FIPS v0.2.0 Released

FIPS v0.2.0 is now available. This release includes a major discovery protocol overhaul, Tor transport support, runtime peer management, and 12 bug fixes.

Highlights#

Smarter Discovery Routing#

The discovery protocol has been rewritten to use bloom-filter-guided tree routing instead of flooding. Lookups are now forwarded only to spanning tree peers whose bloom filter contains the target, reducing discovery traffic by 90%. When no tree peer matches, a non-tree fallback preserves reachability. The new design includes originator retry with exponential backoff and transit-side rate limiting for defense-in-depth.

Tor Transport#

Nodes can now peer over Tor using SOCKS5 for outbound connections and directory-mode onion services for inbound. This enables anonymous peering without exposing IP addresses.

Runtime Peer Management#

New fipsctl connect and fipsctl disconnect commands allow adding and removing peers at runtime without restarting the daemon. Supports hostname resolution from /etc/fips/hosts.

Reproducible Builds#

The build infrastructure now produces deterministic, reproducible packages. Rust toolchain pinning via rust-toolchain.toml and SOURCE_DATE_EPOCH timestamps ensure bit-identical output across builds from the same commit.

Breaking Change#

This release changes the discovery wire format. The visited bloom filter has been removed from LookupRequest, and a forwarded flag has been added to LookupResponse. Nodes running v0.1.0 cannot interoperate with v0.2.0 on discovery. All mesh nodes must be upgraded to v0.2.0.

Bug Fixes#

• DNS responder NXDOMAIN for A queries on .fips names (#9)

• Stale sessions blocking reconnect (#5)

• Rekey dual-initiation race on Tor links

• Rekey cutover race causing AEAD failures

• Post-rekey jitter spikes corrupting EWMA (#10)

• ICMPv6 PTB source address ignored by Linux (#16)

• Parent selection bypassing SRTT eligibility gate

• Auto-connect peers permanently abandoned after retry exhaustion

• MMP metric discontinuity across rekey

• Control socket permissions for non-root users

• Reconnect backoff reset on link-dead cycles (#5)

• ETX unresponsive to recent loss (#14)

Install#

Packages available:

• Debian/Ubuntu: .deb package

• Systemd tarball: fips-0.2.0-linux-x86_64.tar.gz

• OpenWrt: opkg .ipk package

• Source: https://github.com/jmcorgan/fips

Contributors#

@jmcorgan, @v0l, @alopatindev, @Origami74

Full changelog: https://github.com/jmcorgan/fips/blob/master/CHANGELOG.md