The standard client-server architecture assumes a fundamental compromise: the server is a trusted intermediary. It decrypts, parses, and re-routes your data. But in hostile environments or decentralized systems, you cannot trust the intermediary. You must assume every node sitting between you and your destination is compromised.
When developing Noctis, the goal was to build a secure messaging engine over a multi-hop mesh network. If Node A wants to talk to Node D, the packet might have to route through Node B and Node C. How do you instruct untrusted Node C to forward a packet without giving it the keys to read the payload?
Decoupling the Wire Format
The solution lies in structural isolation. A mesh packet must be bifurcated into two distinct layers: the Cleartext Routing Envelope and the Encrypted Application Payload.
"An intermediate node should only have enough mathematical context to answer one question: 'Who do I hand this to next?' Everything else is cryptographic dead weight to the router."
By enforcing this separation at the Protobuf level, we allow Go routines to quickly unmarshal only the outer envelope. The router inspects the NextHopID, decrements the TTL (Time-To-Live), and pushes it down the TCP socket without ever loading the ChaCha20-Poly1305 ciphertext into active memory for processing.
Loop Prevention & TTL Exhaustion
Mesh networks are inherently chaotic. Without a central router maintaining a global state, dynamic peer-to-peer topologies frequently create circular routing loops. A packet sent from Node A could bounce endlessly between B, C, and D, eventually exhausting the bandwidth of the entire localized mesh.
// Go snippet: Basic Mesh Forwarding Logic
func (r *Router) Forward(packet *MeshPacket) error {
// 1. Hard loop prevention via TTL
if packet.Header.TTL <= 0 {
return ErrTTLExhausted
}
packet.Header.TTL--
// 2. Cache inspection to prevent replay storms
if r.cache.HasSeen(packet.Header.MessageID) {
return ErrDuplicatePacket
}
r.cache.MarkSeen(packet.Header.MessageID)
// 3. Blind forwarding (Payload remains untouched)
nextPeer, err := r.routingTable.Resolve(packet.Header.DestinationID)
if err != nil {
return r.Flood(packet) // Fallback to localized flooding
}
return nextPeer.Conn.Write(packet)
}
The Flooding Fallback
In a highly mobile mesh, routing tables (even those utilizing localized DHTs) become stale in seconds. If a directed route fails, Noctis falls back to controlled flooding. The node duplicates the packet and sends it to all connected peers *except* the one it received it from.
This is where the HasSeen cache is critical. By maintaining an LRU (Least Recently Used) cache of hashed message IDs, nodes instantly drop flooded packets they have already processed, causing the flood wave to collapse exactly at the boundaries of the network rather than echoing indefinitely.
Building a mesh isn't just about connecting sockets; it's about engineering constraints. By bounding memory, capping TTLs, and isolating payloads, a chaotic swarm of untrusted computers can behave as a single, highly resilient cryptographic transport layer.