git.iko.soy/skrepka
on master help sign in
history ofserver.knot
all commits
850d68dsecurity audit fixes: 35 findings across core, shell, server, specLancelot ee54351Security audit 13th pass: fix 23 findings across crypto, server, clientLancelot 3258116Security: add AAD to AEAD (v0x02), fix livelock, bound dedup, cap gossip amplificationiko 11c24d8Security audit fixes: Q16 cursor poisoning, Q17 ack ordering, Q18 persistent seen_ids, Q25 malformed JSON, Q35 revokeOthers challenges, Q37 sig inside atomic, Q38 audit log, Q49 low-order X25519 check, spec gaps Q39-Q44, §10 risk table updatesLancelot da51700Security audit Q1-Q9: zstd window cap, poll event/body caps, cursor clamp, verify_strict, TEST-NET-2, cursor watchdog, cached X25519 keys, base64 photo validationLancelot c24f528Seventh-pass audit: zeroize encrypt inner on AEAD failure, fix stale commentsiko 3154319Second-pass audit: fix regressions from first passiko f04d81bAudit: implement all 18 findings from protocol/codebase reviewiko c28cf14Swift: disable HTTP redirect following; server/protocol: document timing side-channel and key rotation future extensioniko b0ffcd8Add length padding to encrypted blobsiko c89ed87server.knot: fix orphaned forwards bug + 10 simplificationsiko e4eeb27server.knot: fix 4 bugs + 22 simplifications from auditiko 8d304b5server.knot: remove duplicate pruneExpired block commentiko 9118bb4server.knot: saturate decimalValueGo accumulator to prevent i64 overflow paniciko 254f6a0server.knot: document Knot compiler hang on beforeChar consolidationiko 5477c47Comprehensive bug fix pass: crypto, state machine, FFI, server, Apple shelliko 9558212Fix server.knot type mismatches: keep PubkeyHex on route-boundary typesiko df3fc05Simplify server.knot: remove workarounds for fixed Knot compiler issuesiko 199ec3ePin Knot compiler to 2026.6.26.1947 (last working release)iko c0c3f64Fix main: use type variable a (like backgroundPrune) to match listenOn's IO typeiko d93928fFix main: bind listenOn, use let with explicit {} type as final pure valueiko 191f599Fix main: concrete effect row, listenOn as final IO expression (matching backgroundPrune pattern)iko 8b28231Fix main: explicit effect row, _ <- listenOn, {} as final pure valueiko 5a73090Fix main: IO {| r} {} annotation, listenOn as final bare expressioniko 997b9d0Fix main: bind listenOn with _ <- too, yield {} as final IO valueiko 0ac92a3Fix main: all statements as _ <- binds except final listenOniko 73e8ac0Fix main: first statement as IO bind to force IO do-block inferenceiko 4b6f751Fix main: bind listenOn with _ <- and yield {} for IO do-blockiko 918e789Fix main: add yield {} after listenOn for IO do-block typeiko 533de35Fix last server.knot compilation errors: refined-type comparisons, main typeiko 92c8058Fix remaining server.knot compilation errorsiko 4bfde3dFix server.knot compilation errors for stricter Knot compileriko 362399cFix round-2 audit findings: blocked acks, ts clamping, key validation, docsiko affb421Fix all 16 audit findings: outbox stall, deploy auth, panics, security, docsiko ec51d84Fix auth session relay attack by binding challenge signature to target server hostname2026.06.23.0618iko dbba2b3Fix 2 bugs: octal/leading-zero IPv4 SSRF, unvalidated gossip pubkeyiko e1c294aFix 4 bugs: seqCounter empty-database panic, /messages input validation, forward batch determinism, resend skip delivered peersiko 0621b04Fix 3 bugs: send-path dedup, cursor clamp re-delivery, SSRF range gapsiko c731185Fix 5 bugs: GossipEvent record JSON/forward-compat, HTTP body cap, SSRF dword-IP bypass, session IP bindingiko e3237ebUpdate deliveredTo references after wrapping scalar in record typeiko 1a32dc0Fix bug #18: enforce maxForwardsPerServer on the send pathiko 916b7a3Fix bug #17: enforce isBadServerName at federation egressiko fbf23aaFix bug #16: block localhost-with-port in isBadServerNameiko ae2c0acFix bug #15: block RFC1918 172.16.0.0/12 in isBadServerNameiko 3539159Fix bug #14: order recordFailure/clearFailure by attempt start timeiko b16dd69Fix bug #13: key /poll and /messages rate limits on client IP, not beareriko 23efe28Fix bug #12: key IP rate-limit buckets on X-Forwarded-For behind a proxyiko dbd7f47Fix bug #19: text length checks used count (chars s), which dedupesiko a426743Fix bug #11: refuse inbound federation requests when federationEnabled is offiko 8ab1465Fix bug #10: dedupe inbound federated forwards in handleForwardMessageiko