Repository navigation
Conversation
- Secure is the default. - Trusted development requires --security-mode trusted-development or SECURITY_MODE=trusted-development. - Integration environments opt in explicitly. - The example YAML documents the mode.
QuinnUdpSocket and its turmoil test
The deterministic turmoil test now proves:
client Initial
│
▼
server Retry token
│
▼
client retries
│
▼
server confirms address validated
│
▼
mutual TLS handshake + QUIC datagram
- Maximum 128 pending handshakes. - No bidirectional or unidirectional QUIC streams. - 64 × 1200-byte send and receive datagram buffers. - 1200-byte maximum UDP payload. - TLS early data/0-RTT confirmed disabled. - Required Retry address validation.
turmoil TCP socket
↓
TLS 1.3 mutual authentication
↓
AuthenticatedTcpStream
├── encrypted byte stream
└── authenticated peer principal
- Added tokio-rustls.
- Supports inbound and outbound mutual TLS.
- Extracts both peers’ Node Certificate Principals.
- Deterministic turmoil test exchanges ping/pong.
- Not yet used by production actors; the explicit dead_code allowance will be removed when Raft/data transports adopt it in the next slice.
- Focused turmoil test and all-target/all-feature clippy pass.
- Formatting and diff checks pass.
- RaftRpcListener now has one constructor taking the read half and explicit transport identity. - Raft transport uses shared node-stream halves. - Secure streams retain the certificate principal at the connection boundary. - Trusted-development tests name their mode explicitly. - Large TLS stream variant is boxed. - Mutual-TLS turmoil test and five Raft transport tests pass. - All-target/all-feature clippy, formatting, and diff checks pass.
NodeTransportSecurity
│
├── Raft TCP
└── Data TCP
↓
NodeTcpStream
├── Secure: mutual TLS + certificate principal
└── TrustedDevelopment: plaintext
Changes:
- Data readers/writers now use shared node-stream halves.
- Inbound and outbound data connections explicitly select the configured security mode.
- Connection identity stays attached to each reader for later admission authorization.
- No optional TLS configuration.
- Secure startup remains fail-closed because SWIM and client listeners are not secured yet.
- Fixed asymmetric bootstrap voter sets by reasserting known voters through the Raft log during takeover. - Kept strict committed-voter RPC authorization. - Added a focused regression test. - Exact failing turmoil seed now passes. - Full clippy, formatting, and diff checks pass.
TLS client principal
↓
TransportIdentity
↓
ClientController
↓
future ACL checks
Changes:
- Renamed NodeTransportIdentity to shared TransportIdentity.
- Captures identity before splitting the stream.
- Stores identity on ClientController.
- Trusted-development tests explicitly use TrustedDevelopment.
- No ACL behavior added yet.
…utput, append ownership checks, and payload-free error logs. Authenticated appends fail closed when ownership metadata is unavailable.
…certificate/key/CA options.
…ation, acknowledgments, deletion, and catch-up.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Establish the S0 security foundation:
Quinn feasibility
The turmoil test verifies:
Quinn's Bloom-backed Retry-token log provides replay protection.
Current behavior