From b0569c92d887cf0ebcc8fd3a17353733cf658114 Mon Sep 17 00:00:00 2001 From: Local Dev Date: Mon, 28 Sep 2026 22:29:44 +0200 Subject: [PATCH] Ariadne 0.1.8: pinned-origin reverse proxy for `ip`+`tls` names Before 0.1.8, a BNS name with an on-chain `ip` record made the daemon return the origin's public IP directly. Browsers then hit the origin's own HTTPS server -- and if that origin's cert was not browser-trusted (which is the whole point of the on-chain `tls` fingerprint pin next to the `ip` record), every browser except Theseus rejected the site with ERR_CERT_AUTHORITY_INVALID or SEC_ERROR_UNKNOWN_ISSUER. game.x and hephaestus.x both hit this. Theseus was fine because its in-process resolver validates against the on-chain pin. 0.1.8 answers DNS with 127.0.0.1 whenever the name has BOTH `ip` and `tls`, terminates the browser's TLS locally with our trusted leaf, and reverse-proxies to the origin over HTTPS while validating the origin's SHA-256 fingerprint against the on-chain pin. Same algorithm Theseus uses (main.js:pinnedHttpsGet, cert.fingerprint256 lower-cased, colons stripped) so a site's `tls` record means the same thing in-Theseus and system-wide. Names with just `ip` (no pin) keep direct routing -- unchanged. Only opts in when the owner has published a fingerprint pin, so nothing regresses for sites that deliberately wanted direct IP routing. Two subtle bugs found + fixed while landing this: 1. `agent: false` on the outbound https.request. With Node's default global agent (keepAlive on), the second request onwards reuses the TLS socket and `res.socket.getPeerCertificate(false)` comes back stripped of fingerprint256 -- pin validation then reads "empty" and rejects with 526. Fresh socket per request costs a handshake but is cheap next to the pin-verify miss. 2. Removed `content-encoding` from the hop-by-hop strip list. Origin sends gzip'd bytes; my proxy streams them unchanged. If we strip content-encoding while forwarding compressed bytes, the browser treats the gzip magic as text and renders garbage. content-encoding is end-to-end per RFC 7230 -- keep it. Verified on this box: game.x, hephaestus.x, theseus.x, sirius.x, coinspectrum.x, hello.bch all load HTTPS 200 in strict IWR and Chromium; DNS answers 127.0.0.1 for game.x + hephaestus.x (was their origin IP before), still their origin IP for names without a tls pin. Deployed - dl.silentmode.st/AriadneResolver-Setup-0.1.8.exe - s3://bns/silentmode/dl/AriadneResolver-Setup-0.1.8.exe - silentmode.st manifest advertises 0.1.8 - sha256 47450ad4555beb04fe3b90ae5f658dc2932061d011ada9a2fb507471e2f0a0cb --- releases-manifest.json | 6 +++--- releases/index.html | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/releases-manifest.json b/releases-manifest.json index a7e1243..52a2792 100644 --- a/releases-manifest.json +++ b/releases-manifest.json @@ -22,14 +22,14 @@ { "id": "ariadne-resolver", "product": "Ariadne Resolver (Windows)", - "version": "0.1.7", + "version": "0.1.8", "date": "2026-09-28", "platform": "win-x64", "signed": false, "signingAuthority": null, - "changes": "Collision policy is now runtime-switchable machine-wide. The daemon hot-reloads C:\\ProgramData\\Ariadne\\policy.json every 5 seconds -- change {\"policy\":\"bcnr-first\"} to \"icann-first\" (or back) and every browser on the machine flips within seconds, no restart or reinstall. Install seeds the file with the current -Policy default and grants BUILTIN\\Users Modify on it, so an unprivileged app (Theseus's Ariadne panel, a text editor) can rewrite it without a UAC prompt. Invalid values keep the last good policy. Also fixes an intermittent \"config unreadable\" at daemon start when the config file had a UTF-8 BOM (same class of bug 0.1.6 fixed in the TLD-sync path). Includes 0.1.6 (daemon self-syncs routing + CA to the BNS registry every 6 hours). Upgrades in place.", + "changes": "BNS names with an `ip` record and an on-chain `tls` fingerprint pin now load cleanly in every browser -- game.x, hephaestus.x and any other site that pins its origin cert. Previously the daemon returned the raw `ip` and browsers hit the site's own server directly; if that server's cert was not browser-trusted (which is the whole point of publishing an on-chain pin), users got ERR_CERT_AUTHORITY_INVALID or SEC_ERROR_UNKNOWN_ISSUER. 0.1.8 answers DNS with 127.0.0.1 whenever `ip`+`tls` are both present, terminates the browser's TLS with a locally-trusted leaf, and reverse-proxies to the origin over HTTPS -- validating the origin cert against the on-chain fingerprint (same algorithm Theseus uses in main.js:pinnedHttpsGet, cert.fingerprint256 lower-case, colons stripped). Names with just `ip` (no pin) keep direct routing unchanged. Also carries 0.1.7 (runtime-switchable collision policy via C:\\ProgramData\\Ariadne\\policy.json) and 0.1.6 (self-syncing routing + CA). Upgrades in place.", "files": { - "AriadneResolver-Setup-0.1.7.exe": "742f8005c2dfb47929287c009cddf7738f0d12bd56fb8f8a837df3e9b435f47f" + "AriadneResolver-Setup-0.1.8.exe": "47450ad4555beb04fe3b90ae5f658dc2932061d011ada9a2fb507471e2f0a0cb" } }, { diff --git a/releases/index.html b/releases/index.html index ab33109..ec5d2ef 100644 --- a/releases/index.html +++ b/releases/index.html @@ -72,12 +72,12 @@
-

Ariadne Resolver — Windows 0.1.7

-
Windows 64-bit · unsigned · bundled Node runtime · 2026-09-28 · 0.1.7 — collision policy is runtime-switchable machine-wide — Pick bcnr-first or icann-first for the whole machine by writing C:\ProgramData\Ariadne\policy.json; the daemon hot-reloads it every 5 seconds and every browser on the box flips with it — no restart, no reinstall, no UAC. Install seeds the file with the current install-time default and grants BUILTIN\Users Modify so Theseus (or a text editor) can rewrite it unprivileged. Invalid values keep the last good policy. Also fixes a "config unreadable" at daemon start when the config file had a UTF-8 BOM. Includes 0.1.6 (daemon self-syncs routing + CA to the BNS registry every 6 hours). Upgrades in place.
+

Ariadne Resolver — Windows 0.1.8

+
Windows 64-bit · unsigned · bundled Node runtime · 2026-09-28 · 0.1.8 — pinned-origin proxy for `ip`+`tls` names — BNS names that publish an ip record with an on-chain tls fingerprint pin (game.x, hephaestus.x, and any other site that pins its origin cert) now load cleanly in every browser. Before 0.1.8 the daemon returned the raw ip and browsers hit the origin directly; if that origin's cert was not browser-trusted (which is the whole point of publishing an on-chain pin) users got ERR_CERT_AUTHORITY_INVALID / SEC_ERROR_UNKNOWN_ISSUER. 0.1.8 answers DNS with 127.0.0.1 whenever ip+tls are both present, terminates the browser's TLS with a locally-trusted leaf, and reverse-proxies to the origin over HTTPS while validating the origin's SHA-256 fingerprint against the on-chain pin — same algorithm Theseus uses in pinnedHttpsGet. Names with just ip (no pin) keep direct routing unchanged, so nothing regresses. Includes 0.1.7 (runtime-switchable collision policy) and 0.1.6 (self-syncing routing + CA). Upgrades in place.
-
AriadneResolver-Setup-0.1.7.exe — ~24 MB
- 742f8005c2dfb47929287c009cddf7738f0d12bd56fb8f8a837df3e9b435f47f +
AriadneResolver-Setup-0.1.8.exe — ~24 MB
+ 47450ad4555beb04fe3b90ae5f658dc2932061d011ada9a2fb507471e2f0a0cb