mirror of https://github.com/wweir/sower.git synced 2026-10-20 08:16:35 +00:00

Files

T

wweir 8db5288365 fix(sower): resolve the self-target check through the upstream resolvers

v1.7.4 asked the system resolver and was wrong on a deployed client: this
client's own DNS answers its serve address for every domain it proxies (that
is how its clients are steered into it), so "the name resolves to one of my
listeners" is true for every normally proxied domain. In the field that
refused legitimate traffic (SOCKS5 google answered code 2 not-allowed).

The recursion discriminator has to be the name's own record, i.e. what the
relay will act on, so the guard now resolves through the configured upstreams
(which already exclude this client's serve addresses) and caches the answer,
including an empty one, for a minute. Verified against a fake upstream in
tests: a name the upstream points at this client is refused, one it resolves
remotely is proxied.

docs/plans/2026-10-12-self-proxy-target-guard.md records the regression, the
rollback and the deploy pitfall (cat > file leaves 0644, so cp -a installed a
non-executable binary and procd could not start the service).

2026-10-12 20:11:34 +08:00

plans

fix(sower): resolve the self-target check through the upstream resolvers

2026-10-12 20:11:34 +08:00

README.md

docs: security model for the sowerd edge; document the unknown-SNI cert fallback

2026-09-18 18:05:02 +08:00

security.md

fix(sowerd): give the service a soft heap ceiling on every install path

2026-10-12 17:58:08 +08:00

README.md

Documentation Index

This directory contains long-lived design documents. Per AGENTS.md rules:

docs/ root holds only finalized, authoritative design documents (product, architecture, protocol, security, deployment, data model, test strategy, etc.).
docs/plans/ holds draft proposals and in-progress implementation plans — not authoritative.
docs/reviews/ holds review records, issue lists, and retrospective summaries — not authoritative.

When a plan or review produces a durable rule, it must be written back to the relevant root-level design document and referenced from this index.

Cross-document references must point to root-level design documents only. Never reference protocol, field, security, or deployment rules from plans/ or reviews/.

Root-Level Documents

Document	Description
ARCHITECTURE.md	System boundary, layer responsibilities, data flows, design decisions
security.md	sowerd edge threat model, anti-probing layers, unknown-SNI certificate fallback, rejected directions

Plans

Historical plans live under docs/plans/ and are not authoritative. Durable rules from completed plans are reflected only in the root-level documents listed above.

Reviews

No reviews yet.