Mesh Network

Sliding window rate limiter protecting against connection floods, handshake spam, and gossip storms. Per-IP and per-node tracking with automatic banning.

import { ConnectionRateLimiter } from './mesh/rate-limiter.js';

const limiter = new ConnectionRateLimiter({
  maxConnectionsPerMinute: 10,
  maxMessagesPerSecond: 50,
  maxHandshakesPerMinute: 5,
  banThreshold: 5,
  banDuration: 300000,  // 5 minutes
});

if (!limiter.checkConnection(ip).allowed) {
  ws.close(1008, 'Rate limited');
}

Validates message size and structure to prevent amplification attacks. Enforces payload limits by type: gossip (64KB), handshake (8KB), listing (128KB), data (512KB).

import { MessageValidator, SafeJsonParser } from './mesh/message-validator.js';

const validator = new MessageValidator();
const parser = new SafeJsonParser();

const sizeCheck = validator.validateRaw(rawMessage, 'gossip');
if (!sizeCheck.valid) reject(sizeCheck.reason);

const parsed = parser.parse(rawMessage);
if (!parsed.success) reject(parsed.error);

const structCheck = validator.validateStructure(parsed.data, 'gossip');
if (!structCheck.valid) reject(structCheck.reason);

Multi-layer replay attack protection with nonce registry, timestamp validation, and sequence tracking. Automatically detects and rejects duplicate or out-of-window messages.

import { NonceRegistry, TimestampValidator, SequenceTracker } 
  from './mesh/replay-defense.js';

const nonces = new NonceRegistry({ maxAge: 3600000 });
const timestamps = new TimestampValidator({ maxAge: 600000 });
const sequences = new SequenceTracker();

// Generate nonce for outgoing message
const nonce = nonces.generate();

// Validate incoming message
const nonceOk = nonces.validate(msg.nonce);
const timeOk = timestamps.validate(msg.timestamp);
const seqOk = sequences.validate(msg.senderId, msg.sequence);

Protection against Sybil attacks through NAVR (proof-of-work challenges), reputation tracking, and subnet diversity enforcement.

import { NAVR, ReputationTracker, SubnetDiversity } 
  from './mesh/sybil-defense.js';

const navr = new NAVR({ difficulty: 16 });
const reputation = new ReputationTracker();
const subnets = new SubnetDiversity({ maxPerSubnet: 3 });

// Challenge new peer
const challenge = navr.createChallenge(peerId);
// Peer solves and returns solution
const verified = navr.verify(challenge, solution);

// Track reputation
reputation.registerNode(peerId, solution);
reputation.reportGoodBehavior(peerId);
const trust = reputation.getTrustLevel(peerId);  // 'trusted'|'normal'|'suspicious'|'banned'

// Check subnet diversity
if (!subnets.allowConnection(peerIp).allowed) {
  reject('Too many connections from this subnet');
}