Skip to content

Proxy service hardening: RFC compliance, SSRF protection, streaming pipeline, WebSocket support #139

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jbarwick wants to merge 26 commits into
base: master
Choose a base branch
from
Open

Proxy service hardening: RFC compliance, SSRF protection, streaming pipeline, WebSocket support #139

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
1edb530
Fix DNS server concurrency bug and add TCP support
jbarwick Feb 7, 2026
2846822
Fix concurrent query blocking and IPv6 resolver support
jbarwick Feb 7, 2026
1d5bb69
Use net.JoinHostPort for bindAddr to support IPv6 listen addresses
jbarwick Feb 7, 2026
cc609f8
Fix data race: move len(internalRecords) inside RLock section
jbarwick Feb 7, 2026
646f811
Fix data race: use atomic.Bool for serverRunning flag
jbarwick Feb 7, 2026
a6ab3ed
Add shebang and set -euo pipefail to build.sh
jbarwick Feb 7, 2026
434e76d
Add cross-platform support to dns_deep_test.sh
jbarwick Feb 7, 2026
b01e72d
Forward TCP queries via TCP and retry truncated UDP responses over TCP
jbarwick Feb 7, 2026
9f4e508
Fix silent request drops, test script lockups, and false test failures
jbarwick Feb 7, 2026
a5982af
feat: device discovery foundation — data model, record store, and 30 …
jbarwick Feb 8, 2026
f3421c0
docs: add parental controls design considerations to device store (#1)
jbarwick Feb 8, 2026
feb1353
feat: wire device store into DNS handler with passive discovery (#1)
jbarwick Feb 8, 2026
5c5c986
Phase 3: mDNS/Bonjour browser + multi-zone DNS support
jbarwick Feb 8, 2026
83c091e
Phase 4: RFC 2136 Dynamic DNS UPDATE handler
jbarwick Feb 8, 2026
5e17065
feat: configurable base path, Docker deployment, admin port consolida…
jbarwick Feb 8, 2026
947d206
feat: Phase 6 — Devices page, API endpoints, dev tooling fixes
jbarwick Feb 9, 2026
3224cff
feat: add Docker Hub publish script and repository README
jbarwick Feb 9, 2026
7a6882a
Phase 1: Response header sanitization & proxy hardening
jbarwick Feb 10, 2026
d16ef77
Phase 2: DNS wiring & SSRF hardening
jbarwick Feb 10, 2026
cf2a2e3
Phase 3: Streaming response pipeline — 3-path content router
jbarwick Feb 10, 2026
1e1db94
Tune MaxContentScanSize: 10MB→2MB default, add GS_MAX_SCAN_SIZE_MB en…
jbarwick Feb 10, 2026
a61b25c
Phase 4: WebSocket tunnel, DNS cache, NXDOMAIN fix
jbarwick Feb 10, 2026
f45eb03
Phase 5: Content scanning hardening — Via/gzip fix, TRACE block, dead…
jbarwick Feb 10, 2026
04aef53
Remove dead legacy proxy code (application/proxy/)
jbarwick Feb 10, 2026
8f318e2
Fix typos in plan document executive summary
jbarwick Feb 10, 2026
b5c7f88
Address PR review: remove secrets, fix portability, harden code
jbarwick Feb 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .dockerignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
# Only bin/ and Dockerfile are needed for the Docker build context.
# Exclude everything else.

*
!bin/gatesentrybin
!Dockerfile
17 changes: 17 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,3 +3,20 @@ log.txt
docker_root
test-binaries
pr-binaries
dns_test_server.log
ui/.yarn/
ui/dist/

# Frontend build artifacts (generated by build.sh, embedded via //go:embed)
application/webserver/frontend/files/*
!application/webserver/frontend/files/.gitkeep

# Ephemeral test certificates — generated by tests/fixtures/gen_test_certs.sh
tests/fixtures/JVJCA.crt
tests/fixtures/JVJCA.key
tests/fixtures/httpbin.org.crt
tests/fixtures/httpbin.org.key
tests/fixtures/*:Zone.Identifier

# Test run artifacts
tests/proxy_benchmark_results.log
694 changes: 694 additions & 0 deletions DEVICE_DISCOVERY_SERVICE_PLAN.md
View file
Open in desktop

Large diffs are not rendered by default.

Loading