Authenticated reachability: endpoint roaming (M2) + signed rendezvous registration (#37)#100

Merged

vxfemboy merged 16 commits into

mainfrom

feat/authenticated-reachability-37-m2

Jul 25, 2026

Commits on Jul 23, 2026

docs(auth-reachability): design spec — signed rendezvous registration (#37) + endpoint roaming (M2)
vxfemboy
committed
docs(auth-reachability): implementation plans — M2 endpoint roaming + #37 signed registration
vxfemboy
committed

Commits on Jul 24, 2026

feat(roaming.m2): endpoint follows an authenticated, non-replayed inbound packet
vxfemboy
committed
feat(roaming.m2): deobf_ingress trials session keys so a roamed peer's data is found
vxfemboy
committed
feat(roaming.m2): egress follows the roam — update DataPlane peer_addr on relearn
vxfemboy
committed
test(roaming.m2): netns — mid-session NAT rebind recovers on the obf path
vxfemboy
committed
fix(roaming.m2): redirect an in-flight rekey's target on roam (review Important)
vxfemboy
committed
feat(rdv.37): RegisterSigned message + optional PeerInfo.record (codec)
vxfemboy
committed
feat(rdv.37): rooted server verifies RegisterSigned, drops unsigned; PeerInfo carries the record
vxfemboy
committed
feat(rdv.37): server --roots/--network-id enable mesh-mode signed registration
vxfemboy
committed
feat(membership.37): sign_registration + verify_record accessors
vxfemboy
committed
feat(rdv.37): client sends RegisterSigned + verifies PeerInfo.record before probing
vxfemboy
committed
fix(rdv.37): bind PeerInfo.record to the resolved node before probing (review Minor)
vxfemboy
committed
test(rdv.37): netns — forged registration refused, victim stays reachable
vxfemboy
committed

Commits on Jul 25, 2026