Activate network primitives, SYN trust gate, hostname privacy

- Remove WIP guards from create_network, join_network, leave_network
  handlers, enabling all network operations
- Add SYN trust gate: private nodes reject connections from untrusted
  peers that don't share a non-backbone network (sends RST, emits
  syn.rejected webhook)
- Add hostname privacy: resolve_hostname checks trust pairs and shared
  networks before revealing private node info
- Add check_trust registry message for unified trust+network queries
- Gate broadcast: block on backbone (network 0), require membership
- Add ResolveHostnameAs client method for trust-aware hostname resolution
- Unskip 15 tests (network, admin token, broadcast, handshake)
- Add 8 new tests (4 SYN trust gate, 4 hostname privacy)

Author: teovl

pkg/daemon/daemon.go

@@ -547,6 +547,14 @@ func (d *Daemon) Identity() *crypto.Identity { return d.identity }
 // TaskQueue returns the daemon's task queue.
 func (d *Daemon) TaskQueue() *TaskQueue { return d.taskQueue }
 
+// AddTunnelPeer registers a peer's address in the tunnel manager (for testing/manual setup).
+func (d *Daemon) AddTunnelPeer(nodeID uint32, addr *net.UDPAddr) {
+	d.tunnels.AddPeer(nodeID, addr)
+}
+
+// TunnelAddr returns the local UDP address of the tunnel listener.
+func (d *Daemon) TunnelAddr() net.Addr { return d.tunnels.LocalAddr() }
+
 func (d *Daemon) Addr() protocol.Addr {
 	d.addrMu.RLock()
 	defer d.addrMu.RUnlock()
@@ -728,6 +736,26 @@ func (d *Daemon) handleStreamPacket(pkt *protocol.Packet) {
 			return
 		}
 
+		// Trust gate: private nodes only accept SYN from trusted or same-network peers
+		if !d.config.Public {
+			srcNode := pkt.Src.Node
+			trusted := d.handshakes.IsTrusted(srcNode)
+			if !trusted && d.regConn != nil {
+				// Fall back to registry trust check (covers admin-set trust pairs + shared networks)
+				trusted, _ = d.regConn.CheckTrust(d.NodeID(), srcNode)
+			}
+			if !trusted {
+				slog.Warn("SYN rejected: untrusted source", "src_node", srcNode, "src_addr", pkt.Src, "dst_port", pkt.DstPort)
+				d.webhook.Emit("syn.rejected", map[string]interface{}{
+					"src_node_id": srcNode,
+					"src_addr":    pkt.Src.String(),
+					"dst_port":    pkt.DstPort,
+				})
+				d.sendRST(pkt)
+				return
+			}
+		}
+
 		conn := d.ports.NewConnection(pkt.DstPort, pkt.Src, pkt.SrcPort)
 		conn.Mu.Lock()
 		conn.LocalAddr = d.Addr()
@@ -1520,7 +1548,7 @@ func (d *Daemon) SendDatagram(dstAddr protocol.Addr, dstPort uint16, data []byte
 	srcPort := d.ports.AllocEphemeralPort()
 
 	if dstAddr.IsBroadcast() {
-		return fmt.Errorf("broadcast is not available — custom networks are WIP")
+		return d.broadcastDatagram(dstAddr.Network, srcPort, dstPort, data)
 	}
 
 	if err := d.ensureTunnel(dstAddr.Node); err != nil {
@@ -1541,7 +1569,12 @@ func (d *Daemon) SendDatagram(dstAddr protocol.Addr, dstPort uint16, data []byte
 }
 
 // broadcastDatagram sends a datagram to all members of a network.
+// Only network members are allowed to broadcast. Backbone (network 0) is blocked.
 func (d *Daemon) broadcastDatagram(netID uint16, srcPort, dstPort uint16, data []byte) error {
+	if netID == 0 {
+		return fmt.Errorf("broadcast on backbone network is not permitted")
+	}
+
 	resp, err := d.regConn.ListNodes(netID)
 	if err != nil {
 		return fmt.Errorf("list nodes for broadcast: %w", err)
@@ -1552,6 +1585,22 @@ func (d *Daemon) broadcastDatagram(netID uint16, srcPort, dstPort uint16, data [
 		return nil // no nodes
 	}
 
+	// Verify sender is a member of the network
+	isMember := false
+	for _, n := range nodesRaw {
+		nodeMap, ok := n.(map[string]interface{})
+		if !ok {
+			continue
+		}
+		if nid, ok := nodeMap["node_id"].(float64); ok && uint32(nid) == d.NodeID() {
+			isMember = true
+			break
+		}
+	}
+	if !isMember {
+		return fmt.Errorf("broadcast denied: node %d is not a member of network %d", d.NodeID(), netID)
+	}
+
 	for _, n := range nodesRaw {
 		nodeMap, ok := n.(map[string]interface{})
 		if !ok {

pkg/registry/client.go

@@ -450,6 +450,30 @@ func (c *Client) ResolveHostname(hostname string) (map[string]interface{}, error
 	})
 }
 
+// ResolveHostnameAs resolves a hostname with a requester_id for privacy checks.
+// Private nodes require the requester to have a trust pair or shared network.
+func (c *Client) ResolveHostnameAs(requesterID uint32, hostname string) (map[string]interface{}, error) {
+	return c.Send(map[string]interface{}{
+		"type":         "resolve_hostname",
+		"hostname":     hostname,
+		"requester_id": requesterID,
+	})
+}
+
+// CheckTrust checks if a trust pair or shared network exists between two nodes.
+func (c *Client) CheckTrust(nodeA, nodeB uint32) (bool, error) {
+	resp, err := c.Send(map[string]interface{}{
+		"type":    "check_trust",
+		"node_id": nodeA,
+		"peer_id": nodeB,
+	})
+	if err != nil {
+		return false, err
+	}
+	trusted, _ := resp["trusted"].(bool)
+	return trusted, nil
+}
+
 // UpdatePoloScore adjusts the polo score of a node by the given delta.
 // Delta can be positive (increase polo score) or negative (decrease polo score).
 func (c *Client) UpdatePoloScore(nodeID uint32, delta int) (map[string]interface{}, error) {

pkg/registry/server.go

@@ -696,11 +696,11 @@ func (s *Server) handleMessage(msg map[string]interface{}, remoteAddr string) (r
 		}
 		return s.handleRegister(msg, remoteAddr)
 	case "create_network":
-		return nil, fmt.Errorf("custom networks are WIP — only backbone (network 0) is available")
+		return s.handleCreateNetwork(msg)
 	case "join_network":
-		return nil, fmt.Errorf("custom networks are WIP — only backbone (network 0) is available")
+		return s.handleJoinNetwork(msg)
 	case "leave_network":
-		return nil, fmt.Errorf("custom networks are WIP — only backbone (network 0) is available")
+		return s.handleLeaveNetwork(msg)
 	case "lookup":
 		return s.handleLookup(msg)
 	case "resolve":
@@ -725,6 +725,8 @@ func (s *Server) handleMessage(msg map[string]interface{}, remoteAddr string) (r
 		return s.handleReportTrust(msg)
 	case "revoke_trust":
 		return s.handleRevokeTrust(msg)
+	case "check_trust":
+		return s.handleCheckTrust(msg)
 	case "request_handshake":
 		return s.handleRequestHandshake(msg)
 	case "poll_handshakes":
@@ -1488,6 +1490,44 @@ func (s *Server) handleRevokeTrust(msg map[string]interface{}) (map[string]inter
 	}, nil
 }
 
+// handleCheckTrust checks if a trust pair exists between two nodes OR if they share a non-backbone network.
+func (s *Server) handleCheckTrust(msg map[string]interface{}) (map[string]interface{}, error) {
+	nodeA := jsonUint32(msg, "node_id")
+	nodeB := jsonUint32(msg, "peer_id")
+
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	trusted := s.trustPairs[trustPairKey(nodeA, nodeB)]
+
+	// Also check shared non-backbone network
+	if !trusted {
+		nA, okA := s.nodes[nodeA]
+		nB, okB := s.nodes[nodeB]
+		if okA && okB {
+			for _, aNet := range nA.Networks {
+				if aNet == 0 {
+					continue
+				}
+				for _, bNet := range nB.Networks {
+					if aNet == bNet {
+						trusted = true
+						break
+					}
+				}
+				if trusted {
+					break
+				}
+			}
+		}
+	}
+
+	return map[string]interface{}{
+		"type":    "check_trust_ok",
+		"trusted": trusted,
+	}, nil
+}
+
 func (s *Server) handleSetVisibility(msg map[string]interface{}) (map[string]interface{}, error) {
 	nodeID := jsonUint32(msg, "node_id")
 	public, _ := msg["public"].(bool)
@@ -1848,6 +1888,46 @@ func (s *Server) handleResolveHostname(msg map[string]interface{}) (map[string]i
 		return nil, fmt.Errorf("hostname %q maps to missing node %d", hostname, nodeID)
 	}
 
+	// Privacy check: private nodes require trust or shared network
+	if !node.Public {
+		requesterID := jsonUint32(msg, "requester_id")
+		allowed := false
+
+		// Self-resolve always allowed
+		if requesterID == nodeID {
+			allowed = true
+		}
+
+		// Check trust pair
+		if !allowed && s.trustPairs[trustPairKey(requesterID, nodeID)] {
+			allowed = true
+		}
+
+		// Check shared non-backbone network
+		if !allowed {
+			if requester, rOk := s.nodes[requesterID]; rOk {
+				for _, rNet := range requester.Networks {
+					if rNet == 0 {
+						continue
+					}
+					for _, tNet := range node.Networks {
+						if rNet == tNet {
+							allowed = true
+							break
+						}
+					}
+					if allowed {
+						break
+					}
+				}
+			}
+		}
+
+		if !allowed {
+			return nil, fmt.Errorf("resolve denied: hostname %q belongs to a private node", hostname)
+		}
+	}
+
 	return map[string]interface{}{
 		"type":     "resolve_hostname_ok",
 		"node_id":  node.ID,

tests/admin_token_test.go

@@ -11,7 +11,6 @@ import (
 // TestAdminTokenRequired verifies that with an admin token configured,
 // create_network requires the correct token.
 func TestAdminTokenRequired(t *testing.T) {
-	t.Skip("custom networks are WIP")
 	t.Parallel()
 	env := NewTestEnv(t)
 
@@ -54,7 +53,6 @@ func TestAdminTokenRequired(t *testing.T) {
 // TestAdminTokenJoinLeaveGated verifies that join_network and leave_network
 // also require admin token.
 func TestAdminTokenJoinLeaveGated(t *testing.T) {
-	t.Skip("custom networks are WIP")
 	t.Parallel()
 	env := NewTestEnv(t)
 

tests/broadcast_test.go

@@ -10,7 +10,6 @@ import (
 )
 
 func TestBroadcast(t *testing.T) {
-	t.Skip("custom networks are WIP")
 	t.Parallel()
 	env := NewTestEnv(t)
 

tests/fuzz_registry_server_test.go

@@ -640,7 +640,7 @@ func TestRegistryClientSetHostname(t *testing.T) {
 		t.Fatalf("expected set_hostname_ok, got %v", hnResp["type"])
 	}
 
-	resolveResp, err := c.ResolveHostname("myagent")
+	resolveResp, err := c.ResolveHostnameAs(nodeID, "myagent")
 	if err != nil {
 		t.Fatalf("ResolveHostname: %v", err)
 	}

tests/handshake_test.go

@@ -259,7 +259,6 @@ func TestHandshakePendingApproveReject(t *testing.T) {
 }
 
 func TestHandshakeNetworkTrust(t *testing.T) {
-	t.Skip("custom networks are WIP")
 	t.Parallel()
 	// Two nodes on the same non-backbone network should auto-approve handshakes