mirror of
https://github.com/getpaseo/paseo.git
synced 2026-10-23 09:42:53 +00:00
Mohamed Boudra
eaf38b6eb2
Relay channel: - Validate a record header against the bytes received before allocating the assembly buffer. - Client record failures close with 4003 (browser-safe) instead of 1011, which a browser WebSocket.close rejects and leaves the socket open. - A present but malformed protected ready fails the handshake instead of falling through to a later legacy ready. - A hello buffered while the ready send is in flight is answered: an identical retry gets the same ready, a changed hello closes 1008. - Cipher-state nonce exhaustion is tested in both directions. Client: - DaemonClient and the Node host connector raise their endpoint security floor to protected once a daemon negotiates it, so a reconnect cannot be answered in legacy mode. - The relay E2EE transport reports a channel-decided close synchronously and no longer forwards channel errors ahead of it; the client was reconnecting on the error before it saw the 4002 close. - Module-mocked transport tests are replaced with real secure-channel tests through an in-memory link and a real ws server. App: - The protected pin belongs to the daemon identity: every relay route to the same key is pinned, and a new relay address for a pinned key inherits the pin. Docs: relay URI parameter is security=protected; enabling the flag protects new admissions only, so restart or disconnect sessions to finish enforcement; SECURITY.md scopes confidentiality, forgery and replay claims per mode.