wg-relay hardening: shape filter, MAC1, automatic roaming, blocklist#19

Merged

KRuskowski merged 13 commits into

wg-relay-hardening

Apr 29, 2026

Commits on Apr 29, 2026

wg-relay: drop non-WG-shaped packets at XDP
KRuskowski
committed
wg-relay: verify MAC1 on handshakes against partner pubkey
KRuskowski
committed
wg-relay: automatic roaming via MAC1 + tentative-then-confirm
KRuskowski
committed
wg-relay: dynamic source-IP blocklist on failed-confirm strikes
KRuskowski
committed
release-prep: 0.2.1 — version bump, CHANGELOG, release notes, blake2s tests
KRuskowski
committed
wg-relay: sweep on idle + don't refresh contested candidate slot
KRuskowski
committed
wg-relay: confirm candidate only after partner-attributable response
KRuskowski
committed
wg-relay: refresh candidate sender_index on same-source retry
KRuskowski
committed
wg-relay: drop type-2 from unknown src + rate-limit retry forwards
KRuskowski
committed
wg-relay: sweep stale strike entries during candidate expiry
KRuskowski
committed
CHANGELOG: extend 0.2.1 wg-relay hardening with fuzz fixes
KRuskowski
committed
CHANGELOG: unwrap fuzz-hardening bullets
KRuskowski
committed
wg-relay: split if-clause body across lines for cpplint
KRuskowski
committed