v0.2.0

Yggdrasil-NG v0.2.0

25 commits since v0.1.6.

New features

• Stateful firewall — built-in conntrack, opt-in via the [firewall] config section (disabled by default).
• Group password — closed-network session authentication, folded into the handshake signature preimage. Wire-compatible with Go ironwood PR #51.
• CKR (Crypto-Key Routing) is now a default feature, with expanded options (multiple IPs per node and more). Note: default builds now include CKR.
• Multiple prefixes from a single configuration file (#8).
• Peer URI query parameters — support plus documentation (#7).
• Windows: DNS servers are now assigned to the TUN device.
• Android: added a force-refresh handle.

Performance

• SIMD Salsa20 (AVX2/SSE2/NEON) fork wired into the crypto path. This gives about 100% speedup.
• CoDel AQM replaces the previous 25 ms age-drop backpressure (15 ms target) — cuts spurious drops and retransmits on high-latency Wi-Fi/mobile links. Also, gives about 40% speedup in low-latency networks.
• Deficit Round Robin (DRR) packet queue.
• TUN read-path speedups — removed the intermediate queue and the inner_buf allocation in the RWC read path.

Fixes & platform

• Windows 7: fixed TUN teardown in service mode; start correctly on builds lacking SetInterfaceDnsSettings in iphlpapi.dll (#14).
• Linux: systemd service mode changed to notify (Type=notify). Upgraders receive the updated unit via the package postinst.

Internal

• Extracted mobile sub-crate, it was slowing down the builds.
• Config normalization.
• Started the docs/ folder (CKR topic extracted from the README).
• CI fixes.