wweir 3ea411e5fd fix(transport,pkg): authenticate full sower frame, validate DHCP offers, harden handshakes ...

- The sower frame checksum now covers the command and port in addition to
  the target, using HMAC-SHA256 (length-extension resistant) so a
  man-in-the-middle on a plaintext link cannot retarget a captured frame
  to an arbitrary port.
- Unwrap rejects empty or control-character target hosts.
- The SOCKS5 server writes the RFC 1928 METHOD=0xFF failure response
  instead of leaving the peer hanging on an unusable negotiation.
- DHCP discovery validates the reply (matching xid, BOOTREPLY, message
  type OFFER) and skips unrelated packets instead of trusting the first
  datagram, closing a LAN-side DNS-hijack vector; the socket also sets
  SO_BROADCAST explicitly (Go 1.26 removed UDPConn.SetBroadcast).
- The uTLS handshake gets a bounded default deadline when the dialer has
  no timeout, so it cannot hang open forever.
- The suffix tree trims every trailing dot so dirty rule files cannot
  build unreachable empty-label subtrees.

2026-08-12 17:26:26 +08:00

..

suffix_tree_internal_test.go

perf: batch byte accounting and bound gateway memory

2026-08-07 12:02:26 +08:00

suffix_tree_test.go

feat(router): report matched rule text for hit tracking

2026-08-09 19:02:18 +08:00

suffix_tree.go

fix(transport,pkg): authenticate full sower frame, validate DHCP offers, harden handshakes

2026-08-12 17:26:26 +08:00

util.go

feat: optimize code with 1.18 generic

2022-05-01 22:53:51 +08:00