mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-22 07:48:26 +00:00
6c90cf6c02
Add TorTransport in src/transport/tor/ supporting three operating modes: Outbound (socks5 mode): - Non-blocking SOCKS5 connect via tokio-socks with per-destination circuit isolation (IsolateSOCKSAuth) - TorAddr enum for .onion and clearnet address types - Connection pool with per-connection receive tasks, reuses TCP stream FMP framing - connect_async()/connection_state_sync()/promote_connection() follow the same non-blocking polling pattern as TCP transport Inbound (directory mode — recommended for production): - Tor manages the onion service via HiddenServiceDir in torrc - FIPS reads .onion address from hostname file at startup - No control port needed — enables Tor Sandbox 1 (seccomp-bpf) - Accept loop mirrors TCP pattern with DirectoryServiceConfig Monitoring (control_port mode and optional in directory mode): - Async control port client supporting TCP and Unix socket connections via Box<dyn AsyncRead/Write> trait objects - AUTHENTICATE with cookie or password auth - 8 GETINFO queries: bootstrap, circuits, traffic, liveness, version, dormant state, SOCKS listeners - Background monitoring task polls every 10s, caches TorMonitoringInfo in Arc<RwLock> for synchronous query access - Bootstrap milestone logging (25/50/75/100%), stall warning (>60s), network liveness transitions, dormant mode entry - Directory mode optionally connects to control port when control_addr is configured (non-fatal on failure) Operator visibility: - show_transports query exposes tor_mode, onion_address, tor_monitoring (bootstrap, circuit_established, traffic, liveness, version, dormant) - fipstop transport detail view: Tor mode, onion address, SOCKS5/control errors, connection stats, Tor daemon status section - fipstop table view: tor(mode) label with truncated onion address hint Security hardening: - Per-destination circuit isolation via IsolateSOCKSAuth - Unix socket default for control port (/run/tor/control) - Reference torrc with HiddenServiceDir, VanguardsLiteEnabled, ConnectionPadding, DoS protections (PoW + intro rate limiting) Config: - TorConfig with socks5, control_port, and directory modes - DirectoryServiceConfig: hostname_file, bind_addr - control_addr, control_auth, cookie_path, connect_timeout, max_inbound_connections Testing: - 69 unit + integration tests with mock SOCKS5 and control servers - Docker tests: socks5-outbound (clearnet via Tor) and directory-mode (HiddenServiceDir onion service) Documentation: - Transport layer design doc: Tor architecture, directory mode - Configuration doc: Tor config tables and examples
65 lines
1.9 KiB
Rust
65 lines
1.9 KiB
Rust
//! FIPS: Free Internetworking Peering System
|
|
//!
|
|
//! A distributed, decentralized network routing protocol for mesh nodes
|
|
//! connecting over arbitrary transports.
|
|
|
|
pub mod version;
|
|
pub mod bloom;
|
|
pub mod cache;
|
|
pub mod config;
|
|
pub mod control;
|
|
pub mod identity;
|
|
pub mod mmp;
|
|
pub mod noise;
|
|
pub mod utils;
|
|
pub mod node;
|
|
pub mod peer;
|
|
pub mod protocol;
|
|
pub mod transport;
|
|
pub mod tree;
|
|
pub mod upper;
|
|
|
|
// Re-export identity types
|
|
pub use identity::{
|
|
decode_npub, decode_nsec, decode_secret, encode_npub, encode_nsec, AuthChallenge, AuthResponse,
|
|
FipsAddress, Identity, IdentityError, NodeAddr, PeerIdentity,
|
|
};
|
|
|
|
// Re-export config types
|
|
pub use config::{Config, ConfigError, IdentityConfig, TorConfig, UdpConfig};
|
|
pub use upper::config::{DnsConfig, TunConfig};
|
|
|
|
// Re-export tree types
|
|
pub use tree::{CoordEntry, ParentDeclaration, TreeCoordinate, TreeError, TreeState};
|
|
|
|
// Re-export bloom filter types
|
|
pub use bloom::{BloomError, BloomFilter, BloomState};
|
|
|
|
// Re-export transport types
|
|
pub use transport::{
|
|
packet_channel, DiscoveredPeer, Link, LinkDirection, LinkId, LinkState, LinkStats, PacketRx,
|
|
PacketTx, ReceivedPacket, Transport, TransportAddr, TransportError, TransportHandle,
|
|
TransportId, TransportState, TransportType,
|
|
};
|
|
pub use transport::udp::UdpTransport;
|
|
|
|
// Re-export protocol types
|
|
pub use protocol::{
|
|
CoordsRequired, FilterAnnounce, HandshakeMessageType, LinkMessageType,
|
|
LookupRequest, LookupResponse, PathBroken, ProtocolError, SessionAck, SessionDatagram,
|
|
SessionFlags, SessionMessageType, SessionSetup, TreeAnnounce,
|
|
};
|
|
|
|
// Re-export cache types
|
|
pub use cache::{CacheEntry, CacheError, CacheStats, CoordCache};
|
|
|
|
// Re-export peer types
|
|
pub use peer::{
|
|
cross_connection_winner, ActivePeer, ConnectivityState, HandshakeState, PeerConnection,
|
|
PeerError, PeerSlot, PromotionResult,
|
|
};
|
|
|
|
// Re-export node types
|
|
pub use node::{Node, NodeError, NodeState};
|
|
|