Skip to content

v0.9.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Sep 02:11
· 137 commits to main since this release
v0.9.0
2a9d298

Added

  • An SNI gate: [security] expected_sni. Empty by default, which is exactly what every release before this one did. With a list of host names configured, each QUIC Initial packet is decrypted at the socket with the keys RFC 9001 derives from its Destination Connection ID, the ClientHello is reassembled from the CRYPTO frames, and a handshake that does not name one of the listed hosts is blinded before the QUIC layer reads it. A port scan of the address then gets nothing back: no Version Negotiation packet, no CONNECTION_CLOSE, no TLS alert, no certificate, no 407. Probes carrying an unsupported QUIC version fall silent the same way.
  • A second gate in the TLS layer. With a list configured, the certificate resolver declines any other name, so a ClientHello deliberately split across Initial packets, which the socket gate passes on purpose, still gets neither the certificate nor a 407.
  • The list reloads on SIGHUP like the certificate and the credentials.

Changed

  • Two SHOULDs are knowingly set aside when the gate is on, recorded with their reasons: RFC 9000 §5.2.2's Version Negotiation answer and RFC 6066 §3's unrecognized_name alert. Nothing changes with the default empty list.

Testing

  • Twelve on-wire tests pin the gate: a wrong name times out rather than being closed, the same 1200-byte unsupported-version probe draws a Version Negotiation packet with the gate off and nothing with it on, a reload swaps the list, a split ClientHello reaches the second gate, and nmap-shaped empty probes are silent either way. Nineteen unit tests cover the Initial reader.
  • Cross-implementation interop (masque-go + aioquic) and the full suite were re-run against this tree before tagging, both green with a clean server log.

Upgrading: nothing changes unless you set expected_sni. If you do, every client must already send that name as SNI (in Surge, the sni= parameter); configure the clients first, then the server, or nobody can connect and the only trace is this server's debug log. See docs/configuration.md.

Static musl builds for x86_64 and aarch64. Verify with SHA256SUMS.

Each archive carries the binary, LICENSE, README.md and the script/ and docs/ directories. Installing and updating is described in docs/deployment.md.

Full Changelog: v0.8.1...v0.9.0

Assets 5
Loading