WS3: beacon punch-token gate (default-off)#45
Merged
Conversation
v0.5.4 adds BeaconMsgDiscoverEx (0x08) and BeaconMsgRelayDeliverDest (0x09) which this PR references in server.go.
ipv4.PacketConn.WriteBatch (sendmmsg) fails with EINVAL when the send socket is bound to the IPv6/dual-stack wildcard ([::], the default for a ':port' listen on Linux) and a relay destination carries an IPv4 address. Because the node fleet is IPv4, this meant every relay delivery to a node failed and was silently dropped — relay-routed nodes were unreachable. Detect a dual-stack send socket at worker start and route the flush through per-packet WriteToUDP (which maps IPv4 destinations onto the dual-stack socket correctly) instead of the always-failing WriteBatch. The sendmmsg fast path is unchanged on IPv4-bound sockets, and a per-packet fallback also covers any unexpected partial-batch error.
Adds RequirePunchToken gate on handlePunchRequest so an endpoint is only released against a valid target-issued punch token. Gate is an atomic.Bool defaulting to false (no behavior change; not yet wired to a CLI flag), so this is wire-compatible and does NOT enforce until explicitly enabled. Adds zz_punch_token_test.go. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ult off) Makes the WS3 RequirePunchToken gate flippable in prod. Default false — no behavior change, wire-compatible with old agents. Enforcement stays deferred. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…lay-delivery # Conflicts: # go.mod # go.sum # server.go
TeoSlayer
enabled auto-merge
July 23, 2026 22:41
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of pre-launch security remediation (WS3.1). Gates beacon endpoint disclosure behind a target-issued punch token via
RequirePunchToken(atomic.Bool, default false — not enforcing, not yet CLI-wired, wire-compatible with old agents). Excludes a junk assertion-less scratch test. Build + punch-token test green.Note: this branch also carries the previously-committed relay dual-stack fix.
🤖 Generated with Claude Code