silentmode/site
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Ariadne 0.1.8: pinned-origin reverse proxy for ip+tls names

Browse source 
Before 0.1.8, a BNS name with an on-chain `ip` record made the daemon return
the origin's public IP directly. Browsers then hit the origin's own HTTPS
server -- and if that origin's cert was not browser-trusted (which is the
whole point of the on-chain `tls` fingerprint pin next to the `ip` record),
every browser except Theseus rejected the site with ERR_CERT_AUTHORITY_INVALID
or SEC_ERROR_UNKNOWN_ISSUER. game.x and hephaestus.x both hit this. Theseus
was fine because its in-process resolver validates against the on-chain pin.

0.1.8 answers DNS with 127.0.0.1 whenever the name has BOTH `ip` and `tls`,
terminates the browser's TLS locally with our trusted leaf, and reverse-proxies
to the origin over HTTPS while validating the origin's SHA-256 fingerprint
against the on-chain pin. Same algorithm Theseus uses (main.js:pinnedHttpsGet,
cert.fingerprint256 lower-cased, colons stripped) so a site's `tls` record
means the same thing in-Theseus and system-wide.

Names with just `ip` (no pin) keep direct routing -- unchanged. Only opts in
when the owner has published a fingerprint pin, so nothing regresses for sites
that deliberately wanted direct IP routing.

Two subtle bugs found + fixed while landing this:

1. `agent: false` on the outbound https.request. With Node's default global
   agent (keepAlive on), the second request onwards reuses the TLS socket
   and `res.socket.getPeerCertificate(false)` comes back stripped of
   fingerprint256 -- pin validation then reads "empty" and rejects with 526.
   Fresh socket per request costs a handshake but is cheap next to the
   pin-verify miss.

2. Removed `content-encoding` from the hop-by-hop strip list. Origin sends
   gzip'd bytes; my proxy streams them unchanged. If we strip
   content-encoding while forwarding compressed bytes, the browser treats the
   gzip magic as text and renders garbage. content-encoding is end-to-end
   per RFC 7230 -- keep it.

Verified on this box: game.x, hephaestus.x, theseus.x, sirius.x,
coinspectrum.x, hello.bch all load HTTPS 200 in strict IWR and Chromium; DNS
answers 127.0.0.1 for game.x + hephaestus.x (was their origin IP before),
still their origin IP for names without a tls pin.

Deployed
- dl.silentmode.st/AriadneResolver-Setup-0.1.8.exe
- s3://bns/silentmode/dl/AriadneResolver-Setup-0.1.8.exe
- silentmode.st manifest advertises 0.1.8
- sha256 47450ad4555beb04fe3b90ae5f658dc2932061d011ada9a2fb507471e2f0a0cb
This commit is contained in:
Local Dev 2026-09-28 22:29:44 +02:00
parent 612ff248d4
commit b0569c92d8
2 changed files with 7 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
releases-manifest.json
View file

@ -22,14 +22,14 @@
{
"id": "ariadne-resolver",
"product": "Ariadne Resolver (Windows)",
"version": "0.1.7",
"version": "0.1.8",
"date": "2026-09-28",
"platform": "win-x64",
"signed": false,
"signingAuthority": null,
"changes": "Collision policy is now runtime-switchable machine-wide. The daemon hot-reloads C:\\ProgramData\\Ariadne\\policy.json every 5 seconds -- change {\"policy\":\"bcnr-first\"} to \"icann-first\" (or back) and every browser on the machine flips within seconds, no restart or reinstall. Install seeds the file with the current -Policy default and grants BUILTIN\\Users Modify on it, so an unprivileged app (Theseus's Ariadne panel, a text editor) can rewrite it without a UAC prompt. Invalid values keep the last good policy. Also fixes an intermittent \"config unreadable\" at daemon start when the config file had a UTF-8 BOM (same class of bug 0.1.6 fixed in the TLD-sync path). Includes 0.1.6 (daemon self-syncs routing + CA to the BNS registry every 6 hours). Upgrades in place.",
"changes": "BNS names with an `ip` record and an on-chain `tls` fingerprint pin now load cleanly in every browser -- game.x, hephaestus.x and any other site that pins its origin cert. Previously the daemon returned the raw `ip` and browsers hit the site's own server directly; if that server's cert was not browser-trusted (which is the whole point of publishing an on-chain pin), users got ERR_CERT_AUTHORITY_INVALID or SEC_ERROR_UNKNOWN_ISSUER. 0.1.8 answers DNS with 127.0.0.1 whenever `ip`+`tls` are both present, terminates the browser's TLS with a locally-trusted leaf, and reverse-proxies to the origin over HTTPS -- validating the origin cert against the on-chain fingerprint (same algorithm Theseus uses in main.js:pinnedHttpsGet, cert.fingerprint256 lower-case, colons stripped). Names with just `ip` (no pin) keep direct routing unchanged. Also carries 0.1.7 (runtime-switchable collision policy via C:\\ProgramData\\Ariadne\\policy.json) and 0.1.6 (self-syncing routing + CA). Upgrades in place.",
"files": {
"AriadneResolver-Setup-0.1.7.exe": "742f8005c2dfb47929287c009cddf7738f0d12bd56fb8f8a837df3e9b435f47f"
"AriadneResolver-Setup-0.1.8.exe": "47450ad4555beb04fe3b90ae5f658dc2932061d011ada9a2fb507471e2f0a0cb"
}
},
{

8
releases/index.html
View file

@ -72,12 +72,12 @@
</div>
<div class="rel">
<h2>Ariadne Resolver — Windows <span style="color:var(--acid)">0.1.7</span></h2>
<div class="meta">Windows 64-bit · unsigned · bundled Node runtime · 2026-09-28 · <b>0.1.7 — collision policy is runtime-switchable machine-wide</b> — Pick <code style="display:inline">bcnr-first</code> or <code style="display:inline">icann-first</code> for the whole machine by writing <code style="display:inline">C:\ProgramData\Ariadne\policy.json</code>; the daemon hot-reloads it every 5 seconds and every browser on the box flips with it — no restart, no reinstall, no UAC. Install seeds the file with the current install-time default and grants <code style="display:inline">BUILTIN\Users</code> Modify so Theseus (or a text editor) can rewrite it unprivileged. Invalid values keep the last good policy. Also fixes a "config unreadable" at daemon start when the config file had a UTF-8 BOM. Includes 0.1.6 (daemon self-syncs routing + CA to the BNS registry every 6 hours). Upgrades in place.</div>
<h2>Ariadne Resolver — Windows <span style="color:var(--acid)">0.1.8</span></h2>
<div class="meta">Windows 64-bit · unsigned · bundled Node runtime · 2026-09-28 · <b>0.1.8 — pinned-origin proxy for `ip`+`tls` names</b> — BNS names that publish an <code style="display:inline">ip</code> record with an on-chain <code style="display:inline">tls</code> fingerprint pin (game.x, hephaestus.x, and any other site that pins its origin cert) now load cleanly in every browser. Before 0.1.8 the daemon returned the raw <code style="display:inline">ip</code> and browsers hit the origin directly; if that origin's cert was not browser-trusted (which is the whole point of publishing an on-chain pin) users got <code style="display:inline">ERR_CERT_AUTHORITY_INVALID</code> / <code style="display:inline">SEC_ERROR_UNKNOWN_ISSUER</code>. 0.1.8 answers DNS with <code style="display:inline">127.0.0.1</code> whenever <code style="display:inline">ip</code>+<code style="display:inline">tls</code> are both present, terminates the browser's TLS with a locally-trusted leaf, and reverse-proxies to the origin over HTTPS while validating the origin's SHA-256 fingerprint against the on-chain pin — same algorithm Theseus uses in <code style="display:inline">pinnedHttpsGet</code>. Names with just <code style="display:inline">ip</code> (no pin) keep direct routing unchanged, so nothing regresses. Includes 0.1.7 (runtime-switchable collision policy) and 0.1.6 (self-syncing routing + CA). Upgrades in place.</div>
<div class="file">
<div class="n"><a href="https://dl.silentmode.st/AriadneResolver-Setup-0.1.7.exe">AriadneResolver-Setup-0.1.7.exe</a> — ~24 MB</div>
<code>742f8005c2dfb47929287c009cddf7738f0d12bd56fb8f8a837df3e9b435f47f</code>
<div class="n"><a href="https://dl.silentmode.st/AriadneResolver-Setup-0.1.8.exe">AriadneResolver-Setup-0.1.8.exe</a> — ~24 MB</div>
<code>47450ad4555beb04fe3b90ae5f658dc2932061d011ada9a2fb507471e2f0a0cb</code>
</div>
</div>