sower

mirror of https://github.com/wweir/sower.git synced 2026-10-20 08:16:35 +00:00

Files

T

wweir 8db5288365 fix(sower): resolve the self-target check through the upstream resolvers

v1.7.4 asked the system resolver and was wrong on a deployed client: this
client's own DNS answers its serve address for every domain it proxies (that
is how its clients are steered into it), so "the name resolves to one of my
listeners" is true for every normally proxied domain. In the field that
refused legitimate traffic (SOCKS5 google answered code 2 not-allowed).

The recursion discriminator has to be the name's own record, i.e. what the
relay will act on, so the guard now resolves through the configured upstreams
(which already exclude this client's serve addresses) and caches the answer,
including an empty one, for a minute. Verified against a fake upstream in
tests: a name the upstream points at this client is refused, one it resolves
remotely is proxied.

docs/plans/2026-10-12-self-proxy-target-guard.md records the regression, the
rollback and the deploy pitfall (cat > file leaves 0644, so cp -a installed a
non-executable binary and procd could not start the service).

2026-10-12 20:11:34 +08:00

2026-09-18-sowerd-antiprobe-hardening.md

docs: security model for the sowerd edge; document the unknown-SNI cert fallback

2026-09-18 18:05:02 +08:00

2026-10-12-self-proxy-target-guard.md

fix(sower): resolve the self-target check through the upstream resolvers

2026-10-12 20:11:34 +08:00

2026-10-12-sowerd-connection-bounds.md

docs(plans): record the recursion driver and the v1.7.3 rollout

2026-10-12 19:18:53 +08:00

admin-console.md

docs: trim the completed plans and record the sowerd rejected directions