Skip to content

FIPS 0.4.74

Latest
Latest

Choose a tag to compare

View all tags
@mmalmi mmalmi released this 05 Sep 22:36
· 798 commits to master since this release
Immutable release. Only release title and notes can be modified.
v0.4.74
9faa85a

FIPS 0.4.74

  • Preserve queued payloads and completed replies through the existing key drain window, including packets admitted before cutover.

  • Refresh coordinate warmup when an established reply path changes to a different transit node.

  • Drain outstanding stress-test replies before final accounting so stopping the sender cannot report a false last-packet loss.

  • Keep receive counters attached to the session selected by its receiver index, so delayed simultaneous startup does not stall awaiting a flag change.

  • Confirm replacement carriers before retiring a usable path. Preserve queued packets behind confirmation and clean up unused candidates using existing limits and deadlines.

  • Keep mature WebSocket reconnects on their fresh carrier by removing a redundant key-rotation age fallback.

  • Keep endpoint control responsive after maintenance overruns and resolve UDP hostnames before installing handshake state. Preserve configured hostname matching and retries.

  • Retain initial IPv6 traffic through route discovery; keep the existing stale-send budget once the session is usable.

  • Honor early FMP key-rotation thresholds without overwriting pending or draining epochs; expire abandoned responder exchanges using the existing handshake timeout.

  • Start queued first-contact traffic as soon as a reachable route is announced, using the existing bounded discovery ladder and timeout for unanswered requests.

  • Resolve simultaneous connection ownership correctly when inbound handshake packets waited in a queue before processing.

  • Wait for the existing receiver-feedback window before recovering a newly active path, avoiding needless fallback and rekeying during healthy bursts.

  • Preserve the proven fallback route until a staged direct probe receives its own delivery feedback.

  • Allow healthy routed sessions to rotate keys while preserving the epoch during a staged direct probe.

  • Keep direct reply paths tied to authenticated direct traffic; relayed or invalid packets cannot redirect replies to the wrong carrier.

  • Replace replay bitmap shifts with bounded counter-indexed storage, preserving the exact replay window and wire formats.

  • Handle expired replay counters safely and retain full-width bounds on 32-bit targets.

  • Allow authenticated WebSocket bootstrap links to upgrade to direct paths when Nostr discovery is disabled.

  • Consolidate overlapping tests, replace rate-limit sleeps with injected clocks, and run unit CI alongside platform builds. A simultaneous-dial regression now waits for the required connection state, reducing it from 23.7 seconds to 0.03 seconds.

Published together: nvpn-fips-core 0.4.74 and nvpn-fips-endpoint 0.4.74. Protocol formats are unchanged.

Assets 15
Loading