Phase 1 security hardening: trust gate for datagrams, SYN ordering

Security fixes:
- Add trust gate to handleDatagramPacket (private nodes drop untrusted
  datagrams, matching SYN gate behavior)
- Move trust check before rate limiting so untrusted sources cannot
  waste rate-limit tokens
- Silent drop on untrusted SYN instead of RST to prevent leaking
  node existence
- Normalize hostname resolve errors (denied returns same message as
  not-found to prevent enumeration)

Tests:
- Unskip 5 network tests (persistence, replication, broadcast
  exclusion, network create/join/leave via client)
- Add 4 new trust gate tests (public node accepts untrusted SYN,
  datagram rejected from untrusted, datagram allowed from same
  network, datagram rejection webhook)

Author: teovl

pkg/daemon/daemon.go

@@ -741,6 +741,26 @@ func (d *Daemon) handleStreamPacket(pkt *protocol.Packet) {
 			return
 		}
 
+		// Trust gate: private nodes only accept SYN from trusted or same-network peers.
+		// Runs before rate limiting so untrusted sources cannot waste rate-limit tokens.
+		if !d.config.Public {
+			srcNode := pkt.Src.Node
+			trusted := d.handshakes.IsTrusted(srcNode)
+			if !trusted && d.regConn != nil {
+				// Fall back to registry trust check (covers admin-set trust pairs + shared networks)
+				trusted, _ = d.regConn.CheckTrust(d.NodeID(), srcNode)
+			}
+			if !trusted {
+				slog.Warn("SYN rejected: untrusted source", "src_node", srcNode, "src_addr", pkt.Src, "dst_port", pkt.DstPort)
+				d.webhook.Emit("syn.rejected", map[string]interface{}{
+					"src_node_id": srcNode,
+					"src_addr":    pkt.Src.String(),
+					"dst_port":    pkt.DstPort,
+				})
+				return // silent drop — no RST to avoid leaking node existence
+			}
+		}
+
 		// SYN rate limiting
 		if !d.allowSYN() {
 			slog.Warn("SYN rate limit exceeded", "src_addr", pkt.Src, "src_port", pkt.SrcPort)
@@ -768,26 +788,6 @@ func (d *Daemon) handleStreamPacket(pkt *protocol.Packet) {
 			return
 		}
 
-		// Trust gate: private nodes only accept SYN from trusted or same-network peers
-		if !d.config.Public {
-			srcNode := pkt.Src.Node
-			trusted := d.handshakes.IsTrusted(srcNode)
-			if !trusted && d.regConn != nil {
-				// Fall back to registry trust check (covers admin-set trust pairs + shared networks)
-				trusted, _ = d.regConn.CheckTrust(d.NodeID(), srcNode)
-			}
-			if !trusted {
-				slog.Warn("SYN rejected: untrusted source", "src_node", srcNode, "src_addr", pkt.Src, "dst_port", pkt.DstPort)
-				d.webhook.Emit("syn.rejected", map[string]interface{}{
-					"src_node_id": srcNode,
-					"src_addr":    pkt.Src.String(),
-					"dst_port":    pkt.DstPort,
-				})
-				d.sendRST(pkt)
-				return
-			}
-		}
-
 		conn := d.ports.NewConnection(pkt.DstPort, pkt.Src, pkt.SrcPort)
 		conn.Mu.Lock()
 		conn.LocalAddr = d.Addr()
@@ -1056,13 +1056,33 @@ func (d *Daemon) sendDelayedACK(conn *Connection) {
 }
 
 func (d *Daemon) handleDatagramPacket(pkt *protocol.Packet) {
-	if len(pkt.Payload) > 0 {
-		d.webhook.Emit("data.datagram", map[string]interface{}{
-			"src_addr": pkt.Src.String(), "src_port": pkt.SrcPort,
-			"dst_port": pkt.DstPort, "size": len(pkt.Payload),
-		})
-		d.ipc.DeliverDatagram(pkt.Src, pkt.SrcPort, pkt.DstPort, pkt.Payload)
+	if len(pkt.Payload) == 0 {
+		return
 	}
+
+	// Trust gate: private nodes only accept datagrams from trusted or same-network peers
+	if !d.config.Public {
+		srcNode := pkt.Src.Node
+		trusted := d.handshakes.IsTrusted(srcNode)
+		if !trusted && d.regConn != nil {
+			trusted, _ = d.regConn.CheckTrust(d.NodeID(), srcNode)
+		}
+		if !trusted {
+			slog.Warn("datagram rejected: untrusted source", "src_node", srcNode, "src_addr", pkt.Src, "dst_port", pkt.DstPort)
+			d.webhook.Emit("datagram.rejected", map[string]interface{}{
+				"src_node_id": srcNode,
+				"src_addr":    pkt.Src.String(),
+				"dst_port":    pkt.DstPort,
+			})
+			return
+		}
+	}
+
+	d.webhook.Emit("data.datagram", map[string]interface{}{
+		"src_addr": pkt.Src.String(), "src_port": pkt.SrcPort,
+		"dst_port": pkt.DstPort, "size": len(pkt.Payload),
+	})
+	d.ipc.DeliverDatagram(pkt.Src, pkt.SrcPort, pkt.DstPort, pkt.Payload)
 }
 
 func (d *Daemon) handleControlPacket(pkt *protocol.Packet) {

pkg/registry/server.go

@@ -1941,7 +1941,7 @@ func (s *Server) handleResolveHostname(msg map[string]interface{}) (map[string]i
 		}
 
 		if !allowed {
-			return nil, fmt.Errorf("resolve denied: hostname %q belongs to a private node", hostname)
+			return nil, fmt.Errorf("hostname %q not found", hostname) // same error as non-existent to prevent enumeration
 		}
 	}
 

tests/datagram_test.go

@@ -57,7 +57,6 @@ func TestUnicastDatagram(t *testing.T) {
 
 // TestBroadcastExcludesSender verifies the broadcaster does not receive its own broadcast.
 func TestBroadcastExcludesSender(t *testing.T) {
-	t.Skip("custom networks are WIP")
 	t.Parallel()
 	env := NewTestEnv(t)
 

tests/fuzz_registry_server_test.go

@@ -724,11 +724,69 @@ func TestRegistryClientNetworkCreateNoToken(t *testing.T) {
 }
 
 func TestRegistryClientNetworkCreateWithToken(t *testing.T) {
-	t.Skip("custom networks are WIP")
+	s := startTestServer(t)
+	s.SetAdminToken(TestAdminToken)
+	defer s.Close()
+
+	addr := s.Addr().(*net.TCPAddr)
+	c, err := registry.Dial(addr.String())
+	if err != nil {
+		t.Fatalf("Dial: %v", err)
+	}
+	defer c.Close()
+
+	nodeID := regTestNodeWithKey(t, c, "127.0.0.1:4000")
+
+	resp, err := c.CreateNetwork(nodeID, "tokennet", "open", "", TestAdminToken)
+	if err != nil {
+		t.Fatalf("CreateNetwork with token: %v", err)
+	}
+	netID, ok := resp["network_id"].(float64)
+	if !ok || netID < 1 {
+		t.Fatalf("expected valid network_id, got %v", resp["network_id"])
+	}
+	t.Logf("created network %d", int(netID))
 }
 
 func TestRegistryClientNetworkJoinLeave(t *testing.T) {
-	t.Skip("custom networks are WIP")
+	s := startTestServer(t)
+	s.SetAdminToken(TestAdminToken)
+	defer s.Close()
+
+	addr := s.Addr().(*net.TCPAddr)
+	c1, err := registry.Dial(addr.String())
+	if err != nil {
+		t.Fatalf("Dial c1: %v", err)
+	}
+	defer c1.Close()
+	c2, err := registry.Dial(addr.String())
+	if err != nil {
+		t.Fatalf("Dial c2: %v", err)
+	}
+	defer c2.Close()
+
+	nodeID1 := regTestNodeWithKey(t, c1, "127.0.0.1:4001")
+	nodeID2 := regTestNodeWithKey(t, c2, "127.0.0.1:4002")
+
+	// Create network with node1
+	resp, err := c1.CreateNetwork(nodeID1, "joinleave", "open", "", TestAdminToken)
+	if err != nil {
+		t.Fatalf("CreateNetwork: %v", err)
+	}
+	netID := uint16(resp["network_id"].(float64))
+
+	// Node2 joins
+	_, err = c2.JoinNetwork(nodeID2, netID, "", 0, TestAdminToken)
+	if err != nil {
+		t.Fatalf("JoinNetwork: %v", err)
+	}
+
+	// Node2 leaves
+	_, err = c2.LeaveNetwork(nodeID2, netID, TestAdminToken)
+	if err != nil {
+		t.Fatalf("LeaveNetwork: %v", err)
+	}
+	t.Logf("node %d joined and left network %d", nodeID2, netID)
 }
 
 func TestRegistryClientListNetworks(t *testing.T) {

tests/persistence_test.go

@@ -11,7 +11,6 @@ import (
 )
 
 func TestRegistryPersistence(t *testing.T) {
-	t.Skip("custom networks are WIP")
 	t.Parallel()
 	tmpDir, err := os.MkdirTemp("/tmp", "w4-persist-")
 	if err != nil {

tests/replication_test.go

@@ -16,7 +16,6 @@ import (
 // 3. Verify standby has the same data
 // 4. Verify standby rejects writes
 func TestRegistryReplication(t *testing.T) {
-	t.Skip("custom networks are WIP")
 	t.Parallel()
 	tmpDir, err := os.MkdirTemp("/tmp", "w4-repl-")
 	if err != nil {

tests/syn_trust_gate_test.go

@@ -195,3 +195,153 @@ func TestSYNRejectionWebhook(t *testing.T) {
 	data, _ := ev.Data.(map[string]interface{})
 	t.Logf("syn.rejected: src_node=%v", data["src_node_id"])
 }
+
+// TestPublicNodeAcceptsUntrustedSYN verifies that public nodes skip the trust
+// gate entirely — any node can connect without trust or shared network.
+func TestPublicNodeAcceptsUntrustedSYN(t *testing.T) {
+	t.Parallel()
+	env := NewTestEnv(t)
+
+	server := env.AddDaemon(func(cfg *daemon.Config) {
+		cfg.Public = true // public node — trust gate should be skipped
+	})
+	client := env.AddDaemon(func(cfg *daemon.Config) {
+		cfg.Public = false // private, no trust, no shared network
+	})
+
+	client.Daemon.AddTunnelPeer(server.Daemon.NodeID(), localUDPAddr(server.Daemon))
+	server.Daemon.AddTunnelPeer(client.Daemon.NodeID(), localUDPAddr(client.Daemon))
+
+	conn, err := client.Driver.DialAddr(server.Daemon.Addr(), 7)
+	if err != nil {
+		t.Fatalf("expected dial to public node to succeed without trust: %v", err)
+	}
+	conn.Close()
+	t.Log("dial to public node succeeded without trust")
+}
+
+// TestDatagramRejectedFromUntrustedNode verifies that private nodes drop
+// datagrams from untrusted sources (same trust gate as SYN).
+func TestDatagramRejectedFromUntrustedNode(t *testing.T) {
+	t.Parallel()
+	env := NewTestEnv(t)
+
+	server := env.AddDaemon(func(cfg *daemon.Config) {
+		cfg.Public = false
+	})
+	client := env.AddDaemon(func(cfg *daemon.Config) {
+		cfg.Public = false
+	})
+
+	// Pre-populate tunnel peers
+	client.Daemon.AddTunnelPeer(server.Daemon.NodeID(), localUDPAddr(server.Daemon))
+	server.Daemon.AddTunnelPeer(client.Daemon.NodeID(), localUDPAddr(client.Daemon))
+
+	// Start listening for datagrams on server
+	received := make(chan struct{}, 1)
+	go func() {
+		dg, err := server.Driver.RecvFrom()
+		if err == nil && dg != nil {
+			received <- struct{}{}
+		}
+	}()
+
+	// Send datagram from untrusted client — should be silently dropped
+	_ = client.Driver.SendTo(server.Daemon.Addr(), 5000, []byte("untrusted datagram"))
+
+	select {
+	case <-received:
+		t.Fatal("datagram from untrusted node should have been dropped, but was delivered")
+	case <-time.After(500 * time.Millisecond):
+		t.Log("correctly: datagram from untrusted node was dropped")
+	}
+}
+
+// TestDatagramAllowedFromSameNetwork verifies that datagrams from same-network
+// peers are delivered normally (trust via shared network membership).
+func TestDatagramAllowedFromSameNetwork(t *testing.T) {
+	t.Parallel()
+	env := NewTestEnv(t)
+
+	server := env.AddDaemon(func(cfg *daemon.Config) {
+		cfg.Public = false
+	})
+	client := env.AddDaemon(func(cfg *daemon.Config) {
+		cfg.Public = false
+	})
+
+	// Join both to the same custom network via registry
+	rc, err := registry.Dial(env.RegistryAddr)
+	if err != nil {
+		t.Fatalf("dial registry: %v", err)
+	}
+	defer rc.Close()
+
+	resp, err := rc.CreateNetwork(server.Daemon.NodeID(), "dg-trust-net", "open", "", env.AdminToken)
+	if err != nil {
+		t.Fatalf("create network: %v", err)
+	}
+	netID := uint16(resp["network_id"].(float64))
+
+	if _, err := rc.JoinNetwork(client.Daemon.NodeID(), netID, "", 0, env.AdminToken); err != nil {
+		t.Fatalf("join network: %v", err)
+	}
+
+	// Pre-populate tunnel peers
+	client.Daemon.AddTunnelPeer(server.Daemon.NodeID(), localUDPAddr(server.Daemon))
+	server.Daemon.AddTunnelPeer(client.Daemon.NodeID(), localUDPAddr(client.Daemon))
+
+	// Start listening for datagrams on server
+	received := make(chan string, 1)
+	go func() {
+		dg, err := server.Driver.RecvFrom()
+		if err == nil && dg != nil {
+			received <- string(dg.Data)
+		}
+	}()
+
+	// Send datagram from trusted client — should be delivered
+	if err := client.Driver.SendTo(server.Daemon.Addr(), 5000, []byte("trusted datagram")); err != nil {
+		t.Fatalf("sendto: %v", err)
+	}
+
+	select {
+	case msg := <-received:
+		if msg != "trusted datagram" {
+			t.Errorf("expected %q, got %q", "trusted datagram", msg)
+		}
+		t.Log("datagram from same-network node delivered correctly")
+	case <-time.After(5 * time.Second):
+		t.Fatal("timeout waiting for datagram from same-network node")
+	}
+}
+
+// TestDatagramRejectionWebhook verifies that a datagram.rejected webhook event
+// is emitted when an untrusted node sends a datagram to a private node.
+func TestDatagramRejectionWebhook(t *testing.T) {
+	t.Parallel()
+	collector := newWebhookCollector()
+	defer collector.Close()
+
+	env := NewTestEnv(t)
+
+	server := env.AddDaemon(func(cfg *daemon.Config) {
+		cfg.Public = false
+		cfg.WebhookURL = collector.URL()
+	})
+	client := env.AddDaemon(func(cfg *daemon.Config) {
+		cfg.Public = false
+	})
+
+	client.Daemon.AddTunnelPeer(server.Daemon.NodeID(), localUDPAddr(server.Daemon))
+
+	// Send datagram — should be rejected
+	_ = client.Driver.SendTo(server.Daemon.Addr(), 5000, []byte("should be rejected"))
+
+	ev, ok := collector.WaitFor("datagram.rejected", 3*time.Second)
+	if !ok {
+		t.Fatal("expected datagram.rejected webhook event, but none received")
+	}
+	data, _ := ev.Data.(map[string]interface{})
+	t.Logf("datagram.rejected: src_node=%v", data["src_node_id"])
+}