Fix core_test.go

This reverts commit f0a5cd542c.

.circleci/config.yml

@@ -162,43 +162,6 @@ jobs:
           paths:
             - upload
 
-  build-windows:
-    docker:
-      - image: circleci/golang:1.16
-
-    steps:
-      - checkout
-
-      - run:
-          name: Create artifact upload directory and set variables
-          command: |
-              mkdir /tmp/upload
-              echo 'export CINAME=$(sh contrib/semver/name.sh)' >> $BASH_ENV
-              echo 'export CIVERSION=$(sh contrib/semver/version.sh --bare)' >> $BASH_ENV
-              git config --global user.email "$(git log --format='%ae' HEAD -1)";
-              git config --global user.name "$(git log --format='%an' HEAD -1)";
-
-      - run:
-          name: Install tools
-          command: |
-              sudo apt-get update
-              sudo apt-get -y install msitools wixl
-
-      - run:
-          name: Build for Windows
-          command: |
-              rm -f {yggdrasil,yggdrasilctl}
-              GOOS=windows GOARCH=amd64 ./build && mv yggdrasil.exe /tmp/upload/$CINAME-$CIVERSION-windows-amd64.exe && mv yggdrasilctl.exe /tmp/upload/$CINAME-$CIVERSION-yggdrasilctl-windows-amd64.exe;
-              GOOS=windows GOARCH=386 ./build && mv yggdrasil.exe /tmp/upload/$CINAME-$CIVERSION-windows-i386.exe && mv yggdrasilctl.exe /tmp/upload/$CINAME-$CIVERSION-yggdrasilctl-windows-i386.exe;
-              bash contrib/msi/build-msi.sh x64
-              bash contrib/msi/build-msi.sh x86
-              mv *.msi /tmp/upload
-
-      - persist_to_workspace:
-          root: /tmp
-          paths:
-            - upload
-
   build-other:
     docker:
       - image: circleci/golang:1.16
@@ -229,6 +192,13 @@ jobs:
               GOOS=freebsd GOARCH=amd64 ./build && mv yggdrasil /tmp/upload/$CINAME-$CIVERSION-freebsd-amd64 && mv yggdrasilctl /tmp/upload/$CINAME-$CIVERSION-yggdrasilctl-freebsd-amd64;
               GOOS=freebsd GOARCH=386 ./build && mv yggdrasil /tmp/upload/$CINAME-$CIVERSION-freebsd-i386 && mv yggdrasilctl /tmp/upload/$CINAME-$CIVERSION-yggdrasilctl-freebsd-i386;
 
+      - run:
+          name: Build for Windows
+          command: |
+              rm -f {yggdrasil,yggdrasilctl}
+              GOOS=windows GOARCH=amd64 ./build && mv yggdrasil.exe /tmp/upload/$CINAME-$CIVERSION-windows-amd64.exe && mv yggdrasilctl.exe /tmp/upload/$CINAME-$CIVERSION-yggdrasilctl-windows-amd64.exe;
+              GOOS=windows GOARCH=386 ./build && mv yggdrasil.exe /tmp/upload/$CINAME-$CIVERSION-windows-i386.exe && mv yggdrasilctl.exe /tmp/upload/$CINAME-$CIVERSION-yggdrasilctl-windows-i386.exe;
+
       - persist_to_workspace:
           root: /tmp
           paths:
@@ -252,11 +222,9 @@ workflows:
       - lint
       - build-linux
       - build-macos
-      - build-windows
       - build-other
       - upload:
           requires:
             - build-linux
             - build-macos
-            - build-windows
             - build-other

.gitmodules

@@ -1,3 +0,0 @@
-[submodule "doc/yggdrasil-network.github.io"]
-	path = doc/yggdrasil-network.github.io
-	url = https://github.com/yggdrasil-network/yggdrasil-network.github.io/

appveyor.yml

@@ -0,0 +1,20 @@
+version: '{build}'
+pull_requests:
+  do_not_increment_build_number: true
+os: Visual Studio 2019
+shallow_clone: false
+
+environment:
+  MSYS2_PATH_TYPE: inherit
+  CHERE_INVOKING: enabled_from_arguments
+
+build_script:
+- cmd: >-
+    cd %APPVEYOR_BUILD_FOLDER%
+- c:\msys64\usr\bin\bash -lc "./contrib/msi/build-msi.sh x64"
+- c:\msys64\usr\bin\bash -lc "./contrib/msi/build-msi.sh x86"
+
+test: off
+
+artifacts:
+- path: '*.msi'

build

@@ -32,18 +32,16 @@ fi
 
 if [ $IOS ]; then
   echo "Building framework for iOS"
-  gomobile bind -target ios -tags mobile -ldflags="$LDFLAGS $STRIP" -gcflags="$GCFLAGS" \
-    github.com/yggdrasil-network/yggdrasil-go/src/yggdrasil \
-    github.com/yggdrasil-network/yggdrasil-go/src/config \
+  go get golang.org/x/mobile/bind
+  gomobile bind -target ios -tags mobile -o Yggdrasil.framework -ldflags="$LDFLAGS $STRIP" -gcflags="$GCFLAGS" \
     github.com/yggdrasil-network/yggdrasil-extras/src/mobile \
-    github.com/yggdrasil-network/yggdrasil-extras/src/dummy
+    github.com/yggdrasil-network/yggdrasil-go/src/config
 elif [ $ANDROID ]; then
   echo "Building aar for Android"
-  gomobile bind -target android -tags mobile -ldflags="$LDFLAGS $STRIP" -gcflags="$GCFLAGS" \
-    github.com/yggdrasil-network/yggdrasil-go/src/yggdrasil \
-    github.com/yggdrasil-network/yggdrasil-go/src/config \
+  go get golang.org/x/mobile/bind
+  gomobile bind -target android -tags mobile -o yggdrasil.aar -ldflags="$LDFLAGS $STRIP" -gcflags="$GCFLAGS" \
     github.com/yggdrasil-network/yggdrasil-extras/src/mobile \
-    github.com/yggdrasil-network/yggdrasil-extras/src/dummy
+    github.com/yggdrasil-network/yggdrasil-go/src/config
 else
   for CMD in yggdrasil yggdrasilctl ; do
     echo "Building: $CMD"

cmd/yggdrasil/main.go

@@ -25,6 +25,7 @@ import (
 	"github.com/yggdrasil-network/yggdrasil-go/src/address"
 	"github.com/yggdrasil-network/yggdrasil-go/src/admin"
 	"github.com/yggdrasil-network/yggdrasil-go/src/config"
+	"github.com/yggdrasil-network/yggdrasil-go/src/defaults"
 
 	"github.com/yggdrasil-network/yggdrasil-go/src/core"
 	"github.com/yggdrasil-network/yggdrasil-go/src/multicast"
@@ -73,7 +74,7 @@ func readConfig(log *log.Logger, useconf *bool, useconffile *string, normaliseco
 	// then parse the configuration we loaded above on top of it. The effect
 	// of this is that any configuration item that is missing from the provided
 	// configuration will use a sane default.
-	cfg := config.GenerateConfig()
+	cfg := defaults.GenerateConfig()
 	var dat map[string]interface{}
 	if err := hjson.Unmarshal(conf, &dat); err != nil {
 		panic(err)
@@ -95,6 +96,31 @@ func readConfig(log *log.Logger, useconf *bool, useconffile *string, normaliseco
 			}
 		}
 	}
+	if oldmc, ok := dat["MulticastInterfaces"]; ok {
+		if oldmcvals, ok := oldmc.([]interface{}); ok {
+			var newmc []config.MulticastInterfaceConfig
+			for _, oldmcval := range oldmcvals {
+				if str, ok := oldmcval.(string); ok {
+					newmc = append(newmc, config.MulticastInterfaceConfig{
+						Regex:  str,
+						Beacon: true,
+						Listen: true,
+					})
+				}
+			}
+			if newmc != nil {
+				if oldport, ok := dat["LinkLocalTCPPort"]; ok {
+					// numbers parse to float64 by default
+					if port, ok := oldport.(float64); ok {
+						for idx := range newmc {
+							newmc[idx].Port = uint16(port)
+						}
+					}
+				}
+				dat["MulticastInterfaces"] = newmc
+			}
+		}
+	}
 	// Sanitise the config
 	confJson, err := json.Marshal(dat)
 	if err != nil {
@@ -114,7 +140,7 @@ func readConfig(log *log.Logger, useconf *bool, useconffile *string, normaliseco
 // Generates a new configuration and returns it in HJSON format. This is used
 // with -genconf.
 func doGenconf(isjson bool) string {
-	cfg := config.GenerateConfig()
+	cfg := defaults.GenerateConfig()
 	var bs []byte
 	var err error
 	if isjson {
@@ -205,7 +231,7 @@ func main() {
 	case *autoconf:
 		// Use an autoconf-generated config, this will give us random keys and
 		// port numbers, and will use an automatically selected TUN/TAP interface.
-		cfg = config.GenerateConfig()
+		cfg = defaults.GenerateConfig()
 	case *useconffile != "" || *useconf:
 		// Read the configuration from either stdin or from the filesystem
 		cfg = readConfig(logger, useconf, useconffile, normaliseconf)

contrib/msi/build-msi.sh

@@ -1,7 +1,9 @@
-#!/bin/bash
+#!/bin/sh
 
 # This script generates an MSI file for Yggdrasil for a given architecture. It
-# needs to run on Linux or macOS with Go 1.16, wixl and msitools installed.
+# needs to run on Windows within MSYS2 and Go 1.13 or later must be installed on
+# the system and within the PATH. This is ran currently by Appveyor (see
+# appveyor.yml in the repository root) for both x86 and x64.
 #
 # Author: Neil Alexander <neilalexander@users.noreply.github.com>
 
@@ -26,10 +28,29 @@ then
   git checkout ${APPVEYOR_REPO_BRANCH}
 fi
 
+# Install prerequisites within MSYS2
+pacman -S --needed --noconfirm unzip git curl
+
+# Download the wix tools!
+if [ ! -d wixbin ];
+then
+  curl -LO https://github.com/wixtoolset/wix3/releases/download/wix3112rtm/wix311-binaries.zip
+  if [ `md5sum wix311-binaries.zip | cut -f 1 -d " "` != "47a506f8ab6666ee3cc502fb07d0ee2a" ];
+  then
+    echo "wix package didn't match expected checksum"
+    exit 1
+  fi
+  mkdir -p wixbin
+  unzip -o wix311-binaries.zip -d wixbin || (
+    echo "failed to unzip WiX"
+    exit 1
+  )
+fi
+
 # Build Yggdrasil!
-[ "${PKGARCH}" == "x64" ] && GOOS=windows GOARCH=amd64 CGO_ENABLED=0 ./build -p -l "-aslr"
-[ "${PKGARCH}" == "x86" ] && GOOS=windows GOARCH=386 CGO_ENABLED=0 ./build -p -l "-aslr"
-[ "${PKGARCH}" == "arm" ] && GOOS=windows GOARCH=arm CGO_ENABLED=0 ./build -p -l "-aslr"
+[ "${PKGARCH}" == "x64" ] && GOOS=windows GOARCH=amd64 CGO_ENABLED=0 ./build
+[ "${PKGARCH}" == "x86" ] && GOOS=windows GOARCH=386 CGO_ENABLED=0 ./build
+[ "${PKGARCH}" == "arm" ] && GOOS=windows GOARCH=arm CGO_ENABLED=0 ./build
 #[ "${PKGARCH}" == "arm64" ] && GOOS=windows GOARCH=arm64 CGO_ENABLED=0 ./build
 
 # Create the postinstall script
@@ -39,24 +60,25 @@ if not exist %ALLUSERSPROFILE%\\Yggdrasil (
 )
 if not exist %ALLUSERSPROFILE%\\Yggdrasil\\yggdrasil.conf (
   if exist yggdrasil.exe (
-    if not exist %ALLUSERSPROFILE%\\Yggdrasil\\yggdrasil.conf (
-      yggdrasil.exe -genconf > %ALLUSERSPROFILE%\\Yggdrasil\\yggdrasil.conf
-    )
+    yggdrasil.exe -genconf > %ALLUSERSPROFILE%\\Yggdrasil\\yggdrasil.conf
   )
 )
 EOF
 
 # Work out metadata for the package info
 PKGNAME=$(sh contrib/semver/name.sh)
-PKGVERSION=$(sh contrib/semver/version.sh --bare)
+PKGVERSION=$(sh contrib/msi/msversion.sh --bare)
 PKGVERSIONMS=$(echo $PKGVERSION | tr - .)
 [ "${PKGARCH}" == "x64" ] && \
   PKGGUID="77757838-1a23-40a5-a720-c3b43e0260cc" PKGINSTFOLDER="ProgramFiles64Folder" || \
   PKGGUID="54a3294e-a441-4322-aefb-3bb40dd022bb" PKGINSTFOLDER="ProgramFilesFolder"
 
 # Download the Wintun driver
-curl -o wintun.zip https://www.wintun.net/builds/wintun-0.10.2.zip
-unzip wintun.zip
+if [ ! -d wintun ];
+then
+  curl -o wintun.zip https://www.wintun.net/builds/wintun-0.11.zip
+  unzip wintun.zip
+fi
 if [ $PKGARCH = "x64" ]; then
   PKGWINTUNDLL=wintun/bin/amd64/wintun.dll
 elif [ $PKGARCH = "x86" ]; then
@@ -87,7 +109,6 @@ cat > wix.xml << EOF
     Language="1033"
     Codepage="1252"
     Version="${PKGVERSIONMS}"
-    Platform="${PKGARCH}"
     Manufacturer="github.com/yggdrasil-network">
 
     <Package
@@ -100,7 +121,6 @@ cat > wix.xml << EOF
       InstallScope="perMachine"
       Languages="1033"
       Compressed="yes"
-      Platform="${PKGARCH}"
       SummaryCodepage="1252" />
 
     <MajorUpgrade
@@ -189,7 +209,9 @@ cat > wix.xml << EOF
     <InstallExecuteSequence>
       <Custom
         Action="UpdateGenerateConfig"
-        Before="StartServices" />
+        Before="StartServices">
+          NOT Installed AND NOT REMOVE
+      </Custom>
     </InstallExecuteSequence>
 
   </Product>
@@ -197,4 +219,7 @@ cat > wix.xml << EOF
 EOF
 
 # Generate the MSI
-wixl -v wix.xml -a ${PKGARCH} -o ${PKGNAME}-${PKGVERSION}-${PKGARCH}.msi
+CANDLEFLAGS="-nologo"
+LIGHTFLAGS="-nologo -spdb -sice:ICE71 -sice:ICE61"
+wixbin/candle $CANDLEFLAGS -out ${PKGNAME}-${PKGVERSION}-${PKGARCH}.wixobj -arch ${PKGARCH} wix.xml && \
+wixbin/light $LIGHTFLAGS -ext WixUtilExtension.dll -out ${PKGNAME}-${PKGVERSION}-${PKGARCH}.msi ${PKGNAME}-${PKGVERSION}-${PKGARCH}.wixobj

contrib/msi/msversion.sh

@@ -0,0 +1,46 @@
+#!/bin/sh
+
+# Get the last tag
+TAG=$(git describe --abbrev=0 --tags --match="v[0-9]*\.[0-9]*\.[0-9]*" 2>/dev/null)
+
+# Did getting the tag succeed?
+if [ $? != 0 ] || [ -z "$TAG" ]; then
+  printf -- "unknown"
+  exit 0
+fi
+
+# Get the current branch
+BRANCH=$(git symbolic-ref -q HEAD --short 2>/dev/null)
+
+# Did getting the branch succeed?
+if [ $? != 0 ] || [ -z "$BRANCH" ]; then
+  BRANCH="master"
+fi
+
+# Split out into major, minor and patch numbers
+MAJOR=$(echo $TAG | cut -c 2- | cut -d "." -f 1)
+MINOR=$(echo $TAG | cut -c 2- | cut -d "." -f 2)
+PATCH=$(echo $TAG | cut -c 2- | cut -d "." -f 3 | awk -F"rc" '{print $1}')
+
+# Output in the desired format
+if [ $((PATCH)) -eq 0 ]; then
+  printf '%s%d.%d' "$PREPEND" "$((MAJOR))" "$((MINOR))"
+else
+  printf '%s%d.%d.%d' "$PREPEND" "$((MAJOR))" "$((MINOR))" "$((PATCH))"
+fi
+
+# Add the build tag on non-master branches
+if [ "$BRANCH" != "master" ]; then
+  BUILD=$(git rev-list --count $TAG..HEAD 2>/dev/null)
+
+  # Did getting the count of commits since the tag succeed?
+  if [ $? != 0 ] || [ -z "$BUILD" ]; then
+    printf -- "-unknown"
+    exit 0
+  fi
+
+  # Is the build greater than zero?
+  if [ $((BUILD)) -gt 0 ]; then
+      printf -- "-%04d" "$((BUILD))"
+  fi
+fi

doc/Whitepaper.md

@@ -1,148 +0,0 @@
-# Yggdrasil
-
-Note: This is a very rough early draft.
-
-Yggdrasil is an encrypted IPv6 network running in the [`200::/7` address range](https://en.wikipedia.org/wiki/Unique_local_address).
-It is an experimental/toy network, so failure is acceptable, as long as it's instructive to see how it breaks if/when everything falls apart.
-
-IP addresses are derived from cryptographic keys, to reduce the need for public key infrastructure.
-A form of locator/identifier separation (similar in goal to [LISP](https://en.wikipedia.org/wiki/Locator/Identifier_Separation_Protocol)) is used to map static identifiers (IP addresses) onto dynamic routing information (locators), using a [distributed hash table](https://en.wikipedia.org/wiki/Distributed_hash_table) (DHT).
-Locators are used to approximate the distance between nodes in the network, where the approximate distance is the length of a real worst-case-scenario path through the network.
-This is (arguably) easier to secure and requires less information about the network than commonly used routing schemes.
-
-While not technically a [compact routing scheme](https://arxiv.org/abs/0708.2309), tests on real-world networks suggest that routing in this style incurs stretch comparable to the name-dependent compact routing schemes designed for static networks.
-Compared to compact routing schemes, Yggdrasil appears to have smaller average routing table sizes, works on dynamic networks, and is name-independent.
-It currently lacks the provable bounds of compact routing schemes, and there's a serious argument to be made that it cheats by stretching the definition of some of the above terms, but the main point to be emphasized is that there are trade-offs between different concerns when trying to route traffic, and we'd rather make every part *good* than try to make any one part *perfect*.
-In that sense, Yggdrasil seems to be competitive, on what are supposedly realistic networks, with compact routing schemes.
-
-## Addressing
-
-Yggdrasil uses a truncated version of a `NodeID` to assign addresses.
-An address is assigned from the `200::/7` prefix, according to the following:
-
-1. Begin with `0x02` as the first byte of the address, or `0x03` if it's a `/64` prefix.
-2. Count the number of leading `1` bits in the NodeID.
-3. Set the second byte of the address to the number of leading `1` bits in the NodeID (8 bit unsigned integer, at most 255).
-4. Append the NodeID to the remaining bits of the address, truncating the leading `1` bits and the first `0` bit, to a total address size of 128 bits.
-
-The last bit of the first byte is used to flag if an address is for a router (`200::/8`), or part of an advertised prefix (`300::/8`), where each router owns a `/64` that matches their address (except with the eight bit set to 1 instead of 0).
-This allows the prefix to be advertised to the router's LAN, so unsupported devices can still connect to the network (e.g. network printers).
-
-The NodeID is a [sha512sum](https://en.wikipedia.org/wiki/SHA-512) of a node's public encryption key.
-Addresses are checked that they match NodeID, to prevent address spoofing.
-As such, while a 128 bit IPv6 address is likely too short to be considered secure by cryptographer standards, there is a significant cost in attempting to cause an address collision.
-Addresses can be made more secure by brute force generating a large number of leading `1` bits in the NodeID.
-
-When connecting to a node, the IP address is unpacked into the known bits of the NodeID and a matching bitmask to track which bits are significant.
-A node is only communicated with if its `NodeID` matches its public key and the known `NodeID` bits from the address.
-
-It is important to note that only `NodeID` is used internally for routing, so the addressing scheme could in theory be changed without breaking compatibility with intermediate routers.
-This has been done once, when moving the address range from the `fd00::/8` ULA range to the reserved-but-[deprecated](https://tools.ietf.org/html/rfc4048) `200::/7` range.
-Further addressing scheme changes could occur if, for example, an IPv7 format ever emerges.
-
-### Cryptography
-
-Public key encryption is done using the `golang.org/x/crypto/nacl/box`, which uses [Curve25519](https://en.wikipedia.org/wiki/Curve25519), [XSalsa20](https://en.wikipedia.org/wiki/Salsa20), and [Poly1305](https://en.wikipedia.org/wiki/Poly1305) for key exchange, encryption, and authentication (interoperable with [NaCl](https://en.wikipedia.org/wiki/NaCl_(software))).
-Permanent keys are used only for protocol traffic, with random nonces generated on a per-packet basis using `crypto/rand` from Go's standard library.
-Ephemeral session keys (for [forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy)) are generated for encapsulated IPv6 traffic, using the same set of primitives, with random initial nonces that are subsequently incremented.
-A list of recently received session nonces is kept (as a bitmask) and checked to reject duplicated packets, in an effort to block duplicate packets and replay attacks.
-A separate set of keys are generated and used for signing with [Ed25519](https://en.wikipedia.org/wiki/Ed25519), which is used by the routing layer to secure construction of a spanning tree.
-
-### Prefixes
-
-Recall that each node's address is in the lower half of the address range, I.e. `200::/8`. A `/64` prefix is made available to each node under `300::/8`, where the remaining bits of the prefix match the node's address under `200::/8`.
-A node may optionally advertise a prefix on their local area network, which allows unsupported or legacy devices with IPv6 support to connect to the network.
-Note that there are 64 fewer bits of `NodeID` available to check in each address from a routing prefix, so it makes sense to brute force a `NodeID` with more significant bits in the address if this approach is to be used.
-Running `genkeys.go` will do this by default.
-
-## Locators and Routing
-
-Locators are generated using information from a spanning tree (described below).
-The result is that each node has a set of [coordinates in a greedy metric space](https://en.wikipedia.org/wiki/Greedy_embedding).
-These coordinates are used as a distance label.
-Given the coordinates of any two nodes, it is possible to calculate the length of some real path through the network between the two nodes.
-
-Traffic is forwarded using a [greedy routing](https://en.wikipedia.org/wiki/Small-world_routing#Greedy_routing) scheme, where each node forwards the packet to a one-hop neighbor that is closer to the destination (according to this distance metric) than the current node.
-In particular, when a packet needs to be forwarded, a node will forward it to whatever peer is closest to the destination in the greedy [metric space](https://en.wikipedia.org/wiki/Metric_space) used by the network, provided that the peer is closer to the destination than the current node.
-
-If no closer peers are idle, then the packet is queued in FIFO order, with separate queues per destination coords (currently, as a bit of a hack, IPv6 flow labels are embedded after the end of the significant part of the coords, so queues distinguish between different traffic streams with the same destination).
-Whenever the node finishes forwarding a packet to a peer, it checks the queues, and will forward the first packet from the queue with the maximum `<age of first packet>/<queue size in bytes>`, i.e. the bandwidth the queue is attempting to use, subject to the constraint that the peer is a valid next hop (i.e. closer to the destination than the current node).
-If no non-empty queue is available, then the peer is added to the idle set, forward packets when the need arises.
-
-This acts as a crude approximation of backpressure routing, where the remote queue sizes are assumed to be equal to the distance of a node from a destination (rather than communicating queue size information), and packets are never forwarded "backwards" through the network, but congestion on a local link is routed around when possible.
-The queue selection strategy behaves similar to shortest-queue-first, in that a larger fraction of available bandwidth to sessions that attempt to use less bandwidth, and is loosely based on the rationale behind some proposed solutions to the [cake-cutting](https://en.wikipedia.org/wiki/Fair_cake-cutting) problem.
-
-The queue size is limited to 4 MB. If a packet is added to a queue and the total size of all queues is larger than this threshold, then a random queue is selected (with odds proportional to relative queue sizes), and the first packet from that queue is dropped, with the process repeated until the total queue size drops below the allowed threshold.
-
-Note that this forwarding procedure generalizes to nodes that are not one-hop neighbors, but the current implementation omits the use of more distant neighbors, as this is expected to be a minor optimization (it would add per-link control traffic to pass path-vector-like information about a subset of the network, which is a lot of overhead compared to the current setup).
-
-### Spanning Tree
-
-A [spanning tree](https://en.wikipedia.org/wiki/Spanning_tree) is constructed with the tree rooted at the highest TreeID, where TreeID is equal to a sha512sum of a node's public [Ed25519](https://en.wikipedia.org/wiki/Ed25519) key (used for signing).
-A node sends periodic advertisement messages to each neighbor.
-The advertisement contains the coords that match the path from the root through the node, plus one additional hop from the node to the neighbor being advertised to.
-Each hop in this advertisement includes a matching ed25519 signature.
-These signatures prevent nodes from forging arbitrary routing advertisements.
-
-The first hop, from the root, also includes a sequence number, which must be updated periodically.
-A node will blacklist the current root (keeping a record of the last sequence number observed) if the root fails to update for longer than some timeout (currently hard coded at 1 minute).
-Normally, a root node will update their sequence number for frequently than this (once every 30 seconds).
-Nodes are throttled to ignore updates with a new sequence number for some period after updating their most recently seen sequence number (currently this cooldown is 15 seconds).
-The implementation chooses to set the sequence number equal to the unix time on the root's clock, so that a new (higher) sequence number will be selected if the root is restarted and the clock is not set back.
-
-Other than the root node, every other node in the network must select one of its neighbors to use as their parent.
-This selection is done by tracking when each neighbor first sends us a message with a new timestamp from the root, to determine the ordering of the latency of each path from the root, to each neighbor, and then to the node that's searching for a parent.
-These relative latencies are tracked by, for each neighbor, keeping a score vs each other neighbor.
-If a neighbor sends a message with an updated timestamp before another neighbor, then the faster neighbor's score is increased by 1.
-If the neighbor sends a message slower, then the score is decreased by 2, to make sure that a node must be reliably faster (at least 2/3 of the time) to see a net score increase over time.
-If a node begins to advertise new coordinates, then its score vs all other nodes is reset to 0.
-A node switches to a new parent if a neighbor's score (vs the current parent) reaches some threshold, currently 240, which corresponds to about 2 hours of being a reliably faster path.
-The intended outcome of this process is that stable connections from fixed infrastructure near the "core" of the network should (eventually) select parents that minimize latency from the root to themselves, while the more dynamic parts of the network, presumably more towards the edges, will try to favor reliability when selecting a parent.
-
-The distance metric between nodes is simply the distance between the nodes if they routed on the spanning tree.
-This is equal to the sum of the distance from each node to the last common ancestor of the two nodes being compared.
-The locator then consists of a root's key, timestamp, and coordinates representing each hop in the path from the root to the node.
-In practice, only the coords are used for routing, while the root and timestamp, along with all the per-hop signatures, are needed to securely construct the spanning tree.
-
-## Name-independent routing
-
-A [Chord](https://en.wikipedia.org/wiki/Chord_(peer-to-peer))-like Distributed Hash Table (DHT) is used as a distributed database that maps NodeIDs onto coordinates in the spanning tree metric space.
-The DHT is Chord-like in that it uses a successor/predecessor structure to do lookups in `O(n)` time with `O(1)` entries, then augments this with some additional information, adding roughly `O(logn)` additional entries, to reduce the lookup time to something around `O(logn)`.
-In the long term, the idea is to favor spending our bandwidth making sure the minimum `O(1)` part is right, to prioritize correctness, and then try to conserve bandwidth (and power) by being a bit lazy about checking the remaining `O(logn)` portion when it's not in use.
-
-To be specific, the DHT stores the immediate successor of a node, plus the next node it manages to find which is strictly closer (by the tree hop-count metric) than all previous nodes.
-The same process is repeated for predecessor nodes, and lookups walk the network in the predecessor direction, with each key being owned by its successor (to make sure defaulting to 0 for unknown bits of a `NodeID` doesn't cause us to overshoot the target during a lookup).
-In addition, all of a node's one-hop neighbors are included in the DHT, since we get this information "for free", and we must include it in our DHT to ensure that the network doesn't diverge to a broken state (though I suspect that only adding parents or parent-child relationships may be sufficient -- worth trying to prove or disprove, if somebody's bored).
-The DHT differs from Chord in that there are no values in the key:value store -- it only stores information about DHT peers -- and that it uses a [Kademlia](https://en.wikipedia.org/wiki/Kademlia)-inspired iterative-parallel lookup process.
-
-To summarize the entire routing procedure, when given only a node's IP address, the goal is to find a route to the destination.
-That happens through 3 steps:
-
-1. The address is unpacked into the known bits of a NodeID and a bitmask to signal which bits of the NodeID are known (the unknown bits are ignored).
-2. A DHT search is performed, which normally results in a response from the node closest in the DHT keyspace to the target `NodeID`. The response contains the node's curve25519 public key, which is checked to match the `NodeID` (and therefore the address), as well as the node's coordinates.
-3. Using the keys and coords from the above step, an ephemeral key exchange occurs between the source and destination nodes. These ephemeral session keys are used to encrypt any ordinary IPv6 traffic that may be encapsulated and sent between the nodes.
-
-From that point, the session keys and coords are cached and used to encrypt and send traffic between nodes. This is *mostly* transparent to the user: the initial DHT lookup and key exchange takes at least 2 round trips, so there's some delay before session setup completes and normal IPv6 traffic can flow. This is similar to the delay caused by a DNS lookup, although it generally takes longer, as a DHT lookup requires multiple iterations to reach the destination.
-
-## Project Status and Plans
-
-The current (Go) implementation is considered alpha, so compatibility with future versions is neither guaranteed nor expected.
-While users are discouraged from running anything truly critical on top of it, as of writing, it seems reliable enough for day-to-day use.
-
-As an "alpha" quality release, Yggdrasil *should* at least be able to detect incompatible versions when it sees them, and warn the users that an update may be needed.
-A "beta" quality release should know enough to be compatible in the face of wire format changes, and reasonably feature complete.
-A "stable" 1.0 release, if it ever happens, would probably be feature complete, with no expectation of future wire format changes, and free of known critical bugs.
-
-Roughly speaking, there are a few obvious ways the project could turn out:
-
-1. The developers could lose interest before it goes anywhere.
-2. The project could be reasonably complete (beta or stable), but never gain a significant number of users.
-3. The network may grow large enough that fundamental (non-fixable) design problems appear, which is hopefully a learning experience, but the project may die as a result.
-4. The network may grow large, but never hit any design problems, in which case we need to think about either moving the important parts into other projects ([cjdns](https://github.com/cjdelisle/cjdns)) or rewriting compatible implementations that are better optimized for the target platforms (e.g. a linux kernel module).
-
-That last one is probably impossible, because the speed of light would *eventually* become a problem, for a sufficiently large network.
-If the only thing limiting network growth turns out to be the underlying physics, then that arguably counts as a win.
-
-Also, note that some design decisions were made for ease-of-programming or ease-of-testing reasons, and likely need to be reconsidered at some point.
-In particular, Yggdrasil currently uses TCP for connections with one-hop neighbors, which introduces an additional layer of buffering that can lead to increased and/or unstable latency in congested areas of the network.
-

go.mod

@@ -3,7 +3,7 @@ module github.com/yggdrasil-network/yggdrasil-go
 go 1.16
 
 require (
-	github.com/Arceliar/ironwood v0.0.0-20210606094153-1bd43ce71198
+	github.com/Arceliar/ironwood v0.0.0-20210619124114-6ad55cae5031
 	github.com/Arceliar/phony v0.0.0-20210209235338-dde1a8dca979
 	github.com/VividCortex/ewma v1.2.0 // indirect
 	github.com/cheggaaa/pb/v3 v3.0.8

go.sum

@@ -1,5 +1,5 @@
-github.com/Arceliar/ironwood v0.0.0-20210606094153-1bd43ce71198 h1:wLF+CSqm9DrPeT2dp1E4Xe5of8SyUxfJVxw8DHeT1YM=
-github.com/Arceliar/ironwood v0.0.0-20210606094153-1bd43ce71198/go.mod h1:RP72rucOFm5udrnEzTmIWLRVGQiV/fSUAQXJ0RST/nk=
+github.com/Arceliar/ironwood v0.0.0-20210619124114-6ad55cae5031 h1:DZVDfYhVdu+0wAiRHoY1olyNkKxIot9UjBnbQFzuUlM=
+github.com/Arceliar/ironwood v0.0.0-20210619124114-6ad55cae5031/go.mod h1:RP72rucOFm5udrnEzTmIWLRVGQiV/fSUAQXJ0RST/nk=
 github.com/Arceliar/phony v0.0.0-20210209235338-dde1a8dca979 h1:WndgpSW13S32VLQ3ugUxx2EnnWmgba1kCqPkd4Gk1yQ=
 github.com/Arceliar/phony v0.0.0-20210209235338-dde1a8dca979/go.mod h1:6Lkn+/zJilRMsKmbmG1RPoamiArC6HS73xbwRyp3UyI=
 github.com/VividCortex/ewma v1.1.1/go.mod h1:2Tkkvm3sRDVXaiyucHiACn4cqf7DpdyLvmxzcbUokwA=

src/admin/admin.go

@@ -83,6 +83,7 @@ func (a *AdminSocket) Init(c *core.Core, nc *config.NodeConfig, log *log.Logger,
 		}
 		return res, nil
 	})
+	a.core.SetAdmin(a)
 	return nil
 }
 
@@ -142,6 +143,10 @@ func (a *AdminSocket) SetupAdminHandlers(na *AdminSocket) {
 		}
 		return res, nil
 	})
+	//_ = a.AddHandler("getNodeInfo", []string{"key"}, t.proto.nodeinfo.nodeInfoAdminHandler)
+	//_ = a.AddHandler("debug_remoteGetSelf", []string{"key"}, t.proto.getSelfHandler)
+	//_ = a.AddHandler("debug_remoteGetPeers", []string{"key"}, t.proto.getPeersHandler)
+	//_ = a.AddHandler("debug_remoteGetDHT", []string{"key"}, t.proto.getDHTHandler)
 }
 
 // Start runs the admin API socket to listen for / respond to admin API calls.

src/admin/getpeers.go

@@ -18,6 +18,7 @@ type PeerEntry struct {
 	PublicKey string   `json:"key"`
 	Port      uint64   `json:"port"`
 	Coords    []uint64 `json:"coords"`
+	Remote    string   `json:"remote"`
 }
 
 func (a *AdminSocket) getPeersHandler(req *GetPeersRequest, res *GetPeersResponse) error {
@@ -29,6 +30,7 @@ func (a *AdminSocket) getPeersHandler(req *GetPeersRequest, res *GetPeersRespons
 			PublicKey: hex.EncodeToString(p.Key),
 			Port:      p.Port,
 			Coords:    p.Coords,
+			Remote:    p.Remote,
 		}
 	}
 	return nil

src/config/config.go

@@ -20,8 +20,6 @@ import (
 	"crypto/ed25519"
 	"encoding/hex"
 	"sync"
-
-	"github.com/yggdrasil-network/yggdrasil-go/src/defaults"
 )
 
 // NodeConfig is the main configuration structure, containing configuration
@@ -29,45 +27,25 @@ import (
 // supply one of these structs to the Yggdrasil core when starting a node.
 type NodeConfig struct {
 	sync.RWMutex        `json:"-"`
-	Peers               []string               `comment:"List of connection strings for outbound peer connections in URI format,\ne.g. tcp://a.b.c.d:e or socks://a.b.c.d:e/f.g.h.i:j. These connections\nwill obey the operating system routing table, therefore you should\nuse this section when you may connect via different interfaces."`
-	InterfacePeers      map[string][]string    `comment:"List of connection strings for outbound peer connections in URI format,\narranged by source interface, e.g. { \"eth0\": [ tcp://a.b.c.d:e ] }.\nNote that SOCKS peerings will NOT be affected by this option and should\ngo in the \"Peers\" section instead."`
-	Listen              []string               `comment:"Listen addresses for incoming connections. You will need to add\nlisteners in order to accept incoming peerings from non-local nodes.\nMulticast peer discovery will work regardless of any listeners set\nhere. Each listener should be specified in URI format as above, e.g.\ntcp://0.0.0.0:0 or tcp://[::]:0 to listen on all interfaces."`
-	AdminListen         string                 `comment:"Listen address for admin connections. Default is to listen for local\nconnections either on TCP/9001 or a UNIX socket depending on your\nplatform. Use this value for yggdrasilctl -endpoint=X. To disable\nthe admin socket, use the value \"none\" instead."`
-	MulticastInterfaces []string               `comment:"Regular expressions for which interfaces multicast peer discovery\nshould be enabled on. If none specified, multicast peer discovery is\ndisabled. The default value is .* which uses all interfaces."`
-	AllowedPublicKeys   []string               `comment:"List of peer encryption public keys to allow incoming TCP peering\nconnections from. If left empty/undefined then all connections will\nbe allowed by default. This does not affect outgoing peerings, nor\ndoes it affect link-local peers discovered via multicast."`
-	PublicKey           string                 `comment:"Your public signing key. Your peers may ask you for this to put\ninto their AllowedPublicKeys configuration."`
-	PrivateKey          string                 `comment:"Your private signing key. DO NOT share this with anyone!"`
-	LinkLocalTCPPort    uint16                 `comment:"The port number to be used for the link-local TCP listeners for the\nconfigured MulticastInterfaces. This option does not affect listeners\nspecified in the Listen option. Unless you plan to firewall link-local\ntraffic, it is best to leave this as the default value of 0. This\noption cannot currently be changed by reloading config during runtime."`
-	IfName              string                 `comment:"Local network interface name for TUN adapter, or \"auto\" to select\nan interface automatically, or \"none\" to run without TUN."`
-	IfMTU               uint64                 `comment:"Maximum Transmission Unit (MTU) size for your local TUN interface.\nDefault is the largest supported size for your platform. The lowest\npossible value is 1280."`
-	NodeInfoPrivacy     bool                   `comment:"By default, nodeinfo contains some defaults including the platform,\narchitecture and Yggdrasil version. These can help when surveying\nthe network and diagnosing network routing problems. Enabling\nnodeinfo privacy prevents this, so that only items specified in\n\"NodeInfo\" are sent back if specified."`
-	NodeInfo            map[string]interface{} `comment:"Optional node info. This must be a { \"key\": \"value\", ... } map\nor set as null. This is entirely optional but, if set, is visible\nto the whole network on request."`
+	Peers               []string                   `comment:"List of connection strings for outbound peer connections in URI format,\ne.g. tls://a.b.c.d:e or socks://a.b.c.d:e/f.g.h.i:j. These connections\nwill obey the operating system routing table, therefore you should\nuse this section when you may connect via different interfaces."`
+	InterfacePeers      map[string][]string        `comment:"List of connection strings for outbound peer connections in URI format,\narranged by source interface, e.g. { \"eth0\": [ tls://a.b.c.d:e ] }.\nNote that SOCKS peerings will NOT be affected by this option and should\ngo in the \"Peers\" section instead."`
+	Listen              []string                   `comment:"Listen addresses for incoming connections. You will need to add\nlisteners in order to accept incoming peerings from non-local nodes.\nMulticast peer discovery will work regardless of any listeners set\nhere. Each listener should be specified in URI format as above, e.g.\ntls://0.0.0.0:0 or tls://[::]:0 to listen on all interfaces."`
+	AdminListen         string                     `comment:"Listen address for admin connections. Default is to listen for local\nconnections either on TCP/9001 or a UNIX socket depending on your\nplatform. Use this value for yggdrasilctl -endpoint=X. To disable\nthe admin socket, use the value \"none\" instead."`
+	MulticastInterfaces []MulticastInterfaceConfig `comment:"Configuration for which interfaces multicast peer discovery should be\nenabled on. Each entry in the list should be a json object which may\ncontain Regex, Beacon, Listen, and Port. Regex is a regular expression\nwhich is matched against an interface name, and interfaces use the\nfirst configuration that they match gainst. Beacon configures whether\nor not the node should send link-local multicast beacons to advertise\ntheir presence, while listening for incoming connections on Port.\nListen controls whether or not the node listens for multicast beacons\nand opens outgoing connections."`
+	AllowedPublicKeys   []string                   `comment:"List of peer public keys to allow incoming peering connections\nfrom. If left empty/undefined then all connections will be allowed\nby default. This does not affect outgoing peerings, nor does it\naffect link-local peers discovered via multicast."`
+	PublicKey           string                     `comment:"Your public key. Your peers may ask you for this to put\ninto their AllowedPublicKeys configuration."`
+	PrivateKey          string                     `comment:"Your private key. DO NOT share this with anyone!"`
+	IfName              string                     `comment:"Local network interface name for TUN adapter, or \"auto\" to select\nan interface automatically, or \"none\" to run without TUN."`
+	IfMTU               uint64                     `comment:"Maximum Transmission Unit (MTU) size for your local TUN interface.\nDefault is the largest supported size for your platform. The lowest\npossible value is 1280."`
+	NodeInfoPrivacy     bool                       `comment:"By default, nodeinfo contains some defaults including the platform,\narchitecture and Yggdrasil version. These can help when surveying\nthe network and diagnosing network routing problems. Enabling\nnodeinfo privacy prevents this, so that only items specified in\n\"NodeInfo\" are sent back if specified."`
+	NodeInfo            map[string]interface{}     `comment:"Optional node info. This must be a { \"key\": \"value\", ... } map\nor set as null. This is entirely optional but, if set, is visible\nto the whole network on request."`
 }
 
-// Generates default configuration and returns a pointer to the resulting
-// NodeConfig. This is used when outputting the -genconf parameter and also when
-// using -autoconf.
-func GenerateConfig() *NodeConfig {
-	// Generate encryption keys.
-	spub, spriv, err := ed25519.GenerateKey(nil)
-	if err != nil {
-		panic(err)
-	}
-	// Create a node configuration and populate it.
-	cfg := NodeConfig{}
-	cfg.Listen = []string{}
-	cfg.AdminListen = defaults.GetDefaults().DefaultAdminListen
-	cfg.PublicKey = hex.EncodeToString(spub[:])
-	cfg.PrivateKey = hex.EncodeToString(spriv[:])
-	cfg.Peers = []string{}
-	cfg.InterfacePeers = map[string][]string{}
-	cfg.AllowedPublicKeys = []string{}
-	cfg.MulticastInterfaces = defaults.GetDefaults().DefaultMulticastInterfaces
-	cfg.IfName = defaults.GetDefaults().DefaultIfName
-	cfg.IfMTU = defaults.GetDefaults().DefaultIfMTU
-	cfg.NodeInfoPrivacy = false
-
-	return &cfg
+type MulticastInterfaceConfig struct {
+	Regex  string
+	Beacon bool
+	Listen bool
+	Port   uint16
 }
 
 // NewSigningKeys replaces the signing keypair in the NodeConfig with a new

src/core/api.go

@@ -3,6 +3,7 @@ package core
 import (
 	"crypto/ed25519"
 	//"encoding/hex"
+	"encoding/json"
 	//"errors"
 	//"fmt"
 	"net"
@@ -27,6 +28,7 @@ type Peer struct {
 	Root   ed25519.PublicKey
 	Coords []uint64
 	Port   uint64
+	Remote string
 }
 
 type DHTEntry struct {
@@ -46,7 +48,7 @@ type Session struct {
 
 func (c *Core) GetSelf() Self {
 	var self Self
-	s := c.PacketConn.PacketConn.Debug.GetSelf()
+	s := c.pc.PacketConn.Debug.GetSelf()
 	self.Key = s.Key
 	self.Root = s.Root
 	self.Coords = s.Coords
@@ -55,13 +57,23 @@ func (c *Core) GetSelf() Self {
 
 func (c *Core) GetPeers() []Peer {
 	var peers []Peer
-	ps := c.PacketConn.PacketConn.Debug.GetPeers()
+	names := make(map[net.Conn]string)
+	c.links.mutex.Lock()
+	for _, info := range c.links.links {
+		names[info.conn] = info.lname
+	}
+	c.links.mutex.Unlock()
+	ps := c.pc.PacketConn.Debug.GetPeers()
 	for _, p := range ps {
 		var info Peer
 		info.Key = p.Key
 		info.Root = p.Root
 		info.Coords = p.Coords
 		info.Port = p.Port
+		info.Remote = p.Conn.RemoteAddr().String()
+		if name := names[p.Conn]; name != "" {
+			info.Remote = name
+		}
 		peers = append(peers, info)
 	}
 	return peers
@@ -69,7 +81,7 @@ func (c *Core) GetPeers() []Peer {
 
 func (c *Core) GetDHT() []DHTEntry {
 	var dhts []DHTEntry
-	ds := c.PacketConn.PacketConn.Debug.GetDHT()
+	ds := c.pc.PacketConn.Debug.GetDHT()
 	for _, d := range ds {
 		var info DHTEntry
 		info.Key = d.Key
@@ -82,7 +94,7 @@ func (c *Core) GetDHT() []DHTEntry {
 
 func (c *Core) GetPaths() []PathEntry {
 	var paths []PathEntry
-	ps := c.PacketConn.PacketConn.Debug.GetPaths()
+	ps := c.pc.PacketConn.Debug.GetPaths()
 	for _, p := range ps {
 		var info PathEntry
 		info.Key = p.Key
@@ -94,7 +106,7 @@ func (c *Core) GetPaths() []PathEntry {
 
 func (c *Core) GetSessions() []Session {
 	var sessions []Session
-	ss := c.PacketConn.Debug.GetSessions()
+	ss := c.pc.Debug.GetSessions()
 	for _, s := range ss {
 		var info Session
 		info.Key = s.Key
@@ -222,3 +234,68 @@ func (c *Core) RemovePeer(addr string, sintf string) error {
 func (c *Core) CallPeer(u *url.URL, sintf string) error {
 	return c.links.call(u, sintf)
 }
+
+func (c *Core) PublicKey() ed25519.PublicKey {
+	return c.public
+}
+
+func (c *Core) MaxMTU() uint64 {
+	return c.store.maxSessionMTU()
+}
+
+func (c *Core) SetMTU(mtu uint64) {
+	if mtu < 1280 {
+		mtu = 1280
+	}
+	c.store.mutex.Lock()
+	c.store.mtu = mtu
+	c.store.mutex.Unlock()
+}
+
+func (c *Core) MTU() uint64 {
+	c.store.mutex.Lock()
+	mtu := c.store.mtu
+	c.store.mutex.Unlock()
+	return mtu
+}
+
+// Implement io.ReadWriteCloser
+
+func (c *Core) Read(p []byte) (n int, err error) {
+	n, err = c.store.readPC(p)
+	return
+}
+
+func (c *Core) Write(p []byte) (n int, err error) {
+	n, err = c.store.writePC(p)
+	return
+}
+
+func (c *Core) Close() error {
+	c.Stop()
+	return nil
+}
+
+// Hack to get the admin stuff working, TODO something cleaner
+
+type AddHandler interface {
+	AddHandler(name string, args []string, handlerfunc func(json.RawMessage) (interface{}, error)) error
+}
+
+// SetAdmin must be called after Init and before Start.
+// It sets the admin handler for NodeInfo and the Debug admin functions.
+func (c *Core) SetAdmin(a AddHandler) error {
+	if err := a.AddHandler("getNodeInfo", []string{"key"}, c.proto.nodeinfo.nodeInfoAdminHandler); err != nil {
+		return err
+	}
+	if err := a.AddHandler("debug_remoteGetSelf", []string{"key"}, c.proto.getSelfHandler); err != nil {
+		return err
+	}
+	if err := a.AddHandler("debug_remoteGetPeers", []string{"key"}, c.proto.getPeersHandler); err != nil {
+		return err
+	}
+	if err := a.AddHandler("debug_remoteGetDHT", []string{"key"}, c.proto.getDHTHandler); err != nil {
+		return err
+	}
+	return nil
+}

src/core/core.go

@@ -5,6 +5,7 @@ import (
 	"crypto/ed25519"
 	"encoding/hex"
 	"errors"
+	"fmt"
 	"io/ioutil"
 	"net/url"
 	"time"
@@ -25,11 +26,13 @@ type Core struct {
 	// We're going to keep our own copy of the provided config - that way we can
 	// guarantee that it will be covered by the mutex
 	phony.Inbox
-	*iw.PacketConn
+	pc           *iw.PacketConn
 	config       *config.NodeConfig // Config
 	secret       ed25519.PrivateKey
 	public       ed25519.PublicKey
 	links        links
+	proto        protoHandler
+	store        keyStore
 	log          *log.Logger
 	addPeerTimer *time.Timer
 	ctx          context.Context
@@ -41,13 +44,13 @@ func (c *Core) _init() error {
 	//  Init sets up structs
 	//  Start launches goroutines that depend on structs being set up
 	// This is pretty much required to completely avoid race conditions
+	c.config.RLock()
+	defer c.config.RUnlock()
 	if c.log == nil {
 		c.log = log.New(ioutil.Discard, "", 0)
 	}
 
-	c.config.RLock()
 	sigPriv, err := hex.DecodeString(c.config.PrivateKey)
-	c.config.RUnlock()
 	if err != nil {
 		return err
 	}
@@ -59,8 +62,13 @@ func (c *Core) _init() error {
 	c.public = c.secret.Public().(ed25519.PublicKey)
 	// TODO check public against current.PublicKey, error if they don't match
 
-	c.PacketConn, err = iw.NewPacketConn(c.secret)
+	c.pc, err = iw.NewPacketConn(c.secret)
 	c.ctx, c.ctxCancel = context.WithCancel(context.Background())
+	c.store.init(c)
+	c.proto.init(c)
+	if err := c.proto.nodeinfo.setNodeInfo(c.config.NodeInfo, c.config.NodeInfoPrivacy); err != nil {
+		return fmt.Errorf("setNodeInfo: %w", err)
+	}
 	return err
 }
 
@@ -160,7 +168,7 @@ func (c *Core) Stop() {
 func (c *Core) _stop() {
 	c.log.Infoln("Stopping...")
 	c.ctxCancel()
-	c.PacketConn.Close()
+	c.pc.Close()
 	if c.addPeerTimer != nil {
 		c.addPeerTimer.Stop()
 		c.addPeerTimer = nil

src/core/core_test.go

@@ -11,11 +11,12 @@ import (
 	"github.com/gologme/log"
 
 	"github.com/yggdrasil-network/yggdrasil-go/src/config"
+	"github.com/yggdrasil-network/yggdrasil-go/src/defaults"
 )
 
 // GenerateConfig produces default configuration with suitable modifications for tests.
 func GenerateConfig() *config.NodeConfig {
-	cfg := config.GenerateConfig()
+	cfg := defaults.GenerateConfig()
 	cfg.AdminListen = "none"
 	cfg.Listen = []string{"tcp://127.0.0.1:0"}
 	cfg.IfName = "none"
@@ -43,11 +44,13 @@ func CreateAndConnectTwo(t testing.TB, verbose bool) (nodeA *Core, nodeB *Core)
 	if err := nodeA.Start(GenerateConfig(), GetLoggerWithPrefix("A: ", verbose)); err != nil {
 		t.Fatal(err)
 	}
+	nodeA.SetMTU(1500)
 
 	nodeB = new(Core)
 	if err := nodeB.Start(GenerateConfig(), GetLoggerWithPrefix("B: ", verbose)); err != nil {
 		t.Fatal(err)
 	}
+	nodeB.SetMTU(1500)
 
 	u, err := url.Parse("tcp://" + nodeA.links.tcp.getAddr().String())
 	if err != nil {
@@ -89,8 +92,9 @@ func CreateEchoListener(t testing.TB, nodeA *Core, bufLen int, repeats int) chan
 	done := make(chan struct{})
 	go func() {
 		buf := make([]byte, bufLen)
+		res := make([]byte, bufLen)
 		for i := 0; i < repeats; i++ {
-			n, from, err := nodeA.ReadFrom(buf)
+			n, err := nodeA.Read(buf)
 			if err != nil {
 				t.Error(err)
 				return
@@ -99,7 +103,10 @@ func CreateEchoListener(t testing.TB, nodeA *Core, bufLen int, repeats int) chan
 				t.Error("missing data")
 				return
 			}
-			_, err = nodeA.WriteTo(buf, from)
+			copy(res, buf)
+			copy(res[8:24], buf[24:40])
+			copy(res[24:40], buf[8:24])
+			_, err = nodeA.Write(res)
 			if err != nil {
 				t.Error(err)
 			}
@@ -130,17 +137,20 @@ func TestCore_Start_Transfer(t *testing.T) {
 
 	// Send
 	msg := make([]byte, msgLen)
-	rand.Read(msg)
-	_, err := nodeB.WriteTo(msg, nodeA.LocalAddr())
+	rand.Read(msg[40:])
+	msg[0] = 0x60
+	copy(msg[8:24], nodeB.Address())
+	copy(msg[24:40], nodeA.Address())
+	_, err := nodeB.Write(msg)
 	if err != nil {
 		t.Fatal(err)
 	}
 	buf := make([]byte, msgLen)
-	_, _, err = nodeB.ReadFrom(buf)
+	_, err = nodeB.Read(buf)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !bytes.Equal(msg, buf) {
+	if !bytes.Equal(msg[40:], buf[40:]) {
 		t.Fatal("expected echo")
 	}
 	<-done
@@ -159,18 +169,22 @@ func BenchmarkCore_Start_Transfer(b *testing.B) {
 
 	// Send
 	msg := make([]byte, msgLen)
-	rand.Read(msg)
+	rand.Read(msg[40:])
+	msg[0] = 0x60
+	copy(msg[8:24], nodeB.Address())
+	copy(msg[24:40], nodeA.Address())
+
 	buf := make([]byte, msgLen)
 
 	b.SetBytes(int64(msgLen))
 	b.ResetTimer()
 
 	for i := 0; i < b.N; i++ {
-		_, err := nodeB.WriteTo(msg, nodeA.LocalAddr())
+		_, err := nodeB.Write(msg)
 		if err != nil {
 			b.Fatal(err)
 		}
-		_, _, err = nodeB.ReadFrom(buf)
+		_, err = nodeB.Read(buf)
 		if err != nil {
 			b.Fatal(err)
 		}

src/core/icmpv6.go

@@ -1,4 +1,4 @@
-package tuntap
+package core
 
 // The ICMPv6 module implements functions to easily create ICMPv6
 // packets. These functions, when mixed with the built-in Go IPv6

src/core/keystore.go

@@ -0,0 +1,308 @@
+package core
+
+import (
+	"crypto/ed25519"
+	"errors"
+	"fmt"
+	"net"
+	"sync"
+	"time"
+
+	"golang.org/x/net/icmp"
+	"golang.org/x/net/ipv6"
+
+	iwt "github.com/Arceliar/ironwood/types"
+
+	"github.com/yggdrasil-network/yggdrasil-go/src/address"
+)
+
+const keyStoreTimeout = 2 * time.Minute
+
+type keyArray [ed25519.PublicKeySize]byte
+
+type keyStore struct {
+	core         *Core
+	address      address.Address
+	subnet       address.Subnet
+	mutex        sync.Mutex
+	keyToInfo    map[keyArray]*keyInfo
+	addrToInfo   map[address.Address]*keyInfo
+	addrBuffer   map[address.Address]*buffer
+	subnetToInfo map[address.Subnet]*keyInfo
+	subnetBuffer map[address.Subnet]*buffer
+	mtu          uint64
+}
+
+type keyInfo struct {
+	key     keyArray
+	address address.Address
+	subnet  address.Subnet
+	timeout *time.Timer // From calling a time.AfterFunc to do cleanup
+}
+
+type buffer struct {
+	packet  []byte
+	timeout *time.Timer
+}
+
+func (k *keyStore) init(core *Core) {
+	k.core = core
+	k.address = *address.AddrForKey(k.core.public)
+	k.subnet = *address.SubnetForKey(k.core.public)
+	if err := k.core.pc.SetOutOfBandHandler(k.oobHandler); err != nil {
+		err = fmt.Errorf("tun.core.SetOutOfBandHander: %w", err)
+		panic(err)
+	}
+	k.keyToInfo = make(map[keyArray]*keyInfo)
+	k.addrToInfo = make(map[address.Address]*keyInfo)
+	k.addrBuffer = make(map[address.Address]*buffer)
+	k.subnetToInfo = make(map[address.Subnet]*keyInfo)
+	k.subnetBuffer = make(map[address.Subnet]*buffer)
+	k.mtu = 1280 // Default to something safe, expect user to set this
+}
+
+func (k *keyStore) sendToAddress(addr address.Address, bs []byte) {
+	k.mutex.Lock()
+	if info := k.addrToInfo[addr]; info != nil {
+		k.resetTimeout(info)
+		k.mutex.Unlock()
+		_, _ = k.core.pc.WriteTo(bs, iwt.Addr(info.key[:]))
+	} else {
+		var buf *buffer
+		if buf = k.addrBuffer[addr]; buf == nil {
+			buf = new(buffer)
+			k.addrBuffer[addr] = buf
+		}
+		msg := append([]byte(nil), bs...)
+		buf.packet = msg
+		if buf.timeout != nil {
+			buf.timeout.Stop()
+		}
+		buf.timeout = time.AfterFunc(keyStoreTimeout, func() {
+			k.mutex.Lock()
+			defer k.mutex.Unlock()
+			if nbuf := k.addrBuffer[addr]; nbuf == buf {
+				delete(k.addrBuffer, addr)
+			}
+		})
+		k.mutex.Unlock()
+		k.sendKeyLookup(addr.GetKey())
+	}
+}
+
+func (k *keyStore) sendToSubnet(subnet address.Subnet, bs []byte) {
+	k.mutex.Lock()
+	if info := k.subnetToInfo[subnet]; info != nil {
+		k.resetTimeout(info)
+		k.mutex.Unlock()
+		_, _ = k.core.pc.WriteTo(bs, iwt.Addr(info.key[:]))
+	} else {
+		var buf *buffer
+		if buf = k.subnetBuffer[subnet]; buf == nil {
+			buf = new(buffer)
+			k.subnetBuffer[subnet] = buf
+		}
+		msg := append([]byte(nil), bs...)
+		buf.packet = msg
+		if buf.timeout != nil {
+			buf.timeout.Stop()
+		}
+		buf.timeout = time.AfterFunc(keyStoreTimeout, func() {
+			k.mutex.Lock()
+			defer k.mutex.Unlock()
+			if nbuf := k.subnetBuffer[subnet]; nbuf == buf {
+				delete(k.subnetBuffer, subnet)
+			}
+		})
+		k.mutex.Unlock()
+		k.sendKeyLookup(subnet.GetKey())
+	}
+}
+
+func (k *keyStore) update(key ed25519.PublicKey) *keyInfo {
+	k.mutex.Lock()
+	var kArray keyArray
+	copy(kArray[:], key)
+	var info *keyInfo
+	if info = k.keyToInfo[kArray]; info == nil {
+		info = new(keyInfo)
+		info.key = kArray
+		info.address = *address.AddrForKey(ed25519.PublicKey(info.key[:]))
+		info.subnet = *address.SubnetForKey(ed25519.PublicKey(info.key[:]))
+		k.keyToInfo[info.key] = info
+		k.addrToInfo[info.address] = info
+		k.subnetToInfo[info.subnet] = info
+		k.resetTimeout(info)
+		k.mutex.Unlock()
+		if buf := k.addrBuffer[info.address]; buf != nil {
+			k.core.pc.WriteTo(buf.packet, iwt.Addr(info.key[:]))
+			delete(k.addrBuffer, info.address)
+		}
+		if buf := k.subnetBuffer[info.subnet]; buf != nil {
+			k.core.pc.WriteTo(buf.packet, iwt.Addr(info.key[:]))
+			delete(k.subnetBuffer, info.subnet)
+		}
+	} else {
+		k.resetTimeout(info)
+		k.mutex.Unlock()
+	}
+	return info
+}
+
+func (k *keyStore) resetTimeout(info *keyInfo) {
+	if info.timeout != nil {
+		info.timeout.Stop()
+	}
+	info.timeout = time.AfterFunc(keyStoreTimeout, func() {
+		k.mutex.Lock()
+		defer k.mutex.Unlock()
+		if nfo := k.keyToInfo[info.key]; nfo == info {
+			delete(k.keyToInfo, info.key)
+		}
+		if nfo := k.addrToInfo[info.address]; nfo == info {
+			delete(k.addrToInfo, info.address)
+		}
+		if nfo := k.subnetToInfo[info.subnet]; nfo == info {
+			delete(k.subnetToInfo, info.subnet)
+		}
+	})
+}
+
+func (k *keyStore) oobHandler(fromKey, toKey ed25519.PublicKey, data []byte) {
+	if len(data) != 1+ed25519.SignatureSize {
+		return
+	}
+	sig := data[1:]
+	switch data[0] {
+	case typeKeyLookup:
+		snet := *address.SubnetForKey(toKey)
+		if snet == k.subnet && ed25519.Verify(fromKey, toKey[:], sig) {
+			// This is looking for at least our subnet (possibly our address)
+			// Send a response
+			k.sendKeyResponse(fromKey)
+		}
+	case typeKeyResponse:
+		// TODO keep a list of something to match against...
+		// Ignore the response if it doesn't match anything of interest...
+		if ed25519.Verify(fromKey, toKey[:], sig) {
+			k.update(fromKey)
+		}
+	}
+}
+
+func (k *keyStore) sendKeyLookup(partial ed25519.PublicKey) {
+	sig := ed25519.Sign(k.core.secret, partial[:])
+	bs := append([]byte{typeKeyLookup}, sig...)
+	_ = k.core.pc.SendOutOfBand(partial, bs)
+}
+
+func (k *keyStore) sendKeyResponse(dest ed25519.PublicKey) {
+	sig := ed25519.Sign(k.core.secret, dest[:])
+	bs := append([]byte{typeKeyResponse}, sig...)
+	_ = k.core.pc.SendOutOfBand(dest, bs)
+}
+
+func (k *keyStore) maxSessionMTU() uint64 {
+	const sessionTypeOverhead = 1
+	return k.core.pc.MTU() - sessionTypeOverhead
+}
+
+func (k *keyStore) readPC(p []byte) (int, error) {
+	buf := make([]byte, k.core.pc.MTU(), 65535)
+	for {
+		bs := buf
+		n, from, err := k.core.pc.ReadFrom(bs)
+		if err != nil {
+			return n, err
+		}
+		if n == 0 {
+			continue
+		}
+		switch bs[0] {
+		case typeSessionTraffic:
+			// This is what we want to handle here
+		case typeSessionProto:
+			var key keyArray
+			copy(key[:], from.(iwt.Addr))
+			data := append([]byte(nil), bs[1:n]...)
+			k.core.proto.handleProto(nil, key, data)
+			continue
+		default:
+			continue
+		}
+		bs = bs[1:n]
+		if len(bs) == 0 {
+			continue
+		}
+		if bs[0]&0xf0 != 0x60 {
+			continue // not IPv6
+		}
+		if len(bs) < 40 {
+			continue
+		}
+		k.mutex.Lock()
+		mtu := int(k.mtu)
+		k.mutex.Unlock()
+		if len(bs) > mtu {
+			// Using bs would make it leak off the stack, so copy to buf
+			buf := make([]byte, 40)
+			copy(buf, bs)
+			ptb := &icmp.PacketTooBig{
+				MTU:  mtu,
+				Data: buf[:40],
+			}
+			if packet, err := CreateICMPv6(buf[8:24], buf[24:40], ipv6.ICMPTypePacketTooBig, 0, ptb); err == nil {
+				_, _ = k.writePC(packet)
+			}
+			continue
+		}
+		var srcAddr, dstAddr address.Address
+		var srcSubnet, dstSubnet address.Subnet
+		copy(srcAddr[:], bs[8:])
+		copy(dstAddr[:], bs[24:])
+		copy(srcSubnet[:], bs[8:])
+		copy(dstSubnet[:], bs[24:])
+		if dstAddr != k.address && dstSubnet != k.subnet {
+			continue // bad local address/subnet
+		}
+		info := k.update(ed25519.PublicKey(from.(iwt.Addr)))
+		if srcAddr != info.address && srcSubnet != info.subnet {
+			continue // bad remote address/subnet
+		}
+		n = copy(p, bs)
+		return n, nil
+	}
+}
+
+func (k *keyStore) writePC(bs []byte) (int, error) {
+	if bs[0]&0xf0 != 0x60 {
+		return 0, errors.New("not an IPv6 packet") // not IPv6
+	}
+	if len(bs) < 40 {
+		strErr := fmt.Sprint("undersized IPv6 packet, length: ", len(bs))
+		return 0, errors.New(strErr)
+	}
+	var srcAddr, dstAddr address.Address
+	var srcSubnet, dstSubnet address.Subnet
+	copy(srcAddr[:], bs[8:])
+	copy(dstAddr[:], bs[24:])
+	copy(srcSubnet[:], bs[8:])
+	copy(dstSubnet[:], bs[24:])
+	if srcAddr != k.address && srcSubnet != k.subnet {
+		// This happens all the time due to link-local traffic
+		// Don't send back an error, just drop it
+		strErr := fmt.Sprint("incorrect source address: ", net.IP(srcAddr[:]).String())
+		return 0, errors.New(strErr)
+	}
+	buf := make([]byte, 1+len(bs), 65535)
+	buf[0] = typeSessionTraffic
+	copy(buf[1:], bs)
+	if dstAddr.IsValid() {
+		k.sendToAddress(dstAddr, buf)
+	} else if dstSubnet.IsValid() {
+		k.sendToSubnet(dstSubnet, buf)
+	} else {
+		return 0, errors.New("invalid destination address")
+	}
+	return len(bs), nil
+}

src/core/link.go

@@ -20,8 +20,6 @@ import (
 	//"github.com/Arceliar/phony" // TODO? use instead of mutexes
 )
 
-type keyArray [ed25519.PublicKeySize]byte
-
 type links struct {
 	core    *Core
 	mutex   sync.RWMutex // protects links below
@@ -95,6 +93,7 @@ func (l *links) call(u *url.URL, sintf string) error {
 			tcpOpts.socksProxyAuth.User = u.User.Username()
 			tcpOpts.socksProxyAuth.Password, _ = u.User.Password()
 		}
+		tcpOpts.upgrade = l.tcp.tls.forDialer // TODO make this configurable
 		pathtokens := strings.Split(strings.Trim(u.Path, "/"), "/")
 		l.tcp.call(pathtokens[0], tcpOpts, sintf)
 	case "tls":
@@ -231,7 +230,7 @@ func (intf *link) handler() (chan struct{}, error) {
 	intf.links.core.log.Infof("Connected %s: %s, source %s",
 		strings.ToUpper(intf.info.linkType), themString, intf.info.local)
 	// Run the handler
-	err = intf.links.core.PacketConn.HandleConn(ed25519.PublicKey(intf.info.key[:]), intf.conn)
+	err = intf.links.core.pc.HandleConn(ed25519.PublicKey(intf.info.key[:]), intf.conn)
 	// TODO don't report an error if it's just a 'use of closed network connection'
 	if err != nil {
 		intf.links.core.log.Infof("Disconnected %s: %s, source %s; error: %s",

src/core/nodeinfo.go

@@ -1,4 +1,4 @@
-package tuntap
+package core
 
 import (
 	"encoding/hex"
@@ -129,7 +129,7 @@ func (m *nodeinfo) _sendReq(key keyArray, callback func(nodeinfo NodeInfoPayload
 	if callback != nil {
 		m._addCallback(key, callback)
 	}
-	_, _ = m.proto.tun.core.WriteTo([]byte{typeSessionProto, typeProtoNodeInfoRequest}, iwt.Addr(key[:]))
+	_, _ = m.proto.core.pc.WriteTo([]byte{typeSessionProto, typeProtoNodeInfoRequest}, iwt.Addr(key[:]))
 }
 
 func (m *nodeinfo) handleReq(from phony.Actor, key keyArray) {
@@ -146,7 +146,7 @@ func (m *nodeinfo) handleRes(from phony.Actor, key keyArray, info NodeInfoPayloa
 
 func (m *nodeinfo) _sendRes(key keyArray) {
 	bs := append([]byte{typeSessionProto, typeProtoNodeInfoResponse}, m._getNodeInfo()...)
-	_, _ = m.proto.tun.core.WriteTo(bs, iwt.Addr(key[:]))
+	_, _ = m.proto.core.pc.WriteTo(bs, iwt.Addr(key[:]))
 }
 
 // Admin socket stuff

src/core/proto.go

@@ -1,4 +1,4 @@
-package tuntap
+package core
 
 import (
 	"encoding/hex"
@@ -31,15 +31,15 @@ type reqInfo struct {
 
 type protoHandler struct {
 	phony.Inbox
-	tun      *TunAdapter
+	core     *Core
 	nodeinfo nodeinfo
 	sreqs    map[keyArray]*reqInfo
 	preqs    map[keyArray]*reqInfo
 	dreqs    map[keyArray]*reqInfo
 }
 
-func (p *protoHandler) init(tun *TunAdapter) {
-	p.tun = tun
+func (p *protoHandler) init(core *Core) {
+	p.core = core
 	p.nodeinfo.init(p)
 	p.sreqs = make(map[keyArray]*reqInfo)
 	p.preqs = make(map[keyArray]*reqInfo)
@@ -103,7 +103,7 @@ func (p *protoHandler) sendGetSelfRequest(key keyArray, callback func([]byte)) {
 }
 
 func (p *protoHandler) _handleGetSelfRequest(key keyArray) {
-	self := p.tun.core.GetSelf()
+	self := p.core.GetSelf()
 	res := map[string]string{
 		"key":    hex.EncodeToString(self.Key[:]),
 		"coords": fmt.Sprintf("%v", self.Coords),
@@ -144,12 +144,12 @@ func (p *protoHandler) sendGetPeersRequest(key keyArray, callback func([]byte))
 }
 
 func (p *protoHandler) _handleGetPeersRequest(key keyArray) {
-	peers := p.tun.core.GetPeers()
+	peers := p.core.GetPeers()
 	var bs []byte
 	for _, pinfo := range peers {
 		tmp := append(bs, pinfo.Key[:]...)
 		const responseOverhead = 2 // 1 debug type, 1 getpeers type
-		if uint64(len(tmp))+responseOverhead > p.tun.maxSessionMTU() {
+		if uint64(len(tmp))+responseOverhead > p.core.store.maxSessionMTU() {
 			break
 		}
 		bs = tmp
@@ -186,12 +186,12 @@ func (p *protoHandler) sendGetDHTRequest(key keyArray, callback func([]byte)) {
 }
 
 func (p *protoHandler) _handleGetDHTRequest(key keyArray) {
-	dinfos := p.tun.core.GetDHT()
+	dinfos := p.core.GetDHT()
 	var bs []byte
 	for _, dinfo := range dinfos {
 		tmp := append(bs, dinfo.Key[:]...)
 		const responseOverhead = 2 // 1 debug type, 1 getdht type
-		if uint64(len(tmp))+responseOverhead > p.tun.maxSessionMTU() {
+		if uint64(len(tmp))+responseOverhead > p.core.store.maxSessionMTU() {
 			break
 		}
 		bs = tmp
@@ -209,7 +209,7 @@ func (p *protoHandler) _handleGetDHTResponse(key keyArray, bs []byte) {
 
 func (p *protoHandler) _sendDebug(key keyArray, dType uint8, data []byte) {
 	bs := append([]byte{typeSessionProto, typeProtoDebug, dType}, data...)
-	_, _ = p.tun.core.WriteTo(bs, iwt.Addr(key[:]))
+	_, _ = p.core.pc.WriteTo(bs, iwt.Addr(key[:]))
 }
 
 // Admin socket stuff

src/core/tcp.go

@@ -54,7 +54,7 @@ type TcpListener struct {
 }
 
 type TcpUpgrade struct {
-	upgrade func(c net.Conn) (net.Conn, error)
+	upgrade func(c net.Conn, o *tcpOptions) (net.Conn, error)
 	name    string
 }
 
@@ -185,17 +185,21 @@ func (t *tcp) listener(l *TcpListener, listenaddr string) {
 		l.Listener.Close()
 		return
 	}
+	callproto := "TCP"
+	if l.opts.upgrade != nil {
+		callproto = strings.ToUpper(l.opts.upgrade.name)
+	}
 	t.listeners[listenaddr] = l
 	t.mutex.Unlock()
 	// And here we go!
 	defer func() {
-		t.links.core.log.Infoln("Stopping TCP listener on:", l.Listener.Addr().String())
+		t.links.core.log.Infoln("Stopping", callproto, "listener on:", l.Listener.Addr().String())
 		l.Listener.Close()
 		t.mutex.Lock()
 		delete(t.listeners, listenaddr)
 		t.mutex.Unlock()
 	}()
-	t.links.core.log.Infoln("Listening for TCP on:", l.Listener.Addr().String())
+	t.links.core.log.Infoln("Listening for", callproto, "on:", l.Listener.Addr().String())
 	go func() {
 		<-l.stop
 		l.Listener.Close()
@@ -361,7 +365,7 @@ func (t *tcp) handler(sock net.Conn, incoming bool, options tcpOptions) chan str
 	var upgraded bool
 	if options.upgrade != nil {
 		var err error
-		if sock, err = options.upgrade.upgrade(sock); err != nil {
+		if sock, err = options.upgrade.upgrade(sock, &options); err != nil {
 			t.links.core.log.Errorln("TCP handler upgrade failed:", err)
 			return nil
 		}

src/core/tls.go

@@ -9,6 +9,7 @@ import (
 	"crypto/x509/pkix"
 	"encoding/hex"
 	"encoding/pem"
+	"errors"
 	"log"
 	"math/big"
 	"net"
@@ -76,16 +77,47 @@ func (t *tcptls) init(tcp *tcp) {
 	}
 }
 
-func (t *tcptls) upgradeListener(c net.Conn) (net.Conn, error) {
-	conn := tls.Server(c, t.config)
+func (t *tcptls) configForOptions(options *tcpOptions) *tls.Config {
+	config := *t.config
+	config.VerifyPeerCertificate = func(rawCerts [][]byte, _ [][]*x509.Certificate) error {
+		if len(rawCerts) != 1 {
+			return errors.New("tls not exactly 1 cert")
+		}
+		cert, err := x509.ParseCertificate(rawCerts[0])
+		if err != nil {
+			return errors.New("tls failed to parse cert")
+		}
+		if cert.PublicKeyAlgorithm != x509.Ed25519 {
+			return errors.New("tls wrong cert algorithm")
+		}
+		pk := cert.PublicKey.(ed25519.PublicKey)
+		var key keyArray
+		copy(key[:], pk)
+		// If options does not have a pinned key, then pin one now
+		if options.pinnedEd25519Keys == nil {
+			options.pinnedEd25519Keys = make(map[keyArray]struct{})
+			options.pinnedEd25519Keys[key] = struct{}{}
+		}
+		if _, isIn := options.pinnedEd25519Keys[key]; !isIn {
+			return errors.New("tls key does not match pinned key")
+		}
+		return nil
+	}
+	return &config
+}
+
+func (t *tcptls) upgradeListener(c net.Conn, options *tcpOptions) (net.Conn, error) {
+	config := t.configForOptions(options)
+	conn := tls.Server(c, config)
 	if err := conn.Handshake(); err != nil {
 		return c, err
 	}
 	return conn, nil
 }
 
-func (t *tcptls) upgradeDialer(c net.Conn) (net.Conn, error) {
-	conn := tls.Client(c, t.config)
+func (t *tcptls) upgradeDialer(c net.Conn, options *tcpOptions) (net.Conn, error) {
+	config := t.configForOptions(options)
+	conn := tls.Client(c, config)
 	if err := conn.Handshake(); err != nil {
 		return c, err
 	}

src/core/types.go

@@ -1,4 +1,4 @@
-package tuntap
+package core
 
 // Out-of-band packet types
 const (

src/core/version.go

@@ -22,7 +22,7 @@ func version_getBaseMetadata() version_metadata {
 	return version_metadata{
 		meta:     [4]byte{'m', 'e', 't', 'a'},
 		ver:      0,
-		minorVer: 0,
+		minorVer: 4,
 	}
 }
 

src/defaults/defaults.go

@@ -1,5 +1,9 @@
 package defaults
 
+import "github.com/yggdrasil-network/yggdrasil-go/src/config"
+
+type MulticastInterfaceConfig = config.MulticastInterfaceConfig
+
 // Defines which parameters are expected by default for configuration on a
 // specific platform. These values are populated in the relevant defaults_*.go
 // for the platform being targeted. They must be set.
@@ -11,10 +15,30 @@ type platformDefaultParameters struct {
 	DefaultConfigFile string
 
 	// Multicast interfaces
-	DefaultMulticastInterfaces []string
+	DefaultMulticastInterfaces []MulticastInterfaceConfig
 
 	// TUN/TAP
 	MaximumIfMTU  uint64
 	DefaultIfMTU  uint64
 	DefaultIfName string
 }
+
+// Generates default configuration and returns a pointer to the resulting
+// NodeConfig. This is used when outputting the -genconf parameter and also when
+// using -autoconf.
+func GenerateConfig() *config.NodeConfig {
+	// Create a node configuration and populate it.
+	cfg := new(config.NodeConfig)
+	cfg.NewKeys()
+	cfg.Listen = []string{}
+	cfg.AdminListen = GetDefaults().DefaultAdminListen
+	cfg.Peers = []string{}
+	cfg.InterfacePeers = map[string][]string{}
+	cfg.AllowedPublicKeys = []string{}
+	cfg.MulticastInterfaces = GetDefaults().DefaultMulticastInterfaces
+	cfg.IfName = GetDefaults().DefaultIfName
+	cfg.IfMTU = GetDefaults().DefaultIfMTU
+	cfg.NodeInfoPrivacy = false
+
+	return cfg
+}

src/defaults/defaults_darwin.go

@@ -13,9 +13,9 @@ func GetDefaults() platformDefaultParameters {
 		DefaultConfigFile: "/etc/yggdrasil.conf",
 
 		// Multicast interfaces
-		DefaultMulticastInterfaces: []string{
-			"en.*",
-			"bridge.*",
+		DefaultMulticastInterfaces: []MulticastInterfaceConfig{
+			{Regex: "en.*", Beacon: true, Listen: true},
+			{Regex: "bridge.*", Beacon: true, Listen: true},
 		},
 
 		// TUN/TAP

src/defaults/defaults_freebsd.go

@@ -13,8 +13,8 @@ func GetDefaults() platformDefaultParameters {
 		DefaultConfigFile: "/usr/local/etc/yggdrasil.conf",
 
 		// Multicast interfaces
-		DefaultMulticastInterfaces: []string{
-			".*",
+		DefaultMulticastInterfaces: []MulticastInterfaceConfig{
+			{Regex: ".*", Beacon: true, Listen: true},
 		},
 
 		// TUN/TAP

src/defaults/defaults_linux.go

@@ -13,8 +13,8 @@ func GetDefaults() platformDefaultParameters {
 		DefaultConfigFile: "/etc/yggdrasil.conf",
 
 		// Multicast interfaces
-		DefaultMulticastInterfaces: []string{
-			".*",
+		DefaultMulticastInterfaces: []MulticastInterfaceConfig{
+			{Regex: ".*", Beacon: true, Listen: true},
 		},
 
 		// TUN/TAP

src/defaults/defaults_openbsd.go

@@ -13,8 +13,8 @@ func GetDefaults() platformDefaultParameters {
 		DefaultConfigFile: "/etc/yggdrasil.conf",
 
 		// Multicast interfaces
-		DefaultMulticastInterfaces: []string{
-			".*",
+		DefaultMulticastInterfaces: []MulticastInterfaceConfig{
+			{Regex: ".*", Beacon: true, Listen: true},
 		},
 
 		// TUN/TAP

src/defaults/defaults_other.go

@@ -13,8 +13,8 @@ func GetDefaults() platformDefaultParameters {
 		DefaultConfigFile: "/etc/yggdrasil.conf",
 
 		// Multicast interfaces
-		DefaultMulticastInterfaces: []string{
-			".*",
+		DefaultMulticastInterfaces: []MulticastInterfaceConfig{
+			{Regex: ".*", Beacon: true, Listen: true},
 		},
 
 		// TUN/TAP

src/defaults/defaults_windows.go

@@ -13,8 +13,8 @@ func GetDefaults() platformDefaultParameters {
 		DefaultConfigFile: "C:\\Program Files\\Yggdrasil\\yggdrasil.conf",
 
 		// Multicast interfaces
-		DefaultMulticastInterfaces: []string{
-			".*",
+		DefaultMulticastInterfaces: []MulticastInterfaceConfig{
+			{Regex: ".*", Beacon: true, Listen: true},
 		},
 
 		// TUN/TAP

src/multicast/multicast.go

@@ -1,8 +1,10 @@
 package multicast
 
 import (
+	"bytes"
 	"context"
 	"crypto/ed25519"
+	"encoding/binary"
 	"encoding/hex"
 	"fmt"
 	"net"
@@ -30,20 +32,23 @@ type Multicast struct {
 	sock        *ipv6.PacketConn
 	groupAddr   string
 	listeners   map[string]*listenerInfo
-	listenPort  uint16
 	isOpen      bool
 	_interfaces map[string]interfaceInfo
 }
 
 type interfaceInfo struct {
-	iface net.Interface
-	addrs []net.Addr
+	iface  net.Interface
+	addrs  []net.Addr
+	beacon bool
+	listen bool
+	port   uint16
 }
 
 type listenerInfo struct {
 	listener *core.TcpListener
 	time     time.Time
 	interval time.Duration
+	port     uint16
 }
 
 // Init prepares the multicast interface for use.
@@ -53,7 +58,6 @@ func (m *Multicast) Init(core *core.Core, nc *config.NodeConfig, log *log.Logger
 	m.log = log
 	m.listeners = make(map[string]*listenerInfo)
 	m._interfaces = make(map[string]interfaceInfo)
-	m.listenPort = m.config.LinkLocalTCPPort
 	m.groupAddr = "[ff02::114]:9001"
 	return nil
 }
@@ -134,18 +138,16 @@ func (m *Multicast) _stop() error {
 }
 
 func (m *Multicast) _updateInterfaces() {
-	interfaces := make(map[string]interfaceInfo)
-	intfs := m.getAllowedInterfaces()
-	for _, intf := range intfs {
-		addrs, err := intf.Addrs()
+	interfaces := m.getAllowedInterfaces()
+	for name, info := range interfaces {
+		addrs, err := info.iface.Addrs()
 		if err != nil {
-			m.log.Warnf("Failed up get addresses for interface %s: %s", intf.Name, err)
+			m.log.Warnf("Failed up get addresses for interface %s: %s", name, err)
+			delete(interfaces, name)
 			continue
 		}
-		interfaces[intf.Name] = interfaceInfo{
-			iface: intf,
-			addrs: addrs,
-		}
+		info.addrs = addrs
+		interfaces[name] = info
 	}
 	m._interfaces = interfaces
 }
@@ -161,10 +163,10 @@ func (m *Multicast) Interfaces() map[string]net.Interface {
 }
 
 // getAllowedInterfaces returns the currently known/enabled multicast interfaces.
-func (m *Multicast) getAllowedInterfaces() map[string]net.Interface {
-	interfaces := make(map[string]net.Interface)
+func (m *Multicast) getAllowedInterfaces() map[string]interfaceInfo {
+	interfaces := make(map[string]interfaceInfo)
 	// Get interface expressions from config
-	exprs := m.config.MulticastInterfaces
+	ifcfgs := m.config.MulticastInterfaces
 	// Ask the system for network interfaces
 	allifaces, err := net.Interfaces()
 	if err != nil {
@@ -186,15 +188,24 @@ func (m *Multicast) getAllowedInterfaces() map[string]net.Interface {
 			// Ignore point-to-point interfaces
 			continue
 		}
-		for _, expr := range exprs {
+		for _, ifcfg := range ifcfgs {
 			// Compile each regular expression
-			e, err := regexp.Compile(expr)
+			e, err := regexp.Compile(ifcfg.Regex)
 			if err != nil {
 				panic(err)
 			}
 			// Does the interface match the regular expression? Store it if so
 			if e.MatchString(iface.Name) {
-				interfaces[iface.Name] = iface
+				if ifcfg.Beacon || ifcfg.Listen {
+					info := interfaceInfo{
+						iface:  iface,
+						beacon: ifcfg.Beacon,
+						listen: ifcfg.Listen,
+						port:   ifcfg.Port,
+					}
+					interfaces[iface.Name] = info
+				}
+				break
 			}
 		}
 	}
@@ -270,13 +281,18 @@ func (m *Multicast) _announce() {
 			if !addrIP.IsLinkLocalUnicast() {
 				continue
 			}
-			// Join the multicast group
-			_ = m.sock.JoinGroup(&iface, groupAddr)
+			if info.listen {
+				// Join the multicast group, so we can listen for beacons
+				_ = m.sock.JoinGroup(&iface, groupAddr)
+			}
+			if !info.beacon {
+				break // Don't send multicast beacons or accept incoming connections
+			}
 			// Try and see if we already have a TCP listener for this interface
-			var info *listenerInfo
+			var linfo *listenerInfo
 			if nfo, ok := m.listeners[iface.Name]; !ok || nfo.listener.Listener == nil {
 				// No listener was found - let's create one
-				urlString := fmt.Sprintf("tcp://[%s]:%d", addrIP, m.listenPort)
+				urlString := fmt.Sprintf("tls://[%s]:%d", addrIP, info.port)
 				u, err := url.Parse(urlString)
 				if err != nil {
 					panic(err)
@@ -284,33 +300,36 @@ func (m *Multicast) _announce() {
 				if li, err := m.core.Listen(u, iface.Name); err == nil {
 					m.log.Debugln("Started multicasting on", iface.Name)
 					// Store the listener so that we can stop it later if needed
-					info = &listenerInfo{listener: li, time: time.Now()}
-					m.listeners[iface.Name] = info
+					linfo = &listenerInfo{listener: li, time: time.Now()}
+					m.listeners[iface.Name] = linfo
 				} else {
 					m.log.Warnln("Not multicasting on", iface.Name, "due to error:", err)
 				}
 			} else {
 				// An existing listener was found
-				info = m.listeners[iface.Name]
+				linfo = m.listeners[iface.Name]
 			}
 			// Make sure nothing above failed for some reason
-			if info == nil {
+			if linfo == nil {
 				continue
 			}
-			if time.Since(info.time) < info.interval {
+			if time.Since(linfo.time) < linfo.interval {
 				continue
 			}
 			// Get the listener details and construct the multicast beacon
-			lladdr := info.listener.Listener.Addr().String()
+			lladdr := linfo.listener.Listener.Addr().String()
 			if a, err := net.ResolveTCPAddr("tcp6", lladdr); err == nil {
 				a.Zone = ""
 				destAddr.Zone = iface.Name
 				msg := append([]byte(nil), m.core.GetSelf().Key...)
-				msg = append(msg, a.String()...)
+				msg = append(msg, a.IP...)
+				pbs := make([]byte, 2)
+				binary.BigEndian.PutUint16(pbs, uint16(a.Port))
+				msg = append(msg, pbs...)
 				_, _ = m.sock.WriteTo(msg, nil, destAddr)
 			}
-			if info.interval.Seconds() < 15 {
-				info.interval += time.Second
+			if linfo.interval.Seconds() < 15 {
+				linfo.interval += time.Second
 			}
 			break
 		}
@@ -350,23 +369,33 @@ func (m *Multicast) listen() {
 		}
 		var key ed25519.PublicKey
 		key = append(key, bs[:ed25519.PublicKeySize]...)
-		anAddr := string(bs[ed25519.PublicKeySize:nBytes])
-		addr, err := net.ResolveTCPAddr("tcp6", anAddr)
+		if bytes.Equal(key, m.core.GetSelf().Key) {
+			continue // don't bother trying to peer with self
+		}
+		begin := ed25519.PublicKeySize
+		end := nBytes - 2
+		if end <= begin {
+			continue // malformed address
+		}
+		ip := bs[begin:end]
+		port := binary.BigEndian.Uint16(bs[end:nBytes])
+		anAddr := net.TCPAddr{IP: ip, Port: int(port)}
+		addr, err := net.ResolveTCPAddr("tcp6", anAddr.String())
 		if err != nil {
 			continue
 		}
 		from := fromAddr.(*net.UDPAddr)
-		if addr.IP.String() != from.IP.String() {
+		if !from.IP.Equal(addr.IP) {
 			continue
 		}
 		var interfaces map[string]interfaceInfo
 		phony.Block(m, func() {
 			interfaces = m._interfaces
 		})
-		if _, ok := interfaces[from.Zone]; ok {
+		if info, ok := interfaces[from.Zone]; ok && info.listen {
 			addr.Zone = ""
 			pin := fmt.Sprintf("/?key=%s", hex.EncodeToString(key))
-			u, err := url.Parse("tcp://" + addr.String() + pin)
+			u, err := url.Parse("tls://" + addr.String() + pin)
 			if err != nil {
 				m.log.Debugln("Call from multicast failed, parse error:", addr.String(), err)
 			}

src/tuntap/admin.go

@@ -34,8 +34,4 @@ func (t *TunAdapter) SetupAdminHandlers(a *admin.AdminSocket) {
 		}
 		return res, nil
 	})
-	_ = a.AddHandler("getNodeInfo", []string{"key"}, t.proto.nodeinfo.nodeInfoAdminHandler)
-	_ = a.AddHandler("debug_remoteGetSelf", []string{"key"}, t.proto.getSelfHandler)
-	_ = a.AddHandler("debug_remoteGetPeers", []string{"key"}, t.proto.getPeersHandler)
-	_ = a.AddHandler("debug_remoteGetDHT", []string{"key"}, t.proto.getDHTHandler)
 }

src/tuntap/iface.go

@@ -1,22 +1,5 @@
 package tuntap
 
-import (
-	"crypto/ed25519"
-
-	"github.com/yggdrasil-network/yggdrasil-go/src/address"
-	"golang.org/x/net/icmp"
-	"golang.org/x/net/ipv6"
-
-	//"github.com/yggdrasil-network/yggdrasil-go/src/crypto"
-	//"github.com/yggdrasil-network/yggdrasil-go/src/yggdrasil"
-
-	//"golang.org/x/net/icmp"
-	//"golang.org/x/net/ipv6"
-
-	iwt "github.com/Arceliar/ironwood/types"
-	//"github.com/Arceliar/phony"
-)
-
 const TUN_OFFSET_BYTES = 4
 
 func (tun *TunAdapter) read() {
@@ -34,28 +17,8 @@ func (tun *TunAdapter) read() {
 		begin := TUN_OFFSET_BYTES
 		end := begin + n
 		bs := buf[begin:end]
-		if bs[0]&0xf0 != 0x60 {
-			continue // not IPv6
-		}
-		if len(bs) < 40 {
-			tun.log.Traceln("TUN iface read undersized ipv6 packet, length:", len(bs))
-			continue
-		}
-		var srcAddr, dstAddr address.Address
-		var srcSubnet, dstSubnet address.Subnet
-		copy(srcAddr[:], bs[8:])
-		copy(dstAddr[:], bs[24:])
-		copy(srcSubnet[:], bs[8:])
-		copy(dstSubnet[:], bs[24:])
-		if srcAddr != tun.addr && srcSubnet != tun.subnet {
-			continue // Wrong source address
-		}
-		bs = buf[begin-1 : end]
-		bs[0] = typeSessionTraffic
-		if dstAddr.IsValid() {
-			tun.store.sendToAddress(dstAddr, bs)
-		} else if dstSubnet.IsValid() {
-			tun.store.sendToSubnet(dstSubnet, bs)
+		if _, err := tun.core.Write(bs); err != nil {
+			tun.log.Debugln("Unable to send packet:", err)
 		}
 	}
 }
@@ -63,63 +26,16 @@ func (tun *TunAdapter) read() {
 func (tun *TunAdapter) write() {
 	var buf [TUN_OFFSET_BYTES + 65535]byte
 	for {
-		bs := buf[TUN_OFFSET_BYTES-1:]
-		n, from, err := tun.core.ReadFrom(bs)
+		bs := buf[TUN_OFFSET_BYTES:]
+		n, err := tun.core.Read(bs)
 		if err != nil {
+			tun.log.Errorln("Exiting tun writer due to core read error:", err)
 			return
 		}
-		if n == 0 {
-			continue
+		if !tun.isEnabled {
+			continue // Nothing to do, the tun isn't enabled
 		}
-		switch bs[0] {
-		case typeSessionTraffic:
-			// This is what we want to handle here
-			if !tun.isEnabled {
-				continue // Drop traffic if the tun is disabled
-			}
-		case typeSessionProto:
-			var key keyArray
-			copy(key[:], from.(iwt.Addr))
-			data := append([]byte(nil), bs[1:n]...)
-			tun.proto.handleProto(nil, key, data)
-			continue
-		default:
-			continue
-		}
-		bs = bs[1:n]
-		if len(bs) == 0 {
-			continue
-		}
-		if bs[0]&0xf0 != 0x60 {
-			continue // not IPv6
-		}
-		if len(bs) < 40 {
-			continue
-		}
-		if len(bs) > int(tun.MTU()) {
-			ptb := &icmp.PacketTooBig{
-				MTU:  int(tun.mtu),
-				Data: bs[:40],
-			}
-			if packet, err := CreateICMPv6(bs[8:24], bs[24:40], ipv6.ICMPTypePacketTooBig, 0, ptb); err == nil {
-				_, _ = tun.core.WriteTo(packet, from)
-			}
-			continue
-		}
-		var srcAddr, dstAddr address.Address
-		var srcSubnet, dstSubnet address.Subnet
-		copy(srcAddr[:], bs[8:])
-		copy(dstAddr[:], bs[24:])
-		copy(srcSubnet[:], bs[8:])
-		copy(dstSubnet[:], bs[24:])
-		if dstAddr != tun.addr && dstSubnet != tun.subnet {
-			continue // bad local address/subnet
-		}
-		info := tun.store.update(ed25519.PublicKey(from.(iwt.Addr)))
-		if srcAddr != info.address && srcSubnet != info.subnet {
-			continue // bad remote address/subnet
-		}
-		bs = buf[:TUN_OFFSET_BYTES+len(bs)]
+		bs = buf[:TUN_OFFSET_BYTES+n]
 		if _, err = tun.iface.Write(bs, TUN_OFFSET_BYTES); err != nil {
 			tun.Act(nil, func() {
 				if !tun.isOpen {

src/tuntap/keystore.go

@@ -1,157 +0,0 @@
-package tuntap
-
-import (
-	"crypto/ed25519"
-	"sync"
-	"time"
-
-	iwt "github.com/Arceliar/ironwood/types"
-
-	"github.com/yggdrasil-network/yggdrasil-go/src/address"
-)
-
-const keyStoreTimeout = 2 * time.Minute
-
-type keyStore struct {
-	tun          *TunAdapter
-	mutex        sync.Mutex
-	keyToInfo    map[keyArray]*keyInfo
-	addrToInfo   map[address.Address]*keyInfo
-	addrBuffer   map[address.Address]*buffer
-	subnetToInfo map[address.Subnet]*keyInfo
-	subnetBuffer map[address.Subnet]*buffer
-}
-
-type keyArray [ed25519.PublicKeySize]byte
-
-type keyInfo struct {
-	key     keyArray
-	address address.Address
-	subnet  address.Subnet
-	timeout *time.Timer // From calling a time.AfterFunc to do cleanup
-}
-
-type buffer struct {
-	packets [][]byte
-	timeout *time.Timer
-}
-
-func (k *keyStore) init(tun *TunAdapter) {
-	k.tun = tun
-	k.keyToInfo = make(map[keyArray]*keyInfo)
-	k.addrToInfo = make(map[address.Address]*keyInfo)
-	k.addrBuffer = make(map[address.Address]*buffer)
-	k.subnetToInfo = make(map[address.Subnet]*keyInfo)
-	k.subnetBuffer = make(map[address.Subnet]*buffer)
-}
-
-func (k *keyStore) sendToAddress(addr address.Address, bs []byte) {
-	k.mutex.Lock()
-	if info := k.addrToInfo[addr]; info != nil {
-		k.resetTimeout(info)
-		k.mutex.Unlock()
-		_, _ = k.tun.core.WriteTo(bs, iwt.Addr(info.key[:]))
-	} else {
-		var buf *buffer
-		if buf = k.addrBuffer[addr]; buf == nil {
-			buf = new(buffer)
-			k.addrBuffer[addr] = buf
-		}
-		msg := append([]byte(nil), bs...)
-		buf.packets = append(buf.packets, msg)
-		if buf.timeout != nil {
-			buf.timeout.Stop()
-		}
-		buf.timeout = time.AfterFunc(keyStoreTimeout, func() {
-			k.mutex.Lock()
-			defer k.mutex.Unlock()
-			if nbuf := k.addrBuffer[addr]; nbuf == buf {
-				delete(k.addrBuffer, addr)
-			}
-		})
-		k.mutex.Unlock()
-		k.tun.sendKeyLookup(addr.GetKey())
-	}
-}
-
-func (k *keyStore) sendToSubnet(subnet address.Subnet, bs []byte) {
-	k.mutex.Lock()
-	if info := k.subnetToInfo[subnet]; info != nil {
-		k.resetTimeout(info)
-		k.mutex.Unlock()
-		_, _ = k.tun.core.WriteTo(bs, iwt.Addr(info.key[:]))
-	} else {
-		var buf *buffer
-		if buf = k.subnetBuffer[subnet]; buf == nil {
-			buf = new(buffer)
-			k.subnetBuffer[subnet] = buf
-		}
-		msg := append([]byte(nil), bs...)
-		buf.packets = append(buf.packets, msg)
-		if buf.timeout != nil {
-			buf.timeout.Stop()
-		}
-		buf.timeout = time.AfterFunc(keyStoreTimeout, func() {
-			k.mutex.Lock()
-			defer k.mutex.Unlock()
-			if nbuf := k.subnetBuffer[subnet]; nbuf == buf {
-				delete(k.subnetBuffer, subnet)
-			}
-		})
-		k.mutex.Unlock()
-		k.tun.sendKeyLookup(subnet.GetKey())
-	}
-}
-
-func (k *keyStore) update(key ed25519.PublicKey) *keyInfo {
-	k.mutex.Lock()
-	var kArray keyArray
-	copy(kArray[:], key)
-	var info *keyInfo
-	if info = k.keyToInfo[kArray]; info == nil {
-		info = new(keyInfo)
-		info.key = kArray
-		info.address = *address.AddrForKey(ed25519.PublicKey(info.key[:]))
-		info.subnet = *address.SubnetForKey(ed25519.PublicKey(info.key[:]))
-		k.keyToInfo[info.key] = info
-		k.addrToInfo[info.address] = info
-		k.subnetToInfo[info.subnet] = info
-		k.resetTimeout(info)
-		k.mutex.Unlock()
-		if buf := k.addrBuffer[info.address]; buf != nil {
-			for _, bs := range buf.packets {
-				_, _ = k.tun.core.WriteTo(bs, iwt.Addr(info.key[:]))
-			}
-			delete(k.addrBuffer, info.address)
-		}
-		if buf := k.subnetBuffer[info.subnet]; buf != nil {
-			for _, bs := range buf.packets {
-				_, _ = k.tun.core.WriteTo(bs, iwt.Addr(info.key[:]))
-			}
-			delete(k.subnetBuffer, info.subnet)
-		}
-	} else {
-		k.resetTimeout(info)
-		k.mutex.Unlock()
-	}
-	return info
-}
-
-func (k *keyStore) resetTimeout(info *keyInfo) {
-	if info.timeout != nil {
-		info.timeout.Stop()
-	}
-	info.timeout = time.AfterFunc(keyStoreTimeout, func() {
-		k.mutex.Lock()
-		defer k.mutex.Unlock()
-		if nfo := k.keyToInfo[info.key]; nfo == info {
-			delete(k.keyToInfo, info.key)
-		}
-		if nfo := k.addrToInfo[info.address]; nfo == info {
-			delete(k.addrToInfo, info.address)
-		}
-		if nfo := k.subnetToInfo[info.subnet]; nfo == info {
-			delete(k.subnetToInfo, info.subnet)
-		}
-	})
-}

src/tuntap/tun.go

@@ -9,7 +9,6 @@ package tuntap
 // TODO: Don't block in reader on writes that are pending searches
 
 import (
-	"crypto/ed25519"
 	"errors"
 	"fmt"
 	"net"
@@ -34,7 +33,6 @@ type MTU uint16
 // calling yggdrasil.Start().
 type TunAdapter struct {
 	core        *core.Core
-	store       keyStore
 	config      *config.NodeConfig
 	log         *log.Logger
 	addr        address.Address
@@ -45,7 +43,6 @@ type TunAdapter struct {
 	//mutex        sync.RWMutex // Protects the below
 	isOpen    bool
 	isEnabled bool // Used by the writer to drop sessionTraffic if not enabled
-	proto     protoHandler
 }
 
 // Gets the maximum supported MTU for the platform based on the defaults in
@@ -98,18 +95,8 @@ func MaximumMTU() uint64 {
 // the Yggdrasil core before this point and it must not be in use elsewhere.
 func (tun *TunAdapter) Init(core *core.Core, config *config.NodeConfig, log *log.Logger, options interface{}) error {
 	tun.core = core
-	tun.store.init(tun)
 	tun.config = config
 	tun.log = log
-	tun.proto.init(tun)
-	tun.config.RLock()
-	if err := tun.proto.nodeinfo.setNodeInfo(tun.config.NodeInfo, tun.config.NodeInfoPrivacy); err != nil {
-		return fmt.Errorf("tun.proto.nodeinfo.setNodeInfo: %w", err)
-	}
-	tun.config.RUnlock()
-	if err := tun.core.SetOutOfBandHandler(tun.oobHandler); err != nil {
-		return fmt.Errorf("tun.core.SetOutOfBandHander: %w", err)
-	}
 	return nil
 }
 
@@ -132,8 +119,7 @@ func (tun *TunAdapter) _start() error {
 	if tun.config == nil {
 		return errors.New("no configuration available to TUN")
 	}
-	sk := tun.core.PrivateKey()
-	pk := sk.Public().(ed25519.PublicKey)
+	pk := tun.core.PublicKey()
 	tun.addr = *address.AddrForKey(pk)
 	tun.subnet = *address.SubnetForKey(pk)
 	addr := fmt.Sprintf("%s/%d", net.IP(tun.addr[:]).String(), 8*len(address.GetPrefix())-1)
@@ -144,8 +130,8 @@ func (tun *TunAdapter) _start() error {
 		return nil
 	}
 	mtu := tun.config.IfMTU
-	if tun.maxSessionMTU() < mtu {
-		mtu = tun.maxSessionMTU()
+	if tun.core.MaxMTU() < mtu {
+		mtu = tun.core.MaxMTU()
 	}
 	if err := tun.setup(tun.config.IfName, addr, mtu); err != nil {
 		return err
@@ -153,6 +139,7 @@ func (tun *TunAdapter) _start() error {
 	if tun.MTU() != mtu {
 		tun.log.Warnf("Warning: Interface MTU %d automatically adjusted to %d (supported range is 1280-%d)", tun.config.IfMTU, tun.MTU(), MaximumMTU())
 	}
+	tun.core.SetMTU(tun.MTU())
 	tun.isOpen = true
 	tun.isEnabled = true
 	go tun.read()
@@ -188,42 +175,3 @@ func (tun *TunAdapter) _stop() error {
 	}
 	return nil
 }
-
-func (tun *TunAdapter) oobHandler(fromKey, toKey ed25519.PublicKey, data []byte) {
-	if len(data) != 1+ed25519.SignatureSize {
-		return
-	}
-	sig := data[1:]
-	switch data[0] {
-	case typeKeyLookup:
-		snet := *address.SubnetForKey(toKey)
-		if snet == tun.subnet && ed25519.Verify(fromKey, toKey[:], sig) {
-			// This is looking for at least our subnet (possibly our address)
-			// Send a response
-			tun.sendKeyResponse(fromKey)
-		}
-	case typeKeyResponse:
-		// TODO keep a list of something to match against...
-		// Ignore the response if it doesn't match anything of interest...
-		if ed25519.Verify(fromKey, toKey[:], sig) {
-			tun.store.update(fromKey)
-		}
-	}
-}
-
-func (tun *TunAdapter) sendKeyLookup(partial ed25519.PublicKey) {
-	sig := ed25519.Sign(tun.core.PrivateKey(), partial[:])
-	bs := append([]byte{typeKeyLookup}, sig...)
-	_ = tun.core.SendOutOfBand(partial, bs)
-}
-
-func (tun *TunAdapter) sendKeyResponse(dest ed25519.PublicKey) {
-	sig := ed25519.Sign(tun.core.PrivateKey(), dest[:])
-	bs := append([]byte{typeKeyResponse}, sig...)
-	_ = tun.core.SendOutOfBand(dest, bs)
-}
-
-func (tun *TunAdapter) maxSessionMTU() uint64 {
-	const sessionTypeOverhead = 1
-	return tun.core.MTU() - sessionTypeOverhead
-}