NexusPi Git Node
FIREWALL_ADDRESSES.md ee519cc2af334ec099a032f7aa7f762489a2407a (ee519cc2) Text, 5.37 KB
Firewall Address Taxonomy
Every packet that reaches the firewall has its addresses extracted, checked against the whitelists (WL#1 + WL#2), and conditionally seeded.
Two tiers
┌───────────────────────┬──────────┬───────────────────────────────────────────────────────────────┐
│ Tier │ Purpose │ Examples │
├───────────────────────┼──────────┼───────────────────────────────────────────────────────────────┤
│ Tier 1 — seed + check │ User-fa… │ T383838destination_hash, T383838link_id, queried destination, ratchet hash │
│ Tier 2 — check only │ Relay i… │ T383838transport_id │
│ Removed │ Useless… │ T383838getTruncatedHash() (per-packet content hash, not an identity) │
└───────────────────────┴──────────┴───────────────────────────────────────────────────────────────┘
By packet type
ANNOUNCE (T383838packet_type == 1)
A node telling the network "I exist, here's how to reach me."
┌───────────────────────────┬─────────────────────────────────────────────────────┬───────┬────────┐
│ Field │ What it is │ Seed? │ Check? │
├───────────────────────────┼─────────────────────────────────────────────────────┼───────┼────────┤
│ T383838packet.destination_hash() │ The hash being announced (the destination's identi… │ ✅ │ ✅ │
│ T383838packet.transport_id() │ Relay transport instance (HEADER_2 only) │ ❌ │ ✅ │
│ Ratchet pubkey hash │ T383838Identity::truncated_hash(packet.data().mid(84,32))… │ ✅ │ ✅ │
└───────────────────────────┴─────────────────────────────────────────────────────┴───────┴────────┘
LINKREQUEST (T383838packet_type == 2)
A node asking another node to establish an encrypted link.
┌──────────────────────────────────────┬──────────────────────────────────────────┬───────┬────────┐
│ Field │ What it is │ Seed? │ Check? │
├──────────────────────────────────────┼──────────────────────────────────────────┼───────┼────────┤
│ T383838packet.destination_hash() │ The destination being requested │ ✅ │ ✅ │
│ T383838packet.transport_id() │ Relay transport instance (HEADER_2 only) │ ❌ │ ✅ │
│ T383838Link::link_id_from_lr_packet(packet) │ Link identifier — needed so the returni… │ ✅ │ ✅ │
└──────────────────────────────────────┴──────────────────────────────────────────┴───────┴────────┘
DATA (T383838packet_type == 0)
General-purpose data. Path requests are DATA packets addressed to a control destination.
┌───────────────────────────┬─────────────────────────────────────────────────────┬───────┬────────┐
│ Field │ What it is │ Seed? │ Check? │
├───────────────────────────┼─────────────────────────────────────────────────────┼───────┼────────┤
│ T383838packet.destination_hash() │ Where the packet is going │ ✅ │ ✅ │
│ T383838packet.transport_id() │ Relay transport instance (HEADER_2 only) │ ❌ │ ✅ │
│ Queried destination hash │ T383838packet.data().left(16) — present only when the DAT… │ ✅ │ ✅ │
└───────────────────────────┴─────────────────────────────────────────────────────┴───────┴────────┘
PROOF (T383838packet_type == 3)
Delivery confirmation or link request proof (LRPROOF).
┌───────────────────────────┬─────────────────────────────────────────────────────┬───────┬────────┐
│ Field │ What it is │ Seed? │ Check? │
├───────────────────────────┼─────────────────────────────────────────────────────┼───────┼────────┤
│ T383838packet.destination_hash() │ For LRPROOF: the T383838link_id from the original LINKREQ… │ ✅ │ ✅ │
│ T383838packet.transport_id() │ Relay transport instance (HEADER_2 only) │ ❌ │ ✅ │
└───────────────────────────┴─────────────────────────────────────────────────────┴───────┴────────┘
How a path request is identified
A packet is a path request when:
1. It's a DATA packet (T383838packet_type == 0)
2. Its T383838destination_hash matches a control hash (T383838_control_hashes — contains T383838path.request and T383838tunnel.synthesize)
3. Its data is at least 16 bytes (the queried destination hash)
The packet's T383838destination_hash is who processes it (the path.request endpoint, e.g. T3838386b9f6601).
The packet's first 16 bytes of data are what it's asking about (the queried destination, e.g. T3838380358192f for Browser).
What is NOT extracted from incoming packets
┌───────────────────────────┬──────────────────────────────────────────────────────────────────────┐
│ Field │ Why removed │
├───────────────────────────┼──────────────────────────────────────────────────────────────────────┤
│ T383838packet.getTruncatedHash() │ This is a per-packet content hash (hash of the packet body), not a … │
└───────────────────────────┴──────────────────────────────────────────────────────────────────────┘
What IS whitelisted at forwarding time (not by packet extraction)
When the firewall node forwards a packet from LAN to WAN, the return path must be whitelisted so the proof/reply can come back through the firewall.
┌───────────────────────────┬────────────────────────────────────────────────────────────────┬─────┐
│ Field │ When added │ Why │
├───────────────────────────┼────────────────────────────────────────────────────────────────┼─────┤
│ T383838packet.getTruncatedHash() │ At forwarding time (both FWD-TRANSPORT and FWD-LOCAL paths), … │ Th… │
└───────────────────────────┴────────────────────────────────────────────────────────────────┴─────┘
This is NOT done during the per-packet address extraction loop — it's done at the point where we decide to forward the packet and create a T383838ReverseEntry:
T282828
T8b949e// At both reverse-entry creation sites:
Te6edf3Bytes Te6edf3th Tff7b72= Te6edf3packetTb4b4b4.Te6edf3getTruncatedHashTb4b4b4(Tb4b4b4)Tb4b4b4;
Te6edf3_reverse_tableTb4b4b4.Te6edf3push_backTb4b4b4(Tb4b4b4{Te6edf3thTb4b4b4, Te6edf3reverse_entryTb4b4b4}Tb4b4b4)Tb4b4b4;
T8b949e// Whitelist so the return proof isn't blocked:
Te6edf3_firewall_mentioned_addressesTb4b4b4.Te6edf3push_backTb4b4b4(Te6edf3thTb4b4b4)Tb4b4b4;
Control hash filtering
Addresses matching T383838_control_hashes (path.request, tunnel.synthesize) are never added to WL#2. These are infrastructure plumbing, not user traffic. Seeding them would allow all backbone path requests to pass — which is how the ~80-path-request flood happened.
Firewall logic summary
T282828
For every packet:
1. Extract Tier 1 addresses (seed + check)
2. Extract Tier 2 addresses (check only)
3. any_known = any Tier 1 or Tier 2 address is in WL#1 or WL#2
If backbone:
any_known == false → BLOCK
any_known == true → PASS, seed Tier 1 addresses into WL#2
If local (LoRa):
Always PASS, seed Tier 1 addresses into WL#2
Served by rngit 1.5.2 - Generated in 0.04s