Mercurial > prosody-modules

annotate mod_s2s_v6mesh/README.md @ 6478:bd785f524fd2

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
author Matthew Wild <mwild1@gmail.com>
date Wed, 18 Mar 2026 18:54:30 +0000
parents 9f43226c7de1
children 771944f2a7c7
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
1 ---
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
2 labels:
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
3 - Stage-Alpha
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
4 summary: "Federate using stable IPv6 addresses encoded as hostnames, e.g. in mesh networks"
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
5 rockspec:
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
6 build:
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
7 modules:
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
8 mod_s2s_v6mesh.base32: base32.lib.lua
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
9 ---
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
10
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
11 ## Overview
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
12
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
13 There are various virtual network overlay projects which provide peers with
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
14 stable IPv6 addresses, including [Yggdrasil](https://yggdrasil-network.github.io/),
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
15 [CJDNS](https://github.com/cjdelisle/cjdns/), and others.
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
16
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
17 One problem is that these systems are generally peer-to-peer, and there is
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
18 typically no standard DNS root for the private networks. Public DNS can be
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
19 used, but that adds a dependency on the public internet which can cause
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
20 problems, e.g. if the public internet becomes inaccessible.
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
21
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
22 The "obvious" solution is to skip domain names, and just federate between IP
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
23 addresses directly. Unfortunately this brings a lot of problems, such as
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
24 the inability for IP addresses to have subdomains, which are used extensively
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
25 in XMPP to allow hosting multiple services on a single IP address.
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
26
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
27 This module provides an alternative solution. For every possible IPv6 address,
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
28 it can generate an encoded hostname, which supports subdomains, and can be
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
29 resolved to an IPv6 address without any external DNS server infrastructure.
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
30
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
31 The domain names end with `.v6.alt`. The `.alt` TLD was defined by [RFC 9476](https://www.rfc-editor.org/rfc/rfc9476.html)
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
32 specifically for non-DNS use cases such as this. `.v6.alt` is our own scheme.
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
33
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
34 ## Usage
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
35
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
36 For this module to be useful for federation:
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
37
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
38 - Both servers must have this module loaded
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
39 - Both servers must have stable IPv6 addresses (if the IP address changes, the
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
40 hostname changes, and your XMPP identity changes - a new hostname is like
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
41 starting fresh).
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
42
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
43 Although this module was designed with virtual/mesh networks in mind, it is
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
44 possible to use it between any two servers with IPv6 addresses (check the
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
45 section on connection security below if you are using it over unencrypted
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
46 networks such as the public internet).
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
47
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
48 Discover your hostname with the prosodyctl command (our example will use the
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
49 IP address `2a00:1098:3a0::1` but you should replace it with your own):
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
50
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
51 ```
6478
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6472
diff changeset
52 $ prosodyctl shell v6alt get_domain 2a00:1098:3a0::1
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
53 OK: Encoded hostname: fiabbgadu-e.v6.alt
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
54 ```
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
55
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
56 You can then use this domain name in your config file, for example:
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
57
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
58 ```lua
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
59 VirtualHost "fiabbgadu-e.v6.alt" -- Main host, for user accounts
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
60
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
61 Component "groups.fiabbgadu-e.v6.alt" "muc" -- MUC on a subdomain
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
62 ```
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
63
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
64 ### Connection security
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
65
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
66 By default, Prosody requires TLS for server-to-server connections. However, it
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
67 is not possible to obtain CA-issued certificates for `.v6.alt` domains. This
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
68 module disables certificate validation (it treats all certificates as trusted)
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
69 for all `v6.alt` domains where the IP address matches the domain name that the
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
70 remote server is claiming to be (the actual certificate contents are
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
71 irrelevant and never checked, so self-signed certificates are fine).
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
72
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
73 Additionally, if the IP is within one of the CIDR ranges listed in the
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
74 `s2s_v6mesh_secure_ranges` configuration option, then the module will tell
6478
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6472
diff changeset
75 Prosody to disable TLS encryption for the connection.
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
76
6478
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6472
diff changeset
77 **Warning:** Prosody will treat connections within any configured ranges as
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6472
diff changeset
78 already totally secure, and **TLS will be disabled**. Be *very* sure you trust
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6472
diff changeset
79 the underlying network's security layer before adding an IP range to this
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6472
diff changeset
80 list, and never add IPs that use the public internet. If you want similar
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6472
diff changeset
81 behaviour for other (non-`v6.alt`) domains, look at [mod_secure_interfaces](https://modules.prosody.im/mod_secure_interfaces)
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6472
diff changeset
82 and configure it with your mesh interface's address. If in doubt, just don't
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6472
diff changeset
83 set any secure ranges, and use self-signed certificates with TLS instead.
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6472
diff changeset
84
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6472
diff changeset
85 Finally, because of the above mechanisms in place, it is strongly recommended
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6472
diff changeset
86 to keep Prosody's default settings of `s2s_require_encryption = true` and
6472
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
87 `s2s_secure_auth = true` so that connections not covered by this module are
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
88 always encrypted and authenticated properly.
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
89
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
90 ### Connecting from clients
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
91
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
92 Note that although Prosody supports `.v6.alt` domains for federation when this
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
93 module is loaded, this domain scheme is not (currently?) supported by clients,
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
94 and you'll need to specify the connection IP manually in order to connect.
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
95
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
96 Your JID should always be entered as `<username>@<domain.v6.alt>`, and you
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
97 should specify the server's IPv6 address in your client's advanced connection
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
98 configuration screen.
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
99
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
100 ### HTTP
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
101
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
102 Services that use HTTP such as file sharing, web clients, etc. will need to
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
103 use the IP address in the URL, as clients and browsers won't be able to
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
104 resolve the `.v6.alt` domain names. You will need to [configure Prosody's HTTP
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
105 server](https://prosody.im/doc/http) appropriately for your deployment, e.g.
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
106
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
107 ```lua
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
108 http_external_url = "https://[2a00:1098:3a0::1]:5281"
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
109 ```
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
110
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
111 ## Configuration
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
112
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
113 | Name | Default| Description
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
114 |--------------------------|--------|-------------------------------------------------------------------------
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
115 | s2s_v6mesh_secure_ranges | `{}` | A list of IP ranges to treat as secure (bypassing TLS)
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
116
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
117 ## Compatibility
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
118
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
119 |Prosody-Version|Status
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
120 |---------------|----------------------
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
121 |trunk | Works
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
122 |13.0 | Works
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
123 |0.12 | Does not work
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
124
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
125
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
126 ## Developers
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
127
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
128 This section is for developers who want to encode/decode v6.alt addresses
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
129 in their own code.
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
130
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
131 ### Encoding scheme
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
132
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
133 1. Take an IPv6 address as raw packed bytes
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
134 2. Encode it using base32 (RFC 4648), remove `====` padding from the end.
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
135 3. Lowercase the output
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
136 4. Find the first longest sequence of 'a' characters that is:
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
137 1. Not at the start of the string (start scanning from second position)
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
138 2. Two or more characters in length
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
139 3. Not including the end character
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
140
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
141 If found, replace this sequence with a hyphen (`-`).
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
142
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
143 5. Append `.v6.alt`
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
144
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
145 ### Decoding scheme
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
146
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
147 1. Take a hostname ending with `.v6.alt`
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
148 2. Remove `.v6.alt`
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
149 3. Remove any '.' characters and all content before them (`foo.bar` -> `bar`)
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
150 4. If the string contains a hyphen, replace that hyphen with sufficient 'a' characters to make the string 26 characters in length. Strings with multiple hyphen characters are invalid and must be rejected.
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
151 5. Uppercase the string
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
152 6. Decode using base32
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
153
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
154 ### Test vectors
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
155
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
156 | IP | Domain |
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
157 |-------------------------------------------|------------------------------------|
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
158 | `2001:db8::1` | `eaaq3o-e.v6.alt` |
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
159 | `0200::1` | `ai-e.v6.alt` |
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
160 | `200:cab8:deb4:ce60:4362:4492:e539:4b5` | `aiamvog6wthgaq3cisjokoiewu.v6.alt`|
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
161 | `::1` | `a-e.v6.alt` |
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
162 | `::` | `a-a.v6.alt` |
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
163 | `fe80::1` | `72-e.v6.alt` |
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
164 | `ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff` | `77777777777777777777777774.v6.alt`|
9f43226c7de1 mod_s2s_v6mesh: DNS-less federation for IPv6 networks
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
165 | `1111:0000:0000:1111::1111` | `ceiqaaaaaairc-rce.v6.alt` |
6478
bd785f524fd2 mod_s2s_v6mesh: Fix various bugs, s2s auth policies now work as expected
Matthew Wild <mwild1@gmail.com>
parents: 6472
diff changeset
166 | `1111:0000:0000:0000:1111::1111` | `ceiq-eiraaaaaaarce.v6.alt` |