush of held datagrams go
through send_tun_packet, which sends a datagram whole or as fragments
by the smaller of the node's own limit and the session's path MTU, and
the flush clamps a held SYN again from the node's own path MTU map.
- A Packet Too Big for a packet over 1280 on a path under 1280 reports
1280, both for a datagram the node refuses and for one the adapter
answers itself.
- The new node tests are ported to master's TUN taps and compressed held
payloads. The two existing Packet Too Big tests that now use a
Hop-by-Hop header give it a real length, since master's ICMPv6 builder
does not answer a packet whose extension headers run past its end.
The host-link tests of refusals send a packet with a Hop-by-Hop header
where they mean a packet that is refused rather than fragmented, and
one of them also checks that a fragmentable oversized packet to a key
the node cannot resolve is told no route.
The IPv6 adapter design document now says that on this structure the
node decides fragmentation at its two refusal sites and splits a
datagram where it sends it, that it clamps a held SYN again from its
own path MTU map when it releases the datagrams it held, and that both
apply to an app-owned TUN because the node holds and releases the
datagrams of either path. It also names the functions an app-owned
TUN's packets pass through on this structure, Handles::outbound and
handle_datagram, and the MTU document says it is the ingress node that
fragments.
Architectural and protocol-level explanations for FIPS — the why
and the how behind the wire and the system. For wire formats and
configuration keys, see reference/. For task
recipes, see how-to/. For end-to-end lessons, see
tutorials/.
Reading Order
Start with fips-concepts.md for the
novice-friendly framing of what FIPS is and why, then move to
fips-architecture.md for the protocol stack,
identity model, and two-layer encryption walkthrough. From there,
follow the protocol stack from bottom to top. After the stack,
fips-mesh-operation.md explains how the
pieces work together at runtime. Cross-cutting and supporting
documents cover specific subsystems in detail.
Johnathan Corgan
26cfb4fad3