Security/robustness hardening: handshake verification, message-size bounds, TLS IP SANs, mask entropy, liveness - #7

Merged

amigniter merged 10 commits into

amigniter:mainfrom

voicetel:fix/security-hardening

Sep 10, 2026

Commits on Jul 2, 2026

fix: verify Sec-WebSocket-Accept against computed value
mavroudis
committed
ef2298b
fix: bound permessage-deflate output (decompression bomb)
mavroudis
committed
ef32bb2
fix: bound single-frame and reassembled message size
mavroudis
committed
07dc1cb
fix: seed frame-mask PRNG from a strong entropy source
mavroudis
committed
82edf7b
fix: bound pre-upgrade handshake response size
mavroudis
committed
2d282c1
fix: reject RSV1 on control and continuation frames
mavroudis
committed
666ea08
fix: verify IP-literal TLS endpoints against iPAddress SANs
mavroudis
committed
d113768
fix: strip CR/LF from configured URI/host/headers in handshake
mavroudis
committed
7d8d07d
fix: detect half-open peer via ping/pong liveness timeout
mavroudis
committed
33aa144

Commits on Sep 10, 2026

Harden PR #7 security fixes
amigniter
committed
efbab3c