letmein 12.5.0

Fixes

• Fixed a letmeind abort if a remote client aborted the connection during initial TCP accept. This was a remotely exploitable DoS. The systemd service will be restarted after a delay if this happens.
• Only log remotely trigger-able UDP errors instead of taking further actions. This was remotely trigger-able.
• The IP-limiter put all IPv6-IPv4-mapped addresses into the same bucket. This caused pre-mature limiting of IPv4 connections.

The remotely trigger-able bugs are at most a "Denial of Service". No further exploitation is possible.

Breaking changes

• The build not defaults to libc-resolver instead of hickory-resolver. That means the client command line options --dns and --dns-crypt are no longer available. That should not be a problem for most users. If it is a major problem for you, please open a Github issue.

Hardening

• The letmeinfwd daemon has been hardened against a malicious letmeind local service. This is a hardening measure against an already exploited letmeind service.