Repository navigation

[codex] Harden DDoS protection controls - #2

Merged

CuriosityOS merged 31 commits into

mainfrom

Codex-Hardening

Jun 25, 2026

Merged

[codex] Harden DDoS protection controls#2
CuriosityOS merged 31 commits into
mainfrom
Codex-Hardening

Commits on Jun 25, 2026
- Mark legacy defense benchmark artifacts historical
  Codex
  committed
  1a6c6cb
- Bound TCP relay activity notifications
  Codex
  committed
  11e4366
- Prune stale filter activation state
  Codex
  committed
  303fd82
- Enforce recorded local benchmark probes
  Codex
  committed
  cd8f175
- Enforce edge packet benchmark guardrails
  Codex
  committed
  b5abddc
- Enforce admin control-plane rate guards
  Codex
  committed
  995fa6d
- Enforce resource startup benchmark guards
  Codex
  committed
  994217b
- Enforce trusted client benchmark guards
  Codex
  committed
  5f2ab41
- Enforce HTTP admission benchmark guards
  Codex
  committed
  86bd5bd
- Enforce rate response benchmark guards
  Codex
  committed
  fe7b40d
- Enforce remaining benchmark observations
  Codex
  committed
  0d33b26
- Improve local benchmark startup diagnostics
  Codex
  committed
  b1ea07e
- Honor whitespace in content length guards
  Codex
  committed
  70eeb86
- Tighten host allowlist authority matching
  Codex
  committed
  9d03da4
- Reject merged filter rule id collisions
  Codex
  committed
  5b69f0e
- Inspect duplicate header values in filters
  Codex
  committed
  fe5991c
- Harden request signature fingerprints
  Codex
  committed
  5f9866e
- Validate learned filter signatures
  Codex
  committed
  efd8029
- Reject non-literal custom client IP headers
  Codex
  committed
  be33fa1
- Parse hop-by-hop headers from bytes
  Codex
  committed
  38de36c
- Bound empty transfer encoding elements
  Codex
  committed
  b47d326
- Validate raw initial header names
  Codex
  committed
  6117870
- Validate upstream response framing
  Codex
  committed
  c23d379
- Validate filter rule header ids
  Codex
  committed
  e94b4ca
- Deconflict learned filter IDs
  Codex
  committed
  1059270
- Sanitize learned filter matchers
  Codex
  committed
  b5dfe39
- Run nftables template validation with sudo in CI
  Codex
  committed
  380b142
- Address PR hardening review findings
  Codex
  committed
  5c94af2
- Accept canonical nft flag output in edge smoke
  Codex
  committed
  f61b1c4
- Keep local benchmark edge validation unprivileged
  Codex
  committed
  8813497
- Normalize edge smoke nft output checks
  Codex
  committed
  954af28

Commits

Commits on Jun 25, 2026