Skip to content

v1.0.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Sep 10:20
· 7 commits to main since this release
v1.0.1
8aaf250

A patch release for the four findings of an independent full-tree audit of v1.0.0. None of them is on the pre-authentication path or in the protocol layer; one closes a gap in the destination policy, two make the shipped scripts leave a host whole when they fail, one corrects the architecture page.

Fixed

  • The local-use NAT64 prefix 64:ff9b:1::/48 is refused as a whole under allow_private_networks = false. The policy read an IPv4 address out of it at the RFC 6052 /48 layout, but RFC 8215 section 5 lets an operator place the address anywhere inside that reservation and forbids a reader assuming a layout. At the /64 layout the octets read were the operator's subnet, so a subnet spelling a public IPv4 prefix hid a private target. The whole prefix now follows the switch. The well-known 64:ff9b::/96, 6to4 and Teredo are judged by the address they carry, as before.
  • A failed install-selfsigned.sh --force renewal leaves the old certificate and key in place. The script moved the pair to their backup names before running openssl, so a failed generation left the configured paths empty and the next restart could not start. The new pair is generated beside the old one and moved into place only after openssl succeeds; the new key is created under umask 077, and both backups carry one timestamp.
  • A volto-deploy update that fails before the health check restores the previous binary and unit. A copy that failed part-way, or a failure between the binary copy and the unit copy, ended the run with the rollback pair on disk and nothing restored, because the rollback branch ran only after systemctl is-active. An error trap now covers that window.
  • docs/architecture.md no longer claims that a peer closing a QPACK stream is knowingly not a connection error. The server has reported H3_CLOSED_CRITICAL_STREAM for both a clean finish and a reset since v1.0.0, with the one exemption for a connection that has already ended; the page now says so.

Testing

  • The policy change carries a test proven red first, with a translation of 10.0.0.1 at each of the /56, /64 and /96 layouts that the old reader judged public.
  • Both script fixes were driven red then green against stub openssl, install and systemctl; the transcripts are in the private audit record.

Upgrading: volto-deploy on the host, or the install line below. No configuration change. A deployment that dials 64:ff9b:1::/48 destinations needs allow_private_networks = true from this release on.

Static musl builds for x86_64 and aarch64. Verify with SHA256SUMS.

Each archive carries the binary, LICENSE, README.md and the script/ and docs/ directories. Installing and updating is described in docs/deployment.md.

Full Changelog: v1.0.0...v1.0.1

Assets 5
Loading