Commits

Commit history

1. Commits on Oct 8, 2026

   • fix(demo): address review findings on knock-port rollout

     Show description for 874e15a
     fengyily

     committed
     874e15aView commit details

     Copy full SHA for 874e15a

     View code at this pointBrowse repository at this point

   • fix(demo): harden NHP knock port handling and rollback

     Show description for b9839a4
     fengyily

     committed
     b9839a4View commit details

     Copy full SHA for b9839a4

     View code at this pointBrowse repository at this point

   • docs: sync NHP knock port references to udp/443

     Show description for dd1c1ee
     fengyily

     committed
     dd1c1eeView commit details

     Copy full SHA for dd1c1ee

     View code at this pointBrowse repository at this point

   • userdata(server.sh): allow ec2-user to bind udp/443 via sysctl

     Show description for 0411480
     fengyily

     committed
     0411480View commit details

     Copy full SHA for 0411480

     View code at this pointBrowse repository at this point

   • demo deploy: switch NHP knock port to udp/443 (source + workflow wiring)

     Show description for 82717ab
     fengyily

     committed
     82717abView commit details

     Copy full SHA for 82717ab

     View code at this pointBrowse repository at this point
2. Commits on Oct 4, 2026

   • Merge origin/main into fix/req_cd0ae0b016dfed9c

     Show description for 02499b3
     fengyily

     committed
     02499b3View commit details

     Copy full SHA for 02499b3

     View code at this pointBrowse repository at this point

   • fix(ci): stop the terraform wrapper's error annotation from posing as an output

     Show description for ba30a4c
     fengyily

     committed
     ba30a4cView commit details

     Copy full SHA for ba30a4c

     View code at this pointBrowse repository at this point

   • fix(ci): build the demo daemons on the hosts' glibc, not the runner's

     Show description for 07b465e
     fengyily

     committed
     07b465eView commit details

     Copy full SHA for 07b465e

     View code at this pointBrowse repository at this point

   • fix(ci): never delete the demo.nhp cert on a failed stealth_ca_enabled read

     Show description for 7c03190
     fengyily

     committed
     7c03190View commit details

     Copy full SHA for 7c03190

     View code at this pointBrowse repository at this point

   • fix(ci): stop the terraform wrapper's error annotation from posing as an output

     Show description for ca67c13
     fengyily

     committed
     ca67c13View commit details

     Copy full SHA for ca67c13

     View code at this pointBrowse repository at this point

   • fix(server): give back only the loader's three capabilities

     Show description for 7e81e2d
     fengyily

     committed
     7e81e2dView commit details

     Copy full SHA for 7e81e2d

     View code at this pointBrowse repository at this point

   • fix(ebpf): drop the loader's capabilities on the failed-load path too

     Show description for 17e6d3d
     fengyily

     committed
     17e6d3dView commit details

     Copy full SHA for 17e6d3d

     View code at this pointBrowse repository at this point

   • fix(server): drop the XDP loader's capabilities and bound the event log

     Show description for eb54fd0
     fengyily

     committed
     eb54fd0View commit details

     Copy full SHA for eb54fd0

     View code at this pointBrowse repository at this point

   • fix(server): install the XDP relay whitelist before attaching the filter

     Show description for 671ad77
     fengyily

     committed
     671ad77View commit details

     Copy full SHA for 671ad77

     View code at this pointBrowse repository at this point
3. Commits on Sep 30, 2026

   • fix(server): close the XDP filter's IPv6 and fragment holes

     Show description for c2ad64d
     fengyily

     committed
     c2ad64dView commit details

     Copy full SHA for c2ad64d

     View code at this pointBrowse repository at this point

   • fix(server): refuse an XDP whitelist that reaches the kernel empty

     Show description for 19a4c28
     fengyily

     committed
     19a4c28View commit details

     Copy full SHA for 19a4c28

     View code at this pointBrowse repository at this point
4. Commits on Sep 29, 2026

   • fix(demo): whitelist the VPC subnet so a replaced relay keeps SSH in

     Show description for dbf510b
     fengyily

     committed
     dbf510bView commit details

     Copy full SHA for dbf510b

     View code at this pointBrowse repository at this point

   • fix(server): let the XDP filter pass DHCP and NTP replies

     Show description for 0320932
     fengyily

     committed
     0320932View commit details

     Copy full SHA for 0320932

     View code at this pointBrowse repository at this point

   • fix(server): bound the XDP event log instead of writing a line per packet

     Show description for 98cf27f
     fengyily

     committed
     98cf27fView commit details

     Copy full SHA for 98cf27f

     View code at this pointBrowse repository at this point

   • fix(server): let the XDP filter pass replies to the host's own flows

     Show description for da4c040
     fengyily

     committed
     da4c040View commit details

     Copy full SHA for da4c040

     View code at this pointBrowse repository at this point

   • fix(ci): whitelist the relay private address in the server XDP filter

     Show description for 339aa02
     fengyily

     committed
     339aa02View commit details

     Copy full SHA for 339aa02

     View code at this pointBrowse repository at this point

   • fix(ci): resolve the relay whitelist address from DOMAIN_RELAY

     Show description for 6bff2ad
     fengyily

     committed
     6bff2adView commit details

     Copy full SHA for 6bff2ad

     View code at this pointBrowse repository at this point

   • docs(demo): add a verification procedure for the server XDP filter

     Show description for 301cc52
     fengyily

     committed
     301cc52View commit details

     Copy full SHA for 301cc52

     View code at this pointBrowse repository at this point

   • feat(server): filter nhp-server ingress traffic with eBPF/XDP

     Show description for 5198df0
     fengyily

     committed
     5198df0View commit details

     Copy full SHA for 5198df0

     View code at this pointBrowse repository at this point
5. Commits on Sep 28, 2026

   • Let the AC's own client flows outrank a knock from the same address

     Show description for bb6a220
     fengyily

     committed
     bb6a220View commit details

     Copy full SHA for bb6a220

     View code at this pointBrowse repository at this point

   • Delete the egress entry a knock_peers record blocks, and keep the lookup off the hot path

     Show description for aa564a6
     fengyily

     committed
     aa564a6View commit details

     Copy full SHA for aa564a6

     View code at this pointBrowse repository at this point

   • Keep the UDP egress gate shut once the knock has expired

     Show description for 89010f6
     fengyily

     committed
     89010f6View commit details

     Copy full SHA for 89010f6

     View code at this pointBrowse repository at this point

   • Stop a spoofed RST or FIN from permanently cutting a session's window

     Show description for 1fdc80d
     fengyily

     committed
     1fdc80dView commit details

     Copy full SHA for 1fdc80d

     View code at this pointBrowse repository at this point

   • Bind non-TCP knock admission to the knock, and stop RST from cutting flows

     Show description for f3bd7c2
     fengyily

     committed
     f3bd7c2View commit details

     Copy full SHA for f3bd7c2

     View code at this pointBrowse repository at this point

   • Keep the AC's own channel to the nhp-server answerable

     Show description for 80e30cb
     fengyily

     committed
     80e30cbView commit details

     Copy full SHA for 80e30cb

     View code at this pointBrowse repository at this point

   • Close the UDP egress hole and stop cutting established sessions

     Show description for 19bbbbd
     fengyily

     committed
     19bbbbdView commit details

     Copy full SHA for 19bbbbd

     View code at this pointBrowse repository at this point
6. Commits on Sep 24, 2026

   • Stop a userdata edit from bouncing the long-lived demo AC

     Show description for e01b47f
     fengyily

     committed
     e01b47fView commit details

     Copy full SHA for e01b47f

     View code at this pointBrowse repository at this point

   • Pin the AC boot kernel and stop a crash loop from bricking the unit

     Show description for b786846
     fengyily

     committed
     b786846View commit details

     Copy full SHA for b786846

     View code at this pointBrowse repository at this point

   • Upgrade the AC kernel from the deploy instead of failing on it

     Show description for 6e420ea
     fengyily

     committed
     6e420eaView commit details

     Copy full SHA for 6e420ea

     View code at this pointBrowse repository at this point
7. Commits on Sep 23, 2026

   • Verify the AC deploy against the daemon's own log and shrink its caps

     Show description for e5df4b2
     fengyily

     committed
     e5df4b2View commit details

     Copy full SHA for e5df4b2

     View code at this pointBrowse repository at this point