52 lines
3.1 KiB
Plaintext
52 lines
3.1 KiB
Plaintext
FIPS diagnostics for the Companion performance proposal
|
|
|
|
The patch fips-stale-lan-reproducer.patch applies to upstream jmcorgan/fips
|
|
v0.5.3, commit f4a5b4a8e61e340e6be7551608109a5c399f8353. It is a diagnostic,
|
|
not a patch to the shipping dependency. No upstream submission is implied.
|
|
|
|
Apply in a separate upstream checkout, then run:
|
|
cargo test --lib archy_lost_lan_peer_blocks_live_anchor_return_until_remote_cleanup --locked
|
|
|
|
Observed: one test passed in 2.46 seconds. It creates three loopback nodes and
|
|
empty temporary ACL files (does not change host FIPS configuration). The phone
|
|
loses its direct server edge but retains a route through the anchor. Replies
|
|
still choose the stale server-side direct edge. Session establishment succeeds
|
|
only after removing that edge remotely. Cleanup is simulated rather than
|
|
waiting thirty seconds, so the test is not a wall-clock handover benchmark.
|
|
|
|
This explains why faster Android network callbacks alone cannot guarantee fast
|
|
handover. Do not lower authenticated liveness thresholds blindly or remove a
|
|
remote peer merely because a packet arrived along a different path. A production
|
|
fix needs authenticated path migration or tested multipath failover on both
|
|
ends. Preserve this failure case when evaluating upstream transport changes.
|
|
|
|
The config compatibility patch verifies the generated node YAML through the
|
|
same pinned upstream parser, including legacy-key normalization, zero extra
|
|
lookup suppression, LAN rendezvous and handshake pacing. Apply it separately
|
|
and run cargo test --lib archy_generated_node_config_keeps_current_lookup_defaults --locked.
|
|
|
|
Private authenticated return-path candidate
|
|
|
|
fips-authenticated-return-path.patch is an alternative to the diagnostic patch
|
|
above; apply it alone to the same pinned upstream commit. It supplies the fix
|
|
and a regression scenario, plus expiry/new-direct-traffic checks. Temporary
|
|
return hops are session-owned, learned after end-to-end authentication, bounded
|
|
by existing liveness timeouts, and only override an old direct destination edge.
|
|
Session setup acknowledgements can reply along the request's authenticated link
|
|
without trusting the setup packet enough to persist a route. No ACL or peer
|
|
identity changes are required.
|
|
|
|
Run upstream session tests in an isolated filesystem/network namespace with
|
|
empty /etc/fips, not against a live node's ACL or interfaces. The local result
|
|
is 183 passed, 1 ignored plus 2 focused checks; physical acceptance is pending.
|
|
|
|
Build a private Debian amd64 candidate using:
|
|
python3 scripts/companion/build-fips-handoff-candidate.py --image IMAGE_ID \
|
|
--output PRIVATE_OUTPUT --cargo-home DEDICATED_CARGO_CACHE
|
|
The immutable Podman image must provide Rust 1.98.1 on Debian bookworm, clang,
|
|
cmake, pkg-config, libssl-dev, libdbus-1-dev, libudev-dev, protobuf-compiler and
|
|
dpkg-deb. The script checks the exact upstream commit and official package
|
|
checksum, records the patch/image/artifact hashes, and builds version
|
|
0.5.3+archy.handoff1. It does not install, publish or claim upstream approval.
|
|
Retain the official package and identity-preserving rollback before private UAT.
|