 zeekay
|
2ba428c21b
|
fix(forward+node): canonical HTTP-over-ZAP security hardening (v0.8.8)
V4 CRITICAL: forward.handle no longer panics on hostile method/path
(validForwardLine→400 + http.NewRequestWithContext); node.safeHandle adds a
recover() boundary across all 5 dispatch sites (TCP dispatchLoop x2,
getOrConnect, QUIC handleCallStream + invokeHandlerOneWay) — a handler panic
drops one conn, never crashes the node. Proven on TCP+QUIC.
V2 HIGH: forward/identity.go single-source strip set (superset of base's
StripIdentityHeaders + Cookie drop + X-Gateway-* sweep), applied on BOTH legs
(serve.go backend + client.go gateway); Authorization preserved.
V6: SSE responses → 501 (buffered-stream guard).
+ consolidation: zap_crosswire_test.go proves byte-identical wire vs zap-proto/go;
MIGRATION.md roadmap.
Red-reviewed SHIP (0 crit/high/med). Zero exported-API change — source-compatible.
|
2026-06-18 13:39:56 -07:00 |
|
|
zeekay
|
6dd965f755
|
feat(forward): canonical HTTP-over-ZAP contract (Forward/Response/Push + Serve/Relay/Forwarder)
HIP-0110 single source of truth for the ingress→gateway→service ZAP path.
- Forward (identity+req), Response (status/body/headers), Push (SSE stream)
- Serve: backend terminal (ZAP→http.Handler, identity injected as X-* headers)
- Relay: gateway ZAP→ZAP (envelope-only auth/billing Gate, body never deserialized)
- Forwarder: ingress HTTP→ZAP client (http.RoundTripper)
- Fixes the 8-byte Object slot encoding (zap_backend.go's 4-byte offsets overlapped)
14 tests, race-clean, CGO_ENABLED=0.
|
2026-06-18 11:16:25 -07:00 |
|