Skip to content

v0.3.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Jun 09:05
· 30 commits to main since this release
v0.3.1
b74db2e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Alighieri 0.3.1 is a maintenance and hardening release — a drop-in upgrade from 0.3.0 with no breaking changes and no config changes required.

What's new

Reliable UDP through NAT — udp.advertise

When the proxy runs behind NAT or a port-forward, UDP clients could be handed a local relay address they couldn't actually reach. Set udp.advertise to the public IP or hostname clients should use, and the proxy advertises that in the UDP ASSOCIATE reply while still listening on its real port. Pairs with udp.portrange for a stable port-forward.

Security and hardening

  • Windows installs now lock down their data folder. C:\ProgramData\Alighieri — which holds your config and user list — is restricted to SYSTEM, Administrators, and the service account, so other users on the machine can't read your password hashes or tamper with the config the service loads. Re-run the installer to apply it. (Linux was already protected.)
  • Misconfigurations are caught at --check, not at runtime. Hostnames in udp.advertise and tls.acme.domains, and the domains clients request, are now validated. Notably, tls.acme.domains rejects names a public certificate authority can never issue for (IP addresses, wildcards, localhost, internal .local-style names, and similar) — so you learn about a bad entry immediately instead of when certificate issuance quietly fails.
  • Stronger guard against reaching internal addresses (SSRF). More IPv6 forms that map onto loopback, private, or reserved ranges are now caught by the DNS deny policy.
  • Stricter external-auth credentials — the verifier now also rejects a stray carriage return, matching its newline and NUL handling.

Reliability

  • The metrics endpoint and the UDP relay no longer spin on certain transient OS errors — they back off and recover instead.
  • shutdown.draintimeout: 0 now clearly warns that it cuts in-flight connections immediately (the most aggressive setting — not an unlimited wait).

Get it

  • Binaries for Linux and Windows (x86-64 and ARM64) are attached below.
  • Container: docker pull ghcr.io/wiresock/alighieri:0.3.1 (also tagged 0.3 and latest).

Upgrading

Replace the binary or pull the new image and restart — no config changes needed. On Windows, re-running the installer applies the new data-folder permissions.

All changes in this release (merged pull requests)
  • Harden Windows service install rollback and config-marker write by @wiresock in #75
  • Store an absolute service config path and surface marker read errors by @wiresock in #76
  • Decouple the Event Log source from service-create/uninstall failures by @wiresock in #77
  • Source ERROR_SERVICE_EXISTS from windows_sys instead of hardcoding 1073 by @wiresock in #78
  • Reject relative service config markers and test the no-follow read by @wiresock in #79
  • Fail fast when one TCP relay direction errors by @wiresock in #80
  • Validate the config before writing the systemd unit on install by @wiresock in #81
  • Add udp.advertise to override the UDP ASSOCIATE reply address by @wiresock in #82
  • Warn when start/reload falls back to the default config on a missing marker by @wiresock in #83
  • Warn when the ACME cache is outside the systemd StateDirectory by @wiresock in #84
  • Bound udp.advertise DNS and warn on hardened-unit path footguns by @wiresock in #85
  • Resolve udp.advertise at associate time; harden installer path checks by @wiresock in #86
  • Wire-test udp.advertise, sync its docs, and normalise installer paths in-shell by @wiresock in #87
  • Add installer self-tests, make the advertise hostname test resolver-agnostic by @wiresock in #88
  • Canonicalize the UDP ASSOCIATE source-endpoint lock; fail advertise test loudly by @wiresock in #89
  • Back off on persistent accept() failures instead of spinning by @wiresock in #90
  • Surface UDP-reply send failures; harden the dual-stack test; cover the accept metric by @wiresock in #91
  • Parse installer --check --json with an escape-aware extractor instead of sed by @wiresock in #92
  • Make installer field-presence checks escape- and key-aware by @wiresock in #93
  • Match the installer's acme boolean key-aware and whitespace-tolerant by @wiresock in #94
  • Back off the metrics-accept and UDP-recv loops instead of spinning by @wiresock in #95
  • Catch IPv4-compatible and special-use IPv6 forms in the deny policy by @wiresock in #96
  • Reject a carriage return in external-verifier credentials by @wiresock in #97
  • Warn (and document) that shutdown.draintimeout 0 cuts connections at once by @wiresock in #98
  • Harden the Windows ProgramData\Alighieri ACL on install by @wiresock in #99
  • Add security tests: SSRF deny, per-datagram UDP deny, parser rejects, connection cap by @wiresock in #101
  • Validate SOCKS domain names; gate Windows DACL tests; fix README drift by @wiresock in #102
  • Gate Windows DACL tests on harden failure; tighten domain validation; doc ACL grammar by @wiresock in #103
  • Validate config hostnames; require the Windows DACL tests in CI by @wiresock in #104
  • Validate tls.acme.domains against TLS-ALPN-01 issuability by @wiresock in #105
  • Reject special-use TLDs for ACME; document the grammar by @wiresock in #106
  • Scope the ACME validation docs to what --check checks; fix the .alt RFC by @wiresock in #107
  • Release 0.3.1 by @wiresock in #108

Full changelog: v0.3.0...v0.3.1

Contributors

wiresock
Assets 6
Loading