FIPS v0.5.0
Released: 2026-08-30
v0.5.0 is a feature release, the first since v0.4.0. It adds two new
supported platforms, a new way for applications to use the mesh, and a set
of smaller additions across transports, diagnostics and packaging. It also
renames part of the configuration surface, carries four fixes for bugs that
shipped in earlier releases, and adds four security fixes specific to this
line.
Upgrading. Nodes upgrade in any order. A v0.5.0 node and a v0.4.x node
peer, rekey and route normally, so there is no flag day and no coordination.
If you are coming from v0.4.1 or earlier, read the v0.4.2 notes too: v0.5.0
contains that release, and most of this cycle's security work is in it.
Platform support
A port to FreeBSD, on x86_64, has been made, with a native package. The
daemon, fipsctl and fipstop build and run there; fips-gateway stays
Linux-only. One thing this paves the way for is to create FIPS native
support in FreeBSD-based firewall appliances, such as OPNsense and pfSense.
Android support is officially provided in this release, but for use as an
embedded crate in other applications rather than as a standalone daemon.
Android applications own the TUN adapter, and the FIPS crate provides a Rust
API to send and receive packets over the mesh. The Bluetooth LE transport is
now supported on Android, and is interoperable with Linux.
Native API for datagrams
The FIPS mesh sends datagrams between cryptographic endpoints, and the main
way this has been used up until now has been to emulate an IPv6 network
adapter and tunnel IPv6 packets over it. This has allowed existing IPv6
applications to use the mesh without any changes.
The native datagram API lets an application written to it communicate
directly over the mesh, addressing a peer by public key and exchanging
datagrams on a file descriptor. It bypasses the local IP stack and the
emulated IPv6 adapter entirely. How nodes peer with each other does not
change, and nothing on the wire changes.
Other changes
OpenWrt gains an 802.11s mesh between routers and the open !FIPS client
SSID, both opt-in. The Bluetooth LE transport is refactored so Linux and
Android share one implementation with a backend for each. A peer address may
name which instance of a transport it belongs to, so a node running several
listeners of one type can be dialled on the right one.
fipsctl gains two subcommands: probe, which reports in five stages
whether one target is reachable and where the attempt stopped, and
address, which derives a node's mesh address from a key file with no
daemon running. Shutdown now drains before it closes, and an optional
profiler measures where the maintenance tick spends its time.
The Nix flake gains a NixOS module and an overlay, so a flake consumer
enables the daemon with one line rather than hand-rolling a systemd unit.
FreeBSD details
The .pkg is published on the release page. No aarch64 artifact is produced
and that combination is not verified here.
FreeBSD follows the macOS install layout: /usr/local/etc/fips for config,
hosts, peers.allow, peers.deny and fipsctl keygen output, and
/var/run/fips for the control socket. Packaging under packaging/freebsd/
builds through make freebsd and ships rc.d services, a fips
control-socket group, service stop and restart across pkg upgrade, and
.fips DNS integration for local_unbound, unbound and dnsmasq. mDNS
LAN discovery works, by way of an mdns-sd bump to 0.20 that picks up the
first socket-pktinfo release building on FreeBSD.
Two changes here reach every platform. That mdns-sd bump applies to all
targets, and the daemon now disables ANSI color in its logs when stdout is
not a terminal.
Contributed by @fr34aky
(#129).
The native datagram API
The API is off by default and its surface may still change, so it ships for
client authors to build against and report back on.
The wire needs no change and gets none. Every FSP data packet has carried a
port pair inside its AEAD envelope since v0.2.0, and port 256 is simply the
IPv6 shim, so what was missing was a way for a program to ask for a port of
its own and be handed the traffic.
The x-only public key is the address, and an npub is that key written in
bech32, so converting between them is a local encoding rather than a lookup
or a name service. The 16-byte node address that travels on the wire is a
truncated hash of the key, does not invert, and appears nowhere a client can
see.
The API is a direct, best-effort interface to FSP, the session protocol the
mesh already speaks. FSP authenticates and encrypts end to end, and it
delivers datagrams on a best-effort basis: no acknowledgement, no
retransmission, no ordering guarantee and no flow control between the two
ends. A program that needs any of those builds them itself, or runs an
ordinary reliable protocol over the fips0 adapter instead.
The interface style is deliberately close to Berkeley sockets. A program
calls connect for a flow to a public key and a port, or bind for a port
to receive flows on, and from there uses ordinary socket calls on the
descriptor it holds.
A listener is a descriptor. The daemon writes one message per arrival to it,
carrying the new flow's descriptor and the peer's address, so poll,
select and epoll work on a listener and accepting is a recvmsg. There
is no accept command and no reject command: refusing a flow is closing the
descriptor you were handed.
The Rust surface mirrors std::net, with FipsStream::connect,
FipsListener::bind, incoming, accept, io::Result and an errno
mapping rather than a bespoke error type, plus set_nonblocking, AsFd and
four deadline methods under the names and signatures std::net uses for the
same jobs.
One rule has no counterpart in Berkeley sockets and a client author must
know it: the v1 wire carries no half-close. Nothing peer-driven ever
closes a flow, so a server written to read until the flow ends waits for a
signal that cannot arrive.
The listener uses SOCK_SEQPACKET on Linux and SOCK_DGRAM on macOS and
FreeBSD; both keep the message boundaries the API's contract with its
clients rests on. macOS does not implement SOCK_SEQPACKET for AF_UNIX at
all. FreeBSD accepts the constant and returns a socket that is not an
atomic-record socket, so consecutive messages coalesce and a zero-length
message is dropped rather than delivered; both were measured on the FreeBSD
15.1 image rather than reasoned about. The three kernels signal a closed
peer differently and were measured too, so the receive path treats a Darwin
or FreeBSD ECONNRESET as end of file alongside the POLLHUP and zero-byte
read that Linux gives.
Contributed by @jmcorgan (Johnathan
Corgan).
Start with the walkthrough, then
how to write a client; the
reference carries the full surface.
OpenWrt
Two capabilities land together here, and the second is stacked on the first.
Both arrive as opt-in helpers: a package must not commandeer a router's
radios on install, so neither runs unless you run it.
802.11s mesh backhaul
FIPS can now be the encryption and routing layer over router-to-router radio
links. The mesh runs open, with mesh_fwding 0: SAE would duplicate the
Noise layer and force ath10k into raw mode, and the FIPS spanning tree is
the routing layer, so the 802.11s link is deliberately left as a bare L2
neighbor link and FIPS provides all encryption, authentication and routing
over it.
fips-mesh-setup is a UCI helper that creates a mesh point per radio:
radio0 becomes fips-mesh0, radio1 becomes fips-mesh1, with a
free-index fallback and a collision guard. A dual-band router gets one
instance per radio, and FIPS treats the two paths as failover rather than
multipath: cross-connection resolution keeps one active link per peer and
the second band stands by, re-establishing after keepalive timeout.
The shipped fips.yaml carries the matching mesh0 and mesh1
Ethernet-transport entries commented out, so a stock install that never
creates the interfaces logs no per-boot interface-missing warning. The
helper uncomments the block when it creates the interface and re-comments it
on remove. Two silent non-peering causes found in the field are surfaced by
the helper's warnings: a radio left on auto channel, and a sta interface
dragging the radio to its upstream access point's channel.
Contributed by @Origami74
(#123). The full procedure
is in
the 802.11s backhaul how-to.
The open !FIPS access SSID
Stacked on that backhaul, every FIPS router can broadcast the same open
!FIPS SSID, forming one standard ESS that phones and laptops save once and
roam between natively, with the Noise IK handshake as the only security
layer. The leading ! sorts it to the top of alphabetically ordered network
pickers. The encryption type must be uniform across routers or clients treat
the ESS as separate saved networks.
fips-ap-setup creates the fips-ap0 open access point on an isolated
network. IPv6 is a static ULA /64 announced by router advertisement, so
addressing is stateless SLAAC with DHCPv6 off; IPv4 is a DHCPv4 lease out of
a fixed 10.21.<N>.0/24, deliberately identical on every router so a
roaming client's lease stays valid. Both sit behind a locked-down fips_ap
firewall zone with no path to br-lan or the WAN, passing only DHCPv4,
ICMPv6, mDNS and the FIPS transports. There is no internet by design, so
phones keep cellular as their default route, and the addressing is what an
Android client's connectivity check needs to stay associated. The helper
also uncomments the node.rendezvous.lan block, since a phone app cannot
open raw Ethernet sockets and DNS-SD is how it finds the daemon.
Contributed by @Origami74
(#126). The full procedure
is in
the open access SSID how-to.
Bluetooth LE peering
The BLE transport has been refactored so the code common to Linux and
Android is implemented once, with a separate backend for each platform. Most
of the work is contributed. The transport compiles on every glibc Linux
target and on Android, and is excluded on musl; the gate is ble_available,
and a platform with no concrete backend now fails the build rather than
compiling a transport that starts, reports itself up and never peers.
A peer is recognised by node identity rather than by its link address.
Resolvable private addresses rotate continually and modern phones use them
by default, so every rotation presented as a brand-new device and none of
the already-connected guards could tell.
The L2CAP PSM is now decided by the backend. BlueZ is the exception in
letting an application choose the PSM it binds: Android and macOS both
return an OS-assigned one that cannot be requested, and before a connection
exists there is no channel on which to be told it. So listen reports the
PSM it actually bound, the advertisement carries it alongside the 128-bit
FIPS service UUID, and a dialer takes it from the scan, falling back to the
configured value for a peer that advertises none.
Probe retry is bounded. A discovered address that failed to connect was
re-dialled every cooldown for the life of the process, and because BLE
hardware caps concurrent connections at roughly four to ten, a handful of
unreachable peers starved discovery of everything behind them. Failing
addresses now back off by powers of two and the retry book itself is capped,
so rotating private addresses cannot grow it without bound. Each connect
outcome has its own counter and structured log line carrying the role, the
outcome, the PSM dialled and how long the peer took to conclude, which is
what distinguishes a peer out of range from one being dialled at the wrong
PSM.
Inbound handshakes run off the accept loop, eight in flight, aborting the
oldest at the bound. The exchange previously ran inline, so a peer that
connected and then said nothing held the loop for the full 5-second deadline
and the effective inbound concurrency was one.
Node and transport control
Shutdown now drains before it closes
On the shutdown signal the node broadcasts Disconnect to all peers and then
keeps serving for a bounded window, exiting early once all peers are gone.
The window is the new node.drain_timeout_secs, default 2 seconds. Teardown
was previously immediate.
Under systemd or launchd this shows up as a stop taking up to two seconds
longer than it used to. If your service manager has a short stop timeout, or
you have tooling that expects the process to be gone immediately, that is
the thing to check. Setting node.drain_timeout_secs: 0 restores the old
behaviour. The immediate stop path used by non-daemon callers is unchanged.
A peer address may name a transport instance
A peer address may name which instance of a transport it belongs to, as
transport: "udp/aware", where the part after the slash is the key the
transport was configured under. A node running several instances of one type
could not be told them apart by a dialer: both bind wildcard sockets, so the
address-family test matched either and selection fell through to the lowest
transport id. One socket carried every dial and the other never carried
traffic. A bare type is unqualified and matches any instance, which is what
every existing configuration and caller produces, so nothing changes for a
node that does not use the syntax. A qualified name is never substituted
with a different instance, since that is the wrong-lane dial the syntax
exists to prevent, and the configuration validator rejects a name that no
configured transport answers to rather than letting the address be skipped
invisibly at every dial.
Diagnostics
fipsctl probe
For one target, where it sits in the spanning tree relative to this node and
whether this node can actually reach it. Five stages report separately,
bloom, discovery, path, session and rtt, because one verdict
covering several findings is what sends an operator to the source: "no
peer's filter claims this address" says the mesh has never heard of the
target, while "a filter claimed it and nothing answered" says the opposite.
The probe opens an FSP session, waits for one MMP receiver report to yield a
round-trip time, and tears down only what it opened; a session that existed
before the probe started is left alone. The path it prints is the
least-common-ancestor walk computed from the two sets of coordinates. That
is the worst-case fallback route, not necessarily the route a packet takes:
a cut-through between peers can deliver in fewer hops, so the tree distance
is an upper bound. Nothing here changes the wire format. --json emits
exactly one document at the end, so a script parsing the report does not
have to skip past progress output.
fipsctl address
fipsctl address [npub|hostname] prints a node's fd00::/8 mesh
address and nothing else, without contacting the daemon. With no argument it
derives the local node's address from fips.key in the default key
directory, falling back to the world-readable fips.pub beside it; --key PATH names a key or public key file elsewhere. This lets an installer or an
image build write a mesh address into a config file at a point where no node
is running and none can be, and keeps the derivation in one place rather
than reimplemented by whatever needs it.
Maintenance tick profiling
The rx-loop tick arm runs twenty-five unconditional housekeeping steps on
one runtime thread and is polled last, so anything slow in it holds inbound
packets, TUN traffic and control commands behind it. A new tick-body
profiler measures that, on a live node, with no restart.
It lives behind the new profiling Cargo feature and is off by default.
With the feature off, the instrumentation macro is a pure pass-through, so a
default build carries no timing code on the tick path. With it on, fipsctl profile tick on [--dir PATH], off and status start and stop a capture
at runtime. Each capture writes one tab-separated file, by default under
/var/log/fips and capped at 32 MB, carrying per ten-second interval the
exact count, max and total for every step, the whole-tick span, and gauges
for ticks, peer count, the gap between successive tick-arm entries and the
resulting arm-starvation delay.
Getting an instrumented build installed is supported directly:
packaging/debian/build-deb.sh --features <list> builds the .deb with a
Cargo feature list, and the auto-derived dev Version gains a matching
+<features> marker so a feature build and a default build of the same
commit are no longer indistinguishable. The marker sorts above the unmarked
build, so installing a feature build is an upgrade and reverting to the
default build is a downgrade: revert with dpkg -i, not apt install.
The packaged systemd units gained LogsDirectory=fips so the capture
directory is created and cleaned up declaratively.
Packaging and deployment
The NixOS module and overlay
The flake now exposes a NixOS module and an overlay, so a flake consumer
enables the daemon with one line instead of hand-rolling a systemd unit.
overlays.default adds pkgs.fips; nixosModules.default provides
services.fips.* with enable, package, configFile, openFirewall
(UDP 2121 and TCP 8443) and dns.enable, which routes .fips to
[::1]:5354 through systemd-resolved declaratively rather than with setup
and teardown scripts. packaging/nixos/README.md carries a full consumer
flake.nix. Contributed by @Origami74
(Arjen).
For app and embedding developers
FIPS can now be embedded in an application, and that is how Android is
supported: as an embedded crate rather than as a standalone daemon. There is
no Android daemon artifact and no host-app integration guide. What ships is
a library surface that compiles for Android and a pair of entry points for
an app that owns its own tunnel.
The daemon's desktop transports and TUN operations are now gated by
target_os rather than by Cargo features, so a plain cargo build compiles
for every target with no flags, and Android self-excludes the raw Ethernet
transport exactly as Windows already did. No Cargo features are introduced
and desktop builds are unchanged.
Node::enable_app_owned_tun() gives an embedder that owns the TUN file
descriptor, an Android VpnService for instance, a channel pair for
exchanging IPv6 packet bytes with FIPS, instead of FIPS creating a system
TUN device. start() then performs no system-TUN and no CAP_NET_ADMIN
operations. Packets entering this way bypass handle_tun_packet, so the
embedder must push only fd00::/8 destined packets and must clamp TCP MSS
on outbound SYNs.
Node::dns_local_addr() is the DNS companion. An embedder whose resolver is
pointed into the tunnel has no system socket aimed at the built-in .fips
responder, so the accessor reports the address read back off the bound
socket: dns.port = 0 therefore yields the kernel-assigned port. It returns
Some only while the responder is up. Read it once, after start() returns
and before the node is moved into a background task; it is not a liveness
feed.
Both contributed by @Origami74
(#127,
#136). CI cross-compiles the
library for aarch64-linux-android and runs clippy against it, which is a
compile gate. Nothing executes on Android in CI.
Node::enable_app_owned_udp_fd() is a third such entry point. Some hosts
associate a socket with one interface or network and steer inbound traffic
by that association rather than by destination address, and the socket
option that corrects it depends on host state FIPS has no basis to reason
about, so the descriptor goes to whoever does. One descriptor arrives per
UDP transport that binds, labelled with the instance name it was configured
under, so an embedder running several listeners can tell them apart. FIPS
keeps owning the socket. Unix only, since the Windows UDP backend has no
descriptor.
Upgrade notes
This section is the operator-actionable list. Everything in it applies
to every platform.
A node with no working transport now fails to start
Node health is determined once startup completes, instead of every node
unconditionally reaching a single running state. Zero transports up is
now fatal: the node tears down cleanly and the daemon exits with an
error. Previously such a node came up, reported itself running, and
served nothing.
fipsctl show transportsOn the running v0.4.x node, that lists every transport instance with its
state. If it lists none, or lists none in an up state, that node will
fail to start on v0.5.0 and the fix is a working transport, not a
rollback. The common causes are a transports: block where every entry
is commented out, and an Ethernet transport naming an interface that
does not exist on the box, which logs an interface-missing warning and
does not come up.
A node with at least one transport up, and some other configured child
that failed, comes up degraded and serving, with a warning naming
what failed. That covers a second or later transport, Nostr, mDNS, TUN,
DNS, and the worker pools. A child you never asked the node to run does
not count against it.
Three new node states are visible through the control socket
Degraded, Failed and Draining join the published node state and
show up in control queries. Degraded is operational, Failed is not.
If you have a monitor that matches the node state string exactly, teach
it the three new values before you upgrade.
Exit detection also re-evaluates health at runtime for the DNS task, the
two TUN threads and mDNS, so a child that dies after a healthy start now
shows as degraded rather than staying green.
The node.discovery.* config table is split
node.discovery.* carried two unrelated things: the scalars that govern
mesh lookup, and the settings that govern peer rendezvous. They are now
separate tables.
node.lookup.*takes the mesh-lookup scalars:ttl,
attempt_timeouts_secs,recent_expiry_secs,backoff_base_secs,
backoff_max_secs,forward_min_interval_secs.node.rendezvous.*takes peer rendezvous:nostr.*andlan.*.
A deployed node.discovery: block still loads. It is folded into
the new tables at startup and behaves identically, with a one-time
deprecation warning on the fips::config target naming the moves. The
legacy block will be removed at the v2 cutover, so migrate your
fips.yaml rather than leaving it.
Two of these keys are ones you may have adopted only one release ago. If
you are coming from v0.4.2, then
node.discovery.nostr.max_concurrent_offers_per_npub and
node.discovery.nostr.signal_ttl_secs are now
node.rendezvous.nostr.max_concurrent_offers_per_npub and
node.rendezvous.nostr.signal_ttl_secs.
One further rename, in the same vocabulary: the Ethernet transport's
per-interface discovery flag is now listen, pairing with the
existing announce flag as receive and transmit. The old discovery:
key is still accepted through a serde alias, so deployed configs load
unchanged, but a config the daemon re-emits will carry listen:.
Every shipped sample, guide and reference now teaches the new spelling.
One exception is worth knowing about on OpenWrt: /etc/fips/fips.yaml
is an opkg conffile there, so upgrading a router keeps its existing copy
and the new sample is never installed. A router upgraded from an earlier
release will still show the old commented discovery: examples in its
config file. Nothing breaks, since the old key parses, but the file on
the router is not the file in the package.
Tracing targets moved, so RUST_LOG filters go blind rather than error
The internal restructuring moved modules, and tracing targets follow
module paths, so the targets moved with them:
fips::discovery::nostr::*is nowfips::nostr::*- mDNS is now
fips::mdns::* fips::treeis nowfips::proto::stpfips::bloomis nowfips::proto::bloomfips::protocolis nowfips::proto::*- the mesh-lookup subsystem moves from
fips::discoveryto
fips::proto::lookup
An existing RUST_LOG filter naming an old target still parses. It
simply stops matching. The symptom is missing log lines rather than an
error, and a filter that has gone blind looks exactly like a subsystem
that has gone quiet, so update RUST_LOG settings, journal-watch
recipes and log-scraping alerts as part of the upgrade. Four targets are
named explicitly in the source rather than derived from a module path
and are unaffected: fips::config, fips::instr,
fips::node::handlers::handshake and fips::node::handlers::rekey.
The discovery metric family is now lookup
The mesh-lookup control-metrics family is emitted under the key lookup
in fipsctl stats metrics and show routing. The former discovery
key is still emitted as a deprecated alias carrying identical counters
during the migration window, and will be removed. Point dashboards and
alerts at lookup.*.
fipstop's Routing State pane follows: its Discovery Requests and
Discovery Responses sections are now Lookup Requests and Lookup Responses. The counters are unchanged, so an operator who knows the
pane by its old labels is reading the same numbers under new names.
The first handshake resend no longer follows its config key
node.rate_limit.handshake_resend_interval_ms no longer governs the
first outbound handshake resend, which is now armed from a hardcoded
1000 ms constant in the peer state machine. The key still governs the
second and later resends, alongside
node.rate_limit.handshake_resend_backoff and
node.rate_limit.handshake_max_resends. The constant equals the shipped
default of 1000, so a deployment that never overrode the key sees no
change. A deployment that raised or lowered it will find the first
resend still firing at 1000 ms.
For library consumers
These changes are source-breaking for code that depends on the fips
crate. Nothing about the behaviour of the shipped binaries changes,
nothing on the wire changes, and an operator who runs the packaged
daemon and tools is unaffected. If you do not build against the crate,
skip this section.
The protocol layers were restructured into sans-IO cores with the I/O
kept in a thin shell. The consequence for the public surface:
- The crate-root modules
bloom,discovery,mmp,protocoland
treeare gone. The protocol cores moved into an internalproto
module and are reached through crate-root re-exports: tree types
throughproto::stp, bloom types throughproto::bloom, and the FSP,
STP, lookup, routing and FMP wire types through their matching
proto::*submodules.PromotionResultandcross_connection_winner
come fromproto::fmprather than frompeer. - The crate-root
HandshakeState,PeerConnection,PeerSlotand
ProtocolErrorre-exports are removed. TheHandshakeStateremoved
here is the peer connection-phase enum, not the Noise handshake type
of the same name, which is untouched and still lives at
fips::noise::HandshakeState. ProtocolErroris replaced byfips::Error. ItsMalformedvariant
now carries a&'static strrather than aString, and it gained
BadSizeClass,BadCoordandBadBloomvariants, so the diagnostic
text changed with it.PeerSlotand thePeerConnectionresend API were unused and are
deleted.Node::connections()is nowpub(crate)and yields the internal peer
machine rather than aPeerConnection. A consumer that walked links
through it should useNode::peers(),Node::get_peer()and
Node::peer_count()overActivePeer, all of which remain public.
Two new crate-root modules, nostr and mdns, own peer rendezvous and
LAN discovery, and the crate root gains the is_punch_packet helper and
the CoordError, MtuExceeded, COORDS_REQUIRED_SIZE and
MTU_EXCEEDED_SIZE exports.
Data plane and diagnostics
- Batched macOS receives on connected UDP peer drains. The connected
UDP path now usesrecvmsg_x(2), matching the wildcard UDP receive
path instead of issuing onerecv(2)syscall per queued datagram.
Contributed by Martti Malmi (@mmalmi,
#135). - Allocation-free next-hop selection. Routing next-hop selection
visits borrowed peers and coordinates instead of allocating candidate
snapshots for each forwarded packet. Contributed by Martti Malmi
(@mmalmi,
#134). - A connected UDP socket that cannot open now names the syscall and
the address. The local address forbind, the peer address for
connect. Both paths previously returned a bare OS error that the
caller wrapped identically, so a field report ofAddress already in usecould not be attributed to either, and the two have entirely
different causes. A node at roughly 245 peers was emitting this three
times a second across nine peers with no way to diagnose it. - The sub-floor path-MTU refusal warning carries its correlator. The
warning raised when a lookup response carries a path MTU below the
actionable floor now names the request it refused, as arequest_id
field on the log line. Only the log line changes: the response is
still accepted, the coordinates are still cached, the sub-floor value
is still discarded, and the same counter is still charged.
Notable bug fixes
This release carries four fixes for bugs that shipped in previous
releases. Every other fix in the range either shipped in v0.4.2
or repairs something that was introduced and corrected within this
development cycle, and never reached a released version. The CHANGELOG
has the complete list.
-
The macOS control socket lands in
/var/run/fips, not/tmp. The
packaged macOS daemon now recreates and binds its control socket at
/var/run/fips/control.sock. A privileged macOS process selects that
private runtime path before its leaf exists, so bind creates it, and
clients follow once it is there. Socket setup now changes ownership
and mode only for a private parent directory it creates or recognizes
as a canonical FIPS runtime directory. Previously the packaged daemon
fell through to the shared/tmp/fips-control.sockpath after every
boot, and because socket setup changed the parent directory
unconditionally, the root daemon also took group ownership of/tmp
itself. Contributed by
@erskingardner
(#138). -
fipsctl disconnectnow closes the transport connection, not only
the peer. It notified the peer and freed every node-side structure,
sessions, indices, links, address mapping, tree and bloom state, and
never touched the transport, so on a connection-oriented transport
(TCP, Tor, Nym, BLE) the pool entry, the socket and its inbound-slot
accounting outlived the peer the node had just forgotten, until the
far end closed or the receive loop errored. An operator who
disconnected a peer to free a slot did not free the slot. UDP,
Ethernet and loopback are unaffected, theirclose_connectionbeing
the connectionless no-op. Still not addressed:disconnectreports
peer not foundfor an identity that is only mid-handshake. -
fipsctl connectnow tries the address it was given for a peer the
node is already connected to, instead of reporting success without
doing anything. The command built an ephemeral peer configuration and
handed it to the ordinary dial path, which returns success the moment
the peer is already held, so an operator moving a peer onto a freshly
provisioned link had no way to make the node use it: the peer stayed
where it first authenticated until that path died. The address is now
tried as an alternate path alongside the live one, so promotion
happens only after the alternate handshake authenticates and a wrong
address cannot displace a healthy link. The response gains an additive
refreshedfield.connectstays ephemeral: the peer is not written
to configuration and gets no auto-reconnect. -
A path MTU measured on one link no longer clamps a peer that has
moved to another. Every writer of the per-destination path-MTU cache
keeps the smaller of the existing and incoming value, which is right
while a peer stays put, but the entry was keyed by destination alone.
A peer first reached over a narrow link stayed clamped to that link's
ceiling for the lifetime of the process: when it later became
reachable over a wider transport, the re-seed saw a tighter existing
value and declined, and traffic kept running at the old ceiling with
nothing reporting it, because the clamp was doing exactly what it was
told. The node now records which transport last seeded each
destination and treats a seed from a different one as authoritative.
Security
Most of this cycle's security content shipped in v0.4.2, which v0.5.0
contains: session and handshake authentication hardening, path MTU
bounding, routing-signal gating, private key material protection and
clearing, gateway DNS answer validation, the supply-chain work, and the
nineteen further fixes from two security reports received during the release
cycle. If you are upgrading from v0.4.1 or earlier, all of that arrives with
this release, and the [0.4.2] section of the CHANGELOG is where it is
enumerated.
Four items are specific to this line, because the code they touch
exists only here.
An inbound onion connection no longer leaks its inbound slot. The Tor
accept loop spawned the per-connection receive task before inserting the
pool entry and bumping the counter, so a remote that reset immediately
let the receive task reach its cleanup first: the removal found nothing,
the decrement never fired, and the increment landed with nothing left to
undo it. Enough of those and max_inbound rejected every further onion
connection while the pool was visibly empty. The readiness barrier the
TCP accept loop already used is now applied here too.
The --dir given to profile tick on is confined to /var/log/fips
when the daemon runs as root. The control socket is reachable by the
fips group, which the security model treats as strictly weaker than
root, and the directory travelled from the socket into a root
create_dir_all with no validation. This affects only a
--features profiling build; the subcommand is absent from a stock
package. The capture sink also no longer writes over whatever is already
at its path, and capture files are created private to their owner.
Two further defects were found while merging the v0.4.2 security work up
into this line, and they were already present here in a different shape
than on the maintenance line: the socket-bind policy, which this line had
centralized across three sockets rather than one, and a shared
per-address rate limiter that swept its whole map on every admission with
no ceiling. Fixing them here reaches further than the original fixes did.
One piece of supply-chain hygiene does belong to this release. The
workflow files and composite actions that exist only on this line are
now pinned to full commit SHAs, so the whole .github tree is pinned or
explicitly justified: 75 action references, 71 pinned to a
40-character commit SHA with the mandatory version comment, and 4 left
on mutable tags by explicit allowance. Nine of those were pinned here,
in files that arrived through the merge on mutable tags because the
original pinning sweep was authored on a branch that never carried them.
Security reports have a private channel; see
SECURITY.md.
Known limitations
A zero-length datagram before a close is reported as the close
This affects the experimental native datagram API only.
A peer that closes its half of a flow leaves POLLHUP latched, and the flag
stays set while its messages are still queued. The receive path therefore asks
FIONREAD as well: bytes still queued prove a further message is waiting, so a
client that sends an empty datagram, then a message, then closes has both
delivered.
One case has no answer. A zero-length datagram that is the last message
before a close is indistinguishable from the close itself. Reading it drains the
queue, and a zero-length message contributes no bytes for FIONREAD to report.
Measured on Linux 6.8: a socket in that state is identical to a drained one in
revents, in FIONREAD, under MSG_PEEK and in the recvmsg return.
Do not give a zero-length payload a meaning of its own on this API. Carry a
one-byte discriminator, and let the zero-byte read mean end of file. Separating
the two needs a payload that is never zero bytes on the wire, which is a
protocol change and is not in this release.
Getting v0.5.0
- Linux x86_64 / aarch64:
.deband tarball at the
v0.5.0 release page. - Arch Linux:
fipsfrom the AUR. - macOS:
.pkgat the v0.5.0 release page. - Windows: ZIP at the v0.5.0 release page.
- FreeBSD (x86_64):
.pkgat the v0.5.0 release page. New this
release; see the FreeBSD section ofpackaging/README.md. - OpenWrt:
.ipk(OpenWrt 24.x and earlier) or.apk(OpenWrt 25+)
at the v0.5.0 release page. Both carry thefips-mesh-setupand
fips-ap-setuphelpers. - From source:
cargo build --releasefrom a checkout of the v0.5.0
tag (Rust 1.94.1 perrust-toolchain.toml;libclang-devis a
required Linux build prerequisite). - Nix / NixOS:
nix build .#fipsfrom a checkout of the v0.5.0 tag
builds the binaries from source with the pinned toolchain and no
manual prerequisites (see the Nix section ofpackaging/README.md).
There is no Android daemon artifact. Android is supported as an
embedded crate, described above.
The full per-commit changelog lives in
CHANGELOG.md. Issues and discussion at
github.com/jmcorgan/fips.
Contributors
Thanks to everyone who contributed code, packaging work, bug reports, or
reviews to this release. Twenty of this release's commits came from
outside the project, and they carry several of the capabilities an
operator meets first.
- @Origami74 (Arjen): the OpenWrt
802.11s mesh backhaul
(#123), the open!FIPS
access SSID (#126), the
Android-ready core with the app-owned TUN interface
(#127), and
dns_local_addr()for embedders
(#136). Also the
per-instance transport addressing that lets a peer address name which
listener it belongs to, the app-owned UDP socket interface beside it, and
theconnect,disconnectand path-MTU fixes, all carried in through
the platform integration branch rather than a numbered pull request.
Also the NixOS flake module and overlay, the UDPsin6_scope_id
receive fix, and most of the Bluetooth LE rework: packet-boundary
recovery, identity-based peer recognition, the bounded probe retry and
the embedder-supplied Android radio backend, with the build gate that
decides where the transport exists. Fifteen commits, and the two
largest new operator capabilities in the release. - Martti Malmi (@mmalmi): allocation-free
routing next-hop selection
(#134) and batched macOS
connected-UDP receives
(#135). Two commits. - @fr34aky: FreeBSD support, covering the
daemon, the TUN datapath,.fipsDNS integration and native pkg
packaging (#129), and the
L2CAP PSM interface for Bluetooth LE with its BlueZ implementation. Two
commits, and a new supported platform. - @erskingardner (Jeff Gardner): the
control-socket runtime directory fix
(#138). One commit, and a
first contribution to FIPS. - @jmcorgan (Johnathan Corgan): release
shepherd; the sans-IO protocol restructuring, the per-peer control
machine, the peering reconciler, node lifecycle, health and drain, the
tick profiler, the lookup and rendezvous naming split, and the
integration and review of the contributed work above, plus the
native datagram API and thefipsctl probediagnostic.
174 commits.