Skip to content

v0.8.0

Latest
Latest

Choose a tag to compare

View all tags
@power0matin power0matin released this 07 Aug 12:07
· 9 commits to main since this release
v0.8.0
6e4f406
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Backhaul v0.8.0 is a production-focused hardening release based on upstream Backhaul v0.7.2 (df7966f).

This release focuses on measurable improvements to long-running stability, bounded memory behavior, reconnect handling, concurrency, transport lifecycle management, observability, and security while preserving Backhaul's existing purpose and compatibility.

Highlights

Reliability & Lifecycle

  • Reworked transport restart and shutdown ownership to prevent stale sessions, sockets, and goroutines.

  • Improved automatic recovery after temporary network failures and remote restarts.

  • Added bounded exponential reconnect backoff with jitter.

  • Improved DNS recovery by resolving endpoints on reconnect attempts.

  • Hardened TCP, TCPMUX, UDP, WS, WSS, WSMUX, and WSSMUX lifecycle handling.

  • Improved hot reload so invalid configuration does not destroy a healthy running generation.

Memory & Backpressure

  • Replaced extremely large per-UDP-flow queues with configurable bounded queues.

  • Added transport-wide UDP packet and flow limits.

  • Removed an unnecessary full UDP packet copy in the framed UDP path.

  • Replaced repeated packet timers with reusable lifecycle-managed timers.

  • Improved listener backpressure: saturated queues remain bounded while receiving a short drain opportunity before explicit rejection.

  • Added bounded connection-pool growth through max_pool_size.

Reconnect & WSMUX

  • Hardened WSMUX session and stream cleanup.

  • Control connections are now tied to transport cancellation.

  • Transient outages recover automatically in tested scenarios without manual process restart.

  • Mixed v0.7.2 ↔ v0.8.0 WSMUX compatibility was tested successfully in both directions.

Security

  • Hardened authentication/token comparisons.

  • Added framing and network-input length validation.

  • Raw invalid tokens are no longer logged.

  • Added WebSocket read limits.

  • Monitoring now binds to loopback by default.

  • Added optional monitoring authentication with web_username / web_password.

  • Added configurable web_bind_addr.

  • Added tls_verify for WSS/WSSMUX.

  • Added warnings for unsafe monitoring, TLS, and configuration-file permissions.

tls_verify remains disabled by default for v0.7.2/self-signed certificate compatibility. Enable it when using a properly trusted TLS certificate.

Observability

Runtime monitoring now includes useful operational information such as:

  • active connections

  • pool connections

  • reconnect count

  • rejected connections

  • goroutine count

  • Go heap usage

  • uptime

Logging on overloaded hot paths is rate-limited to avoid log storms.

Measured Results

Controlled local comparison against untouched upstream v0.7.2:

Measurement | v0.7.2 | v0.8.0 -- | -- | -- 32-flow framed UDP retained heap after GC | ~76.8 MB | ~3.4 KB Native UDP bytes/op | 3712 B | 3248 B Native UDP allocs/op | 60 | 54 Framed UDP bytes/op | 3055 B | 1543 B Framed UDP allocs/op | 25 | 21 30s WSMUX soak successful roundtrips | — | 340,704 WSMUX soak failures | — | 0

The UDP improvements correspond to approximately:

  • 49.5% fewer bytes allocated/op on the framed UDP benchmark

  • 16% fewer allocations/op on framed UDP

  • 12.5% fewer bytes allocated/op on native UDP

  • 10% fewer allocations/op on native UDP

Stream throughput results were noisy and did not demonstrate a repeatable material improvement or regression, so this release does not claim a general throughput increase.

TCP connection setup measured approximately 5.2% slower in the controlled benchmark in exchange for deterministic connection cleanup and cancellation behavior.

See PERFORMANCE.md for methodology, raw results, compatibility notes, and limitations.

Validation

The final release passed:

  • go test ./...

  • go test -race ./...

  • go vet ./...

  • Go 1.25.12 build/test/vet

  • Go 1.26.5 build/test/vet

  • Linux amd64 cross-build

  • Linux arm64 cross-build

  • reconnect integration testing

  • transport integration testing

  • lifecycle/stress testing

  • WSMUX soak testing

  • resolver fuzz testing

  • mixed v0.7.2/v0.8.0 WSMUX compatibility testing

GitHub Actions CI passed successfully for the final v0.8.0 PR.

Compatibility

Existing v0.7.2 configurations should continue to work where documented.

Notable safe-default change:

  • The web monitoring interface now binds to 127.0.0.1 by default instead of being publicly exposed.

No intentionally incompatible WSMUX protocol change was introduced.

Release Assets

  • backhaul_linux_amd64.tar.gz

  • backhaul_linux_arm64.tar.gz

  • backhaul_darwin_amd64.tar.gz

  • backhaul_darwin_arm64.tar.gz

  • checksums.txt

Production binaries were built with Go 1.26.5, CGO_ENABLED=0, and the project's release flags.

SHA-256

7f59655b4e0dc54b5da5f4a14e0b4d2720d3a51e1fef998ffab0af97d192f697  backhaul_darwin_amd64.tar.gz
161521c5410132a363905b9ca7ff0c83dc3b07a6b8213c924051c8c9aa17d15a  backhaul_darwin_arm64.tar.gz
3a98aa6637bbdfda58a57e8f820e776bd9c435ba36ca5a991d7ef3edee274ff4  backhaul_linux_amd64.tar.gz
cee8e34e5724555fa9a66ab964439c9af00f661aeb1c55d116ccaca54855e8d6  backhaul_linux_arm64.tar.gz

Verify downloaded assets against checksums.txt before deployment.

Production Recommendation

v0.8.0 is the preferred baseline for this fork and has substantially stronger automated validation than v0.7.2.

For production infrastructure, use a staged/canary rollout before fleet-wide replacement. Local testing cannot prove month-long RSS behavior or reproduce every real Iran ↔ foreign-server network condition.

Assets 7
Loading