FIPS diagnostics for the Companion performance proposal
The patch fips-stale-lan-reproducer.patch applies to upstream jmcorgan/fips
v0.5.3, commit f4a5b4a8e61e340e6be7551608109a5c399f8353. It is a diagnostic,
not a patch to the shipping dependency. No upstream submission is implied.
Apply in a separate upstream checkout, then run:
cargo test --lib archy_lost_lan_peer_blocks_live_anchor_return_until_remote_cleanup --locked
Observed: one test passed in 2.46 seconds. It creates three loopback nodes and
empty temporary ACL files (does not change host FIPS configuration). The phone
loses its direct server edge but retains a route through the anchor. Replies
still choose the stale server-side direct edge. Session establishment succeeds
only after removing that edge remotely. Cleanup is simulated rather than
waiting thirty seconds, so the test is not a wall-clock handover benchmark.
This explains why faster Android network callbacks alone cannot guarantee fast
handover. Do not lower authenticated liveness thresholds blindly or remove a
remote peer merely because a packet arrived along a different path. A production
fix needs authenticated path migration or tested multipath failover on both
ends. Preserve this failure case when evaluating upstream transport changes.
The config compatibility patch verifies the generated node YAML through the
same pinned upstream parser, including legacy-key normalization, zero extra
lookup suppression, LAN rendezvous and handshake pacing. Apply it separately
and run cargo test --lib archy_generated_node_config_keeps_current_lookup_defaults --locked.
Private authenticated return-path candidate
fips-authenticated-return-path.patch is an alternative to the diagnostic patch
above; apply it alone to the same pinned upstream commit. It supplies the fix
and a regression scenario, plus expiry/new-direct-traffic checks. Temporary
return hops are session-owned, learned after end-to-end authentication, bounded
by existing liveness timeouts, and only override an old direct destination edge.
Session setup acknowledgements can reply along the request's authenticated link
without trusting the setup packet enough to persist a route. No ACL or peer
identity changes are required.
Run upstream session tests in an isolated filesystem/network namespace with
empty /etc/fips, not against a live node's ACL or interfaces. The local result
is 183 passed, 1 ignored plus 2 focused checks; physical acceptance is pending.
Build a private Debian amd64 candidate using:
python3 scripts/companion/build-fips-handoff-candidate.py --image IMAGE_ID \
--output PRIVATE_OUTPUT --cargo-home DEDICATED_CARGO_CACHE
The immutable Podman image must provide Rust 1.98.1 on Debian bookworm, clang,
cmake, pkg-config, libssl-dev, libdbus-1-dev, libudev-dev, protobuf-compiler and
dpkg-deb. The script checks the exact upstream commit and official package
checksum, records the patch/image/artifact hashes, and builds version
0.5.3+archy.handoff1. It does not install, publish or claim upstream approval.
Retain the official package and identity-preserving rollback before private UAT.
